@delorenj/pjangler 1.3.7 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.3.7",
+  "version": "1.4.2",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "esbuild src/index.ts src/mcp-server.ts src/prompt.ts --bundle --packages=external --platform=node --format=esm --outdir=dist",
+    "build": "esbuild src/index.ts src/mcp-server.ts src/prompt.ts --bundle --packages=external --platform=node --format=esm --outdir=dist && node scripts/export-project-notebook-skill.mjs",
     "check:audit:prod": "npm audit --omit=dev",
     "check:lock": "node scripts/check-package-lock-parity.mjs",
     "check:submodules": "node scripts/check-submodule-contract.mjs",
@@ -32,7 +32,8 @@
     "mcp": "node dist/mcp-server.js",
     "typecheck": "tsc --noEmit",
     "test:bmad-installer-contract": "node tests/bmad-installer-contract-regressions.mjs",
-    "test": "npm run check:lock && node tests/package-lock-parity-regressions.mjs && npm run check:submodules && npm run check:tracked-secrets && node tests/portable-test-paths-regressions.mjs && node tests/release-regressions.mjs && node tests/submodule-contract-regressions.mjs && node tests/secret-publication-gate-regressions.mjs && node tests/bmad-version-surface-regressions.mjs && node tests/bmad-transaction-regressions.mjs && node tests/parity-migrate-regressions.mjs && node tests/hermes-profile-inheritance-regressions.mjs && node tests/pjan-57-lifecycle-recipes-regressions.mjs && node tests/pjan-57-dogfood-regressions.mjs && node tests/generated-project-lifecycle-regressions.mjs && node tests/pack-flatten-regressions.mjs && node tests/pack-flatten-cross-engine-regressions.mjs && node tests/registry-cache-parity-regressions.mjs && node tests/registry-root-ladder-regressions.mjs && node tests/pjan-23-regressions.mjs && node tests/pjan-24-regressions.mjs && node tests/pjan-28-regressions.mjs && node tests/pjan-30-regressions.mjs && node tests/pjan-31a-regressions.mjs && node tests/pjan-36-regressions.mjs && node tests/pjan-43-regressions.mjs && node tests/pjan-48-regressions.mjs && node tests/pjan-49-regressions.mjs && node tests/pjan-50-regressions.mjs && node tests/pjan-65-regressions.mjs && node tests/pjan-67-lifecycle-preflight-regressions.mjs && node tests/pjan-67-regressions.mjs && node tests/pjan-67-trusted-lifecycle-regressions.mjs && node tests/pjan-71-regressions.mjs && node tests/pjan-72-regressions.mjs && node tests/pjan-75-regressions.mjs && node tests/pjan-76-regressions.mjs && node tests/skillex-init-regressions.mjs && node tests/fleet-shared-bloodbank-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs && node tests/momo-lifecycle-plane-regressions.mjs",
+    "test:pjan-77": "node tests/pjan-77-notebook-domain-regressions.mjs && node tests/pjan-77-notebook-adapter-contract.mjs && node tests/pjan-77-notebook-lifecycle-regressions.mjs && node tests/pjan-77-notebook-cli-contract.mjs && node tests/pjan-77-notebook-hooks-capture.mjs && node tests/pjan-77-notebook-security-isolation.mjs && node tests/pjan-77-notebook-release-gates.mjs",
+    "test": "npm run check:lock && node tests/package-lock-parity-regressions.mjs && npm run check:submodules && npm run check:tracked-secrets && node tests/portable-test-paths-regressions.mjs && node tests/release-regressions.mjs && node tests/submodule-contract-regressions.mjs && node tests/secret-publication-gate-regressions.mjs && node tests/bmad-version-surface-regressions.mjs && node tests/bmad-transaction-regressions.mjs && node tests/parity-migrate-regressions.mjs && node tests/hermes-profile-inheritance-regressions.mjs && node tests/pjan-57-lifecycle-recipes-regressions.mjs && node tests/pjan-57-dogfood-regressions.mjs && node tests/generated-project-lifecycle-regressions.mjs && node tests/pack-flatten-regressions.mjs && node tests/pack-flatten-cross-engine-regressions.mjs && node tests/registry-cache-parity-regressions.mjs && node tests/registry-root-ladder-regressions.mjs && node tests/pjan-23-regressions.mjs && node tests/pjan-24-regressions.mjs && node tests/pjan-28-regressions.mjs && node tests/pjan-30-regressions.mjs && node tests/pjan-31a-regressions.mjs && node tests/pjan-36-regressions.mjs && node tests/pjan-43-regressions.mjs && node tests/pjan-48-regressions.mjs && node tests/pjan-49-regressions.mjs && node tests/pjan-50-regressions.mjs && node tests/pjan-65-regressions.mjs && node tests/pjan-67-lifecycle-preflight-regressions.mjs && node tests/pjan-67-regressions.mjs && node tests/pjan-67-trusted-lifecycle-regressions.mjs && node tests/pjan-71-regressions.mjs && node tests/pjan-72-regressions.mjs && node tests/pjan-75-regressions.mjs && node tests/pjan-76-regressions.mjs && node tests/skillex-init-regressions.mjs && node tests/pjan-84-global-scope-regressions.mjs && node tests/pjan-84-registry-flag-regressions.mjs && node tests/pjan-84-finding-scope-regressions.mjs && node tests/pjan-84-orphan-adoption-regressions.mjs && node tests/fleet-shared-bloodbank-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs && node tests/momo-lifecycle-plane-regressions.mjs && npm run test:pjan-77",
     "migrate:up": "node-pg-migrate --migrations-dir migrations up",
     "migrate:down": "node-pg-migrate --migrations-dir migrations down",
     "migrate:create": "node-pg-migrate --migrations-dir migrations create",

package/templates/commonproject/copier.yml

@@ -114,18 +114,27 @@ _exclude:
 # into the caller's shared per-user CLI configs. Scaffolding must never mutate
 # global state as a side effect — the operator trusts/enters the repo themselves.
 _tasks:
-  - "cp ~/.config/git/ignore .gitignore 2>/dev/null || echo '# Add ignores here' > .gitignore"
+  # PJAN-82: seed the base ignore only when there is nothing to lose. `cp` over
+  # an existing .gitignore silently discarded whatever the repo already had,
+  # every time the template was re-rendered into a live project.
+  - "[ -s .gitignore ] || cp ~/.config/git/ignore .gitignore 2>/dev/null || [ -s .gitignore ] || echo '# Add ignores here' > .gitignore"
   # Ensure secrets + per-dev agent-hook/skill overrides are ignored (appended after the base ignore).
   # Each CLI root's hand-owned config is durable project state; the skill
   # projections inside it are not — bmad-method and skills:sync rewrite them
   # on every run, so they are re-ignored after the un-ignore lines (last
   # match wins). _bmad/_config/manifest.yaml pins the version that
   # reproduces them exactly.
-  - "printf '\\n# Secrets + per-dev agent-hook/skill overrides (see .agents/local.example.json)\\n.env\\n.env.*\\n!.env.op\\n.agents/local.json\\n.lastagent\\n**/.claude/settings.local.json\\n\\n# Generated CLI configurations are durable project state...\\n!.claude/\\n!.claude/**\\n!.codex/\\n!.codex/**\\n!.gemini/\\n!.gemini/**\\n!.copilot/\\n!.copilot/**\\n!.opencode/\\n!.opencode/**\\n!.kimi-code/\\n!.kimi-code/**\\n# ...but their skill projections are regenerated, so they stay out of the tree.\\n/.agents/skills/\\n.claude/skills/\\n.codex/skills/\\n.gemini/skills/\\n.copilot/skills/\\n.opencode/skills/\\n.kimi-code/skills/\\n' >> .gitignore"
-  - "ln -sf AGENTS.md CLAUDE.md"
-  - "ln -sf AGENTS.md GEMINI.md"
+  # PJAN-82: appended once (a re-render used to duplicate the whole block), and
+  # the skill patterns carry no trailing slash so a SYMLINKED projection is
+  # ignored too — .gemini/.copilot/.kimi-code get a symlink, not a directory.
+  - "grep -q '^# Generated CLI configurations are durable project state' .gitignore 2>/dev/null || printf '\\n# Secrets + per-dev agent-hook/skill overrides (see .agents/local.example.json)\\n.env\\n.env.*\\n!.env.op\\n.agents/local.json\\n.lastagent\\n**/.claude/settings.local.json\\n\\n# Generated CLI configurations are durable project state...\\n!.claude/\\n!.claude/**\\n!.codex/\\n!.codex/**\\n!.gemini/\\n!.gemini/**\\n!.copilot/\\n!.copilot/**\\n!.opencode/\\n!.opencode/**\\n!.kimi-code/\\n!.kimi-code/**\\n# ...but their skill projections are regenerated, so they stay out of the tree.\\n# No trailing slash: some CLIs get a real directory here and some a symlink.\\n/.agents/skills\\n.claude/skills\\n.codex/skills\\n.gemini/skills\\n.copilot/skills\\n.opencode/skills\\n.kimi-code/skills\\n' >> .gitignore"
+  # PJAN-82: use the managed script, which refuses to replace a REAL CLAUDE.md.
+  # `ln -sf` cannot distinguish a stale link it owns from a hand-written file it
+  # must not touch, so a re-render into a live project destroyed the file and
+  # reported success.
+  - "./.mise/scripts/link-agentfiles.sh \"$(pwd)\""
   # Materialize the declared Skillex packs' manifest + symlink topology
   # without copying pack content or disturbing project-specific skills.
-  - "python3 .mise/scripts/provision-packs.py"
+  - "python3 .mise/scripts/provision-packs.py --root \"$(pwd)\""
   # Stamp the repo's absolute path into .project.json (the SOT) post-render.
   - "python3 -c \"import json,os,pathlib; p=pathlib.Path('.project.json'); d=json.loads(p.read_text()); d['repo_path']=os.getcwd(); p.write_text(json.dumps(d,indent=2)+chr(10))\""

package/templates/commonproject/template/.mise/scripts/link-agentfiles.sh

@@ -1,9 +1,42 @@
 #!/bin/bash
+set -eu
 
-if [ -f AGENTS.md ]; then
-  ln -sf AGENTS.md CLAUDE.md
-  ln -sf AGENTS.md GEMINI.md
-  echo "✅ AI agent symlinks verified"
+# Symlink the per-CLI agent instruction files at AGENTS.md.
+#
+# A mise ENTER hook runs with cwd set to the directory the user cd'd into, NOT
+# to config_root — measured on mise 2026.8.10, and true even for a parent config
+# when the entered directory is a nested child. `mise run <task>` does run at
+# config_root, which is why the old cwd-relative version looked correct for
+# years: only the enter-hook path was wrong. So take the root explicitly, and
+# fall back to this script's own location — never to cwd.
+root="${1:-${MISE_CONFIG_ROOT:-}}"
+own_root=$(CDPATH= cd "$(dirname "$0")/../.." && pwd -P)
+if [ -z "$root" ]; then
+  root="$own_root"
 else
-  echo "No AGENTS.md file found. Can't symlink."
+  root=$(CDPATH= cd "$root" && pwd -P)
 fi
+if [ "$root" != "$own_root" ]; then
+  echo "link-agentfiles: refusing to act on $root; this script belongs to $own_root" >&2
+  echo "link-agentfiles: a nested repo must ship its own .mise/scripts copy" >&2
+  exit 1
+fi
+
+CDPATH= cd "$root"
+if [ ! -f AGENTS.md ]; then
+  echo "No AGENTS.md in $root. Nothing to symlink."
+  exit 0
+fi
+
+# `ln -sf` cannot tell a stale link it owns from a real file it must not touch:
+# -f means "unlink whatever is there". A hand-written CLAUDE.md was silently
+# replaced by a symlink, and the script printed a green checkmark while doing it.
+for name in CLAUDE.md GEMINI.md; do
+  if [ -e "$name" ] && [ ! -L "$name" ]; then
+    echo "link-agentfiles: refusing to replace the real file $root/$name with a symlink" >&2
+    echo "link-agentfiles: move its content into AGENTS.md, then delete $name" >&2
+    exit 1
+  fi
+  ln -sfn AGENTS.md "$name"
+done
+echo "✅ AGENTS.md links verified in $root"

package/templates/commonproject/template/.mise/scripts/provision-packs.py

@@ -29,6 +29,7 @@ from __future__ import annotations
 
 import importlib.util
 import json
+import argparse
 import os
 import re
 import shutil
@@ -286,13 +287,46 @@ def atomic_write(path: Path, content: bytes, mode: int) -> None:
 # --------------------------------------------------------------------------- #
 
 
+def own_root() -> Path:
+    """The repo this script file belongs to: <root>/.mise/scripts/<this>."""
+    return Path(__file__).resolve().parents[2]
+
+
+def resolved_project_root(requested: str | None) -> Path:
+    """Resolve the repo to provision, refusing to infer it from cwd.
+
+    A mise ENTER hook runs with cwd set to the directory the user cd'd into, not
+    config_root -- including a PARENT config's hook. That is how 33GOD's copy of
+    this script came to force-rewrite `pjangler/.agents/skills.json` and plant 75
+    dangling pack links in `pjangler/.agents/skills`. `mise run <task>` does run
+    at config_root, so the cwd assumption was only ever wrong on the hook path.
+    """
+    mine = own_root()
+    if requested is None:
+        requested = os.environ.get("MISE_CONFIG_ROOT") or None
+    if requested is None:
+        raise SystemExit(
+            "provision-packs: --root (or $MISE_CONFIG_ROOT) is required; "
+            "refusing to infer the subject repo from cwd"
+        )
+    resolved = Path(requested).resolve(strict=True)
+    if resolved != mine:
+        raise SystemExit(
+            f"provision-packs: refusing to act on {resolved}; this script "
+            f"belongs to {mine}.  A nested repo must ship its own "
+            ".mise/scripts copy."
+        )
+    return resolved
+
+
 def provision(
     *,
+    root: str | None = None,
     after_preflight: Callable[[], None] | None = None,
     create_link: Callable[[Path, Path, int], None] | None = None,
     after_apply: Callable[[Path, Path], None] | None = None,
 ) -> int:
-    project_root = Path.cwd().resolve(strict=True)
+    project_root = resolved_project_root(root)
     agents_path = project_root / ".agents"
     skills_path = agents_path / "skills"
     agents_existed = agents_path.exists() or agents_path.is_symlink()
@@ -387,10 +421,24 @@ def provision(
             )
         except OSError:
             link_targets_pack = False
+        # PJAN-82: a DANGLING symlink here is stale by definition.
+        #
+        # An entry stopped being recognizable as pack-managed the moment its pack
+        # declaration went away: `ownership_roots` no longer contains the pack, so
+        # `link_targets_pack` is false, and the normalized manifest no longer names
+        # it either — so the checks below skipped it and it stayed forever. That is
+        # how momo, bloodbank and candystore each ended up with 76 links into
+        # `~/.agents/.cache/registries/.../packs/bmad/6.10.1-next.31/`, a cache
+        # directory that no longer exists. A link that resolves to nothing cannot be
+        # a hand-authored skill and cannot be serving anyone, so it is reclaimable
+        # regardless of where it points. A link that still RESOLVES is left alone
+        # unless it is provably pack-managed.
+        dangling_link = link_target is not None and not entry.exists()
         if (
             entry.name not in expected
             and entry.name not in managed_manifest_names
             and not link_targets_pack
+            and not dangling_link
         ):
             continue
         target = expected.get(entry.name)
@@ -514,8 +562,18 @@ def provision(
 
 
 def main() -> None:
+    parser = argparse.ArgumentParser(description="Provision declared Skillex packs.")
+    parser.add_argument(
+        "--root",
+        default=None,
+        help=(
+            "Project root to provision; defaults to $MISE_CONFIG_ROOT.  Never "
+            "cwd -- see resolved_project_root()."
+        ),
+    )
+    args = parser.parse_args()
     try:
-        changed = provision()
+        changed = provision(root=args.root)
     except (FileNotFoundError, OSError, ValueError, RuntimeError, engine.PackUnavailable) as error:
         raise SystemExit(
             f"Skillex pack provisioning failed: {error}; "