@cosmicdrift/kumiko-cli 0.364.0 → 0.365.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-cli",
-  "version": "0.364.0",
+  "version": "0.365.0",
   "description": "CLI for Kumiko apps. `bunx @cosmicdrift/kumiko-cli new app <name>` scaffolds a runnable workspace; `add feature <name>` mounts a feature; `check` runs boot validation plus the guard suites with the step list derived from kumiko.json; `agent lint`, `project` and `consumer` operate on an existing app; `handbuch build` renders the HTML handbuch.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -36,10 +36,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.364.0",
-    "@cosmicdrift/kumiko-guards": "0.364.0",
-    "@cosmicdrift/kumiko-repo-manifest": "0.364.0",
-    "@cosmicdrift/kumiko-testing": "0.364.0",
+    "@cosmicdrift/kumiko-dev-server": "0.365.0",
+    "@cosmicdrift/kumiko-guards": "0.365.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.365.0",
+    "@cosmicdrift/kumiko-testing": "0.365.0",
     "marked": "^18.0.3",
     "zod": "^4.4.3"
   },
@@ -64,9 +64,9 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.364.0",
-    "@cosmicdrift/kumiko-framework": "0.364.0",
-    "@cosmicdrift/kumiko-headless": "0.364.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.365.0",
+    "@cosmicdrift/kumiko-framework": "0.365.0",
+    "@cosmicdrift/kumiko-headless": "0.365.0",
     "sharp": "^0.35.5"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "kumiko handbuch build refuses a dangerous --out; missing-peer message tells an outdated install from a missing one",
+    "detail": "handbuch build deletes the output directory before building, so `--out .` or `--out <root>` removed the checkout. The command now exits 2 when --out is, or contains, the working directory, --root or a configured source repo. When an installed @cosmicdrift package lacks a requested subpath, the error asks for an upgrade instead of recommending bun add."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/src/commands/handbuch.ts

@@ -1,4 +1,4 @@
-import { basename, join, resolve } from "node:path";
+import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { ZodError } from "zod";
 import type { HandbuchConfig } from "../handbuch/config";
@@ -41,6 +41,11 @@ function appSlug(configPath: string): string {
   return basename(configPath).replace(/\.json$/, "") || "handbuch";
 }
 
+function containsPath(parentDir: string, candidate: string): boolean {
+  const rel = relative(parentDir, candidate);
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
 async function runBuild(ctx: CliCommandContext, args: ReadonlyArray<string>): Promise<number> {
   let parsed: ReturnType<
     typeof parseArgs<{ options: typeof BUILD_OPTIONS; allowPositionals: true }>
@@ -82,11 +87,27 @@ async function runBuild(ctx: CliCommandContext, args: ReadonlyArray<string>): Pr
     return 2;
   }
 
+  // buildHandbuch wipes outDir recursively, so a mistyped --out must never be
+  // (or contain) a directory the build reads from or the user works in.
+  const outDir = resolve(ctx.cwd, values.out ?? join(rootDir, ".handbuch", appSlug(configPath)));
+  const protectedDirs = [
+    ctx.cwd,
+    rootDir,
+    resolve(rootDir, config.repo),
+    ...(config.flowSources ?? []).map((source) => resolve(rootDir, source.repo)),
+  ];
+  if (protectedDirs.some((dir) => containsPath(outDir, dir))) {
+    return usageError(
+      ctx,
+      `Refusing to build into ${outDir}: it is or contains the working directory, --root or a source repo, and is deleted before the build.`,
+    );
+  }
+
   const optionalDir = (value: string | undefined) => (value ? resolve(ctx.cwd, value) : undefined);
   try {
     const result = await buildHandbuch(config, {
       rootDir,
-      outDir: resolve(ctx.cwd, values.out ?? join(rootDir, ".handbuch", appSlug(configPath))),
+      outDir,
       shotsDir: optionalDir(values.shots),
       textsDir: optionalDir(values.texts),
       flowShotsDir: optionalDir(values["web-shots"]),

package/src/missing-peer.ts

@@ -6,12 +6,18 @@ const APP_PEER_PACKAGES = [
 
 // The runtime packages are optional peers (so `new app` runs without them); a
 // command that needs one must report the missing install, not a resolver stacktrace.
+// A subpath miss means the package is installed but too old for the requested export.
 export function missingPeerMessage(error: unknown): string | undefined {
   if (!(error instanceof Error)) return undefined;
+  if (!/cannot find (package|module)/i.test(error.message)) return undefined;
   for (const peer of APP_PEER_PACKAGES) {
-    if (error.message.includes(`'${peer}`) && /cannot find (package|module)/i.test(error.message)) {
+    if (error.message.includes(`'${peer}'`)) {
       return `${peer} is not installed. Install ${peer} in your app (bun add ${peer}).`;
     }
+    const subpath = error.message.match(new RegExp(`'${peer}(/[^']*)'`))?.[1];
+    if (subpath !== undefined) {
+      return `Installed ${peer} lacks ${subpath.slice(1)}. Upgrade ${peer} in your app.`;
+    }
   }
   return undefined;
 }