@orkestrel/scaffold 0.0.88 → 0.0.89

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -25,7 +25,7 @@ description: Run an Orkestrel release from layer order to registry confirmation.
 | `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit (a failed step names the `code: message` refusal or the `note` a JSON verb writes on stdout, else the last stderr lines), the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage. |
-| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` refuses a batch whose nearest `.git` entry is a file, including ancestor entries, with exit 3 before contacting npm; it names a linked worktree's primary clone or identifies a submodule, then uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                   |
 
 The user's current instruction wins. `references/release.md` owns the credential
 and authorization law; nothing here weakens it.

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -93,6 +93,8 @@ registry copy over any staged tip, so every consumer stays red until that tip is
 
 ## Prepare a layer
 
+- Compare release packs between hosts by paths, sizes, and content hashes, and report executable-mode differences separately; a pack made on Windows records `0644` for an entry git tracks as `100755`.
+
 An unpublished package's first version is `0.0.1`. Do not bump it before that first publish. The
 registry has nothing to serve, so there is no version to move away from, and bumping produces a
 package whose history starts at a number nothing explains.

package/dist/host/agents/skills/orkestrel-publish/references/window.md

@@ -9,6 +9,8 @@ rest of the layer either fits inside it or takes another approval.
 
 ## Arm the terminal
 
+- Before any upload, walk from each package directory to its nearest ancestor carrying a `.git` entry; refuse the batch with exit 3 before contacting npm when that entry is a file. For a linked worktree, resolve its `gitdir:` path and `commondir` file and publish from the named primary clone; for a submodule without `commondir`, publish from a standalone clone.
+
 - Read the session with `node .agents/skills/orkestrel-publish/scripts/window.ts --whoami`; `--login` prints the command the operator runs in a real terminal and polls `whoami` until it answers. No child of a script holds the TTY npm needs, so the login itself is the operator's.
 
 - Run the login and every browser-authorized publish under `script -qfc '<command>' <log>`. npm

package/dist/host/agents/skills/orkestrel-publish/scripts/window.ts

@@ -6,7 +6,9 @@
 // --whoami reads `npm whoami` once, or polls it every 5 seconds until it answers or the wait ends.
 // --login prints the command the operator runs in a real terminal (npm offers its approval only to a
 // TTY, so no child of this script can hold it), then polls `npm whoami` until it answers or the wait
-// ends. --publish re-reads `npm whoami` immediately before the first upload and refuses when it
+// ends. --publish refuses linked worktrees and submodules found at a package or its ancestors,
+// and names a linked worktree's primary clone.
+// It then re-reads `npm whoami` immediately before the first upload and refuses when it
 // answers nothing, then runs `npm publish --ignore-scripts --browser=false --otp=CODE` in each
 // directory back to back under captured pipes (npm's non-TTY guard turns a refused code into
 // EOTP with no prompt, so the path needs no TTY), journals each upload to tmp/units/publish-<name>.log, reads the `+ name@version`
@@ -14,8 +16,8 @@
 // each accepted version against the registry. --confirm re-reads the registry for each name@version every 5
 // seconds until it serves the version or the wait (default 120 seconds) ends. Exit 0 when the mode
 // succeeded, 3 when it did not, 64 on usage.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
 import {
 	readList,
 	readMissingFlags,
@@ -39,8 +41,8 @@ interface Upload {
 }
 
 function waitFor(ms: number): Promise<void> {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms)
+	return new Promise((settle) => {
+		setTimeout(settle, ms)
 	})
 }
 
@@ -196,6 +198,33 @@ async function main(argv: readonly string[]): Promise<number> {
 			)
 			return 64
 		}
+		for (const directory of directories) {
+			let root = resolve(directory)
+			while (!existsSync(join(root, '.git')) && dirname(root) !== root) root = dirname(root)
+			const entry = join(root, '.git')
+			if (!existsSync(entry) || !statSync(entry).isFile()) continue
+			const line = readFileSync(entry, 'utf8')
+				.split(/\r\n|\n/u)
+				.find((value) => value.startsWith('gitdir:'))
+			const target = line?.slice('gitdir:'.length).trim()
+			if (target === undefined || target === '') {
+				console.error(
+					`window: ${directory} has a .git file without a gitdir: path; cannot identify its primary clone`,
+				)
+				return 3
+			}
+			const gitdir = resolve(root, target)
+			const common = join(gitdir, 'commondir')
+			if (!existsSync(common)) {
+				console.error(`window: ${directory} is a submodule; publish from a standalone clone`)
+				return 3
+			}
+			const primary = dirname(resolve(gitdir, readFileSync(common, 'utf8').trim()))
+			console.error(
+				`window: ${directory} is a linked worktree; publish from its primary clone at ${primary} so npm records gitHead`,
+			)
+			return 3
+		}
 		// A stored credential expires mid-session, so the session-start answer does not hold here.
 		if (readWhoami() === undefined) {
 			console.error(

package/dist/host/claude/rules/tests.md

@@ -292,6 +292,8 @@ Use the real browser as the system under test:
 
 - Do not replace DOM events, storage, observers, viewports, layout methods, pointer, or drag APIs unless the browser genuinely lacks one.
 - Prefer real nodes, events, styles/layout, and observers.
+- In a file compiled by a browser or Vue scope, never load `@vitest/browser-playwright` types; read `cdp()` as `unknown`, and narrow `send` and each reply with guards.
+- When a browser test moves the real pointer through CDP, move it to `(-1, -1)` in the case's `finally` block.
 - Centralize event factories: `createPointerEvent`, `createDragEvent`, `typeInput`, `fireTransitionEnd`.
 - Centralize DOM builders: `createButtonElement`, `createDropdownElements`, `createModalElement`.
 - Assert DOM state, emitted events, callback records, focus, classes, attributes, and public API state.

package/dist/host/claude/rules/workspace.md

@@ -242,7 +242,7 @@ then runs the configured scoped checks that prove environment isolation.
 | Scope                        | `lib`                             | `types`                 | Permitted host globals                                                                                                                   |
 | ---------------------------- | --------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
 | `src:core`, `app:core`       | `["ESNext","WebWorker"]`          | `[]`                    | WHATWG web interop: fetch family, streams, URL, Abort, encoders, crypto, timers, console, DOMException, structuredClone; no DOM, no Node |
-| `src:browser`, `app:browser` | `["ESNext","DOM","DOM.Iterable"]` | default                 | DOM; no Node                                                                                                                             |
+| `src:browser`, `app:browser` | `["ESNext","DOM","DOM.Iterable"]` | `["vite/client"]`       | DOM; no Node                                                                                                                             |
 | `src:server`, `app:server`   | `["ESNext"]`                      | `["node"]`              | Node; no DOM                                                                                                                             |
 | `src:styles`, `src:<name>`   | `["ESNext"]`                      | `["vite/client"]`       | Vite SCSS module declaration only                                                                                                        |
 | `src:vue`                    | `["ESNext","DOM","DOM.Iterable"]` | `["vite/client"]`       | DOM; no Node                                                                                                                             |

package/dist/host/guides/scaffold.md

@@ -2067,6 +2067,12 @@ read or write that file.
 
 ## Generated workspace
 
+The generated factories name unnamed browser instances after merging the caller's override, using
+the merged project label and browser. An override setting the label to `widgets` produces
+`widgets (chromium)`, including for an instance added by the override. Explicit instance names stay
+unchanged. Vue and journey factories discard inherited instance names before applying their own
+labels. Vitest reports the same names when a wrapper runs alone and when the root registers it.
+
 A workspace's file set is a function of its axes, its structural facts, and its extensions.
 Nothing is fixed except the manifest.
 
@@ -2084,7 +2090,8 @@ Nothing is fixed except the manifest.
   `dist/`, and `npm run check` would wait on `npm run build`. Every subpath is written before the
   bare specifier, because `vite.config.ts` derives its `alias` record from these entries in order and
   a bare specifier also matches its own subpaths. An `app` environment publishes nothing and maps no
-  such entry.
+  such entry. Browser and Vue scoped configurations exclude Node globals. Browser setup helpers
+  read CDP sessions as `unknown` and guard the members they use.
 - One template artifact, `configs/browsers.ts`, for a workspace selecting `browser` on either
   environment axis or in its setup runtime list.
   It resolves the Chromium the Playwright provider launches, and the root `vite.config.ts` calls it
@@ -2110,7 +2117,8 @@ Nothing is fixed except the manifest.
   journey per application of a journey workspace. Surfaces and extensions lists each face.
 - One template artifact, `tests/distribution.test.ts`, for a workspace publishing any `src`
   environment or sheet face. It is the packed-package proof, and it is claimed by presence rather
-  than birth, so a workspace that replaces it keeps its replacement. A published browser environment
+  than birth, so a workspace that replaces it keeps its replacement. The suite stages its consumer
+  during setup; listing the project creates no distribution staging directory. A published browser environment
   adds the
   real-browser stage to it: the stage bundles the installed package with the workspace's own
   `configs/browsers.ts` resolution, serves the bundle over a loopback server, and drives it in
@@ -2609,7 +2617,9 @@ The generated guide index lists each occupied Vue face with its source, tests, a
 - [`tests/src/core/cloners.test.ts`](../tests/src/core/cloners.test.ts) — ownership of a snapshot
   taken from a hostile value.
 - [`tests/src/core/templates.test.ts`](../tests/src/core/templates.test.ts) — the frozen template
-  definitions.
+  definitions and generated configurations under live Vitest. The isolated `templates` project runs
+  through `test:templates` in `prepublishOnly`; its compiler and Chromium processes run apart from
+  the `src:core` project.
 - [`tests/src/core/constants.test.ts`](../tests/src/core/constants.test.ts) — the seeded rows named
   as a set, the floor form every shared table and this manifest carry, and the emitted TypeScript
   bound.

package/dist/host/manifest.json

@@ -244,7 +244,7 @@
 			"storage": "agents/skills/orkestrel-harden/SKILL.md",
 			"destination": ".agents/skills/orkestrel-harden/SKILL.md",
 			"executable": false,
-			"digest": "fdb32a356c23d911f47a417b999397a188b508278cbf19d92b21e72979fea4c2"
+			"digest": "8d108a0545b9f70e7c27477af988b990d6a8f772649f04ef21bae99e08e4fa05"
 		},
 		{
 			"storage": "agents/skills/orkestrel-harden/agents/openai.yaml",
@@ -280,7 +280,7 @@
 			"storage": "agents/skills/orkestrel-harden/scripts/discovery.ts",
 			"destination": ".agents/skills/orkestrel-harden/scripts/discovery.ts",
 			"executable": false,
-			"digest": "06128d912f79de527522075e7ebb3ccf24be864fad1015f4db5e456744201f7d"
+			"digest": "3dd132bd7d8a40f43417d2dc604af1f383a623587a288e7f104fecfde0dca3b0"
 		},
 		{
 			"storage": "agents/skills/orkestrel-journey/SKILL.md",
@@ -352,7 +352,7 @@
 			"storage": "agents/skills/orkestrel-publish/SKILL.md",
 			"destination": ".agents/skills/orkestrel-publish/SKILL.md",
 			"executable": false,
-			"digest": "f4bcc24e910bbd40de268ba6a9d4ba57b3e5f9ce69075dea395479a45ec0f9d4"
+			"digest": "9cb5cecb878001d08fa9cd250906628a3ad0f58eabde484ca8c1dc13510503e9"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/agents/openai.yaml",
@@ -370,13 +370,13 @@
 			"storage": "agents/skills/orkestrel-publish/references/wave.md",
 			"destination": ".agents/skills/orkestrel-publish/references/wave.md",
 			"executable": false,
-			"digest": "2d5479e0d3ed0529015f5f1f21345fb389f8119333b6c5530d2320be432fe1e1"
+			"digest": "68f5df5747f2b5cbd950413ce3e4a070ef5be229a79811711192763cd70d73fa"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/references/window.md",
 			"destination": ".agents/skills/orkestrel-publish/references/window.md",
 			"executable": false,
-			"digest": "734840b4803d8914bb88634f76f8c03b37da13d411a640614e446fec3c0c6ac5"
+			"digest": "1debb388eba46e221f99a2518de5aa94ba04ffced781a855b4a305cafc7176c3"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/scripts/compare.ts",
@@ -400,7 +400,7 @@
 			"storage": "agents/skills/orkestrel-publish/scripts/window.ts",
 			"destination": ".agents/skills/orkestrel-publish/scripts/window.ts",
 			"executable": false,
-			"digest": "143e29576afbf97e29141e4c9f38faef306929fbdfe41442c490f0d3064d119e"
+			"digest": "46594a58df8c07926b737373ece0fcb65e3eadfc0786bf3891542ca98e291fcc"
 		},
 		{
 			"storage": "agents/skills/orkestrel-scout/SKILL.md",
@@ -586,7 +586,7 @@
 			"storage": "claude/rules/tests.md",
 			"destination": ".claude/rules/tests.md",
 			"executable": false,
-			"digest": "6913f316d2bae3bb19e579bf419c820cdba97ed70422ea5d11deb800bd07973e"
+			"digest": "5808e375cf559c6d51aa3a744bcea574613945629e66e304c3d2f338b2f7abc0"
 		},
 		{
 			"storage": "claude/rules/typescript.md",
@@ -598,7 +598,7 @@
 			"storage": "claude/rules/workspace.md",
 			"destination": ".claude/rules/workspace.md",
 			"executable": false,
-			"digest": "3c9e269acd88935ee6c4f34dd07784f09f45bb6bfd1e27c6a183da3420da4fcc"
+			"digest": "f62b3c7321444d6fc30b587d9221915d0835ea3bb78204868e27beeb3ea5450b"
 		},
 		{
 			"storage": "claude/rules/writing.md",
@@ -1042,7 +1042,7 @@
 			"storage": "guides/scaffold.md",
 			"destination": "guides/scaffold.md",
 			"executable": false,
-			"digest": "9d6ea9f86610e3237d6ddbe120aabdec137f022092fc5311ca18e87d4b4e6212"
+			"digest": "02922fe230a3d85e58ad16aa9e3b2e93afd42e9d3d66b88f60bbd68b1b90e19e"
 		},
 		{
 			"storage": "guides/sea.md",
@@ -1168,7 +1168,7 @@
 			"storage": "tests/config.test.ts",
 			"destination": "tests/config.test.ts",
 			"executable": false,
-			"digest": "5cb647597fb27442d2be85a75b446805dd33d05b9ca93808595497ab7587387f"
+			"digest": "ac12462cfc786b77c23e8996c0a050f9719d870db08abe7f3a8994cbbf778e2d"
 		},
 		{
 			"storage": "tests/policy.test.ts",
@@ -2144,5 +2144,5 @@
 			]
 		}
 	],
-	"digest": "e53117186fbcf5d34fce9dcecef09fc8581335b11561f9ccd264a0d9f7fb52f3"
+	"digest": "551ef9dbdc726896039afd3e7edc69321303f148e28cd711a6e4ba028dba2d46"
 }

package/dist/host/tests/config.test.ts

@@ -183,7 +183,9 @@ describe('selected faces', () => {
 			expect(project.test?.include).toContain(`tests/${axis}/${face}/**/*.test.ts`)
 			expect(project.test?.browser).toMatchObject({
 				enabled: true,
-				instances: expect.arrayContaining([expect.objectContaining({ browser: 'chromium' })]),
+				instances: expect.arrayContaining([
+					expect.objectContaining({ browser: 'chromium', name: `${axis}:${face} (chromium)` }),
+				]),
 			})
 			expect(project.optimizeDeps?.include).toEqual(
 				expect.arrayContaining(['@orkestrel/test', '@orkestrel/test/browser']),
@@ -355,6 +357,14 @@ describe('selected faces', () => {
 					width: selected.width,
 					height: selected.height,
 				})
+				expect(readConfigRecord(test.browser).instances).toEqual(
+					expect.arrayContaining([
+						expect.objectContaining({
+							browser: 'chromium',
+							name: `journey:${provide.variant} (chromium)`,
+						}),
+					]),
+				)
 				expect(typeof provide.capture).toBe('boolean')
 				expect(readConfigRecord(project.optimizeDeps).include).toEqual(
 					expect.arrayContaining(['@orkestrel/test', '@orkestrel/test/browser']),
@@ -398,6 +408,12 @@ describe('selected faces', () => {
 			)
 			const test = readConfigRecord(project.test)
 			if (readConfigRecord(test.browser ?? {}).enabled !== true) continue
+			const label = typeof test.name === 'string' ? test.name : readConfigRecord(test.name).label
+			expect(readConfigRecord(test.browser).instances).toEqual(
+				expect.arrayContaining([
+					expect.objectContaining({ browser: 'chromium', name: `${label} (chromium)` }),
+				]),
+			)
 			const include = readConfigRecord(project.optimizeDeps).include
 			expect(include).toEqual(
 				expect.arrayContaining([