@smoothbricks/cli 0.11.10 → 0.11.12

package/src/monorepo/cargo-policy.ts

@@ -1,4 +1,5 @@
-import { type Dirent, existsSync, readdirSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { type Dirent, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import typia from 'typia';
 import { parsePackageJsonText } from '../lib/json.js';
@@ -21,6 +22,11 @@ interface CargoManifest {
     workspace?: string | boolean;
   };
   profile?: Record<string, CargoProfile>;
+  // Only the KEYS matter here: a workspace-hack is wired in by name, and every
+  // dependency spelling — string, table, inherited — carries the same key.
+  dependencies?: Record<string, unknown>;
+  'dev-dependencies'?: Record<string, unknown>;
+  'build-dependencies'?: Record<string, unknown>;
 }
 
 interface CargoConfigTarget {
@@ -42,6 +48,22 @@ interface CargoConfig {
   };
   target?: Record<string, CargoConfigTarget>;
   env?: Record<string, string | CargoConfigEnvObject>;
+  resolver?: {
+    'feature-unification'?: string;
+  };
+  unstable?: {
+    'feature-unification'?: boolean;
+  };
+}
+
+interface RustToolchainFile {
+  toolchain?: {
+    channel?: string;
+  };
+}
+
+interface HakariConfig {
+  'hakari-package'?: string;
 }
 
 interface LoadedManifest {
@@ -62,6 +84,45 @@ interface EffectiveProfile {
 
 const validateCargoManifest = typia.createValidate<CargoManifest>();
 const validateCargoConfig = typia.createValidate<CargoConfig>();
+const validateRustToolchainFile = typia.createValidate<RustToolchainFile>();
+const validateHakariConfig = typia.createValidate<HakariConfig>();
+
+/**
+ * The one command this policy shells out to, behind a seam. `cargo hakari
+ * verify` is the only authority on whether a generated workspace-hack still
+ * unifies what the workspace resolves today; nothing in these files can answer
+ * that. Tests supply their own so the policy stays runnable without the binary.
+ */
+export interface CargoHakariShell {
+  run(directory: string, args: readonly string[]): { code: number; output: string; missing: boolean };
+}
+
+const defaultHakariShell: CargoHakariShell = {
+  run(directory, args) {
+    const result = spawnSync('cargo', ['hakari', ...args], { cwd: directory, encoding: 'utf8' });
+    const output = `${result.stdout ?? ''}${result.stderr ?? ''}`.trim();
+    // cargo itself exists; a missing subcommand is cargo's own error, not ENOENT.
+    const missing =
+      (result.error as NodeJS.ErrnoException | undefined)?.code === 'ENOENT' || output.includes('no such command');
+    return { code: result.status ?? 1, output, missing };
+  },
+};
+
+/** Cargo's nightly-only workspace feature unification, and the config that turns it on. */
+const RESOLVER_UNIFICATION_BLOCK = [
+  '# One feature resolution for the whole workspace. Without it every per-crate',
+  '# cargo invocation resolves features for its own selection, so one shared',
+  '# dependency is compiled once per selection and no warm target directory is',
+  '# reused across crates. Requires the nightly channel the managed devenv',
+  '# module pins; on a stable toolchain a cargo-hakari workspace-hack does the',
+  '# same job. Both keys are needed: cargo ignores [resolver] without the',
+  '# [unstable] opt-in.',
+  '[unstable]',
+  'feature-unification = true',
+  '',
+  '[resolver]',
+  'feature-unification = "workspace"',
+].join('\n');
 
 const SKIPPED_DIRECTORY_NAMES = new Set([
   'node_modules',
@@ -256,6 +317,188 @@ function hasAncestorWorkspace(manifest: LoadedManifest, workspaceRoots: LoadedMa
   );
 }
 
+/**
+ * The channel that will actually compile this repository.
+ *
+ * The managed devenv module wins when it exists: devenv resolves the toolchain
+ * through rust-overlay and ignores `rust-toolchain.toml` unless
+ * `languages.rust.toolchainFile` names it, so a rust-toolchain file beside that
+ * module is decoration. Without the module, rustup's file is the answer. With
+ * neither, stable is the safe verdict: it is the channel on which the nightly
+ * resolver keys silently do nothing.
+ */
+function isNightlyToolchain(repositoryRoot: string, workspaceDirectory: string): boolean {
+  const devenvModule = join(repositoryRoot, 'tooling/direnv/devenv.smoo.nix');
+  if (existsSync(devenvModule)) {
+    const text = readFileSync(devenvModule, 'utf8');
+    const rustIndex = text.indexOf('languages.rust');
+    const channel = rustIndex === -1 ? null : /channel\s*=\s*"([^"]+)"/.exec(text.slice(rustIndex))?.[1];
+    return channel?.startsWith('nightly') === true;
+  }
+  for (const directory of [workspaceDirectory, repositoryRoot]) {
+    const path = join(directory, 'rust-toolchain.toml');
+    if (!existsSync(path)) {
+      continue;
+    }
+    try {
+      const validation = validateRustToolchainFile(Bun.TOML.parse(readFileSync(path, 'utf8')));
+      return validation.success && validation.data.toolchain?.channel?.startsWith('nightly') === true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+
+/**
+ * Cargo merges `.cargo/config.toml` from the invocation directory upward, with
+ * the deepest file winning. Only the configs at or above the workspace root can
+ * govern a command run there, so the effective value is the deepest of those.
+ */
+function effectiveConfigValue<T>(
+  configs: LoadedConfig[],
+  workspaceDirectory: string,
+  read: (config: CargoConfig) => T | undefined,
+): T | undefined {
+  let deepest: { directory: string; value: T } | null = null;
+  for (const loaded of configs) {
+    const directory = dirname(dirname(loaded.path));
+    if (!pathWithin(directory, workspaceDirectory)) {
+      continue;
+    }
+    const value = read(loaded.config);
+    if (value === undefined) {
+      continue;
+    }
+    if (deepest === null || directory.length > deepest.directory.length) {
+      deepest = { directory, value };
+    }
+  }
+  return deepest?.value;
+}
+
+function workspaceCrates(root: LoadedManifest, manifests: LoadedManifest[]): LoadedManifest[] {
+  const members = manifests.filter((manifest) => workspaceContains(root, manifest));
+  return root.manifest.package === undefined ? members : [root, ...members];
+}
+
+const FEATURE_UNIFICATION_FIX = 'Run: smoo monorepo update';
+
+/**
+ * A workspace of two or more crates must resolve features ONCE for all of them.
+ *
+ * Without that, every per-crate cargo invocation resolves features for its own
+ * selection, and one shared dependency is compiled once per selection: the same
+ * `nx run cargo-test-<crate>` that should reuse a warm target directory rebuilds
+ * its half of the graph instead. Cargo's own mechanism is nightly-only, so a
+ * stable toolchain reaches the identical result through a cargo-hakari
+ * workspace-hack — a generated crate that depends on the union of features, which
+ * every member then depends on.
+ *
+ * One crate needs neither: there is only one selection to unify.
+ */
+function featureUnificationPolicy(
+  repositoryRoot: string,
+  workspaceRoots: LoadedManifest[],
+  manifests: LoadedManifest[],
+  configs: LoadedConfig[],
+  shell: CargoHakariShell,
+): number {
+  let failures = 0;
+  for (const root of workspaceRoots) {
+    const crates = workspaceCrates(root, manifests);
+    if (crates.length < 2) {
+      continue;
+    }
+    const nightly = isNightlyToolchain(repositoryRoot, root.directory);
+    const resolver = effectiveConfigValue(
+      configs,
+      root.directory,
+      (config) => config.resolver?.['feature-unification'],
+    );
+    const unstable = effectiveConfigValue(
+      configs,
+      root.directory,
+      (config) => config.unstable?.['feature-unification'],
+    );
+    if (nightly && resolver === 'workspace') {
+      if (unstable !== true) {
+        failures += report(
+          join(root.directory, '.cargo/config.toml'),
+          'sets [resolver] feature-unification = "workspace" without [unstable] feature-unification = true, ' +
+            `so cargo ignores it and every crate still resolves features on its own. ${FEATURE_UNIFICATION_FIX}`,
+        );
+      }
+      continue;
+    }
+    if (existsSync(join(root.directory, '.config/hakari.toml'))) {
+      failures += hakariWorkspaceHackPolicy(root, crates, shell);
+      continue;
+    }
+    failures += report(
+      root.path,
+      `workspace of ${crates.length} crates has no workspace-wide feature unification: ` +
+        (nightly
+          ? 'add [unstable] feature-unification = true and [resolver] feature-unification = "workspace" to .cargo/config.toml'
+          : 'the [resolver] feature-unification key needs the nightly channel, so this stable toolchain needs a ' +
+            'cargo-hakari workspace-hack (.config/hakari.toml)') +
+        `. Every per-crate cargo invocation otherwise recompiles the shared graph for its own feature selection. ${FEATURE_UNIFICATION_FIX}`,
+    );
+  }
+  return failures;
+}
+
+function hakariWorkspaceHackPolicy(root: LoadedManifest, crates: LoadedManifest[], shell: CargoHakariShell): number {
+  const configPath = join(root.directory, '.config/hakari.toml');
+  let hackName: string | undefined;
+  try {
+    const validation = validateHakariConfig(Bun.TOML.parse(readFileSync(configPath, 'utf8')));
+    hackName = validation.success ? validation.data['hakari-package'] : undefined;
+  } catch {
+    hackName = undefined;
+  }
+  if (hackName === undefined || hackName.length === 0) {
+    return report(configPath, `must declare hakari-package = "<crate>". ${FEATURE_UNIFICATION_FIX}`);
+  }
+  const hack = crates.find((crate) => crate.manifest.package?.name === hackName);
+  if (hack === undefined) {
+    return report(
+      configPath,
+      `names hakari-package "${hackName}", which is not a member of this workspace. ${FEATURE_UNIFICATION_FIX}`,
+    );
+  }
+  const unwired = crates
+    .filter((crate) => crate !== hack)
+    .filter(
+      (crate) =>
+        ![crate.manifest.dependencies, crate.manifest['dev-dependencies'], crate.manifest['build-dependencies']].some(
+          (table) => table !== undefined && hackName in table,
+        ),
+    )
+    .map((crate) => crate.manifest.package?.name ?? crate.path);
+  if (unwired.length > 0) {
+    return report(
+      root.path,
+      `these crates do not depend on "${hackName}", so cargo-hakari cannot unify their features: ` +
+        `${unwired.join(', ')}. ${FEATURE_UNIFICATION_FIX}`,
+    );
+  }
+  const verify = shell.run(root.directory, ['verify']);
+  if (verify.missing) {
+    return report(
+      configPath,
+      'needs cargo-hakari, which is not installed; the managed devenv module provides it — reload the shell (direnv reload).',
+    );
+  }
+  if (verify.code !== 0) {
+    return report(
+      root.path,
+      `cargo hakari verify rejected the workspace-hack: ${verify.output || 'no output'}. ${FEATURE_UNIFICATION_FIX}`,
+    );
+  }
+  return 0;
+}
+
 function isWorkspaceMember(manifest: LoadedManifest, workspaceRoots: LoadedManifest[]): boolean {
   if (manifest.manifest.package?.workspace !== undefined) {
     return true;
@@ -563,7 +806,12 @@ function reportManifestDirectoryAdvisories(repositoryRoot: string, ignoredDirect
   }
 }
 
-export function validateCargoCachePolicy(root: string): number {
+export interface CargoPolicyOptions {
+  /** Injected in tests; production shells out to the real `cargo hakari`. */
+  shell?: CargoHakariShell;
+}
+
+export function validateCargoCachePolicy(root: string, options: CargoPolicyOptions = {}): number {
   const repositoryRoot = resolve(root);
   const discoveredManifestPaths = discoverFiles(repositoryRoot, (name) => name === 'Cargo.toml');
   const ignoredDirectories = discoverIgnoredSubtrees(discoveredManifestPaths);
@@ -606,6 +854,13 @@ export function validateCargoCachePolicy(root: string): number {
 
   const workspaceRoots = manifests.filter((loaded) => loaded.manifest.workspace !== undefined);
   failures += reportManifestPolicy(manifests, workspaceRoots);
+  failures += featureUnificationPolicy(
+    repositoryRoot,
+    workspaceRoots,
+    manifests,
+    configs,
+    options.shell ?? defaultHakariShell,
+  );
   failures += cargoIncrementalPolicy(repositoryRoot, configs, packageJsonPaths, justfilePaths, ignoredDirectories);
   for (const config of configs) {
     failures += configPolicy(config, repositoryRoot);
@@ -613,3 +868,87 @@ export function validateCargoCachePolicy(root: string): number {
   reportManifestDirectoryAdvisories(repositoryRoot, ignoredDirectories);
   return failures;
 }
+
+/**
+ * The fix `smoo monorepo update` applies for the policy above: write the
+ * nightly resolver configuration, or generate and wire the workspace-hack a
+ * stable toolchain needs. Both are idempotent — the second run of either does
+ * nothing — because update runs on every repository, not only broken ones.
+ */
+export function applyCargoFeatureUnification(root: string, options: CargoPolicyOptions = {}): void {
+  const repositoryRoot = resolve(root);
+  const shell = options.shell ?? defaultHakariShell;
+  const discoveredManifestPaths = discoverFiles(repositoryRoot, (name) => name === 'Cargo.toml');
+  const manifestPaths = filterIgnoredPaths(discoveredManifestPaths, discoverIgnoredSubtrees(discoveredManifestPaths));
+  const manifests: LoadedManifest[] = [];
+  for (const path of manifestPaths) {
+    const manifest = loadManifest(path);
+    if (manifest !== null) {
+      manifests.push({ path, directory: dirname(path), manifest });
+    }
+  }
+  for (const root of manifests.filter((loaded) => loaded.manifest.workspace !== undefined)) {
+    if (workspaceCrates(root, manifests).length < 2) {
+      continue;
+    }
+    if (isNightlyToolchain(repositoryRoot, root.directory)) {
+      writeResolverUnification(root.directory);
+      continue;
+    }
+    const hakariConfig = join(root.directory, '.config/hakari.toml');
+    const relativeRoot = relative(repositoryRoot, root.directory) || '.';
+    if (!existsSync(hakariConfig)) {
+      console.log(`generating     cargo workspace-hack in ${relativeRoot} (cargo hakari init workspace-hack)`);
+      runHakari(shell, root.directory, ['init', 'workspace-hack']);
+    }
+    console.log(`unifying       cargo features in ${relativeRoot} (cargo hakari generate, manage-deps)`);
+    runHakari(shell, root.directory, ['generate']);
+    runHakari(shell, root.directory, ['manage-deps', '--yes']);
+  }
+}
+
+function runHakari(shell: CargoHakariShell, directory: string, args: readonly string[]): void {
+  const result = shell.run(directory, args);
+  if (result.missing) {
+    console.error(
+      `cargo hakari is not installed, so the workspace-hack in ${directory} was not updated; the managed devenv module provides it — reload the shell (direnv reload).`,
+    );
+    return;
+  }
+  if (result.code !== 0) {
+    console.error(`cargo hakari ${args.join(' ')} failed in ${directory}: ${result.output || 'no output'}`);
+  }
+}
+
+/**
+ * Append the two keys, never rewrite the file. A `.cargo/config.toml` carries
+ * linkers, env and target settings whose ORDER and comments are load-bearing;
+ * re-emitting parsed TOML would lose both. If either table already exists with
+ * some other content, appending a second one is invalid TOML — so that case is
+ * reported for a human instead of being guessed at.
+ */
+function writeResolverUnification(workspaceDirectory: string): void {
+  const path = join(workspaceDirectory, '.cargo/config.toml');
+  const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
+  if (existing === null) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${RESOLVER_UNIFICATION_BLOCK}\n`);
+    console.log(`writing        ${path}`);
+    return;
+  }
+  const parsed = loadConfig(path);
+  if (parsed === null) {
+    return;
+  }
+  if (parsed.resolver?.['feature-unification'] === 'workspace' && parsed.unstable?.['feature-unification'] === true) {
+    return;
+  }
+  if (parsed.resolver !== undefined || parsed.unstable !== undefined) {
+    console.error(
+      `${path}: already declares [resolver] or [unstable]; add feature-unification to the existing tables by hand:\n${RESOLVER_UNIFICATION_BLOCK}`,
+    );
+    return;
+  }
+  writeFileSync(path, `${existing.replace(/\n*$/, '\n')}\n${RESOLVER_UNIFICATION_BLOCK}\n`);
+  console.log(`updating       ${path}`);
+}

