@tishlang/tish-format 3.10.4 → 3.10.9

package/crates/tish_core/src/value.rs

@@ -847,11 +847,15 @@ impl PropMap {
             // Update existing key → value changes, layout (shape) does not.
             return Some(core::mem::replace(&mut slot.1, val));
         }
-        // New key (inline storage) → transition the shape away from the current one.
-        self.shape = crate::shape::transition(self.shape, &key);
         if self.inline.len() >= PROPMAP_INLINE {
-            // Promote inline storage to an insertion-ordered map (keys + their order are preserved,
-            // so the shape stays valid).
+            // Promote inline storage to an insertion-ordered map — and DEMOTE to dictionary
+            // mode. An object growing past PROPMAP_INLINE keys one insert at a time is being
+            // used as a map (`cache[k] = v`), and continuing to transition would intern a
+            // permanent registry node per novel key, forever (#701). Inline caches lose only
+            // the 9+-key tail, whose slot lookups already go through the IndexMap.
+            // NOTE: the transition for THIS key is deliberately skipped (checked before the
+            // old transition call site so the 9th-key edge is never minted).
+            self.shape = crate::shape::DICT_SHAPE;
             let mut m: IndexMap<Arc<str>, Value, RandomState> =
                 IndexMap::with_capacity_and_hasher(self.inline.len() + 1, RandomState::default());
             for (k, v) in self.inline.drain(..) {
@@ -861,6 +865,8 @@ impl PropMap {
             self.map = Some(Box::new(m));
             return None;
         }
+        // New key (inline storage) → transition the shape away from the current one.
+        self.shape = crate::shape::transition(self.shape, &key);
         self.inline.push((key, val));
         None
     }
@@ -972,6 +978,13 @@ impl PropMap {
         if incoming == 0 {
             return;
         }
+        // Dictionary-ness PROPAGATES: a DICT_SHAPE source stores its keys in whatever order it
+        // was built with (for hashed-map sources, a random per-instance order — see
+        // `from_unordered`). Walking that order through tracked `insert` re-minted a fresh
+        // permanent shape chain per merge (#708: `{ ...headers, id }` at 100 req/s ≈ 950 MB/h).
+        // Copies of dictionaries are dictionaries; copies of tracked objects stay tracked.
+        let dict = self.shape == crate::shape::DICT_SHAPE
+            || other.shape == crate::shape::DICT_SHAPE;
         // If the combined worst-case size escapes inline storage, promote once up front so the
         // per-key inserts below never reallocate or re-promote.
         if self.map.is_none() && self.inline.len() + incoming > PROPMAP_INLINE {
@@ -986,8 +999,15 @@ impl PropMap {
         } else if let Some(m) = &mut self.map {
             m.reserve(incoming);
         }
-        for (k, v) in other.iter() {
-            self.insert(Arc::clone(k), v.clone());
+        if dict {
+            for (k, v) in other.iter() {
+                self.insert_untracked(Arc::clone(k), v.clone());
+            }
+            self.shape = crate::shape::DICT_SHAPE;
+        } else {
+            for (k, v) in other.iter() {
+                self.insert(Arc::clone(k), v.clone());
+            }
         }
     }
 }
@@ -1314,9 +1334,12 @@ pub fn value_call(callee: &Value, args: &[Value]) -> Value {
 pub fn merge_object_data(left: &VmRef<ObjectData>, right: &VmRef<ObjectData>) -> ObjectData {
     let l = left.borrow();
     let r = right.borrow();
-    let mut strings = PropMap::with_capacity(l.strings.len() + r.strings.len());
-    strings.extend(l.strings.iter().map(|(k, v)| (Arc::clone(k), v.clone())));
-    strings.extend(r.strings.iter().map(|(k, v)| (Arc::clone(k), v.clone())));
+    // Seed from a CLONE of the left side: its shape id and storage carry over, so spreading
+    // the same left never re-walks (or re-mints) its chain — the old rebuild-from-empty walked
+    // BOTH sides' stored orders through tracked inserts, which for dictionary-mode sources
+    // minted a fresh permanent shape chain on every single spread (#708).
+    let mut strings = l.strings.clone();
+    strings.merge_from(&r.strings);
     let mut symbols: Option<AHashMap<u64, Value>> = None;
     if let Some(ls) = &l.symbols {
         symbols = Some(ls.clone());
@@ -2067,6 +2090,172 @@ mod number_to_string_tests {
     }
 }
 
+#[cfg(test)]
+mod shape_backstop_tests {
+    use super::*;
+
+    // The registry is process-global, so these tests serialize on one lock (parallel
+    // siblings would observe each other's minting) and still use small margins for
+    // unrelated tests running elsewhere in the binary. The leaks these guard against
+    // mint THOUSANDS of nodes per loop, so the margins cannot mask a regression.
+    static REGISTRY_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+    pub(super) fn locked() -> std::sync::MutexGuard<'static, ()> {
+        REGISTRY_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner())
+    }
+
+    /// #701 pathology A: fresh `{}` objects each taking a novel first key. Pre-fix this
+    /// minted one EMPTY_SHAPE edge per iteration; the fan-out cap must bound it.
+    #[test]
+    fn fresh_object_novel_first_key_is_bounded() {
+        let _g = locked();
+        let before = crate::shape::shape_count();
+        for i in 0..10_000 {
+            let mut pm = PropMap::new();
+            pm.insert(format!("first-key-backstop-a-{i}").into(), Value::Number(i as f64));
+        }
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 256 + 64, "fan-out cap failed: registry grew by {grown}");
+    }
+
+    /// #701 pathology B: one object accumulating novel keys (`cache[k] = v`). Promotion at
+    /// PROPMAP_INLINE must demote to DICT_SHAPE and stop minting entirely.
+    #[test]
+    fn growing_dictionary_demotes_and_stops_minting() {
+        let _g = locked();
+        let mut pm = PropMap::new();
+        for i in 0..8 {
+            pm.insert(format!("dict-backstop-warm-{i}").into(), Value::Number(i as f64));
+        }
+        let before = crate::shape::shape_count();
+        for i in 0..10_000 {
+            pm.insert(format!("dict-backstop-b-{i}").into(), Value::Number(i as f64));
+        }
+        assert_eq!(pm.shape(), crate::shape::DICT_SHAPE, "promotion must demote to dict mode");
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 64, "dictionary keys kept minting: registry grew by {grown}");
+        assert_eq!(pm.len(), 10_008);
+        assert!(matches!(pm.get("dict-backstop-b-9999"), Some(Value::Number(_))));
+    }
+
+    /// #706 shape of the JSON.parse pathology: repeated small objects whose key SET varies
+    /// per iteration. Depth/fan-out caps must bound total registry growth.
+    #[test]
+    fn novel_key_pairs_are_bounded() {
+        let _g = locked();
+        let before = crate::shape::shape_count();
+        for i in 0..10_000 {
+            let mut pm = PropMap::new();
+            pm.insert(format!("json-backstop-{i}").into(), Value::Number(1.0));
+            pm.insert("b".into(), Value::Number(2.0));
+        }
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 2 * 256 + 64, "novel key pairs unbounded: registry grew by {grown}");
+    }
+
+    /// The intended fast path must still intern and DEDUPE: repeating the same fixed-order
+    /// construction mints its chain once, and the objects keep a real (non-dict) shape.
+    #[test]
+    fn fixed_shape_construction_still_dedupes_and_tracks() {
+        let _g = locked();
+        let mk = || {
+            let mut pm = PropMap::new();
+            pm.insert("fixed-backstop-x".into(), Value::Number(1.0));
+            pm.insert("fixed-backstop-y".into(), Value::Number(2.0));
+            pm.insert("fixed-backstop-z".into(), Value::Number(3.0));
+            pm
+        };
+        let first = mk();
+        let before = crate::shape::shape_count();
+        let mut last_shape = first.shape();
+        for _ in 0..5_000 {
+            let pm = mk();
+            assert_ne!(pm.shape(), crate::shape::DICT_SHAPE, "small fixed objects must stay tracked");
+            last_shape = pm.shape();
+        }
+        assert_eq!(last_shape, first.shape(), "identical construction must share one shape");
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 96, "fixed-shape loop should not mint: registry grew by {grown}");
+    }
+}
+
+#[cfg(test)]
+mod dict_propagation_tests {
+    use super::*;
+
+    // Shares the backstop tests' lock: all registry-count assertions serialize together.
+    use super::shape_backstop_tests::locked;
+
+    fn dict_source(n: usize, tag: &str) -> VmRef<ObjectData> {
+        let mut m = ObjectMap::default();
+        for i in 0..n {
+            m.insert(format!("hdr-{tag}-{i}").into(), Value::Number(i as f64));
+        }
+        let Value::Object(od) = Value::object(m) else { unreachable!() };
+        od
+    }
+
+    /// #708: spreading a dictionary-mode source must not mint shape chains, and the result
+    /// must itself be dictionary-mode (so downstream copies stay clean too).
+    #[test]
+    fn spread_from_dict_source_is_flat_and_dict() {
+        let _g = locked();
+        let left = dict_source(12, "left");
+        let right = dict_source(12, "right");
+        let before = crate::shape::shape_count();
+        let mut last = None;
+        for _ in 0..5_000 {
+            last = Some(merge_object_data(&left, &right));
+        }
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 64, "dict spread minted shapes: registry grew by {grown}");
+        let merged = last.unwrap();
+        assert_eq!(merged.strings.shape(), crate::shape::DICT_SHAPE);
+        assert_eq!(merged.strings.len(), 24);
+        assert!(matches!(merged.strings.get("hdr-right-11"), Some(Value::Number(_))));
+    }
+
+    /// Tracked x tracked spreads must still dedupe to one chain and keep a tracked result —
+    /// the fast path is preserved, not blanket-demoted.
+    #[test]
+    fn spread_tracked_sources_stays_tracked_and_dedupes() {
+        let _g = locked();
+        let mk = |a: &str, b: &str| {
+            let mut pm = PropMap::new();
+            pm.insert(a.into(), Value::Number(1.0));
+            pm.insert(b.into(), Value::Number(2.0));
+            VmRef::new(ObjectData { strings: pm, symbols: None, frozen: false })
+        };
+        let left = mk("prop-track-a", "prop-track-b");
+        let right = mk("prop-track-c", "prop-track-d");
+        let first = merge_object_data(&left, &right);
+        assert_ne!(first.strings.shape(), crate::shape::DICT_SHAPE);
+        let before = crate::shape::shape_count();
+        let mut last_shape = first.strings.shape();
+        for _ in 0..5_000 {
+            let m = merge_object_data(&left, &right);
+            last_shape = m.strings.shape();
+        }
+        assert_eq!(last_shape, first.strings.shape(), "repeated identical spread must share one shape");
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 96, "tracked spread re-minted: registry grew by {grown}");
+    }
+
+    /// Last-write-wins override order must be unchanged by the reseeded merge.
+    #[test]
+    fn spread_override_semantics_preserved() {
+        let mut lm = ObjectMap::default();
+        lm.insert("shared-key".into(), Value::Number(1.0));
+        lm.insert("only-left".into(), Value::Number(2.0));
+        let Value::Object(l) = Value::object(lm) else { unreachable!() };
+        let mut rm = ObjectMap::default();
+        rm.insert("shared-key".into(), Value::Number(9.0));
+        let Value::Object(r) = Value::object(rm) else { unreachable!() };
+        let m = merge_object_data(&l, &r);
+        assert!(matches!(m.strings.get("shared-key"), Some(Value::Number(n)) if *n == 9.0));
+        assert!(matches!(m.strings.get("only-left"), Some(Value::Number(n)) if *n == 2.0));
+    }
+}
+
 #[cfg(test)]
 mod dict_shape_leak_tests {
     use super::*;

