@smoothbricks/cli 0.10.0 → 0.10.1

package/dist/cli.js

@@ -67,9 +67,12 @@ function buildProgram() {
         const { validateCommitMessageFile } = await import('./monorepo/index.js');
         validateCommitMessageFile(commitMsgFile, options, await findRepoRoot());
     });
-    monorepo.command('sync-bun-lockfile-versions').action(async () => {
+    monorepo
+        .command('sync-bun-lockfile-versions')
+        .option('--stage', 'stage bun.lock when versions were resynced (pre-commit self-heal); quiet when clean')
+        .action(async (options) => {
         const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-        syncBunLockfileVersions(await findRepoRoot());
+        syncBunLockfileVersions(await findRepoRoot(), options.stage ? { log: false, stage: true } : {});
     });
     monorepo
         .command('list-release-packages')

package/dist/monorepo/lockfile.d.ts

@@ -1,5 +1,7 @@
 export interface SyncBunLockfileVersionsOptions {
     log?: boolean;
+    /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+    stage?: boolean;
 }
 export declare function syncBunLockfileVersions(root: string, options?: SyncBunLockfileVersionsOptions): number;
 export declare function validateBunLockfileVersions(root: string): number;

package/dist/monorepo/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAkD1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiChE"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAiBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAuD1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiChE"}

package/dist/monorepo/lockfile.js

@@ -11,6 +11,12 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
+//
+// Any `bun install` rewrites the workspace versions from package.json, reverting
+// this sync between releases. The pre-commit hook therefore runs
+// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
+// healed at the commit that would otherwise carry it — validation must never
+// fail a committer for drift a routine `bun install` introduced.
 export function syncBunLockfileVersions(root, options = {}) {
     const log = options.log ?? true;
     const lockfilePath = join(root, 'bun.lock');
@@ -53,9 +59,14 @@ export function syncBunLockfileVersions(root, options = {}) {
     }
     if (updated > 0) {
         writeFileSync(lockfilePath, lockfile);
+        if (options.stage) {
+            execSync('git add bun.lock', { cwd: root, stdio: ['pipe', 'pipe', 'pipe'] });
+        }
     }
-    if (log) {
-        console.log(updated > 0 ? `Updated ${updated} workspace version(s) in bun.lock` : 'All workspace versions already in sync.');
+    if (log || updated > 0) {
+        console.log(updated > 0
+            ? `Updated ${updated} workspace version(s) in bun.lock${options.stage ? ' (staged)' : ''}`
+            : 'All workspace versions already in sync.');
     }
     return updated;
 }

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -9,6 +9,12 @@ set -e -o pipefail
 # Format exactly what is staged so the commit includes the formatter output.
 git-format-staged
 
+# Any `bun install` rewrites bun.lock workspace versions from package.json,
+# reverting the stable-tag versions the release flow syncs (see
+# packages/cli/src/monorepo/lockfile.ts). Self-heal here instead of failing a
+# later commit on drift it didn't cause.
+smoo monorepo sync-bun-lockfile-versions --stage
+
 # Adding a workspace package is rare and easy to leave half-wired. Run the
 # full monorepo validator only for newly staged package manifests.
 smoo monorepo validate --fail-fast --only-if-new-workspace-package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -52,7 +52,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.2.5",
+    "@smoothbricks/nx-plugin": "0.3.0",
     "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",

package/src/cli.ts

@@ -76,10 +76,13 @@ function buildProgram(): Command {
       const { validateCommitMessageFile } = await import('./monorepo/index.js');
       validateCommitMessageFile(commitMsgFile, options, await findRepoRoot());
     });
-  monorepo.command('sync-bun-lockfile-versions').action(async () => {
-    const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-    syncBunLockfileVersions(await findRepoRoot());
-  });
+  monorepo
+    .command('sync-bun-lockfile-versions')
+    .option('--stage', 'stage bun.lock when versions were resynced (pre-commit self-heal); quiet when clean')
+    .action(async (options: { stage?: boolean }) => {
+      const { syncBunLockfileVersions } = await import('./monorepo/index.js');
+      syncBunLockfileVersions(await findRepoRoot(), options.stage ? { log: false, stage: true } : {});
+    });
   monorepo
     .command('list-release-packages')
     .option('--fail-empty', 'fail when no owned release packages are found')

package/src/monorepo/lockfile.test.ts

@@ -0,0 +1,157 @@
+import { afterAll, describe, expect, it } from 'bun:test';
+import { execSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import fc from 'fast-check';
+import { syncBunLockfileVersions, validateBunLockfileVersions } from './lockfile.js';
+
+const cleanupRoots: string[] = [];
+afterAll(() => {
+  for (const root of cleanupRoots) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+function git(root: string, args: string): string {
+  return execSync(`git ${args}`, {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GIT_CONFIG_GLOBAL: '/dev/null',
+      GIT_CONFIG_SYSTEM: '/dev/null',
+      GIT_AUTHOR_NAME: 'fixture',
+      GIT_AUTHOR_EMAIL: 'fixture@invalid',
+      GIT_COMMITTER_NAME: 'fixture',
+      GIT_COMMITTER_EMAIL: 'fixture@invalid',
+    },
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+}
+
+interface FixtureOptions {
+  packageVersion: string;
+  lockVersion: string;
+  stableTag?: string;
+}
+
+function makeFixtureRepo(options: FixtureOptions): string {
+  const root = mkdtempSync(join(tmpdir(), 'smoo-lockfile-'));
+  cleanupRoots.push(root);
+  git(root, 'init -q');
+  git(root, 'commit -q --allow-empty -m init');
+  writeFileSync(
+    join(root, 'package.json'),
+    JSON.stringify({ name: 'fixture-root', version: '0.0.0', private: true, workspaces: ['packages/*'] }),
+  );
+  mkdirSync(join(root, 'packages', 'foo'), { recursive: true });
+  writeFixturePackage(root, options.packageVersion);
+  writeFixtureLock(root, options.lockVersion);
+  if (options.stableTag) {
+    git(root, `tag ${options.stableTag}`);
+  }
+  return root;
+}
+
+function writeFixturePackage(root: string, version: string): void {
+  writeFileSync(
+    join(root, 'packages', 'foo', 'package.json'),
+    JSON.stringify({ name: '@fixture/foo', version, nx: { name: 'foo' } }),
+  );
+}
+
+function writeFixtureLock(root: string, version: string): void {
+  writeFileSync(
+    join(root, 'bun.lock'),
+    [
+      '{',
+      '  "lockfileVersion": 1,',
+      '  "workspaces": {',
+      '    "": { "name": "fixture-root" },',
+      '    "packages/foo": {',
+      '      "name": "@fixture/foo",',
+      `      "version": "${version}",`,
+      '    },',
+      '  },',
+      '}',
+      '',
+    ].join('\n'),
+  );
+}
+
+function lockVersionIn(root: string): string {
+  const match = readFileSync(join(root, 'bun.lock'), 'utf8').match(/"packages\/foo":\s*\{[^}]*"version":\s*"([^"]+)"/);
+  if (!match) throw new Error('fixture lockfile lost its workspace entry');
+  return match[1] as string;
+}
+
+describe('bun.lock workspace version sync', () => {
+  it('a bun-install revert of the release-synced version fails validation', () => {
+    // The b3298fc4c shape: package.json holds the next prerelease, a stable tag
+    // exists, and `bun install` rewrote the lockfile back to the prerelease.
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(validateBunLockfileVersions(root)).toBe(1);
+  });
+
+  it('sync restores the latest stable tag version and validation passes', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.2');
+    expect(validateBunLockfileVersions(root)).toBe(0);
+  });
+
+  it('a never-published prerelease package falls back to its manifest version', () => {
+    // The new-workspace-package shape (e.g. cowshed): no stable tag exists yet.
+    const root = makeFixtureRepo({ packageVersion: '0.2.0-next.0', lockVersion: '0.2.0-next.0' });
+    expect(validateBunLockfileVersions(root)).toBe(0);
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(0);
+  });
+
+  it('a stable manifest version is required verbatim in the lockfile', () => {
+    const root = makeFixtureRepo({ packageVersion: '0.1.0', lockVersion: '0.0.9' });
+    expect(validateBunLockfileVersions(root)).toBe(1);
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.0');
+  });
+
+  it('stage: true stages the healed bun.lock', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(1);
+    expect(git(root, 'diff --cached --name-only')).toContain('bun.lock');
+  });
+
+  it('stage: true leaves a clean lockfile unstaged', () => {
+    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
+    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(0);
+    expect(git(root, 'diff --cached --name-only').trim()).toBe('');
+  });
+
+  it('property: after sync, validation always passes', () => {
+    const version = fc
+      .tuple(fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.option(fc.nat({ max: 5 })))
+      .map(([major, minor, patch, next]) => `${major}.${minor}.${patch}${next === null ? '' : `-next.${next}`}`);
+    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
+    fc.assert(
+      fc.property(version, version, (packageVersion, lockVersion) => {
+        writeFixturePackage(root, packageVersion);
+        writeFixtureLock(root, lockVersion);
+        syncBunLockfileVersions(root, { log: false });
+        return validateBunLockfileVersions(root) === 0;
+      }),
+      { numRuns: 25 },
+    );
+  });
+});

package/src/monorepo/lockfile.ts

@@ -5,6 +5,8 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 
 export interface SyncBunLockfileVersionsOptions {
   log?: boolean;
+  /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+  stage?: boolean;
 }
 
 // Temporary Bun workaround. Delete this sync function, validateBunLockfileVersions,
@@ -16,6 +18,12 @@ export interface SyncBunLockfileVersionsOptions {
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
+//
+// Any `bun install` rewrites the workspace versions from package.json, reverting
+// this sync between releases. The pre-commit hook therefore runs
+// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
+// healed at the commit that would otherwise carry it — validation must never
+// fail a committer for drift a routine `bun install` introduced.
 export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVersionsOptions = {}): number {
   const log = options.log ?? true;
   const lockfilePath = join(root, 'bun.lock');
@@ -59,10 +67,15 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   }
   if (updated > 0) {
     writeFileSync(lockfilePath, lockfile);
+    if (options.stage) {
+      execSync('git add bun.lock', { cwd: root, stdio: ['pipe', 'pipe', 'pipe'] });
+    }
   }
-  if (log) {
+  if (log || updated > 0) {
     console.log(
-      updated > 0 ? `Updated ${updated} workspace version(s) in bun.lock` : 'All workspace versions already in sync.',
+      updated > 0
+        ? `Updated ${updated} workspace version(s) in bun.lock${options.stage ? ' (staged)' : ''}`
+        : 'All workspace versions already in sync.',
     );
   }
   return updated;

package/src/release/__tests__/fixture-repo.test.ts

@@ -226,6 +226,14 @@ describe('release planning with fixture git repositories', () => {
     });
   });
 
+  it('kills timed-out fixture Git process groups so descendants cannot hold output pipes open', async () => {
+    await withFixtureRepo(async (root) => {
+      await expect(
+        git(root, ['-c', "alias.hold-pipes=!sh -c 'sleep 30 & exit 0'", 'hold-pipes'], undefined, 100),
+      ).rejects.toThrow('timed out after 100ms');
+    });
+  }, 5_000);
+
   it('repairs a scoped package from its project-name release tag without creating a package-name tag', async () => {
     await withFixtureRepo(async (author) => {
       await writeWorkspace(author);

package/src/release/__tests__/helpers/fixture-repo.ts

@@ -82,9 +82,14 @@ export async function writeBuildablePackage(
   );
 }
 
-export async function git(root: string, args: string[], env?: Record<string, string>): Promise<void> {
-  const result = await gitResult(root, args, env);
-  if (result.exitCode !== 0) {
+export async function git(
+  root: string,
+  args: string[],
+  env?: Record<string, string>,
+  timeoutMs = GIT_TIMEOUT_MS,
+): Promise<void> {
+  const result = await gitResult(root, args, env, timeoutMs);
+  if (result.timedOut || result.exitCode !== 0) {
     throw new Error(gitErrorMessage(root, args, result));
   }
 }
@@ -101,9 +106,15 @@ export async function gitSucceeds(root: string, args: string[]): Promise<boolean
   return (await gitResult(root, args)).exitCode === 0;
 }
 
-async function gitResult(root: string, args: string[], env?: Record<string, string>): Promise<GitResult> {
+async function gitResult(
+  root: string,
+  args: string[],
+  env?: Record<string, string>,
+  timeoutMs = GIT_TIMEOUT_MS,
+): Promise<GitResult> {
   const proc = Bun.spawn(['git', ...args], {
     cwd: root,
+    detached: true,
     env: { ...process.env, ...GIT_FIXTURE_ENV, ...env },
     stdout: 'pipe',
     stderr: 'pipe',
@@ -111,15 +122,23 @@ async function gitResult(root: string, args: string[], env?: Record<string, stri
   let timedOut = false;
   const timeout = setTimeout(() => {
     timedOut = true;
-    proc.kill();
-  }, GIT_TIMEOUT_MS);
+    try {
+      // `git` may exit after spawning a transport or hook which still owns its
+      // pipes. Killing the detached process group closes every inherited pipe.
+      process.kill(-proc.pid, 'SIGKILL');
+    } catch (error) {
+      if (!(error instanceof Error && 'code' in error && error.code === 'ESRCH')) {
+        proc.kill('SIGKILL');
+      }
+    }
+  }, timeoutMs);
   try {
     const [exitCode, stdout, stderr] = await Promise.all([
       proc.exited,
       streamBytes(proc.stdout),
       streamBytes(proc.stderr),
     ]);
-    return { exitCode, stdout, stderr, timedOut };
+    return { exitCode, stdout, stderr, timedOut, timeoutMs };
   } finally {
     clearTimeout(timeout);
   }
@@ -151,12 +170,13 @@ interface GitResult {
   stdout: Uint8Array;
   stderr: Uint8Array;
   timedOut: boolean;
+  timeoutMs: number;
 }
 
 function gitErrorMessage(root: string, args: string[], result: GitResult): string {
   const stderr = new TextDecoder().decode(result.stderr).trim();
   const timeoutText = result.timedOut
-    ? ` timed out after ${GIT_TIMEOUT_MS}ms`
+    ? ` timed out after ${result.timeoutMs}ms`
     : ` failed with exit code ${result.exitCode}`;
   return [`git ${args.join(' ')}${timeoutText}`, `cwd: ${root}`, stderr].filter(Boolean).join('\n');
 }