@gjsify/cli 0.49.0 → 0.51.0

package/lib/actions/barrels-generate.d.ts

@@ -21,9 +21,31 @@ export interface BarrelsArgs {
 }
 export declare const DEFAULT_BARRELS_HEADER = "// Auto-generated by `gjsify barrels` \u2014 do not edit by hand.";
 export declare const DEFAULT_BARRELS_EXCLUDES: readonly string[];
+/**
+ * The entries of `paths` that cannot be scanned as a directory, resolved against `baseDir`
+ * — each already phrased for printing.
+ *
+ * A SEPARATE pass rather than a behaviour change inside {@link generateBarrels}, because
+ * the two callers want opposite things. A programmatic caller may legitimately hand the
+ * generator a directory that is not there yet and still want the others written, which is
+ * why it skips; a COMMAND-LINE caller named these directories, so one that cannot be read
+ * is a typo or a rename and nothing else. So the command asserts first — the shape
+ * `assertEveryIncludeMatches` already has for `gjsify foreach --include`.
+ *
+ * THE INCIDENT: `gjsify barrels --check` counted a directory it could not read as 0 drift
+ * and exited 0, so the guard reported a clean barrel for a directory nothing had looked
+ * at, and the only trace was a line printed under `--verbose`. "Skipped" and "in sync"
+ * have to be told apart by the exit code — a guard that goes green for work it never did
+ * is worse than no guard, because a later step is measuring its output.
+ */
+export declare function unscannableBarrelPaths(baseDir: string, paths: readonly string[]): Promise<string[]>;
 /**
  * Regenerate `index.ts` in every directory in `args.paths`.
  *
+ * A path that cannot be read is SKIPPED here, deliberately — see
+ * {@link unscannableBarrelPaths} for who refuses it instead, and why that is the command
+ * and not this.
+ *
  * Returns the number of files that drifted from the canonical output —
  * always 0 when `check` is false (drift is rewritten in-place); non-zero
  * under `check: true` signals CI failure.

package/lib/actions/barrels-generate.js

@@ -12,14 +12,49 @@
 //
 // Original: Copyright (c) Beabee Community Repo contributors. AGPL-3.0.
 // Reimplemented for gjsify under the project's MIT license.
-import { readdir, readFile, writeFile } from 'node:fs/promises';
+import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { basename, extname, join, resolve } from 'node:path';
 export const DEFAULT_BARRELS_HEADER = '// Auto-generated by `gjsify barrels` — do not edit by hand.';
 export const DEFAULT_BARRELS_EXCLUDES = ['\\.test\\.', '\\.spec\\.', '\\.test-data\\.'];
 const SOURCE_FILE_RE = /\.(ts|tsx|mts|cts)$/;
+/**
+ * The entries of `paths` that cannot be scanned as a directory, resolved against `baseDir`
+ * — each already phrased for printing.
+ *
+ * A SEPARATE pass rather than a behaviour change inside {@link generateBarrels}, because
+ * the two callers want opposite things. A programmatic caller may legitimately hand the
+ * generator a directory that is not there yet and still want the others written, which is
+ * why it skips; a COMMAND-LINE caller named these directories, so one that cannot be read
+ * is a typo or a rename and nothing else. So the command asserts first — the shape
+ * `assertEveryIncludeMatches` already has for `gjsify foreach --include`.
+ *
+ * THE INCIDENT: `gjsify barrels --check` counted a directory it could not read as 0 drift
+ * and exited 0, so the guard reported a clean barrel for a directory nothing had looked
+ * at, and the only trace was a line printed under `--verbose`. "Skipped" and "in sync"
+ * have to be told apart by the exit code — a guard that goes green for work it never did
+ * is worse than no guard, because a later step is measuring its output.
+ */
+export async function unscannableBarrelPaths(baseDir, paths) {
+    const problems = [];
+    for (const p of paths) {
+        const dir = resolve(baseDir, p);
+        try {
+            if (!(await stat(dir)).isDirectory())
+                problems.push(`${dir} is not a directory`);
+        }
+        catch (err) {
+            problems.push(`${dir}: ${err.message}`);
+        }
+    }
+    return problems;
+}
 /**
  * Regenerate `index.ts` in every directory in `args.paths`.
  *
+ * A path that cannot be read is SKIPPED here, deliberately — see
+ * {@link unscannableBarrelPaths} for who refuses it instead, and why that is the command
+ * and not this.
+ *
  * Returns the number of files that drifted from the canonical output —
  * always 0 when `check` is false (drift is rewritten in-place); non-zero
  * under `check: true` signals CI failure.

