From a83627b9da2865cf59af4110d11f52129e3103f2 Mon Sep 17 00:00:00 2001
From: Alexander Nachtmann <anfh22@outlook.com>
Date: Sun, 22 Mar 2026 16:17:57 +0100
Subject: [PATCH] fix: require opt-in for automatic npm restore

---
 src/Build/Common/Npm.targets        |  2 +-
 tests/ANcpLua.Sdk.Tests/SdkTests.cs | 43 +++++++++++++++++++++++++----
 2 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/src/Build/Common/Npm.targets b/src/Build/Common/Npm.targets
index 30ab244..ca26266 100644
--- a/src/Build/Common/Npm.targets
+++ b/src/Build/Common/Npm.targets
@@ -1,7 +1,7 @@
 <Project>
 
   <ItemGroup>
-    <NpmPackageFile Condition="'$(EnableDefaultNpmPackageFile)' == '' AND Exists('$(MSBuildProjectDirectory)/package.json')" Include="$(MSBuildProjectDirectory)/package.json"/>
+    <NpmPackageFile Condition="'$(EnableDefaultNpmPackageFile)' == 'true' AND Exists('$(MSBuildProjectDirectory)/package.json')" Include="$(MSBuildProjectDirectory)/package.json"/>
   </ItemGroup>
 
   <!-- Compute additional metadata for the NpmPackageFile items -->
diff --git a/tests/ANcpLua.Sdk.Tests/SdkTests.cs b/tests/ANcpLua.Sdk.Tests/SdkTests.cs
index 9beaa25..e847571 100644
--- a/tests/ANcpLua.Sdk.Tests/SdkTests.cs
+++ b/tests/ANcpLua.Sdk.Tests/SdkTests.cs
@@ -1002,7 +1002,8 @@ public async Task SetTargetFramework(string propName, string version)
     [Fact]
     public async Task NpmInstall()
     {
-        await using var project = CreateProject(SdkWebName);
+        await using var project = CreateProject(SdkWebName)
+            .WithProperty("EnableDefaultNpmPackageFile", "true");
 
         project.AddFile("package.json", """
             {
@@ -1029,7 +1030,8 @@ public async Task NpmInstall()
     [Fact]
     public async Task NpmRestore()
     {
-        await using var project = CreateProject(SdkWebName);
+        await using var project = CreateProject(SdkWebName)
+            .WithProperty("EnableDefaultNpmPackageFile", "true");
 
         project.AddFile("package.json", """
             {
@@ -1052,10 +1054,36 @@ public async Task NpmRestore()
     }
 
     [Fact]
-    public async Task Npm_Dotnet_Build_sln()
+    public async Task NpmRestore_DefaultAutoDetectionDisabled()
     {
         await using var project = CreateProject(SdkWebName);
 
+        project.AddFile("package.json", """
+            {
+              "name": "sample",
+              "version": "1.0.0",
+              "private": true,
+              "devDependencies": {
+                "is-number": "7.0.0"
+              }
+            }
+            """);
+
+        var result = await project
+            .AddSource("Program.cs", "Console.WriteLine();")
+            .RestoreAsync();
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.False(File.Exists(project.RootFolder / "package-lock.json"));
+        Assert.False(File.Exists(project.RootFolder / "node_modules" / ".npm-install-stamp"));
+    }
+
+    [Fact]
+    public async Task Npm_Dotnet_Build_sln()
+    {
+        await using var project = CreateProject(SdkWebName)
+            .WithProperty("EnableDefaultNpmPackageFile", "true");
+
         var slnFile = project.AddFile("sample.slnx", """
             <Solution>
                 <Project Path="sample.csproj" />
@@ -1087,7 +1115,8 @@ public async Task Npm_Dotnet_Build_sln()
     [InlineData("publish")]
     public async Task Npm_Dotnet_sln(string command)
     {
-        await using var project = CreateProject(SdkWebName);
+        await using var project = CreateProject(SdkWebName)
+            .WithProperty("EnableDefaultNpmPackageFile", "true");
 
         var slnFile = project.AddFile("sample.slnx", """
             <Solution>
@@ -1170,7 +1199,8 @@ public async Task NpmRestore_MultipleFiles()
     [Fact]
     public async Task Npm_Dotnet_Build_RestoreLockedMode_Fail()
     {
-        await using var project = CreateProject(SdkWebName);
+        await using var project = CreateProject(SdkWebName)
+            .WithProperty("EnableDefaultNpmPackageFile", "true");
 
         project.AddFile("package.json", """
             {
@@ -1195,7 +1225,8 @@ public async Task Npm_Dotnet_Build_RestoreLockedMode_Fail()
     [InlineData("/p:ContinuousIntegrationBuild=true")]
     public async Task Npm_Dotnet_Build_Ci_Success(string command)
     {
-        await using var project = CreateProject(SdkWebName);
+        await using var project = CreateProject(SdkWebName)
+            .WithProperty("EnableDefaultNpmPackageFile", "true");
 
         project.AddFile("package.json", """
             {