ic-mops 2.13.2 → 2.14.1

package/dist/tests/cli.test.js

@@ -1,5 +1,6 @@
 import { describe, expect, jest, test } from "@jest/globals";
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "path";
 import { cli, normalizePaths } from "./helpers";
 describe("cli", () => {
@@ -116,6 +117,85 @@ describe("install", () => {
             rmSync(path.join(cwd, ".mops"), { recursive: true, force: true });
         }
     });
+    // Regression: when a file under `.mops/` was edited locally (an unsupported
+    // but common AI-agent workflow), `--lock update` would regenerate the
+    // lockfile from registry hashes, then fail the per-file check, and tell the
+    // user to "Run `mops install --lock update` to regenerate it" — the exact
+    // command that just failed. The post-regen message now says the local copy
+    // was modified and points at the actual fix.
+    test("--lock update flags a locally edited .mops/ file with a clear recovery hint", async () => {
+        const cwd = path.join(import.meta.dirname, "install/success");
+        const lockFile = path.join(cwd, "mops.lock");
+        const localDep = path.join(cwd, ".mops", "core@1.0.0", "mops.toml");
+        rmSync(lockFile, { force: true });
+        rmSync(path.join(cwd, ".mops"), { recursive: true, force: true });
+        try {
+            const first = await cli(["install"], { cwd, env: { CI: undefined } });
+            expect(first.exitCode).toBe(0);
+            expect(existsSync(localDep)).toBe(true);
+            writeFileSync(localDep, readFileSync(localDep, "utf8") + "\n# tampered\n");
+            const result = await cli(["install", "--lock", "update"], {
+                cwd,
+                env: { CI: undefined },
+            });
+            expect(result.exitCode).toBe(1);
+            expect(result.stderr).toMatch(/\.mops\/core@1\.0\.0\/mops\.toml differs from the registry/);
+            expect(result.stderr).toMatch(/delete the `\.mops\/core@1\.0\.0` directory and run `mops install`/);
+            expect(result.stderr).not.toMatch(/Run `mops install --lock update`/);
+        }
+        finally {
+            rmSync(lockFile, { force: true });
+            rmSync(path.join(cwd, ".mops"), { recursive: true, force: true });
+        }
+    });
+    // Regression: parallel `mops install` runs against the same project used to
+    // race in two places — global cache writes (`.mops/<pkg>` populated mid-write)
+    // and local `.mops/<pkg>` copies — leaving zero-byte / partially-written
+    // files. We isolate the global cache via `XDG_CACHE_HOME` so the global-write
+    // path actually executes (cold-cache scenario).
+    test("parallel `mops install` produces a complete .mops tree (no zero-byte / staging dirs)", async () => {
+        const cwd = path.join(import.meta.dirname, "install/success");
+        const lockFile = path.join(cwd, "mops.lock");
+        const localCache = path.join(cwd, ".mops");
+        const xdgCache = mkdtempSync(path.join(tmpdir(), "mops-test-xdg-"));
+        rmSync(lockFile, { force: true });
+        rmSync(localCache, { recursive: true, force: true });
+        try {
+            const N = 5;
+            const env = { CI: undefined, XDG_CACHE_HOME: xdgCache };
+            const runs = await Promise.all(Array.from({ length: N }, () => cli(["install"], { cwd, env })));
+            for (const r of runs) {
+                if (r.exitCode !== 0) {
+                    throw new Error(`mops install exited ${r.exitCode}\nstdout:\n${r.stdout}\nstderr:\n${r.stderr}`);
+                }
+            }
+            const walk = (dir) => {
+                const out = [];
+                for (const entry of readdirSync(dir, { withFileTypes: true })) {
