@alwaysmeticulous/cli 2.326.1 → 2.328.0

package/dist/commands/onboard/__tests__/resolve-app.spec.js

@@ -0,0 +1,166 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7fa2bb6e-e3e7-5926-a3df-be917a1fc652")}catch(e){}}();
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const vitest_1 = require("vitest");
+const cli_user_error_1 = require("../../../utils/cli-user-error");
+const resolve_app_1 = require("../resolve-app");
+const isInteractive = vitest_1.vi.fn(() => false);
+const promptForConfirmation = vitest_1.vi.fn();
+vitest_1.vi.mock("@alwaysmeticulous/client", async (importOriginal) => ({
+    ...(await importOriginal()),
+    isInteractiveContext: () => isInteractive(),
+}));
+vitest_1.vi.mock("inquirer", () => ({
+    default: { prompt: (...args) => promptForConfirmation(...args) },
+}));
+const dirs = [];
+const makeProject = (files) => {
+    const root = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-resolve-app-"));
+    dirs.push(root);
+    for (const [rel, content] of Object.entries(files)) {
+        const full = (0, path_1.join)(root, rel);
+        (0, fs_1.mkdirSync)((0, path_1.dirname)(full), { recursive: true });
+        (0, fs_1.writeFileSync)(full, content);
+    }
+    return root;
+};
+const MONOREPO_FILES = {
+    "package.json": JSON.stringify({
+        name: "root",
+        private: true,
+        workspaces: ["apps/*"],
+    }),
+    "apps/web/package.json": JSON.stringify({
+        name: "@acme/web",
+        dependencies: { react: "18.0.0" },
+        scripts: { dev: "vite" },
+    }),
+    "apps/admin/package.json": JSON.stringify({
+        name: "@acme/admin",
+        dependencies: { react: "18.0.0" },
+        scripts: { dev: "vite" },
+    }),
+};
+const SELECTED_APP = {
+    path: ".",
+    name: "web",
+    packageName: "web",
+};
+(0, vitest_1.afterEach)(() => {
+    for (const dir of dirs.splice(0)) {
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+(0, vitest_1.describe)("resolveSelectedApp", () => {
+    (0, vitest_1.it)("matches the requested app by path", async () => {
+        const root = makeProject(MONOREPO_FILES);
+        const app = await (0, resolve_app_1.resolveSelectedApp)({
+            projectRoot: root,
+            app: "apps/web",
+        });
+        (0, vitest_1.expect)(app.path).toBe("apps/web");
+    });
+    (0, vitest_1.it)("matches the requested app by package name", async () => {
+        const root = makeProject(MONOREPO_FILES);
+        const app = await (0, resolve_app_1.resolveSelectedApp)({
+            projectRoot: root,
+            app: " @acme/admin ",
+        });
+        (0, vitest_1.expect)(app.path).toBe("apps/admin");
+    });
+    (0, vitest_1.it)("lists the available apps when the requested one is unknown", async () => {
+        const root = makeProject(MONOREPO_FILES);
+        await (0, vitest_1.expect)((0, resolve_app_1.resolveSelectedApp)({ projectRoot: root, app: "apps/nope" })).rejects.toThrow(/App 'apps\/nope' not found[\s\S]*apps\/web/);
+    });
+    (0, vitest_1.it)("selects the only app without prompting", async () => {
+        const root = makeProject({
+            "package.json": JSON.stringify({
+                name: "web",
+                dependencies: { react: "18.0.0" },
+                scripts: { dev: "vite" },
+            }),
+        });
+        const app = await (0, resolve_app_1.resolveSelectedApp)({ projectRoot: root, app: undefined });
+        (0, vitest_1.expect)(app.path).toBe(".");
+    });
+    (0, vitest_1.it)("falls back to the repo root when no frontend app is detected", async () => {
+        const root = makeProject({});
+        const app = await (0, resolve_app_1.resolveSelectedApp)({ projectRoot: root, app: undefined });
+        (0, vitest_1.expect)(app.path).toBe(".");
+        (0, vitest_1.expect)(app.packageName).toBeNull();
+    });
+    (0, vitest_1.it)("requires --app in a monorepo without an interactive terminal", async () => {
+        const root = makeProject(MONOREPO_FILES);
+        await (0, vitest_1.expect)((0, resolve_app_1.resolveSelectedApp)({ projectRoot: root, app: undefined })).rejects.toThrow(cli_user_error_1.CliUserError);
+    });
+});
+(0, vitest_1.describe)("assertSupportedSsr", () => {
+    const confident = {
+        framework: "nuxt",
+        rendering: "ssr",
+        isUnsupportedSsr: true,
+        unsupportedSsrConfidence: "high",
+        details: ["Nuxt detected (ssr=true)"],
+    };
+    const ambiguous = {
+        ...confident,
+        unsupportedSsrConfidence: "ambiguous",
+    };
+    const nextAppAmbiguous = {
+        framework: "nextjs-app",
+        rendering: "ssr",
+        isUnsupportedSsr: true,
+        unsupportedSsrConfidence: "ambiguous",
+        details: ["Next.js detected (router: app)"],
+    };
+    const check = (detection, skipSsrCheck = false) => (0, resolve_app_1.assertSupportedSsr)({ detection, selectedApp: SELECTED_APP, skipSsrCheck });
+    (0, vitest_1.beforeEach)(() => {
+        isInteractive.mockReturnValue(false);
+        promptForConfirmation.mockReset();
+    });
+    (0, vitest_1.it)("passes through supported setups", async () => {
+        await (0, vitest_1.expect)(check({
+            ...confident,
+            isUnsupportedSsr: false,
+            unsupportedSsrConfidence: null,
+        })).resolves.toBeUndefined();
+    });
+    (0, vitest_1.it)("lets the user confirm a high-confidence detection", async () => {
+        isInteractive.mockReturnValue(true);
+        promptForConfirmation.mockResolvedValue({ proceed: true });
+        await (0, vitest_1.expect)(check(confident)).resolves.toBeUndefined();
+        (0, vitest_1.expect)(promptForConfirmation).toHaveBeenCalledWith([
+            vitest_1.expect.objectContaining({
+                message: "We think web (.) is an unsupported SSR setup. Continue anyway?",
+            }),
+        ]);
+    });
+    (0, vitest_1.it)("is bypassed by --skip-ssr-check", async () => {
+        await (0, vitest_1.expect)(check(confident, true)).resolves.toBeUndefined();
+    });
+    (0, vitest_1.it)("points at the escape hatch when there is no terminal to confirm", async () => {
+        await (0, vitest_1.expect)(check(confident)).rejects.toThrow(/--skip-ssr-check/);
+        (0, vitest_1.expect)(promptForConfirmation).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("asks whether to continue when Next.js App Router is detected", async () => {
+        isInteractive.mockReturnValue(true);
+        promptForConfirmation.mockResolvedValue({ proceed: true });
+        await (0, vitest_1.expect)(check(nextAppAmbiguous)).resolves.toBeUndefined();
+        (0, vitest_1.expect)(promptForConfirmation).toHaveBeenCalledWith([
+            vitest_1.expect.objectContaining({
+                message: "We think web (.) uses Next.js App Router. Continue anyway?",
+            }),
+        ]);
+    });
+    (0, vitest_1.it)("stops an ambiguous detection when the user declines", async () => {
+        isInteractive.mockReturnValue(true);
+        promptForConfirmation.mockResolvedValue({ proceed: false });
+        await (0, vitest_1.expect)(check(ambiguous)).rejects.toThrow(cli_user_error_1.CliUserError);
+    });
+});
+//# sourceMappingURL=resolve-app.spec.js.map
+//# debugId=7fa2bb6e-e3e7-5926-a3df-be917a1fc652

package/dist/commands/onboard/__tests__/resolve-app.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-app.spec.js","sources":["../../../../src/commands/onboard/__tests__/resolve-app.spec.ts"],"sourceRoot":"","names":[],"mappings":";;;;AAAA,2BAAmE;AACnE,2BAA4B;AAC5B,+BAAqC;AAErC,mCAAyE;AACzE,kEAA6D;AAG7D,gDAAwE;AAExE,MAAM,aAAa,GAAG,WAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACzC,MAAM,qBAAqB,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;AAEtC,WAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,MAAM,cAAc,EAAiC,CAAC;IAC1D,oBAAoB,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;CAC5C,CAAC,CAAC,CAAC;AAEJ,WAAE,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,EAAE;CAC5E,CAAC,CAAC,CAAC;AAEJ,MAAM,IAAI,GAAa,EAAE,CAAC;AAE1B,MAAM,WAAW,GAAG,CAAC,KAA6B,EAAU,EAAE;IAC5D,MAAM,IAAI,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAA,cAAS,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAA,kBAAa,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG;IACrB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,CAAC,QAAQ,CAAC;KACvB,CAAC;IACF,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC;QACtC,IAAI,EAAE,WAAW;QACjB,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;QACjC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;KACzB,CAAC;IACF,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC;QACxC,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;QACjC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,YAAY,GAAkB;IAClC,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,IAAA,kBAAS,EAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAA,gCAAkB,EAAC;YACnC,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAA,gCAAkB,EAAC;YACnC,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,eAAe;SACrB,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,IAAA,eAAM,EACV,IAAA,gCAAkB,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAC5D,CAAC,OAAO,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC7B,IAAI,EAAE,KAAK;gBACX,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACjC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;aACzB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gCAAkB,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAA,gCAAkB,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAA,eAAM,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,IAAA,eAAM,EACV,IAAA,gCAAkB,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAC1D,CAAC,OAAO,CAAC,OAAO,CAAC,6BAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,SAAS,GAAuB;QACpC,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,KAAK;QAChB,gBAAgB,EAAE,IAAI;QACtB,wBAAwB,EAAE,MAAM;QAChC,OAAO,EAAE,CAAC,0BAA0B,CAAC;KACtC,CAAC;IACF,MAAM,SAAS,GAAuB;QACpC,GAAG,SAAS;QACZ,wBAAwB,EAAE,WAAW;KACtC,CAAC;IACF,MAAM,gBAAgB,GAAuB;QAC3C,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,KAAK;QAChB,gBAAgB,EAAE,IAAI;QACtB,wBAAwB,EAAE,WAAW;QACrC,OAAO,EAAE,CAAC,gCAAgC,CAAC;KAC5C,CAAC;IAEF,MAAM,KAAK,GAAG,CACZ,SAA6B,EAC7B,YAAY,GAAG,KAAK,EACL,EAAE,CACjB,IAAA,gCAAkB,EAAC,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAE7E,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACrC,qBAAqB,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAA,eAAM,EACV,KAAK,CAAC;YACJ,GAAG,SAAS;YACZ,gBAAgB,EAAE,KAAK;YACvB,wBAAwB,EAAE,IAAI;SAC/B,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,MAAM,IAAA,eAAM,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,IAAA,eAAM,EAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAAC;YACjD,eAAM,CAAC,gBAAgB,CAAC;gBACtB,OAAO,EACL,gEAAgE;aACnE,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAA,eAAM,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAA,eAAM,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAA,eAAM,EAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,MAAM,IAAA,eAAM,EAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC/D,IAAA,eAAM,EAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAAC;YACjD,eAAM,CAAC,gBAAgB,CAAC;gBACtB,OAAO,EAAE,4DAA4D;aACtE,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5D,MAAM,IAAA,eAAM,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,6BAAY,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","debugId":"7fa2bb6e-e3e7-5926-a3df-be917a1fc652"}

package/dist/commands/onboard/__tests__/safe-repo-fs.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=safe-repo-fs.spec.d.ts.map

package/dist/commands/onboard/__tests__/safe-repo-fs.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-repo-fs.spec.d.ts","sourceRoot":"","sources":["../../../../src/commands/onboard/__tests__/safe-repo-fs.spec.ts"],"names":[],"mappings":""}

package/dist/commands/onboard/__tests__/safe-repo-fs.spec.js

@@ -0,0 +1,137 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="edf0f77d-f913-5f83-bc22-a26182e48546")}catch(e){}}();
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const vitest_1 = require("vitest");
+const cli_user_error_1 = require("../../../utils/cli-user-error");
+const safe_repo_fs_1 = require("../safe-repo-fs");
+const dirs = [];
+const makeRoot = () => {
+    const root = (0, fs_1.realpathSync)((0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-safe-fs-")));
+    dirs.push(root);
+    return root;
+};
+(0, vitest_1.afterEach)(() => {
+    for (const dir of dirs.splice(0)) {
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+(0, vitest_1.describe)("resolveSafeWritePath", () => {
+    (0, vitest_1.it)("resolves a normal relative path under the project root", () => {
+        const root = makeRoot();
+        (0, vitest_1.expect)((0, safe_repo_fs_1.resolveSafeWritePath)(root, ".meticulous-onboard")).toBe((0, path_1.join)(root, ".meticulous-onboard"));
+    });
+    (0, vitest_1.it)("rejects path escape via ..", () => {
+        const root = makeRoot();
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.resolveSafeWritePath)(root, "../outside")).toThrow(cli_user_error_1.CliUserError);
+    });
+    (0, vitest_1.it)("rejects writing through a symlinked directory", () => {
+        const root = makeRoot();
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-outside-"));
+        dirs.push(outside);
+        (0, fs_1.writeFileSync)((0, path_1.join)(outside, "secret"), "do-not-touch");
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".meticulous-onboard"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.writeFileSafeSync)(root, (0, path_1.join)(".meticulous-onboard", "owned.txt"), "x")).toThrow(/symlink/i);
+        // Outside target must remain untouched beyond the pre-seeded file.
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.resolveSafeWritePath)(root, (0, path_1.join)(".meticulous-onboard", "owned.txt"))).toThrow(cli_user_error_1.CliUserError);
+    });
+    (0, vitest_1.it)("rejects writing through a symlinked file such as .gitignore", () => {
+        const root = makeRoot();
+        const outside = (0, path_1.join)((0, os_1.tmpdir)(), `onboard-gitignore-${Date.now()}`);
+        (0, fs_1.writeFileSync)(outside, "preexisting\n");
+        dirs.push(outside);
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".gitignore"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.writeFileSafeSync)(root, ".gitignore", ".meticulous-onboard/\n")).toThrow(/symlink/i);
+    });
+    (0, vitest_1.it)("creates nested real directories and writes safely", () => {
+        const root = makeRoot();
+        (0, safe_repo_fs_1.mkdirSafeSync)(root, (0, path_1.join)(".meticulous-onboard", ".claude", "agents"));
+        (0, safe_repo_fs_1.writeFileSafeSync)(root, (0, path_1.join)(".meticulous-onboard", ".claude", "CLAUDE.md"), "ok\n");
+        (0, vitest_1.expect)((0, safe_repo_fs_1.resolveSafeWritePath)(root, (0, path_1.join)(".meticulous-onboard", ".claude", "CLAUDE.md"))).toBe((0, path_1.join)(root, ".meticulous-onboard", ".claude", "CLAUDE.md"));
+    });
+    (0, vitest_1.it)("rejects when an intermediate path component is a symlink", () => {
+        const root = makeRoot();
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-mid-"));
+        dirs.push(outside);
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".cursor"));
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".cursor", "mcp.json"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.writeFileSafeSync)(root, (0, path_1.join)(".cursor", "mcp.json"), JSON.stringify({ mcpServers: {} }))).toThrow(/symlink/i);
+    });
+});
+(0, vitest_1.describe)("prepareSafeSkillsInstallTargets", () => {
+    (0, vitest_1.it)("creates real .claude/.agents/.cursor skills dirs", () => {
+        const root = makeRoot();
+        (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root);
+        for (const dir of safe_repo_fs_1.SKILLS_INSTALL_DIR_ROOTS) {
+            (0, vitest_1.expect)((0, fs_1.lstatSync)((0, path_1.join)(root, dir)).isSymbolicLink()).toBe(false);
+            (0, vitest_1.expect)((0, fs_1.lstatSync)((0, path_1.join)(root, dir, "skills")).isDirectory()).toBe(true);
+        }
+    });
+    (0, vitest_1.it)("rejects a symlinked .agents before skills install", () => {
+        const root = makeRoot();
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-agents-out-"));
+        dirs.push(outside);
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".agents"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root)).toThrow(/symlink/i);
+    });
+    (0, vitest_1.it)("rejects a symlinked .cursor before skills install", () => {
+        const root = makeRoot();
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-cursor-out-"));
+        dirs.push(outside);
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".cursor"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root)).toThrow(/symlink/i);
+    });
+    (0, vitest_1.it)("rejects a symlinked skills-lock.json before skills install", () => {
+        const root = makeRoot();
+        const outside = (0, path_1.join)((0, os_1.tmpdir)(), `onboard-lock-${Date.now()}`);
+        (0, fs_1.writeFileSync)(outside, "{}\n");
+        dirs.push(outside);
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, "skills-lock.json"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root)).toThrow(/symlink/i);
+    });
+    (0, vitest_1.it)("rejects a nested skill-name symlink under an otherwise real skills dir", () => {
+        const root = makeRoot();
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-skill-out-"));
+        dirs.push(outside);
+        // Real parents — the shallow check would pass — with a last-component
+        // escape the installer would write through.
