Skip to content

Fix/install arg normalization - #283

Open
Spelt wants to merge 2 commits into
HashLoad:mainfrom
Spelt:fix/install-arg-normalization
Open

Fix/install arg normalization#283
Spelt wants to merge 2 commits into
HashLoad:mainfrom
Spelt:fix/install-arg-normalization

Conversation

@Spelt

@Spelt Spelt commented Aug 26, 2026

Copy link
Copy Markdown

Problem

Installing a dependency by its full URL like https://github.com/Me/MyProject:13.1.20 does nothing:

> boss install https://devsource.example.com/scm/at/some-lib
🔍 Analyzing dependencies...
📄 No dependencies to install

Nothing is installed and boss.json is not updated.

Cause: EnsureDependency stores the dependency key in boss.json without the protocol prefix (parseURLAndVersion's regex consumes https://), but collectDependenciesToInstall compares the stored keys against ParseDependency(arg), which keeps the prefix. For a protocol-prefixed argument the two never match, so the requested dependency is filtered out and DoInstall returns before saving the package. Projects whose boss.json still contains protocol-prefixed keys written by older Boss versions were masking this; after a boss remove + boss install cycle the new bare key no longer matches.

Fix

Compare through the existing Dependency.Name() normalization (protocol, credentials and .git suffix ignored, case-insensitive), exposed as a new domain.RepositoryName helper:

  • collectDependenciesToInstall and the requestedDeps filter in the install context match by normalized name.
  • Package.AddDependency / Package.UninstallDependency also match existing keys by normalized name, so a protocol-prefixed argument updates or removes a bare key (and vice versa) instead of creating a duplicate entry or silently missing it.

The same mismatch existed for version-suffixed arguments (boss install https://host/owner/repo:1.2.3): the suffix ended up inside the normalized name. Arguments are now normalized through parseURLAndVersion first (requestedDependencyName helper), and UninstallModules strips the version suffix before matching, so :version / @version arguments resolve to the same key as their plain counterparts.

Testing

  • go build ./..., go vet clean; go test ./internal/core/... passes
  • Windows 11: stock 3.0.17 reproduces the issue (install <https-url> → "No dependencies to install", boss.json unchanged); with this patch boss remove <https-url> followed by boss install <https-url> adds the dependency to boss.json and installs the module
  • boss install https://github.com/viniciussanchez/dataset-serialize:2.5.9 stores "github.com/viniciussanchez/dataset-serialize": "2.5.9" and installs the module; boss remove with the same suffixed argument removes the entry

E Spelt and others added 2 commits August 26, 2026 20:14
…y normalized name

"boss install https://host/owner/repo" reported "No dependencies to
install" and saved nothing. EnsureDependency strips the protocol prefix
when it stores the key in boss.json (parseURLAndVersion's regex consumes
it), but collectDependenciesToInstall compared boss.json keys against
ParseDependency(arg), which keeps the prefix. The two never matched for
a protocol-prefixed argument, so the requested dependency was filtered
out and DoInstall returned before saving the package.

Compare through the existing Dependency.Name() normalization instead
(protocol, credentials and .git suffix ignored, case-insensitive), via a
new domain.RepositoryName helper:

- collectDependenciesToInstall and the requestedDeps filter in the
  install context now match by normalized name.
- Package.AddDependency and Package.UninstallDependency match existing
  keys by normalized name too, so a protocol-prefixed argument updates
  or removes the bare key (and vice versa) instead of creating a
  duplicate entry or silently missing it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
"boss install https://host/owner/repo:1.2.3" still reported "No
dependencies to install": the argument was normalized including the
":1.2.3" suffix (Dependency.Name() turns the colon into a path
separator), while the stored key has the version stripped.

Normalize through parseURLAndVersion first — new requestedDependencyName
helper used by collectDependenciesToInstall and the requestedDeps
filter — and strip the version suffix in UninstallModules before
matching, so ":version" and "@Version" arguments resolve to the same
key as their plain counterparts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant