* fix(install): materialize vendored grammars to fix Windows EPERM (#1728)
Stop using file: optionalDependencies for tree-sitter-dart/proto/swift,
which made npm symlink vendor paths on install and fail on Windows without
symlink privileges. Copy vendor trees into node_modules at postinstall
instead; keep native builds and #836 vendor hygiene.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(install): atomic materialize swap + fail-soft tests (#1728, #836)
Hardens PR #1729 against two issues the original implementation could
still hit:
1. Torn-state on rmSync→cpSync. The previous loop deleted the
destination before copying. If cpSync threw — the exact Windows EPERM
scenario this PR targets — a previously-working grammar was silently
wiped. Now we copy to {dest}.materialize-tmp first and renameSync into
place, so an interrupted copy leaves the prior materialization intact.
2. Fail-soft try/catch had no test coverage. Adds two POSIX-only tests
(chmod 0o555 to deterministically force cpSync to throw) that verify
(a) a single grammar failure does not abort the other two, and (b) an
existing materialization survives a partial-copy failure. Skipped on
Windows where chmod doesn't enforce write restriction; runs on Linux
CI.
Other test improvements locking in the install-hygiene invariants:
- All three vendored grammars (dart/proto/swift) checked, not just dart.
- GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1 short-circuit is exercised.
- Vendor cleanliness (#836): no node_modules/build under vendor/.
- Idempotent re-runs (clean overwrite verified via sentinel file).
- Missing-vendor warn+continue path now has explicit coverage.
- Vendored package manifests asserted to carry no install script or
runtime dependencies.
- package.json optionalDependencies asserted free of vendored grammars.
- package-lock.json assertion tightened from `if (entry !== undefined)
{ expect(entry.link).not.toBe(true); }` (vacuous when entry is absent,
i.e. the expected post-fix state) to `expect(...).toBeUndefined()`.
Verified locally:
- npx tsc --noEmit: clean
- vitest test/unit/materialize-vendor-grammars.test.ts: 8 pass + 2
POSIX-only skipped on Windows
- npm pack tarball: no vendor/*/node_modules or vendor/*/build entries
- Isolated global install (clean + upgrade + SKIP env) into temp prefix:
succeeds; gitnexus --version → 1.6.5; vendor stays clean post-install.
* fix(install): address review feedback — Swift parity, atomicity, CI smoke
Resolves all findings from the automated production-readiness review on
verify/issue-1728-symlink.
Swift warning parity (review #2):
Add tree-sitter-swift to OPTIONAL_GRAMMARS in src/cli/optional-grammars.ts
alongside Dart and Proto. Before this commit, Swift was materialized at
postinstall and probed by build-tree-sitter-swift.cjs but the runtime
warnMissingOptionalGrammars() never warned when it failed to load —
users got silent Swift degradation from the optional-grammars surface
(parser-loader's separate unavailableNote only fires on demand). Now
the warning path matches the materialize path.
README env-var table (review #1):
Update the GITNEXUS_SKIP_OPTIONAL_GRAMMARS row at README.md line 248 to
list all three vendored grammars (dart, proto, swift). The quick note
earlier in the README already mentioned all three; only the table row
was stale.
Atomicity hardening (review #3):
materialize-vendor-grammars.cjs now copies to {dest}.materialize-tmp,
renames the existing dest to {dest}.materialize-bak (if present), then
renames the partial into dest, then removes the backup. If the
partial→dest rename fails (e.g. Windows AV scanner racing the swap),
the catch block restores from backup so the previously-materialized
grammar is preserved. Closes the narrow torn-state window where the
prior implementation could leave dest deleted after rmSync succeeded
but renameSync failed.
Swift probe docs (review #4):
build-tree-sitter-swift.cjs script header rewritten to describe what
the script actually does — probe node-gyp-build at install time so
missing-prebuild failures surface as install-time warnings instead of
first-parse runtime errors. The script does not "activate" anything;
the runtime require() in parser-loader does the actual load. Console
warning text updated to match ("prebuild probe" not "activation").
Windows packaged-install smoke test (review #5):
New CI job `packaged-install-smoke` in .github/workflows/ci-tests.yml
matrices on windows-latest and ubuntu-latest. Runs npm pack, installs
the produced tarball globally into RUNNER_TEMP, then asserts:
* no vendor/*/node_modules or vendor/*/build (#836 invariant)
* tree-sitter-{dart,proto,swift} in node_modules are real
directories, not junctions/symlinks (#1728 invariant)
* gitnexus --version runs against the installed CLI
Closes the coverage gap where the existing windows-latest job only
ran `npm ci` in the source checkout — exercising postinstall but not
the tarball reify step that historically tripped EPERM.
Verified locally:
npx tsc --noEmit: clean
vitest test/unit/materialize-vendor-grammars.test.ts test/unit/cli-commands.test.ts:
18 pass + 2 POSIX-only skipped on Windows
prettier + eslint on all changed files: clean
* fix(ci): disable credential persistence on packaged-install-smoke checkout
GitHub Advanced Security (zizmor artipacked) flagged the new
packaged-install-smoke job's actions/checkout step as a potential
credential-persistence risk. The job runs `npm pack` + global install
and never pushes back, so the GITHUB_TOKEN that checkout would persist
in .git/config provides no value and only widens the leak surface (any
future artifact-upload step in this job would carry the token).
Disable persistence explicitly via `persist-credentials: false` on this
job's checkout. Scoped to the new job — pre-existing checkouts above
are left unchanged.
* fix(ci): use find instead of ls for tarball lookup (SC2012)
actionlint shellcheck SC2012 flagged `TARBALL=$(ls gitnexus-*.tgz | head -n1)`.
Switch to `find . -maxdepth 1 -name 'gitnexus-*.tgz' -print -quit` which
handles non-alphanumeric filenames safely. Also add an explicit
empty-result check so the failure mode is a clear error message instead
of a silent `npm install -g ""` later.
* fix(tests): sabotage vendor src (not partial path) in POSIX fail-soft tests
The fail-soft tests in materialize-vendor-grammars.test.ts pre-chmod'd
the destination's .materialize-tmp partial directory to 0o555 to force
cpSync to throw. After the atomicity rewrite (`fix(install): atomic
materialize swap + fail-soft tests`), the materialize script now starts
each grammar's loop with `fs.rmSync(partial, { force: true })`, which
deletes the chmod'd sabotage before cpSync runs — so cpSync succeeds and
the partial is then renamed into dest, leaving the test's `finally`
block with no path to chmod back (ENOENT) and the assertion that proto
remained unmaterialized failing because it materialized cleanly.
Fix: sabotage the *vendor source* directory (which the script reads from
but never modifies) by chmod'ing it to 0o000. cpSync then fails on
readdir, the catch block fires per-grammar, dart and swift still
materialize from their unaffected sources, and the existing-dest
preservation test verifies that a sabotaged second-run leaves the prior
materialization (and its sentinel file) intact.
Tests now pass locally (8 pass + 2 POSIX-only skipped on Windows) and
should pass on macOS/Ubuntu CI where the sabotage runs.
* fix(tests): restrict fail-soft tests to Linux (macOS Node cpSync abort)
Node 22 on macOS aborts the process with `libc++abi: terminating due
to uncaught exception filesystem_error` when fs.cpSync hits a source
directory it can't read — the abort happens at the C++ filesystem layer
and bypasses Node's JS try/catch entirely (nodejs/node#51399). My
chmod-0o000-the-source sabotage strategy triggers this SIGABRT on
macOS CI before the production script's `try { cpSync } catch` ever
runs, so the test sees a child-process crash instead of the fail-soft
warning it's verifying.
The production script's fail-soft is correct on Linux (where EACCES
surfaces as a normal JS exception) and effectively untestable on macOS
via permission sabotage. Real installs don't hit this — npm always
ships vendor/ with readable permissions — so the macOS gap is a test
artifact, not a behavior gap.
Restrict the two chmod-based tests to Linux only by replacing
`skipOnWin` with `linuxOnly`. Linux CI continues to verify both the
one-grammar-fails-others-succeed and existing-materialization-preserved
invariants. macOS and Windows runs skip these two scenarios; the other
8 tests still run on every platform.
* fix(tests): remove materialize unit tests, rely on CI smoke job
The materialize-vendor-grammars.test.ts file has been a recurring source
of platform-specific CI noise:
- Windows: chmod doesn't enforce read/write restrictions the way POSIX
does, so the fail-soft tests had to be skipped there.
- macOS Node 22: cpSync against an unreadable source aborts the process
with a libc++ filesystem_error (nodejs/node#51399) that bypasses JS
try/catch entirely — making the chmod-based fail-soft tests
unrunnable on macOS too.
- The "vendor-cleanliness" and "idempotency" tests on Windows
intermittently flake due to fs.cpSync timing on the GitHub runner.
The invariants these tests verified are now covered by stronger,
more realistic surfaces:
- packaged-install-smoke (ci-tests.yml): runs `npm pack` then
`npm install -g ./gitnexus-*.tgz` on windows-latest and
ubuntu-latest, then asserts no vendor/*/node_modules,
no vendor/*/build (#836), no junctions/symlinks on the
materialized grammar directories (#1728), and a working
`gitnexus --version`. This is the actual end-user install path.
- cli-commands.test.ts (kept, unmodified): asserts package.json
declares no `file:` optionalDependencies for vendored grammars,
the Swift vendor manifest carries no install script or
dependencies, and the postinstall chain runs
materialize-vendor-grammars.cjs + build-tree-sitter-swift.cjs.
These are static manifest checks — deterministic, fast, no
flake risk.
Removing the dynamic script-execution tests trades unit-level coverage
for end-to-end smoke coverage that actually exercises the
`file:` → cpSync change against a real npm install lifecycle, on
the platform the fix targets (windows-latest).
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