+                    const p = path.join(dir, entry.name);
+                    if (entry.isDirectory()) {
+                        out.push(...walk(p));
+                    }
+                    else if (entry.isFile()) {
+                        out.push(p);
+                    }
+                }
+                return out;
+            };
+            const files = walk(localCache);
+            const empties = files.filter((f) => statSync(f).size === 0);
+            expect(empties).toEqual([]);
+            const stagingLeftovers = readdirSync(localCache).filter((e) => e.startsWith(".staging-"));
+            expect(stagingLeftovers).toEqual([]);
+            const globalPkg = path.join(xdgCache, "mops", "packages", "core@1.0.0", "mops.toml");
+            expect(existsSync(globalPkg)).toBe(true);
+        }
+        finally {
+            rmSync(lockFile, { force: true });
+            rmSync(localCache, { recursive: true, force: true });
+            rmSync(xdgCache, { recursive: true, force: true });
+        }
+    });
 });
 // `mops update` and `mops outdated` default to caret-bound resolution: stay
 // within `0.x.y` (or `1.x.y`) and never cross majors. Fixture pins:
@@ -192,3 +272,58 @@ describe("update / outdated bounds", () => {
         }
     });
 });
+// `--patch` restricts updates to patch versions only, never crossing the minor
+// bound. Fixture pins `core = "2.3.0"`; registry has 2.3.1 (patch) and 2.4.0,
+// 2.5.0 (minor). Caret default lets minors through; --patch must not.
+describe("update / outdated --patch bound", () => {
+    jest.setTimeout(120_000);
+    const cwd = path.join(import.meta.dirname, "install/update-bound-patch");
+    const tomlFile = path.join(cwd, "mops.toml");
+    const original = readFileSync(tomlFile, "utf8");
+    const cleanup = () => {
+        rmSync(path.join(cwd, "mops.lock"), { force: true });
+        rmSync(path.join(cwd, ".mops"), { recursive: true, force: true });
+        writeFileSync(tomlFile, original);
+    };
+    const coreVersion = (toml) => toml.match(/core = "(\d+\.\d+\.\d+)"/)?.[1];
+    test("mops update --patch restricts to patch bumps", async () => {
+        cleanup();
+        try {
+            await cli(["install"], { cwd, env: { CI: undefined } });
+            const result = await cli(["update", "--patch"], {
+                cwd,
+                env: { CI: undefined },
+            });
+            expect(result.exitCode).toBe(0);
+            const after = readFileSync(tomlFile, "utf8");
+            // Stays within 2.3.x — must not cross to 2.4.0 / 2.5.0
+            expect(coreVersion(after)).toMatch(/^2\.3\./);
+            expect(coreVersion(after)).not.toBe("2.3.0");
+        }
+        finally {
+            cleanup();
+        }
+    });
+    test("mops outdated --patch reports patch-only updates", async () => {
+        cleanup();
+        try {
+            await cli(["install"], { cwd, env: { CI: undefined } });
+            const patch = normalizePaths((await cli(["outdated", "--patch"], { cwd, env: { CI: undefined } }))
+                .stdout);
+            // Only 2.3.x updates surface, never 2.4.x / 2.5.x
+            expect(patch).toMatch(/core 2\.3\.0 -> 2\.3\./);
+            expect(patch).not.toMatch(/core 2\.3\.0 -> 2\.[4-9]/);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    test.each([["update"], ["outdated"]])("mops %s rejects --major + --patch", async (cmd) => {
+        const result = await cli([cmd, "--major", "--patch"], {
+            cwd,
+            env: { CI: undefined },
+        });
+        expect(result.exitCode).not.toBe(0);
+        expect(result.stderr).toMatch(/option '--major' cannot be used with option '--patch'/);
+    });
+});

package/dist/vessel.js

@@ -1,15 +1,14 @@
 import process from "node:process";
-import { existsSync, mkdirSync, createWriteStream, readFileSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, createWriteStream, readFileSync, writeFileSync, } from "node:fs";
 import path from "node:path";
 import { pipeline } from "node:stream";
-import { deleteSync } from "del";
 import { execaCommand } from "execa";
 import chalk from "chalk";
 import { createLogUpdate } from "log-update";
 import got from "got";
 import decompress from "decompress";
-import { parseGithubURL, progressBar } from "./mops.js";
-import { getDepCacheDir, getGithubDepCacheName, isDepCached } from "./cache.js";
+import { getRootDir, parseGithubURL, progressBar } from "./mops.js";
+import { commitStagingDir, createStagingDir, getDepCacheDir, getGithubDepCacheName, isDepCached, sweepStaleStagingDirs, } from "./cache.js";
 const dhallFileToJson = async (filePath, silent) => {
     if (existsSync(filePath)) {
         let cwd = new URL(path.dirname(import.meta.url)).pathname;
@@ -85,13 +84,18 @@ export const downloadFromGithub = async (repo, dest, onProgress) => {
             }
             // Prevent `onError` being called twice.
             readStream.off("error", reject);
-            const tmpDir = path.resolve(process.cwd(), ".mops/_tmp/");
+            // Per-invocation download dir (was a shared `.mops/_tmp/` clobbered
+            // by concurrent github installs). `.staging-` prefix lets the sweeper
+            // pick up leftovers from a crashed download.
+            const parentTmp = path.resolve(getRootDir(), ".mops");
+            mkdirSync(parentTmp, { recursive: true });
+            const tmpDir = mkdtempSync(path.join(parentTmp, ".staging-github-dl-"));
             const tmpFile = path.resolve(tmpDir, `${gitName}@${(commitHash || branch).replaceAll("/", "___")}.zip`);
+            const cleanup = () => rmSync(tmpDir, { recursive: true, force: true });
             try {
-                mkdirSync(tmpDir, { recursive: true });
                 pipeline(readStream, createWriteStream(tmpFile), (err) => {
                     if (err) {
-                        deleteSync([tmpDir]);
+                        cleanup();
                         reject(err);
                     }
                     else {
@@ -104,18 +108,18 @@ export const downloadFromGithub = async (repo, dest, onProgress) => {
                         };
                         decompress(tmpFile, dest, options)
                             .then((unzippedFiles) => {
-                            deleteSync([tmpDir]);
+                            cleanup();
                             resolve(unzippedFiles);
                         })
                             .catch((err) => {
-                            deleteSync([tmpDir]);
+                            cleanup();
                             reject(err);
                         });
                     }
                 });
             }
             catch (err) {
-                deleteSync([tmpDir]);
+                cleanup();
                 reject(err);
             }
         });
@@ -123,6 +127,7 @@ export const downloadFromGithub = async (repo, dest, onProgress) => {
     return promise;
 };
 export const installFromGithub = async (name, repo, { verbose = false, dep = false, silent = false, ignoreTransitive = false, } = {}) => {
+    sweepStaleStagingDirs();
     let cacheName = getGithubDepCacheName(name, repo);
     let cacheDir = getDepCacheDir(cacheName);
     let logUpdate = createLogUpdate(process.stdout, { showCursor: true });
@@ -135,12 +140,15 @@ export const installFromGithub = async (name, repo, { verbose = false, dep = fal
                 logUpdate(`${dep ? "Dependency" : "Installing"} ${repo} ${progressBar(step, total)}`);
         };
         progress(0, 1024 * 500);
-        mkdirSync(cacheDir, { recursive: true });
+        // Stage download in a sibling dir; previously `mkdirSync(cacheDir)`
+        // before download made empty dirs look cached to peers.
+        let stagingDir = createStagingDir(cacheDir);
         try {
-            await downloadFromGithub(repo, cacheDir, progress);
+            await downloadFromGithub(repo, stagingDir, progress);
+            commitStagingDir(stagingDir, cacheDir);
         }
         catch (err) {
-            deleteSync([cacheDir], { force: true });
+            rmSync(stagingDir, { recursive: true, force: true });
             return false;
         }
     }

package/dist/wasm/pkg/nodejs/package.json

@@ -11,4 +11,4 @@
   ],
   "main": "wasm.js",
   "types": "wasm.d.ts"
-}
+}

package/dist/wasm/pkg/web/package.json

@@ -15,4 +15,4 @@
   "sideEffects": [
     "./snippets/*"
   ]
-}
+}

package/helpers/autofix-motoko.ts

@@ -26,7 +26,10 @@ export interface MocDiagnostic {
   notes: string[];
 }
 
-export function parseDiagnostics(stdout: string): MocDiagnostic[] {
+export function parseDiagnostics(stdout: string | undefined): MocDiagnostic[] {
+  if (!stdout) {
+    return [];
+  }
   return stdout
     .split("\n")
     .filter((l) => l.trim())
@@ -181,19 +184,18 @@ export async function autofixMotoko(
   for (let iteration = 0; iteration < MAX_FIX_ITERATIONS; iteration++) {
     const fixesByFile = new Map<string, DiagnosticFix[]>();
 
-    for (const file of files) {
-      const result = await execa(
-        mocPath,
-        [file, ...mocArgs, "--error-format=json"],
-        { stdio: "pipe", reject: false },
-      );
-
-      const diagnostics = parseDiagnostics(result.stdout);
-      for (const [targetFile, fixes] of extractDiagnosticFixes(diagnostics)) {
-        const existing = fixesByFile.get(targetFile) ?? [];
-        existing.push(...fixes);
-        fixesByFile.set(targetFile, existing);
-      }
+    // Single invocation: moc dedups shared imports across all files.
+    const result = await execa(
+      mocPath,
+      [...files, ...mocArgs, "--error-format=json"],
+      { stdio: "pipe", reject: false },
+    );
+
+    const diagnostics = parseDiagnostics(result.stdout);
+    for (const [targetFile, fixes] of extractDiagnosticFixes(diagnostics)) {
+      const existing = fixesByFile.get(targetFile) ?? [];
+      existing.push(...fixes);
+      fixesByFile.set(targetFile, existing);
     }
 
     if (fixesByFile.size === 0) {

package/helpers/deprecate-dfx-replica.ts

@@ -0,0 +1,32 @@
+import chalk from "chalk";
+
+export type ReplicaName = "dfx" | "pocket-ic" | "dfx-pocket-ic";
+
+let alreadyWarned = false;
+
+// Prints a deprecation warning (once per process) when `mops bench`/`mops test`/
+// `mops watch` is about to use a dfx-backed replica. Removal is tracked in
+// NEXT-MAJOR.md under "Drop dfx coupling".
+export function warnIfDfxReplica(
+  replicaType: ReplicaName,
+  explicit: boolean,
+): void {
+  if (alreadyWarned) {
+    return;
+  }
+  if (replicaType !== "dfx" && replicaType !== "dfx-pocket-ic") {
+    return;
+  }
+  alreadyWarned = true;
+  let lead =
+    explicit && replicaType === "dfx"
+      ? "`--replica dfx` is deprecated and will be removed in a future release."
+      : replicaType === "dfx-pocket-ic"
+        ? "Falling back to dfx-bundled PocketIC because no `pocket-ic` version is set in `[toolchain]`. This fallback is deprecated and will be removed in a future release."
+        : "Using `dfx` replica because no `pocket-ic` version is set in `[toolchain]`. The `dfx` replica is deprecated and will be removed in a future release.";
+  console.log(
+    chalk.yellow(
+      `${lead}\nRun \`mops toolchain use pocket-ic 12.0.0\` to pin a PocketIC version and silence this warning.`,
+    ),
+  );
+}

package/helpers/fix-lock.ts

@@ -0,0 +1,101 @@
+import chalk from "chalk";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { lock, unlockSync } from "proper-lockfile";
+import { getRootDir } from "../mops.js";
+
+// Serializes Motoko-source-writing commands (`check --fix`, `lint --fix`)
+// across concurrent `mops` invocations in the same project. Two parallel
+// `--fix` runs can otherwise apply stale moc byte offsets to a sibling's
+// already-mutated file, corrupting source. Cargo-style: print a wait
+// message after the first failed acquire, then retry with backoff.
+//
+// Re-entrant within a single process so `mops check --fix` (which calls
+// `mops lint --fix` internally) doesn't deadlock against itself.
+
+let depth = 0;
+let acquiring = false;
+
+export async function withFixLock<T>(fn: () => Promise<T>): Promise<T> {
+  if (depth > 0) {
+    depth++;
+    try {
+      return await fn();
+    } finally {
+      depth--;
+    }
+  }
+
+  // Sequential re-entry is handled by `depth`; concurrent top-level calls
+  // (`Promise.all([withFixLock(a), withFixLock(b)])`) would otherwise
+  // serialize awkwardly via proper-lockfile's ELOCKED retry path — with a
+  // confusing intra-process "Waiting..." log line. Fail loudly instead so
+  // the next caller finds out at the call site. Must be set synchronously
+  // before any await, so concurrent entries can't both pass the check.
+  if (acquiring) {
+    throw new Error(
+      "withFixLock cannot be called concurrently within the same process",
+    );
+  }
+  acquiring = true;
+
+  try {
+    const rootDir = getRootDir();
+    if (!rootDir) {
+      return await fn();
+    }
+
+    const lockDir = join(rootDir, ".mops");
+    await mkdir(lockDir, { recursive: true });
+    const lockTarget = join(lockDir, "fix.lock");
+    await writeFile(lockTarget, "", { flag: "a" });
+
+    const stale = 300_000;
+    let release: () => Promise<void>;
+    try {
+      release = await lock(lockTarget, { stale, retries: 0 });
+    } catch (err: any) {
+      if (err?.code !== "ELOCKED") {
+        throw err;
+      }
+      console.log(
+        chalk.gray("Waiting for another `mops --fix` run to finish..."),
+      );
+      try {
+        release = await lock(lockTarget, {
+          stale,
+          retries: { retries: 240, minTimeout: 250, maxTimeout: 2_000 },
+        });
+      } catch (err2: any) {
+        // proper-lockfile creates `<lockTarget>.lock/` (a directory) for the actual lock,
+        // so manual recovery means removing that, not the empty marker file.
+        throw new Error(
+          `Failed to acquire mops fix lock at ${lockTarget} — another --fix process may be stuck. Remove the ${lockTarget}.lock directory to recover.${err2?.message ? `\n${err2.message}` : ""}`,
+        );
+      }
+    }
+
+    // proper-lockfile registers its own signal-exit handler, but it doesn't reliably
+    // fire on process.exit(). This manual handler covers that gap. Double-unlock is
+    // harmless (the second call throws and is caught).
+    const exitCleanup = () => {
+      try {
+        unlockSync(lockTarget);
+      } catch {}
+    };
+    process.on("exit", exitCleanup);
+
+    depth = 1;
+    try {
+      return await fn();
+    } finally {
+      depth = 0;
+      process.removeListener("exit", exitCleanup);
+      try {
+        await release();
+      } catch {}
+    }
+  } finally {
+    acquiring = false;
+  }
+}

package/integrity.ts

@@ -41,8 +41,8 @@ export async function checkIntegrity(lock?: "check" | "update" | "ignore") {
   }
 
   if (lock === "update") {
-    await updateLockFile({ force });
-    await checkLockFile(force);
+    let regenerated = await updateLockFile({ force });
+    await checkLockFile(force, regenerated);
   } else if (lock === "check") {
     await checkLockFile(force);
   }
@@ -159,14 +159,16 @@ export function checkLockFileLight(): boolean {
   return false;
 }
 
+// returns true if the lock file was (re)written, false if it was skipped
+// because the existing lock is still valid.
 export async function updateLockFile({
   force = false,
-}: { force?: boolean } = {}) {
+}: { force?: boolean } = {}): Promise<boolean> {
   // if lock file exists and mops.toml hasn't changed, don't update it
   // (unless forced: `--lock update` must unconditionally regenerate so users
   // can recover from a corrupt lockfile without `rm mops.lock`)
   if (!force && checkLockFileLight()) {
-    return;
+    return false;
   }
 
   let resolvedDeps = await resolvePackages();
@@ -201,10 +203,13 @@ export async function updateLockFile({
     console.log("  Applications: commit this file.");
     console.log("  Libraries: add mops.lock to .gitignore.");
   }
+  return true;
 }
 
 // compare hashes of local files with hashes from the lock file
-export async function checkLockFile(force = false) {
+// `regenerated` indicates the lockfile was just rewritten from the registry
+// (via `updateLockFile`), so any remaining hash mismatch must be a local edit.
+export async function checkLockFile(force = false, regenerated = false) {
   let supportedVersions = [1, 2, 3];
   let rootDir = getRootDir();
   let lockFile = path.join(rootDir, "mops.lock");
@@ -318,10 +323,26 @@ export async function checkLockFile(force = false) {
         console.error(`Locked hash: ${lockedHash}`);
         console.error(`Actual hash: ${localHash}`);
         console.error("");
-        console.error(
-          "If you have not modified files under .mops/, your lockfile may be stale or corrupt.",
-        );
-        console.error("Run `mops install --lock update` to regenerate it.");
+        if (regenerated) {
+          // The lock was just rewritten from the registry, so the only way
+          // for a per-file hash to still differ is that .mops/<file> was
+          // edited locally. Point users at the actual fix.
+          let pkgDir = fileId.split("/")[0];
+          console.error(
+            `.mops/${fileId} differs from the registry — your local copy has been modified.`,
+          );
+          console.error(
+            `To restore from the global cache, delete the \`.mops/${pkgDir}\` directory and run \`mops install\`.`,
+          );
+          console.error(
+            "To keep custom changes, use a `repo` or `path` entry in mops.toml instead of editing .mops/ directly.",
+          );
+        } else {
+          console.error(
+            "If you have not modified files under .mops/, your lockfile may be stale or corrupt.",
+          );
+          console.error("Run `mops install --lock update` to regenerate it.");
+        }
         process.exit(1);
       }
     }

package/mops.ts

@@ -2,7 +2,7 @@ import process from "node:process";
 import path from "node:path";
 import fs from "node:fs";
 import { Identity } from "@icp-sdk/core/agent";
-import TOML from "@iarna/toml";
+import TOML from "smol-toml";
 import chalk from "chalk";
 import prompts from "prompts";
 import { decodeFile } from "./pem.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ic-mops",
-  "version": "2.13.2",
+  "version": "2.14.1",
   "type": "module",
   "bin": {
     "mops": "dist/bin/mops.js",
@@ -50,7 +50,7 @@
     "test": "NODE_OPTIONS=\"--experimental-vm-modules\" jest"
   },
   "dependencies": {
-    "@iarna/toml": "2.2.5",
+    "smol-toml": "1.6.1",
     "@icp-sdk/core": "4.0.2",
     "@noble/hashes": "1.8.0",
     "as-table": "1.0.55",
@@ -114,6 +114,6 @@
     "ts-jest": "29.4.5",
     "tsx": "4.19.2",
     "typescript": "5.9.2",
-    "wasm-pack": "0.13.1"
+    "wasm-pack": "0.15.0"
   }
 }

package/tests/__snapshots__/check.test.ts.snap

@@ -5,7 +5,7 @@ exports[`check [moc] args are passed to moc 1`] = `
   "exitCode": 1,
   "stderr": "Warning.mo:3.9-3.15: warning [M0194], unused identifier: \`unused\`
 help: if this is intentional, prefix it with an underscore: \`_unused\`
-✗ Check failed for file Warning.mo (exit code: 1)",
+✗ Check failed (exit code: 1)",
   "stdout": "",
 }
 `;
@@ -18,7 +18,7 @@ exports[`check error 1`] = `
 cannot produce expected type
   ()
 Error.mo:7.1-7.21: type error [M0057], unbound variable thisshouldnotcompile
-✗ Check failed for file Error.mo (exit code: 1)",
+✗ Check failed (exit code: 1)",
   "stdout": "",
 }
 `;
@@ -27,11 +27,24 @@ exports[`check error 2`] = `
 {
   "exitCode": 1,
   "stderr": "Ok.mo: No such file or directory
-✗ Check failed for file Ok.mo (exit code: 1)",
+✗ Check failed (exit code: 1)",
   "stdout": "",
 }
 `;
 
+exports[`check multiple files in a single invocation 1`] = `
+{
+  "exitCode": 0,
+  "stderr": "Warning.mo:3.9-3.15: warning [M0194], unused identifier: \`unused\`
+help: if this is intentional, prefix it with an underscore: \`_unused\`",
+  "stdout": "check Using --all-libs for richer diagnostics
+check Running moc:
+<CACHE>moc-wrapper ["Ok.mo","Warning.mo","--check","--all-libs","--default-persistent-actors"]
+✓ Ok.mo
+✓ Warning.mo",
+}
+`;
+
 exports[`check no args checks all canisters 1`] = `
 {
   "exitCode": 0,
@@ -85,7 +98,7 @@ exports[`check warning with -Werror flag 1`] = `
   "exitCode": 1,
   "stderr": "Warning.mo:3.9-3.15: warning [M0194], unused identifier: \`unused\`
 help: if this is intentional, prefix it with an underscore: \`_unused\`
-✗ Check failed for file Warning.mo (exit code: 1)",
+✗ Check failed (exit code: 1)",
   "stdout": "",
 }
 `;

package/tests/check-fix.test.ts

@@ -1,6 +1,8 @@
 import { beforeAll, describe, expect, test } from "@jest/globals";
 import { cpSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
 import path from "path";
+import { lock } from "proper-lockfile";
 import { parseDiagnostics } from "../helpers/autofix-motoko";
 import { cli, normalizePaths } from "./helpers";
 
@@ -60,6 +62,13 @@ describe("check --fix", () => {
     return runFilePath;
   }
 
+  test("parseDiagnostics tolerates missing moc output", () => {
+    // execa with reject:false yields undefined stdout when moc fails to spawn
+    // or is killed (e.g. OOM); parsing must degrade to no diagnostics, not throw.
+    expect(parseDiagnostics(undefined)).toEqual([]);
+    expect(parseDiagnostics("")).toEqual([]);
+  });
+
   test("M0223", async () => {
     await testCheckFix("M0223.mo", { M0223: 1 });
   });
@@ -156,4 +165,41 @@ describe("check --fix", () => {
     expect(result.stderr).toMatch(/error/i);
     expect(result.stdout).not.toMatch(/✓ run/);
   });
+
+  test("concurrent --fix runs serialize and produce the same output", async () => {
+    const runFilePath = copyFixture("edit-suggestions.mo");
+    await cli(["check", runFilePath, "--fix", "--", warningFlags], {
+      cwd: fixDir,
+    });
+    const expected = readFileSync(runFilePath, "utf-8");
+    copyFixture("edit-suggestions.mo");
+
+    // Hold the lock from the test process itself so both children
+    // deterministically hit ELOCKED, print "Waiting...", and queue.
+    const lockTarget = path.join(fixDir, ".mops", "fix.lock");
+    await mkdir(path.dirname(lockTarget), { recursive: true });
+    await writeFile(lockTarget, "", { flag: "a" });
+    const release = await lock(lockTarget, { stale: 30_000 });
+
+    const childA = cli(["check", runFilePath, "--fix", "--", warningFlags], {
+      cwd: fixDir,
+    });
+    const childB = cli(["check", runFilePath, "--fix", "--", warningFlags], {
+      cwd: fixDir,
+    });
+
+    // Hold long enough for both children to spawn (`npm run mops` → bundler →
+    // CLI startup) and attempt the non-blocking acquire. 5s is conservative —
+    // local runs land well under 2s, the headroom is purely to absorb CI jitter.
+    await new Promise((r) => setTimeout(r, 5000));
+    await release();
+
+    const [a, b] = await Promise.all([childA, childB]);
+    expect(a.exitCode).toBe(0);
+    expect(b.exitCode).toBe(0);
+    expect(readFileSync(runFilePath, "utf-8")).toBe(expected);
+    // At least one child must have hit the held lock and queued; if neither
+    // did, the lock didn't actually serialize anything.
+    expect(a.stdout + b.stdout).toContain("Waiting for another");
+  });
 });