fix(actions): ninja 转义与未解析目标 —— 自审第二轮

## 1. action 命令里的 `$` 会被 ninja 吃掉

命令 token 只做了 shell 引号,没做 ninja 转义。**引号救不了它**:ninja 在 shell 被
调用之前就会展开 `$foo`,所以带字面 `$` 的 token(含 `$` 的路径、
`-Wl,-rpath,$ORIGIN`、一段 awk 程序)会被当成变量引用。

改成本文件其余地方一直用的那个配对(与 `include_dir_token` 同序):**先 ninja 转义,
再 shell 引号**。对普通 token 无影响 —— `escape_ninja_chars` 只碰空格 / `$` / `:`,
而 `shell_quote_arg` 对不含元字符的串逐字节原样返回。

这里每个元素**按构造就是一个 argv token**(类型化 builder 一次追加一个),这正是
逐 token 引号成立的前提 —— #331 表明手工拼出来的 flag blob **不**满足这个前提。

顺带把 `escape_ninja_chars` 从匿名 namespace 移出并导出:它此前是内部的,而
ninja_backend 需要它。让它继续内部化就意味着 ninja 转义规则第四份手写副本,而那
正是它们会漂的原因。

## 2. `${mcpp.target_file:拼错}` 静默变成空串

未解析的引擎变量原本会被替换成空字符串,于是生成一条路径为空的边,ninja 在离
错误很远的地方报出来。现在是**硬错误**,并列出本次构建里存在的 target,还提示
「被 required_features 门住的 target 在那些 feature 未激活时不存在」。

## 测试

188 补两条:字面 `$` 能原样到达工具;未知 target 引用报错并**点名**。
两条放在自己的最小工程里 —— `app` 的 main.cpp 故意依赖生成出来的符号,在它上面
换掉 build.mcpp 会让**链接**失败,那说明不了这两条在测什么(我第一版就是这么写的)。

验证:单测 57/57;13 个 e2e 全绿,含先前红的 35_workspace / 120_ws_root_indices。

Author: speak-agent

src/build/flags.cppm

@@ -109,6 +109,14 @@ std::string atomic_link_flag(const std::vector<std::filesystem::path>& linkDirs,
 // escaped as `\"`) — cmd.exe/CreateProcess argv convention.
 std::string shell_quote_arg(std::string_view arg);
 
+// Ninja's own escaping for a value that will sit on a `command = ` line:
+// ` `, `$` and `:` get a leading `$`. Exported because it is needed WITH
+// shell_quote_arg, not instead of it — quoting stops the SHELL from splitting
+// a token, but ninja expands `$foo` before the shell is ever invoked, so a
+// token carrying a literal `$` needs both. Callers apply ninja escaping first,
+// then shell quoting (see include_dir_token).
+std::string escape_ninja_chars(std::string_view s);
+
 // One include-directory token, fully prepared for a ninja command line:
 // dialect prefix, ninja `$` escaping, and shell quoting — in that order.
 //
@@ -146,16 +154,15 @@ std::string include_token(const mcpp::toolchain::CommandDialect& d,
 
 namespace mcpp::build {
 
-namespace {
-
-std::filesystem::path staged_std_bmi_path(const BuildPlan& plan) {
-    return mcpp::toolchain::staged_std_bmi_path(plan.toolchain, plan.outputDir);
-}
-
 // Escape a string for embedding in ninja rule strings. Takes the text, not a
 // path: round-tripping through std::filesystem::path would re-normalize the
 // separators on Windows, which silently undoes a caller that deliberately
 // chose generic_string() for a response-file token (#261).
+//
+// Deliberately OUTSIDE the anonymous namespace below: it is declared in this
+// module's export block so ninja_backend can pair it with shell_quote_arg for
+// action command tokens. Leaving it internal would mean a fourth hand-written
+// copy of ninja's escaping rules, which is how they drift.
 std::string escape_ninja_chars(std::string_view s) {
     std::string out;
     out.reserve(s.size());
@@ -167,6 +174,12 @@ std::string escape_ninja_chars(std::string_view s) {
     return out;
 }
 
+namespace {
+
+std::filesystem::path staged_std_bmi_path(const BuildPlan& plan) {
+    return mcpp::toolchain::staged_std_bmi_path(plan.toolchain, plan.outputDir);
+}
+
 // Escape a path for embedding in ninja rule strings (native separators).
 std::string escape_path(const std::filesystem::path& p) {
     return escape_ninja_chars(p.string());

src/build/ninja_backend.cppm

@@ -1314,7 +1314,21 @@ std::string emit_ninja_string(const BuildPlan& plan) {
         std::string cmd;
         for (auto const& tok : a.command) {
             if (!cmd.empty()) cmd += ' ';
-            cmd += shell_quote_arg(tok);
+            // BOTH escapes, in the order the rest of this file uses
+            // (include_dir_token does the same): ninja first, shell second.
+            // Shell-quoting alone is not enough — a literal `$` in a token
+            // (a path containing one, or an argument like `-Wl,-rpath,$ORIGIN`)
+            // is a VARIABLE REFERENCE to ninja, and quoting does not stop
+            // ninja from expanding it before the shell ever sees it.
+            //
+            // Safe for ordinary tokens: escape_ninja_chars only touches
+            // ` `, `$` and `:`, and shell_quote_arg returns anything without a
+            // metacharacter byte-for-byte, so a plain `--cpp_out=gen` is
+            // unchanged. Each element here is exactly one argv token by
+            // construction (the typed builder appends them one at a time),
+            // which is the assumption per-token quoting needs and which #331
+            // showed is NOT true of hand-assembled flag blobs.
+            cmd += shell_quote_arg(escape_ninja_chars(tok));
         }
         append(std::format("rule mcpp_action_{}\n", i));
         append(std::format("  command = {}\n", cmd));

