@multiplatform.one/cli 6.4.0 → 6.4.1

package/lib/bin/multiplatformOne.mjs

@@ -471,7 +471,7 @@ async function getFrappeApps(root) {
 const program = new Command();
 program.name("mpo");
 program.version(JSON.parse(fsSync.readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json"), "utf8"))?.version);
-program.command("init").option("--universal", "scaffold the universal template (web + iOS + Android; default)").option("--web", "scaffold the web-only template (Vite + React)").option("--app", "alias of --web (back-compat)").option("--skip-install", "skip pnpm install after scaffolding").option("--mpo-version <range>", "semver range for @multiplatform.one/* (default: ^<cli version>)").option("-y, --yes", "non-interactive: accept defaults instead of prompting").option("--monorepo", "DEPRECATED: clone/modify the full multiplatform.one monorepo instead of scaffolding a consumer project").option("-c, --checkout <branch>", "branch, tag or commit to checkout (--monorepo only)", "main").option("-a, --apps <apps>", "comma-separated apps to include (--monorepo only)").option("-s, --services <services>", "comma-separated services to include (--monorepo only)").argument("[name]", "the name of the project").description("scaffold a new multiplatform project (universal web + native by default; --web for web-only; semver @multiplatform.one/* deps)").action(async (name, options) => {
+program.command("init").option("--universal", "scaffold the universal template (web + iOS + Android; default)").option("--web", "scaffold the web-only template (Vite + React)").option("--app", "alias of --web (back-compat)").option("--skip-install", "skip pnpm install after scaffolding").option("--skip-git", "skip git init + scaffold commit").option("--mpo-version <range>", "semver range for @multiplatform.one/* (default: ^<cli version>)").option("-y, --yes", "non-interactive: accept defaults instead of prompting").option("--monorepo", "DEPRECATED: clone/modify the full multiplatform.one monorepo instead of scaffolding a consumer project").option("-c, --checkout <branch>", "branch, tag or commit to checkout (--monorepo only)", "main").option("-a, --apps <apps>", "comma-separated apps to include (--monorepo only)").option("-s, --services <services>", "comma-separated services to include (--monorepo only)").argument("[name]", "the name of the project").description("scaffold a new multiplatform project (universal web + native by default; --web for web-only; semver @multiplatform.one/* deps)").action(async (name, options) => {
 	if (options.monorepo) {
 		console.warn("⚠️  `mpo init --monorepo` clones the whole multiplatform.one monorepo (legacy). New projects should use the default consumer scaffold instead.");
 		if (await spawn("git", ["rev-parse", "--is-inside-work-tree"]).then(() => true, () => false)) throw new Error("mpo cannot be initialized inside a git repository");
@@ -487,6 +487,7 @@ program.command("init").option("--universal", "scaffold the universal template (
 	if (webOnly && options.universal) throw new Error("Pass either --web/--app or --universal, not both");
 	await initApp(name, {
 		skipInstall: Boolean(options.skipInstall),
+		skipGit: Boolean(options.skipGit),
 		version: options.mpoVersion,
 		template: webOnly ? "app" : options.universal ? "universal" : void 0,
 		yes: Boolean(options.yes)
@@ -499,11 +500,9 @@ program.command("update").option("-c, --checkout <branch>", "branch, tag or comm
 			skipInstall: options.skipInstall,
 			version: options.mpoVersion
 		});
-		try {
-			await generateVscodeConfig(projectRoot);
-		} catch {}
 		return;
 	}
+	if (!await fs.stat(path.resolve(projectRoot, "features/package.json")).then((stat) => stat.isFile(), () => false)) throw new Error(".mpo.json not found — this project predates scaffold provenance. Create it with { template, cliVersion, name } matching how the project was generated (cliVersion = the @multiplatform.one/cli that scaffolded it), then re-run `mpo update`.");
 	if (await spawn("git", [
 		"diff",
 		"--cached",
@@ -823,7 +822,12 @@ program.command("generate").description("run generate command").action(async ()
 		cwd: projectRoot
 	});
 });
-program.parse(process.argv);
+program.parseAsync(process.argv).catch((err) => {
+	const error = err;
+	if (process.env.MPO_DEBUG) console.error(error);
+	else console.error(`✖ ${error.message ?? String(err)}`);
+	process.exit(1);
+});
 async function waitWithSpinner(services, options = {}) {
 	const { interval = 1e3, timeout = 6e5 } = options;
 	const waitFunctions = {

