@0xgeorgemathew/zcode 0.3.1 → 0.3.2

package/README.md

@@ -213,9 +213,9 @@ Event types on the way in:
 
 ## Under the hood
 
-**Key handling.** `ZAI_API_KEY` env var, or `zcode login` which stores it at `~/.zcode/credentials.json` (mode 600). The key is never printed or logged. The only file it ever lands in is the scratch provider config, which the engine requires to register the provider.
+**Key handling.** `ZAI_API_KEY` env var, or `zcode login` which stores it at `~/.zcode-cli/credentials.json` (mode 600). The key is never printed or logged. The only file it ever lands in is the scratch provider config, which the engine requires to register the provider.
 
-**Isolation.** The engine runs with `HOME` pointed at a scratch copy this package owns (`~/.zcode/home`, mode 700, mtime-cached). Your live `~/.zcode`, which the desktop app is using right now, is never written to. Your OAuth `credentials.json` is deliberately never copied. The scratch keeps exactly the `zai-api` provider rule with your key, your agents, and your skills.
+**Isolation.** This package's own state lives under `~/.zcode-cli` (never under `~/.zcode`, which belongs to the desktop app; if an older 0.3.x left files there, they are migrated out automatically on first run). The engine runs with `HOME` pointed at a scratch copy we own (`~/.zcode-cli/home`, mode 700, mtime-cached). Your live `~/.zcode`, which the desktop app is using right now, is never written to. Your OAuth `credentials.json` is deliberately never copied. The scratch keeps exactly the `zai-api` provider rule with your key, your agents, and your skills.
 
 **Yolo mode.** Sessions run with auto-approved tool side effects, matching the engine's own headless default; `--cwd` is the declared blast radius. A headless run that requests interactive user input fails fast with exit 5 rather than hanging.
 

package/lib/commands/doctor.js

@@ -85,7 +85,7 @@ module.exports = async function doctor(parsed) {
         (isolation.stamp && typeof isolation.stamp.skillsCopied === 'number'
           ? isolation.stamp.skillsCopied
           : 0) || 0,
-      mcpServersInherited: Object.keys(effectiveMcpServers({})).length,
+      mcpServersInherited: Object.keys(effectiveMcpServers({ inherit: true })).length,
       experimental:
         isolation.mode === 'synthesized'
           ? 'synthesized config path is unproven; copy a real ~/.zcode/v2 or verify once on a clean HOME'

package/lib/isolation.js

@@ -226,13 +226,62 @@ function buildScratch(home, key) {
 
 // --- public API -------------------------------------------------------------
 
+// Root of zcode's own state. MUST NOT be ~/.zcode: that is the desktop
+// app's live directory (0.3.0/0.3.1 regression — the package rename made
+// rootDir collide with it, so login/scratch files landed inside the live
+// config). Ours is ~/.zcode-cli.
 function rootDir(env = process.env) {
-  return env.ZAI_CODE_HOME || path.join(os.homedir(), '.zcode');
+  return env.ZAI_CODE_HOME || path.join(os.homedir(), '.zcode-cli');
+}
+
+// The only file/dir names this package ever creates at its root.
+// migrateRoot moves exactly these out of legacy locations and never
+// touches anything else.
+const OUR_ARTIFACTS = ['credentials.json', 'build-stamp.json', 'injected-skills.json', 'home'];
+
+// 0.3.2 migration: vacate our artifacts from (a) the live ~/.zcode, where
+// 0.3.0/0.3.1 wrongly wrote them, and (b) the pre-rename ~/.zai-code root,
+// into the new ~/.zcode-cli root. Idempotent; never writes or deletes
+// anything else in the live directory.
+function migrateRoot(env = process.env) {
+  const root = rootDir(env);
+  try {
+    fs.mkdirSync(root, { recursive: true });
+  } catch {
+    return; // unwritable home — leave everything as-is; ensureIsolation surfaces it
+  }
+  const sources = [
+    LIVE_ZCODE, // live dir: move ours out, keep everything else
+    path.join(os.homedir(), '.zai-code'), // pre-rename root: wholly ours
+  ];
+  for (const dir of sources) {
+    let entries;
+    try {
+      entries = new Set(fs.readdirSync(dir));
+    } catch {
+      continue; // nothing to migrate from this source
+    }
+    for (const name of OUR_ARTIFACTS) {
+      if (!entries.has(name)) continue;
+      const src = path.join(dir, name);
+      const dest = path.join(root, name);
+      try {
+        if (fs.existsSync(dest)) {
+          fs.rmSync(src, { recursive: true, force: true });
+        } else {
+          fs.renameSync(src, dest);
+        }
+      } catch {
+        /* keep going; a missing artifact just rebuilds */
+      }
+    }
+  }
 }
 
 // Ensures the scratch HOME exists and is current. Returns
 // {root, home, mode, built, stamp}.
 function ensureIsolation(key, { fresh = false, env = process.env } = {}) {
+  migrateRoot(env);
   const root = rootDir(env);
   fs.mkdirSync(root, { recursive: true });
   fs.chmodSync(root, 0o700);
@@ -307,6 +356,7 @@ module.exports = {
   ensureIsolation,
   engineEnv,
   rootDir,
+  migrateRoot,
   keySha256,
   LIVE_ZCODE,
   LIVE_V2,

package/lib/key.js

@@ -1,14 +1,19 @@
 'use strict';
-// API key resolution (DESIGN §5): ZAI_API_KEY env → ~/.zcode/credentials.json
-// ({"apiKey":"…"}, mode 600, written by `zcode login`). The key is never
-// printed, logged, or echoed by anything in this package.
+// API key resolution (DESIGN §5): ZAI_API_KEY env →
+// ~/.zcode-cli/credentials.json ({"apiKey":"…"}, mode 600, written by
+// `zcode login`). The key is never printed, logged, or echoed by anything
+// in this package.
 const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
+const { migrateRoot } = require('./isolation.js');
 
 // Root of zcode's own state (scratch HOME lives under <root>/home).
+// MUST NOT be ~/.zcode — that is the desktop app's live directory the
+// engine itself owns (0.3.0/0.3.1 regression: the rename made the CLI
+// write credentials and the scratch HOME straight into it).
 function rootDir(env = process.env) {
-  return env.ZAI_CODE_HOME || path.join(os.homedir(), '.zcode');
+  return env.ZAI_CODE_HOME || path.join(os.homedir(), '.zcode-cli');
 }
 
 function credentialsPath(env = process.env) {
@@ -41,6 +46,7 @@ function readCredentialsKey(file) {
 // Sources, in order: ZAI_API_KEY (non-empty) → credentials.json.
 // Throws NoKeyError when neither holds a key.
 function resolveKey(env = process.env) {
+  migrateRoot(env); // 0.3.2: vacate our artifacts out of the live ~/.zcode first
   const fromEnv = (env.ZAI_API_KEY || '').trim();
   if (fromEnv) return fromEnv;
   const fromFile = readCredentialsKey(credentialsPath(env));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xgeorgemathew/zcode",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Headless GLM-5.3 / GLM-5.3-Flash coding CLI for agents: streaming thinking, subagents, MCP servers, skills, session continuity. Wraps the ZCode engine. Zero dependencies.",
   "license": "MIT",
   "private": false,