@gjsify/cli 0.22.0 → 0.23.0

package/lib/commands/onboard.js

@@ -27,6 +27,7 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { DEFAULT_REGISTRY, whoami } from '@gjsify/npm-registry';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
+import { mergePublishables } from '../utils/publishable-packages.js';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider } from '../utils/npm-otp.js';
 import { publishWorkspace } from './publish.js';
@@ -142,7 +143,11 @@ export const onboardCommand = {
         const environment = args.environment;
         // 2. Enumerate publishable workspaces (non-private, exclude @girs/*).
         const root = findWorkspaceRoot(cwd) ?? cwd;
-        const all = discoverWorkspaces(root, { includeRoot: true });
+        // Non-workspace publishables (packages/{node-gi,napi}/*) publish through
+        // release.yml but `discoverWorkspaces` cannot see them — without this
+        // merge the sweep reports "all done" while a package that was never
+        // published is simply absent from the list.
+        const all = mergePublishables(discoverWorkspaces(root, { includeRoot: true }), cwd);
         const selected = filterWorkspaces(all, { noPrivate: true, exclude: ['@girs/*'] }).filter((ws) => ws.name);
         if (selected.length === 0) {
             const msg = 'gjsify onboard: no publishable workspace packages found.';

package/lib/commands/pack.js

@@ -29,6 +29,7 @@ import { join, resolve } from 'node:path';
 import { createTarball, gzip } from '@gjsify/tar';
 import { discoverWorkspaces } from '@gjsify/workspace';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
+import { readPackageJson } from '../utils/pkg-json.js';
 import { runLifecycleScript } from '../utils/run-lifecycle-script.js';
 export const packCommand = {
     command: 'pack [path]',
@@ -488,23 +489,87 @@ function globToRegex(glob) {
     pat = pat.replace(/\?/g, '[^/]');
     return new RegExp(`^${pat}($|/)`);
 }
+const DEP_BLOCKS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+/** Every `<block>.<name>` in `pkg` whose range uses the `workspace:` protocol. */
+function collectWorkspaceProtocolDeps(pkg) {
+    const found = [];
+    for (const block of DEP_BLOCKS) {
+        const deps = pkg[block];
+        if (!deps)
+            continue;
+        for (const [name, range] of Object.entries(deps)) {
+            if (typeof range === 'string' && range.startsWith('workspace:'))
+                found.push(`${block}.${name}`);
+        }
+    }
+    return found;
+}
+/**
+ * Monorepo root to resolve `workspace:` ranges against.
+ *
+ * `findWorkspaceRoot` is deliberately strict: it only accepts a candidate root
+ * whose OWN `workspaces` globs list `start` as a member (so an unrelated
+ * grand-parent monorepo can't be picked up). Packing needs a WIDER answer,
+ * because some packages live inside the monorepo on purpose WITHOUT being
+ * members — `packages/napi/**` and `packages/node-gi/**` are excluded from
+ * `package.json#workspaces` (own CI, own release cadence, see AGENTS.md). For
+ * those the strict lookup returns `null`, and the pre-fix code took that as
+ * "nothing to do" and shipped the literal `workspace:^` string.
+ *
+ * So: strict answer first, else the nearest ancestor that declares
+ * `workspaces` at all — the monorepo the package physically lives in, whose
+ * members are exactly the siblings a `workspace:` range can refer to.
+ */
+function findPackWorkspaceRoot(start) {
+    const strict = findWorkspaceRoot(start);
+    if (strict)
+        return strict;
+    let dir = start;
+    for (let i = 0; i < 12; i++) {
+        const pkgPath = join(dir, 'package.json');
+        if (existsSync(pkgPath) && readPackageJson(pkgPath)?.workspaces !== undefined)
+            return dir;
+        const parent = resolve(dir, '..');
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
 /**
  * Walk pkg.dependencies / devDependencies / peerDependencies /
  * optionalDependencies and replace `workspace:^` / `workspace:~` /
  * `workspace:*` ranges with the resolved npm range based on each sibling
  * workspace's version field.
+ *
+ * A `workspace:` range that survives into a published tarball is unresolvable
+ * by EVERY registry client (`npm install` fails with `Unsupported URL Type
+ * "workspace:"`), so there is no such thing as a harmless skip here: this
+ * either substitutes or throws. Same failure mode, same reasoning as
+ * `expandFilesPatterns` above — a packer that silently produces a broken
+ * tarball costs a whole release train (v0.4.20, v0.4.37).
  */
 function rewriteWorkspaceDeps(pkg, wsDir) {
-    const root = findWorkspaceRoot(wsDir);
-    if (!root)
+    const root = findPackWorkspaceRoot(wsDir);
+    if (!root) {
+        // No enclosing monorepo. Fine for a standalone package — but then a
+        // `workspace:` range cannot possibly be resolved, so refuse rather
+        // than ship it.
+        const unresolvable = collectWorkspaceProtocolDeps(pkg);
+        if (unresolvable.length > 0) {
+            throw new Error(`gjsify pack: ${String(pkg.name)} declares workspace: ranges (${unresolvable.join(', ')}) ` +
+                `but ${wsDir} is not inside a monorepo (no ancestor package.json declares "workspaces"). ` +
+                `A workspace: range cannot be published — replace it with a real npm range, or pack from within the monorepo.`);
+        }
         return pkg;
+    }
     const siblings = new Map();
     for (const ws of discoverWorkspaces(root)) {
         if (ws.name && ws.version)
             siblings.set(ws.name, ws.version);
     }
     const cloned = JSON.parse(JSON.stringify(pkg));
-    for (const block of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+    for (const block of DEP_BLOCKS) {
         const deps = cloned[block];
         if (!deps)
             continue;
@@ -513,7 +578,7 @@ function rewriteWorkspaceDeps(pkg, wsDir) {
                 continue;
             const wsVer = siblings.get(name);
             if (!wsVer) {
-                throw new Error(`gjsify pack: ${cloned.name} declares workspace:^ on ${name} but no sibling workspace with that name exists in the monorepo at ${root}`);
+                throw new Error(`gjsify pack: ${cloned.name} declares ${range} on ${name} (${block}) but no sibling workspace with that name exists in the monorepo at ${root}`);
             }
             const operator = range.slice('workspace:'.length);
             if (operator === '*' || operator === '') {

package/lib/commands/run.js

@@ -342,6 +342,17 @@ async function runScript(script, extraArgs, cwd = process.cwd()) {
         process.env.npm_package_version = env.npm_package_version;
         if (env.FORCE_COLOR !== undefined)
             process.env.FORCE_COLOR = env.FORCE_COLOR;
+        // Track the failure LOCALLY rather than through `process.exitCode`.
+        // Under GJS `process.exit()` is deferred (see the note below), so the
+        // `process.exit(1)` that used to live in the catch returned instead of
+        // terminating, execution fell through to the exit-code line below, and
+        // whatever that computed WON. The dispatched command's failure was then
+        // reported as success: `gjsify run build:gjsify` exited 0 while the
+        // `gjsify build` it dispatched exited 1, so `gjsify onboard` happily
+        // published a package whose build had just failed. Anything chaining on
+        // `gjsify run <script>` — every `a && b` build script, CI, onboard —
+        // got a false green from it.
+        let dispatchFailed = false;
         try {
             // Dynamic import to avoid a static cli-app ↔ run.ts import cycle;
             // cli-app is already loaded (the CLI is running through it), so this
@@ -351,21 +362,22 @@ async function runScript(script, extraArgs, cwd = process.cwd()) {
         }
         catch (err) {
             console.error(err.message);
-            process.exit(1);
+            dispatchFailed = true;
         }
-        // Honor a non-zero `process.exitCode` set by the dispatched handler
-        // (e.g. a failing check that sets the code instead of exiting) —
-        // a bare exit(0) here masked such failures as success.
-        process.exit(process.exitCode != null ? Number(process.exitCode) : 0);
-        // `process.exit()` under GJS is NOT synchronous — with the GLib main
-        // loop armed (`ensureMainLoop`, e.g. by a bundle the in-process dispatch
-        // just ran) it defers the actual teardown, so execution CONTINUES past
-        // the call. Without this `return` the function falls through to the
-        // shell-spawn fallback below and runs the SAME command a SECOND time
-        // (the double-execution bug). Mirrors the file-mode path's `return`
-        // after `runGjsBundle`. Keep both — the return is the real guard, the
-        // exit sets the status code for when the loop finally unwinds.
-        return;
+        // A thrown command wins over `process.exitCode`; otherwise honour a
+        // non-zero code the handler set instead of throwing (e.g. a failing
+        // check) — a bare exit(0) here masked those as success too.
+        const dispatchCode = dispatchFailed ? 1 : process.exitCode != null ? Number(process.exitCode) : 0;
+        // `return process.exit(…)`, never a bare call. Under GJS `process.exit()`
+        // is NOT synchronous — with the GLib main loop armed (`ensureMainLoop`,
+        // e.g. by a bundle the in-process dispatch just ran) it defers the
+        // actual teardown and RETURNS, so execution continues past the call.
+        // Without the `return` the function falls through to the shell-spawn
+        // fallback below and runs the SAME command a SECOND time (the
+        // double-execution bug). Mirrors the file-mode path's `return` after
+        // `runGjsBundle`. The return is the real guard; the exit sets the status
+        // code for when the loop finally unwinds.
+        return process.exit(dispatchCode);
     }
     const fullCmd = extraArgs.length > 0 ? `${literal} ${extraArgs.map(shellEscape).join(' ')}` : literal;
     // ensureMainLoop() (called inside spawn) keeps GJS alive after the

package/lib/commands/trust.js

@@ -16,70 +16,14 @@
 //
 // Reference: refs/npm-cli/lib/trust-cmd.js + lib/commands/trust/github.js.
 import { spawnSync } from 'node:child_process';
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm-registry';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
+import { mergePublishables } from '../utils/publishable-packages.js';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider, withOtpRetry } from '../utils/npm-otp.js';
 import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
-/**
- * Publishable packages under `packages/node-gi/*` that are NOT root workspaces
- * (the workspaces glob excludes `packages/node-gi/*`) yet publish via release.yml —
- * `@gjsify/node-gi` + the `@gjsify/gtk-runtime-*` bundles. `discoverWorkspaces`
- * misses them, so `gjsify trust` would never configure their Trusted Publisher.
- * Enumerate them here as Workspace-shaped entries so the sweep covers them too.
- * Best-effort: a missing dir / unreadable manifest is simply skipped.
- */
-function discoverNodeGiPublishables(cwd) {
-    // Walk up from cwd to the repo root — the dir that holds `packages/node-gi` —
-    // so the command works from the root or any subdirectory.
-    let root = cwd;
-    for (let i = 0; i < 8; i++) {
-        if (existsSync(join(root, 'packages', 'node-gi')))
-            break;
-        const parent = dirname(root);
-        if (parent === root)
-            return [];
-        root = parent;
-    }
-    const base = join(root, 'packages', 'node-gi');
-    if (!existsSync(base))
-        return [];
-    const out = [];
-    let entries;
-    try {
-        entries = readdirSync(base, { withFileTypes: true });
-    }
-    catch {
-        return [];
-    }
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const location = join(base, entry.name);
-        const pkgPath = join(location, 'package.json');
-        if (!existsSync(pkgPath))
-            continue;
-        try {
-            const manifest = JSON.parse(readFileSync(pkgPath, 'utf8'));
-            if (!manifest || typeof manifest.name !== 'string' || manifest.name.length === 0)
-                continue;
-            out.push({
-                location,
-                relativeLocation: join('packages', 'node-gi', entry.name),
-                name: manifest.name,
-                version: typeof manifest.version === 'string' ? manifest.version : '0.0.0',
-                manifest,
-                private: manifest.private === true,
-            });
-        }
-        catch {
-            /* unreadable / malformed — skip */
-        }
-    }
-    return out;
-}
 export const trustCommand = {
     command: 'trust [packages..]',
     description: 'Configure npm Trusted Publishers (OIDC/GitHub Actions) for publishable workspace packages so release.yml can publish without a token. Native — no `npm` needed. Incremental: skips already-configured packages.',
@@ -197,9 +141,7 @@ export const trustCommand = {
         // which publish via release.yml but are NOT root workspaces, so
         // discoverWorkspaces misses them and their Trusted Publisher would never get
         // configured. Dedup by name so a real workspace always wins.
-        const workspaceNames = new Set(all.map((ws) => ws.name));
-        const extra = discoverNodeGiPublishables(cwd).filter((ws) => !workspaceNames.has(ws.name));
-        const merged = [...all, ...extra];
+        const merged = mergePublishables(all, cwd);
         const selected = filterWorkspaces(merged, {
             noPrivate: args.private !== true,
             include: args.packages && args.packages.length > 0 ? args.packages : undefined,

