@noir-ai/create 1.15.0-beta.1 → 1.16.0-beta.1

package/dist/index.js

@@ -32,10 +32,11 @@ function writeAncestors(root, map) {
 
 // src/manifest.ts
 import { existsSync as existsSync2 } from "fs";
-import { join as join2, relative } from "path";
+import { join as join3, relative } from "path";
 import {
   AGENTS_MD_FILENAME,
   emitAgentsMd,
+  mcpConfigPathForAdapter,
   resolveAdapter
 } from "@noir-ai/adapters";
 import {
@@ -44,10 +45,48 @@ import {
   managedBlock,
   NOIR_DIR,
   paths,
-  RULES_BLOCK
+  RULES_BLOCK,
+  readWorkspaceMarker
 } from "@noir-ai/core";
+
+// src/template.ts
+var TOKEN = /\{\{\s*([^}{}]+?)\s*\}\}/g;
+function render(template, vars) {
+  return template.replace(TOKEN, (whole, name) => {
+    if (!Object.hasOwn(vars, name)) return whole;
+    const v = vars[name];
+    if (v === void 0 || v === null) return whole;
+    return String(v);
+  });
+}
+
+// src/template-loader.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, join as join2, resolve } from "path";
+import { fileURLToPath } from "url";
+var DEFAULT_TEMPLATES_DIR = resolveTemplatesDir();
+function resolveTemplatesDir() {
+  const override = process.env.NOIR_TEMPLATES_DIR;
+  if (override && override.length > 0) return resolve(override);
+  const here = dirname2(fileURLToPath(import.meta.url));
+  return join2(here, "..", "templates");
+}
+function loadTemplate(name) {
+  return readFileSync2(join2(DEFAULT_TEMPLATES_DIR, name), "utf8");
+}
+function templatesDir() {
+  return DEFAULT_TEMPLATES_DIR;
+}
+
+// src/manifest.ts
 var BRIEF_BLOCK = managedBlock("brief", "html");
 var README_BLOCK = managedBlock("readme", "html");
+var RULES_MAP_ROW_PREFIX = "| `rules/RULES.md` |";
+function readmeMapContent(ctx) {
+  const rendered = render(loadTemplate("noir-readme.md.tmpl"), ctx);
+  if (ctx.rulesEnabled !== false) return rendered;
+  return rendered.split("\n").filter((line) => !line.startsWith(RULES_MAP_ROW_PREFIX)).join("\n");
+}
 var P = {
   projectId: `${NOIR_DIR}/project.id`,
   config: `${NOIR_DIR}/config.yml`,
@@ -100,8 +139,9 @@ function hostAgnosticEntries(ctx) {
       // all-comment, so the file parses to an EMPTY overlay and creating it
       // changes no behaviour — it exists so the user never has to copy the
       // example by hand. `fileMode: 0o600` because the file holds tokens the
-      // moment the user edits it (set on creation only — skipIfExists never
-      // touches an existing file, so a user's own chmod stands).
+      // moment the user edits it. The mode is applied when the file is created;
+      // a copy that predates this contract (or that an editor saved by rename)
+      // has its mode re-asserted on every init/sync/create run — see `ensureOwnerOnly`.
       path: P.env,
       mode: "skipIfExists",
       template: "config.env.tmpl",
@@ -130,10 +170,14 @@ function hostAgnosticEntries(ctx) {
       // next. Host-agnostic: it describes the canonical store, which every
       // host shares. Co-owned (README_BLOCK) so user notes survive while the
       // map stays current through `noir sync` / `init --upgrade`.
+      //
+      // Rendered here rather than left to `renderEntry` because one row of the
+      // map depends on the project: the working-rules row is dropped when
+      // `rules.enabled` is off (see {@link readmeMapContent}).