package/crates/tish_eval/src/timers.rs

@@ -26,13 +26,38 @@ fn next_id() -> u64 {
     NEXT_ID.fetch_add(1, Ordering::SeqCst)
 }
 
+/// Maximum number of LIVE (registered, not-yet-fired) timers per worker thread. A program that keeps
+/// scheduling `setTimeout`/`setInterval` without them draining would otherwise grow the registry (and
+/// its retained callbacks + closed-over data) without bound (#384, ported to this twin by #699). Past
+/// the cap a new timer is dropped rather than registered. Override with `TISH_MAX_TIMERS`; default
+/// 100k — far above any real timer workload, low enough to bound memory.
+fn max_live_timers() -> usize {
+    // Read per call (timer registration is not a hot path, and the cap exists precisely to bound the
+    // pathological caller): keeps the limit overridable per test without a process-global cache.
+    std::env::var("TISH_MAX_TIMERS")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(100_000)
+}
+
+#[cfg(test)]
+fn registry_len() -> usize {
+    REGISTRY.with(|r| r.borrow().len())
+}
+
 /// Register a one-shot timer. Returns immediately with timer id.
 #[allow(non_snake_case)]
 pub fn setTimeout(callback: Value, args: Vec<Value>, delay_ms: u64) -> u64 {
     let id = next_id();
     let due = Instant::now() + Duration::from_millis(delay_ms);
     REGISTRY.with(|r| {
-        r.borrow_mut().insert(
+        let mut reg = r.borrow_mut();
+        // #384: bound the live-timer count so a runaway scheduler can't grow the registry unbounded.
+        if reg.len() >= max_live_timers() {
+            return;
+        }
+        reg.insert(
             id,
             TimerEntry {
                 due,
@@ -51,7 +76,12 @@ pub fn setInterval(callback: Value, args: Vec<Value>, delay_ms: u64) -> u64 {
     let id = next_id();
     let due = Instant::now() + Duration::from_millis(delay_ms);
     REGISTRY.with(|r| {
-        r.borrow_mut().insert(
+        let mut reg = r.borrow_mut();
+        // #384: bound the live-timer count (see setTimeout).
+        if reg.len() >= max_live_timers() {
+            return;
+        }
+        reg.insert(
             id,
             TimerEntry {
                 due,
@@ -91,6 +121,10 @@ pub fn take_due_timers() -> Vec<(u64, Value, Vec<Value>, u64)> {
 }
 
 /// Re-register an interval timer (called after running its callback).
+///
+/// Deliberately uncapped, matching the tish_runtime twin: this re-inserts an entry the drain
+/// phase just removed, so it cannot grow the registry beyond what registration allowed, and
+/// capping it would silently kill a live interval whenever the registry sits at the cap.
 pub fn re_register_interval(id: u64, callback: Value, args: Vec<Value>, interval_ms: u64) {
     let due = Instant::now() + Duration::from_millis(interval_ms);
     REGISTRY.with(|r| {
@@ -118,3 +152,33 @@ pub fn next_due_instant() -> Option<Instant> {
         reg.values().map(|e| e.due).min()
     })
 }
+
+#[cfg(test)]
+mod timer_cap_tests_699 {
+    use super::*;
+
+    fn noop_callback() -> Value {
+        Value::Native(|_| Ok(Value::Null))
+    }
+
+    #[test]
+    fn registration_is_bounded_by_max_timers() {
+        // Each `#[test]` runs on its own thread, so REGISTRY (thread_local) starts empty here.
+        // One test (not one per entry point): TISH_MAX_TIMERS is process-global, and parallel
+        // tests mutating it would race.
+        std::env::set_var("TISH_MAX_TIMERS", "5");
+        for _ in 0..20 {
+            let _ = setTimeout(noop_callback(), Vec::new(), 10_000);
+        }
+        assert_eq!(
+            registry_len(),
+            5,
+            "live timers must be capped at TISH_MAX_TIMERS"
+        );
+        for _ in 0..20 {
+            let _ = setInterval(noop_callback(), Vec::new(), 10_000);
+        }
+        assert_eq!(registry_len(), 5, "setInterval must honor the same cap");
+        std::env::remove_var("TISH_MAX_TIMERS");
+    }
+}

