@mnemahq/cli 0.15.0 → 0.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemahq/cli",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Mnema CLI — connect a repo to your Mnema workspace: install session capture, sweep past sessions, and search from the terminal.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -13,7 +13,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { applyWrites, chooseProject, describeResult, planWrites } from './prd.mjs';
+import { applyWrites, checkProjectMatchesRepo, chooseProject, declaredProjectId, describeResult, planWrites } from './prd.mjs';
 import { parseCodexRollout } from './codex-rollout.mjs';
 import { parseGeminiChat } from './gemini-chat.mjs';
 import { cmdLogin, cmdLogout, accessToken } from './login.mjs';
@@ -869,9 +869,19 @@ function cmdBinding(flags) {
  */
 async function cmdPrd(flags, rest) {
   const sub = (rest[0] || '').toLowerCase();
+  // ⚠️ `--project Display Share` without quotes passes "Display" and leaves
+  // "Share" here. It partial-matched the right project by luck once; silence
+  // would let the next one match the wrong project instead.
+  const stray = rest.slice(1);
+  if (sub === 'init' && stray.length > 0) {
+    console.error(c.red(`Unexpected argument: ${stray.join(' ')}`));
+    console.error(c.dim('  A project name with spaces needs quotes:'));
+    console.error(c.dim(`  mnema prd init --project "${[flags.project, ...stray].filter(Boolean).join(' ')}"`));
+    process.exit(1);
+  }
   if (sub !== 'init') {
     console.error(c.red(`Unknown prd subcommand: ${sub || '(none)'}`));
-    console.error(c.dim('Usage: mnema prd init [--project <name|id>] [--days 365] [--force]'));
+    console.error(c.dim('Usage: mnema prd init [--project <name|id>] [--days 365] [--force] [--allow-mismatch]'));
     process.exit(1);
   }
 
@@ -902,6 +912,16 @@ async function cmdPrd(flags, rest) {
     process.exit(1);
   }
 
+  // ⚠️ Before fetching anything: does this repo actually claim that project?
+  const match = checkProjectMatchesRepo(declaredProjectId(root), choice.project, {
+    allowMismatch: Boolean(flags['allow-mismatch']),
+  });
+  if (!match.ok) {
+    console.error('');
+    console.error(c.red(match.message));
+    process.exit(1);
+  }
+
   let draft;
   try {
     draft = await call({ origin, workspaceId }, (m) =>

package/src/prd.mjs

@@ -38,6 +38,60 @@ export function chooseProject(projects, wanted) {
   return { ok: false, reason: 'no-match', projects };
 }
 
+
+/**
+ * What the repo itself says it is (t-935).
+ *
+ * `.mnema/project.json` carries `projectId`, written when the repo was declared.
+ * It is the repo's own answer to "which project is this", and it was sitting
+ * there unread while the command drafted whichever project was asked for.
+ */
+export function declaredProjectId(root) {
+  for (const rel of ['.mnema/project.json', '.mnema/config.json']) {
+    try {
+      const j = JSON.parse(readFileSync(join(root, rel), 'utf8'));
+      if (j && typeof j.projectId === 'string' && j.projectId) return j.projectId;
+    } catch { /* absent or unreadable — treated as "the repo does not say" */ }
+  }
+  return null;
+}
+
+/**
+ * Refuse to draft a project this repo did not declare.
+ *
+ * ⭐ THE FAILURE THIS PREVENTS, OBSERVED ON THE FIRST PROD RUN:
+ *
+ *     cd project-x                            (declares projectId = Mnema)
+ *     mnema prd init --project "Display Share"
+ *     → 4 features drafted
+ *
+ * Display Share's features, drafted for the Mnema repo. Only the "file already
+ * exists" guard stopped the write; with --force it would have put another
+ * project's features into this repo's docs/prd.md, and the declaration sync
+ * would then have ingested them as this project's own.
+ *
+ * ⚠️ A REPO THAT DECLARES NOTHING IS ALLOWED. Requiring a declaration would break
+ * the first run in a fresh repo, which is exactly when this command is most
+ * useful. Silence is "unknown", not "mismatch".
+ */
+export function checkProjectMatchesRepo(declaredId, chosen, { allowMismatch = false } = {}) {
+  if (!declaredId) return { ok: true, reason: 'repo declares no project' };
+  if (declaredId === chosen.id) return { ok: true, reason: 'matches the repo' };
+  if (allowMismatch) return { ok: true, reason: 'mismatch allowed explicitly' };
+  return {
+    ok: false,
+    declaredId,
+    chosen,
+    message:
+      `This repo declares a different project.\n` +
+      `  repo declares : ${declaredId}\n` +
+      `  you asked for : ${chosen.name} (${chosen.id})\n\n` +
+      `Drafting the wrong project would write its features into this repo's PRD,\n` +
+      `and the declaration sync would then treat them as this project's own.\n` +
+      `If you really mean it, pass --allow-mismatch.`,
+  };
+}
+
 /**
  * Decide what to do with each file the server returned.
  *
@@ -70,6 +124,11 @@ export function applyWrites(plan) {
 /** The report a reader needs after a draft is written. */
 export function describeResult(draft, plan) {
   const lines = [];
+  // ⚠️ SAY WHAT WAS DRAFTED, FOR WHAT. "4 features drafted" does not say drafted
+  // for WHICH project, so drafting the wrong one reads exactly like success —
+  // which is how a cross-project draft went unnoticed on the first prod run.
+  lines.push(`  project   ${draft.project?.name ?? '(unnamed)'}  ${draft.repo ? `· ${draft.repo}` : ''}`.trimEnd());
+  lines.push('');
   const wrote = plan.filter((p) => p.action === 'create' || p.action === 'overwrite');
   const skipped = plan.filter((p) => p.action === 'skip-exists');
   const same = plan.filter((p) => p.action === 'unchanged');