@pleri/olam-cli 0.1.69 → 0.1.72

package/host-cp/compose.yaml

@@ -85,6 +85,12 @@ services:
       # which surfaces in the dashboard as a failed Connect Claude flow.
       OLAM_AUTH_SERVICE_URL: "http://host.docker.internal:9999"
       OLAM_AUTH_SECRET: "${OLAM_AUTH_SECRET:-}"
+      # Operator's CLI version, propagated by `olam host-cp start` via
+      # buildComposeEnv. Surfaces in /api/version/status so the
+      # dashboard's TopNav can render "the version we're working on."
+      # Empty when older CLI versions render this compose; the server
+      # falls back to host-cp's own package.json.
+      OLAM_CLI_VERSION: "${OLAM_CLI_VERSION:-}"
       # Upgrade-trigger feature: host-cp uses these to construct bind
       # mounts on the spawned upgrader container. The upgrader runs
       # `olam upgrade -y` and needs (a) the operator's ~/.olam state,

package/host-cp/src/global-config-source.mjs

@@ -0,0 +1,71 @@
+// E1 (Phase E — olam-repos-and-runbooks): read ~/.olam/config.json and
+// expose it to the host-CP API endpoints (/api/repos, /api/runbooks).
+//
+// Never crashes: missing file → empty arrays, corrupt JSON → { error }.
+// Mirrors the workspace-catalog.mjs pattern: pure function, env-driven
+// path, no side effects at module load time.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const DEFAULT_CONFIG_PATH =
+  process.env.OLAM_CONFIG_PATH ??
+  path.join(os.homedir(), '.olam', 'config.json');
+
+/**
+ * @typedef {object} RepoEntry
+ * @property {string} name
+ * @property {string} path
+ * @property {string} [description]
+ * @property {number} [addedAt]
+ * @property {number} [updatedAt]
+ */
+
+/**
+ * @typedef {object} Runbook
+ * @property {string} name
+ * @property {string[]} repos
+ * @property {number} [updatedAt]
+ * @property {Record<string, Record<string, number>>} [portMap]
+ * @property {Record<string, Record<string, string>>} [env]
+ */
+
+/**
+ * @typedef {{ repos: RepoEntry[], runbooks: Runbook[] }} GlobalConfig
+ * @typedef {{ error: string }} ConfigError
+ */
+
+/**
+ * Load the global olam config from disk.
+ * - Missing file → `{ repos: [], runbooks: [] }`
+ * - Corrupt JSON → `{ error: string }`
+ * - Success → `{ repos: RepoEntry[], runbooks: Runbook[] }`
+ *
+ * @param {string} [configPath]
+ * @returns {GlobalConfig | ConfigError}
+ */
+export function loadGlobalConfig(configPath = DEFAULT_CONFIG_PATH) {
+  if (!fs.existsSync(configPath)) {
+    return { repos: [], runbooks: [] };
+  }
+  let raw;
+  try {
+    raw = fs.readFileSync(configPath, 'utf-8');
+  } catch (err) {
+    return { error: `Failed to read ${configPath}: ${err.message}` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return { error: `Invalid JSON in ${configPath}: ${err.message}` };
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return { error: `${configPath} does not contain a JSON object` };
+  }
+  return {
+    repos: Array.isArray(parsed.repos) ? parsed.repos : [],
+    runbooks: Array.isArray(parsed.runbooks) ? parsed.runbooks : [],
+  };
+}

package/host-cp/src/listening-server-poller.mjs

@@ -8,7 +8,7 @@ import { spawnSync } from 'node:child_process';
 
 const DOCKER_HOST = process.env.DOCKER_HOST ?? 'docker-cli';
 // Skip well-known infra ports — these are always running and not user servers
-const INFRA_PORTS = new Set([8080, 7681]);
+const INFRA_PORTS = new Set([8080, 7681, 7682]);
 
 // Per-world cache: worldId → { ts, servers, error? }
 const cache = new Map();

package/host-cp/src/plan-orchestrator.mjs

@@ -19,6 +19,8 @@ import { SessionManager } from '@mariozechner/pi-coding-agent';
 import { PERSONAS, DEFAULT_PERSONA_ID, getPersona } from './plan/personas.mjs';
 import { AgentRegistry } from './plan/agent-registry.mjs';
 import { HandoffEngine } from './plan/handoff-engine.mjs';
+import { RopeEngine } from './plan/rope-engine.mjs';
+import { loadAuthorityConfig } from './plan/authority-config.mjs';
 
 // ── Paths ─────────────────────────────────────────────────────────────────────
 
@@ -62,6 +64,7 @@ export class PlanOrchestrator {
   #authServiceSecret;
   #registry;
   #handoffEngine;
+  #ropeEngine;
 
   /** Tracks the active persona per conversationId: Map<conversationId, personaId> */
   #activePersona = new Map();
@@ -148,6 +151,14 @@ export class PlanOrchestrator {
       CREATE INDEX IF NOT EXISTS plan_sidebar_chunk_idx
         ON plan_sidebar_signals(chunk_id);
     `);
+
+    const authorityConfig = loadAuthorityConfig();
+    this.#ropeEngine = new RopeEngine({
+      registry: this.#registry,
+      db: this.#db,
+      broadcast: (conversationId, eventName, data) => this.#broadcast(conversationId, eventName, data),
+      authorityConfig,
+    });
   }
 
   // ── Auth-service credential fetching ──────────────────────────────────────
@@ -670,6 +681,14 @@ export class PlanOrchestrator {
       this.#broadcast(conversationId, 'tool_stub_call', { persona: personaId, ...event });
     };
 
+    // Run autoRope delegation (e.g. PM→Scout evidence gathering) before the main turn.
+    const promptContent = await this.#ropeEngine.autoDelegateIfNeeded({
+      conversationId,
+      callerPersonaId: personaId,
+      content,
+      fetchToken: () => this.#fetchToken(),
+    });
+
     const { session, authStorage } = await this.#registry.getAgent(conversationId, personaId, { onStubCall });
 
     // Wire events on first use (idempotent because pi de-duplicates subscribers).
@@ -681,7 +700,7 @@ export class PlanOrchestrator {
 
     const turnId = randomUUID();
 
-    session.prompt(content).catch((err) => {
+    session.prompt(promptContent).catch((err) => {
       console.error(`[plan] prompt error ${conversationId}/${personaId}:`, err.message);
       this.#broadcast(conversationId, 'error', {
         message: err.message,

package/host-cp/src/port-bridge-manager.mjs

@@ -12,7 +12,7 @@ const DOCKER_HOST = process.env.DOCKER_HOST ?? 'docker-cli';
 const SOCAT_IMAGE = 'alpine/socat';
 const HOST_PORT_MIN = 25000;
 const HOST_PORT_MAX = 25999;
-const INFRA_PORTS = new Set([8080, 7681]);
+const INFRA_PORTS = new Set([8080, 7681, 7682]);
 
 let BRIDGES_PATH =
   process.env.OLAM_PORT_BRIDGES_PATH ??

package/host-cp/src/server.mjs

@@ -44,6 +44,7 @@ import {
   projectsFromWorkspaces,
   matchWorkspacesByProjects,
 } from './workspace-catalog.mjs';
+import { loadGlobalConfig } from './global-config-source.mjs';
 import {
   createWorldNamesStore,
   inferNameFromTask,
@@ -810,7 +811,7 @@ const server = http.createServer(async (req, res) => {
         }
         // Infra ports must never be published — filter both client-side (PublishModal)
         // and here so direct API callers cannot tunnel the terminal or per-world CP.
-        const INFRA_PORTS = new Set([7681, 8080]);
+        const INFRA_PORTS = new Set([7681, 7682, 8080]);
         const validServices = parsed.services
           .filter((svc) => typeof svc.name === 'string')
           .map((svc) => ({ name: svc.name, port: Number(svc.port) }))
@@ -908,6 +909,26 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  // /api/repos (Phase E — olam-repos-and-runbooks): list registered repos
+  // from ~/.olam/config.json. Returns { repos: RepoEntry[] }.
+  if (url.pathname === '/api/repos' && req.method === 'GET') {
+    const config = loadGlobalConfig();
+    if ('error' in config) {
+      return jsonReply(res, 500, { error: config.error });
+    }
+    return jsonReply(res, 200, { repos: config.repos });
+  }
+
+  // /api/runbooks (Phase E — olam-repos-and-runbooks): list runbooks
+  // from ~/.olam/config.json. Returns { runbooks: Runbook[] }.
+  if (url.pathname === '/api/runbooks' && req.method === 'GET') {
+    const config = loadGlobalConfig();
+    if ('error' in config) {
+      return jsonReply(res, 500, { error: config.error });
+    }
+    return jsonReply(res, 200, { runbooks: config.runbooks });
+  }
+
   // ── Host-level auth proxy (/api/auth/*) ───────────────────────────
   //
   // Proxies to the olam-auth container (port 9999). These are distinct from
@@ -1199,6 +1220,18 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
+    // /api/world/<id>/ttyd-shell/* → proxy to the shell ttyd (port 7682).
+    // Serves the [Terminal] tab's standalone shell session, separate from
+    // the claude-main session on port 7681.
+    if (subPath.startsWith('/ttyd-shell/') || subPath === '/ttyd-shell') {
+      const portOffset = port - 19080;
+      const ttydPort = 17682 + portOffset;
+      const ttydBase = `http://${HOST_FOR_WORLD}:${ttydPort}`;
+      const ttydSubPath = (subPath === '/ttyd-shell' ? '/' : subPath.slice('/ttyd-shell'.length)) + url.search;
+      proxyToWorld({ req, res, subPath: ttydSubPath, targetBase: ttydBase, secret: '' });
+      return;
+    }
+
     let secret;
     try {
       secret = await getSecret(worldId);
@@ -1866,6 +1899,7 @@ const WELL_KNOWN_PORTS = {
   3000: 'atlas-core (Rails)',
   5175: 'diner-app (Vite)',
   7681: 'Terminal (ttyd)',
+  7682: 'Terminal Shell (ttyd)',
   8080: 'Per-world CP',
 };
 
@@ -2003,13 +2037,14 @@ const DIST_DIR = (() => {
   return '/app/dist'; // fallback; readFile will surface ENOENT
 })();
 
-const SPA_ROUTES = new Set(['/', '/worlds', '/workspaces', '/inbox']);
-const SPA_PREFIX = ['/world/', '/worlds/', '/workspaces/', '/inbox/'];
+const SPA_ROUTES = new Set(['/', '/worlds', '/workspaces', '/inbox', '/repos', '/runbooks']);
+const SPA_PREFIX = ['/world/', '/worlds/', '/workspaces/', '/inbox/', '/repos/', '/runbooks/'];
 
 // Top-level path segments that are NOT world IDs. Mirrors RESERVED_SEGMENTS
 // in lib/worldId.ts — keep in sync.
 const RESERVED_TOP_LEVEL = new Set([
   'sandbox', 'world', 'inbox', 'worlds', 'workspaces',
+  'repos', 'runbooks',
   'api', 'assets', 'health', 'favicon.ico',
   'session', 'hooks', 'dispatch', 'lanes', 'codex', 'review',
 ]);
@@ -2221,7 +2256,7 @@ let _spaCacheMtime = 0;
 //       and the token-comparison check skips reload when the cookie
 //       already matches (so non-rotation 401s — e.g. genuine auth
 //       failures — don't cause a refresh loop).
-const BOOTSTRAP_SCRIPT = `<script>(function(){function ck(){var m=document.cookie.match(/olam_host_cp_token=([^;]+)/);return m?m[1]:'';}function sw(t){document.cookie='olam_host_cp_token='+t+'; path=/; samesite=strict';}try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);sw(d.token);}}catch(e){console.error('[host-cp bootstrap]',e);}var reloading=false;function recover(){if(reloading)return;try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);if(d.token&&ck()!==d.token){reloading=true;sw(d.token);console.warn('[host-cp auth recover] token rotated; reloading');location.reload();}}}catch(e){console.error('[host-cp auth recover]',e);}}var HN=['/api/bootstrap','/api/worlds','/api/projects','/api/workspaces','/api/workspaces/match','/api/auth','/health'];var WP=['/api/','/session/','/hooks/','/dispatch','/lanes','/codex/','/review/'];function sr(p){if(typeof p!=='string')return false;if(p.startsWith('/api/world/'))return false;for(var i=0;i<HN.length;i++){var n=HN[i];if(p===n||p.startsWith(n+'?')||p.startsWith(n+'/'))return false;}for(var j=0;j<WP.length;j++){var w=WP[j];if(p===w||p===w.replace(/\\/$/,'')||p.startsWith(w)||p.startsWith(w.replace(/\\/$/,'')+'?')||p.startsWith(w.replace(/\\/$/,'')+'/'))return true;}return false;}function wid(){var p=location.pathname;var m=p.match(/^\\/(world|inbox)\\/([^/?#]+)/);if(m)return m[2];if(/^\\/(?:worlds?|workspaces?|world|sandbox|inbox|plan|design|assets|api|health|favicon)($|\\/|\\?)/.test(p))return null;var r=p.match(/^\\/([a-z][a-z0-9-]+)(?:\\/|$|\\?)/);return r?r[1]:null;}function rw(p){var w=wid();return w?'/api/world/'+w+p:p;}var of=window.fetch.bind(window);window.fetch=function(input,init){var pr;if(typeof input==='string'&&sr(input))pr=of(rw(input),init);else if(input&&typeof input.url==='string'&&sr(input.url))pr=of(new Request(rw(input.url),input),init);else pr=of(input,init);return pr.then(function(res){if(res&&res.status===401)recover();return res;});};var OE=window.EventSource;if(OE){window.EventSource=function(u,i){var s=u;if(typeof s==='string'&&sr(s))s=rw(s);var es=new OE(s,i);es.addEventListener('error',function(){if(es.readyState===OE.CLOSED)recover();});return es;};window.EventSource.prototype=OE.prototype;window.EventSource.CONNECTING=OE.CONNECTING;window.EventSource.OPEN=OE.OPEN;window.EventSource.CLOSED=OE.CLOSED;}})();</script>`;
+const BOOTSTRAP_SCRIPT = `<script>(function(){function ck(){var m=document.cookie.match(/olam_host_cp_token=([^;]+)/);return m?m[1]:'';}function sw(t){document.cookie='olam_host_cp_token='+t+'; path=/; samesite=strict';}try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);sw(d.token);}}catch(e){console.error('[host-cp bootstrap]',e);}var reloading=false;function recover(){if(reloading)return;try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);if(d.token&&ck()!==d.token){reloading=true;sw(d.token);console.warn('[host-cp auth recover] token rotated; reloading');location.reload();}}}catch(e){console.error('[host-cp auth recover]',e);}}var HN=['/api/bootstrap','/api/worlds','/api/projects','/api/workspaces','/api/workspaces/match','/api/repos','/api/runbooks','/api/auth','/health'];var WP=['/api/','/session/','/hooks/','/dispatch','/lanes','/codex/','/review/'];function sr(p){if(typeof p!=='string')return false;if(p.startsWith('/api/world/'))return false;for(var i=0;i<HN.length;i++){var n=HN[i];if(p===n||p.startsWith(n+'?')||p.startsWith(n+'/'))return false;}for(var j=0;j<WP.length;j++){var w=WP[j];if(p===w||p===w.replace(/\\/$/,'')||p.startsWith(w)||p.startsWith(w.replace(/\\/$/,'')+'?')||p.startsWith(w.replace(/\\/$/,'')+'/'))return true;}return false;}function wid(){var p=location.pathname;var m=p.match(/^\\/(world|inbox)\\/([^/?#]+)/);if(m)return m[2];if(/^\\/(?:worlds?|workspaces?|world|sandbox|inbox|plan|design|repos|runbooks|assets|api|health|favicon)($|\\/|\\?)/.test(p))return null;var r=p.match(/^\\/([a-z][a-z0-9-]+)(?:\\/|$|\\?)/);return r?r[1]:null;}function rw(p){var w=wid();return w?'/api/world/'+w+p:p;}var of=window.fetch.bind(window);window.fetch=function(input,init){var pr;if(typeof input==='string'&&sr(input))pr=of(rw(input),init);else if(input&&typeof input.url==='string'&&sr(input.url))pr=of(new Request(rw(input.url),input),init);else pr=of(input,init);return pr.then(function(res){if(res&&res.status===401)recover();return res;});};var OE=window.EventSource;if(OE){window.EventSource=function(u,i){var s=u;if(typeof s==='string'&&sr(s))s=rw(s);var es=new OE(s,i);es.addEventListener('error',function(){if(es.readyState===OE.CLOSED)recover();});return es;};window.EventSource.prototype=OE.prototype;window.EventSource.CONNECTING=OE.CONNECTING;window.EventSource.OPEN=OE.OPEN;window.EventSource.CLOSED=OE.CLOSED;}})();</script>`;
 
 async function renderSpaShell(filePath) {
   const stat = fs.statSync(filePath);
@@ -2255,13 +2290,17 @@ server.on('upgrade', (req, clientSocket, head) => {
     const { worldId, subPath } = parsed;
     const port = WORLDS[worldId];
     if (port === undefined) { clientSocket.destroy(); return; }
-    if (!subPath.startsWith('/ttyd/') && subPath !== '/ttyd') {
+    const isTtyd = subPath.startsWith('/ttyd/') || subPath === '/ttyd';
+    const isTtydShell = subPath.startsWith('/ttyd-shell/') || subPath === '/ttyd-shell';
+    if (!isTtyd && !isTtydShell) {
       clientSocket.destroy();
       return;
     }
     const portOffset = port - 19080;
-    const ttydPort = 17681 + portOffset;
-    const ttydSubPath = subPath === '/ttyd' ? '/' : subPath.slice('/ttyd'.length);
+    const ttydPort = isTtydShell ? 17682 + portOffset : 17681 + portOffset;
+    const ttydSubPath = isTtydShell
+      ? (subPath === '/ttyd-shell' ? '/' : subPath.slice('/ttyd-shell'.length))
+      : (subPath === '/ttyd' ? '/' : subPath.slice('/ttyd'.length));
     const ttydPath = ttydSubPath + (url.search || '');
     /** @type {Record<string, string | string[]>} */
     const outHeaders = {};

package/host-cp/src/version-status.mjs

@@ -24,6 +24,7 @@ import path from 'node:path';
  * @property {ComponentVersion} devbox
  * @property {string} operatorHead  - resolved HEAD or 'unknown'
  * @property {string} checkedAt     - ISO timestamp
+ * @property {string} cliVersion    - operator's CLI semver (e.g. "0.1.69") or 'unknown'
  */
 
 /**
@@ -187,6 +188,14 @@ export async function buildVersionSnapshot({ authServiceUrl, dockerApiBase }) {
 
   const hostCpRunning = process.env.OLAM_BUILD_SHA ?? 'unknown';
 
+  // CLI version is propagated by `olam host-cp start` via the
+  // OLAM_CLI_VERSION env (see packages/cli/src/commands/host-cp.ts
+  // buildComposeEnv). Falls back to host-cp's own package.json when
+  // an older CLI started this container without setting the env.
+  const cliVersion = process.env.OLAM_CLI_VERSION
+    || readHostCpPackageVersion()
+    || 'unknown';
+
   return {
     hostCp: {
       running: hostCpRunning,
@@ -205,5 +214,32 @@ export async function buildVersionSnapshot({ authServiceUrl, dockerApiBase }) {
     },
     operatorHead,
     checkedAt: new Date().toISOString(),
+    cliVersion,
   };
 }
+
+/**
+ * Read host-cp's bundled package.json version as the CLI-version
+ * fallback when OLAM_CLI_VERSION isn't propagated. The container
+ * Dockerfile copies the manifest into /app, so the lookup walks up
+ * from this module's location.
+ *
+ * @returns {string | null}
+ */
+function readHostCpPackageVersion() {
+  try {
+    const here = path.dirname(new URL(import.meta.url).pathname);
+    for (const candidate of [
+      path.join(here, '..', 'package.json'),
+      path.join(here, '..', '..', 'package.json'),
+    ]) {
+      if (fs.existsSync(candidate)) {
+        const pkg = JSON.parse(fs.readFileSync(candidate, 'utf-8'));
+        if (typeof pkg.version === 'string' && pkg.version.length > 0) return pkg.version;
+      }
+    }
+  } catch {
+    // best-effort
+  }
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.69",
+  "version": "0.1.72",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"
@@ -29,6 +29,7 @@
     "dev": "tsx src/index.ts",
     "test": "vitest run --passWithNoTests",
     "test:ci": "vitest run --reporter=basic --passWithNoTests",
+    "test:docker": "vitest run --config vitest.config.docker.ts",
     "audit:publish-deps": "node scripts/audit-publish-deps.mjs"
   },
   "dependencies": {
@@ -39,6 +40,7 @@
     "ora": "^8.0.0",
     "picocolors": "^1.1.0",
     "ssh2": "^1.16.0",
-    "yaml": "^2.7.0"
+    "yaml": "^2.7.0",
+    "zod-to-json-schema": "^3.24.0"
   }
 }

package/dist/__tests__/audit-publish-deps-contract.test.d.ts

@@ -1,26 +0,0 @@
-/**
- * audit-publish-deps-contract.test.ts — contractual regression for the fix
- * that prevents the May-2026 release-pipeline wedge.
- *
- * Bug history: PR #375 added `_require('json-source-map')` to
- * src/commands/config.ts but rewrite-publish-package-json.mjs's hand-curated
- * PUBLISH_DEPS list never picked it up. Versions 0.1.66 / 0.1.67 / 0.1.68
- * published to npm without json-source-map declared. host-cp Dockerfile's
- * `npm install -g @pleri/olam-cli@latest && olam --version` crashed with
- * `Cannot find module 'json-source-map'`. Three consecutive release runs
- * failed; pipeline wedged because the host-cp build sat upstream of the
- * commit-and-publish-npm step that would have shipped the fix.
- *
- * Pin the contract:
- *   1. PUBLISH_DEPS must contain json-source-map.
- *   2. EXTERNAL must contain json-source-map (esbuild can't bundle dynamic
- *      _require()'d modules; without external, the require survives in the
- *      bundle and crashes if not also installed at runtime).
- *   3. The audit-publish-deps.mjs script exists and is wired into prepublishOnly
- *      so this drift class fails fast rather than wedging the pipeline.
- *   4. The host-cp Dockerfile installs from a local tarball (cli.tgz), not
- *      from npm @latest — eliminates the wedge class permanently.
- *   5. The release.yml workflow stages cli.tgz before the host-cp build.
- */
-export {};
-//# sourceMappingURL=audit-publish-deps-contract.test.d.ts.map

package/dist/__tests__/audit-publish-deps-contract.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-publish-deps-contract.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/audit-publish-deps-contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}

package/dist/__tests__/audit-publish-deps-contract.test.js

@@ -1,86 +0,0 @@
-/**
- * audit-publish-deps-contract.test.ts — contractual regression for the fix
- * that prevents the May-2026 release-pipeline wedge.
- *
- * Bug history: PR #375 added `_require('json-source-map')` to
- * src/commands/config.ts but rewrite-publish-package-json.mjs's hand-curated
- * PUBLISH_DEPS list never picked it up. Versions 0.1.66 / 0.1.67 / 0.1.68
- * published to npm without json-source-map declared. host-cp Dockerfile's
- * `npm install -g @pleri/olam-cli@latest && olam --version` crashed with
- * `Cannot find module 'json-source-map'`. Three consecutive release runs
- * failed; pipeline wedged because the host-cp build sat upstream of the
- * commit-and-publish-npm step that would have shipped the fix.
- *
- * Pin the contract:
- *   1. PUBLISH_DEPS must contain json-source-map.
- *   2. EXTERNAL must contain json-source-map (esbuild can't bundle dynamic
- *      _require()'d modules; without external, the require survives in the
- *      bundle and crashes if not also installed at runtime).
- *   3. The audit-publish-deps.mjs script exists and is wired into prepublishOnly
- *      so this drift class fails fast rather than wedging the pipeline.
- *   4. The host-cp Dockerfile installs from a local tarball (cli.tgz), not
- *      from npm @latest — eliminates the wedge class permanently.
- *   5. The release.yml workflow stages cli.tgz before the host-cp build.
- */
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { dirname } from 'node:path';
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const CLI_ROOT = join(__dirname, '..', '..');
-const REPO_ROOT = join(CLI_ROOT, '..', '..');
-describe('release pipeline wedge — invariants', () => {
-    it('PUBLISH_DEPS contains json-source-map', () => {
-        const src = readFileSync(join(CLI_ROOT, 'scripts', 'rewrite-publish-package-json.mjs'), 'utf8');
-        expect(src).toMatch(/['"]json-source-map['"]\s*:\s*['"]\^?0\.6\./);
-    });
-    it('bundle-cli.mjs marks json-source-map external (dynamic _require)', () => {
-        const src = readFileSync(join(CLI_ROOT, 'scripts', 'bundle-cli.mjs'), 'utf8');
-        // Must appear inside the EXTERNAL array literal.
-        const externalBlock = src.slice(src.indexOf('const EXTERNAL = ['));
-        expect(externalBlock).toMatch(/['"]json-source-map['"]/);
-    });
-    it('audit-publish-deps.mjs exists and is wired into prepublishOnly', () => {
-        const auditScript = readFileSync(join(CLI_ROOT, 'scripts', 'audit-publish-deps.mjs'), 'utf8');
-        expect(auditScript).toMatch(/PUBLISH_DEPS/);
-        expect(auditScript).toMatch(/EXTERNAL/);
-        const pkg = JSON.parse(readFileSync(join(CLI_ROOT, 'package.json'), 'utf8'));
-        // prepublishOnly must run audit:publish-deps before rewrite-publish-package-json.
-        expect(pkg.scripts.prepublishOnly).toMatch(/audit:publish-deps/);
-        // The script itself must exist as an npm script too.
-        expect(pkg.scripts['audit:publish-deps']).toBeDefined();
-    });
-    it('host-cp Dockerfile installs from local cli.tgz, not npm @latest', () => {
-        const dockerfile = readFileSync(join(REPO_ROOT, 'packages', 'host-cp', 'Dockerfile'), 'utf8');
-        // Must NOT pull from npm @latest — that's the wedge.
-        // Match only ACTUAL run-shape lines (npm install at line start or after
-        // backslash-continuation), not the comment block that documents the
-        // historical bug.
-        const runLines = dockerfile
-            .split('\n')
-            .filter((l) => !l.trim().startsWith('#'))
-            .join('\n');
-        expect(runLines).not.toMatch(/npm install -g @pleri\/olam-cli@latest/);
-        // Must install from the staged tarball.
-        expect(dockerfile).toMatch(/COPY cli\.tgz/);
-        expect(dockerfile).toMatch(/npm install -g \/tmp\/olam-cli\.tgz/);
-    });
-    it('release.yml stages cli.tgz before host-cp docker build', () => {
-        const workflow = readFileSync(join(REPO_ROOT, '.github', 'workflows', 'release.yml'), 'utf8');
-        expect(workflow).toMatch(/scripts\/ci\/stage-host-cp-cli\.sh/);
-        // Order matters: stage-host-cp-cli.sh must appear BEFORE the
-        // docker/build-push-action@v6 invocation in publish-host-cp.
-        const publishHostCpBlock = workflow.slice(workflow.indexOf('publish-host-cp:'));
-        const stageIdx = publishHostCpBlock.indexOf('stage-host-cp-cli.sh');
-        const buildIdx = publishHostCpBlock.indexOf('docker/build-push-action');
-        expect(stageIdx).toBeGreaterThan(0);
-        expect(buildIdx).toBeGreaterThan(stageIdx);
-    });
-    it('ci.yml audit job runs audit:publish-deps', () => {
-        const ci = readFileSync(join(REPO_ROOT, '.github', 'workflows', 'ci.yml'), 'utf8');
-        expect(ci).toMatch(/audit:publish-deps/);
-    });
-});
-//# sourceMappingURL=audit-publish-deps-contract.test.js.map

package/dist/__tests__/audit-publish-deps-contract.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-publish-deps-contract.test.js","sourceRoot":"","sources":["../../src/__tests__/audit-publish-deps-contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE7C,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,YAAY,CACtB,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,kCAAkC,CAAC,EAC7D,MAAM,CACP,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,YAAY,CACtB,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CACP,CAAC;QACF,iDAAiD;QACjD,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,WAAW,GAAG,YAAY,CAC9B,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,wBAAwB,CAAC,EACnD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAExC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACrD,CAAC;QACF,kFAAkF;QAClF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACjE,qDAAqD;QACrD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,UAAU,GAAG,YAAY,CAC7B,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,EACpD,MAAM,CACP,CAAC;QACF,qDAAqD;QACrD,wEAAwE;QACxE,oEAAoE;QACpE,kBAAkB;QAClB,MAAM,QAAQ,GAAG,UAAU;aACxB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;aACxC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;QACvE,wCAAwC;QACxC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,QAAQ,GAAG,YAAY,CAC3B,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,EACtD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,GAAG,YAAY,CACrB,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,EACjD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/auth-status.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=auth-status.test.d.ts.map

package/dist/__tests__/auth-status.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-status.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth-status.test.ts"],"names":[],"mappings":""}