@gjsify/cli 0.22.0 → 0.24.1

package/lib/commands/run.js

@@ -342,6 +342,17 @@ async function runScript(script, extraArgs, cwd = process.cwd()) {
         process.env.npm_package_version = env.npm_package_version;
         if (env.FORCE_COLOR !== undefined)
             process.env.FORCE_COLOR = env.FORCE_COLOR;
+        // Track the failure LOCALLY rather than through `process.exitCode`.
+        // Under GJS `process.exit()` is deferred (see the note below), so the
+        // `process.exit(1)` that used to live in the catch returned instead of
+        // terminating, execution fell through to the exit-code line below, and
+        // whatever that computed WON. The dispatched command's failure was then
+        // reported as success: `gjsify run build:gjsify` exited 0 while the
+        // `gjsify build` it dispatched exited 1, so `gjsify onboard` happily
+        // published a package whose build had just failed. Anything chaining on
+        // `gjsify run <script>` — every `a && b` build script, CI, onboard —
+        // got a false green from it.
+        let dispatchFailed = false;
         try {
             // Dynamic import to avoid a static cli-app ↔ run.ts import cycle;
             // cli-app is already loaded (the CLI is running through it), so this
@@ -351,21 +362,22 @@ async function runScript(script, extraArgs, cwd = process.cwd()) {
         }
         catch (err) {
             console.error(err.message);
-            process.exit(1);
+            dispatchFailed = true;
         }
-        // Honor a non-zero `process.exitCode` set by the dispatched handler
-        // (e.g. a failing check that sets the code instead of exiting) —
-        // a bare exit(0) here masked such failures as success.
-        process.exit(process.exitCode != null ? Number(process.exitCode) : 0);
-        // `process.exit()` under GJS is NOT synchronous — with the GLib main
-        // loop armed (`ensureMainLoop`, e.g. by a bundle the in-process dispatch
-        // just ran) it defers the actual teardown, so execution CONTINUES past
-        // the call. Without this `return` the function falls through to the
-        // shell-spawn fallback below and runs the SAME command a SECOND time
-        // (the double-execution bug). Mirrors the file-mode path's `return`
-        // after `runGjsBundle`. Keep both — the return is the real guard, the
-        // exit sets the status code for when the loop finally unwinds.
-        return;
+        // A thrown command wins over `process.exitCode`; otherwise honour a
+        // non-zero code the handler set instead of throwing (e.g. a failing
+        // check) — a bare exit(0) here masked those as success too.
+        const dispatchCode = dispatchFailed ? 1 : process.exitCode != null ? Number(process.exitCode) : 0;
+        // `return process.exit(…)`, never a bare call. Under GJS `process.exit()`
+        // is NOT synchronous — with the GLib main loop armed (`ensureMainLoop`,
+        // e.g. by a bundle the in-process dispatch just ran) it defers the
+        // actual teardown and RETURNS, so execution continues past the call.
+        // Without the `return` the function falls through to the shell-spawn
+        // fallback below and runs the SAME command a SECOND time (the
+        // double-execution bug). Mirrors the file-mode path's `return` after
+        // `runGjsBundle`. The return is the real guard; the exit sets the status
+        // code for when the loop finally unwinds.
+        return process.exit(dispatchCode);
     }
     const fullCmd = extraArgs.length > 0 ? `${literal} ${extraArgs.map(shellEscape).join(' ')}` : literal;
     // ensureMainLoop() (called inside spawn) keeps GJS alive after the

