From 98283fcd459f699d711ededf8257cde471e0d9cd Mon Sep 17 00:00:00 2001
From: Vivek JM <vivekjm77@gmail.com>
Date: Sat, 16 May 2026 12:09:00 +0530
Subject: [PATCH 1/3] fix(tools-node): limit package dependency search scope

---
 .changeset/curly-needles-rest.md         |  5 ++++
 packages/tools-node/src/package.ts       |  9 +++++-
 packages/tools-node/test/package.test.ts | 36 ++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/curly-needles-rest.md

diff --git a/.changeset/curly-needles-rest.md b/.changeset/curly-needles-rest.md
new file mode 100644
index 0000000000..f64d431a98
--- /dev/null
+++ b/.changeset/curly-needles-rest.md
@@ -0,0 +1,5 @@
+---
+"@rnx-kit/tools-node": patch
+---
+
+Add a `stopAt` option to limit `findPackageDependencyDir` searches.
diff --git a/packages/tools-node/src/package.ts b/packages/tools-node/src/package.ts
index f4b572fd8f..a8b3a9505d 100644
--- a/packages/tools-node/src/package.ts
+++ b/packages/tools-node/src/package.ts
@@ -170,6 +170,11 @@ export type FindPackageDependencyOptions = {
    */
   startDir?: string;
 
+  /**
+   * Optional directory where the search should stop.
+   */
+  stopAt?: string;
+
   /**
    * Optional flag controlling whether symlinks can be found. Defaults to `true`.
    * When `false`, and the package dependency directory is a symlink, it will not
@@ -201,10 +206,12 @@ export function findPackageDependencyDir(
 ): string | undefined {
   const pkgName =
     typeof ref === "string" ? ref : path.join(ref.scope ?? "", ref.name);
+  const startDir = options?.startDir ?? process.cwd();
   const packageDir = findUp(
     path.join("node_modules", pkgName),
     {
-      startDir: options?.startDir,
+      startDir,
+      stopAt: options?.stopAt,
       type: "directory",
       allowSymlinks: options?.allowSymlinks,
     },
diff --git a/packages/tools-node/test/package.test.ts b/packages/tools-node/test/package.test.ts
index 74902d25a5..144bd9492b 100644
--- a/packages/tools-node/test/package.test.ts
+++ b/packages/tools-node/test/package.test.ts
@@ -212,4 +212,40 @@ describe("Node > Package", () => {
     );
     equal(pkgDir, undefined);
   });
+
+  it("findPackageDependencyDir() does not search beyond stopAt", () => {
+    const rootDir = path.join(testTempDir, "repo");
+    const workspaceDir = path.join(rootDir, "packages", "app");
+    const externalDir = path.join(testTempDir, "node_modules", "external");
+    const localDir = path.join(
+      rootDir,
+      "packages",
+      "node_modules",
+      "local"
+    );
+    const blockedLocalDir = path.join(rootDir, "node_modules", "blocked");
+
+    fs.mkdirSync(workspaceDir, { recursive: true });
+    fs.mkdirSync(externalDir, { recursive: true });
+    fs.mkdirSync(localDir, { recursive: true });
+    fs.mkdirSync(blockedLocalDir, { recursive: true });
+
+    const blockedPkgDir = findPackageDependencyDir("external", {
+      startDir: workspaceDir,
+      stopAt: rootDir,
+    });
+    equal(blockedPkgDir, undefined);
+
+    const localPkgDir = findPackageDependencyDir("local", {
+      startDir: workspaceDir,
+      stopAt: rootDir,
+    });
+    equal(localPkgDir, localDir);
+
+    const blockedLocalPkgDir = findPackageDependencyDir("blocked", {
+      startDir: workspaceDir,
+      stopAt: rootDir,
+    });
+    equal(blockedLocalPkgDir, undefined);
+  });
 });

From 5918878cd950ff8d5b9b8e91b19fdfa753746538 Mon Sep 17 00:00:00 2001
From: Vivek JM <24496671+vivekjm@users.noreply.github.com>
Date: Tue, 9 Jun 2026 13:23:35 +0530
Subject: [PATCH 2/3] Revert explicit startDir default

---
 packages/tools-node/src/package.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/tools-node/src/package.ts b/packages/tools-node/src/package.ts
index a8b3a9505d..1bcb8e07aa 100644
--- a/packages/tools-node/src/package.ts
+++ b/packages/tools-node/src/package.ts
@@ -206,11 +206,10 @@ export function findPackageDependencyDir(
 ): string | undefined {
   const pkgName =
     typeof ref === "string" ? ref : path.join(ref.scope ?? "", ref.name);
-  const startDir = options?.startDir ?? process.cwd();
   const packageDir = findUp(
     path.join("node_modules", pkgName),
     {
-      startDir,
+      startDir: options?.startDir,
       stopAt: options?.stopAt,
       type: "directory",
       allowSymlinks: options?.allowSymlinks,

From 4d71149b2de6ce3d6296004351ed4d948283ec3a Mon Sep 17 00:00:00 2001
From: Vivek JM <vivekjm77@gmail.com>
Date: Thu, 11 Jun 2026 21:09:39 +0530
Subject: [PATCH 3/3] chore: format tools-node package test

---
 packages/tools-node/test/package.test.ts | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/packages/tools-node/test/package.test.ts b/packages/tools-node/test/package.test.ts
index 144bd9492b..88be449a37 100644
--- a/packages/tools-node/test/package.test.ts
+++ b/packages/tools-node/test/package.test.ts
@@ -217,12 +217,7 @@ describe("Node > Package", () => {
     const rootDir = path.join(testTempDir, "repo");
     const workspaceDir = path.join(rootDir, "packages", "app");
     const externalDir = path.join(testTempDir, "node_modules", "external");
-    const localDir = path.join(
-      rootDir,
-      "packages",
-      "node_modules",
-      "local"
-    );
+    const localDir = path.join(rootDir, "packages", "node_modules", "local");
     const blockedLocalDir = path.join(rootDir, "node_modules", "blocked");
 
     fs.mkdirSync(workspaceDir, { recursive: true });