@gjsify/cli 0.49.0 → 0.50.0

package/lib/actions/barrels-generate.d.ts

@@ -21,9 +21,31 @@ export interface BarrelsArgs {
 }
 export declare const DEFAULT_BARRELS_HEADER = "// Auto-generated by `gjsify barrels` \u2014 do not edit by hand.";
 export declare const DEFAULT_BARRELS_EXCLUDES: readonly string[];
+/**
+ * The entries of `paths` that cannot be scanned as a directory, resolved against `baseDir`
+ * — each already phrased for printing.
+ *
+ * A SEPARATE pass rather than a behaviour change inside {@link generateBarrels}, because
+ * the two callers want opposite things. A programmatic caller may legitimately hand the
+ * generator a directory that is not there yet and still want the others written, which is
+ * why it skips; a COMMAND-LINE caller named these directories, so one that cannot be read
+ * is a typo or a rename and nothing else. So the command asserts first — the shape
+ * `assertEveryIncludeMatches` already has for `gjsify foreach --include`.
+ *
+ * THE INCIDENT: `gjsify barrels --check` counted a directory it could not read as 0 drift
+ * and exited 0, so the guard reported a clean barrel for a directory nothing had looked
+ * at, and the only trace was a line printed under `--verbose`. "Skipped" and "in sync"
+ * have to be told apart by the exit code — a guard that goes green for work it never did
+ * is worse than no guard, because a later step is measuring its output.
+ */
+export declare function unscannableBarrelPaths(baseDir: string, paths: readonly string[]): Promise<string[]>;
 /**
  * Regenerate `index.ts` in every directory in `args.paths`.
  *
+ * A path that cannot be read is SKIPPED here, deliberately — see
+ * {@link unscannableBarrelPaths} for who refuses it instead, and why that is the command
+ * and not this.
+ *
  * Returns the number of files that drifted from the canonical output —
  * always 0 when `check` is false (drift is rewritten in-place); non-zero
  * under `check: true` signals CI failure.

package/lib/actions/barrels-generate.js

@@ -12,14 +12,49 @@
 //
 // Original: Copyright (c) Beabee Community Repo contributors. AGPL-3.0.
 // Reimplemented for gjsify under the project's MIT license.
-import { readdir, readFile, writeFile } from 'node:fs/promises';
+import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { basename, extname, join, resolve } from 'node:path';
 export const DEFAULT_BARRELS_HEADER = '// Auto-generated by `gjsify barrels` — do not edit by hand.';
 export const DEFAULT_BARRELS_EXCLUDES = ['\\.test\\.', '\\.spec\\.', '\\.test-data\\.'];
 const SOURCE_FILE_RE = /\.(ts|tsx|mts|cts)$/;
+/**
+ * The entries of `paths` that cannot be scanned as a directory, resolved against `baseDir`
+ * — each already phrased for printing.
+ *
+ * A SEPARATE pass rather than a behaviour change inside {@link generateBarrels}, because
+ * the two callers want opposite things. A programmatic caller may legitimately hand the
+ * generator a directory that is not there yet and still want the others written, which is
+ * why it skips; a COMMAND-LINE caller named these directories, so one that cannot be read
+ * is a typo or a rename and nothing else. So the command asserts first — the shape
+ * `assertEveryIncludeMatches` already has for `gjsify foreach --include`.
+ *
+ * THE INCIDENT: `gjsify barrels --check` counted a directory it could not read as 0 drift
+ * and exited 0, so the guard reported a clean barrel for a directory nothing had looked
+ * at, and the only trace was a line printed under `--verbose`. "Skipped" and "in sync"
+ * have to be told apart by the exit code — a guard that goes green for work it never did
+ * is worse than no guard, because a later step is measuring its output.
+ */
+export async function unscannableBarrelPaths(baseDir, paths) {
+    const problems = [];
+    for (const p of paths) {
+        const dir = resolve(baseDir, p);
+        try {
+            if (!(await stat(dir)).isDirectory())
+                problems.push(`${dir} is not a directory`);
+        }
+        catch (err) {
+            problems.push(`${dir}: ${err.message}`);
+        }
+    }
+    return problems;
+}
 /**
  * Regenerate `index.ts` in every directory in `args.paths`.
  *
+ * A path that cannot be read is SKIPPED here, deliberately — see
+ * {@link unscannableBarrelPaths} for who refuses it instead, and why that is the command
+ * and not this.
+ *
  * Returns the number of files that drifted from the canonical output —
  * always 0 when `check` is false (drift is rewritten in-place); non-zero
  * under `check: true` signals CI failure.

package/lib/actions/build.js

@@ -15,6 +15,7 @@ import { collectEntryPaths, describeJsxConfig, findJsxEntryPoint, jsxConfigMissi
 import { giSystemProbes } from '../utils/gi-runtime-paths.js';
 import { escapeRawNulForGjs } from '../utils/gjs-source-escape.js';
 import { assertNodeBundleGlobalsShimmed } from '../utils/node-bundle-guard.js';
+import { DEP_CHANGE_LOCKFILES } from '../utils/package-inputs.js';
 const DEFAULT_GJS_SHEBANG = '#!/usr/bin/env -S gjs -m';
 /**
  * `true` when `path` points at a location that's unsafe to use as a build
@@ -59,16 +60,18 @@ function isTruthyEnv(v) {
     return v === '1' || v === 'true' || v === 'yes';
 }
 /**
- * Lockfiles whose change implies a plugin's *transitive* deps may have moved.
+ * Newest mtime (ms) among known lockfiles in `cwd`, or 0 when none exist.
+ *
  * A dep bump (`npm/yarn/pnpm/gjsify install`) rewrites one of these but leaves
  * the plugin's own entry-file mtime untouched — so the plugin GJS-bundle cache
- * must invalidate on these too, not only on the entry.
+ * must invalidate on them too, not only on the entry. The LIST is
+ * {@link DEP_CHANGE_LOCKFILES}, shared with the package-input definition: two
+ * answers to "has the dependency tree moved" is how they come to disagree
+ * about a fifth package manager.
  */
-const PLUGIN_CACHE_DEP_SIGNALS = ['gjsify-lock.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'];
-/** Newest mtime (ms) among known lockfiles in `cwd`, or 0 when none exist. */
 async function newestLockfileMtime(cwd) {
     let newest = 0;
-    for (const name of PLUGIN_CACHE_DEP_SIGNALS) {
+    for (const name of DEP_CHANGE_LOCKFILES) {
         try {
             const s = await stat(join(cwd, name));
             if (s.mtimeMs > newest)

package/lib/commands/barrels.js

@@ -13,7 +13,10 @@
 //     file as a module.
 //   - Output is sorted by file name (locale-compare) — deterministic diffs.
 //   - `--check` exits non-zero on drift without writing (pre-commit / CI use).
-import { DEFAULT_BARRELS_EXCLUDES, DEFAULT_BARRELS_HEADER, generateBarrels, } from '../actions/barrels-generate.js';
+//   - A named path that is not a readable directory is REFUSED before anything
+//     is generated: skipping it would let `--check` report 0 drift, and exit 0,
+//     for a barrel nothing ever looked at.
+import { DEFAULT_BARRELS_EXCLUDES, DEFAULT_BARRELS_HEADER, generateBarrels, unscannableBarrelPaths, } from '../actions/barrels-generate.js';
 export const barrelsCommand = {
     command: 'barrels [paths..]',
     description: 'Regenerate `index.ts` barrel files for the given directories. Drop-in replacement for `barrelsby`.',
@@ -81,13 +84,27 @@ export const barrelsCommand = {
             process.exitCode = 1;
             return;
         }
+        const baseDir = args.baseDir ?? process.cwd();
+        // A named path this cannot scan is a typo or a rename, and it is refused BEFORE
+        // anything is generated. The generator skips such a path and reports no drift for
+        // it, which under `--check` is a guard going green for a directory nothing looked
+        // at — the one failure mode a guard must not have.
+        const unscannable = await unscannableBarrelPaths(baseDir, paths);
+        if (unscannable.length > 0) {
+            for (const problem of unscannable)
+                console.error(`[gjsify barrels] cannot scan ${problem}`);
+            console.error(`[gjsify barrels] ${unscannable.length} of ${paths.length} path(s) could not be scanned — ` +
+                'refusing to report on the rest as if that were the whole set.');
+            process.exitCode = 1;
+            return;
+        }
         const excludePatterns = args.exclude?.length
             ? args.exclude
             : [...DEFAULT_BARRELS_EXCLUDES];
         const drift = await generateBarrels({
             paths,
             extension: args.ext ?? 'none',
-            baseDir: args.baseDir ?? process.cwd(),
+            baseDir,
             exclude: excludePatterns.map((src) => new RegExp(src)),
             header: args.header ?? DEFAULT_BARRELS_HEADER,
             noSemicolon: args.semicolon === false || args.semicolon === undefined,

