@gjsify/cli 0.13.1 → 0.13.2

package/lib/actions/build.js

@@ -2,7 +2,7 @@ import { runBundle, runWatch, bundleToChunks } from '../bundler-pick.js';
 import { gjsifyPlugin, textLoaderPlugin, resolveShebangLine, NODE_SHEBANG } from '@gjsify/rolldown-plugin-gjsify';
 import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { resolveUserPlugins } from '../utils/resolve-plugin-by-name.js';
-import { resolveGlobalsList, writeRegisterInjectFile, detectAutoGlobals } from '@gjsify/rolldown-plugin-gjsify/globals';
+import { resolveGlobalsList, writeRegisterInjectFile, detectAutoGlobals, detectNodeGiGlobals, } from '@gjsify/rolldown-plugin-gjsify/globals';
 import { pnpPlugin } from '@gjsify/rolldown-plugin-pnp';
 import { dirname, extname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -402,6 +402,36 @@ export class BuildAction {
             { extraGlobalsList: extras, excludeGlobals, cwd: process.cwd() }, bundleToChunks);
             pluginOpts.autoGlobalsInject = injectPath;
         }
+        else if (app === 'node' && autoMode) {
+            // `--app node` reverse direction: detect GJS ambient globals
+            // (`print`/`imports`/…) in the bundled, tree-shaken output and
+            // inject `@gjsify/node-gi/globals` only when present. A single
+            // in-memory analysis pass (the shim is external — no convergence
+            // loop). Gated on `autoMode` so `--globals none` opts out. The
+            // detection must run BEFORE the final build so the entry can be
+            // wrapped; nothing is injected when no globals are referenced (the
+            // eager-native-load regression guard).
+            const gjsifyPluginFactory = async (opts) => {
+                const cfg = await gjsifyPlugin({
+                    input: userBundler.input,
+                    output: { file: outfile, dir: outdir },
+                    userExternal,
+                    userBanner,
+                    userAliases: aliases,
+                    shebang: this.configData.shebang,
+                }, opts);
+                return { options: cfg.options, plugins: cfg.plugins };
+            };
+            const needsGiGlobals = await detectNodeGiGlobals({
+                input: userBundler.input,
+                plugins: [...pnpPlugins, ...userPlugins],
+                external: userBundler.external,
+                transform: userBundler.transform,
+                format,
+            }, pluginOpts, gjsifyPluginFactory, bundleToChunks);
+            if (needsGiGlobals)
+                pluginOpts.nodeGiGlobalsInject = true;
+        }
         else if (extras) {
             pluginOpts.autoGlobalsInject = await this.resolveGlobalsInject(app, extras, verbose);
         }

package/lib/commands/affected.js

@@ -119,8 +119,15 @@ const IGNORE = [
     /^refs\//,
     /^website\//,
     /^docs\//,
-    /^\.github\/workflows\/(deploy-docs|commitlint|release|audit-runtimes|prebuilds)\.yml$/,
+    /^\.github\/workflows\/(deploy-docs|commitlint|release|audit-runtimes|prebuilds|node-gi)\.yml$/,
     /^\.githooks\//,
+    // @gjsify/node-gi (the Node-native GObject-Introspection engine, Axis 5) is
+    // NOT a gjsify workspace member — the GJS-first install/foreach tooling can't
+    // build its node-gyp addon, so the main workflow neither builds nor tests it.
+    // Its own `.github/workflows/node-gi.yml` is the source of truth (built +
+    // tested on Node). Without this carve-out its files map to no workspace and
+    // land in `unmatched`, forcing a conservative full run on every node-gi PR.
+    /^packages\/node-gi\//,
     // Flatpak build/distribution tooling (SDK-extension manifest + metainfo).
     // Like `.githooks/`, it has no package-test consumers; its own
     // `tests/e2e/flatpak-sdk-extension` runs on `tests/e2e/**` / global triggers.

