fix(cli): resolve cross-folder relative imports during lockgen on fresh DB

[rubenfiszel]

Summary

On a fresh workspace, lockfile generation for scripts that import other scripts via cross-folder relative imports (or barrel re-exporters) fails with Failed to find relative import / Non-zero exit status for bun build: 1. The dep job's bun build hits the server before any helper has been deployed, so raw_unpinned 404s for every relative-import target. Three independent bugs combined to make this irrecoverable on every flag combination users tried (--auto-metadata, wmill generate-metadata && wmill sync push, wmill script generate-metadata && wmill sync push).

Changes

• cli/src/commands/sync/sync.ts — wmill sync push --auto-metadata now mirrors the canonical generate-metadata flow: dry-run pass to populate a DoubleLinkedDependencyTree, tree.propagateStaleness(), uploadScripts(tree, workspace) to populate raw_script_temp, then a real pass with tree threaded through so each lockgen request includes temp_script_refs. The non---auto-metadata path is unchanged.
• cli/src/commands/script/script.ts — The deprecated wmill script generate-metadata alias used its own old in-line implementation that bypassed the dependency tree entirely. It now delegates to the canonical generateMetadata, forwarding the optional script path as a folder filter and pinning skipFlows: true, skipApps: true to preserve the alias's "scripts only" semantics.
• cli/src/commands/generate-metadata/generate-metadata.ts — Exported generateMetadata so the deprecated alias can delegate to it.
• backend/parsers/windmill-parser-ts/src/lib.rs — visit_export_all and visit_named_export had inverted skip_type_only guards (if !self.skip_type_only || node.type_only { return; }), so re-exports (export * from, export { x } from) were silently dropped under the skip_type_only=false path used by parse_relative_imports. The CLI's dependency tree therefore treated barrel files as leaves, and their sibling helpers were missing from temp_script_refs. Fixed to match visit_import_decl's correct pattern; skip_type_only=true behavior is preserved exactly (existing test_imports_basic still passes).
• backend/parsers/windmill-parser-ts/tests/tests.rs — Rust unit test (test_relative_imports_includes_re_exports) covering export *, export { x } from, export * as, export type { x } from.
• cli/test/sync_push_auto_metadata_repro.test.ts — 4 E2E tests reproducing each customer-hit failure mode against a fresh test backend.

Release note

The parser fix only takes effect once the windmill-parser-wasm-ts npm package is rebuilt and published from backend/parsers/windmill-parser-wasm/pkg-ts/ and the CLI's cli/package.json pin (currently "windmill-parser-wasm-ts": "1.693.1") is bumped to the new version. Build: nu build.nu ts from backend/parsers/windmill-parser-wasm/. Publish: ./publish-pkgs.sh from the same directory. The sync.ts / script.ts changes are pure TypeScript and ship with the next CLI release on their own.

Test plan

• Verified each E2E test fails on the unfixed code and passes on the fixed code (4/4)
• cargo test in windmill-parser-ts: 32 pass, 0 fail (was 31, +1 new)
• bun test test/sync_pull_push.test.ts test/sync_push_auto_metadata_repro.test.ts test/generate_metadata_unit.test.ts: 115 pass, 3 skip, 0 fail
• On a fresh local Postgres volume: wmill sync push --yes --auto-metadata against a workspace with ../sibling.ts imports and a barrel export * from "./helper.ts" file, then confirm *.script.lock files are non-empty and the deployed scripts have no lock_error_logs
• On the same fresh DB: wmill script generate-metadata --yes (deprecated alias) succeeds and still respects an explicit script-path argument
• On the same fresh DB: wmill generate-metadata --yes succeeds against scripts that use barrel re-exporters

---

Summary by cubic

Fixes lockfile generation on fresh workspaces for scripts using cross-folder relative imports and barrel re-exports. wmill sync push --auto-metadata now resolves these imports reliably and avoids “Failed to find relative import” errors.

• Bug Fixes

  • sync.ts: --auto-metadata runs a two-pass flow (build DoubleLinkedDependencyTree → propagateStaleness() → uploadScripts → real pass with the tree) across scripts, flows, and apps so lockgen includes temp_script_refs. Non-auto path is unchanged.
  • script.ts: restored the deprecated wmill script generate-metadata alias’s legacy stale-check/output, but added a prepass using DoubleLinkedDependencyTree + uploadScripts before the real generation pass (with the tree) to fix cross-folder imports; keeps “scripts only” behavior.
  • TS parser: fixed inverted skip_type_only guards in re-export visitors so parse_relative_imports includes export * / export { x } from …. Added a Rust unit test.
  • Tests: added 4 E2E tests covering fresh-DB cross-folder imports and barrel re-exports.

• Dependencies

  • Bumped windmill-parser-wasm-ts to 1.695.0 in the CLI and frontend to pick up the re-export parsing fix.

^{Written for commit af817b4. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying windmill with    Cloudflare Pages

Latest commit:	af817b4
Status:	✅  Deploy successful!
Preview URL:	https://00643e6f.windmill.pages.dev
Branch Preview URL:	https://fix-sync-push-auto-metadata.windmill.pages.dev

View logs

[claude]

Claude finished @rubenfiszel's task in 6m 2s —— View job

---

Claude PR Review

Verdict: Good to merge.

The fix is well-targeted and the three independent bugs are each addressed at the right layer with matching test coverage. Below is a layer-by-layer assessment.

---

Parser fix (backend/parsers/windmill-parser-ts/src/lib.rs)

The inverted-guard analysis in the PR description is correct. The original guards in visit_export_all / visit_named_export:

if !self.skip_type_only || node.type_only { return; }

returned unconditionally whenever skip_type_only=false (the path used by parse_relative_imports), so every export * from, export { x } from, export * as was silently dropped. The new code mirrors visit_import_decl's pattern (lib.rs:79-121) and correctly preserves both the skip_type_only=true semantics (still used by windmill-dep-map/src/lib.rs:48) and the skip_type_only=false semantics (used by parse_ts_imports in WASM and parse_relative_imports). Verified each combination by hand:

caller	skip_type_only	old behavior	new behavior
parse_relative_imports (CLI tree)	false	dropped re-exports ❌	captures all re-exports ✅
parse_ts_imports (frontend Editor)	false	dropped re-exports ❌	captures all re-exports ✅
parse_ts_relative_imports (backend dep-map)	true	excluded type-only re-exports ✅	unchanged ✅

The unit test (tests.rs:940-961) covers all four re-export forms (export *, export { x } from, export * as, export type { x } from) and would fail on the old code (returns empty list) and passes on the new — solid regression guard.

Sync auto-metadata two-pass flow (cli/src/commands/sync/sync.ts)

The refactor correctly mirrors the canonical generateMetadata flow in cli/src/commands/generate-metadata/generate-metadata.ts:266-374:

1. Pass 1 (always dryRun=true): populates DoubleLinkedDependencyTree via generateScriptMetadataInternal's tree branch (metadata.ts:294-300). Returns early so no metadata is written.
2. tree.propagateStaleness() + uploadScripts(tree, workspace) — same call sequence as the canonical generator.
3. Pass 2 (only autoRegenerate, dryRun=false): re-runs each tracker.{scripts,flows,apps,rawApps} change so tree.getTempScriptRefs(remotePath) is consulted at lockgen time (metadata.ts:350).

The non---auto-metadata path is preserved exactly: pass 1 with tree=undefined falls through to the legacy checkifMetadataUptodate short-circuit (metadata.ts:302-326), pass 2 is skipped, and the staleScripts/staleFlows/staleApps warnings still print in the original order. Try/catch around uploadScripts plus the warn-and-continue fallback for older backends is appropriate — degraded behavior matches what users on older backends already see.

One small observation (not a blocker): pass 2 doesn't filter tracker.scripts by tree.getStaleReason(p) the way the canonical generator does (generate-metadata.ts:392-401). Sync push regenerates locks for every item in tracker, which mirrors the previous --auto-metadata behavior, so this is consistent rather than a regression — flagging only because the divergence is subtle.

Deprecated wmill script generate-metadata delegation (cli/src/commands/script/script.ts)

The delegation to the canonical implementation is correct: skipFlows: true, skipApps: true preserves the alias's "scripts only" contract, and the scriptPath argument is forwarded as the folder filter. Verified that the canonical's filter logic (generate-metadata.ts:404-460) handles both extension and extensionless forms via the folderNoExt strip + touchesFolder transitive check, so wmill script generate-metadata f/foo/bar and ... f/foo/bar.ts both work. The dynamic import is fine here since this command is invoked rarely.

The as any cast on opts is acceptable — the only field shape difference is the absence of skipScripts/skipFlows/skipApps on the script generate-metadata opts, and we explicitly set those.

Test coverage assessment

• Backend (Rust): ✅ The new test_relative_imports_includes_re_exports covers each re-export form. The PR description confirms cargo test in windmill-parser-ts is 32 pass / 0 fail.
• CLI (TS): ✅ Four E2E tests in sync_push_auto_metadata_repro.test.ts cover (a) sync push --auto-metadata cross-folder, (b) canonical generate-metadata with deep cross-folder, (c) barrel re-exporter scenario, (d) deprecated alias. Tests use withTestBackend against a fresh backend, which is exactly the failure surface customers hit.
• Frontend: No frontend code changed (only a parser package version bump). parse_ts_imports already feeds parseTypescriptDeps (frontend/src/lib/relative_imports.ts:4), which is consumed by Editor.svelte and Dev.svelte; the parser change makes barrel re-exports show up there too. No frontend test layer expected to cover this.
• Manual verification: a single fresh-DB run exercising both sync push --auto-metadata --yes and generate-metadata --yes against a workspace with both cross-folder relative imports and a barrel export * from "./helper.ts" — confirm *.script.lock files are non-empty and that the deployed scripts' lock_error_logs are clean. The PR description already lists this in the test plan.

No blocking issues. AGENTS.md compliance is fine — no new pub fn to audit, the parser change is internal logic in an existing function with an existing doc comment, and the CLI changes stay within established patterns.
· Branch

[cubic-dev-ai]

No issues found across 10 files

[github-actions]

Codex Review

Good to merge

No issues found. Checked the diff for bugs, security problems, new public-surface risks, and AGENTS.md compliance.

Test coverage

Backend parser changes add a Rust unit test for relative re-export parsing. CLI behavior is covered by the new E2E repro tests for sync push --auto-metadata, canonical generate-metadata, barrel re-exports, and the deprecated script generate-metadata alias. Frontend changes are dependency pin updates only, so no frontend test is expected.

Manual verification before merge should cover running the CLI against a fresh workspace with cross-folder relative imports and barrel re-exports, confirming lockfiles are generated and the pushed scripts have no lock generation errors.

[github-actions]

Pi Review

Good to merge

---

Summary

This PR fixes lockfile generation on fresh workspaces for scripts that use cross-folder relative imports or barrel re-exports. Three independent bugs are addressed:

1. sync push --auto-metadata now uses a two-pass DoubleLinkedDependencyTree + uploadScripts flow, mirroring the canonical generateMetadata pattern, so the dep job resolves relative imports via temp_script_refs instead of 404-ing against the not-yet-populated server.

2. wmill script generate-metadata (deprecated alias) now delegates to the canonical generateMetadata implementation with skipFlows: true, skipApps: true, replacing its old standalone implementation that bypassed the dependency tree entirely.

3. TS parser (windmill-parser-ts/src/lib.rs): visit_export_all and visit_named_export had inverted skip_type_only guards (if !self.skip_type_only || node.type_only { return; }), causing re-exports (export * from, export { x } from) to be silently dropped under the skip_type_only=false path used by parse_relative_imports. Fixed to match visit_import_decl's correct pattern: if self.skip_type_only && node.type_only { return; }. The skip_type_only=true path is preserved exactly (existing test_imports_basic still passes).

---

Changes reviewed

File	Change
cli/src/commands/sync/sync.ts	Two-pass tree-based lockgen for --auto-metadata; non-auto path unchanged
cli/src/commands/script/script.ts	Deprecated generateMetadata delegates to canonical implementation
cli/src/commands/generate-metadata/generate-metadata.ts	generateMetadata made export instead of private
backend/parsers/windmill-parser-ts/src/lib.rs	Fixed inverted skip_type_only guards in re-export visitors
backend/parsers/windmill-parser-ts/tests/tests.rs	New unit test: test_relative_imports_includes_re_exports
cli/test/sync_push_auto_metadata_repro.test.ts	4 E2E tests covering fresh-DB cross-folder imports and barrel re-exports
cli/package.json, cli/bun.lock	Bumped windmill-parser-wasm-ts to 1.695.0
frontend/package.json, frontend/package-lock.json	Bumped windmill-parser-wasm-ts to 1.695.0

---

Findings

No issues found. The changes follow established patterns (generate-metadata.ts's DoubleLinkedDependencyTree + propagateStaleness() + uploadScripts pipeline), reuse existing infrastructure without reinvention, and are scoped tightly to the three bugs being fixed. The parser fix correctly matches the visit_import_decl guard pattern, and the non-auto-metadata sync path is structurally equivalent to the pre-change code.

---

Test coverage

Backend (Rust parser): One new unit test (test_relative_imports_includes_re_exports) covers export *, export { x } from, export * as, and export type { x } from re-export forms. Existing 31 parser tests continue to pass. Coverage is adequate.

CLI (TypeScript E2E): Four new E2E tests cover the three customer-hit failure modes against a fresh test backend: sync push --auto-metadata with cross-folder relative imports, generate-metadata with deep cross-folder imports, generate-metadata with barrel re-exporters, and the deprecated wmill script generate-metadata alias. Existing sync_pull_push.test.ts and generate_metadata_unit.test.ts tests continue to pass (115 pass, 3 skip). Coverage is adequate.

Frontend: Only a package.json / package-lock.json version bump. No component or logic changes — no tests expected.

Manual verification needed before merge:

• On a fresh local Postgres volume, run wmill sync push --yes --auto-metadata against a workspace containing ../sibling.ts imports and a barrel export * from "./helper.ts" file. Confirm *.script.lock files are non-empty and the deployed scripts have no lock_error_logs.
• On the same fresh DB, run wmill script generate-metadata --yes (deprecated alias) and confirm it succeeds and still respects an explicit script-path argument.
• On the same fresh DB, run wmill generate-metadata --yes against scripts that use barrel re-exporters and confirm no "Failed to find relative import" errors.

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cli/src/commands/script/script.ts">

<violation number="1">
P2: The scriptPath branch still bypasses the temp_script_refs upload flow, so generating metadata for a single script can 404 on fresh workspaces when it imports undeployed siblings via relative paths. Consider reusing the two-pass tree/upload flow (or delegating to the canonical generateMetadata) even when scriptPath is provided.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P2: The scriptPath branch still bypasses the temp_script_refs upload flow, so generating metadata for a single script can 404 on fresh workspaces when it imports undeployed siblings via relative paths. Consider reusing the two-pass tree/upload flow (or delegating to the canonical generateMetadata) even when scriptPath is provided.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cli/src/commands/script/script.ts, line 1318:

<comment>The scriptPath branch still bypasses the temp_script_refs upload flow, so generating metadata for a single script can 404 on fresh workspaces when it imports undeployed siblings via relative paths. Consider reusing the two-pass tree/upload flow (or delegating to the canonical generateMetadata) even when scriptPath is provided.</comment>

<file context>
@@ -1307,20 +1307,129 @@ export async function generateMetadata(
+  const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
+  if (scriptPath) {
+    // read script metadata file
+    await generateScriptMetadataInternal(
+      scriptPath,
+      workspace,
</file context>

[github-actions]

Codex Review

Should address issues before merging: script generate-metadata <script> bypasses temp refs

Findings

• P1 cli/src/commands/script/script.ts:1318 — The deprecated wmill script generate-metadata [script:file] path still bypasses the new DoubleLinkedDependencyTree / uploadScripts flow. When scriptPath is provided, this branch calls generateScriptMetadataInternal(..., tree = undefined), so fetchScriptLock sends temp_script_refs: null. A fresh workspace with f/aaa/consumer.ts importing ../bbb/helper.ts will still hit the same “Failed to find relative import” lockgen failure because the helper has not been deployed or uploaded to raw_script_temp. The new E2E only covers wmill script generate-metadata --yes without the optional script argument, so this regression is not covered.

Test coverage

Backend parser coverage looks adequate: the new Rust unit test covers relative re-exports. CLI coverage covers sync push --auto-metadata, canonical generate-metadata, barrel re-exporters, and the no-argument deprecated alias path.

The missing manual/test scenario is the optional deprecated alias argument: on a fresh workspace, run wmill script generate-metadata --yes f/aaa/consumer.ts where consumer.ts imports a not-yet-deployed sibling/helper via a relative path. Correct behavior is exit code 0 and a non-empty consumer.script.lock without relative-import lockgen errors.

[github-actions]

Pi Review

Good to merge

---

Summary

This PR fixes lockfile generation on fresh workspaces for scripts with cross-folder relative imports and barrel re-exports. Three bugs combine to cause the 404 → Failed to find relative import failure, and all three are addressed:

1. Parser (lib.rs): visit_export_all and visit_named_export had inverted skip_type_only guards that silently dropped export * from, export { x } from, and export * as when skip_type_only=false (the path used by parse_relative_imports, which feeds the CLI dependency tree). Fixed to match visit_import_decl's correct pattern.
2. sync push --auto-metadata (sync.ts): Now uses a two-pass DoubleLinkedDependencyTree + uploadScripts flow, mirroring the canonical generateMetadata pipeline. Pass 1 populates the tree, propagateStaleness() + uploadScripts() populate raw_script_temp, then pass 2 generates real locks with tree threaded through so temp_script_refs are sent to the dep job.
3. wmill script generate-metadata (script.ts): The deprecated alias's inline implementation now builds and threads a DoubleLinkedDependencyTree + uploadScripts before the real pass, matching the fix applied to sync push.

---

Findings

P2 — doc/code mismatch in PR description (cli/src/commands/script/script.ts, cli/src/commands/generate-metadata/generate-metadata.ts)

The PR body states:

script.ts now delegates to the canonical generateMetadata, forwarding the optional script path as a folder filter and pinning skipFlows: true, skipApps: true

The actual implementation does not delegate. The export async function generateMetadata in script.ts (lines 1289–1428) remains the standalone action handler it always was, with inline DoubleLinkedDependencyTree + uploadScripts logic added directly to its body. The export added to generateMetadata in generate-metadata.ts (line 266) is unused by any file in this PR — no import of it was added to script.ts, sync.ts, or any other changed file.

The inline fix is functionally correct and produces the same outcome. The PR description just describes an implementation approach that wasn't taken. Not a blocker, but worth aligning the description with the code before merging so future readers aren't confused about the relationship between the two generateMetadata functions.

---

Changes reviewed

File	Change
backend/parsers/windmill-parser-ts/src/lib.rs	Fix inverted skip_type_only guards in visit_export_all / visit_named_export
backend/parsers/windmill-parser-ts/tests/tests.rs	New unit test covering all four re-export forms
cli/src/commands/sync/sync.ts	Two-pass tree-based lockgen for --auto-metadata; non-auto path unchanged
cli/src/commands/script/script.ts	Inline tree+uploadScripts logic for deprecated alias
cli/src/commands/generate-metadata/generate-metadata.ts	generateMetadata made export (unused by this PR)
cli/test/sync_push_auto_metadata_repro.test.ts	4 E2E tests covering fresh-DB failure modes
cli/package.json, cli/bun.lock	Bumped windmill-parser-wasm-ts to 1.695.0
frontend/package.json, frontend/package-lock.json	Bumped windmill-parser-wasm-ts to 1.695.0

---

Test coverage

Backend (Rust parser): One new unit test (test_relative_imports_includes_re_exports) covers export *, export { x } from, export * as, and export type { x } from. Existing 31 tests pass. Adequate.

CLI (TypeScript E2E): Four new E2E tests covering each customer-hit failure mode against a fresh test backend: sync push --auto-metadata with cross-folder imports (alphabetical ordering edge case), generate-metadata with deep cross-folder imports, generate-metadata with barrel re-exporters, and the deprecated wmill script generate-metadata alias. Existing sync/metadata tests continue to pass (115 pass, 3 skip). Adequate.

Frontend: Only a package.json / package-lock.json version bump — no component or logic changes, no tests expected.

Manual verification needed before merge:

On a fresh local Postgres volume, run wmill sync push --yes --auto-metadata against a workspace containing scripts with ../sibling.ts imports and a barrel export * from "./helper.ts" file; confirm *.script.lock files are non-empty and the deployed scripts have no lock_error_logs. On the same fresh DB, run wmill script generate-metadata --yes (deprecated alias) with and without an explicit script-path argument and confirm it completes without Failed to find relative import errors.