@polymorphism-tech/morph-spec 8.47.0 → 9.1.0

package/src/lib/installers/mcp-installer.js

@@ -1,11 +1,3 @@
-/**
- * MCP Installer
- *
- * Core logic for installing and configuring MCP servers during morph-spec init
- * and via `morph-spec mcp setup`. Handles auto-installable (credential-free)
- * MCPs, prerequisite checking, credential collection, and setup guidance.
- */
-
 import { join } from 'path';
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
 import { execSync, spawn } from 'child_process';
@@ -13,10 +5,6 @@ import { homedir } from 'os';
 import { installMcpServers } from '../../utils/claude-settings-manager.js';
 import { mcpServerNames } from '../../utils/agents-installer.js';
 
-/**
- * Load the enhanced MCP registry (v3.0.0)
- * @returns {Object} Registry with install blocks
- */
 export function loadMcpRegistry() {
   const registryPath = join(
     import.meta.dirname, '..', '..', '..', 'framework', 'mcp', 'registry.json'
@@ -25,15 +13,7 @@ export function loadMcpRegistry() {
   return JSON.parse(raw);
 }
 
-/**
- * Filter MCPs by stack relevance
- * @param {Object} registry - Full MCP registry
- * @param {string} stack - Detected project stack (e.g., 'nextjs-neon', 'blazor')
- * @param {string[]} [integrations] - `project.integrations` (e.g., ['neon']). The
- *   detectors put a database or payment provider here, never in the stack string,
- *   so an MCP relevant to it (neon, asaas) is matched against this list too.
- * @returns {Object} Filtered map of mcpName → mcpEntry
- */
+// Detectors put a database or payment provider in `integrations`, never in the stack string.
 export function filterByStack(registry, stack, integrations = []) {
   const result = {};
   const normalizedStack = (stack || '').toLowerCase();
@@ -53,14 +33,7 @@ export function filterByStack(registry, stack, integrations = []) {
   return result;
 }
 
-/**
- * Match detected MCP servers against the registry
- * @param {Array} existingServers - From detectClaudeConfig().mcpServers
- * @param {Object} registry - MCP registry
- * @param {string[]} [enabledPlugins] - From detectClaudeConfig().enabledPlugins. A plugin
- *   that ships the server already runs it, and writing it to `.mcp.json` too starts it twice.
- * @returns {Object} Map of mcpName → { installed: true, source }
- */
+// A plugin that ships the server already runs it: writing it to `.mcp.json` too starts it twice.
 export function getInstalledMcps(existingServers, registry, enabledPlugins = []) {
   const installed = {};
   const registryNames = Object.keys(registry.mcps);
@@ -86,11 +59,6 @@ export function getInstalledMcps(existingServers, registry, enabledPlugins = [])
   return installed;
 }
 
-/**
- * Check if prerequisites are met for an MCP entry
- * @param {Object} mcpEntry - MCP entry from registry
- * @returns {Array} Array of { name, met, installUrl } for each prerequisite
- */
 export function checkPrerequisites(mcpEntry) {
   const prereqs = mcpEntry.install?.prerequisites || [];
   const results = [];
@@ -101,7 +69,6 @@ export function checkPrerequisites(mcpEntry) {
       execSync(prereq.checkCommand, { stdio: 'ignore', timeout: 5000 });
       met = true;
     } catch {
-      // Command failed or not found
     }
     results.push({
       name: prereq.name,
@@ -113,25 +80,13 @@ export function checkPrerequisites(mcpEntry) {
   return results;
 }
 
-/**
- * Check if an MCP config uses remote HTTP transport (no local process).
- * @param {Object} config - MCP server config
- * @returns {boolean}
- */
 export function isRemoteMcp(config) {
   return config.type === 'http' || config.url != null;
 }
 
-/**
- * Patch MCP config for the current platform.
- * On Windows, npx must be invoked via `cmd /c` to avoid ENOENT errors.
- * Registry already stores cmd/c format; this handles legacy configs that still use npx directly.
- * Remote HTTP MCPs are returned as-is (no local process to patch).
- * @param {Object} config - MCP server config { command, args, env? } or { type: "http", url }
- * @returns {Object} Patched config (new object, original unmodified)
- */
+// On Windows npx must run via `cmd /c` (ENOENT otherwise); the registry already stores that form,
+// this covers legacy configs.
 export function patchConfigForPlatform(config) {
-  // Remote MCPs need no platform patching
   if (isRemoteMcp(config)) return config;
   if (config.command !== 'npx') return config;
   return {
@@ -141,20 +96,12 @@ export function patchConfigForPlatform(config) {
   };
 }
 
-/**
- * Install auto-installable MCPs (no credentials, no prerequisites)
- * @param {string} targetPath - Project root directory
- * @param {Object} mcpsToInstall - Map of mcpName → mcpEntry
- * @returns {Promise<Object>} Result from installMcpServers
- */
 export async function installAutoMcps(targetPath, mcpsToInstall) {
   const servers = {};
 
   for (const [name, entry] of Object.entries(mcpsToInstall)) {
     let config = { ...entry.install.config };
-    // Remote MCPs don't have env to strip
     if (!isRemoteMcp(config)) {
-      // Only include env if it has actual values
       if (config.env && Object.values(config.env).every(v => !v)) {
         delete config.env;
       }
@@ -165,13 +112,6 @@ export async function installAutoMcps(targetPath, mcpsToInstall) {
   return installMcpServers(targetPath, servers);
 }
 
-/**
- * Install companion skills for MCPs that define them (e.g., Stitch agent skills).
- * Reads the `companionSkills` field from registry entries and runs the install command.
- * @param {Object} mcpsInstalled - Map of mcpName → mcpEntry that were just installed
- * @param {Function} exec - execSync function (for testing)
- * @returns {Array<{name: string, repo: string, success: boolean}>}
- */
 export function installCompanionSkills(mcpsInstalled, exec = execSync) {
   const results = [];
 
@@ -190,13 +130,6 @@ export function installCompanionSkills(mcpsInstalled, exec = execSync) {
   return results;
 }
 
-/**
- * Generate the Stitch OAuth proxy template script.
- * Cross-platform (Windows gcloud.cmd + Unix gcloud), fetch()-based,
- * with readline, session tracking, and graceful shutdown.
- * @param {string} gcpProject - GCP project ID for x-goog-user-project header
- * @returns {string} CJS proxy script content
- */
 export function getStitchProxyTemplate(gcpProject) {
   return `#!/usr/bin/env node
 /**
@@ -309,12 +242,6 @@ rl.on('close', () => { stdinClosed = true; maybeExit(); });
 `;
 }
 
-/**
- * Generate and write the Stitch OAuth proxy script to the target project.
- * @param {string} targetPath - Project root directory
- * @param {string} gcpProject - GCP project ID
- * @returns {{ proxyPath: string }} Path to the generated proxy script
- */
 export function generateStitchProxy(targetPath, gcpProject) {
   const claudeDir = join(targetPath, '.claude');
   if (!existsSync(claudeDir)) {
@@ -327,20 +254,12 @@ export function generateStitchProxy(targetPath, gcpProject) {
   return { proxyPath };
 }
 
-/**
- * Resolve the gcloud CLI binary path.
- * Checks: system PATH → bundled at ~/.stitch-mcp/ → null.
- * @param {Function} exec - execSync function (for testing)
- * @returns {{ gcloudPath: string|null, source: string }}
- */
 export function findGcloud(exec = execSync) {
-  // Try system PATH first
   try {
     exec('gcloud --version', { stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000 });
     return { gcloudPath: 'gcloud', source: 'system' };
-  } catch { /* not on PATH */ }
+  } catch {}
 
-  // Windows: try Cloud SDK default install location
   if (process.platform === 'win32') {
     const winPath = join(process.env.LOCALAPPDATA || '', 'Google', 'Cloud SDK', 'google-cloud-sdk', 'bin', 'gcloud.cmd');
     if (existsSync(winPath)) {
@@ -348,7 +267,6 @@ export function findGcloud(exec = execSync) {
     }
   }
 
-  // Try bundled at ~/.stitch-mcp/
   const bundledDir = join(homedir(), '.stitch-mcp');
   const bundledBin = process.platform === 'win32'
     ? join(bundledDir, 'google-cloud-sdk', 'bin', 'gcloud.cmd')
@@ -360,29 +278,10 @@ export function findGcloud(exec = execSync) {
   return { gcloudPath: null, source: 'not-found' };
 }
 
-/**
- * Fully automated Stitch MCP setup orchestrator.
- *
- * Steps:
- * 1. Find gcloud CLI
- * 2. Verify ADC credentials
- * 3. Detect GCP project
- * 4. Enable stitch.googleapis.com API
- * 5. Generate proxy script
- * 6. Install MCP config in .mcp.json
- * 7. Health-check the proxy
- *
- * @param {string} targetPath - Project root directory
- * @param {Object} options
- * @param {string} [options.gcpProject] - GCP project ID (auto-detected if omitted)
- * @param {Function} [options._exec] - execSync override for testing
- * @returns {Promise<Object>} Step-by-step results
- */
 export async function setupStitch(targetPath, options = {}) {
   const exec = options._exec || execSync;
   const steps = [];
 
-  // Step 1: Find gcloud
   const { gcloudPath, source: gcloudSource } = findGcloud(exec);
   if (!gcloudPath) {
     steps.push({ step: 'find-gcloud', success: false, error: 'gcloud CLI not found. Install from: https://cloud.google.com/sdk/docs/install' });
@@ -392,7 +291,6 @@ export async function setupStitch(targetPath, options = {}) {
 
   const gcloudCmd = gcloudPath.includes(' ') ? `"${gcloudPath}"` : gcloudPath;
 
-  // Step 2: Verify ADC credentials
   try {
     exec(`${gcloudCmd} auth application-default print-access-token`, {
       encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 15000
@@ -403,26 +301,23 @@ export async function setupStitch(targetPath, options = {}) {
     return { success: false, steps };
   }
 
-  // Step 3: Detect GCP project
   let gcpProject = options.gcpProject;
   if (!gcpProject) {
-    // Try config.json
     const configPath = join(targetPath, '.morph', 'config', 'config.json');
     if (existsSync(configPath)) {
       try {
         const config = JSON.parse(readFileSync(configPath, 'utf-8'));
         gcpProject = config.gcpProject || config.project?.gcpProject;
-      } catch { /* invalid config */ }
+      } catch {}
     }
   }
   if (!gcpProject) {
-    // Try gcloud config
     try {
       gcpProject = exec(`${gcloudCmd} config get-value project`, {
         encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000
       }).trim();
       if (!gcpProject || gcpProject === '(unset)') gcpProject = null;
-    } catch { /* gcloud config failed */ }
+    } catch {}
   }
   if (!gcpProject) {
     steps.push({ step: 'detect-project', success: false, error: 'Could not detect GCP project. Pass it explicitly or set via: gcloud config set project <id>' });
@@ -430,7 +325,6 @@ export async function setupStitch(targetPath, options = {}) {
   }
   steps.push({ step: 'detect-project', success: true, gcpProject });
 
-  // Step 4: Enable Stitch API
   try {
     exec(`${gcloudCmd} services enable stitch.googleapis.com --project=${gcpProject}`, {
       encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30000
@@ -438,20 +332,17 @@ export async function setupStitch(targetPath, options = {}) {
     steps.push({ step: 'enable-api', success: true });
   } catch (err) {
     steps.push({ step: 'enable-api', success: false, error: `Failed to enable stitch API: ${err.message}` });
-    // Non-fatal — API might already be enabled and user may lack permissions to re-enable
+    // Non-fatal: the API may already be enabled and the user may lack permission to re-enable it.
   }
 
-  // Step 5: Generate proxy
   const { proxyPath } = generateStitchProxy(targetPath, gcpProject);
   steps.push({ step: 'generate-proxy', success: true, proxyPath });
 
-  // Step 6: Install MCP config in .mcp.json
   const mcpResult = await installMcpServers(targetPath, {
     stitch: { type: 'stdio', command: 'node', args: ['.claude/stitch-proxy.cjs'] }
   });
   steps.push({ step: 'install-mcp', success: true, added: mcpResult.added, skipped: mcpResult.skipped });
 
-  // Step 7: Health-check
   const healthResult = await healthCheckStitchProxy(proxyPath);
   steps.push({ step: 'health-check', ...healthResult });
 
@@ -462,11 +353,6 @@ export async function setupStitch(targetPath, options = {}) {
   return { success: allCriticalPassed, steps, gcpProject };
 }
 