package/lib/commands/install.js

@@ -619,6 +619,11 @@ async function workspaceInstall(cwd, args, signal) {
             overrides,
             signal,
             progress,
+            // Workspace-named packages are symlinked above — the native backend
+            // must never fetch a same-named published version over those
+            // symlinks (e.g. a `types-dev/<lib>` workspace that also exists on
+            // npm and is pinned transitively in the lockfile).
+            workspaceNames: new Set(byName.keys()),
         });
     }
     else if (args.verbose) {
@@ -644,6 +649,7 @@ async function workspaceInstall(cwd, args, signal) {
             lockfile: !args.immutable,
             frozen: args.immutable,
             signal,
+            workspaceNames: new Set(byName.keys()),
         });
     }
     // Re-wire workspace symlinks once more now that the external + scoped

package/lib/utils/install-backend-native.js

@@ -21,6 +21,7 @@ import { DEFAULT_REGISTRY, fetchPackument, fetchPackumentConditional, fetchTarba
 import { extractTarball } from '@gjsify/tar';
 import { getCachedTarball, getForeignCachedTarball, putCachedTarball, } from './install-tarball-cache.js';
 import { getCachedPackument, putCachedPackument } from './install-packument-cache.js';
+import { assertNativeBackendNodeVersion } from './node-version.js';
 // 16-wide download pool. Matched to the shared Soup.Session's lifted
 // `max-conns-per-host` (see @gjsify/fetch `getSharedSession`) — a higher pool
 // here only translates into real concurrency because that cap was raised from
@@ -30,6 +31,9 @@ const DEFAULT_CONCURRENCY = Number(process.env.GJSIFY_INSTALL_CONCURRENCY ?? '16
 const LOCKFILE_NAME = 'gjsify-lock.json';
 const LOCKFILE_VERSION = 2;
 export async function installPackagesNative(opts) {
+    // Fail clearly on an unsupported Node major BEFORE touching the ABI-locked
+    // native deps — otherwise they SIGSEGV mid-extract with no actionable message.
+    assertNativeBackendNodeVersion();
     if (opts.specs.length === 0) {
         throw new Error('installPackagesNative: empty specs list');
     }
@@ -72,12 +76,29 @@ export async function installPackagesNative(opts) {
         // (and silently bumping transitive deps) on a one-package add.
         const preferred = !opts.refreshLockfile && existingLock ? buildPreferredVersions(existingLock) : undefined;
         log('install: resolving %d top-level spec(s) → %s%s', opts.specs.length, opts.prefix, preferred ? ` (preserving ${preferred.size} locked name(s))` : '');
-        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides, opts.skipDeps, opts.signal, progress, preferred);
+        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides, opts.skipDeps, opts.signal, progress, preferred, opts.workspaceNames);
         if (opts.lockfile) {
             writeLockfile(lockfilePath, opts.specs, nodes);
             log('install: wrote %s (%d entries)', LOCKFILE_NAME, nodes.length);
         }
     }
+    // A package whose name is one of the monorepo's own workspaces is provided
+    // by a workspace symlink (wired by `workspaceInstall`), NOT by a registry
+    // tarball — even when the lockfile or a transitive edge pins a same-named
+    // published version. Drop those nodes from the fetch/extract set so
+    // `extractOne` never `rm`s + overwrites the workspace source symlink (its
+    // data-loss guard would otherwise abort the whole install). This keeps
+    // `--immutable` robust against a committed lockfile that still carries such
+    // registry entries (it is built from the lockfile verbatim and never runs
+    // `resolveDeps`); a fresh resolve additionally skips them at the source.
+    if (opts.workspaceNames && opts.workspaceNames.size > 0) {
+        const before = nodes.length;
+        nodes = nodes.filter((n) => !opts.workspaceNames.has(n.name));
+        const dropped = before - nodes.length;
+        if (dropped > 0) {
+            log('install: %d workspace-provided package(s) symlinked, not fetched', dropped);
+        }
+    }
     log('install: downloading %d tarball(s)', nodes.length);
     await downloadAndExtractAll(nodes, opts.prefix, npmrc, log, opts.signal, progress);
     await linkBins(nodes, opts.prefix, log);
@@ -143,7 +164,14 @@ async function resolveDeps(specs, npmrc, log, overrides, skipDeps, signal, progr
  * Undefined ⇒ a fresh resolve that always picks the newest in-range version
  * (first install, or an explicit `--refresh-lockfile`).
  */
-preferredVersions) {
+preferredVersions, 
+/**
+ * Names of the monorepo's own workspace packages. An edge whose name is in
+ * this set is satisfied by the workspace symlink, so it is skipped here —
+ * the published version (and its subtree) never enters the resolved tree or
+ * the lockfile.
+ */
+workspaceNames) {
     progress?.beginPhase('resolve', specs.length);
     const applyOverride = (name, range) => {
         if (!overrides)
@@ -209,6 +237,11 @@ preferredVersions) {
         // cache instead of blocking on a fresh round-trip.
         for (let wi = 0; wi < wave.length; wi++) {
             const edge = wave[wi];
+            // A workspace member is satisfied by its workspace symlink, never by
+            // a registry tarball — skip the edge so the published version (and
+            // its subtree) never enters the resolved tree or the lockfile.
+            if (workspaceNames?.has(edge.name))
+                continue;
             // Walk the ancestor chain to see whether a satisfying placement is
             // already visible from the requester's `node_modules` lookup. npm's
             // resolver does this — each level of nesting acts as a fallback.

