@cellajs/cli 0.4.1 → 0.4.2

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env tsx
 
 // src/cella-cli.ts
-import { existsSync as existsSync12, statSync as statSync3 } from "fs";
-import { join as join18, resolve as resolve7 } from "path";
+import { existsSync as existsSync13, statSync as statSync3 } from "fs";
+import { join as join19, resolve as resolve7 } from "path";
 import process9 from "process";
 
 // src/cli.ts
@@ -219,7 +219,7 @@ import process4 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.4.1",
+  version: "0.4.2",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and syncing with upstream Cella.",
@@ -2872,13 +2872,18 @@ async function runAnalyze(config) {
 
 // src/services/audit.ts
 import { readFileSync as readFileSync4 } from "fs";
-import { basename as basename4, join as join12, relative as relative3 } from "path";
+import { basename as basename4, join as join13, relative as relative3 } from "path";
 import { checkbox, Separator } from "@inquirer/prompts";
 
 // src/utils/audit-utils.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 var execFileAsync2 = promisify2(execFile2);
+function outdatedPackageName(key) {
+  const name = key.split(" ")[0];
+  const at = name.indexOf("@", 1);
+  return at === -1 ? name : name.slice(0, at);
+}
 function getRepoUrl(repositoryUrl) {
   if (!repositoryUrl) return null;
   let url = repositoryUrl;
@@ -2973,6 +2978,13 @@ function formatDependents(dependents) {
   return `${dependents[0]} +${dependents.length - 1}`;
 }
 
+// src/utils/local-tools.ts
+import { execFile as execFile3 } from "child_process";
+import { existsSync as existsSync7, realpathSync as realpathSync2 } from "fs";
+import { tmpdir } from "os";
+import { delimiter, dirname as dirname6, join as join11, sep as sep2 } from "path";
+import { promisify as promisify3 } from "util";
+
 // src/utils/runtimes.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { basename as basename3, dirname as dirname5, join as join10 } from "path";
@@ -3094,24 +3106,23 @@ async function fetchImageTags(pin) {
   if (!Array.isArray(results)) return null;
   return { pinned: hubTag(pinned), tags: results.flatMap((entry) => hubTag(entry) ?? []) };
 }
+async function fetchPnpmAdvisories(version) {
+  const answer = await fetchJson("https://registry.npmjs.org/-/npm/v1/security/advisories/bulk", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ pnpm: [version] })
+  });
+  return answer ? answer.pnpm ?? [] : null;
+}
 async function fetchRuntimeFeeds(pins, cwd, now) {
   const nodeMajor = pins.node ? parseComparableVersion(pins.node)?.major : void 0;
   const [node, published, advisories, images] = await Promise.all([
     nodeMajor === void 0 ? null : fetchNodeReleases(nodeMajor, now),
     pins.pnpm ? fetchPublishTimes("pnpm", cwd) : null,
-    pins.pnpm ? fetchJson("https://registry.npmjs.org/-/npm/v1/security/advisories/bulk", {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ pnpm: [pins.pnpm] })
-    }) : null,
+    pins.pnpm ? fetchPnpmAdvisories(pins.pnpm) : null,
     Promise.all(pins.images.map(fetchImageTags))
   ]);
-  const pnpmAdvisories = advisories?.pnpm;
-  return {
-    node,
-    pnpm: published && advisories ? { published, advisories: pnpmAdvisories ?? [] } : null,
-    images
-  };
+  return { node, pnpm: published && advisories ? { published, advisories } : null, images };
 }
 var count = (n, noun, plural2 = `${noun}s`) => `${n} ${n === 1 ? noun : plural2}`;
 var monthYear = (time) => new Date(time).toLocaleString("en", { month: "short", year: "numeric", timeZone: "UTC" }).toLowerCase();
@@ -3341,6 +3352,130 @@ function liveExcludes(input) {
   });
 }
 
+// src/utils/local-tools.ts
+var execFileAsync3 = promisify3(execFile3);
+function findOnPath(name, skip = []) {
+  for (const dir of (getEnv("PATH") ?? "").split(delimiter)) {
+    if (!dir || skip.includes(dir) || dir.endsWith(`node_modules${sep2}.bin`)) continue;
+    if (existsSync7(join11(dir, name))) return join11(dir, name);
+  }
+  return null;
+}
+function installerOf(file) {
+  let real = file;
+  try {
+    real = realpathSync2(file);
+  } catch {
+  }
+  if (real.includes(`${sep2}.volta${sep2}`)) return "volta";
