[Packaging/CI] Make shell source fallback builds self-contained

.github/workflows/force-rebuild.yml

@@ -589,12 +589,6 @@ jobs:
             cd host && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm ci --no-audit --no-fund
           '
 
-      - name: Install shell VFS composer dependencies
-        if: ${{ matrix.package == 'shell' }}
-        run: |
-          bash scripts/dev-shell.sh \
-            npm --prefix tools/mkrootfs ci --no-audit --no-fund
-
       - name: Resolve selected library artifacts
         if: needs.preflight.outputs.library_matrix != '[]'
         run: |

.github/workflows/prepare-merge.yml

@@ -1182,18 +1182,6 @@ jobs:
             exit 1
           fi
 
-      - name: Set up Node for the shell VFS composer
-        if: ${{ matrix.package == 'shell' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "24"
-          cache: npm
-          cache-dependency-path: tools/mkrootfs/package-lock.json
-
-      - name: Install shell VFS composer dependencies
-        if: ${{ matrix.package == 'shell' }}
-        run: npm --prefix tools/mkrootfs ci --no-audit --no-fund
-
       - name: Build ${{ matrix.package }} (${{ matrix.arch }})
         id: build
         uses: ./.github/actions/package-archive-build

.github/workflows/staging-build.yml

@@ -596,18 +596,6 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up Node for the shell VFS composer
-        if: ${{ matrix.package == 'shell' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "24"
-          cache: npm
-          cache-dependency-path: tools/mkrootfs/package-lock.json
-
-      - name: Install shell VFS composer dependencies
-        if: ${{ matrix.package == 'shell' }}
-        run: npm --prefix tools/mkrootfs ci --no-audit --no-fund
-
       - name: Build ${{ matrix.package }} (${{ matrix.arch }})
         id: build
         uses: ./.github/actions/package-archive-build

docs/package-management.md

@@ -1567,6 +1567,16 @@ each one before invoking the build script, so a missing or
 too-old tool fails up front with a platform-keyed install hint
 rather than mid-build with a cryptic shell error.
 
+The manifest declares executable prerequisites; the source recipe still owns
+any project-local dependency tree used by those executables. For example, a
+recipe that runs a JavaScript tool from a committed `package-lock.json` must
+install and verify that locked tree in its normal build path, below the
+resolver-owned build output or scratch tree rather than in the shared source
+checkout. Do not provision it only in selected CI callers: archive validation
+can reject a same-run or published artifact and fall through to the source
+recipe from any local, direct-dependency, transitive-dependency, or concurrent
+resolve.
+
 **Inline declaration**
 
 `[[host_tools]]` is an array-of-tables on the consumer manifest

packages/registry/program-packages.json

@@ -151,8 +151,8 @@
     "lamp": {
       "manifestSha256": "40b66d115967f8ea3e1229cccfd1e6636f5363b4fd02ef66850a2dd441ccf13d",
       "cacheKeys": {
-        "wasm32": "c613db2f499d1c74b96dae783d3a82835d50dd377f7f633c7b786d501ea0ffa4",
-        "wasm64": "3c15868f8f21e4b94bac0513e891d5035234405fe386107f6dbef8e73de2589a"
+        "wasm32": "80ed352c435c14648c6bc2c0a4cca45e772c9ab361a5573452baac15001b0ba5",
+        "wasm64": "5b33b3ec8e0fb3f6286e3226ee941198737d245242127a4f92a51c32978039a4"
       }
     },
     "less": {
@@ -305,15 +305,15 @@
     "nginx-php-vfs": {
       "manifestSha256": "97976410cb02f8ba710d856b4ac904bcf976d677b50eefdee39fb64176070d4b",
       "cacheKeys": {
-        "wasm32": "5e7007504c945c77b3c8c2c237a72dfec1d56f366a5d7e983ee73e8548355f63",
-        "wasm64": "5926941134220c301180bb46b65a56459e61e58e0b07c028b23a2af0bab1c651"
+        "wasm32": "2a73a3870ec9ca28d6b952a18522c6715ab06606e8d66ceb692e9476807de907",
+        "wasm64": "660802ab0d74234ed863a16fc8f3e3b836cce4961cc5a10f4795a3813d1c2c80"
       }
     },
     "nginx-vfs": {
       "manifestSha256": "46aa2d3250ac5cd0f102a85c3a36a086c7a50ba1f9e05fa1c2aae3d07ad16f10",
       "cacheKeys": {
-        "wasm32": "1538a04763355d4dd8a573ee318d9ef0c3421b31f44a7acff39884b2cf4ba14a",
-        "wasm64": "383576bc80602179112145bc3f66dc7162e215b1b7a501e494328a8872af5855"
+        "wasm32": "af83f43e0a28aa37b25641d708e39f8bc8c18822f67dcd11116fb6cc77c1a768",
+        "wasm64": "8a4c4fddaf66db02fa11e5c3a0d6d1431ad8c2047bc819d5494060caaab6fd88"
       }
     },
     "node": {
@@ -326,8 +326,8 @@
     "node-vfs": {
       "manifestSha256": "33315fb1b3030a4c187ae075eac08f717de8d7ab017b86c6458778ac9070eece",
       "cacheKeys": {
-        "wasm32": "2cbc8fc1c443a3e0aa1ed1d1638a5c3aca91603b85727c905860dc8e22afb997",
-        "wasm64": "1bfd6a98b32060c347eef77dbaad1ee55831860396bec12e1ccb5cf9b5588625"
+        "wasm32": "f9b061034a2a1405ca6d930366128fc95fe420cdeb24be9bef0defa5afe09ca1",
+        "wasm64": "6deb28b13670c997506a8f530acf62d773d849cb35682b2294aece22de613c5f"
       }
     },
     "openssl": {
@@ -415,10 +415,10 @@
       }
     },
     "shell": {
-      "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
+      "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
       "cacheKeys": {
-        "wasm32": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4",
-        "wasm64": "5a18d3a596bae1adbaba89dcf00e7528b7e2c74f606abe9100369036aff9daab"
+        "wasm32": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229",
+        "wasm64": "96a569b8432365bbefe132c7192b324f648f1cd180c549d8c8d9c6da4b9dda82"
       }
     },
     "spidermonkey": {
@@ -508,8 +508,8 @@
     "wordpress": {
       "manifestSha256": "2c95e72f657a05be445c9b264de769becfb50833d6ef7ee4d18feac690ca2b52",
       "cacheKeys": {
-        "wasm32": "bcd426e3ad7266898c91892ad7adbcad82fcbfbe9d1768862d8abaa58974da56",
-        "wasm64": "ee4954e638302f8fbf4062dfa9908f93e22a0eca68bfe8101f6742e93be92f5c"
+        "wasm32": "d98078b1239f4e6e63377d61a15d846ef082a3f01c262ce0b45dd3cd72fc6c18",
+        "wasm64": "f97ecc1ddeaa55a7fecfb265b36f75c81d7c678411427b2844e3486116961ba6"
       }
     },
     "xz": {
@@ -1058,7 +1058,7 @@
         "wasm32"
       ],
       "cacheKeys": {
-        "wasm32": "c613db2f499d1c74b96dae783d3a82835d50dd377f7f633c7b786d501ea0ffa4"
+        "wasm32": "80ed352c435c14648c6bc2c0a4cca45e772c9ab361a5573452baac15001b0ba5"
       },
       "dependencyClosures": {
         "wasm32": [
@@ -1129,8 +1129,8 @@
           },
           {
             "packageName": "shell",
-            "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
-            "cacheKey": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4"
+            "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
+            "cacheKey": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229"
           },
           {
             "packageName": "sqlite",
@@ -1683,7 +1683,7 @@
         "wasm32"
       ],
       "cacheKeys": {
-        "wasm32": "5e7007504c945c77b3c8c2c237a72dfec1d56f366a5d7e983ee73e8548355f63"
+        "wasm32": "2a73a3870ec9ca28d6b952a18522c6715ab06606e8d66ceb692e9476807de907"
       },
       "dependencyClosures": {
         "wasm32": [
@@ -1744,8 +1744,8 @@
           },
           {
             "packageName": "shell",
-            "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
-            "cacheKey": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4"
+            "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
+            "cacheKey": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229"
           },
           {
             "packageName": "sqlite",
@@ -1775,7 +1775,7 @@
         "wasm32"
       ],
       "cacheKeys": {
-        "wasm32": "1538a04763355d4dd8a573ee318d9ef0c3421b31f44a7acff39884b2cf4ba14a"
+        "wasm32": "af83f43e0a28aa37b25641d708e39f8bc8c18822f67dcd11116fb6cc77c1a768"
       },
       "dependencyClosures": {
         "wasm32": [
@@ -1796,8 +1796,8 @@
           },
           {
             "packageName": "shell",
-            "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
-            "cacheKey": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4"
+            "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
+            "cacheKey": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229"
           }
         ]
       },
@@ -1859,7 +1859,7 @@
         "wasm32"
       ],
       "cacheKeys": {
-        "wasm32": "2cbc8fc1c443a3e0aa1ed1d1638a5c3aca91603b85727c905860dc8e22afb997"
+        "wasm32": "f9b061034a2a1405ca6d930366128fc95fe420cdeb24be9bef0defa5afe09ca1"
       },
       "dependencyClosures": {
         "wasm32": [
@@ -1880,8 +1880,8 @@
           },
           {
             "packageName": "shell",
-            "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
-            "cacheKey": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4"
+            "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
+            "cacheKey": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229"
           },
           {
             "packageName": "spidermonkey",
@@ -2594,12 +2594,12 @@
       ]
     },
     "shell": {
-      "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
+      "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
       "arches": [
         "wasm32"
       ],
       "cacheKeys": {
-        "wasm32": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4"
+        "wasm32": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229"
       },
       "dependencyClosures": {
         "wasm32": []
@@ -2891,7 +2891,7 @@
         "wasm32"
       ],
       "cacheKeys": {
-        "wasm32": "bcd426e3ad7266898c91892ad7adbcad82fcbfbe9d1768862d8abaa58974da56"
+        "wasm32": "d98078b1239f4e6e63377d61a15d846ef082a3f01c262ce0b45dd3cd72fc6c18"
       },
       "dependencyClosures": {
         "wasm32": [
@@ -2952,8 +2952,8 @@
           },
           {
             "packageName": "shell",
-            "manifestSha256": "5d02cd8fee4e0d46c7552a3046c3898f9e3bd5667094e02cab01851eed97a321",
-            "cacheKey": "8f31a8307da11025cf70150730e19af8a5fef7e5bbbd72a94576b4359efb32c4"
+            "manifestSha256": "4f18fd0c3392509329ee71a28b68140fc4876d229a0bd6fa4e0fd8d1f7486215",
+            "cacheKey": "8491816d1052976c83a96560acb9587c3a37c2744ae5b408e3ad8ae963bb3229"
           },
           {
             "packageName": "sqlite",