package/lib/utils/install-backend.d.ts

@@ -70,6 +70,19 @@ export interface InstallOptions {
      * to override.
      */
     progress?: ProgressReporter;
+    /**
+     * Native backend only: the names of the monorepo's own workspace packages.
+     * A package whose name is in this set is materialised as a symlink to its
+     * workspace source by `workspaceInstall`, never fetched from the registry —
+     * even when the lockfile or a transitive edge references a same-named
+     * published version (e.g. a `types-dev/<lib>` workspace that ALSO exists on
+     * npm). The native backend drops such names from `resolveDeps` AND from the
+     * fetch/extract set, so `extractOne` never tries to `rm` + overwrite a
+     * workspace source symlink (its data-loss guard would otherwise abort the
+     * whole install). The `npm` backend ignores this — npm resolves workspaces
+     * itself.
+     */
+    workspaceNames?: Set<string>;
 }
 export interface InstallResult {
     /** Top-level packages that were requested, with the version each

package/lib/utils/node-version.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Minimum Node.js major the native install backend supports — its prebuilt native
+ * modules are ABI-locked to this line (kept in sync with `.nvmrc`).
+ */
+export declare const MIN_NODE_MAJOR = 24;
+/** Parse the major from a `process.versions.node`-style string (`'24.18.0'` → 24). */
+export declare function parseNodeMajor(version: string): number;
+/**
+ * The preflight verdict for the native install backend, factored out so it can be
+ * unit-tested without spawning a foreign Node. Returns an error message when the
+ * runtime is real Node older than {@link MIN_NODE_MAJOR}, else `null` — i.e. on a
+ * supported Node, on GJS (which fakes `process.versions.node` and does not use
+ * these prebuilds), or on a version string that does not parse.
+ */
+export declare function nativeBackendNodeError(version: string, onRealNode: boolean): string | null;
+/**
+ * Guard the native install backend: throw a clear error on an unsupported Node
+ * major instead of letting the ABI-mismatched prebuilds SIGSEGV mid-install.
+ * No-op under GJS and on supported Node.
+ */
+export declare function assertNativeBackendNodeVersion(): void;

