fix(unplugin): track compiler inputs reached through filesystem links

[samchon]

Problem

The Unplugin project cache can omit a compiler input reached through a symlink or Windows junction inside the project root.

The project-tree walk intentionally skips symbolic links. Following them would permit cycles and traversal outside the project. isProjectWalkPath, however, classifies paths only by lexical root and ignored directory names. A graph-reported file such as <project>/linked/dependency.ts is therefore considered covered by the project walk even though the walk never visits it.

That file enters neither inputHashes nor externalInputHashes. The same predicate is used by Metro's supplementary snapshot, so the input is omitted there as well.

Evidence

The cache assembles its input universe in two parts:

• collectProjectInputHashes hashes regular files returned by listProjectInputFiles.
• collectExternalInputHashes hashes graph and plugin inputs for which isProjectWalkPath is false.

listProjectInputFiles accepts Dirent.isDirectory() and Dirent.isFile() entries. A symlink or junction satisfies neither branch and is skipped.

isProjectWalkPath checks the relative path segments but never calls lstat on those segments.

A Windows junction fixture with this shape reproduces the gap:

project/
  tsconfig.json
  linked/ -> external/
external/
  dependency.ts

The observed classification was:

{
  "hashKeys": ["tsconfig.json"],
  "classifiedInsideWalk": true
}

The compiler graph spelling linked/dependency.ts is therefore suppressed from the external snapshot despite being absent from the project snapshot.

Consequence surface

• Bun, Turbopack, and other long-lived cache owners can replay a transform after a linked dependency changes.
• Metro can reuse a stale worker snapshot because its graph supplement applies the same classification.
• Standard bundler watch registration still receives the graph path, but the shared transform cache can answer before compiling again.
• File symlinks, directory symlinks, and Windows junctions have the same classification problem.
• Broken links and link cycles must fail closed without making project discovery recursive.
• Ordinary in-root files, ignored node_modules inputs, out-of-root files, case-insensitive identity, and generated temporary configs must retain their current behavior.

Approach

Keep the tree walk non-following. Refine isProjectWalkPath so an existing relative path is considered walk-covered only when no component below the project root traverses a symbolic link or junction. A linked graph input then belongs to the external-input owner and receives an exact file hash.

The check must be platform-neutral and tolerate an absent candidate path. It must not resolve or follow the link during the recursive project walk.

Acceptance and verification

• A graph input reached through an in-root file symlink is hashed externally.
• A graph input reached through an in-root directory symlink or Windows junction is hashed externally.
• Changing that target invalidates the project cache.
• Metro's snapshot supplement includes the linked input.
• Ordinary in-root files remain project-walk inputs and are not duplicated externally.
• Ignored directories and genuinely out-of-root graph inputs retain coverage.
• Broken links and cycles do not hang or escape the project root.
• Run:

pnpm --filter @ttsc/unplugin build
pnpm --filter @ttsc/test-unplugin start -- --include=external
pnpm --filter @ttsc/test-metro start
pnpm --filter @ttsc/test-unplugin start

Coordination

Issue #252 changes how often a generation is validated, not which inputs it contains. This issue supplies the missing linked-input invariant and must land before performance evidence is used to claim cache freshness.

[samchon]

Implemented in #980 and published in @ttsc/unplugin@0.21.0 and @ttsc/metro@0.21.0.

The recursive project walk still deliberately does not follow symbolic links or junctions, so it cannot loop through link cycles or unexpectedly traverse outside the project. The classification boundary now separately inspects the relative path components of compiler-reported graph inputs. If any component below the project root is a symbolic link or junction, the path is not treated as covered by that non-following walk; it enters the externally hashed input set instead.

This preserves both required properties:

• project discovery remains non-recursive across links; and
• the actual compiler input reached through the link receives an exact hash and can invalidate a long-lived cache generation.

The external snapshot keeps filesystem identity keys separate from the original compiler-reported path spellings. Identity keys provide stable deduplication and platform-aware comparison, while validation reads the original path instead of substituting a normalized spelling that may not address the same entry on every host.

Coverage includes an in-root file symlink, an in-root directory symlink, a Windows junction, ordinary in-root files, ignored directories, genuinely out-of-root inputs, target mutation invalidation, and Metro's supplementary worker snapshot. Broken or cyclic links do not make the project walk follow them.

The complete Unplugin suite and all 59 Metro features passed before merge. This was intentionally completed before accepting the cache performance result: reducing validation frequency would not have been sound if a linked compiler input could disappear from the freshness universe.

Release: https://github.com/samchon/ttsc/releases/tag/v0.21.0