pray-cli 1.14.0 → 1.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc753f65405f7052d882da07b3293b66c69e60cb26b8fe865919000323f2da1a
-  data.tar.gz: 91586f374cc5a677b0f5d2b722a4ba5da5912d8bd3664eac0ccd48b864889c65
+  metadata.gz: 4754a8028d48136e6617f016890123bddb43a4fe27e87a05cc0da63ee5a22106
+  data.tar.gz: 5293f312b5cf2b5adb17d2955b21c447aa7ec1e91b374636b475eef30ad68770
 SHA512:
-  metadata.gz: a84c2945dba3386f31dfdfc08d603ecee88d2be1e9898c20a993cd9dba9149ae4966b9cf9e02ba8c28905b7a1c81e2f5158bdf2eff8b36fe7f470e0bbd82ab6a
-  data.tar.gz: 48f107b5721d69c62b83db0f99247f9c4821eea42f85d3459cac09b7441badc3fa092965f877b1d3ae3fb0d38f391e8f65ae76cc21a6fd1595799dd2de0c6324
+  metadata.gz: 4905aa110a4304e404dfe10e763ec4dee9c30e158659a2390e1af4e9be6aaf07e4cfb909c56023c7c622fdfb4689c250cdb40a632596f4033492bb1cbc7ecdb6
+  data.tar.gz: 59a29e48784dd55363e8c2f63683fccc388029f4dbd18599a44f8efedb6b939e123e7203f96b1bc751edf2dbed8f49f30ca40842b3d13bdb3304a4d2a6e6e129

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # CHANGELOG
 
+## 1.15.0 (2026-09-15)
+
+- Refresh path-fork trees with `pray update` (RFC 0114). Rewrite `spec.upstream` pins with `pray update --latest` when the pin does not admit the latest upstream version. Rewrite Prayfile constraints with `pray update --latest` when they do not admit the registry latest version. `pray update --latest --dry-run` prints the planned rewrite and does not write.
+- Keep `spec.upstream` in the packaged prayspec. Published registry metadata does not copy that pin.
+- Keep a listed package spec in `spec.files` when packing; refuse a repeated or aliased content path in the package archive.
+- Use the current project for a later install after an earlier in-process command in another directory.
+
 ## 1.14.0 (2026-09-14)
 
 - Keep an unchanged package version's artifact, first-publish time, and yank when `pray publish` runs again (RFC 0061).

data/lib/pray/archive.rb

@@ -4,6 +4,7 @@ require "json"
 require "open3"
 require "fileutils"
 require_relative "archive_unpack"
+require_relative "path_safety"
 
 module Pray
   module Archive
@@ -11,14 +12,23 @@ module Pray
 
     def build_package_archive_bytes(package)
       prayspec_path = Resolve.find_prayspec_file(package.root)
-      prayspec_name = File.basename(prayspec_path)
+      prayspec_name = PathSafety.validate_archive_member_path!(File.basename(prayspec_path))
       metadata = package_metadata_json(package)
+      written_paths = Set.new
+      record_archive_path(written_paths, "metadata.json", prayspec_name)
+      record_archive_path(written_paths, prayspec_name, prayspec_name)
+      package.spec.files.each do |file|
+        record_archive_path(written_paths, file, prayspec_name)
+      end
 
       Dir.mktmpdir("pray-package-") do |staging|
         File.write(File.join(staging, "metadata.json"), metadata)
         File.write(File.join(staging, prayspec_name), File.binread(prayspec_path))
         package.spec.files.each do |file|
-          destination = File.join(staging, file)
+          member = PathSafety.validate_archive_member_path!(file)
+          next if member == prayspec_name
+
+          destination = File.join(staging, member)
           FileUtils.mkdir_p(File.dirname(destination))
           File.binwrite(destination, File.binread(File.join(package.root, file)))
         end
@@ -66,5 +76,14 @@ module Pray
     def with_binary_process_encoding(&block)
       ArchiveUnpack.with_binary_process_encoding(&block)
     end
+
+    def record_archive_path(written_paths, path, auto_included_prayspec)
+      normalized = PathSafety.validate_archive_member_path!(path)
+      return if written_paths.add?(normalized)
+      return if normalized == auto_included_prayspec
+
+      raise Error.integrity("duplicate package archive path: #{normalized}")
+    end
+    private_class_method :record_archive_path
   end
 end