package/lib/actions/build.js

@@ -15,6 +15,7 @@ import { collectEntryPaths, describeJsxConfig, findJsxEntryPoint, jsxConfigMissi
 import { giSystemProbes } from '../utils/gi-runtime-paths.js';
 import { escapeRawNulForGjs } from '../utils/gjs-source-escape.js';
 import { assertNodeBundleGlobalsShimmed } from '../utils/node-bundle-guard.js';
+import { DEP_CHANGE_LOCKFILES } from '../utils/package-inputs.js';
 const DEFAULT_GJS_SHEBANG = '#!/usr/bin/env -S gjs -m';
 /**
  * `true` when `path` points at a location that's unsafe to use as a build
@@ -59,16 +60,18 @@ function isTruthyEnv(v) {
     return v === '1' || v === 'true' || v === 'yes';
 }
 /**
- * Lockfiles whose change implies a plugin's *transitive* deps may have moved.
+ * Newest mtime (ms) among known lockfiles in `cwd`, or 0 when none exist.
+ *
  * A dep bump (`npm/yarn/pnpm/gjsify install`) rewrites one of these but leaves
  * the plugin's own entry-file mtime untouched — so the plugin GJS-bundle cache
- * must invalidate on these too, not only on the entry.
+ * must invalidate on them too, not only on the entry. The LIST is
+ * {@link DEP_CHANGE_LOCKFILES}, shared with the package-input definition: two
+ * answers to "has the dependency tree moved" is how they come to disagree
+ * about a fifth package manager.
  */
-const PLUGIN_CACHE_DEP_SIGNALS = ['gjsify-lock.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'];
-/** Newest mtime (ms) among known lockfiles in `cwd`, or 0 when none exist. */
 async function newestLockfileMtime(cwd) {
     let newest = 0;
-    for (const name of PLUGIN_CACHE_DEP_SIGNALS) {
+    for (const name of DEP_CHANGE_LOCKFILES) {
         try {
             const s = await stat(join(cwd, name));
             if (s.mtimeMs > newest)

package/lib/commands/barrels.js

@@ -13,7 +13,10 @@
 //     file as a module.
 //   - Output is sorted by file name (locale-compare) — deterministic diffs.
 //   - `--check` exits non-zero on drift without writing (pre-commit / CI use).
-import { DEFAULT_BARRELS_EXCLUDES, DEFAULT_BARRELS_HEADER, generateBarrels, } from '../actions/barrels-generate.js';
+//   - A named path that is not a readable directory is REFUSED before anything
+//     is generated: skipping it would let `--check` report 0 drift, and exit 0,
+//     for a barrel nothing ever looked at.
+import { DEFAULT_BARRELS_EXCLUDES, DEFAULT_BARRELS_HEADER, generateBarrels, unscannableBarrelPaths, } from '../actions/barrels-generate.js';
 export const barrelsCommand = {
     command: 'barrels [paths..]',
     description: 'Regenerate `index.ts` barrel files for the given directories. Drop-in replacement for `barrelsby`.',
@@ -81,13 +84,27 @@ export const barrelsCommand = {
             process.exitCode = 1;
             return;
         }
+        const baseDir = args.baseDir ?? process.cwd();
+        // A named path this cannot scan is a typo or a rename, and it is refused BEFORE
+        // anything is generated. The generator skips such a path and reports no drift for
+        // it, which under `--check` is a guard going green for a directory nothing looked
+        // at — the one failure mode a guard must not have.
+        const unscannable = await unscannableBarrelPaths(baseDir, paths);
+        if (unscannable.length > 0) {
+            for (const problem of unscannable)
+                console.error(`[gjsify barrels] cannot scan ${problem}`);
+            console.error(`[gjsify barrels] ${unscannable.length} of ${paths.length} path(s) could not be scanned — ` +
+                'refusing to report on the rest as if that were the whole set.');
+            process.exitCode = 1;
+            return;
+        }
         const excludePatterns = args.exclude?.length
             ? args.exclude
             : [...DEFAULT_BARRELS_EXCLUDES];
         const drift = await generateBarrels({
             paths,
             extension: args.ext ?? 'none',
-            baseDir: args.baseDir ?? process.cwd(),
+            baseDir,
             exclude: excludePatterns.map((src) => new RegExp(src)),
             header: args.header ?? DEFAULT_BARRELS_HEADER,
             noSemicolon: args.semicolon === false || args.semicolon === undefined,