-/**
- * Health-check the Stitch proxy by sending an MCP initialize handshake.
- * @param {string} proxyPath - Path to stitch-proxy.cjs
- * @returns {Promise<Object>} { success, protocolVersion?, error? }
- */
 export function healthCheckStitchProxy(proxyPath) {
   return new Promise((resolve) => {
     const initMsg = JSON.stringify({
@@ -492,7 +378,6 @@ export function healthCheckStitchProxy(proxyPath) {
 
     child.stdout.on('data', (data) => {
       output += data.toString();
-      // Check if we got a response
       const lines = output.split('\n').filter(l => l.trim());
       for (const line of lines) {
         try {
@@ -509,7 +394,7 @@ export function healthCheckStitchProxy(proxyPath) {
             resolve({ success: false, error: resp.error.message || 'MCP error' });
             return;
           }
-        } catch { /* not valid JSON yet */ }
+        } catch {}
       }
     });
 
@@ -530,38 +415,22 @@ export function healthCheckStitchProxy(proxyPath) {
       }
     });
 
-    // Send the initialize message
     child.stdin.write(initMsg + '\n');
     child.stdin.end();
   });
 }
 
-/**
- * Install a single MCP with provided credentials
- * @param {string} targetPath - Project root directory
- * @param {string} name - MCP name
- * @param {Object} mcpEntry - MCP entry from registry
- * @param {Object} credentialValues - Map of envVar → value
- * @returns {Promise<Object>} Result from installMcpServers
- */
 export async function installMcpWithCredentials(targetPath, name, mcpEntry, credentialValues) {
   const config = patchConfigForPlatform({ ...mcpEntry.install.config });
   config.env = { ...config.env, ...credentialValues };
   return installMcpServers(targetPath, { [name]: config });
 }
 
-/**
- * Generate setup instructions for a credential-requiring MCP
- * @param {string} name - MCP name
- * @param {Object} mcpEntry - MCP entry from registry
- * @returns {Object} { configSnippet, credentialUrls, cliCommand }
- */
 export function generateSetupInstructions(name, mcpEntry) {
   const config = mcpEntry.install.config;
   const credentials = mcpEntry.install.credentials || [];
   const setupGuide = mcpEntry.install.setupGuide;
 
-  // Remote HTTP MCPs — show claude mcp add command instead of config snippet
   if (isRemoteMcp(config)) {
     const configSnippet = JSON.stringify({ [name]: config }, null, 2);
     const credentialUrls = credentials.map(c => ({
@@ -577,7 +446,6 @@ export function generateSetupInstructions(name, mcpEntry) {
     };
   }
 
-  // Build the config snippet with placeholder values
   const snippetConfig = { ...config };
   if (credentials.length > 0) {
     snippetConfig.env = {};
@@ -601,17 +469,6 @@ export function generateSetupInstructions(name, mcpEntry) {
   };
 }
 
-/**
- * Full orchestrator for MCP setup during init or `mcp setup`
- * @param {string} targetPath - Project root directory
- * @param {string} stack - Detected project stack
- * @param {Array} existingMcps - From detectClaudeConfig().mcpServers
- * @param {Object} options
- * @param {boolean} options.autoOnly - Only handle auto-installable MCPs
- * @param {string[]} [options.integrations] - `project.integrations`, matched like the stack
- * @param {string[]} [options.enabledPlugins] - `detectClaudeConfig().enabledPlugins`
- * @returns {Object} { autoInstallable, alreadyInstalled, needsManualSetup, notRelevant, prerequisitesMissing }
- */
 export function orchestrateMcpSetup(targetPath, stack, existingMcps, options = {}) {
   const registry = loadMcpRegistry();
   const relevant = filterByStack(registry, stack, options.integrations ?? []);
@@ -623,23 +480,19 @@ export function orchestrateMcpSetup(targetPath, stack, existingMcps, options = {
   const notRelevant = {};
   const prerequisitesMissing = {};
 
-  // Categorize all MCPs
   for (const [name, entry] of Object.entries(registry.mcps)) {
     if (!entry.install) continue;
 
-    // Check if already installed
     if (installed[name]) {
       alreadyInstalled[name] = { entry, source: installed[name].source };
       continue;
     }
 
-    // Check if relevant to stack
     if (!relevant[name]) {
       notRelevant[name] = entry;
       continue;
     }
 
-    // Check prerequisites
     const prereqResults = checkPrerequisites(entry);
     const unmetPrereqs = prereqResults.filter(p => !p.met);
     if (unmetPrereqs.length > 0) {
@@ -647,7 +500,6 @@ export function orchestrateMcpSetup(targetPath, stack, existingMcps, options = {
       continue;
     }
 