package/lib/utils/node-version.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: MIT
+// Node-version preflight for the native install backend.
+//
+// The native backend composes native deps whose prebuilt binaries are ABI-locked
+// to the Node line gjsify targets (see `.nvmrc`). On an older Node major they load
+// a mismatched ABI and SIGSEGV mid-install instead of failing cleanly — a
+// confusing crash with no actionable message (observed: Node 22 in a Fedora
+// container segfaults `gjsify install --backend native` during download/extract).
+// This preflight turns that into a clear, actionable error.
+import { isNode } from '@gjsify/rolldown-plugin-gjsify/runtime';
+/**
+ * Minimum Node.js major the native install backend supports — its prebuilt native
+ * modules are ABI-locked to this line (kept in sync with `.nvmrc`).
+ */
+export const MIN_NODE_MAJOR = 24;
+/** Parse the major from a `process.versions.node`-style string (`'24.18.0'` → 24). */
+export function parseNodeMajor(version) {
+    return Number.parseInt(String(version).split('.', 1)[0] ?? '', 10);
+}
+/**
+ * The preflight verdict for the native install backend, factored out so it can be
+ * unit-tested without spawning a foreign Node. Returns an error message when the
+ * runtime is real Node older than {@link MIN_NODE_MAJOR}, else `null` — i.e. on a
+ * supported Node, on GJS (which fakes `process.versions.node` and does not use
+ * these prebuilds), or on a version string that does not parse.
+ */
+export function nativeBackendNodeError(version, onRealNode) {
+    if (!onRealNode)
+        return null;
+    const major = parseNodeMajor(version);
+    if (!Number.isFinite(major) || major >= MIN_NODE_MAJOR)
+        return null;
+    return (`gjsify install (native backend) requires Node ≥ ${MIN_NODE_MAJOR}, but this is Node ${version}. ` +
+        `Its prebuilt native modules are ABI-locked to Node ${MIN_NODE_MAJOR} and crash on older majors. ` +
+        `Use Node ${MIN_NODE_MAJOR} (nvm/asdf locally, actions/setup-node in CI), or run with --backend npm.`);
+}
+/** True when the CLI runs on real Node — NOT GJS, which fakes `process.versions.node`. */
+function onRealNode() {
+    // GJS exposes `imports.system.version`; @gjsify/process fakes
+    // `process.versions.node = '20.0.0'` for compat, so check GJS FIRST — a plain
+    // `process.versions.node` read would be a false Node positive under GJS.
+    const sysVersion = globalThis.imports?.system?.version;
+    if (sysVersion !== undefined)
+        return false;
+    return isNode();
+}
+/**
+ * Guard the native install backend: throw a clear error on an unsupported Node
+ * major instead of letting the ABI-mismatched prebuilds SIGSEGV mid-install.
+ * No-op under GJS and on supported Node.
+ */
+export function assertNativeBackendNodeVersion() {
+    const message = nativeBackendNodeError(process.versions.node, onRealNode());
+    if (message)
+        throw new Error(message);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.13.1",
+    "version": "0.13.2",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -108,6 +108,7 @@
         "start": "node lib/index.js",
         "build": "tsc && mkdir -p lib/templates/flatpak && cp -L src/templates/install.mjs.tmpl lib/templates/install.mjs.tmpl && cp src/templates/flatpak/*.tmpl lib/templates/flatpak/ && cp src/templates/oxlintrc.json.tmpl lib/templates/oxlintrc.json.tmpl && cp src/templates/oxfmtrc.tmpl lib/templates/oxfmtrc.tmpl && gjsify run chmod",
         "build:gjs-bundle": "node lib/index.js build src/index.ts --app gjs --outfile dist/cli.gjs.mjs --shebang",
+        "build:affected-bundle": "node lib/index.js build src/affected-entry.ts --app gjs --outfile dist/affected.gjs.mjs",
         "chmod": "chmod +x ./lib/index.js",
         "build:test:node": "node lib/index.js build src/test.mts --app node --outfile dist/test.node.mjs",
         "test:node": "node dist/test.node.mjs",
@@ -120,19 +121,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.13.1",
-        "@gjsify/create-app": "^0.13.1",
-        "@gjsify/node-globals": "^0.13.1",
-        "@gjsify/node-polyfills": "^0.13.1",
-        "@gjsify/npm-registry": "^0.13.1",
-        "@gjsify/resolve-npm": "^0.13.1",
-        "@gjsify/rolldown-plugin-gjsify": "^0.13.1",
-        "@gjsify/rolldown-plugin-pnp": "^0.13.1",
-        "@gjsify/semver": "^0.13.1",
-        "@gjsify/tar": "^0.13.1",
-        "@gjsify/tsc": "^0.13.1",
-        "@gjsify/web-polyfills": "^0.13.1",
-        "@gjsify/workspace": "^0.13.1",
+        "@gjsify/buffer": "^0.13.2",
+        "@gjsify/create-app": "^0.13.2",
+        "@gjsify/node-globals": "^0.13.2",
+        "@gjsify/node-polyfills": "^0.13.2",
+        "@gjsify/npm-registry": "^0.13.2",
+        "@gjsify/resolve-npm": "^0.13.2",
+        "@gjsify/rolldown-plugin-gjsify": "^0.13.2",
+        "@gjsify/rolldown-plugin-pnp": "^0.13.2",
+        "@gjsify/semver": "^0.13.2",
+        "@gjsify/tar": "^0.13.2",
+        "@gjsify/tsc": "^0.13.2",
+        "@gjsify/web-polyfills": "^0.13.2",
+        "@gjsify/workspace": "^0.13.2",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -140,13 +141,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.13.1",
+        "@gjsify/unit": "^0.13.2",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.13.1",
-        "@gjsify/rolldown-native": "^0.13.1"
+        "@gjsify/oxfmt-native": "^0.13.2",
+        "@gjsify/rolldown-native": "^0.13.2"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {