@rness/cli 0.7.0 → 0.8.0

package/dist/{chunk-VYP4L7BQ.js → chunk-VQMX52HT.js}

@@ -797,7 +797,7 @@ function classifyProbe(url, exitCode, stderr) {
 var STDERR_FLUSH_MS = 200;
 async function probeRemote(url, timeoutMs = 6e4, credentials) {
   positional(url, "repository url");
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const auth = withCredentials(credentials);
     const child = spawn(
       "git",
@@ -816,7 +816,7 @@ async function probeRemote(url, timeoutMs = 6e4, credentials) {
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve5(probe);
+      resolve6(probe);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -827,14 +827,14 @@ async function probeRemote(url, timeoutMs = 6e4, credentials) {
     }, timeoutMs);
     child.on("error", (e) => settle(classifyProbe(url, 1, e.message)));
     child.on("exit", (code) => {
-      const finish = () => settle(classifyProbe(url, code ?? 1, chunks.join("")));
+      const finish2 = () => settle(classifyProbe(url, code ?? 1, chunks.join("")));
       const stderr = child.stderr;
       if (stderr === null || stderr.readableEnded || stderr.destroyed)
-        return finish();
-      const flush = setTimeout(finish, STDERR_FLUSH_MS);
+        return finish2();
+      const flush = setTimeout(finish2, STDERR_FLUSH_MS);
       const done = () => {
         clearTimeout(flush);
-        finish();
+        finish2();
       };
       stderr.once("end", done);
       stderr.once("error", done);
@@ -1248,7 +1248,7 @@ async function detectGithubSsh(opts) {
     ...opts.interactive ? [] : ["-o", "BatchMode=yes"],
     "git@github.com"
   ];
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const child = spawn2(opts.command ?? "ssh", args, {
       stdio: [opts.interactive ? "inherit" : "ignore", "ignore", "pipe"]
     });
@@ -1261,7 +1261,7 @@ async function detectGithubSsh(opts) {
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve5(access2);
+      resolve6(access2);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -1269,7 +1269,7 @@ async function detectGithubSsh(opts) {
     }, timeoutMs);
     child.on("error", (e) => settle({ ok: false, reason: e.message }));
     child.on("exit", (code) => {
-      const finish = () => {
+      const finish2 = () => {
         const stderr2 = chunks.join("");
         const login = parseSshGreeting(stderr2);
         settle(
@@ -1281,11 +1281,11 @@ async function detectGithubSsh(opts) {
       };
       const stderr = child.stderr;
       if (stderr === null || stderr.readableEnded || stderr.destroyed)
-        return finish();
-      const flush = setTimeout(finish, STDERR_FLUSH_MS2);
+        return finish2();
+      const flush = setTimeout(finish2, STDERR_FLUSH_MS2);
       const done = () => {
         clearTimeout(flush);
-        finish();
+        finish2();
       };
       stderr.once("end", done);
       stderr.once("error", done);
@@ -1390,7 +1390,7 @@ function reportError(e) {
 }
 
 // src/version.ts
-var VERSION = "0.7.0";
+var VERSION = "0.8.0";
 
 // src/core/block.ts
 import { createHash } from "crypto";
@@ -2030,12 +2030,12 @@ function sessionUi(p) {
     },
     async step(options, work, done) {
       const label = options.sentence ?? tidy(options.doing);
-      const finish = (result) => done?.(result) ?? null;
+      const finish2 = (result) => done?.(result) ?? null;
       const label_ = (line) => `${line[1]} ${line[0]}`;
       if (options.git === true && !this.gitIsSilent) {
         p.log.message(paint("idle", `${label}\u2026`));
         const result = await work();
-        const line = finish(result);
+        const line = finish2(result);
         if (line !== null) say(line[0], label_(line));
         return result;
       }
@@ -2043,7 +2043,7 @@ function sessionUi(p) {
       spin.start(label);
       try {
         const result = await work();
-        const line = finish(result);
+        const line = finish2(result);
         spin.stop(line === null ? label : label_(line));
         return result;
       } catch (e) {
@@ -2710,21 +2710,29 @@ function scaffoldDir() {
 import { chmod as chmod2, mkdir as mkdir3, readFile as readFile7, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname6, join as join14 } from "path";
 var TOKENISED = /* @__PURE__ */ new Set(["package.json"]);
-async function copyScaffold(dest, tokens) {
-  const source = scaffoldDir();
+async function renderScaffold(source, tokens) {
+  const files = [];
   for (const rel of SCAFFOLD_FILES) {
     if (rel === "rness.json") continue;
     const from = join14(source, ...rel.split("/"));
-    const targetRel = rel === "_gitignore" ? ".gitignore" : rel;
-    const to = join14(dest, ...targetRel.split("/"));
-    await mkdir3(dirname6(to), { recursive: true });
     let content = await readFile7(from, "utf8");
     if (TOKENISED.has(rel)) {
       content = content.replaceAll("__RNESS_VERSION__", tokens.version).replaceAll("__RNESS_PM__", tokens.packageManager);
     }
-    await writeFile2(to, content, "utf8");
-    const mode = (await stat2(from)).mode & 511;
-    if (mode & 73) await chmod2(to, mode);
+    files.push({
+      path: rel === "_gitignore" ? ".gitignore" : rel,
+      content,
+      executable: ((await stat2(from)).mode & 73) !== 0
+    });
+  }
+  return files;
+}
+async function copyScaffold(dest, tokens) {
+  for (const file of await renderScaffold(scaffoldDir(), tokens)) {
+    const to = join14(dest, ...file.path.split("/"));
+    await mkdir3(dirname6(to), { recursive: true });
+    await writeFile2(to, file.content, "utf8");
+    if (file.executable) await chmod2(to, 493);
   }
 }
 
@@ -2878,13 +2886,13 @@ function revokeUrl() {
 }
 
 // src/commands/create.ts
-import { mkdir as mkdir6, mkdtemp, rename as rename2, rm as rm5 } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join18, relative as relative4, resolve as resolve4 } from "path";
+import { mkdir as mkdir6, mkdtemp as mkdtemp2, rename as rename2, rm as rm6 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join19, relative as relative4, resolve as resolve5 } from "path";
 
 // src/core/new-workspace.ts
-import { mkdir as mkdir4, readdir as readdir2, rm as rm4, stat as stat3 } from "fs/promises";
-import { dirname as dirname7, join as join16, relative as relative2 } from "path";
+import { mkdir as mkdir4, readdir as readdir2, rm as rm5, stat as stat3 } from "fs/promises";
+import { dirname as dirname8, join as join17, relative as relative2 } from "path";
 
 // src/core/pinned.ts
 import { execFile as execFile4 } from "child_process";
@@ -3124,6 +3132,166 @@ async function syncPinned(root, shown, fallback) {
   }
 }
 
+// src/core/scaffold-git.ts
+import { execFile as execFile5 } from "child_process";
+import { mkdtemp, realpath as realpath2, rm as rm4, writeFile as writeFile3 } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname7, join as join16, resolve as resolve3 } from "path";
+import { promisify as promisify5 } from "util";
+var execFileP5 = promisify5(execFile5);
+var CREATE_SUBJECT = "chore: rness workspace context";
+var SCAFFOLD_SUBJECT = /^chore: rness scaffold (\S+)$/;
+var SCAFFOLD_TRAILER = "Rness-Scaffold";
+async function run(dir, args, env = {}) {
+  try {
+    const { stdout, stderr } = await execFileP5("git", [...args], {
+      cwd: dir,
+      env: {
+        ...process.env,
+        ...env,
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_CEILING_DIRECTORIES: dirname7(resolve3(dir))
+      },
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return { code: 0, stdout, stderr };
+  } catch (e) {
+    const err = e;
+    return {
+      code: typeof err.code === "number" ? err.code : 1,
+      stdout: err.stdout ?? "",
+      stderr: err.stderr ?? String(e)
+    };
+  }
+}
+async function must(dir, args, env = {}) {
+  const r = await run(dir, args, env);
+  if (r.code !== 0) {
+    const first = r.stderr.split("\n").find((l) => l.trim() !== "") ?? "unknown error";
