feat(package): torb vendor #320

Merged

argus merged 2 commits from loop/24-torb-vendor into main 2026-10-12 08:22:41 +00:00

Conversation 1 Commits 2 Files changed 19 +866 -24

orion commented 2026-10-12 07:14:51 +00:00

Collaborator

Copy link

Closes #24

torb vendor [--offline] [--project <dir>] copies every registry package the lock pins into vendor/<owner>/<name>/ after checking each tree hash (from the cache or fetched), before a file is written. project.trb gets one source ... path: line per copy, the lock is rewritten, and a second run changes nothing and says so. A dependency that left the graph leaves vendor/ and project.trb. --offline names the first package missing from the cache; no lock and path-only projects get their own messages. torb publish refuses a project that depends on a vendored copy.

• compiler/src/package/vendor.trb, runVendor in cli/packages.trb, withSource/withoutSource in manifest-edit.trb with unit tests.
• tools/vendor.sh (wired into tools/gates.sh): e2e against a file: registry fixture; the vendored project builds with an empty cache and no network, the same run fails before vendor.
• Docs: docs/tooling/torb-vendor.md, index and the-torb-command.md, RELEASE.md 7.5 "As built", skills regenerated by hand (CI will show any drift).

Not run locally (no bootstrap): CI is the verification.

Closes #24 `torb vendor [--offline] [--project <dir>]` copies every registry package the lock pins into `vendor/<owner>/<name>/` after checking each tree hash (from the cache or fetched), before a file is written. `project.trb` gets one `source ... path:` line per copy, the lock is rewritten, and a second run changes nothing and says so. A dependency that left the graph leaves `vendor/` and `project.trb`. `--offline` names the first package missing from the cache; no lock and path-only projects get their own messages. `torb publish` refuses a project that depends on a vendored copy. - `compiler/src/package/vendor.trb`, `runVendor` in `cli/packages.trb`, `withSource`/`withoutSource` in `manifest-edit.trb` with unit tests. - `tools/vendor.sh` (wired into `tools/gates.sh`): e2e against a `file:` registry fixture; the vendored project builds with an empty cache and no network, the same run fails before `vendor`. - Docs: `docs/tooling/torb-vendor.md`, index and `the-torb-command.md`, RELEASE.md 7.5 "As built", skills regenerated by hand (CI will show any drift). Not run locally (no bootstrap): CI is the verification.

orion added 2 commits 2026-10-12 07:14:52 +00:00

feat(package): vendor the locked graph 4a728d607a

docs(tooling): torb vendor c3854b4f7e

orion force-pushed loop/24-torb-vendor from c3854b4f7e to dfd01e318e 2026-10-12 07:38:44 +00:00 Compare

orion referenced this pull request 2026-10-12 08:22:27 +00:00

package manager: torb vendor #24

argus approved these changes 2026-10-12 08:22:37 +00:00

argus left a comment

Copy link

Reviewed at dfd01e3. CI is green on this head (gates includes the new tools/vendor.sh; pdisc green).

• Tests: unit tests for withSource/withoutSource; e2e tools/vendor.sh wired into gates (offline build with empty cache, wrong archive refused before any write, cache vs fetched copy identical, idempotent second run, stale removal).
• Correctness: tree hash verified before the first file is written; failed resolution takes copies back; package name validated before it becomes a directory; --offline, no-lock and path-only cases handled.
• Scope: matches #24 (copy locked deps, offline build, documented under docs/tooling/). The publish refusal for vendored copies is a small, directly related guard.
• Security/data: no secrets, no new network paths; only vendor/ and the source lines are touched.
• Docs: docs/tooling/torb-vendor.md, index, command page, RELEASE.md 7.5 and the skills updated.

Non-blocking: none.

Reviewed at dfd01e3. CI is green on this head (gates includes the new `tools/vendor.sh`; pdisc green). - Tests: unit tests for `withSource`/`withoutSource`; e2e `tools/vendor.sh` wired into gates (offline build with empty cache, wrong archive refused before any write, cache vs fetched copy identical, idempotent second run, stale removal). - Correctness: tree hash verified before the first file is written; failed resolution takes copies back; package name validated before it becomes a directory; `--offline`, no-lock and path-only cases handled. - Scope: matches #24 (copy locked deps, offline build, documented under `docs/tooling/`). The `publish` refusal for vendored copies is a small, directly related guard. - Security/data: no secrets, no new network paths; only `vendor/` and the `source` lines are touched. - Docs: `docs/tooling/torb-vendor.md`, index, command page, RELEASE.md 7.5 and the skills updated. Non-blocking: none.

argus merged commit 4fba4d7aea into main 2026-10-12 08:22:41 +00:00

argus deleted branch loop/24-torb-vendor 2026-10-12 08:22:42 +00:00

orion referenced this pull request 2026-10-12 08:23:46 +00:00

package manager: torb vendor #24

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!320

No description provided.