@lemoncode/lemony 0.1.1 → 0.1.2

package/catalog/VERSION

@@ -1 +1 @@
-0.1.1
+0.1.2

package/catalog/hooks/lib/playbook-scan.sh

@@ -324,6 +324,50 @@ glob_to_regex() {
   GLOB_RE="^${re}$"
 }
 
+# Normalize an absolute payload file path to a repo-relative one, assigning the
+# result to the global REPO_RELATIVE_PATH. `applies_to` globs are repo-relative
+# (what the frontmatter documents and every shipped playbook assumes), but Claude
+# Code sends `file_path` ABSOLUTE — so without this every glob that does not start
+# with `**/` can never match and the playbook it guards is silently inert: the
+# `**/` idiom compiles to a leading `(.*/)?` that happens to swallow the whole
+# absolute prefix, hiding the problem behind the one glob shape that appears to work.
+#
+# Fast path: a fork-free textual prefix strip, correct whenever `pwd` (repo_root)
+# and the payload path agree on symlink resolution — the overwhelmingly common
+# case (repos live under an unsymlinked $HOME). Fallback (only when the textual
+# strip finds no prefix): the two producers may disagree on symlink resolution
+# (macOS /tmp → /private/tmp; repo_root is `$(pwd)`, filepath is the tool
+# payload), so resolve both sides with `pwd -P` — bash-3.2-safe, no `realpath`
+# dependency — and retry. A path genuinely outside the repo keeps its absolute
+# form; callers MUST treat a still-absolute result as "outside the repo" and skip
+# matching, because an absolute path does not reliably fail to match a
+# repo-relative glob: a leading `**/` compiles to an optional `(.*/)?` that
+# swallows the whole absolute prefix, so `**/src/**/*.ts` would otherwise match
+# `/some/other/repo/src/app.ts` and gate a write in an unrelated repository.
+_relativize_to_repo() {
+  local repo_root="$1"
+  local filepath="$2"
+
+  # Fast path: quoted prefix forces a literal (non-glob) strip.
+  REPO_RELATIVE_PATH="${filepath#"$repo_root"/}"
+  [ "$REPO_RELATIVE_PATH" != "$filepath" ] && return 0
+
+  # Fallback: resolve symlinks on both sides and retry. `cd` may fail for a
+  # not-yet-created parent dir on a new-file Write, or a path outside the repo —
+  # in either case fall through to keeping the original absolute path.
+  local dir="${filepath%/*}" base="${filepath##*/}" real_root real_dir
+  real_root="$(cd "$repo_root" 2>/dev/null && pwd -P)" || real_root=""
+  real_dir="$(cd "$dir" 2>/dev/null && pwd -P)" || real_dir=""
+  if [ -n "$real_root" ] && [ -n "$real_dir" ]; then
+    local real_path="$real_dir/$base"
+    REPO_RELATIVE_PATH="${real_path#"$real_root"/}"
+    [ "$REPO_RELATIVE_PATH" != "$real_path" ] && return 0
+  fi
+
+  # Genuinely outside the repo (or unresolvable): keep the original path.
+  REPO_RELATIVE_PATH="$filepath"
+}
+
 # Populate MATCHED_PLAYBOOKS with playbooks whose `applies_to` list contains a
 # glob that matches the given file path. One awk fork reads every playbook's
 # frontmatter; glob→regex translation and matching are in-process (no fork).
@@ -338,6 +382,21 @@ playbook_scan_for_path() {
   # empty under `set -u`, even though arr was explicitly initialized to `()`.
   [ ${#ALL_PLAYBOOKS[@]} -gt 0 ] || return 0
 