+    throw new Error(`git ${args[0] ?? ""} failed: ${first.trim()}`);
+  }
+  return r.stdout.trim();
+}
+function scaffoldMessage(subject, version) {
+  return `${subject}
+
+${SCAFFOLD_TRAILER}: ${version}`;
+}
+async function findScaffoldBase(rnessDir) {
+  const log = await run(rnessDir, [
+    "log",
+    "--topo-order",
+    `--format=%H%x1f%P%x1f%s%x1f%(trailers:key=${SCAFFOLD_TRAILER},valueonly,separator=%x2C)%x1e`,
+    "HEAD"
+  ]);
+  if (log.code !== 0) return null;
+  const commits = log.stdout.split("").map((r) => r.trim()).filter((r) => r !== "").map((r) => {
+    const [hash = "", parents = "", subject = "", trailer = ""] = r.split("");
+    return { hash, parents: parents.trim(), subject, trailer: trailer.trim() };
+  });
+  for (const c of commits) {
+    const m = SCAFFOLD_SUBJECT.exec(c.subject);
+    if (m !== null) return { commit: c.hash, version: m[1] ?? null };
+  }
+  const root = commits.find(
+    (c) => c.parents === "" && c.subject === CREATE_SUBJECT
+  );
+  if (root === void 0) return null;
+  return {
+    commit: root.hash,
+    version: root.trailer === "" ? null : root.trailer
+  };
+}
+async function buildScaffoldCommit(rnessDir, base, files, version) {
+  const scratch = await mkdtemp(join16(tmpdir(), "rness-scaffold-"));
+  const env = { GIT_INDEX_FILE: join16(scratch, "index") };
+  try {
+    await must(
+      rnessDir,
+      ["read-tree", ...base === null ? ["--empty"] : [base]],
+      env
+    );
+    for (const [i, file] of files.entries()) {
+      const tmp = join16(scratch, `blob-${i}`);
+      await writeFile3(tmp, file.content, "utf8");
+      const blob = await must(rnessDir, [
+        "hash-object",
+        "-w",
+        "--no-filters",
+        "--",
+        tmp
+      ]);
+      await must(
+        rnessDir,
+        [
+          "update-index",
+          "--add",
+          "--cacheinfo",
+          `${file.executable ? "100755" : "100644"},${blob},${file.path}`
+        ],
+        env
+      );
+    }
+    const tree = await must(rnessDir, ["write-tree"], env);
+    return await must(rnessDir, [
+      "commit-tree",
+      tree,
+      ...base === null ? [] : ["-p", base],
+      "-m",
+      scaffoldMessage(`chore: rness scaffold ${version}`, version)
+    ]);
+  } finally {
+    await rm4(scratch, { recursive: true, force: true });
+  }
+}
+async function blobAt(rnessDir, rev, path) {
+  const r = await run(rnessDir, [
+    "rev-parse",
+    "--verify",
+    "--quiet",
+    `${rev}:${path}`
+  ]);
+  return r.code === 0 ? r.stdout.trim() : null;
+}
+async function mergeScaffold(rnessDir, commit, base) {
+  await run(rnessDir, [
+    "merge",
+    "--no-commit",
+    "--no-ff",
+    ...base === null ? ["--allow-unrelated-histories"] : [],
+    commit
+  ]);
+  const conflicts = (await must(rnessDir, ["diff", "--name-only", "--diff-filter=U"])).split("\n").filter((l) => l !== "");
+  const changes = [];
+  const status2 = await must(rnessDir, [
+    "diff",
+    "--cached",
+    "--name-status",
+    "HEAD"
+  ]);
+  for (const line of status2.split("\n")) {
+    const [letter = "", path = ""] = line.split("	");
+    if (path === "" || conflicts.includes(path)) continue;
+    if (letter === "A") changes.push(["added", path]);
+    else if (letter === "D") changes.push(["removed", path]);
+    else if (letter === "M") {
+      const untouched = base !== null && await blobAt(rnessDir, "HEAD", path) === await blobAt(rnessDir, base, path);
+      changes.push([untouched ? "updated" : "merged", path]);
+    }
+  }
+  return { conflicts, changes };
+}
+async function isShallow(rnessDir) {
+  const r = await run(rnessDir, ["rev-parse", "--is-shallow-repository"]);
+  return r.code === 0 && r.stdout.trim() === "true";
+}
+async function isRepository2(rnessDir) {
+  const r = await run(rnessDir, ["rev-parse", "--show-toplevel"]);
+  if (r.code !== 0) return false;
+  const real = (p) => realpath2(p).catch(() => resolve3(p));
+  return await real(r.stdout.trim()) === await real(rnessDir);
+}
+
 // src/core/new-workspace.ts
 async function isEmptyDir(dir) {
   return (await readdir2(dir)).length === 0;
@@ -3138,11 +3306,11 @@ async function insideWorkspace(dir) {
 }
 async function targetProblem(cwd, root, pm) {
   const shown = relative2(cwd, root) || ".";
-  if (await insideWorkspace(cwd) || await insideWorkspace(dirname7(root)))
+  if (await insideWorkspace(cwd) || await insideWorkspace(dirname8(root)))
     return "already inside an rness workspace; create runs from outside one";
   if (!await exists(root)) return null;
-  if (await exists(join16(root, ".rness", "rness.json"))) {
-    if (!await exists(join16(root, ".rness", "node_modules")))
+  if (await exists(join17(root, ".rness", "rness.json"))) {
+    if (!await exists(join17(root, ".rness", "node_modules")))
       return `${shown} holds an rness workspace whose dependencies are not installed; cd ${shown}/.rness && ${pm} install, then ${rnessCommand()} sync`;
     return `${shown} already holds an rness workspace (.rness/); run ${rnessCommand()} add inside it to add repositories`;
   }
@@ -3165,7 +3333,7 @@ async function installContext(input) {
 }
 async function buildContext(input) {
   const { ui, root, shown, pm } = input;
-  const rnessDir = join16(root, ".rness");
+  const rnessDir = join17(root, ".rness");
   const pmVersion = await packageManagerVersion(pm);
   await mkdir4(root, { recursive: true });
   try {
@@ -3179,9 +3347,9 @@ async function buildContext(input) {
     return true;
   } catch (e) {
     reportError(e);
-    await rm4(rnessDir, { recursive: true, force: true }).catch(() => void 0);
+    await rm5(rnessDir, { recursive: true, force: true }).catch(() => void 0);
     if (await isEmptyDir(root).catch(() => false))
-      await rm4(root, { recursive: true, force: true }).catch(() => void 0);
+      await rm5(root, { recursive: true, force: true }).catch(() => void 0);
     process.stderr.write(
       `removed ${shown}/.rness after the failure; fix it and retry
 `
@@ -3193,7 +3361,7 @@ async function commitContext(input) {
   const { ui, rnessDir, shown } = input;
   await init(rnessDir);
   try {
-    await commitAll(rnessDir, "chore: rness workspace context");
+    await commitAll(rnessDir, scaffoldMessage(CREATE_SUBJECT, VERSION));
     ui.line("committed", `${shown}/.rness`);
   } catch (e) {
     ui.warn(
@@ -3234,7 +3402,7 @@ async function syncBlocks(ui, root, shown, inPlace, sshWorks) {
 
 // src/commands/create-blank.ts
 import { mkdir as mkdir5 } from "fs/promises";
-import { join as join17, relative as relative3, resolve as resolve3 } from "path";
+import { join as join18, relative as relative3, resolve as resolve4 } from "path";
 var WORKSPACE_NAME = /^(?!\.{1,2}$)[A-Za-z0-9._][A-Za-z0-9._-]*$/;
 function workspaceNameError(name) {
   return `workspace name "${name}" may only contain letters, digits, '.', '_' and '-', not starting with '-'`;
@@ -3266,7 +3434,7 @@ async function createBlank(input) {
     name = answer.trim();
     prompted = true;
   }
-  const root = resolve3(cwd, name);
+  const root = resolve4(cwd, name);
   const shown = relative3(cwd, root) || ".";
   const problem = await targetProblem(cwd, root, pm);
   if (problem !== null) {
@@ -3308,8 +3476,8 @@ async function createBlank(input) {
     kind: "blank workspace"
   });
   if (!built) return 1;
-  await mkdir5(join17(root, "org"), { recursive: true });
-  await commitContext({ ui, rnessDir: join17(root, ".rness"), shown });
+  await mkdir5(join18(root, "org"), { recursive: true });
+  await commitContext({ ui, rnessDir: join18(root, ".rness"), shown });
   const code = await syncBlocks(
     ui,
     root,
@@ -3469,7 +3637,7 @@ async function cloneSelection(input) {
           { doing: `cloning  org/${repo}`, git: true },
           () => clone(
             entry.url,
-            join18(input.root, "org", repo),
+            join19(input.root, "org", repo),