+  return /[\\/](Cellar|homebrew|linuxbrew)[\\/]/.test(real) ? "brew" : null;
+}
+async function versionOf(file, cwd) {
+  try {
+    const { stdout } = await execFileAsync3(file, ["--version"], { encoding: "utf8", timeout: 1e4, cwd });
+    return stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function readNode(now) {
+  const version = process.version.slice(1);
+  const major = parseComparableVersion(version)?.major ?? 0;
+  return { version, installer: installerOf(process.execPath), releases: await fetchNodeReleases(major, now) };
+}
+async function readPnpm(cwd) {
+  const running = getEnv("npm_execpath");
+  const file = findOnPath("pnpm", running ? [dirname6(running)] : []);
+  const version = file && await versionOf(file, tmpdir());
+  if (!file || !version) return null;
+  const [published, advisories] = await Promise.all([fetchPublishTimes("pnpm", cwd), fetchPnpmAdvisories(version)]);
+  return { version, installer: installerOf(file), published, advisories };
+}
+async function fetchOsvSeverities(module, version) {
+  const answer = await fetchJson("https://api.osv.dev/v1/query", {
+    method: "POST",
+    body: JSON.stringify({ package: { name: module, ecosystem: "Go" }, version })
+  });
+  if (!answer) return null;
+  const byGhsa = /* @__PURE__ */ new Map();
+  for (const vuln of answer.vulns ?? []) {
+    const id = [vuln.id, ...vuln.aliases ?? []].find((alias) => alias.startsWith("GHSA-")) ?? vuln.id;
+    const severity = SEVERITIES.find((level) => level === vuln.database_specific?.severity?.toLowerCase());
+    if (severity || !byGhsa.has(id)) byGhsa.set(id, severity ?? "moderate");
+  }
+  return [...byGhsa.values()];
+}
+async function readGh() {
+  const file = findOnPath("gh");
+  const version = file && await versionOf(file);
+  if (!file || !version) return null;
+  const [list, advisories] = await Promise.all([
+    fetchJson("https://api.github.com/repos/cli/cli/releases?per_page=30"),
+    fetchOsvSeverities("github.com/cli/cli/v2", version)
+  ]);
+  const releases = Array.isArray(list) ? list.flatMap((entry) => {
+    const { tag_name, published_at } = entry;
+    const publishedAt = Date.parse(published_at ?? "");
+    return tag_name && !Number.isNaN(publishedAt) ? [{ version: tag_name.replace(/^v/, ""), publishedAt }] : [];
+  }) : null;
+  return { version, installer: installerOf(file), releases, advisories };
+}
+async function readLocalTools(cwd, now) {
+  const [node, pnpm, gh] = await Promise.all([readNode(now), readPnpm(cwd), readGh()]);
+  return { node, pnpm, gh };
+}
+function upgradeCommand(name, installer, target) {
+  if (installer === "brew") return `brew upgrade ${name}`;
+  if (!target) return "no fixed release older than the release age yet";
+  if (installer === "volta") return `volta install ${name}@${target}`;
+  return name === "pnpm" ? `pnpm self-update ${target}` : `update to ${target}`;
+}
+function toCheck(name, tool, missed, target, noun) {
+  if (!missed)
+    return { name, version: tool.version, severity: null, note: "not checked, no answer from the feed", fix: "" };
+  if (missed.length === 0) return { name, version: tool.version, severity: null, note: "", fix: "" };
+  const high = missed.filter((severity) => severity === "critical" || severity === "high").length;
+  return {
+    name,
+    version: tool.version,
+    severity: SEVERITIES.find((severity) => missed.includes(severity)) ?? null,
+    note: `${plural(missed.length, ...noun)}${high > 0 && high < missed.length ? `, ${high} high` : ""}`,
+    fix: upgradeCommand(name, tool.installer, target)
+  };
+}
+function planLocalTools(tools, options) {
+  const cutoff = options.now - options.releaseAgeMinutes * 60 * 1e3;
+  const { node, pnpm, gh } = tools;
+  const nodeTarget = node.releases ? newestAged(node.version, node.releases, cutoff) : void 0;
+  const securityReleases = (node.releases ?? []).filter(
+    (release) => release.security && nodeTarget && compareVersionStrings(release.version, node.version) > 0 && compareVersionStrings(release.version, nodeTarget.version) <= 0
+  );
+  const checks = [
+    toCheck(
+      "node",
+      node,
+      node.releases && securityReleases.map(() => "high"),
+      nodeTarget?.version,