       path: P.readme,
       mode: "managedBlock",
       block: README_BLOCK,
-      template: "noir-readme.md.tmpl",
+      content: readmeMapContent(ctx),
       description: ".noir/ runtime map (what exists now / what appears later)"
     },
     // --- ignore files (host-agnostic; co-owned via IGNORE_BLOCK) ------------
@@ -168,21 +212,24 @@ function hostAgnosticEntries(ctx) {
   ];
   const isEmpty = (ctx.stack?.languages?.length ?? 0) === 0 && !ctx.stack?.packageManager;
   const isJs = isEmpty || (ctx.stack?.languages?.some((l) => l === "typescript" || l === "javascript") ?? false) || ["npm", "pnpm", "yarn"].includes(ctx.stack?.packageManager ?? "");
-  const hasDocker = isEmpty || existsSync2(join2(ctx.root, "Dockerfile")) || existsSync2(join2(ctx.root, "docker-compose.yml")) || existsSync2(join2(ctx.root, "compose.yaml"));
+  const hasDocker = isEmpty || existsSync2(join3(ctx.root, "Dockerfile")) || existsSync2(join3(ctx.root, "docker-compose.yml")) || existsSync2(join3(ctx.root, "compose.yaml"));
+  const rulesEnabled = ctx.rulesEnabled !== false;
   return entries.filter((e) => {
+    if (e.path === P.rulesMd) return rulesEnabled;
     if (e.path === ".npmignore" || e.path === ".prettierignore") return isJs;
     if (e.path === ".dockerignore") return hasDocker;
     return true;
   });
 }
 function buildHostArtifacts(adapter, ctx) {
-  const ectx = { root: ctx.root };
+  const rulesEnabled = ctx.rulesEnabled !== false;
+  const ectx = { root: ctx.root, rulesEnabled };
   const host = adapter.id;
   const entries = [];
   const emitsAgentsMd = host === "agents-md" || host === "cursor" || host === "opencode";
   if (emitsAgentsMd) {
     entries.push({
-      path: hostRel(adapter.agentsMdPath?.(ectx) ?? join2(ctx.root, AGENTS_MD_FILENAME), ctx.root),
+      path: hostRel(adapter.agentsMdPath?.(ectx) ?? join3(ctx.root, AGENTS_MD_FILENAME), ctx.root),
       mode: "regenerate",
       host,
       content: emitAgentsMd(ectx),
@@ -199,14 +246,16 @@ function buildHostArtifacts(adapter, ctx) {
         template: "claude-context-block.md.tmpl",
         description: "CLAUDE.md context @import block"
       });
-      entries.push({
-        path: "CLAUDE.md",
-        mode: "managedBlock",
-        host,
-        block: RULES_BLOCK,
-        template: "claude-rules-block.md.tmpl",
-        description: "CLAUDE.md rules @import block"
-      });
+      if (rulesEnabled) {
+        entries.push({
+          path: "CLAUDE.md",
+          mode: "managedBlock",
+          host,
+          block: RULES_BLOCK,
+          template: "claude-rules-block.md.tmpl",
+          description: "CLAUDE.md rules @import block"
+        });
+      }
       break;
     case "gemini":
       entries.push({
@@ -217,23 +266,26 @@ function buildHostArtifacts(adapter, ctx) {
         content: "@.noir/NOIR.md",
         description: "GEMINI.md context @-import block"
       });
-      entries.push({
-        path: "GEMINI.md",
-        mode: "managedBlock",
-        host,
-        block: RULES_BLOCK,
-        content: "@.noir/rules/RULES.md",
-        description: "GEMINI.md rules @-import block"
-      });
+      if (rulesEnabled) {
+        entries.push({
+          path: "GEMINI.md",
+          mode: "managedBlock",
+          host,
+          block: RULES_BLOCK,
+          content: "@.noir/rules/RULES.md",
+          description: "GEMINI.md rules @-import block"
+        });
+      }
       break;
     case "agents-md":
     case "cursor":
     case "opencode":
       break;
   }
-  const mcpAbs = adapter.mcpConfigPath?.(ectx) ?? join2(ctx.root, ".mcp.json");
+  const mcpAbs = mcpConfigPathForAdapter(adapter, ctx.root);
   const mcpRel = hostRel(mcpAbs, ctx.root);
-  if (host === "claude") {
+  const workspace = readWorkspaceMarker(ctx.root);
+  if (host === "claude" && workspace === null) {
     const mcpTemplate = ctx.transport === "streamable-http" ? "mcp.http.json.tmpl" : "mcp.stdio.json.tmpl";
     entries.push({
       path: mcpRel,
@@ -243,18 +295,24 @@ function buildHostArtifacts(adapter, ctx) {
       description: "host MCP server pointer"
     });
   } else {
-    const mcpContent = `${adapter.emitMcpConfig(ectx, {
-      transport: ctx.transport,
-      command: ctx.command,
-      ...ctx.url !== void 0 ? { url: ctx.url } : {}
-    })}
+    const mcpContent = `${adapter.emitMcpConfig(
+      ectx,
+      workspace !== null ? (
+        // Joined: stdio + the workspace name, whatever transport was asked for.
+        { transport: "stdio", command: ctx.command, workspace }
+      ) : {
+        transport: ctx.transport,
+        command: ctx.command,
+        ...ctx.url !== void 0 ? { url: ctx.url } : {}
+      }
+    )}
 `;
     entries.push({
       path: mcpRel,
       mode: "regenerate",
       host,
       content: mcpContent,
-      description: `${host} MCP server pointer`
+      description: workspace !== null ? `${host} MCP server pointer (workspace "${workspace}")` : `${host} MCP server pointer`
     });
   }
   if (host === "claude") {
@@ -481,19 +539,15 @@ function mergeThreeWay(base, ours, theirs, style = "minimal") {
 }
 
 // src/migrations/index.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5 } from "path";
-
-// src/template.ts
-var TOKEN = /\{\{\s*([^}{}]+?)\s*\}\}/g;
-function render(template, vars) {
-  return template.replace(TOKEN, (whole, name) => {
-    if (!Object.hasOwn(vars, name)) return whole;
-    const v = vars[name];
-    if (v === void 0 || v === null) return whole;
-    return String(v);
-  });
-}
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5, relative as relative2, sep } from "path";
+import { mcpConfigPathFor, noirStdioArgs, TRANSPORT_KEYS } from "@noir-ai/adapters";
+import {
+  atomicWriteFile as atomicWriteFile2,
+  loadProjectInfo,
+  readWorkspaceMarker as readWorkspaceMarker2,
+  resolveNoirCommand
+} from "@noir-ai/core";
 
 // src/template-history.ts
 var ENV_EXAMPLE_1_1_0 = `# .noir/.env.example \u2014 committable documentation of the format.
@@ -734,24 +788,6 @@ function isStaleSeed(seed, fileBytes, currentRender) {
   return SEED_TEMPLATE_HISTORY.some((entry) => entry[seed] === fileBytes);
 }
 
-// src/template-loader.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join3, resolve } from "path";
-import { fileURLToPath } from "url";
-var DEFAULT_TEMPLATES_DIR = resolveTemplatesDir();
-function resolveTemplatesDir() {
-  const override = process.env.NOIR_TEMPLATES_DIR;
-  if (override && override.length > 0) return resolve(override);
-  const here = dirname2(fileURLToPath(import.meta.url));
-  return join3(here, "..", "templates");
-}
-function loadTemplate(name) {
-  return readFileSync2(join3(DEFAULT_TEMPLATES_DIR, name), "utf8");
-}
-function templatesDir() {
-  return DEFAULT_TEMPLATES_DIR;
-}
-
 // src/writers.ts
 import {
   closeSync,
@@ -760,11 +796,11 @@ import {
   readFileSync as readFileSync3,
   renameSync,
   rmSync,
-  writeFileSync as writeFileSync2,
   writeSync
 } from "fs";
 import { basename, dirname as dirname3, join as join4 } from "path";
 import { atomicWriteFile, stripManagedBlock, writeManagedRegion } from "@noir-ai/core";
+import { ensureOwnerOnly } from "@noir-ai/core";
 function regenerate(absPath, content) {
   const dir = dirname3(absPath);
   const tmp = join4(
@@ -818,7 +854,7 @@ function managedBlocks(absPath, regions) {
   const next = stripped.trim().length > 0 ? `${stripped.trimEnd()}
 
 ${regionsJoined}` : regionsJoined;
-  writeFileSync2(absPath, next, "utf8");
+  atomicWriteFile(absPath, next);
   return { path: absPath, mode: "managedBlock", written: true };
 }
 function buildRegion(block, body) {
@@ -911,7 +947,11 @@ function deepMergePreservingHooks(existing, patch, dedupSubstring) {
 // src/migrations/runner.ts
 function runMigrations(root, from, to, opts = {}) {
   const window = pickWindow(from ?? "0.0.0", to, MIGRATIONS);
-  const ctx = { root, dryRun: opts.dryRun === true };
+  const ctx = {
+    root,
+    dryRun: opts.dryRun === true,
+    rulesEnabled: opts.rulesEnabled
+  };
   const aggregate = { changed: [], conflicts: [], notes: [] };
   const ran = [];
   for (const script of window) {
@@ -960,7 +1000,7 @@ var synthetic = {
       if (existsSync4(file)) {
         const prev = readFileSync4(file, "utf8");
         const merged = applyInlineConflict(prev, "noir-scaffold=1.0.0\n", "ours", "theirs");
-        writeFileSync3(file, merged, "utf8");
+        writeFileSync2(file, merged, "utf8");
         result.conflicts.push(".noir/scaffold-version");
       }
     }
@@ -1015,7 +1055,7 @@ var envPointer = {
       return result;
     }
     try {
-      writeFileSync3(abs, appendSeparated(prev, ENV_POINTER_BLOCK), "utf8");
+      writeFileSync2(abs, appendSeparated(prev, ENV_POINTER_BLOCK), "utf8");
     } catch (err) {
       result.conflicts.push(rel);
       result.notes.push(`${rel}: write failed (${errorMessage(err)}) \u2014 left untouched`);
@@ -1037,6 +1077,10 @@ var envTemplates = {
   run: (ctx) => {
     const result = { changed: [], conflicts: [], notes: [] };
     for (const seed of DOC_SEEDS) {
+      if (seed.kind === "rulesSeed" && ctx.rulesEnabled === false) {
+        result.notes.push(`${seed.rel}: skipped \u2014 the working-rules switch is off`);
+        continue;
+      }
       const abs = join5(ctx.root, seed.rel);
       if (!existsSync4(abs)) {
         result.notes.push(`${seed.rel}: absent \u2014 nothing to refresh`);
@@ -1073,7 +1117,101 @@ var envTemplates = {
     return result;
   }
 };
-var MIGRATIONS = [synthetic, envPointer, envTemplates];
+function mcpConfigPath(root) {
+  let host = "claude";
+  try {
+    host = loadProjectInfo(root).config.host;
+  } catch {
+  }
+  const abs = mcpConfigPathFor(host, root);
+  if (!existsSync4(abs)) return null;
+  return { rel: relative2(root, abs).split(sep).join("/"), abs };
+}
+var workspaceBridge = {
+  from: "1.2.0",
+  to: "1.3.0",
+  description: "point a joined repo's MCP entry at the workspace bridge",
+  run: (ctx) => {
+    const result = { changed: [], conflicts: [], notes: [] };
+    const name = readWorkspaceMarker2(ctx.root);
+    if (name === null) {
+      result.notes.push("not joined to a workspace \u2014 nothing to rewrite");
+      return result;
+    }
+    const target = mcpConfigPath(ctx.root);
+    if (target === null) {
+      result.notes.push(`workspace "${name}": no MCP config file to migrate`);
+      return result;
+    }
+    let config;
+    try {
+      config = JSON.parse(readFileSync4(target.abs, "utf8"));
+    } catch (err) {
+      result.conflicts.push(target.rel);
+      result.notes.push(`${target.rel}: unreadable (${errorMessage(err)}) \u2014 left untouched`);
+      return result;
+    }
+    const servers = config.mcpServers;
+    if (typeof servers !== "object" || servers === null || Array.isArray(servers)) {
+      result.notes.push(`${target.rel}: no mcpServers block \u2014 left untouched`);
+      return result;
+    }
+    const entry = servers.noir;
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+      result.notes.push(`${target.rel}: no noir entry \u2014 left untouched`);
+      return result;
+    }
+    const entryObj = entry;
+    const args = entryObj.args;
+    const namesWorkspace = Array.isArray(args) && args.includes("--workspace");
+    const isHttpPointer = entryObj.type === "http";
+    const isRepoScopedStdio = typeof entryObj.command === "string" && !namesWorkspace;
+    if (!isHttpPointer && !isRepoScopedStdio) {
+      result.notes.push(
+        namesWorkspace ? `${target.rel}: already reaches Noir over the bridge \u2014 left untouched` : `${target.rel}: noir entry is not a transport this migration owns \u2014 left untouched`
+      );
+      return result;
+    }
+    const kept = Object.entries(entryObj).filter(([key]) => !TRANSPORT_KEYS.has(key));
+    if (ctx.dryRun) {
+      result.changed.push(target.rel);
+      result.notes.push(`${target.rel}: would point the noir entry at workspace "${name}"`);
+      return result;
+    }
+    const next = {
+      ...config,
+      mcpServers: {
+        ...servers,
+        noir: {
+          command: resolveNoirCommand(),
+          // The argv comes from the adapters' own helper, so this rewrite lands
+          // on exactly the entry a fresh join writes — the name is the whole
+          // address, and the bridge resolves the daemon (and reads its token)
+          // itself, so none of that is written into a committed config file.
+          args: noirStdioArgs(name),
+          ...Object.fromEntries(kept)
+        }
+      }
+    };
+    try {
+      atomicWriteFile2(target.abs, `${JSON.stringify(next, null, 2)}
+`);
+    } catch (err) {
+      result.conflicts.push(target.rel);
+      result.notes.push(`${target.rel}: write failed (${errorMessage(err)}) \u2014 left untouched`);
+      return result;
+    }
+    result.changed.push(target.rel);
+    result.notes.push(`${target.rel}: noir entry now reaches workspace "${name}" over the bridge`);
+    return result;
+  }
+};
+var MIGRATIONS = [
+  synthetic,
+  envPointer,
+  envTemplates,
+  workspaceBridge
+];
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1096,10 +1234,11 @@ import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as rea
 import { basename as basename2, dirname as dirname5, join as join8 } from "path";
 import {
   createProjectId,
-  loadProjectInfo,
+  loadProjectInfo as loadProjectInfo2,
   paths as paths2,
   readManagedBlock,
-  resolveNoirCommand,
+  readProjectConfig,
+  resolveNoirCommand as resolveNoirCommand2,
   sha256Hex12
 } from "@noir-ai/core";
 
@@ -1107,7 +1246,7 @@ import {
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname4, join as join6 } from "path";
 import { NOIR_DIR as NOIR_DIR2 } from "@noir-ai/core";
-var CURRENT_SCAFFOLD_VERSION = "1.2.0";
+var CURRENT_SCAFFOLD_VERSION = "1.3.0";
 var PREFIX = "noir-scaffold=";
 function scaffoldVersionPath(root) {
   return join6(root, NOIR_DIR2, "scaffold-version");
@@ -1339,14 +1478,21 @@ function assertSafeRoot(root) {
     cur = parent;
   }
 }
+function envOwnerOnly(opts) {
+  if (opts.dryRun === true) return void 0;
+  return ensureOwnerOnly(join8(paths2.noirDir(opts.root), ".env"));
+}
 function readConfiguredHost(root) {
   if (!existsSync6(paths2.config(root))) return "claude";
   try {
-    return loadProjectInfo(root).config.host;
+    return loadProjectInfo2(root).config.host;
   } catch {
     return "claude";
   }
 }
+function readConfiguredRulesEnabled(root) {
+  return readProjectConfig(root)?.rules.enabled ?? true;
+}
 async function scaffold(opts) {
   assertSafeRoot(opts.root);
   const host = opts.host ?? readConfiguredHost(opts.root);
@@ -1382,6 +1528,7 @@ async function scaffold(opts) {
       refreshed: [],
       conflicts: [],
       fileModes: {},
+      envMode: envOwnerOnly(opts),
       noop: true,
       migrationsRan: [],
       migrationConflicts: [],
@@ -1398,13 +1545,18 @@ async function scaffold(opts) {
   const migrationChanged = [];
   if (opts.mode === "init" && opts.upgrade === true && (fromVersion !== null || idFile.state === "valid")) {
     const m = runMigrations(opts.root, fromVersion, CURRENT_SCAFFOLD_VERSION, {
-      dryRun: opts.dryRun === true
+      dryRun: opts.dryRun === true,
+      // The migration runs BEFORE the manifest, so it cannot see the manifest's
+      // own rules-gating. Hand the switch through so a migration that would
+      // rewrite the working-rules seed (the doc-seed refresh keyed on recorded
+      // older bytes) leaves a switch-off project's RULES.md alone.
+      rulesEnabled: readConfiguredRulesEnabled(opts.root)
     });
     migrationsRan.push(...m.ran);
     migrationConflicts.push(...m.conflicts);
     migrationChanged.push(...m.changed);
   }
-  const command = resolveNoirCommand();
+  const command = resolveNoirCommand2();
   const manifest = buildManifest({
     root: opts.root,
     projectId,
@@ -1412,7 +1564,12 @@ async function scaffold(opts) {
     transport,
     url: opts.url,
     command,
-    stack
+    stack,
+    // The project's own working-rules switch: a project that set
+    // `rules.enabled: false` gets no `.noir/rules/RULES.md` — not on the first
+    // scaffold, and not backfilled by an upgrade. Unchanged (enabled) whenever
+    // the config is absent or says nothing about rules.
+    rulesEnabled: readConfiguredRulesEnabled(opts.root)
   });
   const emitContext = opts.mode === "sync" ? "sync" : opts.mode === "init" && opts.upgrade === true ? "upgrade" : null;
   const vars = {
@@ -1626,6 +1783,10 @@ async function scaffold(opts) {
     refreshed,
     conflicts: conflictRecords,
     fileModes,
+    // Re-asserted here, after the emit, so the mode on disk is the one this run
+    // leaves behind: the seed writer only applies 0600 at creation (see
+    // `envOwnerOnly`).
+    envMode: envOwnerOnly(opts),
     noop: false,
     migrationsRan,
     migrationConflicts,
@@ -1847,6 +2008,7 @@ export {
   buildManifest,
   buildRegion,
   detectStack,
+  ensureOwnerOnly,
   isStaleSeed,
   lineDiff,
   loadTemplate,