package/src/monorepo/github-actions-bootstrap.test.ts

@@ -140,7 +140,7 @@ interface InstallRun {
   nixCalls: string;
 }
 
-function runInstallDevenv(lock: string, options: { devenvOnPath?: boolean } = {}): InstallRun {
+function runInstallDevenv(lock: string, options: { devenvVersion?: string; hostRunner?: boolean } = {}): InstallRun {
   const dir = mkdtempSync(join(tmpdir(), 'gab-install-'));
   try {
     const direnv = join(dir, 'root', 'tooling', 'direnv');
@@ -154,20 +154,22 @@ function runInstallDevenv(lock: string, options: { devenvOnPath?: boolean } = {}
     const stub = join(bin, 'nix');
     writeFileSync(stub, NIX_STUB);
     chmodSync(stub, 0o755);
-    if (options.devenvOnPath) {
+    if (options.devenvVersion !== undefined) {
+      // Shaped like the real thing: `devenv <semver>+<short rev> (<system>)`.
       const devenv = join(bin, 'devenv');
-      writeFileSync(devenv, '#!/usr/bin/env bash\necho 9.9.9-from-path\n');
+      writeFileSync(devenv, `#!/usr/bin/env bash\necho "${options.devenvVersion}"\n`);
       chmodSync(devenv, 0o755);
     }
     const r = spawnSync('bash', [join(direnv, 'github-actions-bootstrap.sh'), 'install-devenv'], {
       encoding: 'utf8',
-      // A bare PATH on purpose: an ambient devenv would select the
-      // already-installed branch and the pin would never be exercised.
+      // A bare PATH on purpose: an ambient devenv would decide these cases
+      // instead of the stub.
       env: {
         PATH: `${bin}:${dirname(REAL_NIX)}:/usr/bin:/bin`,
         HOME: join(dir, 'home'),
         NIX_CALLS: nixCalls,
         REAL_NIX,
+        ...(options.hostRunner ? { SMOO_HOST_RUNNER: 'true' } : {}),
       },
     });
     return {
@@ -181,10 +183,12 @@ function runInstallDevenv(lock: string, options: { devenvOnPath?: boolean } = {}
   }
 }
 
+const REV = 'f'.repeat(40);
+
 const LOCK_WITH_REV = JSON.stringify({
   nodes: {
     devenv: {
-      locked: { dir: 'src/modules', owner: 'cachix', repo: 'devenv', rev: 'f'.repeat(40), type: 'github' },
+      locked: { dir: 'src/modules', owner: 'cachix', repo: 'devenv', rev: REV, type: 'github' },
       original: { dir: 'src/modules', owner: 'cachix', repo: 'devenv', type: 'github' },
     },
   },
@@ -202,10 +206,10 @@ describe('github-actions-bootstrap install-devenv', () => {
     // The rev comes out of the lock, so the CLI is the commit whose modules the
     // shell is locked to. An unpinned `github:cachix/devenv` would install
     // whatever HEAD is on the day a cold runner misses the store cache.
-    expect(run.nixCalls).toContain(`nix profile add --accept-flake-config github:cachix/devenv/${'f'.repeat(40)}`);
+    expect(run.nixCalls).toContain(`nix profile add --accept-flake-config github:cachix/devenv/${REV}`);
     expect(run.nixCalls).not.toContain('github:cachix/devenv\n');
     // Announced, so a run's log names the version it installed.
-    expect(run.stdout).toContain(`github:cachix/devenv/${'f'.repeat(40)}`);
+    expect(run.stdout).toContain(`github:cachix/devenv/${REV}`);
   });
 