package/crates/tish_ffi/src/lib.rs

@@ -43,8 +43,7 @@ pub const TISH_TAG_OTHER: i32 = 6;
 
 /// An `extern "C"` native function: receives a borrowed array of argument handles (owned by the
 /// host for the call) and returns a freshly-owned result handle (the host drops it).
-pub type TishNativeFn =
-    extern "C" fn(args: *const TishValueRef, argc: usize) -> TishValueRef;
+pub type TishNativeFn = extern "C" fn(args: *const TishValueRef, argc: usize) -> TishValueRef;
 
 /// One named export in a module's table.
 #[repr(C)]
@@ -304,6 +303,33 @@ pub fn wrap_native_fn(func: TishNativeFn) -> Value {
     })
 }
 
+/// Cached exports of one loaded module: name → C-ABI fn pointer. Fn pointers — unlike `Value`,
+/// whose containers may be `Rc` — are `Send + Sync`, so the process-global cache stores the raw
+/// export list and re-wraps it into fresh `Value::native`s per `load_module` call.
+#[cfg(not(target_arch = "wasm32"))]
+type CachedExports = Vec<(String, TishNativeFn)>;
+
+/// Process-global module cache keyed by RESOLVED path (#711): repeated loads of the same cdylib in
+/// one process (an embedder host running programs back to back) reuse the first dlopen mapping
+/// instead of leaking a freshly forgotten `Library` handle per call, and canonicalizing the key
+/// collapses distinct spellings of one path into one entry.
+#[cfg(not(target_arch = "wasm32"))]
+fn module_cache(
+) -> &'static std::sync::Mutex<std::collections::HashMap<std::path::PathBuf, CachedExports>> {
+    static LOADED_MODULES: std::sync::OnceLock<
+        std::sync::Mutex<std::collections::HashMap<std::path::PathBuf, CachedExports>>,
+    > = std::sync::OnceLock::new();
+    LOADED_MODULES.get_or_init(Default::default)
+}
+
+/// Number of distinct modules in the process-global cache. Test-only accessor (the integration
+/// loader test asserts a re-spelled path hits the cache instead of re-mapping).
+#[cfg(not(target_arch = "wasm32"))]
+#[doc(hidden)]
+pub fn loaded_module_count() -> usize {
+    module_cache().lock().unwrap().len()
+}
+
 /// Load a native C-ABI extension (`cdylib`) and return its exports as a name→`Value::native` map,
 /// ready for the interpreter's `with_modules` or the VM's `register_native_module`. The module
 /// must export `extern "C" fn tish_module_register() -> *const TishExportTable`.
@@ -311,12 +337,33 @@ pub fn wrap_native_fn(func: TishNativeFn) -> Value {
 /// The extension imports the host's `tish_value_*` accessors, so the host must export them at link
 /// time (`-rdynamic` / `-Wl,-export_dynamic`). The loaded library is intentionally leaked so the
 /// function pointers stay valid for the process — the load-once model (matches the JIT module).
+/// "Once" is enforced by [`module_cache`]: only the first load of a given resolved path maps the
+/// library; every later call re-wraps the cached export list (#711).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn load_module(path: &str) -> Result<tishlang_core::ObjectMap, String> {
     use tishlang_core::ObjectMap;
+
+    fn wrap_exports(exports: &CachedExports) -> ObjectMap {
+        let mut map = ObjectMap::default();
+        for (name, func) in exports {
+            map.insert(name.as_str().into(), wrap_native_fn(*func));
+        }
+        map
+    }
+
+    // #711: key on the RESOLVED path so `./lib.dylib` and its absolute spelling share one entry.
+    // When canonicalize fails (e.g. a bare dyld/ld.so-searched name), the literal path is still a
+    // correct — merely less collapsing — key. Failed loads are never cached.
+    let key = std::fs::canonicalize(path).unwrap_or_else(|_| std::path::PathBuf::from(path));
+
+    if let Some(cached) = module_cache().lock().unwrap().get(&key) {
+        return Ok(wrap_exports(cached));
+    }
+
     // SAFETY: dlopen of a caller-supplied path; the export table is validated (null checks) and the
-    // function pointers are wrapped behind the marshaling shim.
-    unsafe {
+    // function pointers are wrapped behind the marshaling shim. The dlopen runs WITHOUT the cache
+    // lock held — it may execute arbitrary static initializers.
+    let exports: CachedExports = unsafe {
         let lib =
             libloading::Library::new(path).map_err(|e| format!("ffi: load {}: {}", path, e))?;
         let register: libloading::Symbol<unsafe extern "C" fn() -> *const TishExportTable> = lib
@@ -330,20 +377,29 @@ pub fn load_module(path: &str) -> Result<tishlang_core::ObjectMap, String> {
         if table.count > 0 && table.exports.is_null() {
             return Err(format!("ffi: {}: null export table", path));
         }
-        let exports = std::slice::from_raw_parts(table.exports, table.count);
-        let mut map = ObjectMap::default();
-        for exp in exports {
+        let raw = std::slice::from_raw_parts(table.exports, table.count);
+        let mut exports = CachedExports::with_capacity(raw.len());
+        for exp in raw {
             if exp.name.is_null() {
                 continue;
             }
             let name = CStr::from_ptr(exp.name)
                 .to_str()
                 .map_err(|_| format!("ffi: {}: non-UTF-8 export name", path))?;
-            map.insert(name.into(), wrap_native_fn(exp.func));
+            exports.push((name.to_owned(), exp.func));
         }
+        // Still deliberate: the cached fn pointers must outlive every wrapped value, and dlopened
+        // extensions are immortal by contract. The #711 fix is not re-leaking a fresh mapping per
+        // call, not making the first one reclaimable.
         std::mem::forget(lib); // keep symbols live for the process lifetime
-        Ok(map)
-    }
+        exports
+    };
+
+    // Re-check under the lock: a concurrent first load of the same path only bumps the OS dlopen
+    // refcount, and whichever insert wins becomes the canonical copy.
+    let mut cache = module_cache().lock().unwrap();
+    let entry = cache.entry(key).or_insert(exports);
+    Ok(wrap_exports(entry))
 }
 
 #[cfg(test)]
@@ -463,8 +519,14 @@ mod tests {
             tish_value_drop(b);
             // A module table referencing it type-checks (the `tish_module_register` shape).
             let name = CString::new("add").unwrap();
-            let exports = [TishExport { name: name.as_ptr(), func: add_fn }];
-            let table = TishExportTable { exports: exports.as_ptr(), count: 1 };
+            let exports = [TishExport {
+                name: name.as_ptr(),
+                func: add_fn,
+            }];
+            let table = TishExportTable {
+                exports: exports.as_ptr(),
+                count: 1,
+            };
             assert_eq!(table.count, 1);
         }
     }

