@pugi/cli 0.1.0-beta.3 → 0.1.0-beta.31

package/dist/core/release-notes/parser.js

@@ -0,0 +1,241 @@
+/**
+ * Keep-a-Changelog parser — Leak L24 (2026-05-27).
+ *
+ * Parses a `CHANGELOG.md` written в the Keep-a-Changelog v1.1 layout
+ * (https://keepachangelog.com) into an ordered list of version
+ * sections. The parser is intentionally minimal — it understands the
+ * `## [<version>] - <date>` header marker and the section body up к
+ * the next header, and ignores every other Markdown construct (links,
+ * footnotes, sub-sub-headers). That is enough к drive the
+ * `pugi release-notes` diff between last-seen and current.
+ *
+ * # Module contract
+ *
+ *   - Pure function. Takes the raw CHANGELOG text + returns parsed
+ *     sections. Zero IO; the file read happens at the call site so the
+ *     spec can pin fixtures without touching disk.
+ *
+ *   - Header grammar: `## [<version>] - <YYYY-MM-DD>`. The leading
+ *     `## ` is required (h2). The version is everything between the
+ *     square brackets — semver-shaped strings are not validated
+ *     beyond non-emptiness so pre-release tags like `0.1.0-beta.21`
+ *     parse correctly. The date is captured verbatim; the comparator
+ *     does not parse it — version ordering is enough.
+ *
+ *   - Section body: every line from the header (exclusive) up к the
+ *     next `## [...] - ...` header (exclusive). Lines are joined
+ *     verbatim with `\n`; leading + trailing blank lines are trimmed
+ *     so the renderer can paste sections back-to-back without double
+ *     blank lines piling up.
+ *
+ *   - Pre-header content (the leading `# Changelog` + introduction
+ *     blurb) is discarded. The parser only surfaces version sections;
+ *     callers that want к render the introduction read the source
+ *     file directly.
+ *
+ *   - Sections appear в the order they are written in the file. The
+ *     Keep-a-Changelog convention is newest-first; the parser does
+ *     NOT re-sort. The slicing helpers (`sliceVersionsBetween`) trust
+ *     the input order so a malformed CHANGELOG with shuffled
+ *     versions produces a deterministic — if surprising — diff
+ *     instead of silently swallowing entries.
+ *
+ *   - Semver comparison (`compareSemver`) handles the canonical
+ *     `MAJOR.MINOR.PATCH[-PRERELEASE]` shape. The pre-release tail
+ *     is compared lexicographically by dot-separated identifier per
+ *     semver §11. Unknown / malformed input compares lower than any
+ *     valid semver so an accidental `unknown` last-seen marker
+ *     never blocks the operator from seeing new notes.
+ */
+const SECTION_HEADER_RE = /^##\s+\[([^\]]+)\](?:\s*-\s*(.+))?\s*$/u;
+/**
+ * Parse the raw `CHANGELOG.md` text into ordered version sections.
+ *
+ * Returns sections in the same order they appear in the source. The
+ * Keep-a-Changelog convention is newest-first; the parser does not
+ * re-sort.
+ */
+export function parseChangelog(raw) {
+    const lines = raw.split(/\r?\n/u);
+    const sections = [];
+    let current = null;
+    const flush = () => {
+        if (!current)
+            return;
+        sections.push({
+            version: current.version,
+            date: current.date,
+            body: trimBlankEdges(current.lines).join('\n'),
+        });
+        current = null;
+    };
+    for (const line of lines) {
+        const match = SECTION_HEADER_RE.exec(line);
+        if (match) {
+            flush();
+            const version = (match[1] ?? '').trim();
+            const date = (match[2] ?? '').trim();
+            if (version.length === 0) {
+                // Malformed `## []` header — skip entirely instead of
+                // emitting a zero-version row that would corrupt the diff.
+                continue;
+            }
+            current = { version, date, lines: [] };
+            continue;
+        }
+        if (current) {
+            current.lines.push(line);
+        }
+    }
+    flush();
+    return sections;
+}
+/**
+ * Slice the section list к those strictly newer than `lastSeen` and
+ * up к (and including) `current`. Both bounds are matched on the
+ * verbatim version string — the comparator runs on every section к
+ * decide membership.
+ *
+ * Semantics:
+ *
+ *   - If `lastSeen` is null OR empty OR matches no section, every
+ *     section ≤ current is returned. This is the first-run path —
+ *     the operator has never run the command before, so the entire
+ *     bundled changelog is fair game.
+ *
+ *   - If `lastSeen` equals `current`, the empty array is returned.
+ *     The caller renders the "no new release notes" copy.
+ *
+ *   - If `lastSeen` is newer than `current`, the empty array is
+ *     returned. This is the dev-build path — operators running a
+ *     local build of `0.1.0-beta.30` against a registry that
+ *     publishes `0.1.0-beta.22` would otherwise see the stale
+ *     bundled notes; the caller still surfaces the same no-op copy.
+ *
+ *   - Otherwise: sections strictly newer than `lastSeen` and ≤
+ *     `current`, in the source order (newest-first by convention).
+ *
+ * The function is pure — no IO, no clock — so the spec can pin every
+ * branch with hand-rolled fixtures.
+ */
+export function sliceVersionsBetween(sections, lastSeen, current) {
+    if (sections.length === 0)
+        return [];
+    // Treat а blank / sentinel last-seen as "never seen".
+    const lastSeenValue = typeof lastSeen === 'string' && lastSeen.trim().length > 0 && lastSeen !== 'none'
+        ? lastSeen.trim()
+        : null;
+    // Dev-build path: operator's last-seen marker is strictly newer than
+    // the installed CLI version. This happens when running а local build
+    // older than the registry, or when the operator manually edited the
+    // marker. Either way, return the empty array — re-rendering the
+    // bundled notes would be misleading. The renderer surfaces the same
+    // "no new release notes" copy as the up-to-date branch.
+    if (lastSeenValue !== null && compareSemver(lastSeenValue, current) > 0) {
+        return [];
+    }
+    // Diff path: surface sections strictly newer than the marker and ≤
+    // current. The comparator drives every section — а marker that does
+    // not appear in the bundled changelog (operator on а stale build,
+    // hand-edited marker, version no longer published) still bisects
+    // correctly because every comparison runs against the marker value
+    // directly, not the matching-section guard.
+    const out = [];
+    for (const section of sections) {
+        // Anything newer than current is а future entry that should not
+        // surface until the operator actually upgrades — guards against а
+        // dev build of CHANGELOG.md leaking unreleased notes к а customer
+        // install.
+        if (compareSemver(section.version, current) > 0)
+            continue;
+        if (lastSeenValue !== null && compareSemver(section.version, lastSeenValue) <= 0) {
+            continue;
+        }
+        out.push(section);
+    }
+    return out;
+}
+/**
+ * Semver comparator. Returns a negative number when `a < b`, zero
+ * when equal, and a positive number when `a > b`. Pre-release tags
+ * compare lexicographically by dot-separated identifier per semver §11.
+ *
+ * Unknown / malformed input compares lower than any valid semver so
+ * an accidental sentinel like `unknown` or `none` never accidentally
+ * blocks the diff from surfacing newer entries.
+ */
+export function compareSemver(a, b) {
+    const left = parseSemver(a);
+    const right = parseSemver(b);
+    if (!left && !right)
+        return 0;
+    if (!left)
+        return -1;
+    if (!right)
+        return 1;
+    for (let i = 0; i < 3; i += 1) {
+        const cmp = (left.core[i] ?? 0) - (right.core[i] ?? 0);
+        if (cmp !== 0)
+            return cmp;
+    }
+    // A version without a pre-release tag is newer than the same core
+    // with a pre-release tag (per semver §11: 1.0.0 > 1.0.0-rc).
+    if (left.pre.length === 0 && right.pre.length === 0)
+        return 0;
+    if (left.pre.length === 0)
+        return 1;
+    if (right.pre.length === 0)
+        return -1;
+    const len = Math.max(left.pre.length, right.pre.length);
+    for (let i = 0; i < len; i += 1) {
+        const li = left.pre[i];
+        const ri = right.pre[i];
+        if (li === undefined)
+            return -1;
+        if (ri === undefined)
+            return 1;
+        const ln = Number.parseInt(li, 10);
+        const rn = Number.parseInt(ri, 10);
+        const liNumeric = Number.isFinite(ln) && String(ln) === li;
+        const riNumeric = Number.isFinite(rn) && String(rn) === ri;
+        if (liNumeric && riNumeric) {
+            if (ln !== rn)
+                return ln - rn;
+            continue;
+        }
+        if (liNumeric)
+            return -1; // numeric < alphanumeric per §11
+        if (riNumeric)
+            return 1;
+        if (li < ri)
+            return -1;
+        if (li > ri)
+            return 1;
+    }
+    return 0;
+}
+function parseSemver(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return null;
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/u.exec(trimmed);
+    if (!match)
+        return null;
+    const major = Number.parseInt(match[1] ?? '0', 10);
+    const minor = Number.parseInt(match[2] ?? '0', 10);
+    const patch = Number.parseInt(match[3] ?? '0', 10);
+    const pre = match[4] ? match[4].split('.') : [];
+    return { core: [major, minor, patch], pre };
+}
+function trimBlankEdges(lines) {
+    let start = 0;
+    let end = lines.length;
+    while (start < end && (lines[start] ?? '').trim().length === 0)
+        start += 1;
+    while (end > start && (lines[end - 1] ?? '').trim().length === 0)
+        end -= 1;
+    return lines.slice(start, end);
+}
+//# sourceMappingURL=parser.js.map

package/dist/core/release-notes/state.js

@@ -0,0 +1,116 @@
+/**
+ * `~/.pugi/.last-seen-version` state I/O — Leak L24 (2026-05-27).
+ *
+ * The `pugi release-notes` command renders the diff between the
+ * version the operator last saw notes for and the currently
+ * installed CLI version. This module owns the on-disk marker that
+ * tracks the last-seen value.
+ *
+ * # Module contract
+ *
+ *   - File path: `<home>/.pugi/.last-seen-version`. The leading dot
+ *     keeps it out of casual `ls` output; the file is plain ASCII
+ *     (one line, the version string) so operators can edit it by
+ *     hand when reproducing scenarios. Missing parent dir is
+ *     created on write.
+ *
+ *   - Reads: missing file → null. Unreadable / blank file → null.
+ *     The caller treats null as "operator has never run the command"
+ *     and surfaces every bundled section. Read failures NEVER throw —
+ *     the command surface is informational and must keep working on
+ *     a read-only mount or a misconfigured permission bit.
+ *
+ *   - Writes: best-effort. EACCES / EROFS / ENOSPC log а warning к
+ *     the caller-supplied logger and return the failure code so the
+ *     command renderer can footer the output with "could not persist
+ *     last-seen — re-run will show the same notes". The command
+ *     itself stays exit 0 because the value of the render did not
+ *     depend on the write succeeding.
+ *
+ *   - The helpers are pure I/O wrappers — no clock, no random, no
+ *     env reads. Callers pass `home` explicitly so the spec can
+ *     pin a tmp dir without monkey-patching `os.homedir`.
+ */
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+/** Filename inside `<home>/.pugi/` that holds the last-seen marker. */
+export const LAST_SEEN_VERSION_FILE = '.last-seen-version';
+/**
+ * Resolve the absolute path of the last-seen marker file inside the
+ * passed home directory. Pure helper — no IO.
+ */
+export function lastSeenVersionPath(home) {
+    return resolve(home, '.pugi', LAST_SEEN_VERSION_FILE);
+}
+/**
+ * Read the last-seen marker. Returns null when the file is missing,
+ * unreadable, or empty. Never throws.