   it('refuses to install anything when the lock names no devenv rev', () => {
@@ -216,10 +220,60 @@ describe('github-actions-bootstrap install-devenv', () => {
     expect(run.nixCalls).not.toContain('profile add');
   });
 
-  it('keeps an already-installed devenv and never evaluates the flake', () => {
-    const run = runInstallDevenv(LOCK_WITH_REV, { devenvOnPath: true });
+  it('keeps a restored devenv built from the locked commit', () => {
+    const run = runInstallDevenv(LOCK_WITH_REV, { devenvVersion: 'devenv 2.3.1+fffffff (aarch64-darwin)' });
+    expect(run.status).toBe(0);
+    expect(run.stdout).toContain('using locked devenv');
+    // The warm path must cost nothing: no eval of the flake, no profile writes.
+    expect(run.nixCalls).toBe('');
+  });
+
+  it('replaces a restored devenv that is a different commit than the lock', () => {
+    // The real drift: the store cache restores ~/.nix-profile wholesale, so a
+    // rotated key hands the job the CLI of whichever run last populated the
+    // prefix. Observed in run 34369909403 as devenv 2.3.1+2a399e9 against a
+    // lock naming 190959a.
+    const run = runInstallDevenv(LOCK_WITH_REV, { devenvVersion: 'devenv 2.3.1+2a399e9 (aarch64-darwin)' });
+    if (run.status !== 0) {
+      printCommandOutput(run.stdout, run.stderr);
+    }
+    expect(run.status).toBe(0);
+    // Removal first: `nix profile add` collides on bin/devenv at equal priority.
+    const removeAt = run.nixCalls.indexOf('profile remove --all');
+    const addAt = run.nixCalls.indexOf(`profile add --accept-flake-config github:cachix/devenv/${REV}`);
+    expect(removeAt).toBeGreaterThanOrEqual(0);
+    expect(addAt).toBeGreaterThan(removeAt);
+    // Said out loud, with both commits, so a log explains the replacement.
+    expect(run.stdout).toContain('replacing devenv');
+    expect(run.stdout).toContain('2a399e9');
+  });
+
+  it('leaves a host runner its own devenv, whatever commit it is', () => {
+    // Host runners own their Nix profile; a repository rewriting it would take
+    // the whole fleet's shared store with it.
+    const run = runInstallDevenv(LOCK_WITH_REV, {
+      devenvVersion: 'devenv 2.3.1+2a399e9 (x86_64-linux)',
+      hostRunner: true,
+    });
     expect(run.status).toBe(0);
-    expect(run.stdout).toContain('using existing devenv');
+    expect(run.stdout).toContain('using host devenv');
     expect(run.nixCalls).toBe('');
   });
+
+  it('installs from the floating branch on a host runner with no devenv', () => {
+    // The one place drift is accepted deliberately. A host installs into a
+    // long-lived profile that roots the fleet's shared store, and holding it
+    // back to an older CLI than the fleet was running segfaulted the Rust
+    // linker in run 34374650577. Refusing to install at all was also wrong —
+    // that failed linux-release-candidate in run 34373420924.
+    const run = runInstallDevenv(LOCK_WITH_REV, { hostRunner: true });
+    if (run.status !== 0) {
+      printCommandOutput(run.stdout, run.stderr);
+    }
+    expect(run.status).toBe(0);
+    expect(run.nixCalls).toContain('nix profile add --accept-flake-config github:cachix/devenv\n');
+    expect(run.nixCalls).not.toContain(REV);
+    // Never on a host: the profile roots a store the whole fleet shares.
+    expect(run.nixCalls).not.toContain('profile remove');
+  });
 });