+      ["security release", "security releases"]
+    )
+  ];
+  if (pnpm) {
+    const affecting = (version) => (pnpm.advisories ?? []).filter((advisory) => satisfiesComparators(version, advisory.vulnerable_versions));
+    const fixed = Object.entries(pnpm.published ?? {}).map(([version, time]) => ({ version, publishedAt: Date.parse(time) })).filter(
+      (release) => parseComparableVersion(release.version) && !isPrerelease(release.version) && release.publishedAt <= cutoff && compareVersionStrings(release.version, pnpm.version) > 0 && affecting(release.version).length === 0
+    ).sort((a, b) => compareVersionStrings(b.version, a.version));
+    const major = parseComparableVersion(pnpm.version)?.major;
+    const target = fixed.find((release) => parseComparableVersion(release.version)?.major === major) ?? fixed[0];
+    const missed = pnpm.advisories && pnpm.published && affecting(pnpm.version).map((advisory) => advisory.severity);
+    checks.push(toCheck("pnpm", pnpm, missed, target?.version, ["advisory", "advisories"]));
+  }
+  if (gh) {
+    const target = gh.releases ? newestAged(gh.version, gh.releases, cutoff) : void 0;
+    checks.push(toCheck("gh", gh, gh.advisories, target?.version, ["advisory", "advisories"]));
+  }
+  return checks;
+}
+
 // src/utils/workspace-yaml.ts
 import { isMap, isScalar, isSeq, parseDocument } from "yaml";
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -3421,37 +3556,37 @@ function writeAuditSettings(content, next) {
 
 // src/services/audit-security.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { cpSync, existsSync as existsSync7, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir } from "os";
-import { dirname as dirname6, join as join11, relative as relative2 } from "path";
+import { cpSync, existsSync as existsSync8, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname7, join as join12, relative as relative2 } from "path";
 import { confirm, select as select2 } from "@inquirer/prompts";
 var WORKSPACE_FILE = "pnpm-workspace.yaml";
 var LOCK_FILE = "pnpm-lock.yaml";
 var RESOLUTION_FILES = ["package.json", LOCK_FILE, ".npmrc", ".pnpmfile.cjs"];
-var readOr = (path, fallback = "") => existsSync7(path) ? readFileSync3(path, "utf8") : fallback;
+var readOr = (path, fallback = "") => existsSync8(path) ? readFileSync3(path, "utf8") : fallback;
 var count2 = (n, noun, plural2 = `${noun}s`) => `${n} ${n === 1 ? noun : plural2}`;
 var isBreaking = (item) => item.remedy.kind !== "none" && item.remedy.breaking;
 var needsDecision = (item) => item.standing === "new" && (item.remedy.kind !== "override" || item.remedy.breaking || item.direct);
 var sameEntries = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([key, value]) => b[key] === value);
 async function createStaging(forkPath, workspaceYaml) {
-  const staging = mkdtempSync(join11(tmpdir(), "cella-audit-"));
+  const staging = mkdtempSync(join12(tmpdir2(), "cella-audit-"));
   const projects = await runPnpmJson(["ls", "-r", "--depth", "-1", "--json"], forkPath) ?? [];
   const files = [
     ...RESOLUTION_FILES,
     ...readPatchFiles(workspaceYaml),
-    ...projects.map((project) => join11(relative2(forkPath, project.path), "package.json"))
+    ...projects.map((project) => join12(relative2(forkPath, project.path), "package.json"))
   ];
   for (const file of new Set(files)) {
-    if (file.startsWith("..") || !existsSync7(join11(forkPath, file))) continue;
-    mkdirSync2(dirname6(join11(staging, file)), { recursive: true });
-    cpSync(join11(forkPath, file), join11(staging, file));
+    if (file.startsWith("..") || !existsSync8(join12(forkPath, file))) continue;
+    mkdirSync2(dirname7(join12(staging, file)), { recursive: true });
+    cpSync(join12(forkPath, file), join12(staging, file));
   }
   return staging;
 }
 async function resolveStaging(staging, workspaceYaml, settings) {
-  writeFileSync2(join11(staging, WORKSPACE_FILE), writeAuditSettings(workspaceYaml, settings));
+  writeFileSync2(join12(staging, WORKSPACE_FILE), writeAuditSettings(workspaceYaml, settings));
   const result = await runPnpm(["install", "--lockfile-only", "--no-frozen-lockfile", "--ignore-scripts"], staging);
-  return result.ok ? { lock: readOr(join11(staging, LOCK_FILE)) } : { error: `${result.stdout}${result.stderr}`.trim() };
+  return result.ok ? { lock: readOr(join12(staging, LOCK_FILE)) } : { error: `${result.stdout}${result.stderr}`.trim() };
 }
 function lockedVersions(lock, name) {
   const escaped = name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
@@ -3555,8 +3690,8 @@ function changeLine(label, before, after) {
 var NO_EDITS = { manifests: {}, files: {} };
 async function runSecurityPass(forkPath, options) {
   const { releaseAgeMinutes, edits = NO_EDITS } = options;
-  const workspaceYaml = readOr(join11(forkPath, WORKSPACE_FILE));
-  const workspaceLock = readOr(join11(forkPath, LOCK_FILE));
+  const workspaceYaml = readOr(join12(forkPath, WORKSPACE_FILE));
+  const workspaceLock = readOr(join12(forkPath, LOCK_FILE));
   let previous;
   try {
     previous = readAuditSettings(workspaceYaml);
@@ -3582,7 +3717,7 @@ async function runSecurityPass(forkPath, options) {
   };
   const staging = await createStaging(forkPath, workspaceYaml);
   try {
-    for (const [file, content] of Object.entries(edits.manifests)) writeFileSync2(join11(staging, file), content);
+    for (const [file, content] of Object.entries(edits.manifests)) writeFileSync2(join12(staging, file), content);
     const bare = await resolveStaging(staging, workspaceYaml, { ...previous, overrides: lasting, ignoredGhsas: [] });
     if ("error" in bare) {
       const without = updatesManifests ? "with the selected updates" : "without its audit overrides";
@@ -3634,7 +3769,7 @@ async function runSecurityPass(forkPath, options) {
     const settingsChanged = nextYaml !== workspaceYaml;
     const otherFiles = Object.keys(edits.files);
     const writeFiles = () => {
-      for (const [file, content] of Object.entries(edits.files)) writeFileSync2(join11(forkPath, file), content);
+      for (const [file, content] of Object.entries(edits.files)) writeFileSync2(join12(forkPath, file), content);
       if (otherFiles.length > 0) console.info(`${checkMark} ${otherFiles.join(", ")} updated`);
     };
     if (!settingsChanged && !updatesManifests) {
@@ -3654,7 +3789,7 @@ async function runSecurityPass(forkPath, options) {
     };
     if (!updatesManifests && sameEntries(next.overrides, previous.overrides)) {
       writeFiles();
-      writeFileSync2(join11(forkPath, WORKSPACE_FILE), nextYaml);
+      writeFileSync2(join12(forkPath, WORKSPACE_FILE), nextYaml);
       console.info(`${checkMark} ${WORKSPACE_FILE} updated ${colors_default.dim("\xB7 nothing to install")}`);
       printOpen(open);
       summarize();
@@ -3665,14 +3800,14 @@ async function runSecurityPass(forkPath, options) {
     stagingSpinner.stop();
     if ("error" in staged) return fail("could not resolve the workspace with the new settings", staged.error);
     const written = { ...edits.files, ...edits.manifests, [WORKSPACE_FILE]: nextYaml, [LOCK_FILE]: staged.lock };
-    const before = Object.fromEntries(Object.keys(written).map((file) => [file, readOr(join11(forkPath, file))]));
+    const before = Object.fromEntries(Object.keys(written).map((file) => [file, readOr(join12(forkPath, file))]));
     before[WORKSPACE_FILE] = workspaceYaml;
     before[LOCK_FILE] = workspaceLock;
-    for (const [file, content] of Object.entries(written)) writeFileSync2(join11(forkPath, file), content);
+    for (const [file, content] of Object.entries(written)) writeFileSync2(join12(forkPath, file), content);
     const install = spawnSync2("pnpm", ["install"], { cwd: forkPath, stdio: "inherit" });
     console.info();
     if (install.status !== 0) {
-      for (const [file, content] of Object.entries(before)) writeFileSync2(join11(forkPath, file), content);
+      for (const [file, content] of Object.entries(before)) writeFileSync2(join12(forkPath, file), content);
       console.error(`${colors_default.red("\u2717")} pnpm install failed (exit code ${install.status})`);
       console.info(colors_default.dim(`  ${Object.keys(before).join(", ")} are back as they were; run pnpm install to match`));
       console.info();
@@ -3741,7 +3876,7 @@ function createDependentPkgReader() {
     let cached = cache.get(location);
     if (cached === void 0) {
       try {
-        cached = JSON.parse(readFileSync4(join12(location, "package.json"), "utf8"));
+        cached = JSON.parse(readFileSync4(join13(location, "package.json"), "utf8"));
       } catch {
         cached = null;
       }
@@ -3756,11 +3891,12 @@ async function runAudit(config) {
   try {
     const pins = await readRuntimePins(forkPath);
     const now = Date.now();
-    const [outdated, auditResult, releaseAgeMinutes, feeds] = await Promise.all([
+    const [outdated, auditResult, releaseAgeMinutes, feeds, machine] = await Promise.all([
       runPnpmJson(["-r", "outdated", "--json", "--long"], forkPath),
       runPnpmAudit(forkPath),
       readReleaseAgeMinutes(forkPath),
-      fetchRuntimeFeeds(pins, forkPath, now)
+      fetchRuntimeFeeds(pins, forkPath, now),
+      readLocalTools(forkPath, now)
     ]);
     if (!outdated) {
       spinnerFail("pnpm outdated gave no answer: run pnpm -r outdated to see why");
@@ -3768,6 +3904,7 @@ async function runAudit(config) {
       return;
     }
     const runtimes = planRuntimeUpdates(pins, feeds, { releaseAgeMinutes, now });
+    const localTools = planLocalTools(machine, { releaseAgeMinutes, now });
     const rows = [
       ...packageRows(outdated, auditResult ? advisoriesFromAudit(auditResult) : []),
       ...runtimes.updates.map(runtimeRow)
@@ -3776,6 +3913,7 @@ async function runAudit(config) {
       spinnerSuccess("all packages and runtimes are up to date");
       printNotes(forkPath, runtimes.unchecked);
       console.info();
+      printLocalTools(localTools);
       await runSecurityPass(forkPath, { apply: !config.list, releaseAgeMinutes });
       return;
     }
@@ -3783,6 +3921,7 @@ async function runAudit(config) {
     printOutdatedResults(rows, forkPath);
     printNotes(forkPath, runtimes.unchecked);
     console.info();
+    printLocalTools(localTools);
     if (config.list) {
       await runSecurityPass(forkPath, { apply: false, releaseAgeMinutes });
       return;
@@ -3798,7 +3937,8 @@ async function runAudit(config) {
 function packageRows(outdated, advisories) {
   const severityOf = (name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
   const readDependentPkg = createDependentPkgReader();
-  const rows = Object.entries(outdated).map(([name, pkg]) => {
+  const rows = Object.entries(outdated).map(([key, pkg]) => {
+    const name = outdatedPackageName(key);
     const repoUrl = getRepoUrl(pkg.latestManifest?.repository?.url);
     const current = pkg.current ?? "missing";
     const pinnedIn = [];
@@ -3809,6 +3949,7 @@ function packageRows(outdated, advisories) {
       }
     }
     return {
+      key,
       name,
       current,
       latest: pkg.latest,
@@ -3825,6 +3966,7 @@ function packageRows(outdated, advisories) {
 }
 function runtimeRow(update) {
   return {
+    key: `runtime:${update.file}:${update.name}`,
     name: update.name,
     current: update.current,
     latest: update.target,
@@ -3838,7 +3980,6 @@ function runtimeRow(update) {
     runtime: update
   };
 }
-var rowKey = (row) => row.runtime ? `runtime:${row.runtime.file}:${row.name}` : row.name;
 var isRed = (row) => row.severity === "critical" || row.severity === "high";
 var inText = (row) => row.runtime ? pinLocation(row.runtime.file) : formatDependents(row.dependentPackages.map((d) => d.name));
 function printOutdatedResults(rows, forkPath) {
@@ -3894,7 +4035,7 @@ function printOutdatedResults(rows, forkPath) {
   const sortedDependents = [...dependentMap.entries()].sort((a, b) => a[0].localeCompare(b[0]));
   const maxDependentNameLen = Math.max(0, ...sortedDependents.map(([name]) => name.length));
   for (const [dependentName, { location, count: count3 }] of sortedDependents) {
-    const packageJsonPath2 = join12(location, "package.json");
+    const packageJsonPath2 = join13(location, "package.json");
     const relativePath = relative3(forkPath, packageJsonPath2);
     const paddedName = dependentName.padEnd(maxDependentNameLen);
     console.info(
@@ -3905,7 +4046,7 @@ function printOutdatedResults(rows, forkPath) {
 function printNotes(forkPath, unchecked) {
   let held = [];
   try {
-    const updateConfig = readTopLevel(readFileSync4(join12(forkPath, "pnpm-workspace.yaml"), "utf8"), "updateConfig");
+    const updateConfig = readTopLevel(readFileSync4(join13(forkPath, "pnpm-workspace.yaml"), "utf8"), "updateConfig");
     const ignored = updateConfig?.ignoreDependencies;
     held = Array.isArray(ignored) ? ignored.map(String) : [];
   } catch {
@@ -3914,6 +4055,16 @@ function printNotes(forkPath, unchecked) {
   if (unchecked.length > 0)
     console.info(`  ${colors_default.dim(`not checked, no answer from the feed: ${unchecked.join(", ")}`)}`);
 }
+function printLocalTools(checks) {
+  const width = Math.max(...checks.map((tool) => `${tool.name} ${tool.version}`.length));
+  console.info(colors_default.bold("this machine"));
+  for (const tool of checks) {
+    const label = `${tool.name} ${tool.version}`.padEnd(width);
+    const detail = tool.severity ? `${tool.note} ${colors_default.dim("\xB7")} ${tool.fix}` : colors_default.dim(tool.note || "no missing security fixes");
+    console.info(`${tool.severity ? getVulnIcon(tool.severity) : " "} ${label}  ${detail}`);
+  }
+  console.info();
+}
 function buildUpdateChoices(rows) {
   const makeChoice = (row) => {
     const devTag = row.isDev ? colors_default.dim(" (dev)") : "";
@@ -3925,7 +4076,7 @@ function buildUpdateChoices(rows) {
     ].filter(Boolean);
     return {
       name: `${row.name}${devTag}  ${version}${notes.length > 0 ? `  ${notes.join("  ")}` : ""}`,
-      value: rowKey(row),
+      value: row.key,
       checked: isRed(row)
     };
   };
@@ -3985,17 +4136,17 @@ async function planEdits(forkPath, rows, selected, nodeImageSuffixes) {
   const summary = /* @__PURE__ */ new Map();
   const bumped = [];
   const edit = (file, label, item, resolves, change) => {
-    const entry = contents.get(file) ?? { content: readFileSync4(join12(forkPath, file), "utf8"), resolves: false };
+    const entry = contents.get(file) ?? { content: readFileSync4(join13(forkPath, file), "utf8"), resolves: false };
     const next = change(entry.content);
     if (next === entry.content) return;
     contents.set(file, { content: next, resolves: entry.resolves || resolves });
     summary.set(label, [...summary.get(label) ?? [], item]);
   };
-  const chosen = rows.filter((row) => selected.includes(rowKey(row)));
+  const chosen = rows.filter((row) => selected.includes(row.key));
   for (const row of chosen) {
     if (row.runtime) continue;
     for (const { name: dependent, location } of row.dependentPackages) {
-      const file = relative3(forkPath, join12(location, "package.json"));
+      const file = relative3(forkPath, join13(location, "package.json"));
       edit(
         file,
         dependent || file,
@@ -4069,7 +4220,7 @@ import { select as select3 } from "@inquirer/prompts";
 
 // src/services/contrib-core.ts
 import { rmSync as rmSync2 } from "fs";
-import { dirname as dirname7, join as join13, resolve as resolve4 } from "path";
+import { dirname as dirname8, join as join14, resolve as resolve4 } from "path";
 async function listFilesAtRef(repoPath, ref) {
   const raw = await git(["ls-tree", "-r", "--name-only", ref], repoPath);
   return new Set(raw.split("\n").filter(Boolean));
@@ -4085,10 +4236,10 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
   const baseFiles = await listFilesAtRef(repoPath, baseRef);
   const baseDirs = /* @__PURE__ */ new Set(["."]);
   for (const f of baseFiles) {
-    let dir = dirname7(f);
+    let dir = dirname8(f);
     while (dir !== ".") {
       baseDirs.add(dir);
-      dir = dirname7(dir);
+      dir = dirname8(dir);
     }
   }
   const files = [];
@@ -4101,7 +4252,7 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
     if (inCella && !inFork) {
       kind = "deleted";
     } else if (!inCella && inFork) {
-      if (!baseDirs.has(dirname7(file.path))) continue;
+      if (!baseDirs.has(dirname8(file.path))) continue;
       kind = "created";
     } else {
       kind = "modified";
@@ -4125,7 +4276,7 @@ async function readBlobInfo(repoPath, ref, filePath) {
 async function buildContribBranch(repoPath, baseRef, forkRef, files, forkName) {
   const branch = `contrib/${forkName}`;
   const gitDir = resolve4(repoPath, await git(["rev-parse", "--git-dir"], repoPath));
-  const tmpIndex = join13(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