package/lib/commands/showcase.js

@@ -7,8 +7,7 @@ import { ensurePkgDir } from './dlx.js';
 import { parseSpec } from '../utils/parse-spec.js';
 import { resolveNodeEntry } from '../utils/resolve-gjs-entry.js';
 import { runRuntimeBundle } from '../utils/run-node.js';
-import { hostRuntime } from '@gjsify/rolldown-plugin-gjsify/runtime';
-import { EXAMPLE_RUNTIMES, isExampleRuntime, readDeclaredRuntimes, checkRuntimeSupported, } from '../utils/runtimes.js';
+import { EXAMPLE_RUNTIMES, isExampleRuntime, readDeclaredRuntimes, checkRuntimeSupported, defaultExampleRuntime, } from '../utils/runtimes.js';
 function readCliVersion() {
     try {
         const pkgUrl = new URL('../../package.json', import.meta.url);
@@ -38,18 +37,23 @@ export const showcaseCommand = {
         default: false,
     })
         .option('runtime', {
-        // Runtime selector, mirroring `gjsify storybook --runtime`. The
-        // default FOLLOWS the host runtime the CLI executes in (gjs under
-        // gjs, node under node/bun/deno). gjs runs the showcase's GJS
-        // bundle via `gjsify dlx`; node/bun/deno run its `--app node`
-        // bundle on that runtime. Validated against the showcase's
-        // declared `gjsify.example.runtimes` — a GTK-only showcase
-        // requested under node fails with a clear message, not a crash.
+        // Runtime selector, mirroring `gjsify storybook --runtime`. gjs
+        // runs the showcase's GJS bundle via `gjsify dlx`; node/bun/deno
+        // run its `--app node` bundle on that runtime. Validated against
+        // the showcase's declared `gjsify.example.runtimes` — a GTK-only
+        // showcase requested under node fails with a clear message, not
+        // a crash.
+        //
+        // NO eager yargs `default:` — it is resolved in the handler via
+        // `defaultExampleRuntime()` (gjs when gjs is installed, else the
+        // host runtime). Two reasons: yargs evaluates a `default:` while
+        // BUILDING the command, before we know a showcase was even
+        // named, and resolving it probes PATH — work that must not
+        // happen for `gjsify showcase` in list mode.
         type: 'string',
         choices: EXAMPLE_RUNTIMES,
-        default: hostRuntime(),
-        defaultDescription: 'host runtime (gjs on gjs, else node/bun/deno)',
-        description: 'Runtime to run the showcase on: gjs | node | bun | deno (default: the host runtime). node/bun/deno run its `--app node` bundle.',
+        defaultDescription: 'gjs when gjs is installed, else the host runtime',
+        description: 'Runtime to run the showcase on: gjs | node | bun | deno (default: gjs when installed, else the host runtime). node/bun/deno run its `--app node` bundle.',
     }),
     handler: async (args) => {
         // List mode: no name given, or --list flag
@@ -116,7 +120,7 @@ export const showcaseCommand = {
             // `return` — bare `process.exit` falls through under GJS (see above).
             return process.exit(1);
         }
-        const runtime = (args.runtime ?? hostRuntime());
+        const runtime = (args.runtime ?? defaultExampleRuntime());
         if (!isExampleRuntime(runtime)) {
             console.error(`Unknown --runtime "${runtime}" (expected: ${EXAMPLE_RUNTIMES.join(', ')}).`);
             // `return` — bare `process.exit` falls through under GJS (see above).

package/lib/commands/storybook.js

@@ -181,9 +181,12 @@ export const storybookCommand = {
             // typelib env wired like `gjsify run`. All three need @gjsify/node-gi
             // (the storybook uses gi://), kept external by the bundler.
             const { computeNativeEnvForBundle } = await import('../utils/run-gjs.js');
-            const { resolveNodeGi, nodeBinary } = await import('../utils/run-node.js');
+            const { resolveNodeGiForBundle, nodeBinary } = await import('../utils/run-node.js');
             const { RUNTIMES } = await import('../utils/runtimes.js');
-            if (!resolveNodeGi(cwd)) {
+            // Same resolution base as `runRuntimeBundle`: the bundle's own dir
+            // first (that is where the runtime resolves the external specifier
+            // from), cwd as the fallback.
+            if (!resolveNodeGiForBundle(outPath, cwd)) {
                 throw new Error(`Cannot run the storybook on ${runtime}: \`@gjsify/node-gi\` is not installed. ` +
                     `Add @gjsify/node-gi as a dependency to run the storybook on ${runtime}.`);
             }

