Fixes for broken master, trust-based source selection, module split, feed discovery & caching, sectioned config, and release tooling

[line0]

PR description

Summary

This branch started as a set of fixes to unbreak master after the incomplete 0.7.0 refactor, but it has grown to carry the bulk of the 0.7.0 work itself. It is being merged as a single unit. The list below describes the delta against master, grouped by area rather than by commit (history was rebased/reworked as we iterated, so individual commits are not a reliable map of the end state).

At a high level, relative to master this branch:

• Restores a working updater/loader (the original "broken master" fixes).
• Adds a real SemanticVersion type, a computed-property primitive (Accessors), and a feed trust/security model (FeedTrust, Host, SSRF guard, fetch policy).
• Replaces DepCtrl's hard dependencies on BadMutex, DownloadManager and PreciseTimer with internal, OS-API-based implementations, and drops the aegisub.re / aegisub.util dependencies.
• Ports the newer ConfigHandler/ConfigView, FileOps and Logger from the sqlite branch.
• Adds a CLI/CI toolchain (test runner, deploy, bundler) and a JSON-Schema-validated feed format.
• Migrates all annotations to LuaCATS and namespaces the repo module paths.

It also introduces a few one-time, persisted config migrations.

Reviewability note

This is intentionally a large single PR. The genuine "unbreak master" fixes (SemanticVersion presence, script-type handling, the double-init regression, capitalize, late DownloadManager init, the multi-assignment corruption) are the smallest slice; everything else is new 0.7.0 surface. Reviewers short on time should concentrate on the Security and Migrations sections, which change what gets fetched/executed and mutate users' config files.

---

Changelog — 0.7.0

Added

Version handling

• SemanticVersion module: parsing, formatting and comparison utilities (absent on master), plus an instantiable version value object — construct from a string, from numeric components, or fromPacked; instances compare with < / <= / ==, stringify, bump immutably, and test range satisfaction. Static helpers accept an instance anywhere they take a version.
• npm-style version ranges for provides module aliases.

Core primitives

• Accessors: metatable-backed computed properties. Accessors.property{get, set} in the class body plus Accessors.install(class) after it; setter-less properties are read-only, subclasses inherit parent properties, every property is recorded on class.__accessors, and readable properties appear in pairs(instance) via __pairs.

Trust & networking

• FeedTrust class: centralized trust/block logic. Trusted / blocked / extra-feed lists with add + remove; block entries are objects carrying a match mode (prefix or exact) and a block reason; trust/block data can be sourced from the official feed.
• Host class: DNS resolver binding and private/loopback host detection (isPrivate, memoized).
• FeedInventory: breadth-first feed crawler, with every root and child gated through the fetch policy.
• Persistent feed cache and an untrusted-feed fetch policy.
• Trust-ranked package-source selection with provider fallback; interactive trust flows with a persisted per-package source choice.

Self-contained runtime

• Internal NamedSemaphore / FileLock locking primitive that uses only OS APIs, as a replacement for the BadMutex dependency.
• Internal DownloadManager alternative built on OS APIs or an installed libcurl, with stall detection and a concurrent-connection limit.
• Bundled dkjson, provided as json when luajson is not installed; module import aliases.
• Aegisub shim adds the ?user directory to the Lua/Moon search path.

FileOps / Common

• FileOps.writeFile().
• Common helper to detect running headless / in CLI.

Toolbox

• Feed-management macro/UI.

Tooling

• CLI/CI toolchain: test runner that works on automation-script tests and external repos, runs across multiple packages, and supports multi-file suites; a deploy command; a bundler script with CLI zip-archiver bindings.
• JSON Schema for the DepCtrl feed plus a schema validator.

Changed

• Repository module files namespaced under an l0/ directory to match their require paths. (Confirm downstream require paths before tagging.)
• Records back their version with a SemanticVersion instance (@semanticVersion); record.version is now a packed-integer accessor over it, so existing packed-int reads/writes/comparisons are unchanged. The version is persisted to config as a major.minor.patch string.
• Cheap no-arg getters are now read-only computed properties: Downloader:getProgress → progress, Lock:getState → state, UnitTestSuite:getFailures → failures, and Host isPrivate. (getVersionNumber / getVersionString remain instance methods.)
• Updater status codes are now an UpdateStatus enum; scriptType is a ScriptType enum end-to-end.
• Ported the newer ConfigHandler / ConfigView, FileOps and Logger from the sqlite branch.
• DepCtrl uses its own internal BadMutex / DownloadManager / PreciseTimer replacements and no longer requires aegisub.re or aegisub.util.
• No longer shadows packages installed to the Aegisub ?data automation directory.
• Logger: assert passes all varargs through on success (chainable); new assertNotNil (fails only on nil); dump / dumpToString accept a maxDepth; new describeType; log/format calls guard against non-string templates; incremental progress-bar fill; RNG warmed up after seeding.
• UnitTestSuite: manual _order no longer required; tests can be skipped; per-test durations measured with a monotonic wall clock instead of CPU time.
• All annotations converted to LuaCATS / luals format; type annotations added throughout.
• Consistent private-method convention across the codebase.
• LF + final-newline enforced repo-wide for stable feed hash calculation.

Security

• SSRF guard: feed and package downloads to private/loopback hosts are blocked (Host + DNS resolver).
• Untrusted-feed fetch policy honored for both crawl roots and advertised children; a blocked root is never fetched.
• Block-list entries validated at the mutation boundary (unknown match mode coerced to prefix) and deduplicated case-insensitively, matching case-insensitive block matching.
• The official trust/block list is no longer cached when its feed fails to load, so an offline first run can pick it up later instead of being stuck on the fallback.
• FileOps.remove() no longer recurses into directories by default, removing a silent whole-tree deletion path.

Fixed

Updater / loader

• __depCtrlInit hooks were re-run on already-initialized modules, breaking modules that mutate exported state on first init (e.g. BadMutex).
• Legacy boolean true/false script-type arguments were rejected after the ScriptType enum migration.
• DownloadManager was instantiated too late, failing the update process.
• Multi-assignment on a failed update could corrupt record fields.
• Typo broke optional-module presence checks; broken module-loader skip lists.
• performUpdate gated unmanaged-record handling on a nonexistent updateRecordType field, so unmanaged modules never registered a dummy ref/version and the dummy ref was never cleaned up on failure.
• Up-to-date-but-not-updated path passed a namespace string instead of the record to loadModule, crashing on a string index.
• Record.checkVersion ignored its precision argument.
• Broken version-number display in version errors; update errors omitted whether a record was virtual/unmanaged; toolbox error-path typo.

SemanticVersion

• Parsers accepted numeric segments over 255 and non-dot separators.
• toString roundtrip raised on an invalid version string.
• Malformed changelog version keys (from unvalidated feed data) crashed getChangelog after a successful install; such keys are now skipped.

FileOps

• joinPath dropped every segment after an empty/separator-only one (joinPath("a", "", "b") → "a").
• move did not create destination directories recursively and emitted wrong error messages.
• Downloader did not create the target directory tree recursively.
• Inaccurate path-length-limit detection; mkdir reported success on failure; createTempDir / rmdir errors lacked detail.

Config

• ConfigHandler cache was scanned by raw path instead of validated path, building duplicate handlers with divergent in-memory config for the same file.
• ConfigView did not register/unregister itself with its handler on setFile / unsetFile, so whole-file refreshes skipped it and its writes were lost after another view replaced the backing tables.
• Default-wrapping wiped populated sections on load.
• Record type persisted the stale boolean unmanaged flag instead of recordType, round-tripping unmanaged records back to managed.
• writeConfig was not actually called when persisting a new record.
• Spurious deprecation notices on non-deprecated ConfigView methods.

Feed / trust / deployment

• Nil dereference crash in feed template variable expansion.
• Fetched-feed temp files were written outside the trimmed cache dir, so temp downloads accumulated unbounded.
• Deployment ignored the delete flag on files.

Concurrency / logging

• NamedSemaphore called sem_unlink on per-instance GC, letting an ephemeral handle remove a name still held by another owner and producing split-brain locks on POSIX; unlink is now deferred to Lua-state teardown. (Windows unaffected; verified on WSL with a regression test.)
• Logger crashed instead of degrading when the log file could not be opened, and tried to clean logs before the log dir existed.

Common

• Cyclic tables were wrongly reported equal when a sibling key differed; depth accounting was also corrupted.
• itemsEqual tracked items as a boolean set, so duplicates matched incorrectly ({1,1} vs {1,1} → false); now count-matched as a multiset.

Platform / misc

• Broken home-directory expansion on Linux.
• package.path corruption when the existing path did not end in a semicolon.
• capitalize() used unsupported string indexing and had never actually worked; the depctrl CLI used the wrong config filename; assorted wrong file names and log tags.

Removed

• Hard dependencies on aegisub.re, aegisub.util, PreciseTimer, external BadMutex and external DownloadManager (replaced by internal equivalents — see Changed).

Migrations (one-time, persisted on first load)

• Legacy boolean unmanaged flag → recordType; the obsolete flag is dropped from the config file.
• Packed-integer record version → major.minor.patch string.

Both run once and persist. Note the implication for users who roll back to 0.6.x after a migrated load.

Dev / docs

• AGENTS.md contribution conventions (annotation/comment style, file naming, MoonScript gotchas, public-API and test-exposure patterns, computed properties, changelog rules).
• Expanded test coverage: FileOps, validateFullPath / validateNamespace, FileLock / NamedSemaphore, downloader integration, Toolbox plumbing, wider Updater coverage; tests split into per-file suites; record-registry cleanup after runs; mock-server readiness fix.
• README update; cspell settings and dictionaries.

[Copilot]

Pull request overview

This PR aims to restore a working “master” by reintroducing missing version-handling functionality, fixing several regressions in module loading and update/feed handling, and adding initial unit-test and line-ending consistency infrastructure.

Changes:

• Added SemanticVersioning and migrated version parsing/formatting to use it across updater/feed paths.
• Fixed/adjusted updater + module-loader behaviors related to initialization and update flows, and added a minimal DepCtrl unit test.
• Updated the project update feed metadata, bumped versions, and enforced LF + final newline consistency.

Reviewed changes

Copilot reviewed 12 out of 15 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
modules/DependencyControl/Updater.moon	Migrates updater version handling to SemanticVersioning and adjusts update logging/changelog display.
modules/DependencyControl/UpdateFeed.moon	Adds legacy scriptType compatibility + new invalid scriptType messaging; moves DownloadManager init earlier.
modules/DependencyControl/UnitTestSuite.moon	No functional change (newline normalization).
modules/DependencyControl/Tests.moon	Adds a first unit test for Common.terms.capitalize.
modules/DependencyControl/SemanticVersioning.moon	Introduces semantic version parsing/formatting/comparison utilities.
modules/DependencyControl/Record.moon	Switches record version parsing to SemanticVersioning and adds compatibility helpers.
modules/DependencyControl/ModuleLoader.moon	Updates init-hook guard logic and switches version formatting/parsing to SemanticVersioning.
modules/DependencyControl/FileOps.moon	No functional change (newline normalization).
modules/DependencyControl/ConfigHandler.moon	No functional change (newline normalization).
modules/DependencyControl/Common.moon	Fixes capitalize() implementation to avoid unsupported string indexing.
modules/DependencyControl.moon	Bumps DepCtrl version, exposes SemanticVersioning, and adds a Moonscript minimum-version guard.
macros/l0.DependencyControl.Toolbox.moon	Bumps toolbox version; updates version formatting and script-type handling; registers DepCtrl test suite.
DependencyControl.json	Updates feed versions/hashes and adds new files (including tests) to the module feed.
.vscode/settings.json	Enforces final newline on save in VS Code.
.gitattributes	Enforces LF line endings in git.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 15 changed files in this pull request and generated 5 comments.

[github-actions]

Test results — macos-latest ✅1032 · ubuntu-latest ✅1032 · windows-latest ✅1028

Summary

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Other ❓	Flaky 🍂	Duration ⏱️
3096	3092	0	4	0	0	1m 19s

_{🎉 No failed tests in this run.}

Github Test Reporter by CTRF 💚

🔄 This comment has been updated