package/lib/commands/initApp.mjs

@@ -151,12 +151,39 @@ async function initApp(nameArg, options = {}) {
 		name,
 		mpoVersion: vars.MPO_VERSION
 	});
+	let scaffoldCommitted = false;
+	if (!options.skipGit) {
+		if (!await spawn("git", ["rev-parse", "--is-inside-work-tree"], { cwd: targetDir }).then(() => true, () => false)) {
+			const label = template === "universal" ? "universal" : "web-only";
+			await spawn("git", ["init", "--quiet"], { cwd: targetDir });
+			await spawn("git", ["add", "-A"], { cwd: targetDir });
+			scaffoldCommitted = await spawn("git", [
+				"commit",
+				"--quiet",
+				"-m",
+				`feat: scaffold ${label} multiplatform.one app (mpo init)`
+			], { cwd: targetDir }).then(() => true, () => {
+				console.warn("⚠️  git commit failed (missing git identity?) — repo left staged.");
+				return false;
+			});
+		}
+	}
 	if (!options.skipInstall) {
 		console.log("Installing dependencies...");
 		await spawn("pnpm", ["install"], {
 			cwd: targetDir,
 			stdio: "inherit"
 		});
+		if (scaffoldCommitted) await spawn("git", [
+			"add",
+			"--",
+			"pnpm-lock.yaml"
+		], { cwd: targetDir }).then(() => spawn("git", [
+			"commit",
+			"--amend",
+			"--no-edit",
+			"--quiet"
+		], { cwd: targetDir })).catch(() => {});
 	} else console.log("Skipped pnpm install (--skip-install).");
 	console.log(`\n✅ Project created at ${targetDir}`);
 	console.log("\nNext steps:");

package/lib/commands/updateApp.mjs

@@ -1,3 +1,4 @@
+import { generateVscodeConfig } from "../generateVscode.mjs";
 import { cliVersion, initApp, readProvenance, writeProvenance } from "./initApp.mjs";
 import { join } from "node:path";
 import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
@@ -76,8 +77,10 @@ async function scaffoldBaseline(version, name, template, mpoVersion) {
 	});
 	const current = cliVersion();
 	const templateFlag = template === "app" ? ["--web"] : ["--universal"];
-	if (version !== current) {
-		try {
+	const [major = 0, minor = 0] = version.split(".").map(Number);
+	if (!(major > 6 || major === 6 && minor >= 3)) console.warn(`⚠️  @multiplatform.one/cli@${version} predates the consumer scaffolder (6.3.0); using the current CLI's template as the merge base.`);
+	else if (version !== current) {
+		for (let attempt = 1; attempt <= 2; attempt++) try {
 			await spawn("pnpm", [
 				"--package",
 				`@multiplatform.one/cli@${version}`,
@@ -99,9 +102,14 @@ async function scaffoldBaseline(version, name, template, mpoVersion) {
 				dir,
 				cleanup
 			};
-			console.warn(`⚠️  dlx scaffold for @multiplatform.one/cli@${version} produced no project;`);
+			console.warn(`⚠️  dlx scaffold for @multiplatform.one/cli@${version} produced no project`);
+			break;
 		} catch {
-			console.warn(`⚠️  could not scaffold baseline with @multiplatform.one/cli@${version} (network?);`);
+			rmSync(join(parent, name), {
+				recursive: true,
+				force: true
+			});
+			if (attempt === 2) console.warn(`⚠️  could not scaffold baseline with @multiplatform.one/cli@${version} (network?);`);
 		}
 		console.warn("   falling back to the current CLI's template as the merge base.");
 	}
@@ -110,6 +118,7 @@ async function scaffoldBaseline(version, name, template, mpoVersion) {
 	try {
 		await initApp(name, {
 			skipInstall: true,
+			skipGit: true,
 			yes: true,
 			template,
 			version: mpoVersion
@@ -122,6 +131,50 @@ async function scaffoldBaseline(version, name, template, mpoVersion) {
 		cleanup
 	};
 }
+/** Return a tree derived from `tree` where every path matching `pins` is
+*  replaced by its content in `headCommit` (removed when absent there).
+*  Pure index plumbing — the worktree is untouched. */
+async function pinPathsToHead(projectDir, tree, headCommit, pins) {
+	const indexFile = join(mkdtempSync(join(tmpdir(), "mpo-pin-")), "index");
+	const env = { GIT_INDEX_FILE: indexFile };
+	await git(projectDir, ["read-tree", tree], env);
+	for (const pin of pins) {
+		const inTree = await gitOut(projectDir, [
+			"ls-tree",
+			"-r",
+			"--name-only",
+			tree,
+			"--",
+			pin
+		], env).then((out) => out.split("\n").filter(Boolean)).catch(() => []);
+		for (const path of inTree) await git(projectDir, [
+			"update-index",
+			"--force-remove",
+			"--",
+			path
+		], env).catch(() => {});
+		const headEntries = await gitOut(projectDir, [
+			"ls-tree",
+			"-r",
+			headCommit,
+			"--",
+			pin
+		], env).catch(() => "");
+		for (const line of headEntries.split("\n").filter(Boolean)) {
+			const match = line.match(/^(\d+) \S+ ([0-9a-f]+)\t(.+)$/);
+			if (!match) continue;
+			await git(projectDir, [
+				"update-index",
+				"--add",
+				"--cacheinfo",
+				`${match[1]},${match[2]},${match[3]}`
+			], env).catch(() => {});
+		}
+	}
+	const pinned = await gitOut(projectDir, ["write-tree"], env);
+	rmSync(indexFile, { force: true });
+	return pinned;
+}
 async function updateApp(options = {}) {
 	const projectDir = await gitOut(process.cwd(), ["rev-parse", "--show-toplevel"]).catch(() => {
 		throw new Error("mpo update must run inside a git repository");
@@ -147,12 +200,8 @@ async function updateApp(options = {}) {
 	const base = await scaffoldBaseline(provenance.cliVersion, provenance.name, provenance.template, provenance.mpoVersion);
 	console.log(`Scaffolding update target (cli@${currentVersion})...`);
 	const next = await scaffoldBaseline(currentVersion, provenance.name, provenance.template, targetMpoRange);
-	writeProvenance(next.dir, {
-		template: provenance.template,
-		cliVersion: currentVersion,
-		name: provenance.name,
-		mpoVersion: targetMpoRange
-	});
+	rmSync(join(base.dir, ".mpo.json"), { force: true });
+	rmSync(join(next.dir, ".mpo.json"), { force: true });
 	try {
 		const head = await gitOut(projectDir, ["rev-parse", "HEAD"]);
 		const baseCommit = await commitTreeFromDir(projectDir, base.dir, `mpo scaffold ${provenance.template}@${provenance.cliVersion}`);
@@ -169,10 +218,11 @@ async function updateApp(options = {}) {
 				nextCommit
 			])).split("\n")[0].trim();
 		} catch (err) {
-			const lines = (err.stdout ?? "").split("\n").filter(Boolean);
-			if (!lines.length) throw err;
+			const lines = (err.stdout ?? "").split("\n");
+			if (!lines[0]?.trim()) throw err;
 			mergedTree = lines[0].trim();
-			conflicts = lines.slice(1).map((line) => line.trim());
+			const blank = lines.indexOf("", 1);
+			conflicts = lines.slice(1, blank === -1 ? void 0 : blank).map((line) => line.trim()).filter(Boolean);
 		}
 		const finalProvenance = {
 			template: provenance.template,
@@ -180,6 +230,33 @@ async function updateApp(options = {}) {
 			name: provenance.name,
 			mpoVersion: targetMpoRange
 		};
+		const pins = ["pnpm-lock.yaml"];
+		const updateignore = join(projectDir, ".updateignore");
+		if (existsSync(updateignore)) for (const line of readFileSync(updateignore, "utf-8").split("\n")) {
+			const pattern = line.trim();
+			if (pattern && !pattern.startsWith("#")) pins.push(pattern);
+		}
+		mergedTree = await pinPathsToHead(projectDir, mergedTree, head, pins);
+		conflicts = conflicts.filter((file) => !pins.some((pin) => file === pin || file.startsWith(`${pin}/`)));
+		const headTree = await gitOut(projectDir, ["rev-parse", `${head}^{tree}`]);
+		if (!conflicts.length && mergedTree === headTree) {
+			if (provenance.cliVersion !== finalProvenance.cliVersion || provenance.mpoVersion !== finalProvenance.mpoVersion) {
+				writeProvenance(projectDir, finalProvenance);
+				await git(projectDir, [
+					"add",
+					"--",
+					".mpo.json"
+				]);
+				await git(projectDir, [
+					"commit",
+					"--quiet",
+					"-m",
+					`chore: record mpo template provenance ${currentVersion}`
+				]);
+				console.log("\n✅ already up to date (provenance refreshed)");
+			} else console.log("\n✅ already up to date");
+			return;
+		}
 		if (!conflicts.length) {
 			const message = `chore: mpo update ${provenance.cliVersion} → ${currentVersion}`;
 			await git(projectDir, [
@@ -202,10 +279,14 @@ async function updateApp(options = {}) {
 				"HEAD"
 			]);
 			writeProvenance(projectDir, finalProvenance);
+			try {
+				await generateVscodeConfig(projectDir);
+			} catch {}
 			await git(projectDir, [
 				"add",
 				"--",
-				".mpo.json"
+				".mpo.json",
+				".vscode"
 			]);
 			await git(projectDir, [
 				"commit",
@@ -231,24 +312,33 @@ async function updateApp(options = {}) {
 			for (const file of conflicts) console.log(`   ${file}`);
 			console.log(`\n   git add -A && git commit -m "chore: mpo update ${provenance.cliVersion} → ${currentVersion}"`);
 		}
-		const pins = ["pnpm-lock.yaml"];
-		const updateignore = join(projectDir, ".updateignore");
-		if (existsSync(updateignore)) for (const line of readFileSync(updateignore, "utf-8").split("\n")) {
-			const pattern = line.trim();
-			if (pattern && !pattern.startsWith("#")) pins.push(pattern);
-		}
-		for (const pin of pins) await git(projectDir, [
-			"checkout",
-			head,
-			"--",
-			pin
-		]).catch(() => {});
-		if (!options.skipInstall) {
+		if (conflicts.length && !options.skipInstall) console.log("\nSkipping pnpm install until conflicts are resolved (then run: pnpm install).");
+		else if (!options.skipInstall) {
 			console.log("\nInstalling dependencies...");
 			await spawn("pnpm", ["install"], {
 				cwd: projectDir,
 				stdio: "inherit"
 			});
+			if (!conflicts.length) {
+				if (await git(projectDir, [
+					"diff",
+					"--quiet",
+					"--",
+					"pnpm-lock.yaml"
+				]).then(() => false, () => true)) {
+					await git(projectDir, [
+						"add",
+						"--",
+						"pnpm-lock.yaml"
+					]);
+					await git(projectDir, [
+						"commit",
+						"--amend",
+						"--no-edit",
+						"--quiet"
+					]);
+				}
+			}
 		}
 	} finally {
 		base.cleanup();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/cli",
-  "version": "6.4.0",
+  "version": "6.4.1",
   "description": "multiplatform.one cli — mpo init / create-multiplatform-app",
   "keywords": [
     "create-multiplatform-app",
@@ -61,7 +61,7 @@
     "nano-spawn": "^2.1.0",
     "yaml": "^2.8.3",
     "yocto-spinner": "^1.1.0",
-    "@multiplatform.one/utils": "6.4.0"
+    "@multiplatform.one/utils": "6.4.1"
   },
   "devDependencies": {
     "@types/inquirer": "^9.0.9",

package/src/bin/multiplatformOne.ts

@@ -222,6 +222,7 @@ program
   .option("--web", "scaffold the web-only template (Vite + React)")
   .option("--app", "alias of --web (back-compat)")
   .option("--skip-install", "skip pnpm install after scaffolding")
+  .option("--skip-git", "skip git init + scaffold commit")
   .option(
     "--mpo-version <range>",
     "semver range for @multiplatform.one/* (default: ^<cli version>)",
@@ -270,6 +271,7 @@ program
     }
     await initApp(name, {
       skipInstall: Boolean(options.skipInstall),
+      skipGit: Boolean(options.skipGit),
       version: options.mpoVersion,
       template: webOnly ? "app" : options.universal ? "universal" : undefined,
       yes: Boolean(options.yes),
@@ -306,17 +308,26 @@ program
       throw new Error("mpo cannot be updated outside of a git repository");
     }
     // Scaffolded consumer projects carry .mpo.json provenance — use the
-    // copier-style three-way template update. Monorepo forks fall through to
-    // the legacy upstream-merge flow below.
+    // copier-style three-way template update. Monorepo forks (identified by
+    // the legacy features/package.json marker) fall through to the upstream-
+    // merge flow below; anything else gets the provenance guidance instead
+    // of the fork flow's unrelated errors.
     if (readProvenance(projectRoot)) {
       await updateApp({ skipInstall: options.skipInstall, version: options.mpoVersion });
-      try {
-        await generateVscodeConfig(projectRoot);
-      } catch {
-        // best-effort
-      }
       return;
     }
+    const legacyFork = await fs.stat(path.resolve(projectRoot, "features/package.json")).then(
+      (stat) => stat.isFile(),
+      () => false,
+    );
+    if (!legacyFork) {
+      throw new Error(
+        ".mpo.json not found — this project predates scaffold provenance. " +
+          "Create it with { template, cliVersion, name } matching how the project " +
+          "was generated (cliVersion = the @multiplatform.one/cli that scaffolded it), " +
+          "then re-run `mpo update`.",
+      );
+    }
     // Require clean working tree (no staged or unstaged changes)
     if (
       await spawn("git", ["diff", "--cached", "--quiet"]).then(
@@ -806,7 +817,14 @@ program
     });
   });
 
-program.parse(process.argv);
+// One-line errors instead of raw stack traces (matches the
+// create-multiplatform-app bin). Stacks stay available via MPO_DEBUG=1.
+program.parseAsync(process.argv).catch((err: unknown) => {
+  const error = err as Error;
+  if (process.env.MPO_DEBUG) console.error(error);
+  else console.error(`✖ ${error.message ?? String(err)}`);
+  process.exit(1);
+});
 
 async function waitWithSpinner(
   services: string[],

package/src/commands/initApp.ts

@@ -23,6 +23,8 @@ export type InitAppTemplate = "universal" | "app";
 export interface InitAppOptions {
   /** Skip pnpm install (useful for CI / dry scaffolding). */
   skipInstall?: boolean;
+  /** Skip git init + scaffold commit (mpo update baselines, nested dirs). */
+  skipGit?: boolean;
   /** Pin @multiplatform.one/* to this semver range. Default: ^<cli version>. */
   version?: string;
   /** Project template. When omitted: prompt (interactive) or "universal". */
@@ -250,12 +252,50 @@ export async function initApp(
     mpoVersion: vars.MPO_VERSION,
   });
 
