@nemus-cli/nemus 0.2.7 → 0.2.9

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.9] - 2026-08-26
+
+### Fixed
+
+- Synced `package-lock.json` to the current version (it had drifted to 0.2.7
+  while package.json was 0.2.8, because the ink/React upgrade regenerated the
+  lockfile before the version bump).
+
+### Added
+
+- CI guard `scripts/check-lock-version.js` — fails PR CI (and the release verify
+  step) if `package-lock.json`'s `version` / `packages[""]` drift from
+  package.json, so a stale lockfile can't reach `npm ci` at release time.
+
+## [0.2.8] - 2026-08-26
+
+### Changed
+
+- Upgraded **ink 5 → 7** and **React 18 → 19** (with `@types/react` 19). The
+  dashboard TUI renders through the same CJS/ESM bridge (`sidebar.js` does the
+  real `await import('ink')`; components receive `Box`/`Text`/`useInput`/`useApp`
+  as props). Verified: build, typecheck, 433 unit tests, and a live pty render of
+  the dashboard sidebar. No user-facing change.
+
 ## [0.2.7] - 2026-08-25
 
 ### Changed
@@ -171,7 +195,9 @@ Initial open-source release of **Nemus**.
 - Automatic retries with backoff on flaky network operations.
 - Optional shell integration (auto-cd on create + quick-navigate helper).
 
-[Unreleased]: https://github.com/me-public/nemus/compare/v0.2.7...HEAD
+[Unreleased]: https://github.com/me-public/nemus/compare/v0.2.9...HEAD
+[0.2.9]: https://github.com/me-public/nemus/compare/v0.2.8...v0.2.9
+[0.2.8]: https://github.com/me-public/nemus/compare/v0.2.7...v0.2.8
 [0.2.7]: https://github.com/me-public/nemus/compare/v0.2.6...v0.2.7
 [0.2.6]: https://github.com/me-public/nemus/compare/v0.2.5...v0.2.6
 [0.2.5]: https://github.com/me-public/nemus/compare/v0.2.4...v0.2.5

package/dist/commands/dashboard/sidebar.js

@@ -4,7 +4,7 @@
  *
  * This is a plain .js file (not .ts) to preserve the real dynamic import().
  * TypeScript compiles `await import('ink')` into `require('ink')` in CJS mode,
- * which fails because ink v5 is ESM-only with top-level await.
+ * which fails because ink v7 is ESM-only with top-level await.
  *
  * By keeping this as .js, tsc copies it as-is to dist/ and the real
  * import() call is preserved at runtime.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nemus-cli/nemus",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Nemus — a CLI for managing multi-repository workspaces. Create, sync, and operate across dozens of repos with a single command, and wire them up to your favorite coding agent.",
   "keywords": [
     "workspace",
@@ -68,11 +68,11 @@
     "cli-progress": "^3.12.0",
     "commander": "^15.0.0",
     "fuzzy": "^0.1.3",
-    "ink": "^5.0.0",
+    "ink": "^7.1.1",
     "inquirer": "^8.0.0",
     "inquirer-autocomplete-prompt": "^2.0.0",
     "markdown-table": "^3.0.3",
-    "react": "^18.3.1",
+    "react": "^19.2.8",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -80,7 +80,7 @@
     "@types/inquirer": "^9.0.3",
     "@types/inquirer-autocomplete-prompt": "^2.0.0",
     "@types/node": "^26.3.0",
-    "@types/react": "^18.3.31",
+    "@types/react": "^19.2.2",
     "ts-node": "^10.9.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11"

package/scripts/check-lock-version.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * CI guard: fail if package-lock.json's version fields drift from package.json.
+ *
+ * A stale lockfile version makes `npm ci` fail at release time (npm errors on a
+ * package.json/lock mismatch before build/publish run). This catches the drift
+ * in PR CI instead. Checks both the lockfile root `version` and the self entry
+ * at `packages[""]`.
+ *
+ * Usage: node scripts/check-lock-version.js
+ * Exit 0 when consistent, 1 (with an ::error:: annotation) otherwise.
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function read(file) {
+  return JSON.parse(fs.readFileSync(path.join(__dirname, '..', file), 'utf8'));
+}
+
+const pkg = read('package.json');
+const lock = read('package-lock.json');
+
+const pkgV = pkg.version;
+const rootV = lock.version;
+const selfV = lock.packages && lock.packages[''] && lock.packages[''].version;
+
+const errs = [];
+if (rootV !== pkgV) {
+  errs.push(`package-lock.json root version "${rootV}" != package.json "${pkgV}"`);
+}
+if (selfV !== pkgV) {
+  errs.push(`package-lock.json packages[""] version "${selfV}" != package.json "${pkgV}"`);
+}
+
+if (errs.length) {
+  console.error('::error::' + errs.join('; '));
+  console.error('Fix: run `npm install --package-lock-only` and commit package-lock.json.');
+  process.exit(1);
+}
+
+console.log(`\u2713 package-lock.json version matches package.json (${pkgV})`);

package/src/cli/dashboard/types.ts

@@ -1,7 +1,7 @@
 /**
  * Shared types for ink dashboard components.
  * ink components are passed as props to avoid direct ESM imports
- * (ink v5 is ESM-only; the project uses CJS).
+ * (ink v7 is ESM-only; the project uses CJS).
  */
 import { FC } from 'react';
 import { BoxProps, TextProps, Key } from 'ink';

package/src/commands/dashboard/sidebar.js

@@ -4,7 +4,7 @@
  *
  * This is a plain .js file (not .ts) to preserve the real dynamic import().
  * TypeScript compiles `await import('ink')` into `require('ink')` in CJS mode,
- * which fails because ink v5 is ESM-only with top-level await.
+ * which fails because ink v7 is ESM-only with top-level await.
  *
  * By keeping this as .js, tsc copies it as-is to dist/ and the real
  * import() call is preserved at runtime.

package/src/types/ink.d.ts

@@ -1,5 +1,5 @@
 /**
- * Type declarations for ink v5 (ESM package used via dynamic import).
+ * Type declarations for ink v7 (ESM package used via dynamic import).
  * Provides basic types for the components and hooks we use.
  * Full types live in node_modules/ink/build/index.d.ts but can't be
  * resolved with moduleResolution: "node".