package/crates/tish_ffi/tests/loader.rs

@@ -63,3 +63,38 @@ fn load_and_call_real_cdylib() {
         other => panic!("make_pair export = {other:?}"),
     }
 }
+
+// #711: repeated loads of one library — including under a distinct spelling of its path — must
+// hit the process-global cache rather than dlopen (and leak) a fresh mapping per call.
+#[test]
+fn repeated_loads_share_one_cache_entry() {
+    let lib = build_and_locate_fixture();
+    let first = tishlang_ffi::load_module(lib.to_str().unwrap())
+        .unwrap_or_else(|e| panic!("first load_module: {e}"));
+    let cached_modules = tishlang_ffi::loaded_module_count();
+
+    // Same file, different spelling: `<dir>/./<name>` canonicalizes to the same resolved path.
+    let respelled = lib
+        .parent()
+        .expect("fixture path has a parent")
+        .join(".")
+        .join(lib.file_name().expect("fixture path has a file name"));
+    let second = tishlang_ffi::load_module(respelled.to_str().unwrap())
+        .unwrap_or_else(|e| panic!("re-spelled load_module: {e}"));
+    assert_eq!(
+        tishlang_ffi::loaded_module_count(),
+        cached_modules,
+        "a re-spelled path of an already-loaded library must not add a cache entry"
+    );
+
+    // Exports wrapped from the cached copy still call through correctly.
+    for module in [&first, &second] {
+        match module.get("triple") {
+            Some(Value::Function(f)) => match f.call(&[Value::Number(7.0)]) {
+                Value::Number(n) => assert_eq!(n, 21.0),
+                other => panic!("triple(7) = {other:?}"),
+            },
+            other => panic!("triple export = {other:?}"),
+        }
+    }
+}

package/crates/tish_fmt/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_fmt"
-version = "3.10.4"
+version = "3.10.9"
 edition = "2021"
 description = "Opinionated formatter for Tish source (parse → pretty-print)"
 license-file = { workspace = true }

