I was asked today by a coworker why "gn check" was not complaining about missing dependency on "//url" when they included "url/gurl.h" in one of the file from the "//foo" target (target renamed as it was in the downstream iOS repository).

Inspecting "gn path" told us there was no public path between "//foo" and "//url" which confounded us:

$ gn path ../out/Debug-iphonesimulator //foo //url
//foo:foo --[private]-->
//components/metrics:net --[private]-->
//url:url

Showing one of 15 "interesting" non-data paths. 0 of them are public.
Use --all to print all paths.

When debugging "gn check", we found that "//net" has a public dependency on "//url" and "//foo" had a public dependency on "//net". This explain why "gn check" is not complaining (since we have "//foo" --[private]--> "//net" --[public]--> "//url") but make "gn path" a poor tool to debug "gn check".

The issue is that "gn check" allows the first dependency to be private if all the others are public, but "gn path" do not consider those path as privileged. Maybe "gn path" should favour non-public path if all but the first is public when selecting the path to display or maybe an option could be added to use the same rule for "gn check" and "gn path".

Or maybe we should add "--explain" option to "gn check" to have it explain why a given include is valid/invalid.