@lovrozagar/grunt 0.9.1 → 0.9.2

package/.grok/hooks/rtk-grok.js

@@ -4,9 +4,8 @@
 Fail-open: parse error, missing rtk, timeout, no rewrite → empty stdout, exit 0.
 Keep the full toolInput (Grok needs `description`); only replace `command`.
 */
-"use strict";
-
-const { spawnSync } = require("node:child_process");
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
 
 const RTK_TIMEOUT_MS = 3000;
 
@@ -108,7 +107,6 @@ function rewrite(cmd) {
 
 /** Read one JSON value (Python json.load): stop when parseable, do not wait for EOF. */
 function readJsonValue() {
-  const fs = require("node:fs");
   let buf = Buffer.alloc(0);
   const tmp = Buffer.alloc(8192);
   for (;;) {

package/bin/grunt.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { start } from "../cli/grunt.mjs"
 
-start().catch(() => {
+start().catch((err) => {
+  process.stderr.write(`grunt: ${err?.message ?? err}\n`)
   process.exit(1)
 })

package/cli/grunt.mjs

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process"
+import { execFileSync } from "./spawn.mjs"
 import { readFileSync } from "node:fs"
 import path from "node:path"
 import { fileURLToPath } from "node:url"

package/cli/grunt.test.ts

@@ -30,7 +30,7 @@ vi.mock("./init.mjs", () => ({
   RESERVED_SKILLS: ["browser", "tmp", "write-plan"],
   GRUNT_NPM_PREFIX: "grunt:",
 }));
-vi.mock("node:child_process", () => ({ execFileSync }));
+vi.mock("./spawn.mjs", () => ({ execFileSync }));
 vi.mock("./self-update.mjs", () => ({ selfUpdate }));
 vi.mock("../scripts/folder-map.mjs", () => ({ mapCommand }));
 vi.mock("../scripts/package-manager.mjs", async (importOriginal) => {

package/cli/init.mjs

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process"
+import { execFileSync } from "./spawn.mjs"
 import fs from "node:fs"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
@@ -53,6 +53,7 @@ export const PRODUCT_SCRIPTS = [
   "guarded-md.mjs",
   "guarded-roots.mjs",
   "emit-mcp-policy.mjs",
+  "jsonc.mjs",
   "folder-map.mjs",
   "gate-fat-tools.mjs",
   "hooks-union.mjs",
@@ -286,7 +287,8 @@ export function mergeClaudeSettings(destRoot, pkgRoot) {
         merged.push(item)
       }
     }
-    destPerms[key] = merged
+    // No empty list the source never had, so a re-init does not rewrite the file.
+    if (merged.length || key in destPerms) destPerms[key] = merged
   }
   destSettings.permissions = destPerms
 
@@ -433,6 +435,21 @@ export function mergePackageJson(dest, pkgRoot) {
   fs.writeFileSync(destPath, `${JSON.stringify(destPkg, null, 2)}\n`)
 }
 
+/**
+ * Recursive overwrite copy on readdir/readFile/writeFile. Not fs.cpSync: it runs in
+ * native code, so Yarn PnP (`yarn dlx`, package inside a zip) cannot serve it.
+ */
+export function copyTree(src, dest, filter = () => true) {
+  if (!filter(src)) return
+  const st = fs.statSync(src)
+  if (st.isDirectory()) {
+    fs.mkdirSync(dest, { recursive: true })
+    for (const name of fs.readdirSync(src)) copyTree(path.join(src, name), path.join(dest, name), filter)
+    return
+  }
+  fs.writeFileSync(dest, fs.readFileSync(src), { mode: st.mode })
+}
+
 function copyRootIfMissing(dest, pkgRoot) {
   for (const file of COPY_ROOT_IF_MISSING) {
     const src = path.join(pkgRoot, file)
@@ -496,20 +513,12 @@ export function init(dest, { pkgRoot: pkgRootOpt, execFileSync: exec = execFileS
       fs.mkdirSync(d, { recursive: true })
       if (samePath(src, d)) continue
       if (dir === ".claude") {
-        fs.cpSync(src, d, {
-          recursive: true,
-          force: true,
-          filter: (s) => path.basename(s) !== "settings.json",
-        })
+        copyTree(src, d, (s) => path.basename(s) !== "settings.json")
         mergeClaudeSettings(dest, pkgRoot)
       } else if (dir === ".rulesync") {
-        fs.cpSync(src, d, {
-          recursive: true,
-          force: true,
-          filter: (s) => !GENERATED_MAP_FILES.has(path.basename(s)),
-        })
+        copyTree(src, d, (s) => !GENERATED_MAP_FILES.has(path.basename(s)))
       } else {
-        fs.cpSync(src, d, { recursive: true, force: true })
+        copyTree(src, d)
       }
     }
 
