fix(pm): address PR #330 review feedback

- tests: assert 'from lock' on rebuild instead of vacuous 'ls-remote'
- prepare: dedupe cache-key formula via computeGitRoot(resolvedGitRev)
- prepare: add anchor.url == spec.git to offline anchor match
- prepare: drop 'mcpp update' from offline diagnostics (offline no-op)
- commands: refresh stale comment in cmd_update about lockfile semantics
- lock_io: split fragment on last '@' (branch names with '@') and
  reset empty resolvedCommit so the offline branch prints the right hint

Author: ZheFeng7110

src/build/prepare.cppm

@@ -3020,7 +3020,9 @@ prepare_build(bool print_fingerprint,
             std::optional<std::string> lockedCommit;
             if (auto it = gitLockAnchors.find(name); it != gitLockAnchors.end()) {
                 auto const& anchor = it->second;
-                if (anchor.refKind == spec.gitRefKind && anchor.ref == spec.gitRev) {
+                if (anchor.refKind == spec.gitRefKind
+                    && anchor.ref == spec.gitRev
+                    && anchor.url == spec.git) {
                     lockedCommit = anchor.resolvedCommit;
                 }
             }
@@ -3063,13 +3065,13 @@ prepare_build(bool print_fingerprint,
                         if (lockedCommit) {
                             return std::unexpected(std::format(
                                 "git dep '{}' locked to commit {} but its local cache is missing or stale; "
-                                "run without --offline to refresh, or `mcpp update {}` to re-resolve",
-                                name, *lockedCommit, name));
+                                "run without --offline to refresh.",
+                                name, *lockedCommit));
                         } else {
                             return std::unexpected(std::format(
                                 "git dep '{}' uses branch '{}' and mcpp.lock has no commit; "
-                                "cannot resolve offline. Run `mcpp update {}` or build without --offline.",
-                                name, spec.gitRev, name));
+                                "cannot resolve offline. Run without --offline.",
+                                name, spec.gitRev));
                         }
                     }
                     auto cmd = std::format(
@@ -3102,18 +3104,14 @@ prepare_build(bool print_fingerprint,
                     mcpp::platform::env::offline_mode()) {
                     return std::unexpected(std::format(
                         "git dep '{}' is locked but its local cache is missing; "
-                        "run without --offline to clone, or `mcpp update {}` to re-resolve.",
-                        name, name));
+                        "run without --offline to clone.",
+                        name));
                 }
             }
 
             // Cache key: hash(url + refkind + declared ref + resolved commit).
             // For fixed rev/tag deps the declared ref is also the resolved ref.
-            std::hash<std::string> H;
-            auto urlHash = std::format("{:016x}",
-                H(spec.git + "|" + spec.gitRefKind + "|" + spec.gitRev
-                  + "|" + resolvedGitRev));
-            auto gitRoot = mcppHome / "git" / urlHash;
+            auto gitRoot = computeGitRoot(resolvedGitRev);
             std::error_code ec;
             std::filesystem::create_directories(gitRoot.parent_path(), ec);
             if (!std::filesystem::exists(gitRoot / ".git")) {
@@ -3150,6 +3148,7 @@ prepare_build(bool print_fingerprint,
                 }
             }
             if (item.consumerDepIndex == kMainConsumer) {
+                std::hash<std::string> H;
                 auto source = std::format("git+{}#{}={}",
                     spec.git, spec.gitRefKind, spec.gitRev);
                 if (spec.gitRefKind == "branch") source += "@" + resolvedGitRev;

src/pm/commands.cppm

@@ -412,14 +412,15 @@ inline int cmd_update(const mcpplibs::cmdline::ParsedArgs& parsed) {
 
     // Refresh the index FIRST (#315/D6).
     //
-    // This command used to only drop lock entries and tell the user to run
-    // `mcpp build` — but the build path never reads mcpp.lock (prepare writes
-    // it and nothing on that path loads it), so the whole command was a no-op:
-    // it changed no behaviour whatsoever. It is also the only command whose
-    // stated purpose is "get me newer dependencies", which since #315 is
-    // exactly what an index refresh is for. Explicit intent, so no debounce and
-    // no TTL — but still refused when offline, loudly, rather than silently
-    // doing nothing again.
+    // Since #330 the build path reads mcpp.lock to short-circuit `git
+    // ls-remote` for branch deps that are already resolved to a commit
+    // with a matching local cache. `mcpp update <dep>` therefore no
+    // longer "refreshes" a git branch dep — it only drops the lock
+    // entry, which forces the next build to call `ls-remote` again.
+    // The index refresh below is unrelated: it covers the registry-served
+    // version deps only. Skipped when offline — loudly, not silently —
+    // since #315 is exactly about not paying a network round-trip to
+    // achieve nothing.
     // Skipped when nothing in the project is served by the shared registry:
     // syncing it does nothing for path deps, git deps or a project `[indices]`
     // entry, and paying a multi-repo network round-trip to achieve nothing is

src/pm/lock_io.cppm

@@ -196,12 +196,17 @@ std::optional<LockedGitSource> parse_git_source(std::string_view source) {
         return std::nullopt;
 
     auto refPart = fragment.substr(eqPos + 1);
-    auto atPos = refPart.find('@');
+    // Split on the LAST `@` so branch names containing `@` (e.g. "feat@v2")
+    // match the write format in prepare.cppm (`ref + "@" + commit`).
+    auto atPos = refPart.rfind('@');
     if (atPos == std::string_view::npos) {
         out.ref = std::string(refPart);
     } else {
         out.ref = std::string(refPart.substr(0, atPos));
         out.resolvedCommit = std::string(refPart.substr(atPos + 1));
+        // A bare `branch=foo@` would otherwise yield an empty commit and
+        // confuse the offline anchor into reporting "locked to commit ".
+        if (out.resolvedCommit->empty()) out.resolvedCommit.reset();
     }
 
     if (out.ref.empty()) return std::nullopt;

tests/e2e/24_git_dependency.sh

@@ -155,7 +155,7 @@ out=$(${triple}${fp_dir}/bin/branchapp)
 
 # Second build with the lock in place must not hit the network for ls-remote.
 build2=$("$MCPP" build 2>&1)
-echo "$build2" | grep -q 'ls-remote' && { echo "FAIL: branch dep re-ls-remoted on rebuild"; exit 1; } || true
+echo "$build2" | grep -q 'from lock' || { echo "FAIL: branch dep not resolved from lock on rebuild"; cat <<<"$build2"; exit 1; }
 echo "$build2" | grep -q 'Cloning' && { echo "FAIL: branch dep re-cloned on rebuild"; exit 1; } || true
 
 grep -q 'source  = "git+' mcpp.lock || {