package/lib/commands/workspace.js

@@ -1,9 +1,14 @@
-// `gjsify workspace <name> <script> [args..]` — yarn-workspace shortcut.
+// `gjsify workspace <name> [run] <script> [args..]` — yarn-workspace shortcut.
 //
 // Equivalent to `yarn workspace <name> run <script>`: locates the named
 // workspace in the current monorepo, then runs the script there. Used
 // extensively in gjsify's own root `package.json` (17 call sites).
 //
+// BOTH spellings work — the yarn-style `run` prefix is accepted and optional.
+// It is deliberately NOT the default and NOT a full CLI proxy: gjsify's command
+// names collide with the most common script names, so `workspace <name> build`
+// must keep meaning the SCRIPT. See the note at the normalization site below.
+//
 // With `--with-dependencies` / `-d` (synonym: `--topological` / `-t`) the
 // command first runs the SAME script in every transitive workspace
 // dependency, in topological build order, then in the target package.
@@ -14,7 +19,7 @@
 // <B> build && …` chains in root `build:infra` scripts: cascade build
 // failures on uninbuilt workspace deps are the single biggest local-dev
 // pain point in this monorepo.
-import { spawn } from 'node:child_process';
+import { spawnToCompletion } from '../utils/spawn.js';
 import { buildDependencyGraph, discoverWorkspaces, topologicalSort } from '@gjsify/workspace';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
 import { BuildCacheRunner, buildCacheEnabledByEnv } from '../utils/build-cache.js';
@@ -22,7 +27,7 @@ import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { suggestClosest } from '../utils/suggest.js';
 export const workspaceCommand = {
     command: 'workspace <name> <script> [args..]',
-    description: 'Run a workspace script (`yarn workspace <name> run <script>` equivalent).',
+    description: 'Run a workspace script. Both `workspace <name> <script>` and the yarn spelling `workspace <name> run <script>` work.',
     builder: (yargs) => yargs
         .positional('name', {
         description: 'Workspace name (matches package.json `name` field).',
@@ -97,10 +102,28 @@ export const workspaceCommand = {
         const verbose = args.verbose === true;
         const withDeps = args['with-dependencies'] === true;
         const continueOnError = args['continue-on-error'] === true;
+        // yarn spells this `yarn workspace <name> run <script>`, and the header
+        // comment above has always advertised that form as the equivalent — so
+        // accept it. `run` is an OPTIONAL prefix, not the default: gjsify's own
+        // command surface collides head-on with the most common script names
+        // (`build`, `check`, `test`, `install`, `publish`, `pack`, `lint`,
+        // `format`), so proxying the whole CLI the way yarn does would make
+        // `gjsify workspace <name> build` ambiguous between the build COMMAND
+        // and the build SCRIPT — and the script reading is the one every script
+        // in this repo relies on.
+        //
+        // A package with a literal `run` script stays reachable: the prefix is
+        // only consumed when something follows it (`… run build`), so a bare
+        // `gjsify workspace <name> run` still runs that package's `run` script.
+        let script = args.script;
+        let extraArgs = args.args ?? [];
+        if (script === 'run' && extraArgs.length > 0) {
+            [script, ...extraArgs] = extraArgs;
+        }
         const targetScripts = target.manifest.scripts ?? {};
-        if (typeof targetScripts[args.script] !== 'string') {
-            const scriptHint = suggestClosest(args.script, Object.keys(targetScripts));
-            console.error(`gjsify workspace: workspace "${args.name}" has no script "${args.script}"` +
+        if (typeof targetScripts[script] !== 'string') {
+            const scriptHint = suggestClosest(script, Object.keys(targetScripts));