+  # Match repo-relative globs against a repo-relative path, not the absolute
+  # payload path. One-time normalization — the fast path is fork-free.
+  _relativize_to_repo "$repo_root" "$filepath"
+  local match_path="$REPO_RELATIVE_PATH"
+
+  # Still absolute => the target lives outside the repo root, so no
+  # repo-relative glob applies to it. Bail BEFORE the match loop rather than
+  # relying on the globs not to match: a leading `**/` becomes an optional
+  # `(.*/)?` which swallows any absolute prefix, so `**/src/**/*.ts` matches
+  # `/elsewhere/src/app.ts` and the hook blocks a write in another repository
+  # until this repo's playbooks are read. Enforcement stops at the repo edge.
+  case "$match_path" in
+    /*) return 0 ;;
+  esac
+
   local file field value seen="|"
   GLOB_RE=""
   while IFS=$'\t' read -r file field value; do
@@ -347,7 +406,7 @@ playbook_scan_for_path() {
     # loop `break`ed on first match) — track which files already matched.
     case "$seen" in *"|${file}|"*) continue ;; esac
     glob_to_regex "$value"
-    if [[ "$filepath" =~ $GLOB_RE ]]; then
+    if [[ "$match_path" =~ $GLOB_RE ]]; then
       MATCHED_PLAYBOOKS+=("$file")
       seen="${seen}${file}|"
     fi