+  // Initialize git with a scaffold commit (unless already inside a repo —
+  // e.g. scaffolding into an existing project dir). `mpo update` needs the
+  // scaffold as a committed baseline to merge on top of.
+  let scaffoldCommitted = false;
+  if (!options.skipGit) {
+    const insideRepo = await spawn("git", ["rev-parse", "--is-inside-work-tree"], {
+      cwd: targetDir,
+    }).then(
+      () => true,
+      () => false,
+    );
+    if (!insideRepo) {
+      const label = template === "universal" ? "universal" : "web-only";
+      await spawn("git", ["init", "--quiet"], { cwd: targetDir });
+      await spawn("git", ["add", "-A"], { cwd: targetDir });
+      scaffoldCommitted = await spawn(
+        "git",
+        ["commit", "--quiet", "-m", `feat: scaffold ${label} multiplatform.one app (mpo init)`],
+        { cwd: targetDir },
+      ).then(
+        () => true,
+        () => {
+          console.warn("⚠️  git commit failed (missing git identity?) — repo left staged.");
+          return false;
+        },
+      );
+    }
+  }
+
   if (!options.skipInstall) {
     console.log("Installing dependencies...");
     await spawn("pnpm", ["install"], {
       cwd: targetDir,
       stdio: "inherit",
     });
+    // The lockfile belongs to the scaffold — fold it into the scaffold
+    // commit so a fresh init is immediately clean.
+    if (scaffoldCommitted) {
+      await spawn("git", ["add", "--", "pnpm-lock.yaml"], { cwd: targetDir })
+        .then(() =>
+          spawn("git", ["commit", "--amend", "--no-edit", "--quiet"], { cwd: targetDir }),
+        )
+        .catch(() => {});
+    }
   } else {
     console.log("Skipped pnpm install (--skip-install).");
   }

package/src/commands/updateApp.ts

@@ -19,6 +19,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import spawn from "nano-spawn";
+import { generateVscodeConfig } from "../generateVscode";
 import { cliVersion, initApp, readProvenance, writeProvenance } from "./initApp";
 
 export interface UpdateAppOptions {
@@ -73,32 +74,51 @@ async function scaffoldBaseline(
   const cleanup = () => rmSync(parent, { recursive: true, force: true });
   const current = cliVersion();
   const templateFlag = template === "app" ? ["--web"] : ["--universal"];
-  if (version !== current) {
-    try {
-      await spawn(
-        "pnpm",
-        [
-          "--package",
-          `@multiplatform.one/cli@${version}`,
-          "dlx",
-          "mpo",
-          "init",
-          name,
-          "--yes",
-          "--skip-install",
-          "--mpo-version",
-          mpoVersion,
-          ...templateFlag,
-        ],
-        { cwd: parent, stdio: "inherit" },
-      );
-      const dir = join(parent, name);
-      if (existsSync(join(dir, "package.json"))) return { dir, cleanup };
-      console.warn(`⚠️  dlx scaffold for @multiplatform.one/cli@${version} produced no project;`);
-    } catch {
-      console.warn(
-        `⚠️  could not scaffold baseline with @multiplatform.one/cli@${version} (network?);`,
-      );
+  // The consumer scaffolder (initApp + templates) shipped in 6.3.0 —
+  // earlier CLIs only had the monorepo-clone init and cannot regenerate a
+  // scaffold baseline.
+  const [major = 0, minor = 0] = version.split(".").map(Number);
+  const scaffoldCapable = major > 6 || (major === 6 && minor >= 3);
+  if (!scaffoldCapable) {
+    console.warn(
+      `⚠️  @multiplatform.one/cli@${version} predates the consumer scaffolder (6.3.0); ` +
+        "using the current CLI's template as the merge base.",
+    );
+  } else if (version !== current) {
+    // Older published CLIs reject flags they don't know (--skip-git), so
+    // only the stable flag set is passed; a scaffold-side git repo is
+    // harmless (index operations never descend into nested .git dirs).
+    for (let attempt = 1; attempt <= 2; attempt++) {
+      try {
+        await spawn(
+          "pnpm",
+          [
+            "--package",
+            `@multiplatform.one/cli@${version}`,
+            "dlx",
+            "mpo",
+            "init",
+            name,
+            "--yes",
+            "--skip-install",
+            "--mpo-version",
+            mpoVersion,
+            ...templateFlag,
+          ],
+          { cwd: parent, stdio: "inherit" },
+        );
+        const dir = join(parent, name);
+        if (existsSync(join(dir, "package.json"))) return { dir, cleanup };
+        console.warn(`⚠️  dlx scaffold for @multiplatform.one/cli@${version} produced no project`);
+        break;
+      } catch {
+        rmSync(join(parent, name), { recursive: true, force: true });
+        if (attempt === 2) {
+          console.warn(
+            `⚠️  could not scaffold baseline with @multiplatform.one/cli@${version} (network?);`,
+          );
+        }
+      }
     }
     console.warn("   falling back to the current CLI's template as the merge base.");
   }
@@ -107,6 +127,7 @@ async function scaffoldBaseline(
   try {
     await initApp(name, {
       skipInstall: true,
+      skipGit: true,
       yes: true,
       template,
       version: mpoVersion,
@@ -117,6 +138,48 @@ async function scaffoldBaseline(
   return { dir: join(parent, name), cleanup };
 }
 