package/lib/commands/trust.js

@@ -16,70 +16,14 @@
 //
 // Reference: refs/npm-cli/lib/trust-cmd.js + lib/commands/trust/github.js.
 import { spawnSync } from 'node:child_process';
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm-registry';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
+import { mergePublishables } from '../utils/publishable-packages.js';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider, withOtpRetry } from '../utils/npm-otp.js';
 import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
-/**
- * Publishable packages under `packages/node-gi/*` that are NOT root workspaces
- * (the workspaces glob excludes `packages/node-gi/*`) yet publish via release.yml —
- * `@gjsify/node-gi` + the `@gjsify/gtk-runtime-*` bundles. `discoverWorkspaces`
- * misses them, so `gjsify trust` would never configure their Trusted Publisher.
- * Enumerate them here as Workspace-shaped entries so the sweep covers them too.
- * Best-effort: a missing dir / unreadable manifest is simply skipped.
- */
-function discoverNodeGiPublishables(cwd) {
-    // Walk up from cwd to the repo root — the dir that holds `packages/node-gi` —
-    // so the command works from the root or any subdirectory.
-    let root = cwd;
-    for (let i = 0; i < 8; i++) {
-        if (existsSync(join(root, 'packages', 'node-gi')))
-            break;
-        const parent = dirname(root);
-        if (parent === root)
-            return [];
-        root = parent;
-    }
-    const base = join(root, 'packages', 'node-gi');
-    if (!existsSync(base))
-        return [];
-    const out = [];
-    let entries;
-    try {
-        entries = readdirSync(base, { withFileTypes: true });
-    }
-    catch {
-        return [];
-    }
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const location = join(base, entry.name);
-        const pkgPath = join(location, 'package.json');
-        if (!existsSync(pkgPath))
-            continue;
-        try {
-            const manifest = JSON.parse(readFileSync(pkgPath, 'utf8'));
-            if (!manifest || typeof manifest.name !== 'string' || manifest.name.length === 0)
-                continue;
-            out.push({
-                location,
-                relativeLocation: join('packages', 'node-gi', entry.name),
-                name: manifest.name,
-                version: typeof manifest.version === 'string' ? manifest.version : '0.0.0',
-                manifest,
-                private: manifest.private === true,
-            });
-        }
-        catch {
-            /* unreadable / malformed — skip */
-        }
-    }
-    return out;
-}
 export const trustCommand = {
     command: 'trust [packages..]',
     description: 'Configure npm Trusted Publishers (OIDC/GitHub Actions) for publishable workspace packages so release.yml can publish without a token. Native — no `npm` needed. Incremental: skips already-configured packages.',
@@ -197,9 +141,7 @@ export const trustCommand = {
         // which publish via release.yml but are NOT root workspaces, so
         // discoverWorkspaces misses them and their Trusted Publisher would never get
         // configured. Dedup by name so a real workspace always wins.
-        const workspaceNames = new Set(all.map((ws) => ws.name));
-        const extra = discoverNodeGiPublishables(cwd).filter((ws) => !workspaceNames.has(ws.name));
-        const merged = [...all, ...extra];
+        const merged = mergePublishables(all, cwd);
         const selected = filterWorkspaces(merged, {
             noPrivate: args.private !== true,
             include: args.packages && args.packages.length > 0 ? args.packages : undefined,

