@cosmicdrift/kumiko-cli 0.414.0 → 0.415.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-cli",
-  "version": "0.414.0",
+  "version": "0.415.0",
   "description": "CLI for Kumiko apps. `bunx @cosmicdrift/kumiko-cli new app <name>` scaffolds a runnable workspace; `add feature <name>` mounts a feature; `check` runs boot validation plus the guard suites with the step list derived from kumiko.json; `agent lint`, `project` and `consumer` operate on an existing app; `handbuch build` renders the HTML handbuch.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -36,19 +36,19 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.414.0",
-    "@cosmicdrift/kumiko-feature-ast": "0.414.0",
-    "@cosmicdrift/kumiko-guards": "0.414.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.414.0",
-    "@cosmicdrift/kumiko-testing": "0.414.0",
+    "@cosmicdrift/kumiko-dev-server": "0.415.0",
+    "@cosmicdrift/kumiko-feature-ast": "0.415.0",
+    "@cosmicdrift/kumiko-guards": "0.415.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.415.0",
+    "@cosmicdrift/kumiko-testing": "0.415.0",
     "marked": "^18.1.2",
     "zod": "^4.6.7"
   },
   "peerDependencies": {
     "sharp": "^0.35.5",
-    "@cosmicdrift/kumiko-bundled-features": "0.414.0",
-    "@cosmicdrift/kumiko-framework": "0.414.0",
-    "@cosmicdrift/kumiko-renderer": "0.414.0"
+    "@cosmicdrift/kumiko-bundled-features": "0.415.0",
+    "@cosmicdrift/kumiko-framework": "0.415.0",
+    "@cosmicdrift/kumiko-renderer": "0.415.0"
   },
   "peerDependenciesMeta": {
     "sharp": {
@@ -65,9 +65,9 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.414.0",
-    "@cosmicdrift/kumiko-framework": "0.414.0",
-    "@cosmicdrift/kumiko-renderer": "0.414.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.415.0",
+    "@cosmicdrift/kumiko-framework": "0.415.0",
+    "@cosmicdrift/kumiko-renderer": "0.415.0",
     "sharp": "^0.35.5"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.415.0",
+    "type": "breaking",
+    "title": "kumiko check fails when biome.json does not extend the Kumiko Biome preset",
+    "detail": "The lint step now reads `biome.json` or `biome.jsonc` (comments allowed) before it starts Biome and follows relative `extends` entries. It passes only if the chain reaches `@cosmicdrift/kumiko-framework/biome-rules`, `@cosmicdrift/kumiko-framework/biome` or a relative path to the framework's `presets/biome-rules.json` or `presets/biome-app.json`. Without the preset the SSRF, path-traversal, event-store write and admin-API plugins are missing and the step used to stay green; now it exits 1 and does not start Biome.",
+    "migration": "Add `\"extends\": [\"@cosmicdrift/kumiko-framework/biome\"]` to the repo's `biome.json` (`@cosmicdrift/kumiko-framework/biome-rules` for repos that keep their own file layout)."
+  },
   {
     "version": "0.413.0",
     "type": "fix",

package/src/commands/check-lint.ts

@@ -1,6 +1,49 @@
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import type { Output } from "../output";
 
+const PRESET_PACKAGE_EXTENDS: ReadonlySet<string> = new Set([
+  "@cosmicdrift/kumiko-framework/biome-rules",
+  "@cosmicdrift/kumiko-framework/biome",
+]);
+const PRESET_FILE_SUFFIXES = ["/presets/biome-rules.json", "/presets/biome-app.json"];
+const BIOME_CONFIG_NAMES = ["biome.json", "biome.jsonc"];
+const PRESET_FIX = '"extends": ["@cosmicdrift/kumiko-framework/biome"]';
+
+function readExtendsList(configPath: string): string[] {
+  let parsed: unknown;
+  try {
+    parsed = Bun.JSONC.parse(readFileSync(configPath, "utf-8"));
+  } catch {
+    return [];
+  }
+  const list =
+    typeof parsed === "object" && parsed !== null && "extends" in parsed
+      ? parsed.extends
+      : undefined;
+  const entries = Array.isArray(list) ? list : [list];
+  return entries.filter((entry): entry is string => typeof entry === "string");
+}
+
+function extendsFrameworkPreset(configPath: string, visited: Set<string>): boolean {
+  if (visited.has(configPath)) return false;
+  visited.add(configPath);
+  return readExtendsList(configPath).some((entry) => {
+    if (PRESET_PACKAGE_EXTENDS.has(entry)) return true;
+    if (!entry.startsWith(".")) return false;
+    const target = resolve(dirname(configPath), entry);
+    if (PRESET_FILE_SUFFIXES.some((suffix) => target.endsWith(suffix))) return true;
+    return existsSync(target) && extendsFrameworkPreset(target, visited);
+  });
+}
+
+function repoExtendsFrameworkPreset(repoRoot: string): boolean {
+  const configPath = BIOME_CONFIG_NAMES.map((name) => join(repoRoot, name)).find((candidate) =>
+    existsSync(candidate),
+  );
+  return configPath !== undefined && extendsFrameworkPreset(configPath, new Set());
+}
+
 function resolveBiomeBin(repoRoot: string): string | undefined {
   try {
     return join(dirname(Bun.resolveSync("@biomejs/biome/package.json", repoRoot)), "bin", "biome");
@@ -19,6 +62,14 @@ export async function runLintCheckStep(out: Output, repoRoot: string): Promise<n
     out.err("    Fix: `bun add -d @biomejs/biome`");
     return 1;
   }
+  // Without the preset the SSRF, path-traversal, event-store-write and admin-API plugins are missing and the lint step stays green.
+  if (!repoExtendsFrameworkPreset(repoRoot)) {
+    out.err(
+      "  ✗ biome.json does not extend the Kumiko Biome preset — the security plugins (SSRF, path traversal, event-store writes, admin API) would not run.",
+    );
+    out.err(`    Fix: add ${PRESET_FIX} to biome.json`);
+    return 1;
+  }
   const proc = Bun.spawn(["bun", biomeBin, "lint", "."], {
     cwd: repoRoot,
     stdout: "pipe",