+/** Return a tree derived from `tree` where every path matching `pins` is
+ *  replaced by its content in `headCommit` (removed when absent there).
+ *  Pure index plumbing — the worktree is untouched. */
+async function pinPathsToHead(
+  projectDir: string,
+  tree: string,
+  headCommit: string,
+  pins: string[],
+): Promise<string> {
+  const indexFile = join(mkdtempSync(join(tmpdir(), "mpo-pin-")), "index");
+  const env = { GIT_INDEX_FILE: indexFile };
+  await git(projectDir, ["read-tree", tree], env);
+  for (const pin of pins) {
+    // Paths under the pin in the merged tree (to drop when HEAD lacks them).
+    const inTree = await gitOut(projectDir, ["ls-tree", "-r", "--name-only", tree, "--", pin], env)
+      .then((out) => out.split("\n").filter(Boolean))
+      .catch(() => [] as string[]);
+    for (const path of inTree) {
+      await git(projectDir, ["update-index", "--force-remove", "--", path], env).catch(() => {});
+    }
+    // HEAD's entries for the pin (restored verbatim).
+    const headEntries = await gitOut(
+      projectDir,
+      ["ls-tree", "-r", headCommit, "--", pin],
+      env,
+    ).catch(() => "");
+    for (const line of headEntries.split("\n").filter(Boolean)) {
+      // "<mode> blob <oid>\t<path>"
+      const match = line.match(/^(\d+) \S+ ([0-9a-f]+)\t(.+)$/);
+      if (!match) continue;
+      await git(
+        projectDir,
+        ["update-index", "--add", "--cacheinfo", `${match[1]},${match[2]},${match[3]}`],
+        env,
+      ).catch(() => {});
+    }
+  }
+  const pinned = await gitOut(projectDir, ["write-tree"], env);
+  rmSync(indexFile, { force: true });
+  return pinned;
+}
+
 export async function updateApp(options: UpdateAppOptions = {}): Promise<void> {
   const projectDir = await gitOut(process.cwd(), ["rev-parse", "--show-toplevel"]).catch(() => {
     throw new Error("mpo update must run inside a git repository");
@@ -168,12 +231,13 @@ export async function updateApp(options: UpdateAppOptions = {}): Promise<void> {
     provenance.template,
     targetMpoRange,
   );
-  writeProvenance(next.dir, {
-    template: provenance.template,
-    cliVersion: currentVersion,
-    name: provenance.name,
-    mpoVersion: targetMpoRange,
-  });
+
+  // .mpo.json is TOOL-owned, never merged: pre-provenance CLIs (≤6.3.0)
+  // didn't write it, so leaving it in the scaffolds guarantees an add/add
+  // phantom conflict on every honest old-baseline update. It is stripped
+  // from both synthetic trees and written authoritatively after the merge.
+  rmSync(join(base.dir, ".mpo.json"), { force: true });
+  rmSync(join(next.dir, ".mpo.json"), { force: true });
 
   try {
     // 3. Three-way merge: base → HEAD (ours) vs base → next (theirs).
@@ -203,12 +267,18 @@ export async function updateApp(options: UpdateAppOptions = {}): Promise<void> {
       ]);
       mergedTree = out.split("\n")[0]!.trim();
     } catch (err) {
-      // Exit code 1 = conflicts; stdout still carries tree + conflict names.
+      // Exit code 1 = conflicts. Output format: <tree>\n<conflicted file
+      // names, one per line>\n\n<informational messages> — only the names
+      // section (up to the blank line) lists conflicted paths.
       const stdout = (err as { stdout?: string }).stdout ?? "";
-      const lines = stdout.split("\n").filter(Boolean);
-      if (!lines.length) throw err;
-      mergedTree = lines[0]!.trim();
-      conflicts = lines.slice(1).map((line) => line.trim());
+      const lines = stdout.split("\n");
+      if (!lines[0]?.trim()) throw err;
+      mergedTree = lines[0].trim();
+      const blank = lines.indexOf("", 1);
+      conflicts = lines
+        .slice(1, blank === -1 ? undefined : blank)
+        .map((line) => line.trim())
+        .filter(Boolean);
     }
 
     // The merged .mpo.json can interleave ours/theirs lines (add/add
@@ -221,6 +291,47 @@ export async function updateApp(options: UpdateAppOptions = {}): Promise<void> {
       mpoVersion: targetMpoRange,
     };
 
+    // .updateignore pathspecs (+ pnpm-lock.yaml) pin to the pre-update HEAD.
+    // Pins are applied to the MERGED TREE before committing, so a clean
+    // update never leaves the tree dirty.
+    const pins = ["pnpm-lock.yaml"];
+    const updateignore = join(projectDir, ".updateignore");
+    if (existsSync(updateignore)) {
+      for (const line of readFileSync(updateignore, "utf-8").split("\n")) {
+        const pattern = line.trim();
+        if (pattern && !pattern.startsWith("#")) pins.push(pattern);
+      }
+    }
+    mergedTree = await pinPathsToHead(projectDir, mergedTree, head, pins);
+    // Pinning resolves any conflict inside a pinned path (the pre-update
+    // HEAD content wins by definition).
+    conflicts = conflicts.filter(
+      (file) => !pins.some((pin) => file === pin || file.startsWith(`${pin}/`)),
+    );
+
+    // No-op detection: identical trees mean the project already carries the
+    // current template — don't stack empty merge commits.
+    const headTree = await gitOut(projectDir, ["rev-parse", `${head}^{tree}`]);
+    if (!conflicts.length && mergedTree === headTree) {
+      if (
+        provenance.cliVersion !== finalProvenance.cliVersion ||
+        provenance.mpoVersion !== finalProvenance.mpoVersion
+      ) {
+        writeProvenance(projectDir, finalProvenance);
+        await git(projectDir, ["add", "--", ".mpo.json"]);
+        await git(projectDir, [
+          "commit",
+          "--quiet",
+          "-m",
+          `chore: record mpo template provenance ${currentVersion}`,
+        ]);
+        console.log("\n✅ already up to date (provenance refreshed)");
+      } else {
+        console.log("\n✅ already up to date");
+      }
+      return;
+    }
+
     if (!conflicts.length) {
       const message = `chore: mpo update ${provenance.cliVersion} → ${currentVersion}`;
       const mergeCommit = await gitOut(projectDir, [
@@ -235,14 +346,21 @@ export async function updateApp(options: UpdateAppOptions = {}): Promise<void> {
       ]);
       await git(projectDir, ["update-ref", "HEAD", mergeCommit]);
       await git(projectDir, ["reset", "--hard", "HEAD"]);
+      // Tool-owned outputs belong to the update commit: provenance + the
+      // regenerated .vscode config.
       writeProvenance(projectDir, finalProvenance);
-      await git(projectDir, ["add", "--", ".mpo.json"]);
+      try {
+        await generateVscodeConfig(projectDir);
+      } catch {
+        // best-effort (older layouts)
+      }
+      await git(projectDir, ["add", "--", ".mpo.json", ".vscode"]);
       await git(projectDir, ["commit", "--amend", "--no-edit", "--quiet"]);
       const amended = await gitOut(projectDir, ["rev-parse", "--short", "HEAD"]);
       console.log(`\n✅ merged cleanly → ${amended} ("${message}")`);
     } else {
       // Land the merged tree (with conflict markers) in index + worktree for
-      // manual resolution.
+      // manual resolution; pins are already part of the tree.
       await git(projectDir, ["read-tree", "-u", "--reset", mergedTree]);
       writeProvenance(projectDir, finalProvenance);
       console.log("\n⚠️  merge conflicts — resolve the markers, then commit:");
@@ -252,23 +370,29 @@ export async function updateApp(options: UpdateAppOptions = {}): Promise<void> {
       );
     }
 
-    // 4. .updateignore: pin matching paths to the pre-update HEAD (always
-    // includes pnpm-lock.yaml — the install below regenerates it).
-    const pins = ["pnpm-lock.yaml"];
-    const updateignore = join(projectDir, ".updateignore");
-    if (existsSync(updateignore)) {
-      for (const line of readFileSync(updateignore, "utf-8").split("\n")) {
-        const pattern = line.trim();
-        if (pattern && !pattern.startsWith("#")) pins.push(pattern);
-      }
-    }
-    for (const pin of pins) {
-      await git(projectDir, ["checkout", head, "--", pin]).catch(() => {});
-    }
-
-    if (!options.skipInstall) {
+    if (conflicts.length && !options.skipInstall) {
+      console.log("\nSkipping pnpm install until conflicts are resolved (then run: pnpm install).");
+    } else if (!options.skipInstall) {
       console.log("\nInstalling dependencies...");
       await spawn("pnpm", ["install"], { cwd: projectDir, stdio: "inherit" });
+      // The merge changed dependency ranges, so the regenerated lockfile
+      // belongs with the update: amend it into the clean-merge commit
+      // (conflict resolutions commit manually and pick it up there).
+      if (!conflicts.length) {
+        const lockDirty = await git(projectDir, [
+          "diff",
+          "--quiet",
+          "--",
+          "pnpm-lock.yaml",
+        ]).then(
+          () => false,
+          () => true,
+        );
+        if (lockDirty) {
+          await git(projectDir, ["add", "--", "pnpm-lock.yaml"]);
+          await git(projectDir, ["commit", "--amend", "--no-edit", "--quiet"]);
+        }
+      }
     }
   } finally {
     base.cleanup();

package/templates/app/gitignore

@@ -2,6 +2,7 @@ node_modules
 dist
 .turbo
 .vite
+.tamagui
 *.log
 .env
 .env.local

package/templates/universal/apps/__NAME__/vite.config.ts

@@ -1,53 +1,8 @@
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
 import { createViteConfig } from "@multiplatform.one/config/vite";
 import { one } from "one/vite";
-import type { Plugin } from "vite";
-import { public as publicConfigKeys } from "../../packages/config/config.json";
+import configJson from "../../packages/config/config.json" with { type: "json" };
 
-const require = createRequire(import.meta.url);
-
-/**
- * Some @multiplatform.one packages at 6.1.0 publish web export targets that
- * don't exist in their tarballs (exports say dist/esm/…/index.js; the build
- * emitted index.mjs), which breaks resolution for anything importing them —
- * e.g. forms → router and frappe-ui → frappe. Resolve those bare imports to
- * the real web builds. Native is unaffected (vxrn's native resolver uses the
- * packages' valid react-native export condition). Remove this plugin once
- * fixed packages are published.
- */
-const BROKEN_PUBLISHED_ENTRIES: Record<string, { pkg: string; entry: string }> = {
-  "@multiplatform.one/router": {
-    pkg: "@multiplatform.one/router",
-    entry: "dist/esm/index.mjs",
-  },
-  "@multiplatform.one/frappe": {
-    pkg: "@multiplatform.one/frappe",
-    entry: "dist/esm/index.mjs",
-  },
-  "@multiplatform.one/frappe/devtools": {
-    pkg: "@multiplatform.one/frappe",
-    entry: "dist/esm/devtools/index.mjs",
-  },
-};
-
-function fixPublishedEsmEntries(): Plugin {
-  return {
-    name: "fix-multiplatform-published-esm-entries",
-    enforce: "pre",
-    resolveId(id) {
-      const broken = BROKEN_PUBLISHED_ENTRIES[id];
-      if (!broken) return null;
-      try {
-        const pkgJson = require.resolve(`${broken.pkg}/package.json`);
-        const entry = pkgJson.replace(/package\.json$/, broken.entry);
-        return existsSync(entry) ? entry : null;
-      } catch {
-        return null;
-      }
-    },
-  };
-}
+const publicConfigKeys = configJson.public;
 
 export default createViteConfig({
   publicConfigKeys,
@@ -61,6 +16,5 @@ export default createViteConfig({
       react: { compiler: true },
       native: { key: "__NAME_PASCAL__" },
     }),
-    fixPublishedEsmEntries(),
   ],
 });

package/templates/universal/gitignore

@@ -5,6 +5,8 @@ dist
 .tamagui
 .expo
 *.log
+# One router generated typings
+routes.d.ts
 .env
 .env.local
 .DS_Store

package/types/commands/initApp.d.ts

@@ -9,6 +9,8 @@ export type InitAppTemplate = "universal" | "app";
 export interface InitAppOptions {
     /** Skip pnpm install (useful for CI / dry scaffolding). */
     skipInstall?: boolean;
+    /** Skip git init + scaffold commit (mpo update baselines, nested dirs). */
+    skipGit?: boolean;
     /** Pin @multiplatform.one/* to this semver range. Default: ^<cli version>. */
     version?: string;
     /** Project template. When omitted: prompt (interactive) or "universal". */

package/types/commands/initApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initApp.d.ts","sourceRoot":"","sources":["../../src/commands/initApp.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mEAAmE;IACnE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AA0CD,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAQ/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,IAAI,CAElF;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAe5E;AAuED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA6Ef"}
+{"version":3,"file":"initApp.d.ts","sourceRoot":"","sources":["../../src/commands/initApp.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mEAAmE;IACnE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AA0CD,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAQ/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,IAAI,CAElF;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAe5E;AAuED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmHf"}

package/types/commands/updateApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateApp.d.ts","sourceRoot":"","sources":["../../src/commands/updateApp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA2FD,wBAAsB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6J7E"}
+{"version":3,"file":"updateApp.d.ts","sourceRoot":"","sources":["../../src/commands/updateApp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyJD,wBAAsB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0N7E"}