package/lib/commands/foreach.js

@@ -583,25 +583,17 @@ async function runParallel(workspaces, script, args, concurrency, verbose, exec,
     await Promise.all(workers);
 }
 async function runTopologicalParallel(workspaces, script, args, concurrency, verbose, includeDev, exec, cache) {
-    const selectedNames = new Set(workspaces.map((w) => w.name));
-    const remaining = new Map();
-    for (const ws of workspaces) {
-        const wsDeps = new Set();
-        const m = ws.manifest;
-        for (const block of [m.dependencies, includeDev ? m.devDependencies : undefined, m.optionalDependencies]) {
-            if (!block)
-                continue;
-            for (const [name, spec] of Object.entries(block)) {
-                if (typeof spec !== 'string')
-                    continue;
-                if (!spec.startsWith('workspace:'))
-                    continue;
-                if (selectedNames.has(name))
-                    wsDeps.add(name);
-            }
-        }
-        remaining.set(ws.name, wsDeps);
-    }
+    // The SHARED graph, walked once — never a private copy of the walk. `buildDependencyGraph`
+    // over the SELECTED set yields exactly these edges: it indexes by name from the list it is
+    // handed, so a dependency outside the selection resolves to no member and is not an edge.
+    //
+    // The copy this replaces followed `workspace:` only. Once #1587 widened the shared rule to
+    // include a plain range the local member satisfies, the two topological legs would have
+    // DISAGREED — `-t` ordering correctly off the shared graph while `-t -p` saw no edges at
+    // all and started every workspace at once, in a monorepo that declares its local deps by
+    // plain semver range. Wrong order, exit 0, and a build measured by a later step: the same
+    // shape #1587 is about, one flag over.
+    const remaining = new Map([...buildDependencyGraph(workspaces, { includeDev }).edges].map(([name, deps]) => [name, new Set(deps)]));
     const byName = new Map(workspaces.map((w) => [w.name, w]));
     const total = workspaces.length;
     const done = new Set();

package/lib/commands/ship.js

@@ -32,10 +32,11 @@ import { buildDeb } from '../utils/ship/deb.js';
 import { deriveDepends, warnAboutGjsFloor, warnAboutNodeFloor } from '../utils/ship/depends.js';
 import { isGtkRuntimeTarget, stageAppRuntime } from '../utils/ship/app-runtime.js';
 import { discoverPayload } from '../utils/ship/discover.js';
+import { appDirFor, appDirPayload, appImageHostRequirements, appImageRuntimeNotice, buildAppImage, findPinnedRuntime, stampAppDirTimes, } from '../utils/ship/appimage.js';
 import { buildDmgImage, dmgVolumeDir, dmgVolumeName } from '../utils/ship/dmg.js';
 import { buildFlatpakBundle } from '../utils/ship/flatpak.js';
 import { localizeMetadata } from '../utils/ship/localize-metadata.js';
-import { assertHostCanFinish, assertToolsInstalled, canCarryTicket, configuredFormats, defaultFormatIds, formatIdsFor, resolveFormats, windowsProgramDirName, FORMAT_IDS, FORMATS, } from '../utils/ship/formats.js';
+import { assertHostCanFinish, assertKindCanPack, assertToolsInstalled, canCarryTicket, configuredFormats, defaultFormatIds, formatIdsFor, resolveFormats, windowsProgramDirName, FORMAT_IDS, FORMATS, } from '../utils/ship/formats.js';
 import { assertLayoutSupportsArch, hostLayout, layoutForOs, place, placeStage, resolveLayout, LAYOUT_NAMES, } from '../utils/ship/layout.js';
 import { isNodeRuntimeTarget, resolveNodeRuntime } from '../utils/ship/node-runtime.js';
 import { isUnder, SHARE } from '../utils/ship/share-dirs.js';
@@ -49,7 +50,7 @@ import { assertOverlayIsLicensed, planOverlay, planStage } from '../utils/ship/p
 import { assertHostCanSign, notarizeArtifact, stapleArtifact, resolveNotaryPlan, resolveSignPlan, signPayload, } from '../utils/ship/signing.js';
 import { renderLauncher } from '../utils/ship/launcher.js';
 import { buildRpm } from '../utils/ship/rpm.js';
-import { resolveShipApp, resolveShipBundle, resolveShipSettings, } from '../utils/ship/settings.js';
+import { resolveShipApp, resolveShipBundle, resolveShipKind, resolveShipSettings, } from '../utils/ship/settings.js';
 import { assertExpectedTarget, assertFormatsStaged, formatTarget, overlayFiles, readStageManifest, resolveStageMtime, warnOnToolSkew, writeStageManifest, STAGE_MANIFEST_FILE, } from '../utils/ship/stage-manifest.js';
 import { directorySize, readStage, writePayload, writeStage } from '../utils/ship/stage-writer.js';
 const LOG = '[gjsify ship]';
@@ -276,6 +277,23 @@ async function assemble(args) {
     // afterwards costs the whole build for a refusal that was knowable up
     // front. Skipped under `--stage`, which is precisely the phase that does
     // NOT need the format's tooling — that asymmetry is the point of the split.
+    // THE THIRD REFUSAL THAT IS KNOWABLE UP FRONT, and it was the one paid for
+    // with a whole build: `appimage` needs a desktop entry at its AppDir root,
+    // `kind: 'cli'` stages none by design, and both facts are configuration. It
+    // used to surface inside the packer — after `runProjectBuild` — so a CLI
+    // project asking for an AppImage built everything first and was then told its
+    // payload could never have become one. The ICON half stays in the packer,
+    // because an icon is discovered and discovery legitimately reads build output.
+    //
+    // BEFORE `assertCanPack` AND NOT AFTER IT, which is an ordering between two
+    // refusals rather than a detail. `assertCanPack` says "not on THIS machine" and
+    // is answered by installing something; this one says "not for THIS PROJECT",
+    // which installing appimagetool would not fix. Reporting the machine first
+    // sends a CLI author to a GitHub release for a tool that was never going to
+    // help them — measured, because the e2e below asserted the message it wanted
+    // and only ever ran on a host that had the tool.
+    if (!args.stage)
+        assertKindCanPack(formats, resolveShipKind(ship, flatpak));
     if (!args.stage)
         for (const format of formats)
             assertCanPack(format);
@@ -949,6 +967,63 @@ async function packOne(input) {
                 verbose: input.verbose,
             });
             break;
+        case 'appimage': {
+            // FROM THE PAYLOAD, like every other container here and NOT from the
+            // stage directory, so the three properties `writePayload` guarantees
+            // hold: the modes are the plan's, the stage's own sidecar stays out
+            // because it was never payload, and `--target appimage` alone works
+            // without another row having run first.
+            //
+            // The host requirement list is derived HERE rather than inside the
+            // packer, because it is the same pair of inputs `deriveDepends` takes
+            // one branch up — `input.namespaces` from the stage manifest and
+            // `facts.bundledTypelibs` from the payload. Two derivations would be
+            // two answers to "what does this artifact need from the machine", from
+            // one build, in two files.
+            const hostRequirements = appImageHostRequirements({
+                app: settings.app,
+                minGjsVersion: settings.minGjsVersion,
+                minNodeVersion: settings.minNodeVersion,
+                namespaces: input.namespaces,
+                bundledTypelibs: facts.bundledTypelibs,
+            });
+            const appDir = appDirFor(outRoot);
+            const tree = appDirPayload(settings, payload, hostRequirements);
+            // ONE `writePayload` FOR THE WHOLE AppDir, prefix and root files
+            // together, because that call WIPES: two of them would leave the
+            // previous run's `<appId>.desktop` and icon at a root the second call
+            // never cleaned, and appimagetool packs an AppDir with two desktop
+            // files without complaining about either.
+            writePayload(appDir, tree, '');
+            // AND THEN THE TIMES, which are the single difference between two packs
+            // of one build (measured, sha256): mksquashfs stores per-file mtimes
+            // and `writePayload`'s own `mkdir`/`writeFileSync` leave the wall clock.
+            stampAppDirTimes(appDir, tree, mtime);
+            // PRINTED, not logged at `--verbose`. ADR 0024 § 9's objection to this
+            // format is that "runs anywhere" is a claim the file cannot keep, and
+            // the answer is that the file says what it does not carry — to the
+            // person building it, every time, and not only in a document.
+            console.log(`${LOG} the AppImage takes these from the host: ${hostRequirements.join(', ')}`);
+            // AND WHAT IT EMBEDS, on the same terms and for the same reason. The
+            // requirement list above says what the file does NOT carry; this says
+            // where the one thing it DOES carry that this tree did not write came
+            // from. With a pin that is a checkable claim (no network, and two packs
+            // of one build embed identical bytes); without one appimagetool fetches
+            // from a rolling tag, which still works and must still be said —
+            // ADR 0024 § A26.1. Unconditional, never behind `--verbose`: the person
+            // who can pin a runtime is the one reading a pack log.
+            const runtimeFile = findPinnedRuntime(archLabel);
+            console.log(`${LOG} ${appImageRuntimeNotice(archLabel, runtimeFile)}`);
+            await buildAppImage({
+                appDir,
+                target,
+                archLabel,
+                runtimeFile,
+                workDir: dirname(appDir),
+                verbose: input.verbose,
+            });
+            break;
+        }
         case 'macos-app':
         case 'windows-dir':
             // ONE STATEMENT FOR TWO ROWS, folded because the code really is