package/lib/commands/workspace.js

@@ -1,9 +1,14 @@
-// `gjsify workspace <name> <script> [args..]` — yarn-workspace shortcut.
+// `gjsify workspace <name> [run] <script> [args..]` — yarn-workspace shortcut.
 //
 // Equivalent to `yarn workspace <name> run <script>`: locates the named
 // workspace in the current monorepo, then runs the script there. Used
 // extensively in gjsify's own root `package.json` (17 call sites).
 //
+// BOTH spellings work — the yarn-style `run` prefix is accepted and optional.
+// It is deliberately NOT the default and NOT a full CLI proxy: gjsify's command
+// names collide with the most common script names, so `workspace <name> build`
+// must keep meaning the SCRIPT. See the note at the normalization site below.
+//
 // With `--with-dependencies` / `-d` (synonym: `--topological` / `-t`) the
 // command first runs the SAME script in every transitive workspace
 // dependency, in topological build order, then in the target package.
@@ -14,7 +19,7 @@
 // <B> build && …` chains in root `build:infra` scripts: cascade build
 // failures on uninbuilt workspace deps are the single biggest local-dev
 // pain point in this monorepo.
-import { spawn } from 'node:child_process';
+import { spawnToCompletion } from '../utils/spawn.js';
 import { buildDependencyGraph, discoverWorkspaces, topologicalSort } from '@gjsify/workspace';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
 import { BuildCacheRunner, buildCacheEnabledByEnv } from '../utils/build-cache.js';
@@ -22,7 +27,7 @@ import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { suggestClosest } from '../utils/suggest.js';
 export const workspaceCommand = {
     command: 'workspace <name> <script> [args..]',
-    description: 'Run a workspace script (`yarn workspace <name> run <script>` equivalent).',
+    description: 'Run a workspace script. Both `workspace <name> <script>` and the yarn spelling `workspace <name> run <script>` work.',
     builder: (yargs) => yargs
         .positional('name', {
         description: 'Workspace name (matches package.json `name` field).',
@@ -97,10 +102,28 @@ export const workspaceCommand = {
         const verbose = args.verbose === true;
         const withDeps = args['with-dependencies'] === true;
         const continueOnError = args['continue-on-error'] === true;
+        // yarn spells this `yarn workspace <name> run <script>`, and the header
+        // comment above has always advertised that form as the equivalent — so
+        // accept it. `run` is an OPTIONAL prefix, not the default: gjsify's own
+        // command surface collides head-on with the most common script names
+        // (`build`, `check`, `test`, `install`, `publish`, `pack`, `lint`,
+        // `format`), so proxying the whole CLI the way yarn does would make
+        // `gjsify workspace <name> build` ambiguous between the build COMMAND
+        // and the build SCRIPT — and the script reading is the one every script
+        // in this repo relies on.
+        //
+        // A package with a literal `run` script stays reachable: the prefix is
+        // only consumed when something follows it (`… run build`), so a bare
+        // `gjsify workspace <name> run` still runs that package's `run` script.
+        let script = args.script;
+        let extraArgs = args.args ?? [];
+        if (script === 'run' && extraArgs.length > 0) {
+            [script, ...extraArgs] = extraArgs;
+        }
         const targetScripts = target.manifest.scripts ?? {};
-        if (typeof targetScripts[args.script] !== 'string') {
-            const scriptHint = suggestClosest(args.script, Object.keys(targetScripts));
-            console.error(`gjsify workspace: workspace "${args.name}" has no script "${args.script}"` +
+        if (typeof targetScripts[script] !== 'string') {
+            const scriptHint = suggestClosest(script, Object.keys(targetScripts));
+            console.error(`gjsify workspace: workspace "${args.name}" has no script "${script}"` +
                 (scriptHint ? ` — did you mean "${scriptHint}"?` : ''));
             // `return process.exit` — see the not-found branch above for why a
             // bare `process.exit` is unsafe under GJS.
@@ -129,26 +152,26 @@ export const workspaceCommand = {
             ? new BuildCacheRunner({
                 root,
                 workspaces: allWorkspaces,
-                script: args.script,
-                args: args.args ?? [],
+                script: script,
+                args: extraArgs,
                 targets: runList.map((w) => w.name),
             })
             : undefined;
         const failures = [];
         for (const ws of runList) {
             const scripts = ws.manifest.scripts ?? {};
-            if (typeof scripts[args.script] !== 'string') {
+            if (typeof scripts[script] !== 'string') {
                 // Skip deps that don't declare the script — mirrors
                 // `gjsify foreach`'s --if-present behaviour. The target
                 // itself was validated above; this branch only filters
                 // intermediate deps. A skipped package is also never touched
                 // by the build cache (the no-build-package safety rule).
                 if (verbose)
-                    console.error(`[${ws.name}] (no "${args.script}" script — skipping)`);
+                    console.error(`[${ws.name}] (no "${script}" script — skipping)`);
                 continue;
             }
             try {
-                await runOne(ws, args.script, args.args ?? [], runner, verbose, cache);
+                await runOne(ws, script, extraArgs, runner, verbose, cache);
             }
             catch (err) {
                 const e = err instanceof Error ? err : new Error(String(err));
@@ -230,26 +253,22 @@ async function runOne(ws, script, extraArgs, runner, verbose, cache) {
     if (verbose) {
         console.error(`[${ws.name}] $ ${runner} ${argv.join(' ')}`);
     }
-    // Default FORCE_COLOR=1 unless the user explicitly opted out (matches
-    // yarn / npm / gjsify run behaviour) — without this, tools that key
-    // on isTTY (chalk, picocolors, biome) drop colors when stdout is a
-    // pipe, including GitHub Actions where the log viewer renders ANSI
-    // fine.
-    const colorEnv = process.env.FORCE_COLOR !== undefined || process.env.NO_COLOR !== undefined ? {} : { FORCE_COLOR: '1' };
-    await new Promise((resolve, reject) => {
-        const child = spawn(runner, argv, {
-            cwd: ws.location,
-            stdio: 'inherit',
-            env: { ...process.env, ...colorEnv },
-        });
-        child.on('close', (code) => {
-            if (code === 0)
-                resolve();
-            else
-                reject(new Error(`${runner} ${argv.join(' ')} exited with code ${code}`));
-        });
-        child.on('error', reject);
+    // `completion: 'exit'` — every path out of this command's handler ends in
+    // `process.exit(…)`, which quits the GLib main loop `spawn()` arms under
+    // GJS, so the streaming async path stays safe here. See utils/spawn.ts.
+    //
+    // `color: true` defaults FORCE_COLOR=1 unless the user explicitly opted
+    // out (matches yarn / npm / gjsify run) — without it, tools that key on
+    // isTTY (chalk, picocolors, oxc) drop colors when stdout is a pipe,
+    // including GitHub Actions where the log viewer renders ANSI fine.
+    const { code } = await spawnToCompletion(runner, argv, {
+        completion: 'exit',
+        cwd: ws.location,
+        color: true,
     });
+    if (code !== 0) {
+        throw new Error(`${runner} ${argv.join(' ')} exited with code ${code}`);
+    }
     if (cache && before)
         cache.storeAfterSuccess(ws, before);
 }

