[tinder-maxwellelliott]

Refs #603

Reproducer and fix for #603: with an extension listed in --labelOnlyModuleExtensions, a single lockfile bump (go.mod via gazelle's go_deps, pnpm-lock.yaml via rules_js's npm) still impacted every target that uses the owning module's rules and every target of every module with a bazel_dep path to the owner.

Fix

In query mode lower_repositories (src/bazel.rs) makes the module that owns an extension depend on every repository the extension generates, because a toolchain resolved from one of them isn't a query input. #559 added a %-view of the owner without a listed extension's repositories, but only targets inside those repositories used it; a root target naming @ext// and //external:dependent still reached the full owner node.

Now, for a listed extension, the owner gets no stand-in edges at all, the same way --isolatedDependencyRoot members (owner_exemptions) already don't. With the owner node itself reduced, the per-extension view nodes and their per-rule repository lookup in hash.rs are redundant, so they're removed (net −43 lines). The hub-to-spoke edges stay.

Contract change: the flag used to assert "the repositories use each other only through labels". It now asserts they are used only through labels, never by resolving a toolchain from one of them. go_deps, npm and crate repositories satisfy that; a toolchain-generating extension like rules_go's go_sdk must not be listed. The README (template + regenerated) and the --help text are updated accordingly.

Hash shift: for users of the flag, the owner's node and everything depending on it hash differently once. No change without the flag, and no change in cquery mode (which never had the stand-in edges).

Reproducer

Extended after the reporter's feedback (comment). Fixture tests/resources/workspaces/extension_owner_dependent_module/:

• ext owns an extension generating a hub @crates and version-named spokes (crates__b__1_0 → crates__b__2_0, like npm__user-agents__2.1.229).
• //:uses_ext uses ext's own rule directly (the npm half).
• //:uses_dependent uses a rule of dependent, which reaches ext through middle (two bazel_dep hops, the Go half).
• //:uses_a / //:uses_b consume the hub.

external::label_only_extension_bump_does_not_reach_users_of_the_owner_or_its_dependents, bumping b:

Configuration	Expected	Before	After
no flags (sanity)	uses_ext, uses_dependent impacted	✅	✅
--labelOnlyModuleExtensions (no fine-graining, reporter's setup)	{uses_a, uses_b}	❌ + uses_dependent, uses_ext	✅
+ --fineGrainedHashExternalRepos=@crates	{uses_b}	❌ + uses_dependent, uses_ext	✅
change to ext/tool.sh, both configs	uses_ext, uses_dependent impacted	✅	✅

The last row keeps the owner's own tree reaching its rule users and dependent modules. The fine-grained run names only the hub, since Bazel rejects a repository that doesn't exist at one of the revisions.

Testing

• //src:rust_tests, //src:cli_tests: pass. The two lower_repositories unit tests are updated: the views test now pins only apparent names, and the owner-edges test checks both the default stand-in edges and the reduced owner for listed extensions.
• Full e2e suite locally (Bazel 9.3.1): 68 of 72 pass, including the reproducer and the existing label-only, toolchain and isolated-root cases. The other 4 (bzlmod_transitive_deps_cquery, two cquery_*_platforms, fine_grained_workspace_external_repo) fail only because this machine has no JDK (rules_java local_jdk / coursier); CI covers them.
• cargo clippy --all-targets -D warnings: clean. regen_check: pass.

🤖 Generated with Claude Code