package/lib/commands/test.d.ts

@@ -9,4 +9,20 @@ interface TestOptions {
     verbose?: boolean;
 }
 export declare const testCommand: Command<unknown, TestOptions>;
+/**
+ * True when `outfile` is at least as new as every build input of the package
+ * at `cwd`.
+ *
+ * The set is {@link packageBuildInputs}, the same one the build cache hashes.
+ * It used to be `dirname(entry)` — `tests/` for any package whose suite lives
+ * there, so `src/**` was never walked: a change to the code UNDER TEST left
+ * the bundle "fresh" and `gjsify test` reran the previous build and reported
+ * on it. That went both ways inside one dependency bump — a green run
+ * measuring a version that was no longer installed, then a red one after the
+ * source had already been repaired (#1651).
+ *
+ * `outdir` is subtracted as this command's own output; `entry` is added
+ * because `--entry ../shared/test.mts` may point outside the package.
+ */
+export declare function isFresh(outfile: string, entry: string, cwd: string, outdir: string): boolean;
 export {};

package/lib/commands/test.js

@@ -5,8 +5,9 @@
 // just needs `src/test.mts` aggregating its `@gjsify/unit` suites; this
 // command builds it for GJS + Node and runs each output, aggregating
 // exit codes.
-import { existsSync, statSync, readdirSync } from 'node:fs';
-import { join, dirname, resolve, relative } from 'node:path';
+import { existsSync, statSync } from 'node:fs';
+import { join, resolve, relative, sep } from 'node:path';
+import { newestDepSignalMtimeMs, newestInputMtimeMs, packageBuildInputs } from '../utils/package-inputs.js';
 import { isRuntimeAvailable, RUNTIMES } from '../utils/runtimes.js';
 import { nodeBinary } from '../utils/run-node.js';
 import { describeExit, spawnToCompletion } from '../utils/spawn.js';
@@ -99,7 +100,7 @@ export const testCommand = {
             const outfile = join(outdir, `test.${runtime}.mjs`);
             // Build stage (skip if --no-build OR (not --rebuild AND outfile fresher than src)).
             if (args.build !== false) {
-                const needsBuild = args.rebuild || !isFresh(outfile, entry);
+                const needsBuild = args.rebuild || !isFresh(outfile, entry, cwd, outdir);
                 if (needsBuild) {
                     const buildStart = Date.now();
                     if (args.verbose) {
@@ -204,16 +205,35 @@ async function runTestBundle(outfile, runtime) {
     if (result.code !== 0)
         throw new Error(`node exited with ${describeExit(result)}`);
 }
-/** True when `outfile` exists and is newer than every `.ts`/`.mts` file under the entry's directory tree. */
-function isFresh(outfile, entry) {
+/**
+ * True when `outfile` is at least as new as every build input of the package
+ * at `cwd`.
+ *
+ * The set is {@link packageBuildInputs}, the same one the build cache hashes.
+ * It used to be `dirname(entry)` — `tests/` for any package whose suite lives
+ * there, so `src/**` was never walked: a change to the code UNDER TEST left
+ * the bundle "fresh" and `gjsify test` reran the previous build and reported
+ * on it. That went both ways inside one dependency bump — a green run
+ * measuring a version that was no longer installed, then a red one after the
+ * source had already been repaired (#1651).
+ *
+ * `outdir` is subtracted as this command's own output; `entry` is added
+ * because `--entry ../shared/test.mts` may point outside the package.
+ */
+export function isFresh(outfile, entry, cwd, outdir) {
     if (!existsSync(outfile))
         return false;
-    const outMtime = statSync(outfile).mtimeMs;
-    const srcRoot = dirname(entry);
-    // Conservative: walk the src tree once. If the package has no `src/`,
-    // fall back to entry-only check.
     try {
-        const newest = newestMtimeUnder(existsSync(srcRoot) ? srcRoot : entry);
+        const outMtime = statSync(outfile).mtimeMs;
+        const extraOutputs = [];
+        const outdirRel = relative(cwd, outdir).split(sep).join('/');
+        if (outdirRel !== '' && !outdirRel.startsWith('../'))
+            extraOutputs.push(outdirRel);
+        const newest = Math.max(newestInputMtimeMs(packageBuildInputs(cwd, { extraOutputs })), statSync(entry).mtimeMs, 
+        // A dependency bump changes no file in the package — and that is
+        // the shape #1651 was found in. `node_modules` is far too large
+        // to stat per run, so the lockfile stands in for it.
+        newestDepSignalMtimeMs(cwd));
         return outMtime >= newest;
     }
     catch {
@@ -221,22 +241,3 @@ function isFresh(outfile, entry) {
         return false;
     }
 }
-function newestMtimeUnder(path) {
-    const st = statSync(path);
-    if (st.isFile())
-        return st.mtimeMs;
-    let max = st.mtimeMs;
-    for (const entry of readdirSync(path, { withFileTypes: true })) {
-        if (entry.name === 'node_modules' ||
-            entry.name === 'dist' ||
-            entry.name === 'lib' ||
-            entry.name.startsWith('.')) {
-            continue;
-        }
-        const child = join(path, entry.name);
-        const m = newestMtimeUnder(child);
-        if (m > max)
-            max = m;
-    }
-    return max;
-}

package/lib/commands/workspace.js

@@ -14,13 +14,16 @@
 // dependency, in topological build order, then in the target package.
 // Skips deps that don't declare the script (`--if-present` behaviour).
 // Stops on the first failure unless `--continue-on-error` is passed.
+// A local dependency counts whether it is declared with the `workspace:`
+// protocol or with a plain range the local member satisfies (@gjsify/workspace
+// § buildDependencyGraph) — and the expansion SAYS when it found nothing.
 //
 // This replaces the manual `gjsify workspace <A> build && gjsify workspace
 // <B> build && …` chains in root `build:infra` scripts: cascade build
 // failures on uninbuilt workspace deps are the single biggest local-dev
 // pain point in this monorepo.
 import { spawnToCompletion } from '../utils/spawn.js';
-import { buildDependencyGraph, discoverWorkspaces, topologicalSort } from '@gjsify/workspace';
+import { affectedClosure, buildDependencyGraph, discoverWorkspaces, topologicalSort, } from '@gjsify/workspace';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
 import { BuildCacheRunner, buildCacheEnabledByEnv } from '../utils/build-cache.js';
 import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';
@@ -135,11 +138,29 @@ export const workspaceCommand = {
         // target itself.
         let runList;
         if (withDeps) {
-            const closure = collectTransitiveClosure(target, allWorkspaces, args['include-dev'] === true);
-            // Sort the closure topologically using the shared @gjsify/workspace
-            // algorithm — same code path that drives `gjsify foreach -t`.
-            const graph = buildDependencyGraph(closure, { includeDev: args['include-dev'] === true });
+            const includeDev = args['include-dev'] === true;
+            // The SHARED graph, walked by the shared closure — the same two calls
+            // `gjsify foreach --with-dependencies` makes. This used to be a private
+            // copy of the walk here, and the copy is where the defect lived: it
+            // followed `workspace:` edges only, so in a monorepo declaring its local
+            // deps by plain semver range it matched nothing, built nothing and exited
+            // 0 (#1587). One walk means the rule for "what is a local dependency" has
+            // one place to be wrong in.
+            const forward = buildDependencyGraph(allWorkspaces, { includeDev });
+            const names = affectedClosure(forward, [target.name]);
+            const closure = allWorkspaces.filter((ws) => names.has(ws.name));
+            reportUnlinked(forward.unlinked, names);
+            const graph = buildDependencyGraph(closure, { includeDev });
             runList = topologicalSort(graph);
+            if (runList.length === 1) {
+                // The expansion found nothing, and it SAYS so. A leaf package
+                // legitimately has no local dependencies, but "no local dependencies"
+                // and "the flag could not see them" produced the same silent exit 0,
+                // and that ambiguity is what cost a Flatpak build, a container run and
+                // a manual `ls` to resolve.
+                console.error(`gjsify workspace: --with-dependencies found no workspace dependencies of ` +
+                    `"${target.name}" — running "${script}" in it alone.`);
+            }
         }
         else {
             runList = [target];
@@ -197,48 +218,30 @@ export const workspaceCommand = {
     },
 };
 /**
- * Walk the workspace-dep graph from `target`, collecting every transitive
- * workspace dependency (production + optional, plus devDependencies when
- * `includeDev`). The returned list includes `target` itself so the caller
- * can pass it straight to `buildDependencyGraph` / `topologicalSort`.
+ * Name a dependency that points at a local workspace but does not link to it, because
+ * the member's version does not satisfy the declared range.
+ *
+ * Only entries declared BY a package in the closure are printed: an unlinked pair
+ * elsewhere in the monorepo is somebody else's business, and printing all of them would
+ * bury the one that explains why this closure is the size it is.
+ *
+ * This is a warning, not a failure, and it deliberately asserts NO outcome, because the
+ * outcome depends on which installer placed `node_modules`: npm and yarn fetch such a
+ * dependency from the registry — the rule the graph follows, under which leaving it out of
+ * the build order is simply right — while `gjsify install` symlinks the local member
+ * whatever the range says. Under that one the build order really is short a package, so
+ * the message asks for the range and the version to be brought into agreement instead of
+ * telling the reader where the files came from.
  */
-function collectTransitiveClosure(target, allWorkspaces, includeDev) {
-    const byName = new Map();
-    for (const ws of allWorkspaces)
-        byName.set(ws.name, ws);
-    const seen = new Set();
-    const out = [];
-    const stack = [target];
-    while (stack.length > 0) {
-        const ws = stack.pop();
-        if (seen.has(ws.name))
+function reportUnlinked(unlinked, closure) {
+    for (const entry of unlinked) {
+        if (!closure.has(entry.from))
             continue;
-        seen.add(ws.name);
-        out.push(ws);
-        const m = ws.manifest;
-        const blocks = [
-            m.dependencies,
-            includeDev ? m.devDependencies : undefined,
-            m.optionalDependencies,
-            // peerDependencies excluded by default (yarn does the same)
-        ];
-        for (const block of blocks) {
-            if (!block)
-                continue;
-            for (const [depName, spec] of Object.entries(block)) {
-                if (typeof spec !== 'string')
-                    continue;
-                if (!spec.startsWith('workspace:'))
-                    continue;
-                const dep = byName.get(depName);
-                if (!dep)
-                    continue;
-                if (!seen.has(dep.name))
-                    stack.push(dep);
-            }
-        }
+        console.error(`gjsify workspace: "${entry.from}" depends on "${entry.to}": ${entry.spec}, which the local ` +
+            `workspace (${entry.to}@${entry.version}) does not satisfy — NOT built as a dependency. ` +
+            `npm and yarn take that one from the registry; \`gjsify install\` links the local one ` +
+            `anyway, so if it is the local one you mean, make the range admit ${entry.version}.`);
     }
-    return out;
 }
 async function runOne(ws, script, extraArgs, runner, verbose, cache) {
     // Build-cache fast path: on a key hit restore the stored outputs and

package/lib/index.js

@@ -6,6 +6,7 @@
 // This file is just the executable wrapper around `runCli`.
 import { hideBin } from 'yargs/helpers';
 import { runCli } from './cli-app.js';
+import { exitOnReportedFailure } from './utils/cli-exit.js';
 import { gjsExit } from '@gjsify/rolldown-plugin-gjsify/runtime';
 try {
     await runCli(hideBin(process.argv));
@@ -43,3 +44,12 @@ catch (err) {
     process.exitCode = 1;
     gjsExit(1);
 }
+// The catch above is only HALF the entry's exit funnel, and the other half was
+// missing: a handler that reports a failure by assigning `process.exitCode` and
+// returning normally never reaches it. That is the Node idiom and the CLI uses
+// it wherever the failure is already printed in full (`gjsify gresource`,
+// `gjsify gsettings`, `gjsify barrels --check`, `setOxcExitCode`) — and under
+// GJS, which has no atexit hook, nothing read it back, so the process ended 0
+// with the error on stderr. `cli-exit.ts` carries the measurement and why `&&`
+// did not protect against it (JumpLink/Learn6502#180).
+exitOnReportedFailure();

package/lib/utils/build-cache.d.ts

@@ -11,9 +11,19 @@ import { type Workspace } from '@gjsify/workspace';
  * still on v2's whole-dir ownership and could restore over a sibling unit; a v2
  * manifest for them records `lib`, so it must not be replayed against the
  * per-child units this version stores.
+ *
+ * v4: the input set is now `packageBuildInputs` instead of `src/**` + the
+ * manifests (#1651). Every v3 key was computed over a strictly narrower set,
+ * so replaying one would report a hit for a change it could not have seen.
+ */
+export declare const BUILD_CACHE_LAYOUT_VERSION = "v4";
+/**
+ * Conventional per-package build output directories, checked in this order.
+ *
+ * Deliberately the same constant the input definition subtracts: a directory
+ * this cache STORES as an output must never also be hashed as an input, or
+ * storing it would invalidate the key it was stored under.
  */
-export declare const BUILD_CACHE_LAYOUT_VERSION = "v3";
-/** Conventional per-package build output directories, checked in this order. */
 export declare const OUTPUT_DIR_CANDIDATES: readonly ["lib", "dist", "dist-templates"];
 /** Keep at most this many keys per package; evict the least recently stored/used. */
 export declare const MAX_KEYS_PER_PACKAGE = 2;
@@ -45,8 +55,9 @@ export declare function sanitizePackageDirName(name: string): string;
 /** Streamed sha256 of one file (bounded memory, real contents). */
 export declare function hashFileStream(path: string): string;
 /**
- * Content hash of a package's build INPUTS: every file under `src/**`, plus
- * `package.json`, plus root `tsconfig*.json`. Sorted, content-streamed —
+ * Content hash of a package's build INPUTS — the set is
+ * {@link packageBuildInputs}, shared with `gjsify test`'s freshness check so
+ * the two cannot drift about what an input is. Sorted, content-streamed:
  * mtimes do not participate, so a `git checkout` with identical contents
  * hashes identically across machines.
  */