fix(bundle): read package.json as Node does; remapping errors never quote; green main after #178

[exo-nikita]

Follow-up to #178. It makes two decided changes and fixes a test that fails on main because of how #178 and #197 combine.

A package.json that's there but can't be read is refused, as Node refuses it

host.stat returns null for any failure. That's right for its ~30 callers, which are existence checks during module resolution, forge's lib discovery and the Solidity walk. Node's resolver and Rust's Path::exists also treat any failure as "not there", so stat stays as it is.

Every package.json reader, though, also took a link loop, or a file behind a directory that may not be searched, for no package.json, and walked past it:

• the strict Solidity reader, which bucketed a forge lib's files as the project's own (proj@1.0.0);
• the submodule bucket, whose version silently fell back to the branch;
• the resolver the Vfs host uses, and the Vfs host's findPackageJSON;
• State's walk up to a bucket's name, and its root discovery;
• readModuleManifest.

Node counts only "nothing there" as no package.json, a link to nothing included. Anything else that can't be read it refuses with ERR_INVALID_PACKAGE_CONFIG. Real stat draws the same line.

So when a reader's stat fails, a read now says why:

• statStrict names the file from the project root: lib/dep/package.json: can't be read (ELOOP). It serves configs and the strict package.json read. readRegularFileOrNull uses it too, instead of rethrowing the raw fs error with its absolute path.
• packageJSONStat throws Node's ERR_INVALID_PACKAGE_CONFIG. It serves the resolver, the Vfs host's findPackageJSON and State.

Lenient lookups (Bash, Rust, stasis add, --package-json) still walk past a malformed or unreadable one, as before.

Invalid-remapping errors never quote the remapping

An invalid remapping's error quoted it. The text is normally a remapping the project wrote. But a file named as a mapping by mistake can hold anything: --mapping=token.txt printed token.txt:1: invalid remapping "ghp_…" to stderr, and so into CI logs. A token pasted into FOUNDRY_REMAPPINGS did the same.

Errors now give the location and the expected form:

• remappings.txt:2: invalid remapping, expected [context:]prefix=target
• foundry.toml: `remappings` entry 2: invalid remapping, expected [context:]prefix=target
• `remappings` entry 1 is not a string

This was the last error of stasis's own that quoted file content.

main was red after #178

buildGitHubBundle and suggestedEntries check their options against an empty Vfs before anything is fetched (#197). #178's directoryEntryError then found every extensionless entry missing from that empty tree. So src with pnpm was refused as "no such file or directory" rather than "only JS bundles are built with pnpm", and buildGitHubBundle reads nothing from disk fails on main.

The pre-fetch checks now pass fetched: false, which skips the missing-entry errors. buildVfsBundle still checks entries against the project's own tree.

Checks

• A differential against Node's require.resolve and findPackageJSON agrees on every case: missing, a link to nothing, a directory named package.json, malformed, a self-loop, a loop through directories, and (run unprivileged) a link into an unsearchable directory.
• The three new package.json tests fail on main. The remapping test also checks that a secret named as a mapping isn't echoed.
• node --run test (Node 24): 2191 pass, 0 fail, 3 skipped, all 82 suites. node --run lint: clean.
• Forge oracle: the scenario, profile, legacy-extends and test-case suites all match, as do 400 new fuzzed projects.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C6oBS5QX4oqZcd2d3STiGA

---

Generated by Claude Code