Framework inference ignores devDependencies in single-package projects

[ysgk]

Verify canary release

• I verified that the issue exists in the latest Turborepo canary release.

Link to code that reproduces this issue

https://github.com/ysgk/turbo-framework-inference-repro

Which canary version will you have in your reproduction?

2.8.12-canary.2

Environment information

• turbo 2.8.12-canary.2
CLI:
   Version: 2.8.12-canary.2
   Path to executable: /private/tmp/turbo-repro/node_modules/turbo-darwin-arm64/bin/turbo
   Daemon status: Not running
   Package manager: npm

Platform:
   Architecture: aarch64
   Operating system: macos
   WSL: false
   Available memory (MB): 6733
   Available CPU cores: 12

Environment:
   CI: None
   Terminal (TERM): xterm-256color
   Terminal program (TERM_PROGRAM): Apple_Terminal
   Terminal program version (TERM_PROGRAM_VERSION): 466
   Shell (SHELL): /bin/zsh
   stdin: false

Expected behavior

In a single-package (non-monorepo) project, frameworks listed in devDependencies (e.g. vite) should be detected by framework inference, and their environment variable wildcards (e.g. VITE_*) should be included in inferred env vars.

Actual behavior

Framework inference does not detect frameworks in devDependencies for single-package projects. turbo build --dry=json shows "framework": "" and "inferred": [], so VITE_* environment variables are not passed to subprocesses in strict mode.

This works correctly in monorepo setups because unresolved_external_dependencies is used, which includes both dependencies and devDependencies.

To Reproduce

1. Clone https://github.com/ysgk/turbo-framework-inference-repro
2. npm install
3. Run: VITE_API_URL=http://localhost:3000 npx turbo build --dry=json | jq '{framework: .tasks[].framework, inferred: .tasks[].environmentVariables.inferred}'
4. Observe: {"framework": "", "inferred": []}
5. Move vite from devDependencies to dependencies in package.json and repeat — framework is now detected correctly.

Additional context

The root cause is in Matcher::test (crates/turborepo-frameworks/src/lib.rs). For single-package projects (is_monorepo: false), it only checks package_json.dependencies, ignoring devDependencies. This affects all frameworks typically installed as devDependencies: Vite, Astro, SvelteKit, Vue CLI, etc.

This was actually flagged during the original PR review (#5746):

"I realize this is just a port of Go behavior, but do we want to also check the other places dependencies could appear? Primarily devDependencies and optionalDependencies"

However, no conclusion was reached and the PR was merged as-is. So this appears to be an oversight carried over from the Go implementation rather than an intentional design decision.