packages/registry/shell/build-shell.sh

@@ -5,7 +5,6 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
 OUT_DIR="${WASM_POSIX_DEP_OUT_DIR:-}"
 HOMEBREW_TAP_ROOT="${WASM_POSIX_BUILD_GIT_HOMEBREW_TAP_CORE_DIR:-}"
 HOMEBREW_TAP_SHA="${WASM_POSIX_BUILD_GIT_HOMEBREW_TAP_CORE_COMMIT:-}"
@@ -23,17 +22,25 @@ if [ "${WASM_POSIX_DEP_TARGET_ARCH:-}" != "wasm32" ]; then
     exit 2
 fi
 
-# Public bottles and the public tap are package inputs, never credentialed
-# ambient state. Fixed locale/time inputs also make mkrootfs bytes independent
-# of the invoking developer or CI runner.
+# Public npm inputs, bottles, and the public tap are package inputs, never
+# credentialed ambient state. NODE_OPTIONS and NODE_PATH are also excluded:
+# otherwise a developer or runner could inject unreviewed JavaScript into the
+# locked composer even though the npm installation itself is isolated.
 unset GH_TOKEN GITHUB_TOKEN HOMEBREW_GITHUB_API_TOKEN \
-    HOMEBREW_GITHUB_PACKAGES_TOKEN HOMEBREW_DOCKER_REGISTRY_TOKEN
+    HOMEBREW_GITHUB_PACKAGES_TOKEN HOMEBREW_DOCKER_REGISTRY_TOKEN \
+    NPM_TOKEN NODE_AUTH_TOKEN NODE_OPTIONS NODE_PATH \
+    NPM_CONFIG_USERCONFIG NPM_CONFIG_GLOBALCONFIG NPM_CONFIG_REGISTRY \
+    npm_config_userconfig npm_config_globalconfig npm_config_registry
+
+# Fixed locale/time inputs make mkrootfs bytes independent of the invoking
+# developer or CI runner.
 export SOURCE_DATE_EPOCH=0
 export TZ=UTC
 export LC_ALL=C
 export LANG=C
 
 BUILD_DIR="$OUT_DIR/.homebrew-shell-build"
+SOURCE_ROOT="$BUILD_DIR/source"
 WORK_DIR="$BUILD_DIR/work"
 VFS="$BUILD_DIR/shell.vfs.zst"
 REPORT="$BUILD_DIR/main-shell-report.json"
@@ -48,11 +55,18 @@ cleanup() {
 }
 trap cleanup EXIT
 
+# The recipe owns its host-side composer tools just as it owns every other
+# source-build input. This must run inside the recipe—not in selected callers—
+# because the resolver can fall back after any archive fails validation. The
+# preparer copies Git-owned inputs into this resolver-exclusive workspace, so
+# npm and the composer never mutate or execute from the shared checkout.
+bash "$SCRIPT_DIR/prepare-build-tools.sh" "$SOURCE_ROOT"
+
 # The checkout is sealed read-only by the resolver. Disable Git's optional
 # index refresh while the strict composer independently verifies exact HEAD,
 # cleanliness, and the migration-lock commit.
 GIT_OPTIONAL_LOCKS=0 \
-bash "$REPO_ROOT/scripts/build-homebrew-main-shell-closure.sh" \
+bash "$SOURCE_ROOT/scripts/build-homebrew-main-shell-closure.sh" \
     --lazy-shell \
     --tap-root "$HOMEBREW_TAP_ROOT" \
     --expected-tap-sha "$HOMEBREW_TAP_SHA" \

packages/registry/shell/build.toml

@@ -1,6 +1,7 @@
 script_path = "packages/registry/shell/build-shell.sh"
 inputs = [
   "packages/registry/shell/build-shell.sh",
+  "packages/registry/shell/prepare-build-tools.sh",
   "scripts/build-homebrew-main-shell-closure.sh",
   "scripts/verify-homebrew-main-shell-artifact-lock.sh",
   "scripts/check-homebrew-main-shell-brewfile.mjs",

packages/registry/shell/package.toml

@@ -45,6 +45,12 @@ version_constraint = ">=20.0"
 probe = { args = ["--version"], version_regex = "v(\\d+\\.\\d+(?:\\.\\d+)?)" }
 install_hints = { darwin = "run through scripts/dev-shell.sh", linux = "run through scripts/dev-shell.sh" }
 
+[[host_tools]]
+name = "npm"
+version_constraint = ">=10.0"
+probe = { args = ["--version"], version_regex = "(\\d+\\.\\d+(?:\\.\\d+)?)" }
+install_hints = { darwin = "run through scripts/dev-shell.sh", linux = "run through scripts/dev-shell.sh" }
+
 [[host_tools]]
 name = "ruby"
 version_constraint = ">=3.0"
@@ -57,6 +63,12 @@ version_constraint = ">=8.0"
 probe = { args = ["--version"], version_regex = "coreutils\\) (\\d+\\.\\d+(?:\\.\\d+)?)" }
 install_hints = { darwin = "run through scripts/dev-shell.sh", linux = "run through scripts/dev-shell.sh" }
 
+[[host_tools]]
+name = "tar"
+version_constraint = ">=1.30"
+probe = { args = ["--version"], version_regex = "(?:bsdtar|tar).*?(\\d+\\.\\d+(?:\\.\\d+)?)" }
+install_hints = { darwin = "run through scripts/dev-shell.sh", linux = "run through scripts/dev-shell.sh" }
+
 [[host_tools]]
 name = "wc"
 version_constraint = ">=8.0"