+ */
+export function readLastSeenVersion(home) {
+    const path = lastSeenVersionPath(home);
+    try {
+        if (!existsSync(path))
+            return null;
+        const raw = readFileSync(path, 'utf8').trim();
+        if (raw.length === 0)
+            return null;
+        return raw;
+    }
+    catch {
+        // Read-only mount, permission denied, race with another process
+        // unlinking the file — every read failure degrades к null so the
+        // command treats the operator as a first-time viewer instead of
+        // dropping out of the slash dispatcher with an unhandled error.
+        return null;
+    }
+}
+/**
+ * Persist the last-seen marker. Creates `<home>/.pugi/` if it does
+ * not exist. Returns a structured envelope describing success or the
+ * failure reason so the renderer can footer а warning when the write
+ * could not be made durable.
+ */
+export function writeLastSeenVersion(home, version) {
+    const path = lastSeenVersionPath(home);
+    try {
+        const dir = resolve(home, '.pugi');
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        // Trailing newline so `cat ~/.pugi/.last-seen-version` reads
+        // nicely in shells that do not auto-append one for the prompt.
+        writeFileSync(path, `${version}\n`, { encoding: 'utf8', mode: 0o600 });
+        return { status: 'ok', path };
+    }
+    catch (error) {
+        return {
+            status: 'failed',
+            path,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Clear the last-seen marker — used by `pugi release-notes --reset`
+ * so the operator can force the full bundled changelog к re-render.
+ * Returns `absent` when the marker did not exist, `cleared` on
+ * success, `failed` on permission errors.
+ */
+export function clearLastSeenVersion(home) {
+    const path = lastSeenVersionPath(home);
+    try {
+        if (!existsSync(path)) {
+            return { status: 'absent', path };
+        }
+        unlinkSync(path);
+        return { status: 'cleared', path };
+    }
+    catch (error) {
+        return {
+            status: 'failed',
+            path,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/core/repl/codebase-survey.js

@@ -0,0 +1,308 @@
+/**
+ * Codebase survey for the `/init` interview - Phase 2.
+ *
+ * Inspired by Claude Code's /init Phase 2 (the upstream spawns a
+ * Task-tool subagent to read manifest files + CI config + existing
+ * agent rules and produce a structured "what this repo is" digest).
+ * Independent implementation: Pugi's subagent infra is admin-api
+ * scheduled and not available in the local REPL boot path, so the
+ * survey runs as a direct filesystem scan instead. The shape of the
+ * output matches the upstream pattern - manifest, languages, build /
+ * test / lint commands, existing AI-tool configs - so the downstream
+ * Phase 3 / Phase 4 logic stays portable.
+ *
+ * # Design notes
+ *
+ * - Pure fs reads. No spawn, no network, no LLM call. Safe to run on
+ *   every `/init` invocation without rate-limit concern.
+ * - Bounded: every read caps at 16 KB to defend against an enormous
+ *   manifest pinning memory. Real package.json / pyproject.toml are
+ *   well under that.
+ * - Defensive: a missing or unreadable file maps to `undefined` in the
+ *   returned record. Phase 3 treats unknowns as "ask the operator".
+ * - Manifest grammar is closed: package.json (Node) and pyproject.toml
+ *   (Python) are recognised explicitly because Pugi customers ship one
+ *   of those nine times out of ten. Cargo.toml / go.mod / pom.xml are
+ *   detected by filename only - we surface "rust"/"go"/"java" as the
+ *   language hint but do not parse them, because the Phase 3 question
+ *   set asks for build commands directly when the manifest is opaque.
+ *
+ * # What we collect
+ *
+ *   1. `manifest`: which manifest file was found (closed enum).
+ *   2. `languages`: deduped list inferred from manifest + file extension
+ *      heuristics under the workspace root (one-level deep scan).
+ *   3. `packageManager`: pnpm / npm / yarn (Node only) or `unknown`.
+ *   4. `buildCommand` / `testCommand` / `lintCommand`: parsed out of
+ *      `package.json` scripts when a Node manifest is present.
+ *   5. `aiToolConfigs`: a record of which sibling-agent config files
+ *      already exist (CLAUDE.md, AGENTS.md, .cursorrules,
+ *      .github/copilot-instructions.md, .windsurfrules, .clinerules,
+ *      .mcp.json). Phase 4 mines these for "important parts" without
+ *      duplicating them into PUGI.md.
+ *   6. `hasReadme`, `hasGit`, `hasCi`: simple booleans for the
+ *      gap-question logic.
+ *   7. `hasExistingPugiMd`: true when re-running `/init` against a
+ *      workspace that already produced PUGI.md.
+ *
+ * # Why not spawn a Pugi subagent
+ *
+ * The Pugi subagent dispatcher (apps/pugi-cli/src/core/subagents/)
+ * speaks to admin-api over the SSE transport. Running the codebase
+ * survey through that path would (a) burn a tenant token quota on
+ * every `/init`, (b) require an online connection, and (c) round-trip
+ * structured data through the persona prompt - which is the wrong
+ * tool for "list which files exist". A direct fs scan is faster,
+ * deterministic, and works offline. The upstream Task-tool decision
+ * makes sense in a hosted product where every operation is metered;
+ * Pugi runs locally so we keep the survey local too.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Maximum bytes the survey reads from any single file. Real manifests
+ * are tiny (<8 KB); this cap defends against a hostile or accidental
+ * gigabyte JSON pinning the REPL boot.
+ */
+const MAX_READ_BYTES = 16 * 1024;
+/**
+ * Top-level directory scan budget. The survey looks at the workspace
+ * root + at most this many entries when inferring languages from file
+ * extensions. Deep walks are not needed - the manifest is the source
+ * of truth for the active stack.
+ */
+const MAX_TOP_LEVEL_ENTRIES = 200;
+/**
+ * Run a codebase survey against `workspaceRoot`. Pure: returns a
+ * snapshot record; the caller decides how to render it.
+ */
+export function surveyCodebase(workspaceRoot) {
+    const errors = [];
+    const manifest = detectManifest(workspaceRoot);
+    const packageJson = manifest === 'package.json'
+        ? safeReadJson(join(workspaceRoot, 'package.json'), errors)
+        : undefined;
+    const packageManager = inferPackageManager(workspaceRoot, packageJson);
+    const languages = inferLanguages(workspaceRoot, manifest, errors);
+    const scripts = (packageJson && typeof packageJson === 'object' && packageJson !== null
+        ? packageJson.scripts
+        : undefined) ?? {};
+    const buildCommand = pickScript(scripts, ['build', 'compile']);
+    const testCommand = pickScript(scripts, ['test', 'tests']);
+    const lintCommand = pickScript(scripts, ['lint', 'check']);
+    const formatCommand = pickScript(scripts, ['format', 'fmt', 'prettier']);
+    const aiToolConfigs = scanAiToolConfigs(workspaceRoot);
+    return {
+        workspaceRoot,
+        manifest,
+        packageManager,
+        languages,
+        buildCommand,
+        testCommand,
+        lintCommand,
+        formatCommand,
+        aiToolConfigs,
+        hasReadme: existsSafe(join(workspaceRoot, 'README.md')) ||
+            existsSafe(join(workspaceRoot, 'readme.md')),
+        hasGit: existsSafe(join(workspaceRoot, '.git')),
+        hasCi: detectCi(workspaceRoot),
+        hasExistingPugiMd: aiToolConfigs['PUGI.md'],
+        readErrors: errors,
+    };
+}
+/* ------------------------------------------------------------------ */
+/* Manifest detection                                                  */
+/* ------------------------------------------------------------------ */
+const MANIFEST_PROBE_ORDER = Object.freeze([
+    'package.json',
+    'pyproject.toml',
+    'Cargo.toml',
+    'go.mod',
+    'pom.xml',
+    'Gemfile',
+    'composer.json',
+]);
+function detectManifest(root) {
+    for (const candidate of MANIFEST_PROBE_ORDER) {
+        if (existsSafe(join(root, candidate)))
+            return candidate;
+    }
+    return 'unknown';
+}
+function inferPackageManager(root, packageJson) {
+    // package.json `packageManager` field wins when present (corepack convention).