package/lib/utils/bin-shim.d.ts

@@ -0,0 +1,66 @@
+/** The three sibling files a Windows bin entry consists of. */
+export interface WindowsShimFiles {
+    /** POSIX `sh` script — the extension-less `<name>` file. */
+    sh: string;
+    /** Batch file — `<name>.cmd`. */
+    cmd: string;
+    /** PowerShell script — `<name>.ps1`. */
+    ps1: string;
+}
+/** A parsed `#!` line. */
+export interface Shebang {
+    /** Leading `KEY=VALUE ` assignments from `env -S KEY=VALUE prog` (may be ''). */
+    variables: string;
+    /** The interpreter, e.g. `node` or `gjs`. */
+    prog: string;
+    /** Everything after the interpreter, e.g. ` -m` (may be ''). */
+    args: string;
+}
+/**
+ * Parse the first line of a bin file. Returns `null` when it is not a shebang
+ * — cmd-shim then treats the target as directly executable.
+ */
+export declare function parseShebang(firstLine: string): Shebang | null;
+/**
+ * Build the three Windows shim files for a package bin.
+ *
+ * @param relTargetPosix POSIX-style path from the `.bin` directory to the real
+ * bin file (i.e. `path.relative(binDir, target)` with `\` normalised to `/`).
+ * @param shebang the target's parsed `#!` line, or `null` when it has none —
+ * in which case the shims invoke the target directly, matching cmd-shim.
+ */
+export declare function buildCmdShim(relTargetPosix: string, shebang: Shebang | null): WindowsShimFiles;
+/**
+ * `.cmd` / `.ps1` companions for a launcher gjsify *generates* itself
+ * (`linkGlobalBins`, `writeWorkspaceBinShims`) rather than links.
+ *
+ * Those launchers are not a symlink to a bin with a shebang — they are a
+ * hand-written `sh` script that picks an interpreter and passes an ABSOLUTE
+ * script path. `buildCmdShim` cannot express them (it derives everything from
+ * a relative target plus a shebang), so this builds the equivalent batch /
+ * PowerShell form: optional `SET` / `$env:` assignments, then
+ * `<interpreter> [args] "<absolute target>" <argv>`.
+ *
+ * Note the interpreter is invoked by NAME (resolved through `PATH`), matching
+ * the `sh` launcher's `exec gjs`/`exec node`. A missing interpreter therefore
+ * fails the same way on every OS.
+ */
+export declare function buildLauncherShims(opts: {
+    /** Interpreter binary name, e.g. `node` or `gjs`. */
+    interpreter: string;
+    /** Arguments before the script path, e.g. `['-m']` for `gjs -m`. */
+    interpreterArgs?: readonly string[];
+    /** Absolute path of the script to run. */
+    target: string;
+    /**
+     * Search-path variables to PREPEND to before the call, preserving whatever
+     * the caller's environment already had. Rendered with each shell's own
+     * expansion syntax (`%K%` in batch, `$env:K` in PowerShell) — a plain
+     * assignment would clobber `PATH`, which on Windows is also the DLL search
+     * path the prebuilds have to be reachable through.
+     */
+    prependEnv?: Readonly<Record<string, string>>;
+}): {
+    cmd: string;
+    ps1: string;
+};