aboutsummaryrefslogtreecommitdiffhomepage
path: root/crates/mozart/src/commands/update.rs
AgeCommit message (Collapse)Author
2026-05-02fix(resolver): honor root self-provide/replace as require fulfilmentnsfisis
Port Composer's RuleSetGenerator::createRequireRule self-fulfilling branch: when the root composer.json's `provide` or `replace` covers a name it also requires (with intersecting constraints), skip emitting an install-one-of rule for that root require. Composer relies on the root package being a fixed entry in the pool so whatProvides() includes it; Mozart does not yet add the root to the pool, so the same decision is made via explicit `root_provide` / `root_replace` tables threaded through ResolveRequest. Without this, an inline repo package whose name matches the root's provide was being force-installed. Fixes installer fixtures `provider_satisfies_its_own_requirement` and `replacer_satisfies_its_own_requirement`.
2026-05-02feat(resolver): add branch-alias support across the resolution pipelinensfisis
Plumb Composer's `extra.branch-alias` mechanism end-to-end so a dev branch (e.g. `dev-foobar`) can be installed alongside its numeric alias (e.g. `3.2.x-dev`) and resolve constraints written against the alias target. Concretely: - `mozart-semver`: stop treating pure-numeric `-dev` as a wildcard branch — `3.2.9999999.9999999-dev` (the form `normalizeBranch` emits) now parses as a classical version with `is_dev_branch=false`, so constraints like `3.2.*` match it. - `mozart-registry/composer_repo`: load `type: composer` repositories from `file://` URLs (legacy embedded `packages.json`). - `mozart-registry/resolver`: emit pool entries in pairs for dev branches with `extra.branch-alias`, link them via `is_alias_of`, and apply `@dev`/`@beta` etc. stability suffix flags from root requires. - `mozart-sat-resolver`: alias rules (`PackageAlias` / `PackageInverseAlias`) so alias and target install together; alias packages skipped from same-name conflict indexing. - `mozart-sat-resolver/policy`: `DefaultPolicy` now honors `prefer_stable` via Composer's stability-tier comparison. - `mozart-registry/lockfile`: split resolved set into real packages vs. alias entries; populate the `aliases[]` block. - `mozart-registry/installer_executor`: new `MarkAliasInstalled` operation; `format_full_pretty_version` mirroring `BasePackage::getFullPrettyVersion` (appends source ref[0..7] for dev/git packages). - Test harness rewrites fixture-relative `file://` URLs to absolute paths. Newly green fixtures: `install_branch_alias_composer_repo`, `alias_solver_problems`, `alias_solver_problems2`, `conflict_with_all_dependencies_option_dont_recommend_to_use_it`, `unbounded_conflict_does_not_match_default_branch_with_branch_alias`, `unbounded_conflict_does_not_match_default_branch_with_numeric_branch`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02fix(installer): match Composer's transaction order and uninstall labelnsfisis
Three coupled changes that bring `compute_operations` + the in-process trace recorder into byte-parity with Composer's `Transaction::__toString` output: - `TraceRecorderExecutor`: emit "Removing X (V)" instead of "Uninstalling X (V)" — Composer's `UninstallOperation::__toString` uses "Removing". - `install_from_lock`: run removals before installs/updates to mirror `Transaction::moveUninstallsToFront`. Both dry-run and real-execution branches now emit the same prefix order. - `topological_sort`: replace recursive DFS with the stack-based DFS that Composer uses in `Transaction::calculateOperations`. Roots are seeded reverse-alphabetically (matching `setResultPackageMaps`'s uasort with `strcmp(b, a)`), and `getProvidersInResult` is mirrored by treating a package's `provide`/`replace` keys as additional name targets when resolving a `require` link. To make the third change work end-to-end, `LockedPackage` gains typed `provide` and `replace` fields (Composer's lock preserves them; Mozart was silently dropping them). `packagist_version_to_locked_package` now copies them through. Unignores 13 installer fixtures (10 newly green from the fix, 3 that were already green-but-still-flagged): conflict_downgrade_nested, install_from_lock_removes_package, install_security_advisory_matching_dependency, load_replaced_package_if_replacer_dropped, partial_update_keeps_older_dep_* (×2), partial_update_security_advisory_matching_locked_dep, provider_packages_can_be_installed_together_with_provided_if_both_installable, remove_deletes_unused_deps, replace_priorities, update_allow_list_require_new_replace, update_allow_list_with_dependencies_require_new_replace, update_requiring_decision_reverts_and_learning_positive_literals. Installer scoreboard: 75/187 → 88/187. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02test(installer): switch fixtures to in-process harnessnsfisis
Replaces the spawn-based runner in tests/installer.rs with the in-process harness from Step E. Every fixture now goes through mozart::commands::{install,update}::run with an empty RepositorySet (Composer's `'packagist' => false` test config) and a TraceRecorderExecutor (Composer's InstallationManagerMock), and the EXPECT section is now asserted against the recorder's trace - load-bearing for behavior parity, not just exit-code. The original CI failure (suggest_replaced) is now legitimately tested: the empty RepositorySet makes b/b unreachable just like Composer's test config, the inline package repo's eager preload finds c/c which replaces b/b, and the topological install order in compute_operations produces the c/c -> a/a trace the fixture pins. Strict trace assertion surfaced 60 Mozart-vs-Composer divergences that the exit-code-only spawn runner had been silently ignoring. Each is marked `installer_fixture\!(name, ignore)` for now; the categories break down roughly as: - alias handling (alias_in_lock2, install_aliased_alias, update_alias*) - replace / provider trace shape (replace_priorities, provider_satisfies_its_own_requirement, replacer_*) - update direction strings (update_changes_url, update_reference, update_dev_*) - partial-update + lock interactions (partial_update_*) - allow-list with replace/dependency interactions (update_allow_list_with_dependencies_require_new*) These each become individual follow-up Mozart bugs rather than mass silent-pass. Also marks prefer_lowest_branches as ignore: it's a real flake driven by HashSet iteration order in the resolver, where two equivalent candidates can be picked in either order. That's a separate determinism bug worth its own fix. The proxy-hack env-vars in mozart-test-harness::runner are removed - no test currently spawns the binary, and the in-process harness expresses Packagist disablement directly via RepositorySet::empty rather than relying on TCP failure to suppress network calls. Headline numbers: 75 passed (in-process, exit-code + EXPECT trace) + 112 ignored, vs prior 136 passed (spawn, exit-code only) + 51 ignored. The drop in passing count reflects the stricter assertion bar, not new regressions. Also removes tests/installer_in_process.rs - its single proof-of- concept fixture (suggest_replaced) is now part of the unified installer.rs harness. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02refactor(commands): split install/update into CLI execute + library runnsfisis
Carve commands::install::execute and commands::update::execute into thin CLI-arg-driven wrappers + run() entry points that take (working_dir, args, console, repositories, executor) directly. The wrappers build a production RepositorySet (Packagist) + FilesystemExecutor from cli, then dispatch to run; in-process tests will call run directly with an empty RepositorySet (Composer's `'packagist' => false` test config) and a tracing InstallerExecutor. The install -> update fallback (no composer.lock present) now goes through update::run, forwarding the caller's repositories + executor so test mocks survive the edge. Also drop the now-dead InstallConfig::no_cache field — install_from_lock stopped consuming the cache when FilesystemExecutor was extracted in the earlier DI plumbing pass, so the field has no effect. All 136 enabled installer fixtures + 114 mozart-registry tests + 541 mozart lib tests still green; clippy clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02refactor(registry): plumb RepositorySet and executor through callersnsfisis
ResolveRequest and LockFileGenerationRequest now take Arc<RepositorySet> instead of a raw Cache. install_from_lock now accepts &mut dyn InstallerExecutor instead of constructing FilesystemExecutor internally. Both changes expose the DI injection points needed by the upcoming in-process test harness, where Packagist must be replaced with an empty RepositorySet (Composer's `'packagist' => false` test config) and filesystem install execution must be replaced with a tracing recorder (Composer's InstallationManagerMock). The eager VCS scan and inline-package preload still happen inside resolve(), so the RawRepository array is kept on ResolveRequest as raw_repositories - migrating those through RepositorySet remains a follow-up. RepositorySet gains with_packagist and empty constructors so production callers and future tests have a uniform construction shape. All 136 enabled installer fixtures + 114 mozart-registry tests + 541 mozart lib tests still green; clippy clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02fix(update): normalize locked version to 4-segment form on partial pinnsfisis
`apply_partial_update` and `apply_patch_only` both pinned non-listed packages back to the lock by copying `LockedPackage.version_normalized` verbatim, falling back to the raw pretty `version` when the field was missing. Lock files written by Composer always include the field, but hand-written fixtures (every `--LOCK--` block in the installer fixtures, in particular) typically only carry `version`. The 3-segment form ("1.0.0") then leaked into the resolved package, where `LockFileGenerationRequest::inline_lookup` compares against the 4-segment normalizer output ("1.0.0.0") and missed inline `type: package` entries — triggering a Packagist fetch (and proxy-blocked failure under the test harness) for a package that should never need one. Extract a single `locked_version_normalized` helper that runs the pretty version through `mozart_semver::Version::parse(...).to_string()` when the lock omits `version_normalized`, and use it from both call sites. Mirrors `packagist_to_pool_inputs` and `inline_lookup`, which already produce the 4-segment form. Unblocks 26 installer fixtures: the entire update-allow-list cluster (16, minus the alias subcase), five partial-update cases, and five others (full-update-minimal-changes, load-replaced-package-if-replacer-dropped, remove-deletes-unused-deps, remove-does-nothing-if-removal-requires-update-of-dep, update-changes-url). Scoreboard: 107 → 133 of 187 installer fixtures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-01feat(core): reject root composer.json that requires its own namensfisis
Mirrors Composer\Package\Loader\RootPackageLoader::load(): if the root package's "name" appears as a key in its own "require" or "require-dev" map, fail loudly before reaching the resolver. Without this, Mozart would silently let the request hit Packagist (which has no entry for the root's vendor/name) and report a misleading "could not be found" error. Wired into install::execute (when a lock file is present) and update::execute (the no-lock fallback path). Carries the same wording as Composer's RuntimeException so a future EXPECT-OUTPUT comparison will match. Also extends the installer test harness: when a fixture sets EXPECT-EXCEPTION but no EXPECT-EXIT-CODE, assert that Mozart exits non-zero. Full exception-class matching remains a follow-up (see .ken/test_design.md §7.2). Closes the gap exercised by the install-self-from-root installer fixture. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-02-24fix(cache): enable dist archive caching for all commandsnsfisis
files_cache was Option<&Cache> and install_from_lock always passed None, so downloaded zip/tar archives were never cached. Make the parameter non-optional (&Cache) and wire it through every command that downloads dist archives (install, update, require, remove, create-project, archive). The Cache internally respects --no-cache via its enabled flag, so the Option wrapper was unnecessary. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24feat(cache): enable repo cache for all Packagist API callsnsfisis
Remove the Option wrapper from repo_cache in ResolveRequest, LockFileGenerationRequest, and fetch_package_versions. All commands now initialize a Cache via build_cache_config(cli.no_cache), ensuring Packagist metadata is cached to disk (respecting --no-cache flag). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23refactor(cli): route command output through Console abstractionnsfisis
Replace direct println\!/eprintln\! calls with console.write(), console.info(), and console.write_stdout() across all command handlers to respect verbosity settings. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23fix(cli): align install/update output with Composer conventionsnsfisis
- Migrate eprintln\! to Console for consistent colored output - Use Composer terminology in lock file operations: Locking instead of Installing, Upgrading/Downgrading instead of Updating - Add is_downgrade() helper to distinguish upgrades from downgrades - Pass Console through install_from_lock for proper output handling Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23feat(vcs): add mozart-vcs crate for VCS repository supportnsfisis
Implement VCS driver/downloader infrastructure mirroring Composer's VCS subsystem. Includes drivers for GitHub, GitLab, Bitbucket, Forgejo, Git, Hg, and SVN with API-based metadata resolution, plus source downloaders for Git/Hg/SVN. Integrates into mozart-registry via vcs_bridge module to scan VCS repositories and feed discovered packages into the SAT resolver. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23fix(update): implement --with constraints, inline shorthand, and APCu ↵nsfisis
passthrough - Parse and apply --with temporary constraints to the resolver - Support inline constraint shorthand (vendor/pkg:1.0.*) - Reject --lock combined with specific package names - Filter magic keywords (lock/nothing/mirrors) from package list - Pass APCu CLI flags through to InstallConfig instead of hardcoding Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23fix(install): add CLI option validation, download-only wiring, and ↵nsfisis
apcu-prefix implicit enable - Restrict --prefer-install to source/dist/auto and --audit-format to table/plain/json/summary via clap value_parser - Error when --prefer-install is combined with --prefer-source/--prefer-dist - Wire --download-only through InstallConfig to skip autoloader and installed.json - Implicitly enable --apcu-autoloader when --apcu-autoloader-prefix is set - Apply same validation fixes to update, require, remove, create-project commands Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22refactor(console): add console_format! proc macro and migrate all commandsnsfisis
Introduce a Symfony Console-style tag macro that replaces verbose patterns like `console::info(&format!("text {name}"))` with `console_format!("<info>text {name}</info>")`. Supports all 6 tag types (info, comment, error, question, highlight, warning) with format argument distribution across multiple tagged segments. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22fix(bump): align output messages with Composer outputnsfisis
- "Nothing to bump." → "No requirements to update in <path>." - "N constraint(s) bumped successfully." → "<path> has been updated (N changes)." - Dry-run now shows "<path> would be updated with:" followed by " - require.<pkg>: <ver>" per change, matching Composer's format - Also update bump message in update command for consistency Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22chore: cargo fmtnsfisis
2026-02-22feat(update): implement --patch-only, --root-reqs, --bump-after-updatensfisis
- --patch-only: restrict updates to patch-level changes by pinning packages back to locked versions when major.minor differs - --root-reqs: auto-populate update list with root require/require-dev packages when no explicit packages are specified - --bump-after-update: bump composer.json version constraints to match resolved versions after update, with dev/no-dev/all modes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22fix(resolver): replace __root__ with actual package name in error messagesnsfisis
Composer never shows the internal __root__ identifier to users. Add root_name field to ResolveRequest so the resolver can substitute the real package name (e.g. "laravel/laravel") in pubgrub error reports. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22chore: remove some of #[ignore] attributesnsfisis
2026-02-22refactor(async): migrate from blocking HTTP to async/await with tokionsfisis
Replace reqwest::blocking with async reqwest across the entire codebase. All command execute functions, registry API calls (packagist, downloader, resolver, lockfile), and the main entry point now use async/await with the tokio runtime. The pubgrub resolver runs on spawn_blocking since its DependencyProvider trait is synchronous, using Handle::block_on for async I/O within that context. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22refactor(workspace): split monolithic crate into 6 workspace cratesnsfisis
Extract modules from the single `mozart` crate into 5 focused library crates to improve compilation parallelism and architectural clarity: - mozart-constraint: version constraint parser (independent) - mozart-core: base types, console, validation, platform utilities - mozart-archiver: archive creation (tar, zip, bzip2) - mozart-registry: Packagist API, cache, resolver, downloader, lockfile - mozart-autoload: autoloader generation and PHP scanner Refactor Console::from_cli and build_cache_config to accept primitive args instead of &Cli to break circular dependencies. Introduce [workspace.dependencies] for centralized version management. Remove 9 unused direct dependencies from the CLI crate. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(console): add structured error handling, verbosity, and suggestionsnsfisis
Implement Phase 7.2 error handling & UX infrastructure: - Add exit_code module with MozartError, bail()/bail_silent() helpers, and Composer-compatible exit code constants (0-5, 100) - Redesign Console struct with Verbosity enum (Quiet/Normal/Verbose/ VeryVerbose/Debug), ANSI auto-detection via IsTerminal, and verbosity-gated output methods (info/verbose/debug/error) - Thread Console through all 33 command execute() signatures - Replace all std::process::exit() calls with structured MozartError returns handled in main() - Migrate eprintln\! status messages to console.info() for quiet-mode suppression - Add suggest module with Levenshtein distance and "Did you mean?" formatting for future package name suggestions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(cache): add filesystem-backed cache with TTL expiration and size-limited GCnsfisis
Implement a cache module with CacheConfig and Cache structs supporting read/write (string and binary), atomic writes via temp+rename, TTL-based expiration, and size-limited garbage collection. Wire the repo cache into packagist.rs and resolver.rs for API response caching, and the files cache into downloader.rs for dist archive caching. Implement the clear-cache command with full clear and --gc modes. All existing call sites pass None for backward compatibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(autoload): add classmap scanning, optimize, APCu, platform checks, and ↵nsfisis
strict-psr Add PHP file scanner (php_scanner.rs) with class/interface/trait/enum detection, comment/string/heredoc stripping, and PSR-4/PSR-0 validation. Extend autoload generation with: classmap directory scanning, --optimize mode (PSR-4/PSR-0 to classmap), --classmap-authoritative, --apcu caching with optional prefix, platform_check.php generation, and --strict-psr violation reporting. Wire new options through dump-autoload, install, require, update, and remove commands. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(update): add wildcard expansion, dependency traversal, minimal-changes, ↵nsfisis
and interactive mode Implement Phase 5.4 update command extensions: - Wildcard package matching (e.g. symfony/*) against the lock file - --with-dependencies expands update set to include direct deps - --with-all-dependencies expands to full transitive dependency tree - --minimal-changes pins all packages to locked versions unless constraints changed - --interactive prompts user to select packages for update (y/n per package) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(install): add InstallConfig, platform warnings, and download progressnsfisis
Replace positional boolean parameters in install_from_lock with a structured InstallConfig. Add platform requirement warnings, download progress display, classmap-authoritative autoloader support, and prefer-source detection across install/update/require/remove commands. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(depends): implement depends and prohibits commands with shared ↵nsfisis
dependency logic Add the `depends` (why) and `prohibits` (why-not) commands that query the dependency graph to answer "which packages require X?" and "which packages prevent version Y of X from being installed?" respectively. Introduces the shared `dependency` module with package loading from lock file or installed.json, forward/inverted dependency graph walking, recursive traversal with cycle detection, and table/tree output formatters. Adds `conflict` field to LockedPackage for conflict-based prohibition detection, updating all struct literals across install, remove, require, and update test helpers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21feat(update): implement update command with resolver-based dependency updatesnsfisis
Add full update command supporting --lock (content-hash refresh only), --dry-run, --no-install, --no-dev, --prefer-stable, --prefer-lowest, and partial updates (named packages). Extract install_from_lock() from install.rs for shared use. Add Stability::parse() to package.rs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-11change commands::*::execute() signaturesnsfisis
2026-02-11enable workspacensfisis