@@ -8,11 +8,3 @@ buildifier(
     ],
     lint_mode = "fix",
 )
-
-# The binary behind the target above, which formats the paths it is given rather than
-# always the whole workspace. `just format` goes through this so that formatting a
-# directory formats that directory.
-alias(
-    name = "binary",
-    actual = "@buildifier_prebuilt//:buildifier",
-)
@@ -149,3 +149,40 @@ to be understood by all of them. That is fine when they speak the same language,
 a broad `just test .` reaches bazel and pytest suites alike, and a flag meant for one of
 them will fail on the other. It fails rather than being quietly ignored, so the answer
 is to aim the verb at something narrower.
+
+# Command separators
+
+Commands are echoed between rules that span the terminal. The formatters echo a summary
+rather than the line that runs: they name the formatter and what it is told to do, and
+leave out the wrapper that collects the files, the patterns it walks and the flags that
+only shape output. A leading `-> ` marks a line as that summary. `just -n` prints what
+actually runs, which it does whether or not the recipe is `@`-quiet.
+
+Nothing is lost by this, as a banner has never been something to paste: the echoed line
+carried an unexpanded `"$@"`, which matches no file in another shell, so pasting one
+formatted nothing and exited 0.
+
+What a formatter says for itself is filtered down to what happened, as several name every
+file they considered and most of them were left alone. One such line is kept on purpose:
+buildifier's count of the warnings it could not fix, which is the only notice of them,
+since it reports no detail in fix mode and exits 0 whether or not any remain. That tally
+grows with the tree and is mostly lint about docstrings. Finding it tiresome is a reason
+to configure what buildifier lints, never to widen the filter back over it, which would
+take the warnings worth having along with the rest.
+
+Measuring the width means a `shell()` call, and that runs on every parse, so the result
+is exported as `JUST_CMD_RULE` and an inherited value is preferred to measuring again.
+
+Inheritance crosses processes, which is what forwarding creates: a child per justfile
+reached, each of them measuring nothing. A `mod` spawns no process, so a module measures
+for itself, and the count is one per `mod` reached, however deeply nested, plus one for
+the file itself. That is cheap, and modules agree anyway since they share a terminal,
+but it is worth knowing before counting measurements. Presetting `JUST_CMD_RULE` skips
+all of them, and is also how to fix the width in CI or in a recording — it is the whole
+separator and ends up in a shell script, so every line of it has to be a comment, or it
+runs.
+
+With no terminal to ask — a pipe, a log, a shell without `stty` — it falls back to a
+fixed 57 columns, so logs and CI output are the same width every time. That is one
+branch rather than a platform test: `just` runs `sh` everywhere, so Windows takes
+whichever arm fits rather than a path of its own.
@@ -14,12 +14,12 @@ _build_dist LANGUAGE: _require_semmle_code (_maybe_build_dist LANGUAGE)
 # something `--ui_event_filters` can let back through, and a build this long is one to
 # see the progress of.
 [no-exit-message]
-_maybe_build_dist LANGUAGE: (_if_in_semmle_code (f'cd "$SEMMLE_CODE"; MSYS2_ARG_CONV_EXCL="*" tools/bazel test //language-packs:intree-{{ LANGUAGE }}-as-test --test_output=errors') '# using codeql from PATH, if any')
+_maybe_build_dist LANGUAGE: (_if_in_semmle_code (f'cd "$SEMMLE_CODE"; tools/bazel test //language-packs:intree-{{ LANGUAGE }}-as-test --test_output=errors') '# using codeql from PATH, if any')
 
 # Call bazel. Uses our official bazel wrapper if we are in an internal repository checkout
 [no-cd]
 [no-exit-message]
-_bazel *ARGS: (_if_in_semmle_code 'cd "$SEMMLE_CODE"; MSYS2_ARG_CONV_EXCL="*" tools/bazel' 'bazel' ARGS)
+_bazel *ARGS: (_if_in_semmle_code 'cd "$SEMMLE_CODE"; tools/bazel' 'bazel' ARGS)
 
 # Call sembuild (requires an internal repository checkout)
 [no-cd]
 
@@ -1,3 +1,8 @@
+# The first definition of a variable wins, not the last, so this order is what lets the
+# internal file set `SEMMLE_CODE` while the stub is the fallback when it is absent.
+# Swapped, the stub wins even where the real file exists and that checkout then behaves
+# as if it were external. Nothing here can catch that: with the file absent, as it
+# always is in this repository, both orders evaluate the same.
 import? '../../../semmle-code.just' # internal repo just file, if present
 import 'semmle-code-stub.just'
 
@@ -12,8 +17,43 @@ set allow-duplicate-variables
 export PATH_SEP := if os() == "windows" { ";" } else { ":" }
 export JUST_EXECUTABLE := just_executable()
 
+# MSYS2 rewrites arguments that look like paths as it hands them to a native program,
+# which mangles bazel's `//target` labels. Set once here rather than at each bazel call:
+# a call that forgets it works everywhere except Windows, which is where nobody looks.
+# The price of setting it once is that it covers every command a recipe runs, so a tool
+# that wants Windows path conversion has to ask for it back.
+export MSYS2_ARG_CONV_EXCL := if os() == "windows" { "*" } else { "" }
+
 error := f'{{ style("error") }}error{{ NORMAL }}: '
-cmd_sep := "\n#--------------------------------------------------------\n"
+
+# The separator line, sized to the terminal.
+#
+# `stty` rather than `tput`: it needs no terminfo, so it survives `TERM=dumb`, and reads
+# the terminal from stdin, so it answers when stdout is piped. The arithmetic is in the
+# shell because just has no integers.
+#
+# With no terminal the value is non-numeric and this falls back to a fixed 57 columns.
+# That is a branch, not a platform test: just runs `sh` everywhere.
+#
+# `JUST_CMD_RULE` is the whole separator and lands in a shell script, so a hand-set value
+# has to be a shell comment, every line of it, or it runs. Left unchecked: setting it at
+# all means being able to run commands already, so there is nothing to defend.
+#
+# Exported and preferred over measuring: `shell()` runs on every parse, so a forwarded
+# verb would otherwise re-measure in every child it spawns, and `if` is lazy in its
+# branches. Inheritance needs a process, so a `mod` measures for itself; presetting
+# `JUST_CMD_RULE` skips measuring entirely.
+_given_horizontal_rule := env('JUST_CMD_RULE', '')
+
+_horizontal_rule := if _given_horizontal_rule == '' { shell('''
+    w=$(stty size 2>/dev/null | cut -d" " -f2)
+    case "$w" in '' | *[!0-9]*) w=57 ;; esac
+    printf "%*s" $w "" | tr " " '#'
+''') } else { _given_horizontal_rule }
+
+export JUST_CMD_RULE := _horizontal_rule
+
+cmd_sep := "\n" + _horizontal_rule + "\n"
 export CMD_BEGIN := style("command") + cmd_sep
 export CMD_END := cmd_sep + NORMAL
 export JUST_ERROR := error
@@ -25,7 +65,7 @@ default_db_checks := ['--check-databases', '--check-diff-informed', '--fail-on-t
 [no-exit-message]
 @_require_semmle_code:
     {{ if SEMMLE_CODE == "" { f'''
-        echo "{error} running this recipe requires doing so from an internal repository checkout" >&2
+        echo "{{ error }}running this recipe requires doing so from an internal repository checkout" >&2
         exit 1
     ''' } else { "" } }}
 
 
@@ -1,83 +1,74 @@
 import "build.just"
 
-_ql_formatter := if SEMMLE_CODE != "" { '"$SEMMLE_CODE/target/intree/codeql-nolang/codeql"' } else { "codeql" }
-
-_py_formatter := if SEMMLE_CODE != "" { "uv run black" } else { "black" }
-
-_cpp_formatter := if SEMMLE_CODE != "" { "uv run clang-format" } else { "clang-format" }
-
-# The `buildifier` bazel target always covers the whole workspace, so the binary behind
-# it is used instead and given paths. bazel is asked from the root of this repository,
-# even when it sits inside another, and the files are bounded to that root as well: each
-# repository then formats its own bazel files with the buildifier version it pins, and a
-# verb aimed at a tree spanning both is answered once by each. This is the opposite of
-# building, where a target needs the enclosing workspace to resolve at all, hence
-# `_bazel` in build.just going the other way.
-_bazel_workspace := quote(parent_directory(parent_directory(source_dir())))
-
-_bazel_formatter := "bazel run --noshow_progress --ui_event_filters=,+error,+fail //misc/bazel/buildifier:binary --"
-
-# bazel files are named rather than suffixed, and buildifier has no exclude option of its
-# own, so the files skipped by the target above are skipped here too. That target formats
-# the whole workspace at once and so cannot take the path this recipe is given, which is
-# why the two run the same binary through different entry points. Their exclusions are
-# therefore stated twice, in two places, in two syntaxes: keep them in step, or `just
-# format` rewrites what pre-commit and CI deliberately leave alone.
-#
-# bazel knows `BUILD` and `WORKSPACE` by those names and everything else by the `.bazel`
-# extension, so a file named `BUILD.<anything>` else is a template or a generator's input
-# rather than a bazel file, and is none of the formatter's business to parse.
+# These formatters take files rather than directories, so `run_on_files.py` collects them
+# and passes them positionally, which is what lets paths contain spaces. Both name every
+# file they were given, so the lines saying nothing happened are dropped: for buildifier
+# that is an empty warning tally, and a non-zero one is left alone, being the only notice
+# of what it could not fix now that the exit code is 0 either way.
 #
-# Both lists are comma-separated, so a root defining its own `_root_format` can name
-# several patterns in one variable. It has no need to repeat the ones here: the files
-# they cover belong to this repository, which formats them itself. Exclusions match the
-# path as walked rather than as spelled on the command line, so one naming a directory
-# has to cover both the path it is reached by and the path it is walked from.
+# The collector announces the run, rather than each recipe saying what it is about to do.
+# A recipe reaches that line knowing neither whether any file matched nor which of the
+# paths it was handed hold one, and both are worth waiting for: a path whose files are all
+# excluded is the ordinary case here, as a repository formatting its own bazel files is
+# handed a nested repository's path too. The price of letting the collector speak is that
+# it names the command as it is really spelled, flags that only shape output and all. It
+# is a report rather than something to paste in any case, the collecting being the point;
+# `just -n` prints what actually runs, `@` or no `@`. `_format_py` echoes its own, having
+# no collector to defer to and nothing to decide.
 #
-# As with the QL formatter, buildifier only names what it rewrote if it also accounts for
-# every file it did not, so that accounting is dropped. It counts the warnings it could
-# not fix there, which are left for linting to report rather than raised on every format.
-_bazel_names := "BUILD,WORKSPACE,*.bazel,*.bzl,*.sky"
-
-_bazel_excluded := ".git/*,*/.git/*,*misc/bazel/3rdparty/*_deps/*"
+# `[no-cd]` keeps a relative argument meaning the caller's directory: the forwarder passes
+# `--justfile`, so without it the default `.` would silently become the whole repository.
 
-_bazel_accounting := ': applied fixes, [0-9]+ warnings left$'
-
-# `codeql query format` and `clang-format` take files rather than directories, so the
-# files are collected by `run_on_files.py`. Arguments are passed positionally so that
-# paths containing spaces survive, of which this repository has many.
-#
-# The files that were rewritten are worth reporting, but `codeql query format` only
-# names those once it also names every file it leaves alone, which buries them under
-# thousands of lines. So it is asked for all of it and the lines about files it did not
-# touch are dropped. Only those are dropped, so errors still come through, as does
-# anything unforeseen.
-#
-# `[no-cd]` is what keeps a relative argument meaning the directory the caller is in.
-# The forwarder reaches a recipe above its argument with `--justfile`, which otherwise
-# runs it from that justfile's own directory: dropping the attribute would silently turn
-# the default `.` into the whole repository, and the only symptom would be slowness.
+_ql_formatter := (if SEMMLE_CODE != "" { '"$SEMMLE_CODE/target/intree/codeql-nolang/codeql"' } else { "codeql" }) + " query format --in-place"
 
 [no-cd]
 [no-exit-message]
 [positional-arguments]
-_format_ql +ARGS: (_maybe_build_dist "nolang")
-    {{ cmd_sep }}{{ py }} "{{ source_dir() }}/run_on_files.py" --drop '^Formatting ' --drop '^No change for ' "*.ql,*.qll" {{ _ql_formatter }} query format --in-place -v -- "$@"{{ cmd_sep }}
+@_format_ql +ARGS: (_maybe_build_dist "nolang")
+    {{ py }} "{{ source_dir() }}/run_on_files.py" --drop '^Formatting ' --drop '^No change for ' "*.ql,*.qll" {{ _ql_formatter }} -v -- "$@"
+
+_py_formatter := if SEMMLE_CODE != "" { "uv run black" } else { "black" }
 
 [no-cd]
 [no-exit-message]
 [positional-arguments]
-_format_py *ARGS=".":
-    {{ cmd_sep }}{{ _py_formatter }} "$@"{{ cmd_sep }}
+@_format_py *ARGS=".":
+    echo "$CMD_BEGIN-> "{{ quote(_py_formatter) }}" $*$CMD_END" >&2
+    {{ _py_formatter }} "$@"
+
+_cpp_formatter := (if SEMMLE_CODE != "" { "uv run clang-format" } else { "clang-format" }) + " -i"
 
 [no-cd]
 [no-exit-message]
 [positional-arguments]
-_format_cpp *ARGS=".":
-    {{ cmd_sep }}{{ py }} "{{ source_dir() }}/run_on_files.py" "*.h,*.cpp" {{ _cpp_formatter }} -i -- "$@"{{ cmd_sep }}
+@_format_cpp *ARGS=".":
+    {{ py }} "{{ source_dir() }}/run_on_files.py" "*.h,*.cpp" {{ _cpp_formatter }} -- "$@"
+
+# The `buildifier` target formats a whole workspace and so cannot take a path, so its
+# binary is driven directly. bazel is asked from this repository's root even when it sits
+# inside another, and the files are bounded to it, so each repository formats its own with
+# the version it pins. Building needs the enclosing workspace instead, hence `_bazel`.
+_bazel_workspace := quote(parent_directory(parent_directory(source_dir())))
+
+_bazel_formatter := (if SEMMLE_CODE != "" { '"$SEMMLE_CODE/tools/bazel"' } else { "bazel" }) + " run @buildifier_prebuilt//:buildifier"
+
+# Kept out of the formatter, unlike the other three: bazel's own flags have to sit between
+# the target and `--`, so no single string spans both sides of it.
+_bazel_args := "-mode=fix -lint=fix"
+
+# Keep both in step with the `buildifier` target. The names are what it recognises walking a
+# workspace, a check it skips for paths handed to it, so anything extra here is rewritten
+# regardless. Being wider is deliberate: what it recognises differs between versions, and
+# each repository pins its own, so only a list covering every one of them can be shared. A
+# directory of one file per candidate name, formatted with `-r`, says what a version takes.
+# Exclusions match the path as walked and its absolute form, so one that has to hold
+# however the path was reached is anchored absolutely.
+_bazel_names := "BUILD,WORKSPACE,*.bazel,*.bzl,*.sky,*.star"
+
+_bazel_excluded := ".git/*,*/.git/*,*misc/bazel/3rdparty/*_deps/*"
 
 [no-cd]
 [no-exit-message]
 [positional-arguments]
-_format_bazel *ARGS=".":
-    {{ cmd_sep }}export MSYS2_ARG_CONV_EXCL="*"; {{ py }} "{{ source_dir() }}/run_on_files.py" --absolute --chdir {{ _bazel_workspace }} --within {{ _bazel_workspace }} --drop '{{ _bazel_accounting }}' --exclude '{{ _bazel_excluded }}' "{{ _bazel_names }}" {{ _bazel_formatter }} -mode=fix -lint=fix -v -- "$@"{{ cmd_sep }}
+@_format_bazel *ARGS=".":
+    {{ py }} "{{ source_dir() }}/run_on_files.py" --absolute --chdir {{ _bazel_workspace }} --within {{ _bazel_workspace }} --drop ': applied fixes, 0 warnings left$' --exclude '{{ _bazel_excluded }}' "{{ _bazel_names }}" {{ _bazel_formatter }} --noshow_progress --ui_event_filters=,+error,+fail -- {{ _bazel_args }} -v -- "$@"
@@ -27,5 +27,5 @@ import "format.just"
 [no-exit-message]
 [positional-arguments]
 @_integration_test *ARGS: _require_semmle_code
-    echo "$CMD_BEGIN$SEMMLE_CODE/tools/pytest --codeql=build-as-test $*$CMD_END"
+    echo "$CMD_BEGIN-> $SEMMLE_CODE/tools/pytest --codeql=build-as-test $*$CMD_END" >&2
     "$SEMMLE_CODE/tools/pytest" --codeql=build-as-test "$@"