fix(zip)!: make includeSources/excludeSources follow standard allowlist behavior (#2114)

Co-authored-by: Eli <88557639+lishaduck@users.noreply.github.com>
Co-authored-by: ТΞNSΛI <tensai@gmx.net>
Co-authored-by: Aaron <aaronklinker1@gmail.com>
Co-authored-by: Patryk Kuniczak <p.kuniczak@gmail.com>
Co-authored-by: Kai Gritun <kai@kaigritun.com>

Author: 6 people

packages/wxt/e2e/tests/zip.test.ts

@@ -110,7 +110,7 @@ describe('Zipping', () => {
     expect(await project.pathExists(unzipDir, '.hidden-dir/file')).toBe(false);
   });
 
-  it('should not zip files inside hidden directories if only the directory is specified', async () => {
+  it('should zip hidden files and directories when dotSources is enabled', async () => {
     const project = new TestProject({
       name: 'test',
       version: '1.0.0',
@@ -127,17 +127,17 @@ describe('Zipping', () => {
     await project.zip({
       browser: 'firefox',
       zip: {
-        includeSources: ['.hidden-dir'],
+        dotSources: true,
       },
     });
     await extract(sourcesZip, { dir: unzipDir });
-    expect(await project.pathExists(unzipDir, '.hidden-dir/file')).toBe(false);
+    expect(await project.pathExists(unzipDir, '.hidden-dir/file')).toBe(true);
     expect(await project.pathExists(unzipDir, '.hidden-dir/nested/file')).toBe(
-      false,
+      true,
     );
   });
 
-  it('should allow zipping hidden files into sources when explicitly listed', async () => {
+  it('should allow ignoring some hidden files', async () => {
     const project = new TestProject({
       name: 'test',
       version: '1.0.0',
@@ -156,20 +156,57 @@ describe('Zipping', () => {
     await project.zip({
       browser: 'firefox',
       zip: {
-        includeSources: ['.env', '.hidden-dir/file', '.hidden-dir/nested/**'],
+        dotSources: true,
+        excludeSources: ['.hidden-dir/nested'],
       },
     });
     await extract(sourcesZip, { dir: unzipDir });
     expect(await project.pathExists(unzipDir, '.env')).toBe(true);
     expect(await project.pathExists(unzipDir, '.hidden-dir/file')).toBe(true);
     expect(await project.pathExists(unzipDir, '.hidden-dir/nested/file1')).toBe(
-      true,
+      false,
     );
     expect(await project.pathExists(unzipDir, '.hidden-dir/nested/file2')).toBe(
-      true,
+      false,
     );
   });
 
+  it('should not include all files when includeSources is provided', async () => {
+    const project = new TestProject({
+      name: 'test',
+      version: '1.0.0',
+    });
+    project.addFile(
+      'entrypoints/background.ts',
+      'export default defineBackground(() => {});',
+    );
+    project.addFile('utils/example.ts', 'export const x = 1;');
+    project.addFile('secrets/api-key.txt', 'supersecret');
+    project.addFile('cache/data.json', '{}');
+    const unzipDir = project.resolvePath('.output/test-1.0.0-sources');
+    const sourcesZip = project.resolvePath('.output/test-1.0.0-sources.zip');
+
+    await project.zip({
+      browser: 'firefox',
+      zip: {
+        includeSources: ['entrypoints/**', 'utils/**'],
+      },
+    });
+    await extract(sourcesZip, { dir: unzipDir });
+
+    // Included files should be present
+    expect(
+      await project.pathExists(unzipDir, 'entrypoints/background.ts'),
+    ).toBe(true);
+    expect(await project.pathExists(unzipDir, 'utils/example.ts')).toBe(true);
+
+    // Non-included files should NOT be present (allowlist behavior)
+    expect(await project.pathExists(unzipDir, 'secrets/api-key.txt')).toBe(
+      false,
+    );
+    expect(await project.pathExists(unzipDir, 'cache/data.json')).toBe(false);
+  });
+
   it('should exclude skipped entrypoints from respective browser sources zip', async () => {
     const project = new TestProject({
       name: 'test',
@@ -188,8 +225,7 @@ describe('Zipping', () => {
       `export default defineContentScript({
         matches: ['*://*/*'],
         main(ctx) {},
-      });
-`,
+      });`,
     );
     const unzipDir = project.resolvePath('.output/test-1.0.0-sources');
     const sourcesZip = project.resolvePath('.output/test-1.0.0-sources.zip');
@@ -289,7 +325,8 @@ describe('Zipping', () => {
 
     await project.zip({
       zip: {
-        exclude: ['**/*.json', '!manifest.json'],
+        // Exclude all JSON files except for ones named `manifest.json`
+        exclude: ['**/!(manifest).json'],
       },
     });
 

packages/wxt/src/core/resolve-config.ts

@@ -304,7 +304,7 @@ function resolveZipConfig(
     artifactTemplate:
       '{{name}}-{{packageVersion}}-{{browser}}{{modeSuffix}}.zip',
     sourcesRoot: root,
-    includeSources: [],
+    includeSources: mergedConfig.zip?.includeSources ?? ['**/*'],
     compressionLevel: 9,
     ...mergedConfig.zip,
     zipSources:
@@ -314,8 +314,6 @@ function resolveZipConfig(
       '**/node_modules',
       // WXT files
       '**/web-ext.config.ts',
-      // Hidden files
-      '**/.*',
       // Tests
       '**/__tests__/**',
       '**/*.+(test|spec).?(c|m)+(j|t)s?(x)',
@@ -324,6 +322,7 @@ function resolveZipConfig(
       // From user
       ...(mergedConfig.zip?.excludeSources ?? []),
     ],
+    dotSources: mergedConfig.zip?.dotSources ?? false,
     downloadPackages: mergedConfig.zip?.downloadPackages ?? [],
     downloadedPackagesDir,
   };

packages/wxt/src/core/utils/__tests__/picomatch-multiple.test.ts

@@ -285,6 +285,7 @@ export const fakeResolvedConfig = fakeObjectCreator<ResolvedConfig>(() => {
       artifactTemplate: '{{name}}-{{version}}.zip',
       includeSources: [],
       excludeSources: [],
+      dotSources: false,
       exclude: [],
       sourcesRoot: fakeDir(),
       sourcesTemplate: '{{name}}-sources.zip',

packages/wxt/src/core/utils/picomatch-multiple.ts

@@ -11,7 +11,6 @@ import { registerWxt, wxt } from './wxt';
 import JSZip from 'jszip';
 import { glob } from 'tinyglobby';
 import { normalizePath } from './utils';
-import { picomatchMultiple } from './utils/picomatch-multiple';
 
 /**
  * Build and zip the extension for distribution.
@@ -70,7 +69,7 @@ export async function zip(config?: InlineConfig): Promise<string[]> {
       ...skippedEntrypoints.map((entry) =>
         path.relative(wxt.config.zip.sourcesRoot, entry.inputPath),
       ),
-    ].map((paths) => paths.replaceAll('\\', '/'));
+    ].map((paths) => paths.replaceAll('\\', '/')); // TODO: Use normalizePath?
     await wxt.hooks.callHook('zip:sources:start', wxt);
     const { overrides, files: downloadedPackages } =
       await downloadPrivatePackages();
@@ -88,6 +87,7 @@ export async function zip(config?: InlineConfig): Promise<string[]> {
         }
       },
       additionalFiles: downloadedPackages,
+      dot: wxt.config.zip.dotSources,
     });
     zipFiles.push(sourcesZipPath);
     await wxt.hooks.callHook('zip:sources:done', wxt, sourcesZipPath);
@@ -118,22 +118,17 @@ async function zipDir(
     ) => Promise<string | undefined | void> | string | undefined | void;
     additionalWork?: (archive: JSZip) => Promise<void> | void;
     additionalFiles?: string[];
+    dot?: boolean;
   },
 ): Promise<void> {
   const archive = new JSZip();
-  const files = (
-    await glob(['**/*', ...(options?.include || [])], {
-      cwd: directory,
-      // Ignore node_modules, otherwise this glob step takes forever
-      ignore: ['**/node_modules'],
-      onlyFiles: true,
-      expandDirectories: false,
-    })
-  ).filter((relativePath) => {
-    return (
-      picomatchMultiple(relativePath, options?.include) ||
-      !picomatchMultiple(relativePath, options?.exclude)
-    );
+  // includeSources patterns are used directly (defaults to ['**/*'] from config)
+  // excludeSources patterns are passed to glob's ignore option for efficient filtering
+  const files = await glob(options?.include ?? ['**/*'], {
+    cwd: directory,
+    ignore: options?.exclude ?? [],
+    onlyFiles: true,
+    dot: options?.dot,
   });
   const filesToZip = [
     ...files,