ic-mops 2.13.2 → 2.14.1

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## Next
 
+## 2.14.1
+- Speed up `mops check <files...>` (e.g. `mops check src/**/*.mo`) on packages with many files. Previously each file was checked in its own `moc` invocation, so every shared transitive import was re-parsed and re-type-checked once per file. All files are now passed to a single `moc --check` call, which loads and type-checks each import only once — on motoko-core (53 files) this drops a full check from ~27s to ~1.6s. The per-file `✓` confirmations now print only when the whole check passes.
+
+## 2.14.0
+- Fix `mops check --fix` crashing with `TypeError: Cannot read properties of undefined (reading 'split')` when `moc` produces no output (e.g. it fails to spawn or is killed by the OOM killer in a memory-constrained container). The autofix pass now treats missing `moc` output as "no fixes to apply" and lets the regular check report the real failure, instead of aborting the whole command with an unhandled exception.
+
+- Fix `mops check --fix` and `mops lint --fix` corrupting source files when two `mops` processes run concurrently in the same project (e.g. two coding agents on the same checkout). Concurrent runs could apply stale `moc` byte offsets to a sibling's already-mutated file, leaving source like `let nat = identity` (with the type-arg and call dropped) or `list.sortInPlace(` with an unclosed paren. `--fix` invocations now acquire a project-root advisory lock at `.mops/fix.lock` and serialize, cargo-style ("Waiting for another `mops --fix` run to finish..."). Read-only `mops check` and `mops lint` are unchanged.
+
+- Deprecate the `dfx` replica in `mops bench`, `mops test --mode replica`, and `mops watch`. Behavior is unchanged — `--replica dfx`, the implicit `dfx` fallback when no `[toolchain.pocket-ic]` is set, and the dfx-bundled PocketIC fallback all still work — but each now prints a warning. Run `mops toolchain use pocket-ic <version>` to silence it. The `dfx` paths will be removed and the default flipped to PocketIC in mops v3 — `dfx` is being deprecated upstream and PocketIC is a better fit for benchmarks and replica tests (deterministic, in-process, no background daemon).
+
+- `mops toolchain --help` now lists the tools mops manages (`moc`, `wasmtime`, `pocket-ic`, `lintoko`) in the top-level description instead of only mentioning them under `bin`, and `mops toolchain use` / `update` / `bin` print the available tools (via the auto-generated help) when invoked with a missing or invalid `<tool>` argument.
+
+- Add `--patch` to `mops update` and `mops outdated` to restrict updates to patch versions only (e.g. `1.2.3 -> 1.2.4`, never `1.2.3 -> 1.3.0`). Mutually exclusive with `--major`. For pre-1.0 packages this matches the default — caret already restricts `0.x.y` to patch updates. Useful for risk-averse upgrades on packages that have hit 1.0+.
+
+- Improve the per-file integrity-check error after `mops install --lock update`. Previously the message told users to run `mops install --lock update` — the exact command that just failed. After a regenerated lockfile, the only way a per-file hash can still mismatch is a local edit under `.mops/`, so the message now says that and suggests restoring from the global cache (delete the `.mops/<pkg>` directory and run `mops install`) or using a `repo`/`path` entry in `mops.toml` to keep custom changes.
+
+- Deprecate the `vessel.dhall` auto-migration in `mops init`. Behavior is unchanged for now — interactive `mops init` still reads `vessel.dhall` and copies its dependencies into `mops.toml` — but a warning is printed (also under `--yes`, which still skips the migration itself), and the migration will be removed in mops v3. Before then, copy your dependencies into `mops.toml` manually and delete `vessel.dhall` / `package-set.dhall`.
+
+- Fix `mops install` race conditions when multiple processes install into the same project (e.g. an editor watcher, fixture installers like vscode-motoko's, or CI matrix jobs sharing a global cache). Concurrent runs could observe a half-populated global cache or local `.mops/<pkg>` directory and copy zero-byte / truncated files, surfacing later as missing completions, hover data, or type-check errors. Cache writes (mops registry, GitHub installs, and project-local `.mops/`) now stage into a sibling `.staging-*` dir and atomically rename onto the canonical path. Stale staging dirs from interrupted runs are swept on the next install. The shared `.mops/_tmp/` zip download dir used by GitHub installs is also per-invocation now. If you have zero-byte files left over in your cache from a pre-fix crash, run `mops cache clean` once after upgrading.
+
+- Replace `@iarna/toml` with `smol-toml` for parsing and writing `mops.toml` (faster, actively maintained, spec-compliant TOML parser). Config reformat behavior on `add`/`remove`/`bump`/`toolchain` is unchanged — both libraries round-trip through a plain object.
+
 ## 2.13.2
 - Fix race conditions when two `mops` processes run on the same project (e.g. an editor watcher and `caffeine check --fix`, or back-to-back invocations). `mops check-stable` used a shared `.mops/.check-stable/` scratch dir and `mops check`/`build`/`check-stable` used a shared `<parent>/.migrations-<canister>/` staging dir; concurrent runs would clobber each other and surface as misleading errors like `.mops/.check-stable/new.most: No such file or directory` or `EEXIST: file already exists, symlink ...`. Both directories are now per-invocation (created via `mkdtemp` and removed when the command finishes).
 - Deprecate `skipIfMissing` in `[canisters.<name>.check-stable]`. Behavior is unchanged for now, but `mops check`/`check-stable` print a warning when it is set. For initial deployments, commit a `.most` file at the configured `path` containing an empty actor (`// Version: 1.0.0\nactor { };`) instead — the stable check then runs against an empty baseline.

package/bun.lock

@@ -5,7 +5,6 @@
     "": {
       "name": "ic-mops",
       "dependencies": {
-        "@iarna/toml": "2.2.5",
         "@icp-sdk/core": "4.0.2",
         "@noble/hashes": "1.8.0",
         "as-table": "1.0.55",
@@ -41,7 +40,9 @@
         "prettier-plugin-motoko": "0.13.0",
         "promisify-child-process": "4.1.2",
         "prompts": "2.4.2",
+        "proper-lockfile": "4.1.2",
         "semver": "7.7.1",
+        "smol-toml": "1.6.1",
         "stream-to-promise": "3.0.0",
         "string-width": "7.2.0",
         "tar": "7.5.11",
@@ -57,6 +58,7 @@
         "@types/ncp": "2.0.8",
         "@types/node": "24.0.3",
         "@types/prompts": "2.4.9",
+        "@types/proper-lockfile": "4.1.4",
         "@types/semver": "7.5.8",
         "@types/stream-to-promise": "2.2.4",
         "@types/tar": "6.1.13",
@@ -246,8 +248,6 @@
 
     "@humanwhocodes/object-schema": ["@humanwhocodes/object-schema@2.0.3", "", {}, "sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA=="],
 
-    "@iarna/toml": ["@iarna/toml@2.2.5", "", {}, "sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg=="],
-
     "@icp-sdk/core": ["@icp-sdk/core@4.0.2", "", { "peerDependencies": { "@dfinity/agent": "^3.2.4", "@dfinity/candid": "^3.2.4", "@dfinity/identity": "^3.2.4", "@dfinity/identity-secp256k1": "^3.2.4", "@dfinity/principal": "^3.2.4" } }, "sha512-tiNXiLbzc4+CJV2R/sk8Iw9WREZ32SmwPPvt5qYUaQDs6A8iftr03alCkVa+Frx4CKqbeVrJehsp07Ms7ZaHWA=="],
 
     "@isaacs/cliui": ["@isaacs/cliui@8.0.2", "", { "dependencies": { "string-width": "^5.1.2", "string-width-cjs": "npm:string-width@^4.2.0", "strip-ansi": "^7.0.1", "strip-ansi-cjs": "npm:strip-ansi@^6.0.1", "wrap-ansi": "^8.1.0", "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0" } }, "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA=="],
@@ -474,6 +474,10 @@
 
     "@types/prompts": ["@types/prompts@2.4.9", "", { "dependencies": { "@types/node": "*", "kleur": "^3.0.3" } }, "sha512-qTxFi6Buiu8+50/+3DGIWLHM6QuWsEKugJnnP6iv2Mc4ncxE4A/OJkjuVOA+5X0X1S/nq5VJRa8Lu+nwcvbrKA=="],
 
+    "@types/proper-lockfile": ["@types/proper-lockfile@4.1.4", "", { "dependencies": { "@types/retry": "*" } }, "sha512-uo2ABllncSqg9F1D4nugVl9v93RmjxF6LJzQLMLDdPaXCUIDPeOJ21Gbqi43xNKzBi/WQ0Q0dICqufzQbMjipQ=="],
+
+    "@types/retry": ["@types/retry@0.12.5", "", {}, "sha512-3xSjTp3v03X/lSQLkczaN9UIEwJMoMCA1+Nb5HfbJEQWogdeQIyVtTvxPXDQjZ5zws8rFQfVfRdz03ARihPJgw=="],
+
     "@types/semver": ["@types/semver@7.5.8", "", {}, "sha512-I8EUhyrgfLrcTkzV3TSsGyl1tSuPrEDzr0yd5m90UgNxQkyDXULk3b6MlQqTCpZpNtWe1K0hzclnZkTcLBe2UQ=="],
 
     "@types/stack-utils": ["@types/stack-utils@2.0.3", "", {}, "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw=="],
@@ -638,7 +642,7 @@
 
     "callsites": ["callsites@3.1.0", "", {}, "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ=="],
 
-    "camelcase": ["camelcase@6.3.0", "", {}, "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA=="],
+    "camelcase": ["camelcase@5.3.1", "", {}, "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg=="],
 
     "caniuse-lite": ["caniuse-lite@1.0.30001781", "", {}, "sha512-RdwNCyMsNBftLjW6w01z8bKEvT6e/5tpPVEgtn22TiLGlstHOVecsX2KHFkD5e/vRnIE4EGzpuIODb3mtswtkw=="],
 
@@ -1332,7 +1336,7 @@
 
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
-    "picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
+    "picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
 
     "pidtree": ["pidtree@0.3.1", "", { "bin": { "pidtree": "bin/pidtree.js" } }, "sha512-qQbW94hLHEqCg7nhby4yRC7G2+jYHY4Rguc2bjw7Uug4GIJuu1tvf2uHaZv5Q8zdt+WKJ6qK1FOI6amaWUo5FA=="],
 
@@ -1366,6 +1370,8 @@
 
     "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="],
 
+    "proper-lockfile": ["proper-lockfile@4.1.2", "", { "dependencies": { "graceful-fs": "^4.2.4", "retry": "^0.12.0", "signal-exit": "^3.0.2" } }, "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA=="],
+
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
     "pure-rand": ["pure-rand@7.0.1", "", {}, "sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ=="],
@@ -1408,6 +1414,8 @@
 
     "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
 
+    "retry": ["retry@0.12.0", "", {}, "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow=="],
+
     "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
 
     "rexreplace": ["rexreplace@7.1.13", "", { "dependencies": { "globs": "0.1.4", "yargs": "16" }, "bin": { "rr": "bin/rexreplace.cli.min.js", "rexreplace": "bin/rexreplace.cli.js" } }, "sha512-UVdKFM4267di4rwFuDBGPlS+OAQ3NE/8SS6sdUQs++7dPpwgYAAO0a1OG85IQoge2IJUaDsvSiNnQkRwrzGH0Q=="],
@@ -1458,6 +1466,8 @@
 
     "slice-ansi": ["slice-ansi@7.1.0", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-bSiSngZ/jWeX93BqeIAbImyTbEihizcwNjFoRUIY/T1wWQsfsm2Vw1agPKylXvQTU7iASGdHhyqRlqQzfz+Htg=="],
 
+    "smol-toml": ["smol-toml@1.6.1", "", {}, "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg=="],
+
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
     "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
@@ -1688,8 +1698,6 @@
 
     "@isaacs/fs-minipass/minipass": ["minipass@7.1.2", "", {}, "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw=="],
 
-    "@istanbuljs/load-nyc-config/camelcase": ["camelcase@5.3.1", "", {}, "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg=="],
-
     "@istanbuljs/load-nyc-config/find-up": ["find-up@4.1.0", "", { "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" } }, "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw=="],
 
     "@istanbuljs/load-nyc-config/js-yaml": ["js-yaml@3.14.2", "", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg=="],
@@ -1750,6 +1758,8 @@
 
     "@unrs/resolver-binding-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@0.2.12", "", { "dependencies": { "@emnapi/core": "^1.4.3", "@emnapi/runtime": "^1.4.3", "@tybys/wasm-util": "^0.10.0" } }, "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ=="],
 
+    "anymatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
+
     "babel-jest/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
     "babel-jest/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
@@ -1836,14 +1846,10 @@
 
     "jest-each/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
-    "jest-haste-map/picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
-
     "jest-matcher-utils/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
     "jest-message-util/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
-    "jest-message-util/picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
-
     "jest-message-util/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
     "jest-resolve/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
@@ -1866,7 +1872,7 @@
 
     "jest-util/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
-    "jest-util/picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
+    "jest-validate/camelcase": ["camelcase@6.3.0", "", {}, "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA=="],
 
     "jest-validate/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
@@ -1884,6 +1890,8 @@
 
     "make-dir/pify": ["pify@3.0.0", "", {}, "sha512-C3FsVNH1udSEX48gGX1xfvwTWfsYWj5U+8/uK15BGzIGrKoUpghX8hWZwa/OFnakBiiVNmBvemTJR5mcy7iPcg=="],
 
+    "micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
+
     "minizlib/minipass": ["minipass@7.1.3", "", {}, "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A=="],
 
     "normalize-package-data/semver": ["semver@5.7.2", "", { "bin": { "semver": "bin/semver" } }, "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="],
@@ -1902,12 +1910,16 @@
 
     "pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
+    "proper-lockfile/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
+
     "read-pkg/path-type": ["path-type@3.0.0", "", { "dependencies": { "pify": "^3.0.0" } }, "sha512-T2ZUsdZFHgA3u4e5PfPbjd7HDDpxPnQb5jN0SrDsjNSuVXHJqtwTnWqG0B1jZrgmJ/7lj1EmVIByWt1gxGkWvg=="],
 
     "readable-stream/isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
 
     "readable-stream/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],
 
+    "readdirp/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
+
     "resolve-cwd/resolve-from": ["resolve-from@5.0.0", "", {}, "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw=="],
 
     "rimraf/glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],

package/cache.ts

@@ -17,6 +17,75 @@ let getGlobalCacheDir = () => {
   return path.join(globalCacheDir, network === "ic" ? "" : network);
 };
 
+// Cache writes stage into a sibling `<dest>/../.staging-<rand>` and atomic-
+// rename onto `dest` so concurrent processes never observe a partial cache.
+const STAGING_PREFIX = ".staging-";
+
+export function createStagingDir(dest: string): string {
+  let parent = path.dirname(dest);
+  fs.mkdirSync(parent, { recursive: true });
+  return fs.mkdtempSync(path.join(parent, STAGING_PREFIX));
+}
+
+// Returns false if another process committed first (race lost) — `staging`
+// is removed and the existing `dest` is left intact. We only swallow
+// `EPERM` (Windows) when `dest` exists; otherwise it's likely AV / open
+// handles and bubbles up.
+export function commitStagingDir(staging: string, dest: string): boolean {
+  try {
+    fs.renameSync(staging, dest);
+    return true;
+  } catch (err: any) {
+    let raceLost =
+      (err.code === "ENOTEMPTY" ||
+        err.code === "EEXIST" ||
+        err.code === "EPERM") &&
+      fs.existsSync(dest);
+    if (raceLost) {
+      fs.rmSync(staging, { recursive: true, force: true });
+      return false;
+    }
+    throw err;
+  }
+}
+
+// Sweep leftover `.staging-*` from interrupted runs. Mtime cutoff avoids
+// clobbering siblings that are mid-staging right now. Runs at most once
+// per process.
+const STAGING_STALE_MS = 60 * 60 * 1000;
+let swept = false;
+export function sweepStaleStagingDirs() {
+  if (swept) {
+    return;
+  }
+  swept = true;
+  let cutoff = Date.now() - STAGING_STALE_MS;
+  let parents = [
+    path.join(getGlobalCacheDir(), "packages"),
+    path.join(getGlobalCacheDir(), "packages", "_github"),
+    path.join(getRootDir(), ".mops"),
+    path.join(getRootDir(), ".mops", "_github"),
+  ];
+  for (let parent of parents) {
+    if (!fs.existsSync(parent)) {
+      continue;
+    }
+    for (let entry of fs.readdirSync(parent)) {
+      if (!entry.startsWith(STAGING_PREFIX)) {
+        continue;
+      }
+      let full = path.join(parent, entry);
+      try {
+        if (fs.statSync(full).mtimeMs < cutoff) {
+          fs.rmSync(full, { recursive: true, force: true });
+        }
+      } catch {
+        // raced with another sweeper; ignore
+      }
+    }
+  }
+}
+
 export let show = () => {
   return getGlobalCacheDir();
 };
@@ -49,32 +118,44 @@ export function getGithubDepCacheName(name: string, repo: string) {
   );
 }
 
-export let addCache = (cacheName: string, source: string) => {
+export let addCache = async (cacheName: string, source: string) => {
   let dest = path.join(getGlobalCacheDir(), "packages", cacheName);
-  fs.mkdirSync(dest, { recursive: true });
-
-  return new Promise<void>((resolve, reject) => {
-    ncp.ncp(source, dest, { stopOnErr: true }, (err) => {
-      if (err) {
-        reject(err);
-      }
-      resolve();
+  let staging = createStagingDir(dest);
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      ncp.ncp(source, staging, { stopOnErr: true }, (err) => {
+        if (err) {
+          reject(err);
+        }
+        resolve();
+      });
     });
-  });
+    commitStagingDir(staging, dest);
+  } catch (err) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw err;
+  }
 };
 
-export let copyCache = (cacheName: string, dest: string) => {
+export let copyCache = async (cacheName: string, dest: string) => {
   let source = path.join(getGlobalCacheDir(), "packages", cacheName);
-  fs.mkdirSync(dest, { recursive: true });
-
-  return new Promise<void>((resolve, reject) => {
-    ncp.ncp(source, dest, { stopOnErr: true }, (err) => {
-      if (err) {
-        reject(err);
-      }
-      resolve();
+  let staging = createStagingDir(dest);
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      ncp.ncp(source, staging, { stopOnErr: true }, (err) => {
+        if (err) {
+          reject(err);
+        }
+        resolve();
+      });
     });
-  });
+    commitStagingDir(staging, dest);
+  } catch (err) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw err;
+  }
 };
 
 export let cacheSize = async () => {

package/cli.ts

@@ -413,7 +413,7 @@ program
   .addOption(
     new Option(
       "--replica <replica>",
-      "Which replica to use to run tests in replica mode",
+      "Which replica to use to run tests in replica mode (`dfx` is deprecated; prefer `pocket-ic`)",
     ).choices(["dfx", "pocket-ic"]),
   )
   .option("-w, --watch", "Enable watch mode")
@@ -435,7 +435,7 @@ program
   .addOption(
     new Option(
       "--replica <replica>",
-      "Which replica to use to run benchmarks",
+      "Which replica to use to run benchmarks (`dfx` is deprecated; prefer `pocket-ic`)",
     ).choices(["dfx", "pocket-ic"]),
   )
   .addOption(
@@ -626,11 +626,19 @@ program
 // outdated
 program
   .command("outdated")
-  .description("Print outdated dependencies specified in mops.toml")
+  .description(
+    "Print outdated dependencies in mops.toml within the caret bound (does not cross major versions, or pre-1.0 minor versions)",
+  )
   .addOption(
     new Option(
       "--major",
       "Allow updates that cross the caret bound (major versions, or for 0.x.y packages, minor versions)",
+    ).conflicts("patch"),
+  )
+  .addOption(
+    new Option(
+      "--patch",
+      "Restrict updates to patch versions only (e.g. 1.2.3 -> 1.2.4, never 1.2.3 -> 1.3.0)",
     ),
   )
   .action(async (options) => {
@@ -640,11 +648,19 @@ program
 // update
 program
   .command("update [pkg]")
-  .description("Update dependencies specified in mops.toml")
+  .description(
+    "Update dependencies in mops.toml to the highest semver-compatible version within the caret bound (does not cross major versions, or pre-1.0 minor versions)",
+  )
   .addOption(
     new Option(
       "--major",
       "Allow updates that cross the caret bound (major versions, or for 0.x.y packages, minor versions)",
+    ).conflicts("patch"),
+  )
+  .addOption(
+    new Option(
+      "--patch",
+      "Restrict updates to patch versions only (e.g. 1.2.3 -> 1.2.4, never 1.2.3 -> 1.3.0)",
     ),
   )
   .addOption(
@@ -658,9 +674,11 @@ program
   });
 
 // toolchain
-const toolchainCommand = new Command("toolchain").description(
-  "Toolchain management",
-);
+const toolchainCommand = new Command("toolchain")
+  .description(
+    `Toolchain management for ${TOOLCHAINS.map((s) => `"${s}"`).join(", ")}`,
+  )
+  .showHelpAfterError();
 
 toolchainCommand
   .command("init")
@@ -679,8 +697,13 @@ toolchainCommand
 toolchainCommand
   .command("use")
   .description("Install specified tool version and update mops.toml")
-  .addArgument(new Argument("<tool>").choices(TOOLCHAINS))
-  .addArgument(new Argument("[version]"))
+  .addArgument(new Argument("<tool>", "tool to install").choices(TOOLCHAINS))
+  .addArgument(
+    new Argument(
+      "[version]",
+      "version to install (defaults to interactive picker)",
+    ),
+  )
   .action(async (tool, version) => {
     if (!checkConfigFile()) {
       process.exit(1);
@@ -693,7 +716,12 @@ toolchainCommand
   .description(
     "Update specified tool or all tools to the latest version and update mops.toml",
   )
-  .addArgument(new Argument("[tool]").choices(TOOLCHAINS))
+  .addArgument(
+    new Argument(
+      "[tool]",
+      "tool to update (defaults to all configured tools)",
+    ).choices(TOOLCHAINS),
+  )
   .action(async (tool?: Tool) => {
     if (!checkConfigFile()) {
       process.exit(1);
@@ -703,10 +731,8 @@ toolchainCommand
 
 toolchainCommand
   .command("bin")
-  .description(
-    `Get path to the tool binary\n<tool> can be one of ${TOOLCHAINS.map((s) => `"${s}"`).join(", ")}`,
-  )
-  .addArgument(new Argument("<tool>").choices(TOOLCHAINS))
+  .description("Get path to the tool binary")
+  .addArgument(new Argument("<tool>", "tool to look up").choices(TOOLCHAINS))
   .addOption(
     new Option(
       "--fallback",

package/commands/available-updates.ts

@@ -6,7 +6,7 @@ import { Config } from "../types.js";
 import { getDepName, getDepPinnedVersion } from "../helpers/get-dep-name.js";
 import { SemverPart } from "../declarations/main/main.did.js";
 
-export type UpdateBound = "caret" | "major";
+export type UpdateBound = "patch" | "caret" | "major";
 
 // [pkg, oldVersion, newVersion]
 export async function getAvailableUpdates(
@@ -45,7 +45,9 @@ export async function getAvailableUpdates(
       let semverPart: SemverPart = { major: null };
       let name = getDepName(dep.name);
       let pinnedVersion = getDepPinnedVersion(dep.name);
-      if (pinnedVersion) {
+      if (bound === "patch") {
+        semverPart = { patch: null };
+      } else if (pinnedVersion) {
         semverPart =
           pinnedVersion.split(".").length === 1
             ? { minor: null }

package/commands/bench.ts

@@ -22,6 +22,7 @@ import { parallel } from "../parallel.js";
 import { absToRel } from "./test/utils.js";
 import { getMocVersion } from "../helpers/get-moc-version.js";
 import { getDfxVersion } from "../helpers/get-dfx-version.js";
+import { warnIfDfxReplica } from "../helpers/deprecate-dfx-replica.js";
 import { getMocPath } from "../helpers/get-moc-path.js";
 import { sources } from "./sources.js";
 import { MOTOKO_GLOB_CONFIG } from "../constants.js";
@@ -98,6 +99,8 @@ export async function bench(
     options.replicaVersion = config.toolchain?.["pocket-ic"] || "";
   }
 
+  warnIfDfxReplica(replicaType, optionsArg.replica === "dfx");
+
   options.verbose && console.log(options);
 
   let replica = new BenchReplica(replicaType, options.verbose);

package/commands/check.ts

@@ -9,6 +9,7 @@ import {
   resolveConfigPath,
 } from "../mops.js";
 import { AutofixResult, autofixMotoko } from "../helpers/autofix-motoko.js";
+import { withFixLock } from "../helpers/fix-lock.js";
 import { getMocSemVer } from "../helpers/get-moc-version.js";
 import {
   filterCanisters,
@@ -82,6 +83,16 @@ function logAutofixResult(
 export async function check(
   args: string[],
   options: Partial<CheckOptions> = {},
+): Promise<void> {
+  if (options.fix) {
+    return withFixLock(() => checkImpl(args, options));
+  }
+  return checkImpl(args, options);
+}
+
+async function checkImpl(
+  args: string[],
+  options: Partial<CheckOptions> = {},
 ): Promise<void> {
   const config = readConfig();
   const canisters = resolveCanisterConfigs(config);
@@ -251,30 +262,30 @@ async function checkFiles(
     logAutofixResult(fixResult, options.verbose);
   }
 
-  for (const file of files) {
-    try {
-      const args = [file, ...mocArgs];
-      if (options.verbose) {
-        console.log(chalk.blue("check"), chalk.gray("Running moc:"));
-        console.log(chalk.gray(mocPath, JSON.stringify(args)));
-      }
-
-      const result = await execa(mocPath, args, {
-        stdio: "inherit",
-        reject: false,
-      });
+  // Check all files in a single moc invocation so shared transitive imports
+  // are chased and type-checked once, not re-checked for every file.
+  const args = [...files, ...mocArgs];
+  if (options.verbose) {
+    console.log(chalk.blue("check"), chalk.gray("Running moc:"));
+    console.log(chalk.gray(mocPath, JSON.stringify(args)));
+  }
 
-      if (result.exitCode !== 0) {
-        cliError(
-          `✗ Check failed for file ${file} (exit code: ${result.exitCode})`,
-        );
-      }
+  try {
+    const result = await execa(mocPath, args, {
+      stdio: "inherit",
+      reject: false,
+    });
 
-      console.log(chalk.green(`✓ ${file}`));
-    } catch (err: any) {
-      cliError(
-        `Error while checking ${file}${err?.message ? `\n${err.message}` : ""}`,
-      );
+    if (result.exitCode !== 0) {
+      cliError(`✗ Check failed (exit code: ${result.exitCode})`);
     }
+  } catch (err: any) {
+    cliError(
+      `Error while checking files${err?.message ? `\n${err.message}` : ""}`,
+    );
+  }
+
+  for (const file of files) {
+    console.log(chalk.green(`✓ ${file}`));
   }
 }

package/commands/init.ts

@@ -25,6 +25,20 @@ export async function init({ yes = false } = {}) {
 
   let config: Config = {};
 
+  let vesselFile = path.join(process.cwd(), "vessel.dhall");
+  let vesselExists = existsSync(vesselFile);
+
+  // Warn before the --yes early-return so scripted/CI users get the heads-up
+  // even though `mops init --yes` skips the vessel migration entirely.
+  if (vesselExists) {
+    console.warn(
+      chalk.yellow(
+        "WARN: vessel.dhall auto-migration is deprecated and will be removed in mops v3. " +
+          "Before then, copy your dependencies into mops.toml manually and delete vessel.dhall / package-set.dhall.",
+      ),
+    );
+  }
+
   if (yes) {
     await applyInit({
       type: "project",
@@ -37,10 +51,9 @@ export async function init({ yes = false } = {}) {
   }
 
   // migrate from vessel
-  let vesselFile = path.join(process.cwd(), "vessel.dhall");
   let vesselConfig: VesselConfig = { dependencies: [], "dev-dependencies": [] };
 
-  if (existsSync(vesselFile)) {
+  if (vesselExists) {
     console.log("Reading vessel.dhall file");
     let res = await readVesselConfig(process.cwd(), { cache: false });
     if (res) {