@smoothbricks/cli 0.11.19 → 0.11.21

package/src/cli.ts

@@ -7,6 +7,7 @@ import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
 import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
+import { secretsRun } from './secrets/run.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
 import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
@@ -74,6 +75,11 @@ function buildProgram(): Command {
     .description('SmoothBricks monorepo tooling')
     .version(cliPackageVersion, '-v, --version', 'print smoo version')
     .exitOverride()
+    // `smoo secrets run <group> <command...>` hands the rest of argv to a
+    // child verbatim, flags included. Commander only stops parsing after the
+    // first operand when positional options are enabled here, on the parent
+    // of the command that declares `passThroughOptions`.
+    .enablePositionalOptions()
     .showHelpAfterError();
 
   const monorepo = program.command('monorepo').description('Manage SmoothBricks-style monorepos');
@@ -529,11 +535,29 @@ function buildProgram(): Command {
 
   const secrets = program
     .command('secrets')
-    .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+    .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds')
+    .enablePositionalOptions();
+  secrets
+    .command('run [group] [command...]')
+    .description(
+      'Run one command with one group of declared secrets in its environment. Shell entry resolves the ' +
+        '`shell` group only, so a registry credential or the Nx cache token is resolved here, by the command ' +
+        'that needs it, instead of by every direnv reload. The group is required and positional: with none, ' +
+        'this lists the groups this repository declares and the secrets in each',
+    )
+    // Everything after the group reaches the child verbatim, flags included:
+    // `smoo secrets run registry bun add -d @acme/x` must run `bun add -d
+    // @acme/x`, not lose `-d` to this command's own parser.
+    .passThroughOptions()
+    .action(async (group: string | undefined, command: string[]) => {
+      process.exitCode = await secretsRun(await findRepoRoot(), group, command);
+    });
   secrets
     .command('status')
     .description(
-      'Show every declared secret with the scopes holding it, and refuse when a workflow passes one none has',
+      'Show every declared secret with the scopes holding it. Exits 0 when every secret a managed workflow ' +
+        'passes has a value in a scope the job reads, and 1 when one does not or when the repository, its ' +
+        'secrets or a stage declaration could not be read',
     )
     .option(
       '-R, --repo <owner/name|remote>',
@@ -543,8 +567,13 @@ function buildProgram(): Command {
       '--env <environment>',
       "also read this GitHub Environment; its value takes precedence over the repository's for a job bound to it",
     )
-    .action(async (options: { repo?: string; env?: string }) => {
-      process.exitCode = secretsStatus(await findRepoRoot(), options);
+    .option(
+      '--json',
+      'write one JSON document to stdout instead of the table, for another tool to read; the exit code is ' +
+        'unchanged, so a status that refuses still refuses',
+    )
+    .action(async (options: { repo?: string; env?: string; json?: boolean }) => {
+      process.exitCode = await secretsStatus(await findRepoRoot(), options);
     });
   secrets
     .command('set [name]')
@@ -586,7 +615,7 @@ function buildProgram(): Command {
   wrangler
     .command('deploy-stage')
     .requiredOption('--stage <stage>', 'staging, production, or prN')
-    .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
+    .option('--config <path>', "deploy a build-generated flat wrangler.json instead of the project's own config")
     .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
     .action(async (options: { stage: string; config?: string; versionEndpoint?: string }) => {
       await deployStage(process.cwd(), {

package/src/lib/json.ts

@@ -212,10 +212,32 @@ export interface PackageRemoteCacheConfig {
   tokenSecret: RepositorySecretName;
 }
 
-/** Local bootstrap fallback; existing environment values always take precedence. */
+/**
+ * A `smoo.secrets` group: which operation resolves the credential. One argv
+ * word of `smoo secrets run <group> <command...>`, so whitespace would make
+ * that command unwritable. Only the shape is validated — the values are the
+ * repository's, and a new group must not need a new smoo release.
+ */
+export type SecretGroupName = string & typia.tags.MinLength<1> & typia.tags.Pattern<'^\\S+$'>;
+
+/**
+ * Local bootstrap fallback; existing environment values always take
+ * precedence, and CI injects these variables instead of running commands.
+ *
+ * Shell entry resolves the `shell` group and nothing else; every other group
+ * is resolved by `smoo secrets run <group> <command...>`, the one command
+ * that needs it. The group is DERIVED from what this manifest already
+ * declares — a variable `.npmrc` interpolates as `${VAR}` is `registry`, the
+ * variable `smoo.remoteCache.tokenSecret` names is `nx-cache`, everything
+ * else is `shell` — so `group` below is only for what those declarations
+ * cannot say. The routing lives in tooling/direnv/secret-references.ts,
+ * whose header states the rule and the derivation.
+ */
 export interface PackageSecretCommand {
   /** Executed directly, without a shell; stdout supplies the secret value. */
   command: NonEmptyArray<string>;
+  /** Overrides the derived group; absent derives one from this manifest and `.npmrc`. */
+  group?: SecretGroupName;
 }
 