+    if (packageJson &&
+        typeof packageJson === 'object' &&
+        packageJson !== null &&
+        'packageManager' in packageJson) {
+        const declared = packageJson.packageManager;
+        if (typeof declared === 'string') {
+            if (declared.startsWith('pnpm@'))
+                return 'pnpm';
+            if (declared.startsWith('yarn@'))
+                return 'yarn';
+            if (declared.startsWith('npm@'))
+                return 'npm';
+            if (declared.startsWith('bun@'))
+                return 'bun';
+        }
+    }
+    // Lockfile fallback.
+    if (existsSafe(join(root, 'pnpm-lock.yaml')))
+        return 'pnpm';
+    if (existsSafe(join(root, 'yarn.lock')))
+        return 'yarn';
+    if (existsSafe(join(root, 'bun.lockb')) || existsSafe(join(root, 'bun.lock')))
+        return 'bun';
+    if (existsSafe(join(root, 'package-lock.json')))
+        return 'npm';
+    return 'unknown';
+}
+/* ------------------------------------------------------------------ */
+/* Language inference                                                  */
+/* ------------------------------------------------------------------ */
+const EXT_TO_LANG = Object.freeze({
+    '.ts': 'typescript',
+    '.tsx': 'typescript',
+    '.js': 'javascript',
+    '.jsx': 'javascript',
+    '.mjs': 'javascript',
+    '.cjs': 'javascript',
+    '.py': 'python',
+    '.rs': 'rust',
+    '.go': 'go',
+    '.java': 'java',
+    '.kt': 'kotlin',
+    '.swift': 'swift',
+    '.rb': 'ruby',
+    '.php': 'php',
+    '.cs': 'csharp',
+    '.cpp': 'cpp',
+    '.c': 'c',
+});
+const MANIFEST_TO_LANG = Object.freeze({
+    'package.json': ['javascript'],
+    'pyproject.toml': ['python'],
+    'Cargo.toml': ['rust'],
+    'go.mod': ['go'],
+    'pom.xml': ['java'],
+    'Gemfile': ['ruby'],
+    'composer.json': ['php'],
+    'unknown': [],
+});
+function inferLanguages(root, manifest, errors) {
+    const collected = new Set(MANIFEST_TO_LANG[manifest]);
+    // Top-level extension scan, bounded.
+    try {
+        const entries = readdirSync(root);
+        let scanned = 0;
+        for (const entry of entries) {
+            if (scanned >= MAX_TOP_LEVEL_ENTRIES)
+                break;
+            scanned += 1;
+            // Skip dotfiles + common dependency dirs - they pollute the
+            // language inference with build/cache content.
+            if (entry.startsWith('.') || entry === 'node_modules' || entry === 'dist')
+                continue;
+            const dot = entry.lastIndexOf('.');
+            if (dot <= 0)
+                continue;
+            const ext = entry.slice(dot);
+            const lang = EXT_TO_LANG[ext];
+            if (lang)
+                collected.add(lang);
+        }
+    }
+    catch (error) {
+        errors.push(`readdir ${root}: ${normalizeError(error)}`);
+    }
+    // `typescript` implies `javascript` runtime; keep both so the
+    // interview can ask "compiled-with vs run-with" if needed.
+    return Array.from(collected).sort();
+}
+/* ------------------------------------------------------------------ */
+/* Script picker                                                       */
+/* ------------------------------------------------------------------ */
+function pickScript(scripts, candidates) {
+    for (const key of candidates) {
+        const value = scripts[key];
+        if (typeof value === 'string' && value.trim().length > 0) {
+            // Surface the npm-style invocation so Phase 4 can quote it
+            // verbatim. The package manager name is filled in by the caller
+            // once it has resolved `packageManager`.