             input.provider.credentialsFor(entry.url)
           ),
           () => ["cloned", `org/${repo}`]
@@ -3738,7 +3906,7 @@ async function createCommand(opts, deps = {}) {
       org = answer.trim();
       prompted = true;
     }
-    const root = resolve4(cwd, org);
+    const root = resolve5(cwd, org);
     const shown = relative4(cwd, root) || ".";
     const problem = await targetProblem(cwd, root, pm);
     if (problem !== null) {
@@ -3793,8 +3961,8 @@ async function createCommand(opts, deps = {}) {
       scopes: {}
     };
     const staged = async () => {
-      staging ??= await mkdtemp(join18(tmpdir(), "rness-join-"));
-      return join18(staging, ".rness");
+      staging ??= await mkdtemp2(join19(tmpdir2(), "rness-join-"));
+      return join19(staging, ".rness");
     };
     if (joining) {
       const stagedDir = await staged();
@@ -3852,7 +4020,7 @@ async function createCommand(opts, deps = {}) {
       });
       if (p.isCancel(ok) || ok !== true) return cancelled(ui);
     }
-    const rnessDir = join18(root, ".rness");
+    const rnessDir = join19(root, ".rness");
     const install = () => installContext({ ui, pm, rnessDir, skip: opts.skipInstall === true });
     if (joining) {
       await mkdir6(root, { recursive: true });
@@ -3865,7 +4033,7 @@ async function createCommand(opts, deps = {}) {
       ui.line("cloned", `${shown}/.rness (joined ${org})`);
       if (opts.pm === void 0) pm = await workspacePackageManager(rnessDir);
       await install();
-      await mkdir6(join18(root, "org"), { recursive: true });
+      await mkdir6(join19(root, "org"), { recursive: true });
       const failures2 = await cloneSelection({
         root,
         rnessDir,
@@ -3918,7 +4086,7 @@ ${next2.map((l) => `  ${l}`).join("\n")}
       kind: "new workspace"
     });
     if (!built) return 1;
-    await mkdir6(join18(root, "org"), { recursive: true });
+    await mkdir6(join19(root, "org"), { recursive: true });
     const failures = await cloneSelection({
       root,
       rnessDir,
@@ -3985,7 +4153,7 @@ ${next2.map((l) => `  ${l}`).join("\n")}
     return reportError(e);
   } finally {
     if (staging !== void 0)
-      await rm5(staging, { recursive: true, force: true }).catch(() => void 0);
+      await rm6(staging, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 
@@ -4018,17 +4186,16 @@ async function logoutCommand() {
 }
 
 // src/commands/upgrade.ts
-import { execFile as execFile5 } from "child_process";
-import { mkdir as mkdir7, readFile as readFile9, readdir as readdir3 } from "fs/promises";
-import { basename as basename5, dirname as dirname8, join as join19, relative as relative5 } from "path";
-import { promisify as promisify5 } from "util";
-var execFileP5 = promisify5(execFile5);
+import { execFile as execFile6 } from "child_process";
+import { mkdtemp as mkdtemp3, readFile as readFile9, rm as rm7 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename5, join as join20, relative as relative5 } from "path";
+import { promisify as promisify6 } from "util";
+var execFileP6 = promisify6(execFile6);
 var NOTES = "https://github.com/rness-dev/rness/tree/main/packages/cli#readme";
-var OLD_WORKFLOW_RUN = /npx --yes @rness\/cli@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?) validate/;
-var WORKFLOW_RUN = `npx --yes "@rness/cli@$(node -p "require('./package.json').devDependencies['@rness/cli']")" validate`;
 async function latestVersion() {
   try {
-    const { stdout } = await execFileP5(
+    const { stdout } = await execFileP6(
       "npm",
       ["view", "@rness/cli@latest", "version"],
       { timeout: 3e4 }
@@ -4039,7 +4206,70 @@ async function latestVersion() {
     return null;
   }
 }
-async function upgradeCommand(version, opts, terminal = defaultTerminal) {
+async function scaffoldFor(version, rnessDir) {
+  if (version === VERSION) return { dir: scaffoldDir() };
+  const installed = await readPinnedCli(rnessDir);