+            console.error(`gjsify workspace: workspace "${args.name}" has no script "${script}"` +
                 (scriptHint ? ` — did you mean "${scriptHint}"?` : ''));
             // `return process.exit` — see the not-found branch above for why a
             // bare `process.exit` is unsafe under GJS.
@@ -129,26 +152,26 @@ export const workspaceCommand = {
             ? new BuildCacheRunner({
                 root,
                 workspaces: allWorkspaces,
-                script: args.script,
-                args: args.args ?? [],
+                script: script,
+                args: extraArgs,
                 targets: runList.map((w) => w.name),
             })
             : undefined;
         const failures = [];
         for (const ws of runList) {
             const scripts = ws.manifest.scripts ?? {};
-            if (typeof scripts[args.script] !== 'string') {
+            if (typeof scripts[script] !== 'string') {
                 // Skip deps that don't declare the script — mirrors
                 // `gjsify foreach`'s --if-present behaviour. The target
                 // itself was validated above; this branch only filters
                 // intermediate deps. A skipped package is also never touched
                 // by the build cache (the no-build-package safety rule).
                 if (verbose)
-                    console.error(`[${ws.name}] (no "${args.script}" script — skipping)`);
+                    console.error(`[${ws.name}] (no "${script}" script — skipping)`);
                 continue;
             }
             try {
-                await runOne(ws, args.script, args.args ?? [], runner, verbose, cache);
+                await runOne(ws, script, extraArgs, runner, verbose, cache);
             }
             catch (err) {
                 const e = err instanceof Error ? err : new Error(String(err));
@@ -230,26 +253,22 @@ async function runOne(ws, script, extraArgs, runner, verbose, cache) {
     if (verbose) {
         console.error(`[${ws.name}] $ ${runner} ${argv.join(' ')}`);
     }
-    // Default FORCE_COLOR=1 unless the user explicitly opted out (matches
-    // yarn / npm / gjsify run behaviour) — without this, tools that key
-    // on isTTY (chalk, picocolors, biome) drop colors when stdout is a
-    // pipe, including GitHub Actions where the log viewer renders ANSI
-    // fine.
-    const colorEnv = process.env.FORCE_COLOR !== undefined || process.env.NO_COLOR !== undefined ? {} : { FORCE_COLOR: '1' };
-    await new Promise((resolve, reject) => {
-        const child = spawn(runner, argv, {
-            cwd: ws.location,
-            stdio: 'inherit',
-            env: { ...process.env, ...colorEnv },
-        });
-        child.on('close', (code) => {
-            if (code === 0)
-                resolve();
-            else
-                reject(new Error(`${runner} ${argv.join(' ')} exited with code ${code}`));
-        });
-        child.on('error', reject);
+    // `completion: 'exit'` — every path out of this command's handler ends in
+    // `process.exit(…)`, which quits the GLib main loop `spawn()` arms under
+    // GJS, so the streaming async path stays safe here. See utils/spawn.ts.
+    //
+    // `color: true` defaults FORCE_COLOR=1 unless the user explicitly opted
+    // out (matches yarn / npm / gjsify run) — without it, tools that key on
+    // isTTY (chalk, picocolors, oxc) drop colors when stdout is a pipe,
+    // including GitHub Actions where the log viewer renders ANSI fine.
+    const { code } = await spawnToCompletion(runner, argv, {
+        completion: 'exit',
+        cwd: ws.location,
+        color: true,
     });
+    if (code !== 0) {
+        throw new Error(`${runner} ${argv.join(' ')} exited with code ${code}`);
+    }
     if (cache && before)
         cache.storeAfterSuccess(ws, before);
 }

package/lib/utils/bin-shim.d.ts

@@ -0,0 +1,66 @@
+/** The three sibling files a Windows bin entry consists of. */
+export interface WindowsShimFiles {
+    /** POSIX `sh` script — the extension-less `<name>` file. */
+    sh: string;
+    /** Batch file — `<name>.cmd`. */
+    cmd: string;
+    /** PowerShell script — `<name>.ps1`. */
+    ps1: string;
+}
+/** A parsed `#!` line. */
+export interface Shebang {
+    /** Leading `KEY=VALUE ` assignments from `env -S KEY=VALUE prog` (may be ''). */
+    variables: string;
+    /** The interpreter, e.g. `node` or `gjs`. */
+    prog: string;
+    /** Everything after the interpreter, e.g. ` -m` (may be ''). */
+    args: string;
+}
+/**
+ * Parse the first line of a bin file. Returns `null` when it is not a shebang
+ * — cmd-shim then treats the target as directly executable.
+ */
+export declare function parseShebang(firstLine: string): Shebang | null;
+/**
+ * Build the three Windows shim files for a package bin.
+ *
+ * @param relTargetPosix POSIX-style path from the `.bin` directory to the real
+ * bin file (i.e. `path.relative(binDir, target)` with `\` normalised to `/`).
+ * @param shebang the target's parsed `#!` line, or `null` when it has none —
+ * in which case the shims invoke the target directly, matching cmd-shim.
+ */
+export declare function buildCmdShim(relTargetPosix: string, shebang: Shebang | null): WindowsShimFiles;
+/**
+ * `.cmd` / `.ps1` companions for a launcher gjsify *generates* itself
+ * (`linkGlobalBins`, `writeWorkspaceBinShims`) rather than links.
+ *
+ * Those launchers are not a symlink to a bin with a shebang — they are a
+ * hand-written `sh` script that picks an interpreter and passes an ABSOLUTE
+ * script path. `buildCmdShim` cannot express them (it derives everything from
+ * a relative target plus a shebang), so this builds the equivalent batch /
+ * PowerShell form: optional `SET` / `$env:` assignments, then
+ * `<interpreter> [args] "<absolute target>" <argv>`.
+ *
+ * Note the interpreter is invoked by NAME (resolved through `PATH`), matching
+ * the `sh` launcher's `exec gjs`/`exec node`. A missing interpreter therefore
+ * fails the same way on every OS.
+ */
+export declare function buildLauncherShims(opts: {
+    /** Interpreter binary name, e.g. `node` or `gjs`. */
+    interpreter: string;
+    /** Arguments before the script path, e.g. `['-m']` for `gjs -m`. */
+    interpreterArgs?: readonly string[];
+    /** Absolute path of the script to run. */
+    target: string;
+    /**
+     * Search-path variables to PREPEND to before the call, preserving whatever
+     * the caller's environment already had. Rendered with each shell's own
+     * expansion syntax (`%K%` in batch, `$env:K` in PowerShell) — a plain
+     * assignment would clobber `PATH`, which on Windows is also the DLL search
+     * path the prebuilds have to be reachable through.
+     */
+    prependEnv?: Readonly<Record<string, string>>;
+}): {
+    cmd: string;
+    ps1: string;
+};