+            return key;
+        }
+    }
+    return undefined;
+}
+/* ------------------------------------------------------------------ */
+/* AI tool config scan                                                 */
+/* ------------------------------------------------------------------ */
+const AI_TOOL_CONFIG_PATHS = Object.freeze([
+    'CLAUDE.md',
+    'CLAUDE.local.md',
+    'AGENTS.md',
+    '.cursorrules',
+    '.cursor/rules',
+    '.github/copilot-instructions.md',
+    '.windsurfrules',
+    '.clinerules',
+    '.mcp.json',
+    'PUGI.md',
+    'PUGI.local.md',
+]);
+function scanAiToolConfigs(root) {
+    const result = {};
+    for (const rel of AI_TOOL_CONFIG_PATHS) {
+        result[rel] = existsSafe(join(root, rel));
+    }
+    return Object.freeze(result);
+}
+/* ------------------------------------------------------------------ */
+/* CI detection                                                        */
+/* ------------------------------------------------------------------ */
+const CI_PROBE_PATHS = Object.freeze([
+    '.github/workflows',
+    '.gitlab-ci.yml',
+    '.circleci/config.yml',
+    'azure-pipelines.yml',
+    '.travis.yml',
+    '.buildkite',
+]);
+function detectCi(root) {
+    return CI_PROBE_PATHS.some((rel) => existsSafe(join(root, rel)));
+}
+/* ------------------------------------------------------------------ */
+/* Safe IO helpers                                                     */
+/* ------------------------------------------------------------------ */
+function existsSafe(path) {
+    try {
+        return existsSync(path);
+    }
+    catch {
+        return false;
+    }
+}
+function safeReadJson(path, errors) {
+    try {
+        const stats = statSync(path);
+        if (!stats.isFile())
+            return undefined;
+        if (stats.size > MAX_READ_BYTES) {
+            errors.push(`oversize ${path}: ${stats.size} bytes`);
+            return undefined;
+        }
+        const raw = readFileSync(path, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        errors.push(`read ${path}: ${normalizeError(error)}`);
+        return undefined;
+    }
+}
+function normalizeError(error) {
+    if (error instanceof Error)
+        return error.message;
+    return String(error);
+}
+//# sourceMappingURL=codebase-survey.js.map

package/dist/core/repl/history.js

@@ -31,6 +31,7 @@
  * keys stay readable English (`brief`, `ts`). No forbidden words.
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, renameSync, unlinkSync, } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 /** Cap on stored entries per workspace. Drops oldest on overflow. */
@@ -77,7 +78,16 @@ export function append(input) {
     // sibling guarantees that). P2 fix from PR #335 triple-review.
     if (existing.length + 1 > MAX_HISTORY_ENTRIES) {
         const trimmed = [...existing.slice(existing.length + 1 - MAX_HISTORY_ENTRIES), entry];
-        const tmpPath = `${path}.tmp`;
+        // β1b #52 (2026-05-26): unique-per-call tmp suffix.
+        // Previous form was a fixed `${path}.tmp`, which means two CLI
+        // processes hitting the overflow rewrite at the same moment race
+        // on the same sibling file. Whichever writeFileSync lands second
+        // can corrupt the renameSync target's content (one process's
+        // serialized buffer overwrites the other mid-flight). Append a
+        // pid + monotonic-ish timestamp + 8 hex random bytes so the tmp
+        // names are collision-proof across PIDs, concurrent calls inside
+        // one PID, and rapid re-runs that share the same ms timestamp.
+        const tmpPath = `${path}.${process.pid}.${Date.now()}.${randomBytes(4).toString('hex')}.tmp`;
         try {
             writeFileSync(tmpPath, trimmed.map(serialize).join('\n') + '\n', { mode: 0o600 });
             renameSync(tmpPath, path);