@6reduk/workspace-pipeline 0.5.0 → 0.6.0

package/README.md

@@ -1,5 +1,10 @@
 # Workspace Pipeline CLI
 
+Everyday update: `workspace-pipeline update --workspace <directory>` shows the
+changes and asks for confirmation. Use `--yes` for unattended application or
+`--preview --json` to retain the advanced saved-plan workflow. See
+[update modes](docs/lifecycle-cli.md#everyday-update-executable).
+
 Claude/Grok shared delivery: [one Claude configuration, plain Grok launch,
 global compatibility preview and recovery](docs/claude-grok.md).
 

package/docs/lifecycle-cli.md

@@ -14,6 +14,52 @@ CLI assembly supplies built-in adapters, never package code.
 
 ## Preview and apply contract
 
+### Everyday update (executable)
+
+`workspace-pipeline update --workspace <absolute-wrapper>` prepares a plan,
+shows every affected path and any user-wide Grok compatibility changes, and
+asks `Apply these changes? [y/N]`. Accepted confirmations are `y`, `yes`, `д`,
+or `да` (case-insensitive, surrounding whitespace ignored). Enter or any other
+answer cancels. Cancellation exits 0 with `status: cancelled, applied: false`;
+exit 0 alone does not mean an update was applied. The CLI
+manages a private temporary preview internally and uses the same approval and
+drift checks as saved-plan apply. No automatic reset or conflict bypass occurs.
+
+`--yes` authorizes this update without a prompt (including displayed global
+changes). Non-interactive input without `--yes` refuses before preparation.
+`--preview` explicitly requests preparation only. `--preview --json` saves a
+machine plan; for compatibility, `update --json` alone also remains preview-only.
+`--yes --json` emits the final machine result on stdout and the change summary
+on stderr; `--json` by itself never authorizes writes. The deterministic embedded
+`runCli` API keeps its prior preview/apply behavior; this convenience is in the
+executable entry layer. Other commands keep their existing explicit flow.
+
+```
+workspace-pipeline update --workspace C:\Work\Game
+workspace-pipeline update --workspace C:\Work\Game --yes
+workspace-pipeline update --workspace C:\Work\Game --preview --json > preview.json
+workspace-pipeline update --workspace C:\Work\Game --apply --preview C:\Private\preview.json
+```
+
+Saved plans remain useful for LLM work, migrations and separate approval. Do not
+share them publicly: configuration payloads can contain private values. A failed
+apply can have partial effects: inspect doctor/recovery, do not blindly retry.
+
+The internal preview is in the current user's OS temporary directory, inside a
+unique `wpc-approved-update-*` directory. It may contain private configuration.
+On POSIX the preview is created with mode `0600`; Windows/NTFS does not enforce
+that POSIX mode, so confidentiality depends on the inherited Windows ACLs of
+your temporary directory. The CLI does not change those ACLs. Use a private
+user temp directory, not a shared writable temp location.
+
+Normal completion (including handled apply failure) attempts to remove only
+that preview and its empty directory. A killed process or failed cleanup can
+leave the directory behind; there is no automatic janitor. After stopping the
+owning update process and inspecting doctor/recovery, you may manually remove
+its obsolete `wpc-approved-update-*` directory. Do not delete another active
+run's directory or `.pipeline/transactions`/backups as part of this cleanup.
+The temporary preview is not a replacement for durable recovery evidence.
+
 Once a trusted registry is provided by the CLI assembly:
 
 ```text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@6reduk/workspace-pipeline",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Workspace-local Git pipeline configuration dispatcher",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -1,10 +1,23 @@
 #!/usr/bin/env node
-import {runCli} from './commands/dispatch.js';
 import {providerRegistry} from './providers/registry.js';
 import {outputWriter} from './commands/output.js';
 import {createClaudeCompatibility} from './compat/claude.js';
+import {runInteractiveUpdate} from './commands/interactive-update.js';
+import {createInterface} from 'node:readline/promises';
 const write=stream=>text=>new Promise((resolve,reject)=>stream.write(text,error=>error?reject(error):resolve()));
 // Prevent an unhandled pipe error; write callbacks report delivery failures.
 process.stdout.on('error',()=>{});process.stderr.on('error',()=>{});
 const args=process.argv.slice(2),json=args.includes('--json');
-process.exitCode=await runCli(args,{stdout:outputWriter(write(process.stdout),json),stderr:outputWriter(write(process.stderr),json),registry:providerRegistry,compatibility:createClaudeCompatibility()});
+const options={stdout:outputWriter(write(process.stdout),json),stderr:outputWriter(write(process.stderr),json),registry:providerRegistry,compatibility:createClaudeCompatibility()};
+try{
+  process.exitCode=await runInteractiveUpdate(args,options,{
+    isTTY:Boolean(process.stdin.isTTY&&process.stderr.isTTY),display:write(process.stderr),
+    confirm:async()=>{
