@ikunin/sprintpilot 2.3.1 → 2.3.3

package/_Sprintpilot/manifest.yaml

@@ -1,6 +1,6 @@
 addon:
   name: sprintpilot
-  version: 2.3.1
+  version: 2.3.3
   description: Sprintpilot — autopilot and multi-agent addon for BMad Method (git workflow, parallel agents, autonomous story execution)
   bmad_compatibility: ">=6.2.0"
   modules:

package/lib/commands/install.js

@@ -517,6 +517,59 @@ async function evictV1SkillsFromToolDirs(projectRoot, { dryRun = false } = {}) {
   return removed;
 }
 
+// Skills owned by Sprintpilot all live under one of these prefixes. Used
+// by the orphan-prune sweep to scope which skill dirs the installer is
+// allowed to touch. Anything outside these prefixes (BMad's own skills,
+// user-authored skills, other addons) is left strictly alone.
+const SPRINTPILOT_SKILL_PREFIXES = ['sprint-autopilot-', 'sprintpilot-'];
+
+// v2.3.2 — orphan prune. After the per-tool deploy loop has installed the
+// current set of skills, walk the tool's skills/ dir and remove any
+// Sprintpilot-namespace skill dirs that fell out of the manifest between
+// releases. Without this, skills removed in a later release (e.g.
+// sprintpilot-code-review and sprintpilot-party-mode dropped in v2.3.1)
+// linger in users' tool dirs forever, polluting the slash-command picker
+// and pointing at stale internal code.
+//
+// Returns the list of orphan names (relative). Backs up before removing,
+// using the same .sprintpilot-backups/ convention as the install loop.
+async function pruneOrphanSkillsFromToolDir(
+  skillsDir,
+  currentSkills,
+  backupDir,
+  ts,
+  { dryRun = false } = {},
+) {
+  if (!(await fs.pathExists(skillsDir))) return [];
+  const orphans = [];
+  const currentSet = new Set(currentSkills);
+  let entries;
+  try {
+    entries = await fs.readdir(skillsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const name = entry.name;
+    if (!SPRINTPILOT_SKILL_PREFIXES.some((p) => name.startsWith(p))) continue;
+    if (currentSet.has(name)) continue;
+    if (dryRun) {
+      orphans.push(name);
+      continue;
+    }
+    const target = path.join(skillsDir, name);
+    try {
+      await backupSkill(target, backupDir, ts);
+      await fs.remove(target);
+      orphans.push(name);
+    } catch {
+      // Best-effort: skip on failure rather than aborting the install.
+    }
+  }
+  return orphans;
+}
+
 // Best-effort detection of a lingering global install of the v1 npm
 // package. When `npm ls -g --json` exits non-zero (e.g. ELSPROBLEMS from
 // unrelated peerDep warnings), it still writes valid JSON to stdout, so
@@ -948,18 +1001,25 @@ async function readExistingComplexityProfile(projectRoot, v1Snapshot) {
   return m[1];
 }
 
-// v2.3.0 — post-install hygiene check. Cross-reference the project's
-// _Sprintpilot/manifest.yaml `installed_skills` against what actually
-// landed under `_Sprintpilot/skills/<name>/SKILL.md`. Catches the
-// classic "added skill to manifest but forgot to ship the files" bug
-// at install time rather than at first invocation.
+// v2.3.0 — packaging-hygiene check. Cross-reference the project's
+// _Sprintpilot/manifest.yaml `installed_skills` against what the npm
+// package actually ships under `<bundleDir>/skills/<name>/SKILL.md`.
+// Catches the classic "added skill to manifest but forgot to ship the
+// files" bug at install time rather than at first invocation.
+//
+// IMPORTANT: this checks the BUNDLE (the npm package's source tree
+// pointed to by `bundleDir`, default `ADDON_DIR`), not the project's
+// _Sprintpilot/. The project never gets `skills/` copied to its
+// _Sprintpilot/ — skills only land in per-tool dirs (.claude/skills/,
+// .cursor/skills/, ...). Earlier versions wrongly checked the project
+// path, which caused a false-positive WARN on every install. Fixed in
+// v2.3.2.
 //
 // Returns { missing: string[] } — empty array means everything is
 // wired correctly. The caller chooses how to surface mismatches
 // (warning vs fail). We never fail the install on a mismatch; it's
-// hygiene, not correctness — the skill just won't appear under the
-// host tool's /-command if it's missing on disk.
-async function verifySkillManifest(projectRoot) {
+// hygiene, not correctness.
+async function verifySkillManifest(projectRoot, bundleDir = ADDON_DIR) {
   const manifestPath = path.join(projectRoot, PROJECT_ADDON_DIR_NAME, 'manifest.yaml');
   if (!(await fs.pathExists(manifestPath))) {
     return { missing: [] };
@@ -982,7 +1042,7 @@ async function verifySkillManifest(projectRoot) {
   }
   const missing = [];
   for (const name of skillNames) {
-    const skillFile = path.join(projectRoot, PROJECT_ADDON_DIR_NAME, 'skills', name, 'SKILL.md');
+    const skillFile = path.join(bundleDir, 'skills', name, 'SKILL.md');
     if (!(await fs.pathExists(skillFile))) missing.push(name);
   }
   return { missing };
@@ -1350,6 +1410,17 @@ async function runInstall(options = {}) {
     }
   }
 