+  const tmpIndex = join14(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
   const indexEnv = { GIT_INDEX_FILE: tmpIndex };
   try {
     await git(["read-tree", baseRef], repoPath, { env: indexEnv });
@@ -4160,20 +4311,20 @@ ${commitBody}`;
 }
 
 // src/services/fork-utils.ts
-import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname8, resolve as resolve5 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname9, resolve as resolve5 } from "path";
 async function resolveForkBasePath(repoPath) {
   const commonDir = await git(["rev-parse", "--git-common-dir"], repoPath, { ignoreErrors: true });
-  return commonDir ? dirname8(resolve5(repoPath, commonDir)) : repoPath;
+  return commonDir ? dirname9(resolve5(repoPath, commonDir)) : repoPath;
 }
 function validateForkPath(fork, basePath, requireConfig = false) {
   const resolvedPath = resolve5(basePath, fork.localPath);
   if (!resolvedPath.startsWith(resolve5(basePath, ".."))) {
     return { fork, resolvedPath, valid: false, error: "path resolves outside parent directory" };
   }
-  if (!existsSync8(resolvedPath)) return { fork, resolvedPath, valid: false, error: "path does not exist" };
-  if (!existsSync8(`${resolvedPath}/.git`)) return { fork, resolvedPath, valid: false, error: "not a git repository" };
-  if (requireConfig && !existsSync8(`${resolvedPath}/${CONFIG_FILE}`)) {
+  if (!existsSync9(resolvedPath)) return { fork, resolvedPath, valid: false, error: "path does not exist" };
+  if (!existsSync9(`${resolvedPath}/.git`)) return { fork, resolvedPath, valid: false, error: "not a git repository" };
+  if (requireConfig && !existsSync9(`${resolvedPath}/${CONFIG_FILE}`)) {
     return { fork, resolvedPath, valid: false, error: `missing ${CONFIG_FILE}` };
   }
   return { fork, resolvedPath, valid: true };
@@ -4524,12 +4675,12 @@ function closePr(cwd, ref) {
 }
 
 // src/services/packages.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join16 } from "path";
 
 // src/services/package-usage.ts
-import { existsSync as existsSync9, readFileSync as readFileSync5, statSync } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync5, statSync } from "fs";
+import { join as join15 } from "path";
 var MAX_FILE_BYTES = 1024 * 1024;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4545,7 +4696,7 @@ function readSearchable(filePath) {
 }
 function fileSource(forkPath, path) {
   let text;
-  return { path, label: path, text: () => text ??= readSearchable(join14(forkPath, path)) };
+  return { path, label: path, text: () => text ??= readSearchable(join15(forkPath, path)) };
 }
 async function readScriptsAtRef(forkPath, ref, path) {
   try {
@@ -4557,7 +4708,7 @@ async function readScriptsAtRef(forkPath, ref, path) {
 async function scriptSources(forkPath, upstreamRef, baseRef, path) {
   let forkScripts;
   try {
-    forkScripts = JSON.parse(readFileSync5(join14(forkPath, path), "utf8")).scripts ?? {};
+    forkScripts = JSON.parse(readFileSync5(join15(forkPath, path), "utf8")).scripts ?? {};
   } catch {
     return [];
   }
@@ -4567,9 +4718,9 @@ async function scriptSources(forkPath, upstreamRef, baseRef, path) {
 }
 function binNames(forkPath, location, name) {
   const bareName = name.split("/").pop();
-  for (const dir of [join14(forkPath, location), forkPath]) {
-    const manifest = join14(dir, "node_modules", name, "package.json");
-    if (!existsSync9(manifest)) continue;
+  for (const dir of [join15(forkPath, location), forkPath]) {
+    const manifest = join15(dir, "node_modules", name, "package.json");
+    if (!existsSync10(manifest)) continue;
     try {
       const { bin } = JSON.parse(readFileSync5(manifest, "utf8"));
       if (typeof bin === "string") return [bareName];
@@ -4750,7 +4901,7 @@ function setTopLevelKey(pkg, key, value) {
   Object.assign(pkg, Object.fromEntries(entries));
 }
 function readPackageJson(filePath) {
-  if (!existsSync10(filePath)) return null;
+  if (!existsSync11(filePath)) return null;
   try {
     return JSON.parse(readFileSync6(filePath, "utf8"));
   } catch (error) {
@@ -4784,13 +4935,13 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
   const changes = [];
   const kept = [];
