@mandujs/core 0.54.11 → 0.54.13

package/scripts/postinstall-lock.ts

@@ -1,153 +1,153 @@
-/**
- * Refresh an existing Guard lock after package-manager updates.
- *
- * Lifecycle scripts run from inside the installed package, so projectRoot
- * defaults to INIT_CWD when Bun provides it. This helper is intentionally
- * best-effort: installs must not fail because a project has a stale, invalid,
- * or temporarily unreadable Mandu config.
- */
-
-import path from "node:path";
-import {
-  validateConfig,
-  type ValidatedManduConfig,
-} from "../src/config/validate.js";
-import { CONFIG_FILES } from "../src/config/mandu.js";
-import {
-  generateLockfile,
-  readLockfile,
-  readMcpConfig,
-  writeLockfile,
-  LOCKFILE_PATH,
-} from "../src/lockfile/index.js";
-
-export type PostinstallLockAction =
-  | "updated"
-  | "skipped-disabled"
-  | "skipped-no-project-config"
-  | "skipped-no-lockfile"
-  | "skipped-invalid-lockfile"
-  | "skipped-invalid-config"
-  | "skipped-invalid-mcp-config"
-  | "skipped-write-failed";
-
-export interface PostinstallLockResult {
-  action: PostinstallLockAction;
-  projectRoot: string;
-  hash?: string;
-  error?: string;
-}
-
-export interface PostinstallLockOptions {
-  projectRoot?: string;
-  env?: NodeJS.ProcessEnv;
-  verbose?: boolean;
-  log?: (message: string) => void;
-  warn?: (message: string) => void;
-}
-
-export async function refreshGuardLockAfterInstall(
-  options: PostinstallLockOptions = {},
-): Promise<PostinstallLockResult> {
-  const env = options.env ?? process.env;
-  const projectRoot = path.resolve(
-    options.projectRoot ?? env.INIT_CWD ?? process.cwd(),
-  );
-  const verbose = options.verbose ?? env.MANDU_POSTINSTALL_VERBOSE === "1";
-  const log = options.log ?? console.log;
-  const warn = options.warn ?? console.warn;
-
-  const report = (result: PostinstallLockResult): PostinstallLockResult => {
-    if (verbose) {
-      if (result.action === "updated") {
-        log(`[Mandu] refreshed ${LOCKFILE_PATH} (${result.hash})`);
-      } else if (result.error) {
-        warn(`[Mandu] ${result.action}: ${result.error}`);
-      } else {
-        log(`[Mandu] ${result.action}`);
-      }
-    }
-    return result;
-  };
-
-  if (env.MANDU_POSTINSTALL_LOCK === "0") {
-    return report({ action: "skipped-disabled", projectRoot });
-  }
-
-  if (!(await hasProjectConfig(projectRoot))) {
-    return report({ action: "skipped-no-project-config", projectRoot });
-  }
-
-  let existingLockfile: Awaited<ReturnType<typeof readLockfile>>;
-  try {
-    existingLockfile = await readLockfile(projectRoot);
-  } catch (error) {
-    return report({
-      action: "skipped-invalid-lockfile",
-      projectRoot,
-      error: stringifyError(error),
-    });
-  }
-
-  if (!existingLockfile) {
-    return report({ action: "skipped-no-lockfile", projectRoot });
-  }
-
-  const validation = await validateConfig(projectRoot);
-  if (!validation.valid || !validation.config) {
-    return report({
-      action: "skipped-invalid-config",
-      projectRoot,
-      error:
-        validation.errors?.map((entry) => entry.message).join("; ") ??
-        "Mandu config validation failed",
-    });
-  }
-
-  let mcpConfig: Record<string, unknown> | null;
-  try {
-    mcpConfig = await readMcpConfig(projectRoot);
-  } catch (error) {
-    return report({
-      action: "skipped-invalid-mcp-config",
-      projectRoot,
-      error: stringifyError(error),
-    });
-  }
-
-  try {
-    const lockfile = generateLockfile(
-      validation.config as ValidatedManduConfig,
-      {
-        includeSnapshot: existingLockfile.snapshot !== undefined,
-        includeMcpServerHashes: true,
-      },
-      mcpConfig,
-    );
-    await writeLockfile(projectRoot, lockfile);
-    return report({ action: "updated", projectRoot, hash: lockfile.configHash });
-  } catch (error) {
-    return report({
-      action: "skipped-write-failed",
-      projectRoot,
-      error: stringifyError(error),
-    });
-  }
-}
-
-async function hasProjectConfig(projectRoot: string): Promise<boolean> {
-  for (const fileName of CONFIG_FILES) {
-    if (await Bun.file(path.join(projectRoot, fileName)).exists()) {
-      return true;
-    }
-  }
-  return false;
-}
-
-function stringifyError(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-if (import.meta.main) {
-  await refreshGuardLockAfterInstall();
-}
+/**
+ * Refresh an existing Guard lock after package-manager updates.
+ *
+ * Lifecycle scripts run from inside the installed package, so projectRoot
+ * defaults to INIT_CWD when Bun provides it. This helper is intentionally
+ * best-effort: installs must not fail because a project has a stale, invalid,
+ * or temporarily unreadable Mandu config.
+ */
+
+import path from "node:path";
+import {
+  validateConfig,
+  type ValidatedManduConfig,
+} from "../src/config/validate.js";
+import { CONFIG_FILES } from "../src/config/mandu.js";
+import {
+  generateLockfile,
+  readLockfile,
+  readMcpConfig,
+  writeLockfile,
+  LOCKFILE_PATH,
+} from "../src/lockfile/index.js";
+
+export type PostinstallLockAction =
+  | "updated"
+  | "skipped-disabled"
+  | "skipped-no-project-config"
+  | "skipped-no-lockfile"
+  | "skipped-invalid-lockfile"
+  | "skipped-invalid-config"
+  | "skipped-invalid-mcp-config"
+  | "skipped-write-failed";
+
+export interface PostinstallLockResult {
+  action: PostinstallLockAction;
+  projectRoot: string;
+  hash?: string;
+  error?: string;
+}
+
+export interface PostinstallLockOptions {
+  projectRoot?: string;
+  env?: NodeJS.ProcessEnv;
+  verbose?: boolean;
+  log?: (message: string) => void;
+  warn?: (message: string) => void;
+}
+
+export async function refreshGuardLockAfterInstall(
+  options: PostinstallLockOptions = {},
+): Promise<PostinstallLockResult> {
+  const env = options.env ?? process.env;
+  const projectRoot = path.resolve(
+    options.projectRoot ?? env.INIT_CWD ?? process.cwd(),
+  );
+  const verbose = options.verbose ?? env.MANDU_POSTINSTALL_VERBOSE === "1";
+  const log = options.log ?? console.log;
+  const warn = options.warn ?? console.warn;
+
+  const report = (result: PostinstallLockResult): PostinstallLockResult => {
+    if (verbose) {
+      if (result.action === "updated") {
+        log(`[Mandu] refreshed ${LOCKFILE_PATH} (${result.hash})`);
+      } else if (result.error) {
+        warn(`[Mandu] ${result.action}: ${result.error}`);
+      } else {
+        log(`[Mandu] ${result.action}`);
+      }
+    }
+    return result;
+  };
+
+  if (env.MANDU_POSTINSTALL_LOCK === "0") {
+    return report({ action: "skipped-disabled", projectRoot });
+  }
+
+  if (!(await hasProjectConfig(projectRoot))) {
+    return report({ action: "skipped-no-project-config", projectRoot });
+  }
+
+  let existingLockfile: Awaited<ReturnType<typeof readLockfile>>;
+  try {
+    existingLockfile = await readLockfile(projectRoot);
+  } catch (error) {
+    return report({
+      action: "skipped-invalid-lockfile",
+      projectRoot,
+      error: stringifyError(error),
+    });
+  }
+
+  if (!existingLockfile) {
+    return report({ action: "skipped-no-lockfile", projectRoot });
+  }
+
+  const validation = await validateConfig(projectRoot);
+  if (!validation.valid || !validation.config) {
+    return report({
+      action: "skipped-invalid-config",
+      projectRoot,
+      error:
+        validation.errors?.map((entry) => entry.message).join("; ") ??
+        "Mandu config validation failed",
+    });
+  }
+
+  let mcpConfig: Record<string, unknown> | null;
+  try {
+    mcpConfig = await readMcpConfig(projectRoot);
+  } catch (error) {
+    return report({
+      action: "skipped-invalid-mcp-config",
+      projectRoot,
+      error: stringifyError(error),
+    });
+  }
+
+  try {
+    const lockfile = generateLockfile(
+      validation.config as ValidatedManduConfig,
+      {
+        includeSnapshot: existingLockfile.snapshot !== undefined,
+        includeMcpServerHashes: true,
+      },
+      mcpConfig,
+    );
+    await writeLockfile(projectRoot, lockfile);
+    return report({ action: "updated", projectRoot, hash: lockfile.configHash });
+  } catch (error) {
+    return report({
+      action: "skipped-write-failed",
+      projectRoot,
+      error: stringifyError(error),
+    });
+  }
+}
+
+async function hasProjectConfig(projectRoot: string): Promise<boolean> {
+  for (const fileName of CONFIG_FILES) {
+    if (await Bun.file(path.join(projectRoot, fileName)).exists()) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function stringifyError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+if (import.meta.main) {
+  await refreshGuardLockAfterInstall();
+}