-    // Categorize by install type
     if (entry.install.autoInstall) {
       autoInstallable[name] = entry;
     } else if (!options.autoOnly) {
@@ -665,18 +517,11 @@ export function orchestrateMcpSetup(targetPath, stack, existingMcps, options = {
   };
 }
 
-/**
- * Format MCP status table for display
- * @param {Object} orchestration - Result from orchestrateMcpSetup
- * @param {Object} justInstalled - Map of names just installed during this run
- * @returns {Array<Object>} Array of { name, status, detail }
- */
 export function formatMcpStatusTable(orchestration, justInstalled = {}) {
   const rows = [];
 
   const { autoInstallable, alreadyInstalled, needsManualSetup, notRelevant, prerequisitesMissing, registry } = orchestration;
 
-  // Installed during this run
   for (const [name, entry] of Object.entries(justInstalled)) {
     const mcpEntry = registry.mcps[name];
     rows.push({
@@ -686,7 +531,6 @@ export function formatMcpStatusTable(orchestration, justInstalled = {}) {
     });
   }
 
-  // Auto-installable but not yet installed (and not just-installed)
   for (const [name, entry] of Object.entries(autoInstallable)) {
     if (justInstalled[name]) continue;
     rows.push({
@@ -696,7 +540,6 @@ export function formatMcpStatusTable(orchestration, justInstalled = {}) {
     });
   }
 
-  // Already installed
   for (const [name, { source }] of Object.entries(alreadyInstalled)) {
     rows.push({
       name,
@@ -705,7 +548,6 @@ export function formatMcpStatusTable(orchestration, justInstalled = {}) {
     });
   }
 
-  // Needs manual setup
   for (const [name, entry] of Object.entries(needsManualSetup)) {
     rows.push({
       name,
@@ -714,7 +556,6 @@ export function formatMcpStatusTable(orchestration, justInstalled = {}) {
     });
   }
 
-  // Prerequisites missing
   for (const [name, { unmet }] of Object.entries(prerequisitesMissing)) {
     const missing = unmet.map(p => p.name).join(', ');
     rows.push({
@@ -724,7 +565,6 @@ export function formatMcpStatusTable(orchestration, justInstalled = {}) {
     });
   }
 
-  // Not relevant
   for (const [name] of Object.entries(notRelevant)) {
     rows.push({
       name,

package/src/lib/installers/memory-installer.js

@@ -1,15 +1,5 @@
-/**
- * Memory Installer — populates Claude Code persistent memory during `morph-spec init`.
- *
- * Writes two memory files (project + reference) plus an entry in MEMORY.md
- * so future Claude Code sessions enter pre-contextualized about the
- * morph-spec setup of this project.
- *
- * Memory location: ~/.claude/projects/<encoded-project-path>/memory/
- *
- * The path encoding mirrors Claude Code's own scheme: replace slashes and
- * colons with dashes. Tests can override via MORPH_MEMORY_ROOT env var.
- */
+// The path encoding mirrors Claude Code's scheme (slashes and colons become dashes);
+// MORPH_MEMORY_ROOT overrides the root in tests.
 
 import fs from 'fs-extra';
 import { join } from 'path';
@@ -41,8 +31,7 @@ metadata:
 - \`.morph/framework/MORPH.md\` — NLH charter (read once per session)
 - \`.morph/framework/agents.json\` — 8 agents: 7 domain personas + 1 stage persona (\`scout\`, read-only)
 - \`.morph/framework/standards/STANDARDS.json\` — standards index (load on demand)
-- \`.morph/framework/schemas/tasks.schema.json\` — JSON Schema for tasks.json
-- \`.morph/features/{feature}/\` — feature artifacts: 0-proposal / 1-design / 2-plan / 3-implement / 4-review
+- \`.morph/features/{feature}/\` — feature artifacts: 2-plan / 1-design / 3-implement / 4-review
 - \`.morph/context/\` — long-lived architectural context (design-system, decisions)
 - \`.morph/state.json\` — feature state (managed by state-sync hook; Edit fallback allowed)
 
@@ -50,8 +39,8 @@ metadata:
 
 | Command | Skill invoked |
 |---------|---------------|
-| \`/morph-proposal {feature}\` | \`Skill(morph-proposal)\` — brainstorming → Gate 1 → plan → Gate 2 |
-| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — DAG-adaptive implement loop → review → Gate 3 |
+| \`/morph-plan {feature}\` | \`Skill(morph-plan)\` — entrevista → plan.md → plan-check → gate do plano |
+| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — fatias do plano → verify → review → Gate 3 |
 | \`/morph-status [feature]\` | inspect state.json |
 | \`/morph-archive {feature}\` | move completed feature to .morph/archive/ |
 | \`/morph-preflight\` | pre-deploy validation |
@@ -59,13 +48,12 @@ metadata:
 
 ## Core skills
 
-\`morph-proposal\`, \`morph-apply\`, \`morph-brainstorming\`, \`morph-plan\`, \`morph-implement\`, \`morph-review\`, \`morph-stack-scan\`, \`morph-standards\`
+\`morph-plan\`, \`morph-apply\`, \`morph-uiux\`, \`morph-review\`, \`morph-hotfix\`, \`morph-standards\`
 
 **Why:** This project is managed by morph-spec — spec-driven autonomous development with trust-aware gates.
 
 **How to apply:**
 - When user mentions a feature, check \`.morph/features/\` first.
-- When user types \`/morph-proposal\`, invoke \`Skill(morph-proposal)\` directly.
 - In \`trust: "auto"\`, gates auto-pass; only AskUserQuestion on risk signals.
 `;
 }
@@ -83,25 +71,12 @@ metadata:
 - \`.morph/context/design-system.md\` — design tokens and components (source of truth)
 - \`.morph/framework/MORPH.md\` — NLH charter, Trust Mode rules, gates, skills table
 - \`.morph/framework/standards/STANDARDS.json\` — index; load specific standard via \`path\` field
-- \`.morph/framework/schemas/tasks.schema.json\` — tasks.json schema reference
 - \`.morph/framework/phases.json\` — phase folder mapping and skill associations
 - \`.morph/framework/agents.json\` — domain persona definitions (dotnet-senior, ef-modeler, etc.)
-- \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 evaluator checks (verdict SHIP/FIX + evidence-typed blockers)
+- \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 verifier, reviewer and security check (verdict SHIP/FIX + evidence-typed blockers)
 `;
 
-/**
- * Populate Claude Code persistent memory for a morph-spec project.
- *
- * Idempotent: re-running overwrites the memory files with current info
- * but appends MEMORY.md index entries only if missing.
- *
- * @param {string} projectPath - Absolute path of the project root
- * @param {object} info - Project facts to embed in the memory
- * @param {string} info.projectName
- * @param {string} info.frameworkVersion
- * @param {string} [info.stack]
- * @returns {Promise<{ projectMemoryPath: string, referenceMemoryPath: string, indexPath: string }>}
- */
+// Idempotent: memory files are overwritten, MEMORY.md entries appended only if missing.
 export async function installProjectMemory(projectPath, info) {
   const memoryRoot = getMemoryRoot(projectPath);
   await fs.ensureDir(memoryRoot);

package/src/lib/installers/templates-reconcile.js

@@ -1,67 +1,13 @@
-/**
- * templates-reconcile.js — reconcile a pre-existing `.morph/framework/templates/`
- * copy against the project's prior recorded morph-spec version.
- *
- * Shared by BOTH install paths that can encounter this directory:
- *   - `morph-spec update` (src/commands/project/update.js) — always knows the
- *     project's prior version (`checkProjectOutdated().current`, read from
- *     `.morph/.morphversion` BEFORE this run overwrites it).
- *   - `morph-spec init`/`setup-infra` (src/scripts/setup-infra.js) — the SAME
- *     source (`getProjectMorphVersion()`, the function `checkProjectOutdated`
- *     itself calls), read at the same point in the run (before its own write
- *     of `.morph/.morphversion`), when it's available — e.g. a repair run
- *     over an already-initialized project. Falls back to a plain warning when
- *     it isn't (a project with no recorded version has nothing here for this
- *     function to reconcile against safely).
- */
-
 import { existsSync } from 'fs';
 import { compareVersions } from '../../utils/version-checker.js';
 import { realEffects } from './effects.js';
 
-/**
- * Last CLI version whose `update`/`setup-infra` still wrote
- * `.morph/framework/templates/` unconditionally, before Task 2 of the R3
- * perf plan removed that copy. Used as the decision boundary in
- * `reconcileLegacyTemplatesCopy` below — see its doc comment for why a
- * version check is used instead of diffing file content.
- */
+// Last CLI version whose install still copied `.morph/framework/templates/` unconditionally.
 export const LAST_VERSION_THAT_COPIED_TEMPLATES = '8.17.0';
 
-/**
- * Reconcile a pre-existing `.morph/framework/templates/` copy now that
- * neither install path unconditionally writes it anymore (Task 2, R3 perf
- * plan — resolution falls back to the npm package's own framework/templates/,
- * see template-registry.js / architecture-scanner.js's layered resolver).
- *
- * Decided from the project's PRIOR recorded CLI version (before THIS run
- * writes a new one), not by diffing content against the package. A content
- * diff can't tell "stale copy from an older CLI version" apart from
- * "deliberate user override" — and staleness is the dominant case for
- * anyone who actually runs `update`/`setup-infra` again, since template
- * content does change between releases. The version boundary is unambiguous
- * instead:
- *
- *   - No local copy → nothing to do.
- *   - Prior version is unrecorded, OR <= LAST_VERSION_THAT_COPIED_TEMPLATES
- *     → the copy could ONLY have been put there by the OLD installer:
- *     `.morph/framework/**` is Edit-denied to the agent (MORPH_DENY in
- *     hooks-installer.js — "installer-managed, immutable at runtime"),
- *     the directory is gitignored, and every install/update before this fix
- *     unconditionally wiped + recopied it. There is no path by which a
- *     project on an old version could have a genuine override sitting
- *     here. Safe to delete unconditionally — it is dead weight, not data.
- *   - Prior version > LAST_VERSION_THAT_COPIED_TEMPLATES → this install path
- *     has never written this directory for this project. Anything found
- *     here was placed deliberately (by the user or other tooling) — this is
- *     the forward-looking override use case the layered resolver exists
- *     for. Preserve untouched, unconditionally, with no diffing.
- *
- * @param {string} templatesDest - .morph/framework/templates (may not exist)
- * @param {string|null} priorProjectVersion - project's recorded morph-spec
- *   version BEFORE this run (e.g. `checkProjectOutdated().current`)
- * @returns {'absent'|'removed-legacy'|'preserved-override'}
- */
+// Decided by the PRIOR recorded version, not by diffing: a diff can't tell a stale copy from an override.
+// Unrecorded or <= the boundary → only the old installer could have written it, delete.
+// Newer → placed deliberately, preserve.
 export function reconcileLegacyTemplatesCopy(templatesDest, priorProjectVersion, fx = realEffects()) {
   if (!existsSync(templatesDest)) return 'absent';
 
@@ -74,8 +20,7 @@ export function reconcileLegacyTemplatesCopy(templatesDest, priorProjectVersion,
     fx.remove(templatesDest);
     return 'removed-legacy';
   } catch {
-    // Couldn't remove — don't risk a half-broken state; leave it and let
-    // the layered resolver's override-first check pick it up as before.
+    // Couldn't remove: leave it; the resolver's override-first check picks it up.
     return 'preserved-override';
   }
 }

package/src/lib/mutation/commands.js

@@ -1,4 +1,5 @@
-import { dotnetBuildCommandFor, resolveTestBuildTargets } from '../tasks/test-runner.js';
+import { resolve } from 'node:path';
+import { discoverDotnetBuildTargets, dotnetBuildCommandFor } from '../tasks/test-runner.js';
 
 const FILTER = /--filter(?:[ =:])(?:"([^"]*)"|'([^']*)'|(\S+))/;
 const quote = (s) => `"${String(s).replace(/"/g, '\\"')}"`;
@@ -32,7 +33,7 @@ const VERBOSITY = /\s(?:-v|--verbosity)[ =:]?\S+/g;
 export function dotnetBuildCommands(node, projectPath) {
   const configuration = CONFIGURATION.exec(node.command ?? '');
   const flag = configuration ? ` -c ${configuration[1] ?? configuration[2]}` : '';
-  return resolveTestBuildTargets(node)
+  return discoverDotnetBuildTargets(node, resolve(projectPath || '.', node.cwd || '.'))
     .map((target) => dotnetBuildCommandFor(target, projectPath))
     .filter(Boolean)
     .map((command) => `${command.replace(VERBOSITY, '')} -v m${flag}`);