package/crates/tish_lsp/src/main.rs

@@ -447,7 +447,10 @@ impl LanguageServer for Backend {
         // files so an externally edited declaration (`.d.tish`) or source file refreshes the
         // workspace-symbol index without a server restart (#161). The client only delivers these
         // events for globs the server registers; a `.tish` glob does NOT cover `.d.tish` (it has a
-        // compound extension), so both are registered explicitly.
+        // compound extension), so both are registered explicitly. Also watch the manifests that
+        // drive `cargo:` resolution — `tish.rustDependencies` lives in package.json, and a path
+        // dep resolves through its Cargo.toml/Cargo.lock — so a dependency edit can invalidate
+        // `cargo_src_cache` (#714); without these globs no event could ever reach it.
         let watchers = |glob: &str| FileSystemWatcher {
             glob_pattern: GlobPattern::String(glob.to_string()),
             kind: None, // create | change | delete
@@ -456,7 +459,13 @@ impl LanguageServer for Backend {
             id: "tish-watch-d-tish".to_string(),
             method: "workspace/didChangeWatchedFiles".to_string(),
             register_options: serde_json::to_value(DidChangeWatchedFilesRegistrationOptions {
-                watchers: vec![watchers("**/*.tish"), watchers("**/*.d.tish")],
+                watchers: vec![
+                    watchers("**/*.tish"),
+                    watchers("**/*.d.tish"),
+                    watchers("**/package.json"),
+                    watchers("**/Cargo.toml"),
+                    watchers("**/Cargo.lock"),
+                ],
             })
             .ok(),
         };
@@ -485,6 +494,10 @@ impl LanguageServer for Backend {
             let mut roots = self.roots.write().unwrap();
             apply_workspace_folder_changes(&mut roots, &params.event);
         }
+        // The cargo-crate-root cache goes with the old folder set (#714): `cargo:` resolution is
+        // root-relative, entries are cheap to recompute on the next goto-definition/hover, and
+        // clearing here mirrors how the folder change already re-scopes the symbol index.
+        self.cargo_src_cache.write().unwrap().clear();
         self.client
             .log_message(MessageType::INFO, "tish-lsp: workspace folders updated")
             .await;
@@ -510,6 +523,25 @@ impl LanguageServer for Backend {
                 }
             }
         }
+        // #714: a manifest change re-routes `cargo:` resolution — `tish.rustDependencies` lives in
+        // package.json, and a path dep resolves through its Cargo.toml/Cargo.lock — so drop the
+        // whole cargo-crate-root cache when any watched manifest changes. Whole-cache rather than
+        // per-root pruning: a path dep's manifest may live outside every project root, entries are
+        // a few hundred bytes, and they are recomputed per (human-rate) goto-definition/hover.
+        let manifest_changed = params.changes.iter().any(|change| {
+            change
+                .uri
+                .to_file_path()
+                .ok()
+                .and_then(|p| {
+                    p.file_name()
+                        .map(|f| f == "package.json" || f == "Cargo.toml" || f == "Cargo.lock")
+                })
+                .unwrap_or(false)
+        });
+        if manifest_changed {
+            self.cargo_src_cache.write().unwrap().clear();
+        }
         // Re-lint any OPEN buffer whose declarations may now have changed. A `.d.tish` supplies
         // ambient `declare` bindings other buffers depend on, so a change there can flip
         // unresolved-name diagnostics; recompute open docs against the new on-disk state.
@@ -2558,6 +2590,63 @@ mod jsonrpc_integration_tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
+    /// Seed `cargo_src_cache` the way a successful goto-definition would.
+    fn seed_cargo_src_cache(service: &LspService<Backend>) {
+        service.inner().cargo_src_cache.write().unwrap().insert(
+            (PathBuf::from("/proj"), "cargo:serde".to_string()),
+            PathBuf::from("/old/crate/root"),
+        );
+    }
+
+    fn cargo_src_cache_len(service: &LspService<Backend>) -> usize {
+        service.inner().cargo_src_cache.read().unwrap().len()
+    }
+
+    fn did_change_watched_files_request(uri: &str) -> Request {
+        Request::build("workspace/didChangeWatchedFiles")
+            .params(serde_json::json!({ "changes": [ { "uri": uri, "type": 2 } ] }))
+            .finish()
+    }
+
+    // #714: a workspace-folder change must drop the cargo-crate-root cache along with the roots
+    // rewrite — previously nothing ever invalidated it, so a stale crate root was served for the
+    // rest of the session.
+    #[tokio::test]
+    async fn workspace_folder_change_clears_cargo_src_cache() {
+        let mut service = new_service();
+        initialize(&mut service).await;
+        seed_cargo_src_cache(&service);
+
+        let dir = crate::test_fs::unique_temp_dir("cargocache");
+        let uri = Url::from_file_path(&dir).unwrap().to_string();
+        let _ = call(&mut service, did_change_workspace_folders(&[&uri], &[])).await;
+        assert_eq!(cargo_src_cache_len(&service), 0, "folder change must clear the cargo src cache");
+
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    // #714: a watched manifest change (package.json / Cargo.toml / Cargo.lock — the files that
+    // drive `cargo:` resolution) must drop the cargo-crate-root cache; a plain `.tish` change
+    // must leave it alone.
+    #[tokio::test]
+    async fn manifest_change_clears_cargo_src_cache() {
+        let mut service = new_service();
+        initialize(&mut service).await;
+
+        // A `.tish` event leaves the cargo cache untouched…
+        seed_cargo_src_cache(&service);
+        let _ = call(&mut service, did_change_watched_files_request("file:///proj/a.tish")).await;
+        assert_eq!(cargo_src_cache_len(&service), 1, "a .tish change must not clear the cargo src cache");
+
+        // …while any manifest event drops it.
+        for name in ["package.json", "Cargo.toml", "Cargo.lock"] {
+            seed_cargo_src_cache(&service);
+            let req = did_change_watched_files_request(&format!("file:///proj/{name}"));
+            let _ = call(&mut service, req).await;
+            assert_eq!(cargo_src_cache_len(&service), 0, "a {name} change must clear the cargo src cache");
+        }
+    }
+
     // #162 protocol edge cases the client is allowed to send: adding the same folder twice must not
     // change the result, and removing a folder that was never added must not evict a tracked root.
     #[tokio::test]