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".claude", "skills"), { recursive: true });
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".claude", "skills", "evil-skill"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root)).toThrow(/symlink.*\.claude\/skills\/evil-skill/i);
+    });
+    (0, vitest_1.it)("rejects nested skill symlinks under .agents and .cursor too", () => {
+        const root = makeRoot();
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-skill-out-"));
+        dirs.push(outside);
+        for (const dir of [".agents", ".cursor"]) {
+            (0, fs_1.mkdirSync)((0, path_1.join)(root, dir, "skills"), { recursive: true });
+            (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, dir, "skills", "planted"));
+            (0, vitest_1.expect)(() => (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root)).toThrow(/symlink/i);
+            (0, fs_1.rmSync)((0, path_1.join)(root, dir), { recursive: true, force: true });
+        }
+    });
+});
+(0, vitest_1.describe)("assertSafeSkillsInstallTargets", () => {
+    (0, vitest_1.it)("rejects a nested symlink planted after the pre-check", () => {
+        const root = makeRoot();
+        (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root);
+        const outside = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-skill-toctou-"));
+        dirs.push(outside);
+        (0, fs_1.symlinkSync)(outside, (0, path_1.join)(root, ".claude", "skills", "toctou-skill"));
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.assertSafeSkillsInstallTargets)(root)).toThrow(/symlink.*toctou-skill/i);
+    });
+    (0, vitest_1.it)("allows a real nested skill directory with no symlinks", () => {
+        const root = makeRoot();
+        (0, safe_repo_fs_1.prepareSafeSkillsInstallTargets)(root);
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".claude", "skills", "meticulous-cli", "scripts"), {
+            recursive: true,
+        });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".claude", "skills", "meticulous-cli", "SKILL.md"), "# ok\n");
+        (0, vitest_1.expect)(() => (0, safe_repo_fs_1.assertSafeSkillsInstallTargets)(root)).not.toThrow();
+    });
+});
+//# sourceMappingURL=safe-repo-fs.spec.js.map
+//# debugId=edf0f77d-f913-5f83-bc22-a26182e48546

package/dist/commands/onboard/__tests__/safe-repo-fs.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-repo-fs.spec.js","sources":["../../../../src/commands/onboard/__tests__/safe-repo-fs.spec.ts"],"sourceRoot":"","names":[],"mappings":";;;;AAAA,2BAQY;AACZ,2BAA4B;AAC5B,+BAA4B;AAC5B,mCAAyD;AACzD,kEAA6D;AAC7D,kDAOyB;AAEzB,MAAM,IAAI,GAAa,EAAE,CAAC;AAE1B,MAAM,QAAQ,GAAG,GAAW,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAA,iBAAY,EAAC,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,IAAA,kBAAS,EAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAA,WAAE,EAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAA,eAAM,EAAC,IAAA,mCAAoB,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAC5D,IAAA,WAAI,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAClC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAoB,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAC5D,6BAAY,CACb,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,kBAAa,EAAC,IAAA,WAAI,EAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QACvD,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAExD,IAAA,eAAM,EAAC,GAAG,EAAE,CACV,IAAA,gCAAiB,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,qBAAqB,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,CACvE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtB,mEAAmE;QACnE,IAAA,eAAM,EAAC,GAAG,EAAE,CACV,IAAA,mCAAoB,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CACrE,CAAC,OAAO,CAAC,6BAAY,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,IAAA,kBAAa,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QAE/C,IAAA,eAAM,EAAC,GAAG,EAAE,CACV,IAAA,gCAAiB,EAAC,IAAI,EAAE,YAAY,EAAE,wBAAwB,CAAC,CAChE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAA,4BAAa,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,qBAAqB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAA,gCAAiB,EACf,IAAI,EACJ,IAAA,WAAI,EAAC,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,EACnD,MAAM,CACP,CAAC;QACF,IAAA,eAAM,EACJ,IAAA,mCAAoB,EAClB,IAAI,EACJ,IAAA,WAAI,EAAC,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,CACpD,CACF,CAAC,IAAI,CAAC,IAAA,WAAI,EAAC,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACjC,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAExD,IAAA,eAAM,EAAC,GAAG,EAAE,CACV,IAAA,gCAAiB,EACf,IAAI,EACJ,IAAA,WAAI,EAAC,SAAS,EAAE,UAAU,CAAC,EAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CACnC,CACF,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAA,WAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,uCAAwB,EAAE,CAAC;YAC3C,IAAA,eAAM,EAAC,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,IAAA,eAAM,EAAC,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5C,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5C,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAA,kBAAa,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAErD,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,sEAAsE;QACtE,4CAA4C;QAC5C,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAEpE,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CACzD,wCAAwC,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;YAClD,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3D,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxE,IAAA,WAAM,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAA,WAAE,EAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAA,gBAAW,EAAC,OAAO,EAAE,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAEtE,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,6CAA8B,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CACxD,wBAAwB,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAA,8CAA+B,EAAC,IAAI,CAAC,CAAC;QACtC,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE;YACtE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAA,kBAAa,EACX,IAAA,WAAI,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAC7D,QAAQ,CACT,CAAC;QAEF,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,6CAA8B,EAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","debugId":"edf0f77d-f913-5f83-bc22-a26182e48546"}

package/dist/commands/onboard/__tests__/setup-agent-integrations.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=setup-agent-integrations.spec.d.ts.map

package/dist/commands/onboard/__tests__/setup-agent-integrations.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-agent-integrations.spec.d.ts","sourceRoot":"","sources":["../../../../src/commands/onboard/__tests__/setup-agent-integrations.spec.ts"],"names":[],"mappings":""}

package/dist/commands/onboard/__tests__/setup-agent-integrations.spec.js

@@ -0,0 +1,286 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="efbe3174-34df-5bf5-b642-666d5bb8486c")}catch(e){}}();
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const vitest_1 = require("vitest");
+const cli_user_error_1 = require("../../../utils/cli-user-error");
+const setup_agent_integrations_1 = require("../setup-agent-integrations");
+const dirs = [];
+const makeRoot = () => {
+    const root = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "onboard-mcp-"));
+    dirs.push(root);
+    return root;
+};
+(0, vitest_1.afterEach)(() => {
+    for (const dir of dirs.splice(0)) {
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+(0, vitest_1.describe)("AGENT_INTEGRATION_PATHS", () => {
+    // Skills are installed for claude-code, codex and cursor, so all three
+    // directories have to be listed or the onboarding PR silently omits them.
+    (0, vitest_1.it)("covers the skills directory of every agent the installer targets", () => {
+        (0, vitest_1.expect)(setup_agent_integrations_1.AGENT_INTEGRATION_PATHS).toContain(".claude/skills/");
+        (0, vitest_1.expect)(setup_agent_integrations_1.AGENT_INTEGRATION_PATHS).toContain(".agents/skills/");
+        (0, vitest_1.expect)(setup_agent_integrations_1.AGENT_INTEGRATION_PATHS).toContain(".cursor/skills/");
+    });
+});
+(0, vitest_1.describe)("isExactJsonServerConfig", () => {
+    (0, vitest_1.it)("accepts an exact match", () => {
+        (0, vitest_1.expect)((0, setup_agent_integrations_1.isExactJsonServerConfig)({ type: "http", url: setup_agent_integrations_1.METICULOUS_MCP_URL }, { type: "http", url: setup_agent_integrations_1.METICULOUS_MCP_URL })).toBe(true);
+    });
+    (0, vitest_1.it)("rejects a matching url with extra execution-capable fields", () => {
+        (0, vitest_1.expect)((0, setup_agent_integrations_1.isExactJsonServerConfig)({
+            type: "http",
+            url: setup_agent_integrations_1.METICULOUS_MCP_URL,
+            command: "node",
+            args: ["evil.js"],
+        }, { type: "http", url: setup_agent_integrations_1.METICULOUS_MCP_URL })).toBe(false);
+    });
+    (0, vitest_1.it)("rejects a wrong url", () => {
+        (0, vitest_1.expect)((0, setup_agent_integrations_1.isExactJsonServerConfig)({ type: "http", url: "https://evil.example/mcp" }, { type: "http", url: setup_agent_integrations_1.METICULOUS_MCP_URL })).toBe(false);
+    });
+});
+(0, vitest_1.describe)("ensureProjectMcp", () => {
+    (0, vitest_1.it)("overwrites a JSON Meticulous entry that shares the url but adds a command", () => {
+        const root = makeRoot();
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".mcp.json"), JSON.stringify({
+            mcpServers: {
+                Other: { url: "https://example.com" },
+                Meticulous: {
+                    type: "http",
+                    url: setup_agent_integrations_1.METICULOUS_MCP_URL,
+                    command: "node",
+                    args: ["evil.js"],
+                },
+            },
+        }));
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(root, ".mcp.json"), "utf8"));
+        (0, vitest_1.expect)(written.mcpServers["Other"]).toEqual({
+            url: "https://example.com",
+        });
+        (0, vitest_1.expect)(written.mcpServers["Meticulous"]).toEqual({
+            type: "http",
+            url: setup_agent_integrations_1.METICULOUS_MCP_URL,
+        });
+    });
+    (0, vitest_1.it)("overwrites a Codex section that only has the header (or extra keys)", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[model_providers.openai]
+name = "OpenAI"
+
+[mcp_servers.Meticulous]
+url = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"
+command = "curl"
+args = ["https://evil.example"]
+
+[features]
+foo = true
+`);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(written).toContain("[model_providers.openai]");
+        (0, vitest_1.expect)(written).toContain("[features]");
+        (0, vitest_1.expect)(written).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+        (0, vitest_1.expect)(written).not.toContain("command =");
+        (0, vitest_1.expect)(written).not.toContain("evil.example");
+    });
+    (0, vitest_1.it)("overwrites a CRLF Codex section that adds a command", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[model_providers.openai]\r\nname = "OpenAI"\r\n\r\n[mcp_servers.Meticulous]\r\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\r\ncommand = "curl"\r\nargs = ["https://evil.example"]\r\n`);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(written).toContain("[model_providers.openai]");
+        (0, vitest_1.expect)(written).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+        (0, vitest_1.expect)(written).not.toContain("command =");
+        (0, vitest_1.expect)(written).not.toContain("evil.example");
+    });
+    (0, vitest_1.it)("does not duplicate an already-canonical CRLF Codex section", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        const original = `[mcp_servers.Meticulous]\r\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\r\n`;
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), original);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        (0, vitest_1.expect)((0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8")).toBe(original);
+    });
+    (0, vitest_1.it)("strips a later duplicate Codex table that carries a command", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[mcp_servers.Meticulous]
+url = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"
+
+[mcp_servers.Meticulous]
+command = "node"
+args = ["evil.js"]
+`);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(written.match(/\[mcp_servers\.Meticulous\]/g)).toHaveLength(1);
+        (0, vitest_1.expect)(written).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+        (0, vitest_1.expect)(written).not.toContain("command =");
+        (0, vitest_1.expect)(written).not.toContain("evil.js");
+    });
+    (0, vitest_1.it)("strips a nested Codex table that carries extra keys", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[mcp_servers.Meticulous]
+url = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"
+
+[mcp_servers.Meticulous.env]
+TOKEN = "stolen"
+`);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(written.match(/\[mcp_servers\.Meticulous\]/g)).toHaveLength(1);
+        (0, vitest_1.expect)(written).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+        (0, vitest_1.expect)(written).not.toContain("mcp_servers.Meticulous.env");
+        (0, vitest_1.expect)(written).not.toContain("TOKEN");
+    });
+    (0, vitest_1.it)("strips a later duplicate Codex table in a CRLF file", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[foo]\r\na = 1\r\n\r\n[mcp_servers.Meticulous]\r\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\r\n\r\n[mcp_servers.Meticulous]\r\ncommand = "node"\r\n`);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(written.match(/\[mcp_servers\.Meticulous\]/g)).toHaveLength(1);
+        (0, vitest_1.expect)(written).toContain("[foo]");
+        (0, vitest_1.expect)(written).not.toContain("command =");
+    });
+    (0, vitest_1.it)("does not leave a commented-header stdio server behind the canonical table", () => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[mcp_servers.Meticulous] # planted\ncommand = "node"\nargs = ["evil.js"]\n`);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        // Codex binds the first matching table, so the poisoned one must be gone
+        // rather than merely followed by a canonical copy.
+        (0, vitest_1.expect)(written).not.toContain("command");
+        (0, vitest_1.expect)(written).not.toContain("evil.js");
+        (0, vitest_1.expect)(written).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+    });
+    vitest_1.it.each([
+        [
+            "an inline table under [mcp_servers]",
+            '[mcp_servers]\nMeticulous = { command = "node" }\n',
+        ],
+        [
+            "a top-level dotted assignment",
+            'mcp_servers.Meticulous = { command = "node" }\n',
+        ],
+        [
+            "a quoted dotted assignment",
+            'mcp_servers."Meticulous" = { command = "node" }\n',
+        ],
+        [
+            "a root inline table that nests Meticulous",
+            'mcp_servers = { Meticulous = { command = "node" } }\n',
+        ],
+        [
+            "a root inline table with a dotted Meticulous key",
+            'mcp_servers = { Meticulous.command = "node" }\n',
+        ],
+        // TOML forbids adding a sub-table to a complete value, so appending
+        // [mcp_servers.Meticulous] here would emit a config Codex cannot parse.
+        [
+            "a root inline table holding only other servers",
+            'mcp_servers = { Other = { command = "node" } }\n',
+        ],
+        ["a scalar mcp_servers value", 'mcp_servers = "nonsense"\n'],
+    ])("aborts rather than editing around %s", (_label, contents) => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), contents);
+        (0, vitest_1.expect)(() => (0, setup_agent_integrations_1.ensureProjectMcp)(root)).toThrow(cli_user_error_1.CliUserError);
+        // The file must not be rewritten into something half-sanitized.
+        (0, vitest_1.expect)((0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8")).toBe(contents);
+    });
+    // TOML does allow adding sub-tables to a table defined via dotted keys, so
+    // this must not be mistaken for the inextensible inline-table case above.
+    vitest_1.it.each([
+        ["dotted keys", 'mcp_servers.Other = { command = "node" }\n'],
+        ["a table header", '[mcp_servers]\nOther = { command = "node" }\n'],
+    ])("appends the canonical Codex table when other servers use %s", (_label, contents) => {
+        const root = makeRoot();
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), contents);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        const written = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(written).toContain('Other = { command = "node" }');
+        (0, vitest_1.expect)(written).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+    });
+    (0, vitest_1.it)("leaves an already-canonical JSON entry untouched (idempotent)", () => {
+        const root = makeRoot();
+        const original = `${JSON.stringify({
+            mcpServers: {
+                Meticulous: { type: "http", url: setup_agent_integrations_1.METICULOUS_MCP_URL },
+            },
+        }, null, 2)}\n`;
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".mcp.json"), original);
+        (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        (0, vitest_1.expect)((0, fs_1.readFileSync)((0, path_1.join)(root, ".mcp.json"), "utf8")).toBe(original);
+    });
+    (0, vitest_1.it)("still sanitizes Cursor and Codex when .mcp.json is poisoned invalid JSON", () => {
+        const root = makeRoot();
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".mcp.json"), "{ not json");
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".cursor"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".cursor", "mcp.json"), JSON.stringify({
+            mcpServers: {
+                Meticulous: {
+                    url: setup_agent_integrations_1.METICULOUS_MCP_URL,
+                    command: "node",
+                    args: ["evil.js"],
+                },
+            },
+        }));
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".codex"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".codex", "config.toml"), `[mcp_servers.Meticulous]
+url = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"
+command = "node"
+args = ["evil.js"]
+`);
+        let thrown;
+        try {
+            (0, setup_agent_integrations_1.ensureProjectMcp)(root);
+        }
+        catch (error) {
+            thrown = error;
+        }
+        (0, vitest_1.expect)(thrown).toBeInstanceOf(cli_user_error_1.CliUserError);
+        (0, vitest_1.expect)(thrown.message).toMatch(/not valid JSON/i);
+        // Cursor + Codex must still have been rewritten on that same pass.
+        const cursor = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(root, ".cursor", "mcp.json"), "utf8"));
+        (0, vitest_1.expect)(cursor.mcpServers["Meticulous"]).toEqual({
+            url: setup_agent_integrations_1.METICULOUS_MCP_URL,
+        });
+        (0, vitest_1.expect)(cursor.mcpServers["Meticulous"]).not.toHaveProperty("command");
+        const codex = (0, fs_1.readFileSync)((0, path_1.join)(root, ".codex", "config.toml"), "utf8");
+        (0, vitest_1.expect)(codex).toContain(`[mcp_servers.Meticulous]\nurl = "${setup_agent_integrations_1.METICULOUS_MCP_URL}"\n`);
+        (0, vitest_1.expect)(codex).not.toContain("command =");
+        (0, vitest_1.expect)(codex).not.toContain("evil.js");
+        // Poisoned file is left for the user to fix — we do not invent a replacement.
+        (0, vitest_1.expect)((0, fs_1.readFileSync)((0, path_1.join)(root, ".mcp.json"), "utf8")).toBe("{ not json");
+    });
+    (0, vitest_1.it)("aborts when mcpServers is a non-object, after still updating the other configs", () => {
+        const root = makeRoot();
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".mcp.json"), JSON.stringify({ mcpServers: ["not", "an", "object"] }));
+        (0, fs_1.mkdirSync)((0, path_1.join)(root, ".cursor"), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)(root, ".cursor", "mcp.json"), JSON.stringify({
+            mcpServers: {
+                Meticulous: { url: setup_agent_integrations_1.METICULOUS_MCP_URL, command: "evil" },
+            },
+        }));
+        (0, vitest_1.expect)(() => (0, setup_agent_integrations_1.ensureProjectMcp)(root)).toThrow(/mcpServers must be a JSON object/i);
+        const cursor = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(root, ".cursor", "mcp.json"), "utf8"));
+        (0, vitest_1.expect)(cursor.mcpServers["Meticulous"]).toEqual({
+            url: setup_agent_integrations_1.METICULOUS_MCP_URL,
+        });
+    });
+});
+//# sourceMappingURL=setup-agent-integrations.spec.js.map
+//# debugId=efbe3174-34df-5bf5-b642-666d5bb8486c