+  const inside = installed === null ? null : join20(installed.dir, "scaffold");
+  if (installed?.version === version && inside !== null && await exists(join20(inside, "package.json")))
+    return { dir: inside };
+  const scratch = await mkdtemp3(join20(tmpdir3(), "rness-pack-"));
+  const cleanup = () => rm7(scratch, { recursive: true, force: true });
+  try {
+    const { stdout } = await execFileP6(
+      "npm",
+      [
+        "pack",
+        `@rness/cli@${version}`,
+        "--pack-destination",
+        scratch,
+        "--silent"
+      ],
+      { timeout: 6e4 }
+    );
+    const tarball = stdout.trim().split("\n").at(-1) ?? "";
+    await execFileP6("tar", ["-xzf", join20(scratch, tarball), "-C", scratch]);
+    return { dir: join20(scratch, "package", "scaffold"), cleanup };
+  } catch (e) {
+    await cleanup();
+    throw new Error(
+      `cannot get the @rness/cli ${version} scaffold (npm pack): ${e instanceof Error ? e.message.split("\n")[0] : String(e)}`,
+      { cause: e }
+    );
+  }
+}
+async function declaredManager(rnessDir, pm) {
+  try {
+    const pkg = JSON.parse(
+      await readFile9(join20(rnessDir, "package.json"), "utf8")
+    );
+    if (typeof pkg.packageManager === "string") return pkg.packageManager;
+  } catch {
+  }
+  return `${pm}@${await packageManagerVersion(pm)}`;
+}
+function finish(ui, cwd, rnessDir, label, target) {
+  const rel = relative5(cwd, rnessDir) || ".";
+  const next = [
+    `git -C ${rel} add -A && git -C ${rel} commit -m "chore: rness ${target}"`,
+    "# teammates: git pull \u2014 the next rness command installs it"
+  ];
+  if (ui.session) {
+    ui.note("Next steps", next);
+    ui.outro(`${label} runs @rness/cli ${target}`);
+  } else
+    process.stdout.write(
+      [
+        "",
+        status("upgraded", `${label} to @rness/cli ${target}`),
+        "",
+        "Next:",
+        ...next.map((line) => `  ${line}`),
+        ""
+      ].join("\n")
+    );
+  return 0;
+}
+async function upgradeCommand(version, opts, terminal = defaultTerminal, deps = {}) {
   const cwd = opts.cwd ?? process.cwd();
   if (version !== void 0 && !EXACT_VERSION.test(version)) {
     process.stderr.write(
@@ -4081,7 +4311,21 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
       return 1;
     }
     const installed = (await readPinnedCli(ws.rnessDir))?.version ?? null;
-    if (pin.spec === target && installed === target) {
+    if (!await isRepository2(ws.rnessDir)) {
+      process.stderr.write(`${label} is not a git repository
+`);
+      return 1;
+    }
+    if (!await isClean(ws.rnessDir)) {
+      process.stderr.write(
+        `${label} has uncommitted changes; commit or stash them, then ${rnessCommand()} upgrade
+`
+      );
+      return 1;
+    }
+    const base = await findScaffoldBase(ws.rnessDir);
+    const scaffoldCurrent = base !== null && base.version === target;
+    if (pin.spec === target && installed === target && scaffoldCurrent) {
       if (ui.session) ui.outro(`Already at ${target}`);
       else process.stdout.write(`already at ${target}
 `);
@@ -4096,7 +4340,9 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
       return 1;
     }
     const pm = await workspacePackageManager(ws.rnessDir);
-    if (pin.spec === target)
+    if (pin.spec === target && installed === target)
+      ui.line("scaffold", `@rness/cli ${target} \u2014 merging it into ${label}`);
+    else if (pin.spec === target)
       ui.line(
         "install",
         `@rness/cli ${target} in ${label} (${pm}) \u2014 ${installed ?? "nothing"} is installed`
@@ -4118,46 +4364,58 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
         return 1;
       }
     }
-    const packageFile = join19(ws.rnessDir, "package.json");
-    const restore = /* @__PURE__ */ new Map([
-      [packageFile, await readFile9(packageFile, "utf8")]
-    ]);
-    if (pin.spec !== target) await writePin(ws.rnessDir, pin.spec, target);