package/src/monorepo/index.ts

@@ -2,7 +2,7 @@ import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { printCommandOutput, run, runResult } from '../lib/run.js';
 import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePackages } from '../lib/workspace.js';
 import { readProjectTargets } from '../nx/index.js';
-import { validateCargoCachePolicy } from './cargo-policy.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy } from './cargo-policy.js';
 import {
   formatCommitMessage,
   stagedDeletedPublicPackages,
@@ -112,6 +112,10 @@ export async function updateManagedFiles(root: string): Promise<void> {
   // Tool dependency policy (typescript API 6, @typescript/native for ttsc, nx, …)
   // lives next to managed templates — update must install them, not only rewrite files.
   await applyToolConfigDefaults(root);
+  // Rust's half of the same job: a multi-crate Cargo workspace must resolve
+  // features once for every member, or each per-crate cargo invocation
+  // recompiles the shared graph for its own selection.
+  applyCargoFeatureUnification(root);
   syncBunLockfileVersions(root, { mode: 'install' });
   console.log('installing     workspace dependencies (bun install)');
   await run('bun', ['install', '--no-summary'], root);

package/src/monorepo/packs/index.test.ts

@@ -221,6 +221,38 @@ describe('monorepo validation pack phases', () => {
     }
   });
 
+  it('validates and fixes cargo workspace feature unification through its own pack', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-validate-cargo-'));
+    try {
+      await mkdir(join(root, 'crates/alpha'), { recursive: true });
+      await mkdir(join(root, 'crates/beta'), { recursive: true });
+      await mkdir(join(root, 'tooling/direnv'), { recursive: true });
+      await writeFile(
+        join(root, 'Cargo.toml'),
+        '[workspace]\nmembers = ["crates/*"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+      );
+      await writeFile(join(root, 'crates/alpha/Cargo.toml'), '[package]\nname = "alpha"\n');
+      await writeFile(join(root, 'crates/beta/Cargo.toml'), '[package]\nname = "beta"\n');
+      await writeFile(join(root, 'tooling/direnv/devenv.smoo.nix'), 'languages.rust = {\n  channel = "nightly";\n};\n');
+      const cargoPack = packsForTest.find((pack) => pack.name === 'cargo');
+      if (!cargoPack) {
+        throw new Error('cargo validation pack not found');
+      }
+      const runBuild = () => 0;
+
+      // A policy nothing calls is not a policy: validate must reach it.
+      expect(
+        await runValidatePacks({ root, syncRuntime: false }, { failFast: true }, { packs: [cargoPack], runBuild }),
+      ).toEqual({ failures: 1, failedChecks: 1 });
+
+      expect(
+        await runValidatePacks({ root, syncRuntime: false }, { fix: true }, { packs: [cargoPack], runBuild }),
+      ).toEqual({ failures: 0, failedChecks: 0 });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it('propagates parsed target dependencies through the production adapter', () => {
     const targetDependencies = new Map([
       ['build', ['compile-linux']],

package/src/monorepo/packs/index.ts

@@ -2,6 +2,7 @@ import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../../nx/index.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy } from '../cargo-policy.js';
 import { validateGoToolchainAgreement } from '../go-toolchain.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateDevenvModuleImport, warnOnManagedFileDrift } from '../managed-files.js';
@@ -120,6 +121,18 @@ const packs: MonorepoPack[] = [
       return validateDevenvModuleImport(ctx.root);
     },
   },
+  {
+    // Cargo's build-cache and feature-unification conventions. `--fix` writes
+    // the workspace feature unification a multi-crate workspace needs; the rest
+    // of the policy is a verdict a human has to act on.
+    name: 'cargo',
+    fixPreBuild(ctx) {
+      applyCargoFeatureUnification(ctx.root);
+    },
+    validatePreBuild(ctx) {
+      return validateCargoCachePolicy(ctx.root);
+    },
+  },
   {
     name: 'publishing',
     init(ctx) {