package/src/a11y/run-audit.ts

@@ -69,11 +69,11 @@ interface DomProvider {
   fromHtml(html: string, url: string): Promise<{ window: unknown; dispose: () => Promise<void> }>;
 }
 
-const DEFAULT_MAX_FILES = 500;
-const DEFAULT_MIN_IMPACT: AuditImpact = "minor";
-const AXE_CORE_MODULE = "axe-core";
-const JSDOM_MODULE = "jsdom";
-const HAPPY_DOM_MODULE = "happy-dom";
+const DEFAULT_MAX_FILES = 500;
+const DEFAULT_MIN_IMPACT: AuditImpact = "minor";
+const AXE_CORE_MODULE = "axe-core";
+const JSDOM_MODULE = "jsdom";
+const HAPPY_DOM_MODULE = "happy-dom";
 
 /**
  * Zero every entry in an impact-count record. Returned by value so
@@ -103,10 +103,10 @@ async function resolveAxe(options: RunAuditOptions): Promise<AxeLike | null> {
       return null;
     }
   };
-
-  if (options.axeLoader) return tryLoad(options.axeLoader);
-  return tryLoad(() => import(AXE_CORE_MODULE));
-}
+
+  if (options.axeLoader) return tryLoad(options.axeLoader);
+  return tryLoad(() => import(AXE_CORE_MODULE));
+}
 
 /**
  * Resolve a DOM provider. Prefers jsdom; falls back to HappyDOM via
@@ -128,9 +128,9 @@ async function resolveDomProvider(options: RunAuditOptions): Promise<DomProvider
     return null;
   }
 
-  // Preferred path — jsdom.
-  try {
-    const jsdom = await import(JSDOM_MODULE);
+  // Preferred path — jsdom.
+  try {
+    const jsdom = await import(JSDOM_MODULE);
     const JSDOMCtor = (jsdom as { JSDOM?: new (html: string, opts?: unknown) => unknown }).JSDOM;
     if (JSDOMCtor) {
       return {
@@ -154,9 +154,9 @@ async function resolveDomProvider(options: RunAuditOptions): Promise<DomProvider
     // jsdom not installed — fall through to HappyDOM.
   }
 
-  // Fallback path — HappyDOM.
-  try {
-    const happy = await import(HAPPY_DOM_MODULE);
+  // Fallback path — HappyDOM.
+  try {
+    const happy = await import(HAPPY_DOM_MODULE);
     const WindowCtor = (happy as { Window?: new (opts?: { url?: string; innerWidth?: number }) => unknown }).Window;
     if (WindowCtor) {
       return {

package/src/agent/__tests__/context.test.ts

@@ -33,6 +33,24 @@ async function writeFile(root: string, rel: string, content: string): Promise<vo
   await fs.writeFile(abs, content, "utf8");
 }
 
+async function runGit(root: string, args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
+  try {
+    const proc = Bun.spawn(["git", ...args], {
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ]);
+    return { ok: exitCode === 0, stdout, stderr };
+  } catch (error) {
+    return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
+  }
+}
+
 describe("agent context", () => {
   let root: string;
 
@@ -174,7 +192,7 @@ describe("agent context", () => {
 
     expect(report.framework).toBe("mandu");
     expect(report.ok).toBe(true);
-    expect(report.checks.map((check) => check.id)).toEqual(["manifest"]);
+    expect(report.checks.map((check) => check.id)).toEqual(["internal-api", "manifest"]);
     expect(report.suggestedCommands.map((cmd) => cmd.command)).toContain("bun run typecheck");
     expect(report.nextRepairInput).toBe(".mandu/agent-verify.json");
 
@@ -184,6 +202,35 @@ describe("agent context", () => {
     expect(parsed.project.name).toBe("agent-app");
   });
 
+  it("records changed file reasons and warns on internal API edits", async () => {
+    const version = await runGit(root, ["--version"]);
+    if (!version.ok) return;
+
+    expect((await runGit(root, ["init"])).ok).toBe(true);
+    await runGit(root, ["config", "user.email", "agent@example.com"]);
+    await runGit(root, ["config", "user.name", "Agent"]);
+    expect((await runGit(root, ["add", "."])).ok).toBe(true);
+    expect((await runGit(root, ["commit", "-m", "initial"])).ok).toBe(true);
+
+    await writeFile(root, "packages/core/src/runtime/internal-change.ts", "export const value = 1;\n");
+
+    const report = await buildAgentVerifyReport(root, {
+      includeDiagnose: false,
+      includeGuard: false,
+      includeContract: false,
+    });
+
+    const reason = report.changedFileReasons.find(
+      (entry) => entry.file === "packages/core/src/runtime/internal-change.ts",
+    );
+    expect(reason?.internalApi).toBe(true);
+    expect(reason?.recommendedChecks).toContain("bun run check:public-api && bun run check:target-boundaries");
+    expect(report.diagnostics.some((diag) => diag.code === "MANDU_VERIFY_INTERNAL_API_EDIT")).toBe(true);
+    expect(report.suggestedCommands.map((cmd) => cmd.command)).toContain(
+      "bun run check:public-api && bun run check:target-boundaries",
+    );
+  });
+
   it("turns a verify report into repair actions", async () => {
     await writeAgentVerifyReport(root, {
       schemaVersion: 1,
@@ -197,6 +244,7 @@ describe("agent context", () => {
         configFile: null,
       },
       changedFiles: [],
+      changedFileReasons: [],
       gitAvailable: false,
       notes: [],
       ok: false,