data/lib/pray/cli/commands/update_latest.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module Pray
+  module CLI
+    def update_latest_command(package, dry_run:, offline:)
+      path = manifest_path
+      original_text = Pray.read_manifest_text(path)
+      manifest_text = original_text
+      preview_options = ResolveOptions.new(
+        offline: offline,
+        refresh: true,
+        refresh_source_revisions: true,
+        ignore_locked_versions: true
+      )
+      project = resolve_current_project(preview_options)
+      if package && project.manifest.packages.none? { |entry| entry.name == package }
+        raise Error.manifest("package #{package} not found")
+      end
+
+      manifest_updates = []
+      project.packages.each do |resolved|
+        next if package && resolved.declaration.name != package
+        next unless resolved.registry_latest_version
+        next if Constraint.version_satisfies(resolved.registry_latest_version, resolved.declaration.constraint)
+
+        new_constraint = Constraint.latest_constraint_for_package(
+          resolved.declaration.constraint,
+          resolved.registry_latest_version
+        )
+        unless Constraint.version_satisfies(resolved.registry_latest_version, new_constraint)
+          raise Error.resolution(
+            "derived constraint #{new_constraint} does not admit registry latest #{resolved.registry_latest_version} for #{resolved.declaration.name}"
+          )
+        end
+
+        manifest_updates << {
+          name: resolved.declaration.name,
+          from_constraint: resolved.declaration.constraint,
+          to_constraint: new_constraint,
+          registry_latest_version: resolved.registry_latest_version
+        }
+        updated = resolved.declaration.dup
+        updated.constraint = new_constraint
+        manifest_text = Pray.replace_package_declaration(manifest_text, updated)
+      end
+
+      previous = File.exist?(lockfile_path) ? Pray.read_lockfile(lockfile_path) : nil
+      upstream_plans = Upstream.plan_path_upstream_latest_constraints(
+        project, previous, package, preview_options
+      )
+      print_latest_constraint_plans(manifest_updates, upstream_plans)
+
+      return if dry_run
+
+      Upstream.apply_path_upstream_latest_constraints(upstream_plans)
+      Transaction.write_file(path, manifest_text) if manifest_text != original_text
+      unlocked = package ? Set[package] : Set.new
+      options = ResolveOptions.new(
+        offline: offline,
+        refresh: true,
+        refresh_source_revisions: true,
+        ignore_locked_versions: package.nil?,
+        unlocked_packages: unlocked
+      )
+      current = resolve_current_project(options)
+      Upstream.apply_path_upstream_refreshes(current, previous, package, options)
+      install_command(
+        {
+          locked: false,
+          frozen: false,
+          offline: offline,
+          refresh: true,
+          ignore_locked_versions: package.nil?,
+          unlocked_packages: unlocked
+        }
+      )
+    end
+
+    def print_latest_constraint_plans(manifest_updates, upstream_plans)
+      if manifest_updates.empty? && upstream_plans.empty?
+        puts "All package constraints already allow latest versions"
+        return
+      end
+
+      manifest_updates.each do |update|
+        puts "Prayfile: #{update[:name]} constraint #{update[:from_constraint]} -> #{update[:to_constraint]} " \
+          "(registry latest #{update[:registry_latest_version]})"
+      end
+      upstream_plans.each do |plan|
+        puts "#{plan.package_name} upstream #{plan.current_constraint} -> #{plan.new_constraint} (latest #{plan.latest_version})"
+      end
+    end
+  end
+end

data/lib/pray/cli/commands/workflow.rb

@@ -10,7 +10,9 @@ module Pray
         frozen: flags[:frozen],
         locked: flags[:locked],
         offline: flags[:offline],
-        refresh: flags[:refresh]
+        refresh: flags[:refresh],
+        ignore_locked_versions: flags[:ignore_locked_versions],
+        unlocked_packages: flags[:unlocked_packages]
       )
     end
 