@@ -524,9 +533,7 @@ export function init(dest, { pkgRoot: pkgRootOpt, execFileSync: exec = execFileS
       const src = path.join(pkgRoot, "scripts", name)
       const d = path.join(dest, "scripts", name)
       if (samePath(src, d)) continue
-      const st = fs.statSync(src)
-      if (st.isDirectory()) fs.cpSync(src, d, { recursive: true, force: true })
-      else fs.copyFileSync(src, d)
+      copyTree(src, d)
     }
 
     fs.mkdirSync(path.join(dest, ".tmp"), { recursive: true })

package/cli/init.test.ts

@@ -20,6 +20,7 @@ import {
   MAX_GUARDED_MARKDOWN_BYTES,
   PRODUCT_SCRIPTS,
   composeGuardedMarkdown,
+  copyTree,
   destAlreadyInited,
   extractGruntBody,
   extractUserMarkdown,
@@ -835,6 +836,36 @@ describe("snapshot/remerge guarded roots", () => {
   });
 });
 
+describe("copyTree", () => {
+  it("copies nested files, overwrites existing ones, and honors the filter", () => {
+    const src = tmp("copytree-src-");
+    fs.mkdirSync(path.join(src, "a", "b"), { recursive: true });
+    fs.writeFileSync(path.join(src, "a", "b", "keep.txt"), "new");
+    fs.writeFileSync(path.join(src, "a", "skip.txt"), "skip");
+    fs.writeFileSync(path.join(src, "top.txt"), "top");
+    const dest = tmp("copytree-dest-");
+    fs.mkdirSync(path.join(dest, "a", "b"), { recursive: true });
+    fs.writeFileSync(path.join(dest, "a", "b", "keep.txt"), "old");
+    fs.writeFileSync(path.join(dest, "mine.txt"), "mine");
+
+    copyTree(src, dest, (s) => path.basename(s) !== "skip.txt");
+
+    expect(fs.readFileSync(path.join(dest, "a", "b", "keep.txt"), "utf8")).toBe("new");
+    expect(fs.readFileSync(path.join(dest, "top.txt"), "utf8")).toBe("top");
+    expect(fs.existsSync(path.join(dest, "a", "skip.txt"))).toBe(false);
+    expect(fs.readFileSync(path.join(dest, "mine.txt"), "utf8")).toBe("mine");
+  });
+
+  it("never calls fs.cpSync (Yarn PnP zips cannot serve it)", () => {
+    const cp = vi.spyOn(fs, "cpSync");
+    const src = tmp("copytree-nocp-");
+    fs.writeFileSync(path.join(src, "f.txt"), "x");
+    copyTree(src, tmp("copytree-nocp-dest-"));
+    expect(cp).not.toHaveBeenCalled();
+    cp.mockRestore();
+  });
+});
+
 describe("mergeClaudeSettings", () => {
   it("dest .claude/settings.json absent: plain copy", () => {
     const pkgRoot = stubPkgRoot();
@@ -846,6 +877,30 @@ describe("mergeClaudeSettings", () => {
     expect(out).toEqual(SRC_CLAUDE_SETTINGS);
   });
 
+  it("re-merge is a byte-for-byte no-op (no empty allow added)", () => {
+    const pkgRoot = stubPkgRoot();
+    const destRoot = tmp("settings-idempotent-");
+    mergeClaudeSettings(destRoot, pkgRoot);
+    const settingsPath = path.join(destRoot, ".claude", "settings.json");
+    const first = fs.readFileSync(settingsPath, "utf8");
+    mergeClaudeSettings(destRoot, pkgRoot);
+    expect(fs.readFileSync(settingsPath, "utf8")).toBe(first);
+    expect(JSON.parse(first).permissions).not.toHaveProperty("allow");
+  });
+
+  it("keeps an empty allow list the consumer wrote", () => {
+    const pkgRoot = stubPkgRoot();
+    const destRoot = tmp("settings-empty-allow-");
+    fs.mkdirSync(path.join(destRoot, ".claude"), { recursive: true });
+    fs.writeFileSync(
+      path.join(destRoot, ".claude", "settings.json"),
+      JSON.stringify({ permissions: { allow: [] } }),
+    );
+    mergeClaudeSettings(destRoot, pkgRoot);
+    const out = JSON.parse(fs.readFileSync(path.join(destRoot, ".claude", "settings.json"), "utf8"));
+    expect(out.permissions.allow).toEqual([]);
+  });
+
   it("malformed dest JSON throws with the path in the message", () => {
     const pkgRoot = stubPkgRoot();
     const destRoot = tmp("settings-malformed-");
@@ -2263,6 +2318,8 @@ const PARENT_IMPORT_RE =
   /(?:from\s+|import\s*\(\s*)["'`](\.\.[^"'`]*)["'`]/g;
 const RELATIVE_IMPORT_RE =
   /(?:from\s+|import\s*\(\s*)["'`](\.[^"'`]+)["'`]/g;
+const ANY_IMPORT_RE =
+  /^\s*(?:import|export)\b[\w\s{},*$]*?(?:\bfrom\s*)?["'`]([^"'`]+)["'`]|\bimport\s*\(\s*["'`]([^"'`]+)["'`]/gm;
 
 function relativeSpecs(text: string, re: RegExp) {
   const out: string[] = [];
@@ -2280,6 +2337,29 @@ describe("product scripts are consumer-safe", () => {
     }
   });
 
+  it("bin graph imports only builtins and runtime dependencies (bunx/npx skip devDependencies)", () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf8"));
+    const runtime = new Set(Object.keys(pkg.dependencies ?? {}));
+    const seen = new Set<string>();
+    const bad: string[] = [];
+    const walk = (file: string) => {
+      if (seen.has(file)) return;
+      seen.add(file);
+      const text = fs.readFileSync(file, "utf8");
+      for (const m of text.matchAll(ANY_IMPORT_RE)) {
+        const spec = m[1] ?? m[2];
+        if (spec.startsWith(".")) walk(path.resolve(path.dirname(file), spec));
+        else if (!spec.startsWith("node:")) {
+          const name = spec.startsWith("@") ? spec.split("/").slice(0, 2).join("/") : spec.split("/")[0];
+          if (!runtime.has(name)) bad.push(`${path.relative(PKG_ROOT, file)} -> ${spec}`);
+        }
+      }
+    };
+    walk(path.join(PKG_ROOT, "bin", "grunt.js"));
+    expect(seen.has(path.join(PKG_ROOT, "scripts", "folder-map.mjs"))).toBe(true);
+    expect(bad).toEqual([]);
+  });
+
   it("do not parent-import (from or import()) — init copies scripts/ only", () => {
     for (const name of PRODUCT_FILES) {
       const text = fs.readFileSync(path.join(PKG_ROOT, "scripts", name), "utf8");

package/cli/self-update.mjs

@@ -1,4 +1,4 @@
-import { spawnSync } from "node:child_process"
+import { spawnSync } from "./spawn.mjs"
 import fs from "node:fs"
 import path from "node:path"
 import { GRUNT_PACKAGE, samePath } from "./init.mjs"
@@ -82,14 +82,16 @@ export async function selfUpdate({
   }
 
   const bin = path.join(cwd, "node_modules", GRUNT_PACKAGE, "bin", "grunt.js")
-  if (!fs.existsSync(bin)) {
+  const opts = { cwd, stdio: "inherit", env: { ...env, [REEXEC_ENV]: "1" } }
+  let child
+  if (fs.existsSync(bin)) {
+    child = run(process.execPath, [bin, ...argv], opts)
+  } else if (fs.existsSync(path.join(cwd, ".pnp.cjs"))) {
+    // Yarn Plug'n'Play has no node_modules; yarn resolves the bin from the updated .pnp.cjs.
+    child = run("yarn", ["grunt", ...argv], opts)
+  } else {
     log(`grunt: ${bin} not found after install; upgrading with ${currentVersion}`)
     return { reexeced: false }
   }
-  const child = run(process.execPath, [bin, ...argv], {
-    cwd,
-    stdio: "inherit",
-    env: { ...env, [REEXEC_ENV]: "1" },
-  })
   return { reexeced: true, status: child.status ?? 1 }
 }

package/cli/self-update.test.ts

@@ -187,6 +187,18 @@ describe("selfUpdate", () => {
     await expect(selfUpdate({ ...opts, run })).rejects.toThrow(/install/);
   });
 
+  it("re-execs through yarn under Plug'n'Play (no node_modules)", async () => {
+    const { opts, run, log, cwd } = setup({ withBin: false, runStatus: 0 });
+    fs.writeFileSync(path.join(cwd, ".pnp.cjs"), "");
+    expect(await selfUpdate(opts)).toEqual({ reexeced: true, status: 0 });
+    const [cmd, args, o] = run.mock.calls[1];
+    expect(cmd).toBe("yarn");
+    expect(args).toEqual(["grunt", "upgrade", "--skip-globals"]);
+    expect(o).toMatchObject({ cwd, stdio: "inherit" });
+    expect(o.env[REEXEC_ENV]).toBe("1");
+    expect(log).toHaveBeenCalledTimes(1);
+  });
+
   it("warns and continues when the installed bin is missing", async () => {
     const { opts, run, log } = setup({ withBin: false });
     expect(await selfUpdate(opts)).toEqual({ reexeced: false });

package/cli/spawn.mjs

@@ -0,0 +1,20 @@
+import crossSpawn from "cross-spawn"
+
+/**
+ * child_process twins for starting package managers. On Windows npm, pnpm, and yarn are
+ * .cmd shims that child_process cannot start without a shell (spawnSync npm ENOENT);
+ * cross-spawn resolves and escapes them. Elsewhere it is plain spawnSync.
+ */
+export function spawnSync(cmd, args, opts) {
+  return crossSpawn.sync(cmd, args, opts)
+}
+
+/** execFileSync semantics: throw unless the command exits 0. */
+export function execFileSync(cmd, args, opts) {
+  const r = spawnSync(cmd, args, opts)
+  if (r.error) throw r.error
+  if (r.status !== 0) {
+    throw new Error(`${cmd} ${args.join(" ")} exited with ${r.status ?? r.signal}`)
+  }
+  return r.stdout
+}