 export interface PackageSmooConfig {

package/src/monorepo/cargo-policy.test.ts

@@ -3,7 +3,13 @@ import { readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { applyCargoFeatureUnification, type CargoHakariShell, validateCargoCachePolicy } from './cargo-policy.js';
+import type { ProjectTargets } from '../nx/index.js';
+import {
+  applyCargoFeatureUnification,
+  type CargoHakariShell,
+  validateCargoCachePolicy,
+  validateCargoToolchainInputs,
+} from './cargo-policy.js';
 
 async function withFixture<T>(files: Record<string, string>, callback: (root: string) => T): Promise<T> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-cargo-policy-'));
@@ -33,6 +39,20 @@ async function check(
   });
 }
 
+async function checkToolchain(
+  files: Record<string, string>,
+  projects: ProjectTargets[],
+): Promise<{ failures: number; messages: string[] }> {
+  return withFixture(files, (root) => {
+    const captured = captureErrors();
+    try {
+      return { failures: validateCargoToolchainInputs(root, projects), messages: captured.messages };
+    } finally {
+      captured.restore();
+    }
+  });
+}
+
 /** Records what update would run, and answers `verify` however the test needs. */
 function recordingHakari(
   verify: { code: number; output?: string; missing?: boolean } = { code: 0 },
@@ -389,3 +409,73 @@ describe('Cargo feature unification update', () => {
     );
   });
 });
+
+describe('cargo toolchain identity policy', () => {
+  const cargoLint = (inputs: string[]): ProjectTargets => ({
+    project: 'codebase',
+    root: '.',
+    targets: ['cargo-lint'],
+    targetCache: new Map([['cargo-lint', true]]),
+    targetInputs: new Map([['cargo-lint', inputs]]),
+    targetOptions: new Map([['cargo-lint', { command: 'cargo --frozen clippy --workspace -- -D warnings' }]]),
+  });
+
+  // The failure this policy exists for: a hand-written input list replaces the
+  // inferred one, so the target stops hashing the pin and a toolchain bump
+  // leaves its cached verdict standing.
+  it('refuses a cached cargo target whose declared inputs drop the pin', async () => {
+    const { failures, messages } = await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['rustWorkspace'])]);
+    expect(failures).toBe(1);
+    expect(messages).toEqual([
+      'codebase:cargo-lint: cached cargo target hashes no toolchain pin, so a toolchain bump cannot invalidate it. ' +
+        'Add "cargoToolchain" to its inputs, or to the named input it uses.',
+    ]);
+  });
+
+  it('accepts the pin reached directly, through a named input, or by the name inference defines', async () => {
+    const viaNamedInput = JSON.stringify({
+      namedInputs: { rustWorkspace: ['{workspaceRoot}/Cargo.toml', '{workspaceRoot}/tooling/direnv/devenv.lock'] },
+    });
+    expect(await checkToolchain({ 'nx.json': viaNamedInput }, [cargoLint(['rustWorkspace'])])).toMatchObject({
+      failures: 0,
+    });
+    expect(
+      await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['{workspaceRoot}/tooling/direnv/devenv.lock'])]),
+    ).toMatchObject({ failures: 0 });
+    expect(await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['cargoToolchain'])])).toMatchObject({
+      failures: 0,
+    });
+  });
+
+  // A negated fileset REMOVES a path from the hash. Reading one as the pin
+  // would accept the exact declaration that guarantees the bug.
+  it('does not accept an excluded lock as the pin', async () => {
+    expect(
+      await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['!{workspaceRoot}/tooling/direnv/devenv.lock'])]),
+    ).toMatchObject({ failures: 1 });
+  });
+
+  // Only what Nx can restore, and only what runs cargo: an uncached warm-up or
+  // a TypeScript build has no stale artifact for a toolchain bump to strand.
+  it('governs cached cargo targets only', async () => {
+    const uncached: ProjectTargets = {
+      ...cargoLint([]),
+      targetCache: new Map([['cargo-lint', false]]),
+    };
+    const notCargo: ProjectTargets = {
+      ...cargoLint([]),
+      targets: ['tsc-js'],
+      targetCache: new Map([['tsc-js', true]]),
+      targetInputs: new Map([['tsc-js', ['default']]]),
+      targetOptions: new Map([['tsc-js', { command: 'ttsc --build' }]]),
+    };
+    expect(await checkToolchain({ 'nx.json': '{}\n' }, [uncached, notCargo])).toMatchObject({ failures: 0 });
+  });
+
+  // A cyclic named input is a repository mistake, not a reason to hang the
+  // whole validation run before it can report anything at all.
+  it('terminates on a named input that references itself', async () => {
+    const cyclic = JSON.stringify({ namedInputs: { rustWorkspace: ['rustWorkspace'] } });
+    expect(await checkToolchain({ 'nx.json': cyclic }, [cargoLint(['rustWorkspace'])])).toMatchObject({ failures: 1 });
+  });
+});

package/src/monorepo/cargo-policy.ts

@@ -1,8 +1,10 @@
 import { spawnSync } from 'node:child_process';
 import { type Dirent, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { CARGO_TOOLCHAIN_NAMED_INPUT, isCargoToolchainInput } from '@smoothbricks/nx-plugin/cargo-toolchain-policy';
 import typia from 'typia';
-import { parsePackageJsonText } from '../lib/json.js';
+import { type NxJson, type NxTargetOptions, parseNxJsonText, parsePackageJsonText } from '../lib/json.js';
+import type { ProjectTargets } from '../nx/index.js';
 
 interface CargoProfile {
   inherits?: string;
@@ -869,6 +871,90 @@ export function validateCargoCachePolicy(root: string, options: CargoPolicyOptio
   return failures;
 }
 
+/** A command that compiles or checks Rust, whichever driver spells it. */
+const RUNS_CARGO = /(?:^|[\s;&|])cargo[\s-]|\bnapi build\b/;
+
+const CARGO_TOOLCHAIN_FIX = `Add "${CARGO_TOOLCHAIN_NAMED_INPUT}" to its inputs, or to the named input it uses`;
+
+function commandsOf(options: NxTargetOptions | undefined): string {
+  const command: unknown = options?.command;
+  const commands: unknown = options?.commands;
+  return [
+    typeof command === 'string' ? command : '',
+    ...(Array.isArray(commands) ? commands.filter((entry) => typeof entry === 'string') : []),
+  ].join('\n');
+}
+
+/**
+ * Every fileset one declared input list reaches, with nx.json's named inputs
+ * expanded. The plugin's own `cargoToolchain` is defined per PROJECT and wins
+ * over nx.json, so naming it counts without an entry here; a repository that
+ * redefines it workspace-wide is expanded and judged on what it resolves to.
+ */
+function resolveInputFilesets(
+  declared: readonly string[],
+  namedInputs: NonNullable<NxJson['namedInputs']>,
+  seen: Set<string> = new Set(),
+): string[] {
+  const filesets: string[] = [];
+  for (const entry of declared) {
+    const name = entry.startsWith('^') ? entry.slice(1) : entry;
+    const definition = namedInputs[name];
+    if (definition === undefined) {
+      filesets.push(entry);
+      continue;
+    }
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const expanded = typeof definition === 'string' ? [definition] : definition;
+    filesets.push(
+      ...resolveInputFilesets(
+        expanded.filter((value): value is string => typeof value === 'string'),
+        namedInputs,
+        seen,
+      ),
+    );
+  }
+  return filesets;
+}
+
+/**
+ * A cached cargo target must hash the toolchain that compiled it.
+ *
+ * Inference attaches the pin to every cargo target it infers, but a repository
+ * that DECLARES `inputs` for one replaces that list wholesale and silently
+ * drops it — the target then survives a toolchain bump with a stale verdict,
+ * and a pre-push cross-compile probe consults a cache entry that cannot
+ * express the change it is probing for. Measured before this policy existed:
+ * a one-byte bump to the declared pin left one repository's `cargo-lint-cross`
+ * hash unchanged.
+ *
+ * This is a generated safety property removed by a local override, which no
+ * amount of care at the override site will catch on its own, so it is checked
+ * against the RESOLVED graph rather than against any one file.
+ */
+export function validateCargoToolchainInputs(root: string, projects: readonly ProjectTargets[]): number {
+  const nxJsonPath = join(resolve(root), 'nx.json');
+  const namedInputs = existsSync(nxJsonPath)
+    ? (parseNxJsonText(readFileSync(nxJsonPath, 'utf8'))?.namedInputs ?? {})
+    : {};
+  let failures = 0;
+  for (const project of projects) {
+    for (const target of [...project.targets].sort()) {
+      if (project.targetCache?.get(target) !== true) continue;
+      if (!RUNS_CARGO.test(commandsOf(project.targetOptions?.get(target)))) continue;
+      const declared = project.targetInputs?.get(target) ?? [];
+      if (declared.includes(CARGO_TOOLCHAIN_NAMED_INPUT)) continue;
+      if (resolveInputFilesets(declared, namedInputs).some(isCargoToolchainInput)) continue;
+      failures += report(
+        `${project.project}:${target}`,
+        `cached cargo target hashes no toolchain pin, so a toolchain bump cannot invalidate it. ${CARGO_TOOLCHAIN_FIX}.`,
+      );
+    }
+  }
+  return failures;
+}
+
 /**
  * The fix `smoo monorepo update` applies for the policy above: write the
  * nightly resolver configuration, or generate and wire the workspace-hack a

package/src/monorepo/index.ts

@@ -2,7 +2,11 @@ import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { printCommandOutput, run, runResult } from '../lib/run.js';
 import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePackages } from '../lib/workspace.js';
 import { readProjectTargets } from '../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from './cargo-policy.js';
+import {
+  applyCargoFeatureUnification,
+  validateCargoCachePolicy,
+  validateCargoToolchainInputs,
+} from './cargo-policy.js';
 import {
   formatCommitMessage,
   stagedDeletedPublicPackages,
@@ -133,7 +137,8 @@ export async function checkManagedFiles(root: string, options: { warn?: boolean
   }
   const results = await applyManagedFiles(root, 'check');
   printResults(results);
-  const resolvedTargets = resolvedTargetsByProject(await readProjectTargets(root));
+  const projectTargets = await readProjectTargets(root);
+  const resolvedTargets = resolvedTargetsByProject(projectTargets);
   const packageFailures =
     validateRootPackagePolicy(root) +
     validateNxProjectNames(root) +
@@ -145,6 +150,7 @@ export async function checkManagedFiles(root: string, options: { warn?: boolean
     validateWorkspaceDependencies(root, { resolvedTargetsByProject: resolvedTargets }) +
     validateDevenvModuleImport(root) +
     validateCargoCachePolicy(root) +
+    validateCargoToolchainInputs(root, projectTargets) +
     validateSccachePatches(root);
   if (results.some((result) => result.action === 'drifted') || packageFailures > 0) {
     throw new Error('Managed monorepo files or package conventions are out of date. Run: smoo monorepo update');

package/src/monorepo/package-policy.test.ts

@@ -532,12 +532,7 @@ describe('workspace package script policy', () => {
     });
     try {
       await writeJson(join(root, 'packages/native/tsconfig.lib.json'), {});
-      const resolvedTargetsByProject = new Map([
-        [
-          'native',
-          { targets: new Set(['build', 'tsc-js', 'tsdown-js']), buildDependsOn: ['^build', 'tsc-js', 'tsdown-js'] },
-        ],
-      ]);
+      const resolvedTargetsByProject = new Map([['native', { targets: new Set(['build', 'tsc-js', 'tsdown-js']) }]]);
 
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
 
@@ -574,9 +569,7 @@ describe('workspace package script policy', () => {
       ],
     });
     try {
-      const resolvedTargetsByProject = new Map([
-        ['native', { targets: new Set(['build', 'tsdown-js']), buildDependsOn: ['^build', 'tsdown-js'] }],
-      ]);
+      const resolvedTargetsByProject = new Map([['native', { targets: new Set(['build', 'tsdown-js']) }]]);
 
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
 
@@ -596,7 +589,7 @@ describe('workspace package script policy', () => {
     }
   });
 
-  it('removes noop aggregate build targets only when they match resolved Nx plugin output', async () => {
+  it('removes noop aggregate build targets whose dependencies inference already produces', async () => {
     const root = await createWorkspace({
       rootName: '@smoothbricks/codebase',
       packages: [
@@ -613,12 +606,7 @@ describe('workspace package script policy', () => {
       ],
     });
     try {
-      const resolvedTargetsByProject = new Map([
-        [
-          'native',
-          { targets: new Set(['build', 'tsc-js', 'tsdown-js']), buildDependsOn: ['^build', 'tsc-js', 'tsdown-js'] },
-        ],
-      ]);
+      const resolvedTargetsByProject = new Map([['native', { targets: new Set(['build', 'tsc-js', 'tsdown-js']) }]]);
 