@@ -84,10 +86,10 @@ module Pray
     end
 
     def update_command(arguments)
-      if arguments.any? { |argument| %w[--dry-run --json].include?(argument) }
+      if arguments.include?("--json") || (arguments.include?("--dry-run") && !arguments.include?("--latest"))
         raise Error.unsupported("this Ruby CLI does not support --dry-run or --json for update; use `pray plan` to preview the current Prayfile")
       end
-      if arguments.any? { |argument| %w[--latest --major].include?(argument) }
+      if arguments.include?("--major")
         raise Error.unsupported(
           "to update beyond the current constraint, edit the package version in Prayfile, then run `pray update`"
         )
@@ -100,9 +102,29 @@ module Pray
           raise Error.manifest("package #{package} not found")
         end
       end
-      current = resolve_current_project(ResolveOptions.new(offline: offline))
-      Upstream.ensure_update_supported!(current.packages, package)
-      install_command({locked: false, frozen: false, offline: offline, refresh: true})
+      if arguments.include?("--latest")
+        return update_latest_command(package, dry_run: arguments.include?("--dry-run"), offline: offline)
+      end
+      unlocked = package ? Set[package] : Set.new
+      options = ResolveOptions.new(
+        offline: offline,
+        refresh: true,
+        refresh_source_revisions: true,
+        ignore_locked_versions: package.nil?,
+        unlocked_packages: unlocked
+      )
+      current = resolve_current_project(options)
+      Upstream.apply_path_upstream_refreshes(current, current.previous_lockfile, package, options)
+      install_command(
+        {
+          locked: false,
+          frozen: false,
+          offline: offline,
+          refresh: true,
+          ignore_locked_versions: package.nil?,
+          unlocked_packages: unlocked
+        }
+      )
     end
 
     def unlock_command(name)

data/lib/pray/cli/help.rb

@@ -101,7 +101,11 @@ module Pray
         "update" => <<~TEXT.strip,
           refresh package versions within constraints
 
-          Usage: pray update [package]
+          Usage: pray update [package] [--latest] [--latest --dry-run]
+
+          --latest adjusts constraints to allow the latest package versions.
+          --latest also rewrites exact spec.upstream pins in path packages, then refreshes those trees.
+          --latest --dry-run prints the planned rewrite and does not write.
         TEXT
         "plan" => <<~TEXT.strip,
           preview install/apply changes

data/lib/pray/cli.rb

@@ -10,6 +10,7 @@ require_relative "cli/suggest"
 require_relative "cli/helpers"
 require_relative "cli/commands/init"
 require_relative "cli/commands/workflow"
+require_relative "cli/commands/update_latest"
 require_relative "cli/commands/packages"
 require_relative "cli/commands/distribution"
 require_relative "cli/commands/trust"
@@ -22,6 +23,7 @@ module Pray
     LOCKFILE_PATH = "Prayfile.lock"
 
     def run(arguments)
+      previous_context = Invocation.context
       arguments = arguments.dup
       if arguments.delete("--no-input")
         ENV["PRAY_NO_INPUT"] = "1"
@@ -35,6 +37,8 @@ module Pray
       else
         dispatch(command)
       end
+    ensure
+      Invocation.context = previous_context
     end
 
     def maybe_print_help(arguments)

data/lib/pray/materialize.rb

@@ -13,7 +13,9 @@ module Pray
       frozen: false,
       locked: false,
       offline: false,
-      refresh: false
+      refresh: false,
+      ignore_locked_versions: false,
+      unlocked_packages: nil
     )
       context = Invocation.invocation_context
       manifest_path = File.expand_path(manifest_path || context.manifest_path)
@@ -25,6 +27,9 @@ module Pray
       options = ResolveOptions.new(
         offline: offline,
         refresh: refresh,
+        refresh_source_revisions: refresh,
+        ignore_locked_versions: ignore_locked_versions,
+        unlocked_packages: unlocked_packages ? Set.new(unlocked_packages) : Set.new,
         environment: context.environment
       )
       allow_git_refresh_fallback = !locked && !frozen

data/lib/pray/package_spec_render.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+module Pray
+  module PackageSpecRender
+    module_function
+
+    def fork_spec_after_refresh(local, new_upstream, local_prayspec_file, clean_replica, merged_content_paths)
+      spec = local.dup
+      spec.files = [local_prayspec_file, *merged_content_paths]
+      if clean_replica
+        spec.exports = new_upstream.exports.dup
+        spec.templates = new_upstream.templates.dup
+      end
+      if spec.upstream
+        spec.upstream = PackageUpstream.new(
+          name: new_upstream.name,
+          constraint: Upstream.next_upstream_constraint(spec.upstream.constraint, new_upstream.version)
+        )
+      end
+      spec
+    end
+
+    def render_package_spec(spec)
+      lines = ["Package::Specification.new do |spec|"]
+      push_identity_fields(lines, spec)
+      push_content_fields(lines, spec)
+      push_relation_fields(lines, spec)
+      lines << "end"
+      lines << ""
+      lines.join("\n")
+    end
+
+    def push_identity_fields(lines, spec)
+      push_assignment(lines, "name", spec.name)
+      push_assignment(lines, "version", spec.version)
+      push_optional(lines, "summary", spec.summary)
+      push_optional(lines, "description", spec.description)
+      push_array(lines, "authors", spec.authors) unless spec.authors.nil? || spec.authors.empty?
+      push_optional(lines, "license", spec.license)
+      push_optional(lines, "homepage", spec.homepage)
+      push_optional(lines, "source_code_uri", spec.source_code_uri)
+      push_optional(lines, "changelog_uri", spec.changelog_uri)
+      push_optional(lines, "prayfile_version", spec.prayfile_version)
+    end
+
+    def push_content_fields(lines, spec)
+      push_array(lines, "files", spec.files)
+      push_exports(lines, spec.exports)
+      push_named_paths(lines, "skills", spec.skills)
+      push_named_paths(lines, "templates", spec.templates)
+      push_string_map(lines, "adapters", spec.adapters)
+      push_array(lines, "targets", spec.targets) unless spec.targets.nil? || spec.targets.empty?
+    end
+
+    def push_relation_fields(lines, spec)
+      (spec.dependencies || []).each do |dependency|
+        method = dependency.optional ? "add_optional_dependency" : "add_dependency"
+        lines << "  spec.#{method} #{quote(dependency.name)}, #{quote(dependency.constraint)}"
+      end
+      unless spec.metadata.nil? || spec.metadata.empty?
+        lines << "  spec.metadata = #{literal_map(spec.metadata)}"
+      end
+      return unless spec.upstream
+
+      lines << "  spec.upstream #{quote(spec.upstream.name)}, #{quote(spec.upstream.constraint)}"
+    end
+
+    def push_assignment(lines, field, value)
+      lines << "  spec.#{field} = #{quote(value)}"
+    end
+
+    def push_optional(lines, field, value)
+      push_assignment(lines, field, value) unless value.nil?
+    end
+
+    def push_array(lines, field, values)
+      lines << "  spec.#{field} = [#{string_array(values)}]"
+    end
+
+    def push_exports(lines, exports)
+      return if exports.nil? || exports.empty?
+
+      lines << "  spec.exports = {"
+      exports.each do |name, export|
+        fields = ["type: #{quote(export.kind)}", "path: #{quote(export.path)}"]
+        fields << "summary: #{quote(export.summary)}" if export.summary
+        fields << "only: [#{string_array(export.only)}]" unless export.only.nil? || export.only.empty?
+        fields << "except: [#{string_array(export.except)}]" unless export.except.nil? || export.except.empty?
+        fields << "default_path: #{quote(export.default_path)}" if export.default_path
+        lines << "    #{quote(name)} => { #{fields.join(", ")} },"
+      end
+      lines << "  }"
+    end
+
+    def push_named_paths(lines, field, entries)
+      return if entries.nil? || entries.empty?
+
+      lines << "  spec.#{field} = {"
+      entries.each do |name, entry|
+        summary = entry.summary ? ", summary: #{quote(entry.summary)}" : ""
+        lines << "    #{quote(name)} => { path: #{quote(entry.path)}#{summary} },"
+      end
+      lines << "  }"
+    end
+
+    def push_string_map(lines, field, entries)
+      return if entries.nil? || entries.empty?
+
+      values = entries.map { |name, value| "#{quote(name)} => #{quote(value)}" }.join(", ")
+      lines << "  spec.#{field} = { #{values} }"
+    end
+
+    def string_array(values)
+      Array(values).map { |value| quote(value) }.join(", ")
+    end
+
+    def quote(value)
+      escaped = value.to_s.gsub("\\", "\\\\").gsub('"', '\\"').gsub("\n", "\\n").gsub("\r", "\\r").gsub("\t", "\\t")
+      %("#{escaped}")
+    end
+
+    def literal_map(entries)
+      values = entries.map { |name, value| "#{quote(name)} => #{literal(value)}" }.join(", ")
+      "{ #{values} }"
+    end
+
+    def literal(value)
+      case value.kind
+      when :string then quote(value.value)
+      when :symbol then ":#{value.value}"
+      when :bool then value.value.to_s
+      when :null then "nil"
+      when :integer then value.value.to_s
+      when :array then "[#{value.value.map { |entry| literal(entry) }.join(", ")}]"
+      when :map then literal_map(value.value)
+      else quote(value.value)
+      end
+    end
+    private_class_method :push_identity_fields, :push_content_fields, :push_relation_fields,
+      :push_assignment, :push_optional, :push_array, :push_exports,
+      :push_named_paths, :push_string_map, :string_array, :quote, :literal_map, :literal
+  end
+end

data/lib/pray/path_safety.rb

@@ -39,20 +39,24 @@ module Pray
     end
 
     def validate_archive_member_path!(path)
-      cleaned = path.to_s.delete_prefix("./")
-      if cleaned.empty? || Pathname.new(cleaned).absolute? || cleaned.start_with?("/")
+      text = path.to_s.tr("\\", "/")
+      if text.empty? || Pathname.new(text).absolute? || text.start_with?("/")
         raise Error.integrity("package path must be relative: #{path}")
       end
 
-      cleaned.split("/").each do |part|
+      parts = []
+      text.split("/").each do |part|
         next if part.empty? || part == "."
 
         if part == ".." || part.include?("\0")
           raise Error.integrity("package path escapes package root: #{path}")
         end
+
+        parts << part
       end
+      raise Error.integrity("package path must be relative: #{path}") if parts.empty?
 
-      cleaned
+      parts.join("/")
     end
 
     def validate_project_relative_path!(value)

data/lib/pray/transaction.rb

@@ -57,5 +57,12 @@ module Pray
 
       journal.replace(path, TransactionJournal.snapshot(path), bytes.b)
     end
+
+    def remove_file(path)
+      journal = Thread.current[:pray_write_transaction]
+      return File.delete(path) unless journal
+
+      journal.replace(path, TransactionJournal.snapshot(path), nil)
+    end
   end
 end

data/lib/pray/upstream.rb

@@ -4,19 +4,6 @@ module Pray
   module Upstream
     module_function
 
-    def ensure_update_supported!(packages, selected = nil)
-      unsupported = packages.find do |package|
-        package.declaration.path && package.spec.upstream &&
-          (selected.nil? || package.declaration.name == selected)
-      end
-      return unless unsupported
-
-      raise Error.unsupported(
-        "this installation cannot refresh upstream package #{unsupported.declaration.name}; " \
-        "install pray with Cargo and retry"
-      )
-    end
-
     def to_lock_hash(entry)
       hash = {
         "name" => entry.name,

data/lib/pray/upstream_latest.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    PathUpstreamLatestConstraint = Struct.new(
+      :package_name, :upstream_name, :current_constraint, :latest_version, :new_constraint, :package_root,
+      keyword_init: true
+    )
+
+    def plan_path_upstream_latest_constraints(project, previous, selected, options)
+      user_config = Config.load_user_config
+      git_sources = GitSources.prepare_git_sources(
+        project.project_root,
+        project.manifest.sources,
+        previous,
+        refresh: options.refresh || options.refresh_source_revisions
+      )
+      sources = Resolve.source_map(project.manifest.sources)
+      plans = []
+      project.packages.each do |package|
+        next if selected && package.declaration.name != selected
+
+        plan = plan_one_path_upstream(project, package, sources, git_sources, user_config, previous, options)
+        plans << plan if plan
+      end
+      plans
+    end
+
+    def apply_path_upstream_latest_constraints(plans)
+      plans.each do |plan|
+        spec_path = Resolve.find_prayspec_file(plan.package_root)
+        spec = Pray.parse_package_spec(File.read(spec_path))
+        unless spec.upstream
+          raise Error.resolution("package #{plan.package_name} has no upstream pin")
+        end
+
+        spec.upstream = PackageUpstream.new(
+          name: spec.upstream.name,
+          constraint: plan.new_constraint
+        )
+        Transaction.write_file(spec_path, PackageSpecRender.render_package_spec(spec))
+      end
+    end
+
+    def latest_spec_upstream_constraint(current, latest_version)
+      derived = Constraint.latest_constraint_for_package(current, latest_version)
+      return "= #{latest_version}" if derived.start_with?("=")
+
+      derived
+    end
+
+    def plan_one_path_upstream(project, package, sources, git_sources, user_config, lockfile, options)
+      upstream = package.spec.upstream
+      return unless upstream && package.declaration.path
+
+      source = ResolveSource.implied_source_name(ManifestPackage.new(name: upstream.name), sources)
+      resolved = Resolve.resolve_package(
+        project.project_root,
+        sources,
+        git_sources,
+        user_config,
+        ManifestPackage.new(name: upstream.name, constraint: "*", source: source),
+        lockfile,
+        options: options
+      )
+      return if Constraint.version_satisfies(resolved.spec.version, upstream.constraint)
+
+      new_constraint = latest_spec_upstream_constraint(upstream.constraint, resolved.spec.version)
+      unless Constraint.version_satisfies(resolved.spec.version, new_constraint)
+        raise Error.resolution(
+          "derived constraint #{new_constraint} does not admit latest #{resolved.spec.version} for #{package.declaration.name}"
+        )
+      end
+
+      PathUpstreamLatestConstraint.new(
+        package_name: package.declaration.name,
+        upstream_name: upstream.name,
+        current_constraint: upstream.constraint,
+        latest_version: resolved.spec.version,
+        new_constraint: new_constraint,
+        package_root: package.root
+      )
+    end
+    private_class_method :plan_one_path_upstream
+  end
+end

data/lib/pray/upstream_merge.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    def identity_path?(path)
+      File.extname(path.to_s) == ".prayspec"
+    end
+
+    def content_paths(files)
+      files.reject { |path| identity_path?(path) }
+    end
+
+    def clean_replica?(old_content, local_content)
+      local_content == old_content
+    end
+
+    def try_merge_content_files(old_content, new_content, local_content)
+      return [new_content.dup, []] if clean_replica?(old_content, local_content)
+
+      merged = {}
+      conflicts = []
+      (old_content.keys + new_content.keys + local_content.keys).uniq.sort.each do |path|
+        result = merge_one_content_path(old_content[path], new_content[path], local_content[path])
+        if result == :conflict
+          conflicts << path
+        elsif result != :omit
+          merged[path] = result
+        end
+      end
+      [merged, conflicts]
+    end
+
+    def merge_one_content_path(old, new, local)
+      case [old.nil?, new.nil?, local.nil?]
+      when [false, false, false]
+        merge_all_present(old, new, local)
+      when [false, true, false]
+        (local == old) ? :omit : :conflict
+      when [false, false, true]
+        (old == new) ? :omit : new
+      when [true, false, true]
+        new
+      when [true, true, false]
+        local
+      when [true, false, false]
+        (local == new) ? new : :conflict
+      else
+        :conflict
+      end
+    end
+
+    def merge_all_present(old, new, local)
+      return new if local == new || local == old
+      return local if old == new
+
+      :conflict
+    end
+
+    def merge_content_files(old_content, new_content, local_content)
+      merged, conflicts = try_merge_content_files(old_content, new_content, local_content)
+      return merged if conflicts.empty?
+
+      raise Error.resolution("upstream merge conflict in #{conflicts.join(", ")}")
+    end
+
+    def merge_conflict_message(fork, upstream_name, old_version, new_version, paths)
+      "upstream merge conflict in #{fork} while refreshing #{upstream_name} " \
+        "#{old_version} to #{new_version}: #{paths.join(", ")}"
+    end
+
+    def next_upstream_constraint(current, new_version)
+      trimmed = current.to_s.strip
+      return current if trimmed == "*" || trimmed.start_with?("~>", "^", ">=", ">", "<=", "<")
+
+      "= #{new_version}"
+    end
+    private_class_method :merge_one_content_path, :merge_all_present
+  end
+end

data/lib/pray/upstream_refresh.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    def apply_path_upstream_refreshes(project, previous, selected, options)
+      user_config = Config.load_user_config
+      git_sources = GitSources.prepare_git_sources(
+        project.project_root,
+        project.manifest.sources,
+        previous,
+        refresh: options.refresh || options.refresh_source_revisions
+      )
+      sources = Resolve.source_map(project.manifest.sources)
+      changed = false
+      project.packages.each do |package|
+        next if selected && package.declaration.name != selected
+        next unless apply_one_path_upstream(project, package, previous, sources, git_sources, user_config, options)
+
+        changed = true
+      end
+      changed
+    end
+
+    def apply_one_path_upstream(project, package, previous, sources, git_sources, user_config, options)
+      new_upstream = package.upstream
+      return false unless new_upstream && package.declaration.path
+
+      old_upstream = previous&.package&.find { |entry| entry.name == package.declaration.name }&.upstream
+      return false unless old_upstream
+      return false if old_upstream.version == new_upstream.version && old_upstream.tree_hash == new_upstream.tree_hash
+
+      old_package, new_package = resolve_upstream_pair(
+        project, previous, sources, git_sources, user_config, options, old_upstream, new_upstream
+      )
+      old_content, local_content, merged = merge_fork_content(package, old_upstream, new_upstream, old_package, new_package)
+      write_content_files(package.root, old_content, merged)
+      write_refreshed_spec(package, new_package, old_content, local_content, merged)
+      true
+    end
+
+    def resolve_upstream_pair(project, previous, sources, git_sources, user_config, options, old_upstream, new_upstream)
+      old_package = resolve_named(
+        project.project_root, sources, git_sources, user_config, previous, options,
+        old_upstream.name, "= #{old_upstream.version}", old_upstream.source
+      )
+      resolved_old = LockedUpstream.new(
+        name: old_upstream.name,
+        version: old_package.spec.version,
+        source: old_upstream.source,
+        tree_hash: old_package.tree_hash,
+        artifact_hash: old_package.artifact_hash
+      )
+      ensure_locked_match!(old_upstream, resolved_old)
+      new_package = resolve_named(
+        project.project_root, sources, git_sources, user_config, previous, options,
+        new_upstream.name, "= #{new_upstream.version}", new_upstream.source
+      )
+      [old_package, new_package]
+    end
+
+    def merge_fork_content(package, old_upstream, new_upstream, old_package, new_package)
+      old_content = content_file_bytes(old_package.root, old_package.spec)
+      new_content = content_file_bytes(new_package.root, new_package.spec)
+      local_content = content_file_bytes(package.root, package.spec)
+      merged, conflicts = try_merge_content_files(old_content, new_content, local_content)
+      unless conflicts.empty?
+        raise Error.resolution(
+          merge_conflict_message(
+            package.declaration.name, old_upstream.name, old_upstream.version, new_upstream.version, conflicts
+          )
+        )
+      end
+      [old_content, local_content, merged]
+    end
+
+    def write_refreshed_spec(package, new_package, old_content, local_content, merged)
+      spec_path = Resolve.find_prayspec_file(package.root)
+      updated = PackageSpecRender.fork_spec_after_refresh(
+        package.spec,
+        new_package.spec,
+        File.basename(spec_path),
+        clean_replica?(old_content, local_content),
+        merged.keys
+      )
+      Transaction.write_file(spec_path, PackageSpecRender.render_package_spec(updated))
+    end
+
+    def resolve_named(project_root, sources, git_sources, user_config, lockfile, options, name, constraint, source)
+      Resolve.resolve_package(
+        project_root,
+        sources,
+        git_sources,
+        user_config,
+        ManifestPackage.new(name: name, constraint: constraint, source: source),
+        lockfile,
+        options: options
+      )
+    end
+
+    def content_file_bytes(root, spec)
+      paths = content_paths(spec.files)
+      if paths.length > ResourceLimits::MAX_ARCHIVE_ENTRIES
+        raise Error.integrity("package content exceeds #{ResourceLimits::MAX_ARCHIVE_ENTRIES} files")
+      end
+
+      files = {}
+      total_bytes = 0
+      paths.each do |relative|
+        PathSafety.validate_archive_member_path!(relative)
+        path = File.join(root, relative)
+        raise Error.integrity("package file missing: #{relative}") unless File.file?(path)
+
+        size = File.size(path)
+        if size > ResourceLimits::MAX_ARCHIVE_ENTRY_BYTES
+          raise Error.integrity("package file exceeds #{ResourceLimits::MAX_ARCHIVE_ENTRY_BYTES} bytes: #{relative}")
+        end
+
+        total_bytes += size
+        if total_bytes > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+          raise Error.integrity("package content exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} bytes")
+        end
+
+        files[relative] = File.binread(path)
+      end
+      files
+    end
+
+    def write_content_files(root, old_content, merged)
+      (old_content.keys + merged.keys).each { |path| PathSafety.validate_archive_member_path!(path) }
+      old_content.each_key do |path|
+        next if merged.key?(path)
+
+        Transaction.remove_file(File.join(root, path))
+      end
+      merged.each do |relative, bytes|
+        Transaction.write_file(File.join(root, relative), bytes)
+      end
+    end
+    private_class_method :apply_one_path_upstream, :resolve_upstream_pair, :merge_fork_content,
+      :write_refreshed_spec, :resolve_named
+  end
+end

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.14.0"
-  GENERATED_BY = "pray 1.14.0"
+  VERSION = "1.15.0"
+  GENERATED_BY = "pray 1.15.0"
 end

data/lib/pray.rb

@@ -25,6 +25,10 @@ require_relative "pray/invocation"
 require_relative "pray/git_refresh"
 require_relative "pray/resolve"
 require_relative "pray/upstream"
+require_relative "pray/upstream_merge"
+require_relative "pray/package_spec_render"
+require_relative "pray/upstream_refresh"
+require_relative "pray/upstream_latest"
 require_relative "pray/compose_dest"
 require_relative "pray/render_patch"
 require_relative "pray/render"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.14.0
+  version: 1.15.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -113,6 +113,7 @@ files:
 - lib/pray/cli/commands/meta.rb
 - lib/pray/cli/commands/packages.rb
 - lib/pray/cli/commands/trust.rb
+- lib/pray/cli/commands/update_latest.rb
 - lib/pray/cli/commands/workflow.rb
 - lib/pray/cli/help.rb
 - lib/pray/cli/helpers.rb
@@ -147,6 +148,7 @@ files:
 - lib/pray/manifest_parser_helpers.rb
 - lib/pray/materialize.rb
 - lib/pray/package_spec.rb
+- lib/pray/package_spec_render.rb
 - lib/pray/path_safety.rb
 - lib/pray/plan.rb
 - lib/pray/project_context.rb
@@ -181,6 +183,9 @@ files:
 - lib/pray/trust_feed.rb
 - lib/pray/trust_ops.rb
 - lib/pray/upstream.rb
+- lib/pray/upstream_latest.rb
+- lib/pray/upstream_merge.rb
+- lib/pray/upstream_refresh.rb
 - lib/pray/verify.rb
 - lib/pray/verify_position.rb
 - lib/pray/verify_provisioned.rb