Fix dependency expansion error handling

[programmersd21]

Keep dependency arrays valid on expansion errors, clean up partial dependencies, reject overlong paths, and bound cyclic dependency resolution. Add a cycle regression test. GCC, Clang, macOS, Windows, Rust, and Sourcery checks pass.

[sourcery-ai]

Reviewer's Guide

Dependency expansion now preserves ownership of partially built arrays across errors, cleans up nested allocations, rejects truncated manifest paths, and enforces the recursion limit on all branches; package tests add coverage confirming cyclic path dependencies terminate with a clear failure.

Sequence diagram for dependency expansion error handling

sequenceDiagram
    participant Install as pkg_install_core
    participant Expand as pkg_expand_deps
    participant Load as pkg_load
    participant Collect as pkg_collect_deps
    participant Free as pkg_free_deps

    Install->>Expand: pkg_expand_deps(..., &expand_ok)
    Expand->>Expand: Check depth > 32
    alt Manifest path too long
        Expand-->>Install: Return partially built list, expand_ok = false
    else Manifest load fails
        Expand->>Load: pkg_load(manifest_path)
        Load-->>Expand: Failure
        Expand-->>Install: Return partially built list, expand_ok = false
    else Nested dependency collection fails
        Expand->>Collect: pkg_collect_deps(...)
        Collect-->>Expand: Failure
        Expand->>Free: pkg_free_deps(nested, nested_count)
        Expand-->>Install: Return partially built list, expand_ok = false
    else Expansion succeeds
        Expand-->>Install: Return expanded list, expand_ok = true
    end
    Install->>Install: Set deps = expanded and count = filled
    alt expand_ok is false
        Install->>Free: pkg_free_deps(deps, count)
    end

Loading

Flow diagram for cyclic dependency depth-limit handling

flowchart TD
    A[pkg_expand_deps] --> B{depth > 32?}
    B -- No --> C[Load and collect nested dependencies]
    C --> D{Nested dependency points back into cycle?}
    D -- No --> E[Append dependencies and recurse]
    E --> A
    D -- Yes --> F[Recursion reaches depth limit]
    B -- Yes --> G[Set error: dependency chain is deeper than 32]
    G --> H[Set success = false]
    H --> I[Return partially built list]
    I --> J[pkg_install_core frees dependencies and exits with failure]

Loading

File-Level Changes

Change	Details	Files
Preserve and clean up the dependency list when recursive expansion fails.	Report expansion failures through a success flag while returning the still-owned list. Update filled counts before failure cleanup so partially appended dependencies are freed. Free dependency arrays after initial collection failure and transfer nested dependency ownership safely.	rust/flintlang/c-src/src/pkg.c src/pkg.c
Harden recursive dependency expansion against invalid paths and excessive recursion.	Reject manifest paths truncated by snprintf. Propagate load, collection, allocation, and normalization failures without losing the dependency-list pointer. Apply the depth limit to every recursive expansion, including cyclic path dependencies.	rust/flintlang/c-src/src/pkg.c src/pkg.c
Add regression coverage for cyclic path dependencies.	Create mutually dependent path packages and verify installation fails. Assert the failure reports the bounded depth error.	tests/pkg/base/flint.toml tests/pkg_test.sh

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9ccf9bd-eda1-4a5a-96b0-73378cdb7e34

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. If the expansion state or ownership handling is wrong, dependency installation could fail, retain an incorrect dependency set, or leave bounded package/lockfile changes that are not undone merely by reverting the code. The effects are repairable by cleaning up or rerunning installation, rather than creating an unbounded or irreversible security or data-loss impact.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook