fix(zip)!: make includeSources/excludeSources follow standard allowlist behavior

[kaigritun]

When includeSources patterns are provided, only files matching those patterns should be included in the sources ZIP. Previously, includeSources patterns were added to the default **/* glob, which could leak sensitive files that weren't explicitly excluded.

Changes per maintainer review (replaces #2111):

• Move default ['**/*'] into resolveZipConfig
• Pass excludeSources directly to glob's ignore option
• Remove hardcoded node_modules glob (already in excludeSources default)
• Simplify zipDir logic
• Adds a dotSources option to allow configuring tinyglobby's dot option, allowing for zipping hidden files

BREAKING CHANGE: Sources zip generation behavior has changed.

Fixes #2059
Supersedes #2111

[aklinker1]

While reviewing, I remembered some past issues related to zipping sources that we need to support:

• #738
• #902
• #373
• #604

TLDR: We need to support including hidden files and files in hidden directories. I think this requirement was why the logic was so complex.

Right now, I don't think this PR supports adding hidden files at all.

I ran some tests to refresh my knowledge of fast-glob, verifying the three cases we care about (regular files, hidden files, regular files in hidden directories):

Details

import { glob, Options } from "fast-glob";
import fs from "node:fs/promises";
import { inspect } from "node:util";

const test = async (sources: string[], options: Options) => {
  const res = await glob(sources, options);
  console.log(
    `
───

glob(
  ${inspect(sources, { colors: true })},
  ${inspect(options, { colors: true })}
)
= ${inspect(res, { colors: true })}`,
  );
};

const allFiles = await fs.readdir(".", {
  recursive: true,
});
console.log("All files (minus node_modules):");
console.log(
  allFiles.filter((file: string) => !file.startsWith("node_modules")),
);

await test(["**/*"], { ignore: ["**/node_modules/**"] });
await test(["**/.*"], { ignore: ["**/node_modules/**"] });
await test(["**/.*/**/*"], { ignore: ["**/node_modules/**"] });

and the output:

All files (minus node_modules):
[ ".wxt", "bun.lock", "package.json", ".env", "index.ts", ".wxt/test.txt" ]

───

glob(
  [ '**/*' ],
  { ignore: [ '**/node_modules/**' ] }
)
= [ 'bun.lock', 'package.json', 'index.ts' ]

───

glob(
  [ '**/.*' ],
  { ignore: [ '**/node_modules/**' ] }
)
= [ '.env' ]

───

glob(
  [ '**/.*/**/*' ],
  { ignore: [ '**/node_modules/**' ] }
)
= []

But it seems like fast-glob doesn't support including files from inside hidden directories (I did try the dot: true option as well, but it didn't make a difference)...

So I tried glob instead:

Details

import { glob, GlobOptions } from "glob";
import fs from "node:fs/promises";
import { inspect } from "node:util";

const test = async (sources: string[], options: GlobOptions) => {
  const res = await glob(sources, options);
  console.log(
    `
───

glob(
  ${inspect(sources, { colors: true })},
  ${inspect(options, { colors: true })}
)
= ${inspect(res, { colors: true })}`,
  );
};

const allFiles = await fs.readdir(".", {
  recursive: true,
});
console.log("All files (minus node_modules):");
console.log(
  allFiles.filter((file: string) => !file.startsWith("node_modules")),
);

await test(["**/*"], { ignore: ["**/node_modules/**"] });
await test(["**/.*"], { ignore: ["**/node_modules/**"] });
await test(["**/.*/**/*"], { ignore: ["**/node_modules/**"] });
await test(["**/.*/**/*"], { ignore: ["**/node_modules/**"], nodir: true });

All files (minus node_modules):
[ ".wxt", "bun.lock", "package.json", ".env", "index.ts", ".wxt/test.txt" ]

───

glob(
  [ '**/*' ],
  { ignore: [ '**/node_modules/**' ] }
)
= [ 'index.ts', 'package.json', 'bun.lock' ]

───

glob(
  [ '**/.*' ],
  { ignore: [ '**/node_modules/**' ] }
)
= [ '.env', '.wxt' ]

───

glob(
  [ '**/.*/**/*' ],
  { ignore: [ '**/node_modules/**' ] }
)
= [ '.wxt/test.txt' ]

───

glob(
  [ '**/.*/**/*' ],
  { ignore: [ '**/node_modules/**' ], nodir: true }
)
= []

It works, but I can't get it to return just files. It does support returning with file-types, so we could filter out directories that way.

Unforunate since glob is 10x as large...

• https://pkg-size.dev/fast-glob - 515KB / 18 packages
• https://pkg-size.dev/glob - 5MB / 9 packages

Maybe there's another glob library that's lighter-weight and would allow devs to include hidden files and files in hidden directories?

Otherwise I think we have to switch from fast-glob to glob.

[aklinker1]

We can delete this file and it's test completely, this was the only place they were used.

[aklinker1]

Can you also update the docs, adding a section about this change to the docs here:

wxt/docs/guide/resources/upgrading.md

Line 66 in 19c1d0a

Maybe wait to do that until all the changes are finalized through.

[MichaelDeBoey]

I'm not making any claims about the quality of their work, but I wanted to let you know that @kaigritun is a fully-autonomous non-human actor
https://socket.dev/blog/ai-agent-lands-prs-in-major-oss-projects-targets-maintainers-via-cold-outreach

[PatrykKuniczak]

@kaigritun Are you want to go on?

[PatrykKuniczak]

@kaigritun One more poke :)

[aklinker1]

I had to make some changes around how hidden files are included, but I'm happy with the result. I imagine for wxt 1.0, we may need to provide the full options for tinyglobby, not just include, exclude, and dot. But this is good enough to get feedback on.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.26%. Comparing base (1f95c6c) to head (f0a320a).
⚠️ Report is 1 commits behind head on major.

Additional details and impacted files

@@            Coverage Diff             @@
##            major    #2114      +/-   ##
==========================================
- Coverage   79.48%   79.26%   -0.22%     
==========================================
  Files         132      131       -1     
  Lines        3982     3970      -12     
  Branches      908      905       -3     
==========================================
- Hits         3165     3147      -18     
- Misses        728      731       +3     
- Partials       89       92       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Thanks for helping make WXT better!