package/lib/commands/foreach.js

@@ -583,25 +583,17 @@ async function runParallel(workspaces, script, args, concurrency, verbose, exec,
     await Promise.all(workers);
 }
 async function runTopologicalParallel(workspaces, script, args, concurrency, verbose, includeDev, exec, cache) {
-    const selectedNames = new Set(workspaces.map((w) => w.name));
-    const remaining = new Map();
-    for (const ws of workspaces) {
-        const wsDeps = new Set();
-        const m = ws.manifest;
-        for (const block of [m.dependencies, includeDev ? m.devDependencies : undefined, m.optionalDependencies]) {
-            if (!block)
-                continue;
-            for (const [name, spec] of Object.entries(block)) {
-                if (typeof spec !== 'string')
-                    continue;
-                if (!spec.startsWith('workspace:'))
-                    continue;
-                if (selectedNames.has(name))
-                    wsDeps.add(name);
-            }
-        }
-        remaining.set(ws.name, wsDeps);
-    }
+    // The SHARED graph, walked once — never a private copy of the walk. `buildDependencyGraph`
+    // over the SELECTED set yields exactly these edges: it indexes by name from the list it is
+    // handed, so a dependency outside the selection resolves to no member and is not an edge.
+    //
+    // The copy this replaces followed `workspace:` only. Once #1587 widened the shared rule to
+    // include a plain range the local member satisfies, the two topological legs would have
+    // DISAGREED — `-t` ordering correctly off the shared graph while `-t -p` saw no edges at
+    // all and started every workspace at once, in a monorepo that declares its local deps by
+    // plain semver range. Wrong order, exit 0, and a build measured by a later step: the same
+    // shape #1587 is about, one flag over.
+    const remaining = new Map([...buildDependencyGraph(workspaces, { includeDev }).edges].map(([name, deps]) => [name, new Set(deps)]));
     const byName = new Map(workspaces.map((w) => [w.name, w]));
     const total = workspaces.length;
     const done = new Set();

package/lib/commands/test.d.ts

@@ -9,4 +9,20 @@ interface TestOptions {
     verbose?: boolean;
 }
 export declare const testCommand: Command<unknown, TestOptions>;
+/**
+ * True when `outfile` is at least as new as every build input of the package
+ * at `cwd`.
+ *
+ * The set is {@link packageBuildInputs}, the same one the build cache hashes.
+ * It used to be `dirname(entry)` — `tests/` for any package whose suite lives
+ * there, so `src/**` was never walked: a change to the code UNDER TEST left
+ * the bundle "fresh" and `gjsify test` reran the previous build and reported
+ * on it. That went both ways inside one dependency bump — a green run
+ * measuring a version that was no longer installed, then a red one after the
+ * source had already been repaired (#1651).
+ *
+ * `outdir` is subtracted as this command's own output; `entry` is added
+ * because `--entry ../shared/test.mts` may point outside the package.
+ */
+export declare function isFresh(outfile: string, entry: string, cwd: string, outdir: string): boolean;
 export {};

package/lib/commands/test.js

@@ -5,8 +5,9 @@
 // just needs `src/test.mts` aggregating its `@gjsify/unit` suites; this
 // command builds it for GJS + Node and runs each output, aggregating
 // exit codes.
-import { existsSync, statSync, readdirSync } from 'node:fs';
-import { join, dirname, resolve, relative } from 'node:path';
+import { existsSync, statSync } from 'node:fs';
+import { join, resolve, relative, sep } from 'node:path';
+import { newestDepSignalMtimeMs, newestInputMtimeMs, packageBuildInputs } from '../utils/package-inputs.js';
 import { isRuntimeAvailable, RUNTIMES } from '../utils/runtimes.js';
 import { nodeBinary } from '../utils/run-node.js';
 import { describeExit, spawnToCompletion } from '../utils/spawn.js';
@@ -99,7 +100,7 @@ export const testCommand = {
             const outfile = join(outdir, `test.${runtime}.mjs`);
             // Build stage (skip if --no-build OR (not --rebuild AND outfile fresher than src)).
             if (args.build !== false) {
-                const needsBuild = args.rebuild || !isFresh(outfile, entry);
+                const needsBuild = args.rebuild || !isFresh(outfile, entry, cwd, outdir);
                 if (needsBuild) {
                     const buildStart = Date.now();
                     if (args.verbose) {
@@ -204,16 +205,35 @@ async function runTestBundle(outfile, runtime) {
     if (result.code !== 0)
         throw new Error(`node exited with ${describeExit(result)}`);
 }
-/** True when `outfile` exists and is newer than every `.ts`/`.mts` file under the entry's directory tree. */
-function isFresh(outfile, entry) {
+/**
+ * True when `outfile` is at least as new as every build input of the package
+ * at `cwd`.
+ *
+ * The set is {@link packageBuildInputs}, the same one the build cache hashes.
+ * It used to be `dirname(entry)` — `tests/` for any package whose suite lives
+ * there, so `src/**` was never walked: a change to the code UNDER TEST left
+ * the bundle "fresh" and `gjsify test` reran the previous build and reported
+ * on it. That went both ways inside one dependency bump — a green run
+ * measuring a version that was no longer installed, then a red one after the
+ * source had already been repaired (#1651).
+ *
+ * `outdir` is subtracted as this command's own output; `entry` is added
+ * because `--entry ../shared/test.mts` may point outside the package.
+ */
+export function isFresh(outfile, entry, cwd, outdir) {
     if (!existsSync(outfile))
         return false;
-    const outMtime = statSync(outfile).mtimeMs;
-    const srcRoot = dirname(entry);
-    // Conservative: walk the src tree once. If the package has no `src/`,
-    // fall back to entry-only check.
     try {
-        const newest = newestMtimeUnder(existsSync(srcRoot) ? srcRoot : entry);
+        const outMtime = statSync(outfile).mtimeMs;
+        const extraOutputs = [];
+        const outdirRel = relative(cwd, outdir).split(sep).join('/');
+        if (outdirRel !== '' && !outdirRel.startsWith('../'))
+            extraOutputs.push(outdirRel);
+        const newest = Math.max(newestInputMtimeMs(packageBuildInputs(cwd, { extraOutputs })), statSync(entry).mtimeMs, 
+        // A dependency bump changes no file in the package — and that is
+        // the shape #1651 was found in. `node_modules` is far too large
+        // to stat per run, so the lockfile stands in for it.
+        newestDepSignalMtimeMs(cwd));
         return outMtime >= newest;
     }
     catch {
@@ -221,22 +241,3 @@ function isFresh(outfile, entry) {
         return false;
     }
 }
-function newestMtimeUnder(path) {
-    const st = statSync(path);
-    if (st.isFile())
-        return st.mtimeMs;
-    let max = st.mtimeMs;
-    for (const entry of readdirSync(path, { withFileTypes: true })) {
-        if (entry.name === 'node_modules' ||
-            entry.name === 'dist' ||
-            entry.name === 'lib' ||
-            entry.name.startsWith('.')) {
-            continue;
-        }
-        const child = join(path, entry.name);
-        const m = newestMtimeUnder(child);
-        if (m > max)
-            max = m;
-    }
-    return max;
-}

package/lib/commands/workspace.js

@@ -14,13 +14,16 @@
 // dependency, in topological build order, then in the target package.
 // Skips deps that don't declare the script (`--if-present` behaviour).
 // Stops on the first failure unless `--continue-on-error` is passed.
+// A local dependency counts whether it is declared with the `workspace:`
+// protocol or with a plain range the local member satisfies (@gjsify/workspace
+// § buildDependencyGraph) — and the expansion SAYS when it found nothing.
 //
 // This replaces the manual `gjsify workspace <A> build && gjsify workspace
 // <B> build && …` chains in root `build:infra` scripts: cascade build
 // failures on uninbuilt workspace deps are the single biggest local-dev
 // pain point in this monorepo.
 import { spawnToCompletion } from '../utils/spawn.js';
-import { buildDependencyGraph, discoverWorkspaces, topologicalSort } from '@gjsify/workspace';
+import { affectedClosure, buildDependencyGraph, discoverWorkspaces, topologicalSort, } from '@gjsify/workspace';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
 import { BuildCacheRunner, buildCacheEnabledByEnv } from '../utils/build-cache.js';
 import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';
@@ -135,11 +138,29 @@ export const workspaceCommand = {
         // target itself.
         let runList;
         if (withDeps) {
-            const closure = collectTransitiveClosure(target, allWorkspaces, args['include-dev'] === true);
-            // Sort the closure topologically using the shared @gjsify/workspace
-            // algorithm — same code path that drives `gjsify foreach -t`.
-            const graph = buildDependencyGraph(closure, { includeDev: args['include-dev'] === true });
+            const includeDev = args['include-dev'] === true;
+            // The SHARED graph, walked by the shared closure — the same two calls
+            // `gjsify foreach --with-dependencies` makes. This used to be a private
+            // copy of the walk here, and the copy is where the defect lived: it
+            // followed `workspace:` edges only, so in a monorepo declaring its local
+            // deps by plain semver range it matched nothing, built nothing and exited
+            // 0 (#1587). One walk means the rule for "what is a local dependency" has
+            // one place to be wrong in.
+            const forward = buildDependencyGraph(allWorkspaces, { includeDev });
+            const names = affectedClosure(forward, [target.name]);
+            const closure = allWorkspaces.filter((ws) => names.has(ws.name));
+            reportUnlinked(forward.unlinked, names);
+            const graph = buildDependencyGraph(closure, { includeDev });
             runList = topologicalSort(graph);
+            if (runList.length === 1) {
+                // The expansion found nothing, and it SAYS so. A leaf package
+                // legitimately has no local dependencies, but "no local dependencies"
+                // and "the flag could not see them" produced the same silent exit 0,
+                // and that ambiguity is what cost a Flatpak build, a container run and
+                // a manual `ls` to resolve.
+                console.error(`gjsify workspace: --with-dependencies found no workspace dependencies of ` +
+                    `"${target.name}" — running "${script}" in it alone.`);
+            }
         }
         else {
             runList = [target];
@@ -197,48 +218,30 @@ export const workspaceCommand = {
     },
 };
 /**
- * Walk the workspace-dep graph from `target`, collecting every transitive
- * workspace dependency (production + optional, plus devDependencies when
- * `includeDev`). The returned list includes `target` itself so the caller
- * can pass it straight to `buildDependencyGraph` / `topologicalSort`.
+ * Name a dependency that points at a local workspace but does not link to it, because
+ * the member's version does not satisfy the declared range.
+ *
+ * Only entries declared BY a package in the closure are printed: an unlinked pair
+ * elsewhere in the monorepo is somebody else's business, and printing all of them would
+ * bury the one that explains why this closure is the size it is.
+ *
+ * This is a warning, not a failure, and it deliberately asserts NO outcome, because the
+ * outcome depends on which installer placed `node_modules`: npm and yarn fetch such a
+ * dependency from the registry — the rule the graph follows, under which leaving it out of
+ * the build order is simply right — while `gjsify install` symlinks the local member
+ * whatever the range says. Under that one the build order really is short a package, so
+ * the message asks for the range and the version to be brought into agreement instead of
+ * telling the reader where the files came from.
  */
-function collectTransitiveClosure(target, allWorkspaces, includeDev) {
-    const byName = new Map();
-    for (const ws of allWorkspaces)
-        byName.set(ws.name, ws);
-    const seen = new Set();
-    const out = [];
-    const stack = [target];
-    while (stack.length > 0) {
-        const ws = stack.pop();
-        if (seen.has(ws.name))
+function reportUnlinked(unlinked, closure) {
+    for (const entry of unlinked) {
+        if (!closure.has(entry.from))
             continue;
-        seen.add(ws.name);
-        out.push(ws);
-        const m = ws.manifest;
-        const blocks = [
-            m.dependencies,
-            includeDev ? m.devDependencies : undefined,
-            m.optionalDependencies,
-            // peerDependencies excluded by default (yarn does the same)
-        ];
-        for (const block of blocks) {
-            if (!block)
-                continue;
-            for (const [depName, spec] of Object.entries(block)) {
-                if (typeof spec !== 'string')
-                    continue;
-                if (!spec.startsWith('workspace:'))
-                    continue;
-                const dep = byName.get(depName);
-                if (!dep)
-                    continue;
-                if (!seen.has(dep.name))
-                    stack.push(dep);
-            }
-        }
+        console.error(`gjsify workspace: "${entry.from}" depends on "${entry.to}": ${entry.spec}, which the local ` +
+            `workspace (${entry.to}@${entry.version}) does not satisfy — NOT built as a dependency. ` +
+            `npm and yarn take that one from the registry; \`gjsify install\` links the local one ` +
+            `anyway, so if it is the local one you mean, make the range admit ${entry.version}.`);
     }
-    return out;
 }
 async function runOne(ws, script, extraArgs, runner, verbose, cache) {
     // Build-cache fast path: on a key hit restore the stored outputs and

package/lib/index.js

@@ -6,6 +6,7 @@
 // This file is just the executable wrapper around `runCli`.
 import { hideBin } from 'yargs/helpers';
 import { runCli } from './cli-app.js';
+import { exitOnReportedFailure } from './utils/cli-exit.js';
 import { gjsExit } from '@gjsify/rolldown-plugin-gjsify/runtime';
 try {
     await runCli(hideBin(process.argv));
@@ -43,3 +44,12 @@ catch (err) {
     process.exitCode = 1;
     gjsExit(1);
 }
+// The catch above is only HALF the entry's exit funnel, and the other half was
+// missing: a handler that reports a failure by assigning `process.exitCode` and
+// returning normally never reaches it. That is the Node idiom and the CLI uses
+// it wherever the failure is already printed in full (`gjsify gresource`,
+// `gjsify gsettings`, `gjsify barrels --check`, `setOxcExitCode`) — and under
+// GJS, which has no atexit hook, nothing read it back, so the process ended 0
+// with the error on stderr. `cli-exit.ts` carries the measurement and why `&&`
+// did not protect against it (JumpLink/Learn6502#180).
+exitOnReportedFailure();

package/lib/utils/build-cache.d.ts

@@ -11,9 +11,19 @@ import { type Workspace } from '@gjsify/workspace';
  * still on v2's whole-dir ownership and could restore over a sibling unit; a v2
  * manifest for them records `lib`, so it must not be replayed against the
  * per-child units this version stores.
+ *
+ * v4: the input set is now `packageBuildInputs` instead of `src/**` + the
+ * manifests (#1651). Every v3 key was computed over a strictly narrower set,
+ * so replaying one would report a hit for a change it could not have seen.
+ */
+export declare const BUILD_CACHE_LAYOUT_VERSION = "v4";
+/**
+ * Conventional per-package build output directories, checked in this order.
+ *
+ * Deliberately the same constant the input definition subtracts: a directory
+ * this cache STORES as an output must never also be hashed as an input, or
+ * storing it would invalidate the key it was stored under.
  */
-export declare const BUILD_CACHE_LAYOUT_VERSION = "v3";
-/** Conventional per-package build output directories, checked in this order. */
 export declare const OUTPUT_DIR_CANDIDATES: readonly ["lib", "dist", "dist-templates"];
 /** Keep at most this many keys per package; evict the least recently stored/used. */
 export declare const MAX_KEYS_PER_PACKAGE = 2;
@@ -45,8 +55,9 @@ export declare function sanitizePackageDirName(name: string): string;
 /** Streamed sha256 of one file (bounded memory, real contents). */
 export declare function hashFileStream(path: string): string;
 /**
- * Content hash of a package's build INPUTS: every file under `src/**`, plus
- * `package.json`, plus root `tsconfig*.json`. Sorted, content-streamed —
+ * Content hash of a package's build INPUTS — the set is
+ * {@link packageBuildInputs}, shared with `gjsify test`'s freshness check so
+ * the two cannot drift about what an input is. Sorted, content-streamed:
  * mtimes do not participate, so a `git checkout` with identical contents
  * hashes identically across machines.
  */