package/cli/spawn.test.ts

@@ -0,0 +1,34 @@
+import crossSpawn from "cross-spawn";
+import { describe, expect, it, vi } from "vitest";
+import { execFileSync, spawnSync } from "./spawn.mjs";
+
+const node = process.execPath;
+
+describe("spawnSync", () => {
+  it("returns status and output like child_process.spawnSync", () => {
+    const r = spawnSync(node, ["-e", "process.stdout.write('hi'); process.exit(3)"], { encoding: "utf8" });
+    expect(r.status).toBe(3);
+    expect(r.stdout).toBe("hi");
+  });
+});
+
+describe("execFileSync", () => {
+  it("returns stdout on exit 0", () => {
+    expect(execFileSync(node, ["-e", "process.stdout.write('ok')"], { encoding: "utf8" })).toBe("ok");
+  });
+
+  it("throws with the exit code on a nonzero exit", () => {
+    expect(() => execFileSync(node, ["-e", "process.exit(2)"], {})).toThrow(/exited with 2$/);
+  });
+
+  // Mocked: Windows has no signals, so a real kill reports an exit code there.
+  it("throws with the signal when the child is killed", () => {
+    const sync = vi.spyOn(crossSpawn, "sync").mockReturnValueOnce({ status: null, signal: "SIGTERM" } as never);
+    expect(() => execFileSync("npm", ["install"], {})).toThrow(/^npm install exited with SIGTERM$/);
+    sync.mockRestore();
+  });
+
+  it("throws the spawn error for a missing command", () => {
+    expect(() => execFileSync("grunt-no-such-command-e2e", [], {})).toThrow(/ENOENT/);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovrozagar/grunt",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Multi-agent orchestrator SoT — deep-merge rulesync trees, product scripts, and generate pipeline into a consumer repo",
   "keywords": [
     "agents",
@@ -31,6 +31,7 @@
     "scripts/guarded-md.mjs",
     "scripts/guarded-roots.mjs",
     "scripts/emit-mcp-policy.mjs",
+    "scripts/jsonc.mjs",
     "scripts/folder-map.mjs",
     "scripts/gate-fat-tools.mjs",
     "scripts/hooks-union.mjs",
@@ -74,7 +75,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@clack/prompts": "^0.11.0"
+    "@clack/prompts": "^0.11.0",
+    "cross-spawn": "^7.0.6"
   },
   "scripts": {
     "rulesync:generate": "node ./scripts/guarded-roots.mjs generate",
@@ -95,14 +97,17 @@
     "codex": "codex --dangerously-bypass-approvals-and-sandbox",
     "gemini": "gemini --yolo",
     "grok": "grok --yolo",
-    "test": "vitest run --coverage"
+    "test": "vitest run --coverage",
+    "test:e2e": "vitest run -c vitest.e2e.config.ts"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
     "@vitest/coverage-v8": "^3.2.7",
     "rulesync": "16.17.0",
     "smol-toml": "^1.8.0",
+    "tar": "^7.5.22",
     "typescript": "^5.9.3",
+    "verdaccio": "^6.10.5",
     "vitest": "^3.2.7"
   },
   "engines": {

package/scripts/emit-mcp-policy.mjs

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { stripJsonc } from "./jsonc.mjs";
 
 export const POLICY_REL = ".rulesync/mcp-policy.jsonc";
 const GROK_REL = ".grok/config.toml";
@@ -22,12 +23,6 @@ function isPlainObject(v) {
   return v != null && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date);
 }
 
-export function stripJsonc(text) {
-  return String(text ?? "")
-    .replace(/\/\*[\s\S]*?\*\//g, "")
-    .replace(/\/\/.*$/gm, "");
-}
-
 export function parseArgv(argv) {
   const args = Array.isArray(argv) ? argv : [];
   let check = false;

package/scripts/folder-map.mjs

@@ -15,7 +15,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { stripJsonc } from "./emit-mcp-policy.mjs";
+import { stripJsonc } from "./jsonc.mjs";
 
 export const DEFAULTS = Object.freeze({
   budget: 5000,

package/scripts/jsonc.mjs

@@ -0,0 +1,7 @@
+/** Dependency-free JSONC helpers. The published CLI imports this, so keep it to node builtins. */
+
+export function stripJsonc(text) {
+  return String(text ?? "")
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .replace(/\/\/.*$/gm, "");
+}