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
 
@@ -629,6 +617,51 @@ describe('workspace package script policy', () => {
     }
   });
 
+  /**
+   * The AxE regression: `containium` declares its build aggregate because
+   * inference cannot reach the producers it needs — its own `build-cli`, and
+   * sibling targets that are not named `build`, so `^build` never visits them,
+   * and are outside the `*-js|*-web|…` output family, so the inferred aggregate
+   * never collects them either. Nx replaces a named property of an inferred
+   * target with the declared one, so the resolved graph echoes the declaration
+   * straight back; comparing a declaration against that echo says "redundant"
+   * about every hand-written aggregate and deletes the only thing that ordered
+   * the build. `tsc-js` is in the list on purpose: one inferable entry beside
+   * two that are not must still keep the whole block.
+   */
+  it('keeps noop build aggregates that name edges inference cannot produce', async () => {
+    const declaredBuild = {
+      executor: 'nx:noop',
+      cache: true,
+      dependsOn: ['build-cli', 'containium-bun:runtime', 'tsc-js'],
+    };
+    const root = await createWorkspace({
+      rootName: '@smoothbricks/codebase',
+      packages: [
+        { dir: 'containium-bun', name: '@axe.sc/containium-bun', nx: { name: 'containium-bun' } },
+        {
+          dir: 'containium',
+          name: '@axe.sc/containium',
+          nx: { name: 'containium', targets: { build: declaredBuild } },
+        },
+      ],
+    });
+    try {
+      const resolvedTargetsByProject = new Map([
+        ['containium-bun', { targets: new Set(['build', 'runtime', 'tsc-js']) }],
+        ['containium', { targets: new Set(['build', 'build-cli', 'tsc-js']) }],
+      ]);
+
+      applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
+
+      const containium = await readJson(join(root, 'packages/containium/package.json'));
+      expect(containium.nx).toEqual({ name: 'containium', targets: { build: declaredBuild } });
+      expect(validateWorkspaceDependencies(root, { resolvedTargetsByProject })).toBe(0);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it('accepts wildcard aggregate build dependencies', async () => {
     const root = await createWorkspace({
       rootName: '@smoothbricks/codebase',
@@ -669,9 +702,7 @@ describe('workspace package script policy', () => {
       ],
     });
     try {
-      const resolvedTargetsByProject = new Map([
-        ['native', { targets: new Set(['build', 'tsc-js', 'tsdown-js']), buildDependsOn: buildOutputDependencies }],
-      ]);
+      const resolvedTargetsByProject = new Map([['native', { targets: new Set(['build', 'tsc-js', 'tsdown-js']) }]]);
 
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
 

package/src/monorepo/packs/index.ts

@@ -2,7 +2,11 @@ import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from '../cargo-policy.js';
+import {
+  applyCargoFeatureUnification,
+  validateCargoCachePolicy,
+  validateCargoToolchainInputs,
+} from '../cargo-policy.js';
 import { validateGoToolchainAgreement } from '../go-toolchain.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateDevenvModuleImport, warnOnManagedFileDrift } from '../managed-files.js';
@@ -140,6 +144,11 @@ const packs: MonorepoPack[] = [
     validatePreBuild(ctx) {
       return validateCargoCachePolicy(ctx.root);
     },
+    // Post-build: the toolchain identity is read off the RESOLVED graph, which
+    // means running the inference plugin, which means its dist has to exist.
+    async validatePostBuild(ctx) {
+      return validateCargoToolchainInputs(ctx.root, await readProjectTargets(ctx.root));
+    },
   },
   {
     name: 'publishing',
@@ -457,7 +466,6 @@ export function resolvedTargetsByProject(projects: ProjectTargets[]): Map<string
       {
         ...(project.root ? { root: project.root } : {}),
         targets: new Set(project.targets),
-        ...(project.buildDependsOn ? { buildDependsOn: project.buildDependsOn } : {}),
         ...(project.targetDependencies ? { targetDependencies: project.targetDependencies } : {}),
         ...(project.targetExecutors ? { targetExecutors: project.targetExecutors } : {}),
         ...(project.targetOptions ? { targetOptions: project.targetOptions } : {}),