   const pkgRelPath = packageJsonPath(relativePath);
-  const pkgPath = join15(forkPath, pkgRelPath);
+  const pkgPath = join16(forkPath, pkgRelPath);
   const forkPkg = readPackageJson(pkgPath);
   const upstream = await readPackageJsonAtRef(forkPath, upstreamRef, relativePath);
   const basePkg = baseRef ? (await readPackageJsonAtRef(forkPath, baseRef, relativePath))?.data : void 0;
   if (!upstream) return { updated: false, changes, kept };
   if (!forkPkg) {
-    const workspaceArrived = relativePath !== "" && existsSync10(join15(forkPath, relativePath));
+    const workspaceArrived = relativePath !== "" && existsSync11(join16(forkPath, relativePath));
     if (basePkg || !workspaceArrived || isIgnored(pkgRelPath, config)) return { updated: false, changes, kept };
     writeFileSync3(pkgPath, upstream.raw.endsWith("\n") ? upstream.raw : `${upstream.raw}
 `, "utf8");
@@ -5417,11 +5568,11 @@ async function runForks(config) {
 
 // src/services/stats.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/utils/coverage-utils.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { join as join16, relative as relative4, sep as sep2 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import { join as join17, relative as relative4, sep as sep3 } from "path";
 var STALE_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1e3;
 function colorPct(pct) {
   if (typeof pct !== "number" || !Number.isFinite(pct)) return colors_default.dim("n/a");
@@ -5439,11 +5590,11 @@ function formatAge(ms) {
   return `${mins} minute${mins === 1 ? "" : "s"} ago`;
 }
 function printCoverageSummary(forkPath) {
-  const file = join16(forkPath, ".coverage", "coverage-summary.json");
+  const file = join17(forkPath, ".coverage", "coverage-summary.json");
   let summary;
   let mtimeMs = 0;
   let problem = "no coverage data found";
-  if (existsSync11(file)) {
+  if (existsSync12(file)) {
     try {
       mtimeMs = statSync2(file).mtimeMs;
       summary = JSON.parse(readFileSync7(file, "utf8"));
@@ -5464,7 +5615,7 @@ function printCoverageSummary(forkPath) {
     if (key === "total") continue;
     const rel = relative4(forkPath, key);
     if (rel.startsWith("..")) continue;
-    const pkg = rel.split(sep2)[0];
+    const pkg = rel.split(sep3)[0];
     const acc = perPackage.get(pkg) ?? { covered: 0, total: 0 };
     acc.covered += entry.lines.covered;
     acc.total += entry.lines.total;
@@ -5490,7 +5641,7 @@ function printCoverageSummary(forkPath) {
 // src/services/stats.ts
 var sourceExtensions = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "json", "jsonc", "css", "html"]);
 async function getWorkspacePackages(forkPath) {
-  const content = await readFile3(join17(forkPath, "pnpm-workspace.yaml"), "utf8");
+  const content = await readFile3(join18(forkPath, "pnpm-workspace.yaml"), "utf8");
   const patterns = readTopLevel(content, "packages");
   return (Array.isArray(patterns) ? patterns.map(String) : []).map((pattern) => {
     if (pattern.endsWith("/*")) {
@@ -5538,9 +5689,9 @@ async function collectStats(forkPath) {
   const entries = [];
   for (const line of output.split("\n")) {
     if (!line) continue;
-    const sep3 = line.lastIndexOf(":");
-    if (sep3 === -1) continue;
-    entries.push({ path: line.slice(0, sep3), loc: Number.parseInt(line.slice(sep3 + 1), 10) });
+    const sep4 = line.lastIndexOf(":");
+    if (sep4 === -1) continue;
+    entries.push({ path: line.slice(0, sep4), loc: Number.parseInt(line.slice(sep4 + 1), 10) });
   }
   const emptyCat = () => ({
     test: { files: 0, loc: 0 },
@@ -5843,7 +5994,7 @@ function getForkPath() {
   const envPath = getEnv("CELLA_FORK_PATH");
   if (envPath) {
     const resolved = resolve7(envPath);
-    if (!existsSync12(resolved) || !statSync3(resolved).isDirectory()) {
+    if (!existsSync13(resolved) || !statSync3(resolved).isDirectory()) {
       throw new Error(`CELLA_FORK_PATH is not a valid directory: ${resolved}`);
     }
     return resolved;
@@ -5855,7 +6006,7 @@ function getForkPath() {
   return cwd;
 }
 function preflight(forkPath) {
-  if (!existsSync12(join18(forkPath, ".git"))) {
+  if (!existsSync13(join19(forkPath, ".git"))) {
     throw new Error(`not a git repository: ${forkPath}`);
   }
 }