Repository navigation
Conversation
`validateLiteral` hand-rolled a second, weaker parser that only inspected the
package-name half. So `bun"react@"` compiled cleanly and then threw from
`BunToolchainModule.parseDependency` during the install -- defeating the
entire purpose of a compile-time validator.
- `validateLiteral` now delegates to `parseDependency`, so the compile-time
and task-time rules cannot diverge again. This also removes a dead `val
name` binding whose two branches both evaluated to `dep` and whose result
was discarded.
- Interpolated forms like `bun"react@$version"` are not knowable at compile
time; the macro previously skipped validation entirely for them. They now
route through `BunDep.validate`, which fails when the build evaluates the
dependency list rather than inside `bun install`.
New `invalid-bun-specifier` fixture covers the literal case; on the parent
commit it compiles and `app.bunDeps` succeeds, returning Seq("react@").
Unit 69 passing, integration 41 passing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`BunScalaJSModule.bunInstall` merged vendored node_modules into `dest/node_modules` unconditionally -- including after the workspace branch had symlinked that path to the shared workspace install's Task.dest. The merge therefore wrote into another task's output, shared by every member of the workspace. - `mergeFromClasspathEntry` refuses a symlinked destination root and names the task the directory belongs to. On its own this turns a silent cross-task write into a loud failure. - The merge moved into the non-workspace branch, and workspace members with a vendored-runtime dependency now fail with an actionable message instead. Sharing one node_modules across members is the point of a workspace, so merging per-member was never going to be right; hoisting vendored trees to the workspace install is a feature, not a bug fix, and is left for later. Only reachable with a published vendored-runtime dependency -- mergeFrom- ClasspathEntry no-ops unless the entry carries META-INF/bun/node_modules -- which is why no fixture caught it. Unit 70 passing, integration 41 passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Stop vendored runtimes leaking into a workspace's shared node_modules
arcaputo3
changed the base branch from
agent/bun-test-lockfile
to
agent/idiomatic-scalajs-mill-workflows
August 26, 2026 22:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack 4/N. Base is
agent/bun-test-lockfile(#16), notmain.The bug
BunDep.validateLiteralhand-rolled a second, weaker npm-spec parser that only inspected the package-name half. So:…and then throws from
BunToolchainModule.parseDependencywhen the install runs. The interpolator exists precisely to catch that at compile time, and it didn't.It also silently skipped validation entirely for any interpolated form (
bun"react@$version"), falling back to$sc.s($args*).The fix
validateLiteraldelegates toparseDependency. One parser, so the compile-time and task-time rules cannot diverge again. This also deletes a deadval namebinding whose two branches both evaluated todepand whose result was discarded.BunDep.validate, which fails when the build evaluates the dependency list rather than insidebun install. Not as good as a compile error, but the value genuinely isn't known until then.Proof
New
invalid-bun-specifierfixture. On the parent commit it compiles andapp.bunDepssucceeds, returningSeq("react@"):New unit test asserts the two parsers agree in both directions across valid and invalid inputs, and that the existing literal cases all still pass — the proof the shared parser didn't over-tighten.
Verification
Unit 69 passing, integration 41 passing.
🤖 Generated with Claude Code