+      const rl=createInterface({input:process.stdin,output:process.stderr});
+      try{return /^(y|yes|д|да)$/i.test((await rl.question('Apply these changes? [y/N] ')).trim());}
+      catch{return false;}finally{rl.close();}
+    }
+  });
+}catch{
+  await options.stderr(JSON.stringify({error:'cli.interactive-io',next:'Inspect doctor before retry; no automatic retry or reset.'})+'\n');process.exitCode=2;
+}

package/src/commands/dispatch.js

@@ -31,6 +31,7 @@ import {parseCompat,runCompat} from './compat.js';
 
 export const help=`Workspace Pipeline CLI — development preview
 Usage: workspace-pipeline doctor --workspace <absolute-directory> [--recovery <relative-record>] [--json]
+       workspace-pipeline update --workspace <absolute-directory> [--yes | --preview] [--json]
        workspace-pipeline compat claude [recover-lock] [--apply --preview <absolute-json-file>] [--json]
        workspace-pipeline launch grok --workspace <absolute-directory> --executable <absolute-native-executable> [--inspect] [--execute]
        workspace-pipeline <init|adopt|wrap> --workspace <absolute-directory> --choices <absolute-json-file> [--manifest <absolute-file>] [--network]

package/src/commands/interactive-update.js

@@ -0,0 +1,59 @@
+import {mkdtemp,writeFile,unlink,rmdir} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {runCli,parseCommand} from './dispatch.js';
+import {safeTerminalText as safe} from './output.js';
+
+export function updateSummary(saved){
+  const p=saved.kind==='prepared-with-claude-compatibility'?saved.workspace:saved;
+  const plan=p.preview.plan;
+  const lines=['Workspace Pipeline — update',`Workspace: ${safe(plan.workspace)}`,
+    `Pipeline: ${safe(plan.desired.pipelineId)} @ ${safe(plan.desired.version)}`,
+    `Providers: ${plan.desired.providers.map(safe).join(', ')}`,`Changes: ${plan.targets.length}`];
+  for(const t of plan.targets)lines.push(`  ${safe(t.action)}  ${safe(t.path)}`);
+  const c=saved.compatibility;
+  if(c){lines.push(`Grok global compatibility: ${safe(c.status)}`);
+    if(c.path)lines.push(`  Config: ${safe(c.path)}`);
+    for(const k of c.changes??[])lines.push(`  compat.claude.${safe(k)} = true`);
+    for(const b of c.blockers??[])lines.push(`  BLOCKED: ${safe(b)}`);
+    if(c.warning)lines.push(safe(c.warning));
+  }
+  lines.push('No automatic reset. Apply rechecks files and approval before writing.');
+  return lines.join('\n')+'\n';
+}
+
+// Human-facing entry only. runCli remains the deterministic preview/apply API.
+export async function runInteractiveUpdate(args,options,{isTTY=false,confirm,display,execute=runCli}={}){
+  if(args[0]!=='update'||args.includes('--apply'))return execute(args,options);
+  const yes=args.includes('--yes'),dry=args.includes('--preview');
+  const clean=args.filter(x=>x!=='--yes'&&x!=='--preview');
+  if(args.filter(x=>x==='--yes').length>1||args.filter(x=>x==='--preview').length>1||(yes&&dry)){
+    await options.stdout(JSON.stringify({error:'cli.arguments'})+'\n');return 2;
+  }
+  // --json alone retains the existing machine preview contract; it never authorizes writes.
+  if(dry||(args.includes('--json')&&!yes))return execute(clean,options);
+  try{parseCommand(clean);}catch{return execute(clean,options);}
+  if(!yes&&(!isTTY||!confirm)){
+    await options.stdout(JSON.stringify({error:'cli.confirmation-required',next:'Use an interactive terminal, --yes to apply, or --preview --json for a saved plan.'})+'\n');return 2;
+  }
+  let raw='';
+  const code=await execute(clean,{...options,stdout:async text=>{raw+=text;}});
+  if(code!==0){if(raw)await options.stdout(raw);return code;}
+  const saved=JSON.parse(raw);
+  await display(updateSummary(saved));
+  if(saved.compatibility?.status==='blocked'){
+    await options.stdout(JSON.stringify({status:'blocked',error:'grok-compat.blocked'})+'\n');return 1;
+  }
+  if(!yes&&await confirm()!==true){await options.stdout(JSON.stringify({status:'cancelled',applied:false})+'\n');return 0;}
+  // Feed the exact approved bytes through the same public saved-preview verifier.
+  const dir=await mkdtemp(path.join(tmpdir(),'wpc-approved-update-'));
+  const file=path.join(dir,'preview.json');
+  try{
+    await writeFile(file,raw,{flag:'wx',mode:0o600});
+    const command=parseCommand(clean);
+    return await execute(['update','--workspace',command.workspace,'--apply','--preview',file],options);
+  }finally{
+    // Only our one named temporary file, never a recursive workspace cleanup.
+    await unlink(file).catch(()=>{});await rmdir(dir).catch(()=>{});
+  }
+}

package/src/commands/output.js

@@ -1,6 +1,7 @@
 // Presentation boundary only: internal command results and saved JSON contracts
 // remain unchanged. Never infer success from the shape of a rendered result.
-const safe = value => String(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+export const safeTerminalText = value => String(value).replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+const safe = safeTerminalText;
 const privateKey = /bytes|base64|content|secret|token|password/i;
 
 export function formatResult(value) {