src/build/prepare.cppm

@@ -4644,6 +4644,11 @@ prepare_build(bool print_fingerprint,
     // what makes an action portable (Windows has no shell to assume) and
     // cacheable (nothing can smuggle in ambient state).
     {
+        // An engine variable that resolves to nothing must be an ERROR, not an
+        // empty string: `${mcpp.target_file:tpyo}` would otherwise silently
+        // become an edge with a blank path, and ninja reports that far away
+        // from the typo that caused it.
+        std::set<std::string> unresolvedTargets;
         auto substitute = [&](std::string s) {
             auto rep = [&](std::string_view what, const std::string& with) {
                 for (std::size_t p; (p = s.find(what)) != std::string::npos; )
@@ -4668,6 +4673,7 @@ prepare_build(bool print_fingerprint,
                 for (auto const& lu : ctx.plan.linkUnits)
                     if (lu.targetName == name)
                         resolved = lu.output.generic_string();
+                if (resolved.empty()) unresolvedTargets.insert(name);
                 s.replace(p, close - p + 1, resolved);
             }
             return s;
@@ -4683,6 +4689,19 @@ prepare_build(bool print_fingerprint,
         collect(*m);
         for (std::size_t i = 1; i < packages.size(); ++i)
             collect(packages[i].manifest);
+        if (!unresolvedTargets.empty()) {
+            std::string bad, known;
+            for (auto const& n : unresolvedTargets) bad += (bad.empty() ? "" : ", ") + n;
+            for (auto const& lu : ctx.plan.linkUnits)
+                known += (known.empty() ? "" : ", ") + lu.targetName;
+            return std::unexpected(std::format(
+                "build.mcpp action references unknown target(s) via "
+                "${{mcpp.target_file:...}}: {}\n"
+                "  targets in this build: [{}]\n"
+                "  (a target gated by required_features is absent unless those "
+                "features are active)",
+                bad, known.empty() ? std::string("none") : known));
+        }
     }
     ctx.plan.stdCompatBmiPath = stdCompatBmiPath;
     ctx.plan.stdCompatObjectPath = stdCompatObjectPath;

tests/e2e/188_build_actions.sh

@@ -144,6 +144,67 @@ if "$MCPP" build > b4.log 2>&1; then
 fi
 rm -f FAIL_THE_CHECK
 
+# ── 3b/3c: their own minimal project ───────────────────────────────────────
+# Separate from `app`, whose main.cpp deliberately depends on the generated
+# symbol — swapping its build.mcpp out would fail the LINK and say nothing
+# about what these two are actually testing.
+mkdir -p "$TMP/edge/src"
+cd "$TMP/edge"
+cat > mcpp.toml <<'EOF'
+[package]
+name    = "edge"
+version = "0.1.0"
+EOF
+printf 'int main() {}\n' > src/main.cpp
+
+# ── 3b. a literal `$` in a command survives to the tool ────────────────────
+# Shell-quoting alone does not save it: ninja expands `$foo` BEFORE the shell
+# runs, so a token carrying a `$` (a path containing one, `-Wl,-rpath,$ORIGIN`,
+# an awk program) needs ninja escaping too.
+cat > dollar.sh <<'EOF'
+#!/usr/bin/env bash
+# $1 must arrive containing a literal dollar sign
+case "$1" in *'$'*) : > "$2";; *) echo "lost the dollar: [$1]" >&2; exit 1;; esac
+EOF
+chmod +x dollar.sh
+cat > build.mcpp <<'EOF'
+#include <cstdio>
+#include <string>
+import mcpp;
+int main() {
+    const std::string root = mcpp::manifest_dir();
+    mcpp::action a;
+    a.id = "dollar"; a.role = "check";
+    a.arg((root + "/dollar.sh").c_str()).arg("-Wl,-rpath,$ORIGIN")
+     .arg("${mcpp.out_dir}/dollar.stamp")
+     .output("${mcpp.out_dir}/dollar.stamp")
+     .submit();
+}
+EOF
+rm -rf target
+"$MCPP" build > b3b.log 2>&1 || {
+    cat b3b.log; echo "FAIL: a literal \$ in an action command did not survive"; exit 1; }
+
+# ── 3c. an unknown target reference is an error, not an empty path ─────────
+cat > build.mcpp <<'EOF'
+#include <cstdio>
+import mcpp;
+int main() {
+    mcpp::action a;
+    a.id = "bad-ref"; a.role = "artifact";
+    a.arg("/bin/true").arg("${mcpp.target_file:no_such_target}")
+     .input("${mcpp.target_file:no_such_target}")
+     .output("${mcpp.out_dir}/x.out")
+     .submit();
+}
+EOF
+rm -rf target
+if "$MCPP" build > b3c.log 2>&1; then
+    cat b3c.log; echo "FAIL: an unknown target reference was accepted"; exit 1
+fi
+grep -q "no_such_target" b3c.log || {
+    cat b3c.log; echo "FAIL: error does not name the unknown target"; exit 1; }
+
 # ── 4. a malformed action is refused, not skipped ──────────────────────────
 cat > build.mcpp <<'EOF'
 #include <cstdio>