+  // v2.3.3 — Sprintpilot bundles js-yaml into _Sprintpilot/node_modules/
+  // at install time (see step 6b below). Guard against users committing it.
+  const nodeModulesResult = await addIgnoreEntry(
+    ignore.path,
+    '_Sprintpilot/node_modules/',
+    { dryRun },
+  );
+  if (nodeModulesResult.added && !dryRun) {
+    console.log(`Added '_Sprintpilot/node_modules/' to ${path.basename(ignore.path)}`);
+  }
+
   // 5. Install skills per tool
   let totalInstalled = 0;
   const allSkills = await listSkills();
@@ -1464,6 +1535,16 @@ async function runInstall(options = {}) {
       totalInstalled += toolInstalled;
     }
 
+    // v2.3.2 — sweep Sprintpilot-namespace skills that fell out of the
+    // manifest between releases. Backed up to .sprintpilot-backups/ before
+    // removal. Skipped on dry-run except for reporting what would happen.
+    const orphans = await pruneOrphanSkillsFromToolDir(skillsDir, allSkills, backupDir, ts, {
+      dryRun,
+    });
+    for (const name of orphans) {
+      console.log(`  ${dryRun ? 'Would remove' : 'Removed'} orphan skill: ${name}`);
+    }
+
     await installSystemPrompt(tool, projectRoot, ADDON_DIR, ctx, { dryRun });
     console.log('');
   }
@@ -1497,6 +1578,32 @@ async function runInstall(options = {}) {
     }
     console.log('Runtime resources installed to _Sprintpilot/');
 
+    // 6b. v2.3.3 — bundle js-yaml into _Sprintpilot/node_modules/.
+    //     Two runtime scripts (sprint-plan.js, infer-dependencies.js)
+    //     require('js-yaml') for full YAML parse/dump support that the
+    //     in-tree yaml-lite intentionally doesn't cover. Without this,
+    //     `/sprintpilot-plan-sprint` and dependency inference crash with
+    //     MODULE_NOT_FOUND on every invocation in the consumer project.
+    //
+    //     We resolve js-yaml from Sprintpilot's own node_modules (where
+    //     npm placed it when the user ran `npx @ikunin/sprintpilot`) and
+    //     copy the whole package into <projectRoot>/_Sprintpilot/node_modules/js-yaml/.
+    //     Node's require walk finds it from _Sprintpilot/scripts/ at runtime.
+    try {
+      const jsYamlPkgJson = require.resolve('js-yaml/package.json');
+      const jsYamlSrc = path.dirname(jsYamlPkgJson);
+      const jsYamlDest = path.join(targetAddonDir, 'node_modules', 'js-yaml');
+      await fs.remove(jsYamlDest);
+      await fs.copy(jsYamlSrc, jsYamlDest, { overwrite: true });
+      console.log('  Bundled js-yaml → _Sprintpilot/node_modules/js-yaml/');
+    } catch (err) {
+      console.warn(
+        pc.yellow(
+          `  WARN: failed to bundle js-yaml (${err.message || err}). sprint-plan and dependency inference will fail at runtime.`,
+        ),
+      );
+    }
+
     // 6a. Re-apply v1 module-config snapshot (if any) — MUST happen after
     //     step 6 because step 6 wrote pristine bundled configs that would
     //     otherwise clobber the user's values. On failure, persist the
@@ -1760,5 +1867,7 @@ module.exports = {
     snapshotUserOwnedFiles,
     applyUserOwnedFiles,
     verifySkillManifest,
+    pruneOrphanSkillsFromToolDir,
+    SPRINTPILOT_SKILL_PREFIXES,
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikunin/sprintpilot",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Sprintpilot — autopilot and multi-agent addon for BMad Method v6: git workflow, parallel agents, autonomous story execution",
   "license": "Apache-2.0",
   "repository": {