feat(add): accept multiple packages

Author: HaceraI

src/Context.zig

@@ -28,13 +28,16 @@ root: std.Io.Dir,
 ///
 /// Context does not own the writer or its buffer: the caller constructs both
 /// and is responsible for flushing before exit. Diagnostics don't belong
-/// here — they go to stderr, which this doesn't cover.
+/// here — they go to `err`.
 out: *std.Io.Writer,
 
-const Context = @This();
+/// Buffered stderr, for diagnostics: warnings, per-item failures, anything
+/// that isn't the command's actual output. Kept separate from `out` so that
+/// callers piping stdout — scripts, agents — get clean data on the pipe with
+/// errors still surfacing on the terminal.
+///
+/// Same ownership rule as `out`: the caller constructs both the writer and its
+/// buffer, and is responsible for flushing before exit.
+err: *std.Io.Writer,
 
-/// Builds a `Context` from an already-initialized allocator and I/O backend.
-/// Takes no ownership of either.
-pub fn init(arena: std.mem.Allocator, io: std.Io, root: std.Io.Dir, out: *std.Io.Writer) Context {
-    return .{ .arena = arena, .io = io, .root = root, .out = out };
-}
+const Context = @This();

src/cli.zig

@@ -8,33 +8,35 @@ const checkCommand = @import("./commands/check.zig");
 const versionCommand = @import("./commands/version.zig");
 const version = @import("build_options").version;
 
-pub fn run(ctx: Context, argv: []const [:0]const u8) !void {
+pub fn run(ctx: Context, argv: []const [:0]const u8) !u8 {
     if (argv.len < 2) return printUsage(ctx);
 
     const a = argv[1];
     if (command.isVersionFlag(a)) return printVersion(ctx);
     if (command.isHelpFlag(a)) return printUsage(ctx);
 
     const cmd = std.meta.stringToEnum(command.Command, argv[1]) orelse {
-        try printUsage(ctx);
-        return error.UnknownCommand;
+        try ctx.err.writeAll(command.usage);
+        return 1;
     };
 
-    switch (cmd) {
+    return switch (cmd) {
         .add => try addCommand.run(ctx, argv),
         .list => try listCommand.run(ctx, argv),
         .check => try checkCommand.run(ctx, argv),
         .version => try versionCommand.run(ctx, argv),
         .help => return printUsage(ctx),
-    }
+    };
 }
 
-fn printUsage(ctx: Context) !void {
+fn printUsage(ctx: Context) !u8 {
     try ctx.out.writeAll(command.usage);
+    return 0;
 }
 
-fn printVersion(ctx: Context) !void {
+fn printVersion(ctx: Context) !u8 {
     try ctx.out.writeAll(version ++ "\n");
+    return 0;
 }
 
 test {

src/commands/add.zig

@@ -5,53 +5,117 @@ const manifest = @import("../manifest.zig");
 const git = @import("../git.zig");
 const fetch = @import("../fetch.zig");
 
-/// Adds a dependency to the current project's `build.zig.zon`.
+/// A parsed `<repo>[@<version>]` argument.
+/// All fields are slices into the original argv string — no allocation.
+const Target = struct {
+    /// Exactly as the user typed it, for diagnostics.
+    raw: []const u8,
+    repo: []const u8,
+    version: ?[]const u8,
+
+    const Error = error{ EmptyRepo, EmptyVersion, RangeUnsupported };
+
+    /// Split on the last '@', but only when what follows looks like a tag.
+    /// An ssh-style `git@host:owner/repo` has an '@' too — its tail contains
+    /// '/' or ':', which a tag never does, so it stays part of the repo.
+    ///
+    /// Consequence: tags containing '/' (`release/1.0`) are unsupported.
+    pub fn parse(raw: []const u8) Error!Target {
+        var repo = raw;
+        var version: ?[]const u8 = null;
+
+        if (std.mem.lastIndexOfScalar(u8, raw, '@')) |i| {
+            const tail = raw[i + 1 ..];
+            if (std.mem.indexOfAny(u8, tail, "/:") == null) {
+                if (tail.len == 0) return error.EmptyVersion;
+                if (isRange(tail)) return error.RangeUnsupported;
+                repo = raw[0..i];
+                version = tail;
+            }
+        }
+        if (repo.len == 0) return error.EmptyRepo;
+        return .{ .raw = raw, .repo = repo, .version = version };
+    }
+};
+
+/// Adds one or more dependencies to the current project's `build.zig.zon`.
 ///
 /// Thin wrapper around `zig fetch --save`, which downloads, hashes, and writes
-/// the dependency entry itself. depz builds the `git+https://…` URL — choosing
+/// each dependency entry itself. depz builds the `git+https://…` URL — choosing
 /// the host from `--registry`, the project's `.depz.registry`, or the default —
 /// and lets `zig fetch` resolve and pin the exact commit.
 ///
 /// A trailing `@<tag>` pins a version; without it, the default branch's latest
 /// commit is tracked. Range constraints (`^1.0.0`) need upstream tag
 /// enumeration to pick a match; that's phase two and is rejected here for now.
-pub fn run(ctx: Context, argv: []const []const u8) !void {
+///
+/// Arguments are fully parsed and validated before any fetch runs, so a bad
+/// argument late in the list can't leave a half-written manifest behind.
+/// Fetches then run serially — each `--save` rewrites `build.zig.zon` — and a
+/// failure is reported without stopping the rest. Returns 1 if any failed.
+pub fn run(ctx: Context, argv: []const []const u8) !u8 {
     const parsed = try args.classify(ctx.arena, argv[2..]);
     if (parsed.positionals.len == 0)
         std.process.fatal("`add` needs a package, e.g. `depz add <owner>/<repo>@<version>`", .{});
 
-    const src = try ctx.root.readFileAllocOptions(ctx.io, "build.zig.zon", ctx.arena, .unlimited, .of(u8), 0);
-    const man = try manifest.parse(ctx.arena, src);
-    const target = parsed.positionals[0];
     const alias = parsed.get("as");
-    const registry = parsed.get("registry");
-    const host = git.resolveHost(registry, man.depz.registry);
+    if (alias != null and parsed.positionals.len > 1)
+        std.process.fatal("--as names a single package, but {d} were given", .{parsed.positionals.len});
 
-    // Split repo from optional @version on the LAST '@', so an ssh-style
-    // git@host:owner/repo keeps its leading git@ in the repo part.
-    const at = std.mem.lastIndexOfScalar(u8, target, '@');
-    const repo = if (at) |i| target[0..i] else target;
-    const version: ?[]const u8 = if (at) |i| target[i + 1 ..] else null;
+    const targets = try ctx.arena.alloc(Target, parsed.positionals.len);
+    for (parsed.positionals, 0..) |p, i| {
+        targets[i] = Target.parse(p) catch |err| {
+            switch (err) {
+                error.EmptyRepo => std.process.fatal(
+                    "'{s}': missing package name, expected <owner>/<repo>[@<version>]",
+                    .{p},
+                ),
+                error.EmptyVersion => std.process.fatal(
+                    "'{s}': trailing '@' with no version — drop it to track the default branch, or write @v1.2.3",
+                    .{p},
+                ),
+                error.RangeUnsupported => std.process.fatal(
+                    "{s}: needs a concrete version like @v1.2.3, not a range. Range resolution is coming.",
+                    .{p},
+                ),
+            }
+        };
+        // Only catches literally repeated repos. Two distinct repos can still
+        // resolve to the same package name, but that isn't known until fetch.
+        for (targets[0..i]) |prev| {
+            if (std.mem.eql(u8, prev.repo, targets[i].repo))
+                std.process.fatal("'{s}' listed more than once", .{targets[i].repo});
+        }
+    }
 
-    const url = if (version) |v| blk: {
-        if (isRange(v))
-            std.process.fatal(
-                "`add` needs a concrete version like @v1.2.3 for now, not a range ('{s}'). Range resolution is coming.",
-                .{v},
-            );
-        break :blk try git.buildGitUrl(ctx.arena, host, repo, v);
-    } else try git.buildGitUrl(ctx.arena, host, repo, null);
+    const src = try ctx.root.readFileAllocOptions(ctx.io, "build.zig.zon", ctx.arena, .unlimited, .of(u8), 0);
+    const man = try manifest.parse(ctx.arena, src);
+    const host = git.resolveHost(parsed.get("registry"), man.depz.registry);
 
-    switch (try fetch.fetchSave(ctx, alias, url)) {
-        .ok => {},
-        .name_not_inferable => std.process.fatal(
-            \\'{s}' has no build.zig.zon, so its name can't be inferred.
-            \\Re-run with --as=<name> to pick one:
-            \\  depz add {s} --as=<name>
-            \\
-        , .{ target, target }),
-        .failed => |stderr| std.process.fatal("`zig fetch` failed for {s}:\n{s}", .{ target, stderr }),
+    // No `fatal` past this point: it skips `defer`, so anything still sitting
+    // in the stdout buffer — every "added …" line above — would be lost.
+    var any_failed = false;
+    for (targets) |t| {
+        const url = try git.buildGitUrl(ctx.arena, host, t.repo, t.version);
+        switch (try fetch.fetchSave(ctx, alias, url)) {
+            .ok => try ctx.out.print("added {s}\n", .{t.raw}),
+            .name_not_inferable => {
+                any_failed = true;
+                try ctx.err.print(
+                    \\'{s}' has no build.zig.zon, so its name can't be inferred.
+                    \\Re-run with --as=<name> to pick one:
+                    \\  depz add {s} --as=<name>
+                    \\
+                , .{ t.raw, t.raw });
+            },
+            .failed => |stderr| {
+                any_failed = true;
+                try ctx.err.print("`zig fetch` failed for {s}:\n{s}\n", .{ t.raw, stderr });
+            },
+        }
     }
+
+    return @intFromBool(any_failed);
 }
 
 /// True if `v` is a range constraint rather than a concrete version.
@@ -64,10 +128,31 @@ fn isRange(v: []const u8) bool {
     };
 }
 
-/// Run `zig fetch --save[=<alias>]`; it downloads, hashes, and writes the entry.
-fn fetchSave(ctx: Context, alias: ?[]const u8, url: []const u8) !std.process.RunResult {
-    const save = if (alias) |a| try std.fmt.allocPrint(ctx.arena, "--save={s}", .{a}) else "--save";
-    return std.process.run(ctx.arena, ctx.io, .{
-        .argv = &.{ "zig", "fetch", save, url },
-    });
+test "Target.parse: accepted forms" {
+    const cases = [_]struct {
+        raw: []const u8,
+        repo: []const u8,
+        version: ?[]const u8,
+    }{
+        .{ .raw = "foo/bar", .repo = "foo/bar", .version = null },
+        .{ .raw = "foo/bar@v1.0.0", .repo = "foo/bar", .version = "v1.0.0" },
+        .{ .raw = "git@github.com:foo/bar", .repo = "git@github.com:foo/bar", .version = null },
+        .{ .raw = "git@github.com:foo/bar@v1.0.0", .repo = "git@github.com:foo/bar", .version = "v1.0.0" },
+    };
+    for (cases) |c| {
+        const t = try Target.parse(c.raw);
+        try std.testing.expectEqualStrings(c.raw, t.raw);
+        try std.testing.expectEqualStrings(c.repo, t.repo);
+        if (c.version) |v| {
+            try std.testing.expectEqualStrings(v, t.version.?);
+        } else {
+            try std.testing.expect(t.version == null);
+        }
+    }
+}
+
+test "Target.parse: rejected forms" {
+    try std.testing.expectError(error.EmptyVersion, Target.parse("foo/bar@"));
+    try std.testing.expectError(error.EmptyRepo, Target.parse("@v1.0.0"));
+    try std.testing.expectError(error.RangeUnsupported, Target.parse("foo/bar@^1.0.0"));
 }

src/commands/check.zig

@@ -37,6 +37,8 @@ pub const Row = struct {
     }
 };
 
+const Tally = struct { updates: usize = 0, failures: usize = 0 };
+
 const Report = struct {
     show_all: bool = false,
     applied: bool = false,
@@ -51,7 +53,7 @@ const Report = struct {
 /// Read-only unless `-u` is passed, which re-fetches everything the check
 /// found an update for. Without it, `check` is exactly the dry run of
 /// `check -u`.
-pub fn run(ctx: Context, argv: []const []const u8) !void {
+pub fn run(ctx: Context, argv: []const []const u8) !u8 {
     const parsed = try args.classify(ctx.arena, argv[2..]);
     const show_all = parsed.has("all");
     const apply = parsed.has("u");
@@ -62,7 +64,7 @@ pub fn run(ctx: Context, argv: []const []const u8) !void {
 
     if (man.deps.len == 0) {
         try ctx.out.writeAll("No dependencies.\n");
-        return;
+        return 0;
     }
 
     const plural = if (man.deps.len == 1) "y" else "ies";
@@ -71,11 +73,16 @@ pub fn run(ctx: Context, argv: []const []const u8) !void {
     const rows = try gather(ctx, man.deps, target);
     try report(ctx.out, rows, .{ .show_all = show_all, .applied = apply });
 
-    if (!apply) return;
+    if (!apply) {
+        const t = tally(rows);
+        return @intFromBool(t.updates > 0 or t.failures > 0);
+    }
 
-    const applied = try applyUpdates(ctx, rows);
-    if (applied > 0)
-        try ctx.out.print("\nUpdated {d} dependenc{s}.\n", .{ applied, if (applied == 1) "y" else "ies" });
+    const t = try applyUpdates(ctx, rows);
+    if (t.updates > 0)
+        try ctx.out.print("\nUpdated {d} dependenc{s}.\n", .{ t.updates, if (t.updates == 1) "y" else "ies" });
+
+    return @intFromBool(t.failures > 0);
 }
 
 /// Render the check results as an aligned table, plus a footer for anything
@@ -111,7 +118,7 @@ fn report(w: *std.Io.Writer, rows: []const Row, opts: Report) !void {
     if (hidden > 0) {
         try w.print("{d} up to date. Run with --all to show {s}.\n", .{ hidden, if (hidden == 1) "it" else "them" });
     }
-    if (!opts.applied) {
+    if (tally(rows).updates > 0 and !opts.applied) {
         try w.writeAll("Run with -u to update.\n");
     }
 }
@@ -123,21 +130,24 @@ pub fn gather(ctx: Context, deps: []const manifest.Dependency, target: Target) !
     return rows;
 }
 
-fn applyUpdates(ctx: Context, rows: []const Row) !usize {
-    var applied: usize = 0;
+fn applyUpdates(ctx: Context, rows: []const Row) !Tally {
+    var t: Tally = .{};
     for (rows) |row| {
         const up = switch (row.status) {
             .update => |u| u,
             else => continue,
         };
         const url = try git.fetchUrl(ctx.arena, up.repo, up.committish);
         switch (try fetch.fetchSave(ctx, row.name, url)) {
-            .ok => applied += 1,
-            // `-u` always passes an explicit name, so name_not_inferable can't occur.
-            else => try ctx.out.print("  {s}: update failed\n", .{row.name}),
+            .ok => t.updates += 1,
+            .failed => |stderr| {
+                t.failures += 1;
+                try ctx.err.print("update failed for {s}:\n{s}\n", .{ row.name, stderr });
+            },
+            .name_not_inferable => unreachable,
         }
     }
-    return applied;
+    return t;
 }
 
 fn parseTarget(parsed: args.Parsed) !Target {
@@ -228,6 +238,21 @@ fn writeRow(w: *std.Io.Writer, row: Row, name_w: usize, cur_w: usize) !void {
     try w.writeByte('\n');
 }
 
+/// Actionable outcomes only. A path dep, a no-match, and a failed check are
+/// all "not up to date", but none of them is something `-u` can fix.
+fn tally(rows: []const Row) Tally {
+    var t: Tally = .{};
+    for (rows) |row| {
+        switch (row.status) {
+            .update => t.updates += 1,
+            .failed => t.failures += 1,
+            else => {},
+        }
+    }
+
+    return t;
+}
+
 /// Append `s` left-aligned in a field of `width`, padding with spaces.
 fn padTo(w: *std.Io.Writer, s: []const u8, width: usize) !void {
     try w.writeAll(s);

src/commands/list.zig

@@ -8,7 +8,7 @@ const git = @import("../git.zig");
 ///
 /// Local only — reads the manifest and nothing else. Anything that needs to
 /// talk to an upstream lives in `check`.
-pub fn run(ctx: Context, argv: []const []const u8) !void {
+pub fn run(ctx: Context, argv: []const []const u8) !u8 {
     const parsed = try args.classify(ctx.arena, argv[2..]);
 
     // Migration shim: `--check` moved out into its own command.
@@ -21,7 +21,7 @@ pub fn run(ctx: Context, argv: []const []const u8) !void {
 
     if (man.deps.len == 0) {
         try ctx.out.writeAll("No dependencies.\n");
-        return;
+        return 0;
     }
 
     var name_w: usize = 0;
@@ -35,6 +35,8 @@ pub fn run(ctx: Context, argv: []const []const u8) !void {
         try padTo(ctx.out, dep.name, name_w + 4);
         try ctx.out.print("{s}\n", .{try pinLabel(ctx.arena, dep)});
     }
+
+    return 0;
 }
 
 fn pinLabel(arena: std.mem.Allocator, dep: manifest.Dependency) ![]const u8 {