@kybernesis/create 0.14.10 → 0.14.11

package/dist/peer-tree.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Who, exactly, is unhappy about the installed eve.
+ *
+ * @remarks
+ * `kyb upgrade` refuses to touch a project whose peer tree is broken (KYB-538),
+ * because changing a project on a bad tree is how a half-upgraded host happens.
+ * That gate read `npm ls eve`'s exit code and nothing else, so any package
+ * anywhere in the tree could veto the whole upgrade.
+ *
+ * On 2026-09-08 one did. `@github-tools/eve-extension` still declares
+ * `>=0.44.0 <0.48.0` while every Kybernesis package declares the 0.49 line the
+ * host actually runs. The upgrade aborted before `repairHostArtifacts`, so
+ * kyber did not receive the KYB-542 reclaim job it was being upgraded for, and
+ * the job had to be installed by hand.
+ *
+ * A third-party range that trails the framework is not a broken install. A
+ * Kybernesis package disagreeing with the framework it is pinned against is.
+ * So the verdict distinguishes them, and anything it cannot attribute is
+ * treated as fatal rather than waved through.
+ */
+export interface PeerTreeVerdict {
+    /** Nothing in the tree objects to the installed version. */
+    readonly ok: boolean;
+    /** Packages whose declared range excludes the installed version, deduplicated and sorted. */
+    readonly offenders: readonly string[];
+    /** An objection from a Kybernesis package, or one that could not be attributed. */
+    readonly fatal: boolean;
+}
+/**
+ * Read `npm ls <pkg> --json` and say whether the upgrade may proceed.
+ *
+ * Unparseable output is fatal: not knowing the shape of the tree is exactly the
+ * case the gate exists for.
+ */
+export declare function assessPeerTree(stdout: string): PeerTreeVerdict;
+/** What to print when a third-party range trails the framework but nothing else does. */
+export declare function staleRangeWarning(offenders: readonly string[], dependency: string): string;

package/dist/peer-tree.js

@@ -0,0 +1,62 @@
+const OWNED_SCOPE = "@kybernesis/";
+/** Every `from node_modules/<pkg>` in one npm `invalid` string. */
+function requiredBy(invalid) {
+    const found = [];
+    const pattern = /from node_modules\/((?:@[^/\s,]+\/)?[^/\s,]+)/g;
+    let match = pattern.exec(invalid);
+    while (match !== null) {
+        if (match[1])
+            found.push(match[1]);
+        match = pattern.exec(invalid);
+    }
+    return found;
+}
+function collect(node, offenders, unattributed) {
+    if (!node || typeof node !== "object")
+        return;
+    const record = node;
+    if (typeof record.invalid === "string" && record.invalid.length > 0) {
+        const owners = requiredBy(record.invalid);
+        // An objection nobody signed is not evidence that the tree is fine.
+        if (owners.length === 0)
+            unattributed.seen = true;
+        for (const owner of owners)
+            offenders.add(owner);
+    }
+    const dependencies = record.dependencies;
+    if (dependencies && typeof dependencies === "object") {
+        for (const child of Object.values(dependencies)) {
+            collect(child, offenders, unattributed);
+        }
+    }
+}
+/**
+ * Read `npm ls <pkg> --json` and say whether the upgrade may proceed.
+ *
+ * Unparseable output is fatal: not knowing the shape of the tree is exactly the
+ * case the gate exists for.
+ */
+export function assessPeerTree(stdout) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return { ok: false, offenders: [], fatal: true };
+    }
+    const offenders = new Set();
+    const unattributed = { seen: false };
+    collect(parsed, offenders, unattributed);
+    if (offenders.size === 0 && !unattributed.seen)
+        return { ok: true, offenders: [], fatal: false };
+    const sorted = [...offenders].sort();
+    const ours = sorted.some((name) => name.startsWith(OWNED_SCOPE));
+    return { ok: false, offenders: sorted, fatal: ours || unattributed.seen };
+}
+/** What to print when a third-party range trails the framework but nothing else does. */
+export function staleRangeWarning(offenders, dependency) {
+    const names = offenders.join(", ");
+    return (`${names} declare${offenders.length === 1 ? "s" : ""} a ${dependency} range that excludes the installed version. ` +
+        `Every Kybernesis package agrees with it, and the runtime already runs on it, so the upgrade continues. ` +
+        `Upgrade or replace ${offenders.length === 1 ? "that package" : "those packages"} when a compatible release exists.`);
+}

package/dist/upgrade.js

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { upsertEnv } from "./envfile.js";
 import { reconcileHostArtifact } from "./host-artifacts.js";
+import { assessPeerTree, staleRangeWarning } from "./peer-tree.js";
 import { dockerPruneCronArtifact } from "./docker-prune-cron.js";
 import { findMatchingAgentServiceUnit, repairManageRestart } from "./systemd.js";
 import { repairTerminalSandboxCleanupHooks } from "./sandbox-cleanup.js";
@@ -821,9 +822,22 @@ export async function upgrade(options = {}) {
     }
     const validation = commandResult("npm", ["ls", "eve"], cwd);
     if (validation.status !== 0) {
-        fail("npm ls eve failed. The installed peer tree is not valid.");
-        recoveryGuidance(targets, stoppedBridge ?? undefined);
-        return;
+        /**
+         * Judge WHO objects, not merely that something did.
+         *
+         * A third-party extension whose declared range trails the framework is not
+         * a broken install, and letting it veto the upgrade left kyber without the
+         * host artifacts it was being upgraded for (KYB-548). A Kybernesis package
+         * disagreeing with the framework it is pinned against still stops
+         * everything, and so does an objection we cannot attribute.
+         */
+        const verdict = assessPeerTree(commandResult("npm", ["ls", "eve", "--json"], cwd, false).stdout);
+        if (verdict.fatal || verdict.ok) {
+            fail("npm ls eve failed. The installed peer tree is not valid.");
+            recoveryGuidance(targets, stoppedBridge ?? undefined);
+            return;
+        }
+        console.log(yellow(`  ! ${staleRangeWarning(verdict.offenders, "eve")}`));
     }
     if (stoppedBridge && !startStoppedBridge(cwd, stoppedBridge))
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.14.10",
+  "version": "0.14.11",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",