package/dist/cli.mjs

@@ -45,7 +45,8 @@ const formatIssue = (schema, issue) => {
 		const valid = validKeysAt(schema, issue.path);
 		return issue.keys.map((key) => {
 			const guess = valid ? nearestKey(key, valid) : null;
-			return `Unknown key "${key}" in ${where}.${guess ? ` Did you mean "${guess}"?` : ""}`;
+			const hint = guess ? ` Did you mean "${guess}"?` : "";
+			return `Unknown key "${key}" in ${where}.${hint}`;
 		});
 	}
 	if (issue.code === "invalid_format" && issue.format === "regex") {
@@ -206,7 +207,8 @@ const setConfigValues = (rawYaml, updates) => {
 };
 const writeConfigValues = async (repoRoot, updates) => {
 	const configPath = join(repoRoot, HARNESS_CONFIG_FILENAME);
-	await writeFile(configPath, setConfigValues(await readFile(configPath, "utf8"), updates));
+	const raw = await readFile(configPath, "utf8");
+	await writeFile(configPath, setConfigValues(raw, updates));
 };
 //#endregion
 //#region src/config/pointer.schema.ts
@@ -1079,7 +1081,8 @@ const runValidate = async (inputs) => {
 		filesScanned: 0,
 		violations: []
 	};
-	const fileCheck = validateTokenFile(await readFile(tokenPath, "utf8"));
+	const raw = await readFile(tokenPath, "utf8");
+	const fileCheck = validateTokenFile(raw);
 	if (!fileCheck.ok) return {
 		ok: false,
 		tokensFound: true,
@@ -1410,7 +1413,8 @@ const linearizeChannel = (channel) => {
 const relativeLuminance = ({ r, g, b }) => .2126 * linearizeChannel(r) + .7152 * linearizeChannel(g) + .0722 * linearizeChannel(b);
 const contrastRatio = (foreground, background) => {
 	const bg = background.a < 1 ? flatten(background, WHITE) : background;
-	const l1 = relativeLuminance(foreground.a < 1 ? flatten(foreground, bg) : foreground);
+	const fg = foreground.a < 1 ? flatten(foreground, bg) : foreground;
+	const l1 = relativeLuminance(fg);
 	const l2 = relativeLuminance(bg);
 	const light = Math.max(l1, l2);
 	const dark = Math.min(l1, l2);
@@ -1457,7 +1461,9 @@ const runContrast = async (inputs) => {
 	};
 	const tokens = collectTokens(parsed);
 	const problems = [];
-	const pairs = measurePairs(discoverPairs(tokens, problems), declaredModes(tokens), tokens);
+	const specs = discoverPairs(tokens, problems);
+	const modes = declaredModes(tokens);
+	const pairs = measurePairs(specs, modes, tokens);
 	return {
 		ok: problems.length === 0 && pairs.every((pair) => pair.passes),
 		tokensFound: true,
@@ -3303,7 +3309,8 @@ const runStatus = async (deps) => {
 	const config = await readHarnessConfig(repoRoot);
 	const pointer = await readPointer(repoRoot, deps.readGitUserEmail);
 	const { branch, behind } = await deps.gitBehind(repoRoot);
-	const openDiscoveries = await countOpenDiscoveries(createTaskTrackerProvider(config.task_storage.type, deps.runCommand), config.task_storage.repo);
+	const provider = createTaskTrackerProvider(config.task_storage.type, deps.runCommand);
+	const openDiscoveries = await countOpenDiscoveries(provider, config.task_storage.repo);
 	return {
 		vendorVersion: config.vendor_version,
 		taskStorageRepo: config.task_storage.repo,
@@ -3659,7 +3666,10 @@ const hasConflictMarkers = (content) => CONFLICT_FENCE.test(content);
 //#endregion
 //#region src/merge/three-way-merge.ts
 const threeWayMerge = (base, client, vendor) => {
-	const regions = diff3Regions(base.split("\n"), client.split("\n"), vendor.split("\n"));
+	const baseLines = base.split("\n");
+	const clientLines = client.split("\n");
+	const vendorLines = vendor.split("\n");
+	const regions = diff3Regions(baseLines, clientLines, vendorLines);
 	const out = [];
 	let conflicted = false;
 	for (const region of regions) {
@@ -4824,12 +4834,13 @@ const update = async (args) => {
 	const repoRoot = cwd();
 	const onConflict = parseOnConflict(args);
 	const dryRun = args.includes("--dry-run");
+	const allowDowngrade = args.includes("--allow-downgrade");
 	const result = await runUpdate({
 		repoRoot,
 		vendorRoot: VENDOR_ROOT,
 		onConflict,
 		dryRun,
-		allowDowngrade: args.includes("--allow-downgrade"),
+		allowDowngrade,
 		runCommand: makeRunCommand()
 	});
 	const verb = (applied, preview) => dryRun ? preview : applied;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemoncode/lemony",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Lemony — a Harness for AI Coding. Vendor package: installer, agent role catalog, generic skill catalog, hooks, and templates for a Spec-Driven Development workflow.",
   "type": "module",
   "private": false,
@@ -28,7 +28,7 @@
   ],
   "engines": {
     "node": ">=24",
-    "npm": ">=11"
+    "pnpm": ">=11.5.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -43,6 +43,24 @@
     "agents",
     "scaffolding"
   ],
+  "devDependencies": {
+    "@changesets/cli": "2.31.1",
+    "@stryker-mutator/core": "9.6.1",
+    "@stryker-mutator/vitest-runner": "9.6.1",
+    "@types/node": "24.13.3",
+    "husky": "9.1.7",
+    "lint-staged": "17.2.0",
+    "oxlint": "1.75.0",
+    "prettier": "3.9.6",
+    "tsdown": "0.22.14",
+    "tsx": "4.23.1",
+    "typescript": "7.0.2",
+    "vitest": "4.1.10"
+  },
+  "dependencies": {
+    "yaml": "2.9.0",
+    "zod": "4.4.3"
+  },
   "scripts": {
     "build": "tsdown",
     "check-types": "tsc --noEmit",
@@ -60,30 +78,7 @@
     "notice:check": "tsx scripts/generate-notice.ts --check",
     "telemetry:aggregate": "tsx scripts/aggregate-telemetry.ts",
     "changeset": "changeset",
-    "changeset:version": "changeset version && tsx scripts/sync-catalog-version.ts",
+    "changeset:version": "changeset version && pnpm install --lockfile-only && tsx scripts/sync-catalog-version.ts",
     "changeset:publish": "node --run build && changeset publish"
-  },
-  "devDependencies": {
-    "@changesets/cli": "2.31.0",
-    "@stryker-mutator/core": "9.6.1",
-    "@stryker-mutator/vitest-runner": "9.6.1",
-    "@types/node": "24.13.2",
-    "oxlint": "1.71.0",
-    "prettier": "3.9.1",
-    "tsdown": "0.22.3",
-    "tsx": "4.22.4",
-    "typescript": "6.0.3",
-    "vitest": "4.1.9"
-  },
-  "dependencies": {
-    "yaml": "2.9.0",
-    "zod": "4.4.3"
-  },
-  "overrides": {
-    "typed-rest-client": {
-      "qs": "6.15.2"
-    },
-    "js-yaml": "4.2.0",
-    "vite": "8.0.16"
   }
-}
+}