@hublo/sentinel 1.2.0-alpha.9 → 1.3.0

package/README.md

@@ -133,16 +133,31 @@ The per-tool knowledge (eslint → `eslint.config.js`, tsc → `tsconfig`, …)
 
 ## Requirements & installing
 
-**Registry: public npm**, under `@hublo`. We started on **GitHub Packages (private)** and moved off it: it authenticates every consumer, including a one-off `pnpm dlx`, which is incompatible with the zero-setup adoption above. Public npm needs no consumer auth, so a module adopts sentinel without any `.npmrc` or token. Releases go out through the repo's `publish` workflow, never from a laptop; a prerelease is published under its prerelease dist-tag (`alpha`) and a stable one under `latest`.
+**Registry: public npm**, under `@hublo`. We started on **GitHub Packages (private)** and moved off it: it authenticates every consumer, including a one-off run, which is incompatible with the zero-setup adoption above. Public npm needs no consumer auth, so a module adopts sentinel without any `.npmrc` or token. Releases go out through the repo's `publish` workflow, never from a laptop; a prerelease is published under its prerelease dist-tag (`alpha`) and a stable one under `latest`.
 
 **Node.** sentinel needs **Node >= 20.12** (its coloured output uses `util.styleText`, added in 20.12). It fails fast with a clear message on an older runtime rather than crashing. If a project runs on an older Node (e.g. a legacy app on Node 10), run sentinel with a modern Node via `fnm`/`nvm`; you do not need to change the project's own Node.
 
 **Try it without installing.** A one-off run needs no auth and touches nothing:
 
 ```bash
-pnpm dlx @hublo/sentinel@<exact-version> --inspect --typescript --module <name>
+npx --yes @hublo/sentinel@<exact-version> --inspect --typescript --module <name>
 ```
 
+**Why `npx` and not `pnpm dlx`, in a pnpm monorepo.** Because `pnpm dlx` no longer works for this,
+and no flag fixes it. pnpm's `strictDepBuilds` defaults to **true**, so adding a package whose build
+scripts have not been approved is a FATAL error rather than the warning it was through pnpm 10
+([settings/build](https://pnpm.io/settings/build)). sentinel pulls `esbuild` and `nx`, so the
+install aborts _before sentinel runs at all_: exit 1, nothing on stdout.
+
+The usual remedy, `allowBuilds` in `pnpm-workspace.yaml`, cannot reach it either: `dlx` runs in a
+throwaway project outside the workspace, so the workspace's approvals do not apply. `--allow-build`,
+`--config.dangerouslyAllowAllBuilds` and `--config.strictDepBuilds=false` were each measured and
+each still exits 1.
+
+`npx` fetches the same published package and runs no dependency build scripts, which is what a
+throwaway run wants. Once a module has adopted, nothing is fetched any more: the scripts call the
+`sentinel` binary from the module's own `devDependencies`.
+
 **Installing a pre-release (`minimumReleaseAge`).** The monorepo enforces a 3-day `minimumReleaseAge` supply-chain gate (a freshly published version cannot be installed until it has aged 3 days). A brand-new `alpha` therefore cannot be added yet, so while testing pre-releases you either exclude the package (`pnpm-workspace.yaml` → `minimumReleaseAgeExclude`) or install with `--config.minimumReleaseAge=0`. This is a deliberate protection, not a bug: **always pin the exact version** (`@hublo/sentinel@0.1.0-alpha.9`) rather than `@latest`, so a run is reproducible and the gate stays meaningful.
 
 ## Docs & cheat sheets

package/dist/bin/sentinel.d.ts

@@ -4,3 +4,4 @@ import '@vitejs/plugin-react';
 import 'nitro/vite';
 import 'vite-plugin-svgr';
 import 'vite';
+import 'vitest/config';

package/dist/bin/sentinel.js

@@ -9,6 +9,7 @@ import {
   WORKSPACE_ROOT_MARKER,
   availableTargets,
   buildConfigFile,
+  correctingSignal,
   declaredPresetFor,
   describeFramework,
   dispatch,
@@ -22,7 +23,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-6RH3LZQZ.js";
+} from "../chunk-676GBPMS.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
@@ -114,7 +115,7 @@ function resolveContext(cwd2, opts2) {
   );
 }
 
-// src/roles/build/scope.ts
+// src/roles/build/declined.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
 var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
@@ -128,7 +129,7 @@ function buildsWithDeprecatedExecutor(cwd2) {
     return false;
   }
 }
-function explainBuildScope(cwd2) {
+function explainDecline(cwd2) {
   if (buildConfigFile(cwd2) !== void 0) {
     return ` This module HAS a Vite config, so detection is the likely problem: the build toolchain is declared at the workspace root, which makes a front app detect as "node". Pass --preset to say what it is.`;
   }
@@ -176,7 +177,7 @@ async function runInit(ctx) {
     } catch (error) {
       if (error instanceof PresetUnsupportedError) {
         if (ctx.targetsExplicit) {
-          const hint = type === "build" ? explainBuildScope(module.root) : ` Pass --preset if it was detected wrongly (hoisted dependencies make detection fall back to "node").`;
+          const hint = type === "build" ? explainDecline(module.root) : ` Pass --preset if it was detected wrongly (hoisted dependencies make detection fall back to "node").`;
           process.stderr.write(
             `
 sentinel (${type}): this module's preset is "${error.preset}", and --${type} has no adapter for it.${hint}
@@ -235,6 +236,7 @@ async function analyse(params) {
           ) + "\n"
         );
       }
+      preset2 = correctingSignal(preset2, module.root)?.preset ?? preset2;
     }
     for (const target of params.targets) {
       let adapter;
@@ -655,7 +657,10 @@ program.name("sentinel").description("One CLI that guards code health: presets,
     "  sentinel --run --json                              # from root \u2192 all types, machine output",
     "  sentinel --run --ci                                # from root \u2192 affected only",
     "  sentinel --inspect --typescript                    # from root \u2192 adoption + what is deferred",
-    "  sentinel --init --preset react                     # adopt EVERY role: lint, format, typescript",
+    // Deliberately not enumerated here. A hand-written list drifts, and this one did: it
+    // still said "lint, format, typescript" after the build role shipped, so the help told
+    // adopters the build was not covered when it was. "Available now", below, is derived.
+    "  sentinel --init --preset react                     # adopt every available role (see below)",
     "  sentinel --init --typescript --preset react       # set up the current module + workspace",
     "  sentinel --run --typescript -- --noImplicitAny     # ask the tool a question of your own"
   ].join("\n")