-    const workflows = join19(ws.rnessDir, ".github", "workflows");
-    for (const name of await readdir3(workflows).catch(() => [])) {
-      if (!/\.ya?ml$/.test(name)) continue;
-      const file = join19(workflows, name);
-      const text = await readOrNull(file);
-      if (text === null) continue;
-      const shown = `.github/workflows/${name}`;
-      if (name === "validate.yml" && OLD_WORKFLOW_RUN.test(text)) {
-        restore.set(file, text);
-        await writeFileAtomic(
-          file,
-          text.replace(OLD_WORKFLOW_RUN, () => WORKFLOW_RUN)
+    let merged = false;
+    if (!scaffoldCurrent) {
+      const source = await (deps.scaffoldFor ?? scaffoldFor)(
+        target,
+        ws.rnessDir
+      );
+      try {
+        const files = await renderScaffold(source.dir, {
+          version: target,
+          packageManager: await declaredManager(ws.rnessDir, pm)
+        });
+        if (base === null)
+          ui.line(
+            "adopting",
+            `the @rness/cli ${target} scaffold (no scaffold commit in ${label} yet)`
+          );
+        else ui.line("merging", `the @rness/cli ${target} scaffold`);
+        const commit = await buildScaffoldCommit(
+          ws.rnessDir,
+          base?.commit ?? null,
+          files,
+          target
         );
-        ui.line(
-          "updated",
-          `${shown} (it now reads the version from package.json)`
+        const result = await mergeScaffold(
+          ws.rnessDir,
+          commit,
+          base?.commit ?? null
         );
-      } else if (pin.spec !== target && text.includes(`@rness/cli@${pin.spec}`)) {
-        ui.warn(`${shown} names @rness/cli@${pin.spec}; update it by hand`);
+        for (const [change, path] of result.changes) ui.line(change, path);
+        if (result.conflicts.length > 0) {
+          for (const path of result.conflicts) ui.error(`conflict ${path}`);
+          const rel = relative5(cwd, ws.rnessDir) || ".";
+          ui.hint(
+            `resolve them in ${rel} (git checkout --ours <file> keeps yours, --theirs takes the scaffold's, or edit), git add, git commit, then ${rnessCommand()} upgrade again`,
+            "stderr"
+          );
+          return 1;
+        }
+        merged = true;
+      } finally {
+        await source.cleanup?.();
       }
     }
-    const dependabot = join19(ws.rnessDir, ".github", "dependabot.yml");
-    if (await exists(dependabot)) {
-      ui.hint(".github/dependabot.yml is already there \u2014 left as it is");
-    } else {
-      await mkdir7(dirname8(dependabot), { recursive: true });
-      await writeFileAtomic(
-        dependabot,
-        await readFile9(join19(scaffoldDir(), ".github", "dependabot.yml"), "utf8")
-      );
-      ui.line(
-        "wrote",
-        ".rness/.github/dependabot.yml (@rness/cli now moves by pull request)"
-      );
-    }
+    const packageFile = join20(ws.rnessDir, "package.json");
+    const restore = /* @__PURE__ */ new Map([
+      [packageFile, await readFile9(packageFile, "utf8")]
+    ]);
+    const moved = await readPin(ws.rnessDir);
+    if (moved !== null && moved.spec !== target)
+      await writePin(ws.rnessDir, moved.spec, target);
+    if (pin.spec === target && installed === target)
+      return finish(ui, cwd, ws.rnessDir, label, target);
     try {
       await ui.step(
         { doing: `installing dependencies with ${pm}` },
@@ -4165,10 +4423,20 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
         () => ["installed", `dependencies with ${pm}`]
       );
     } catch (e) {
-      for (const [file, text] of restore) await writeFileAtomic(file, text);
       const message = e instanceof Error ? e.message : String(e);
       ui.error(message);
-      ui.hint(`restored ${relative5(cwd, packageFile) || packageFile}`, "stderr");
+      if (!merged) {
+        for (const [file, text] of restore) await writeFileAtomic(file, text);
+        ui.hint(
+          `restored ${relative5(cwd, packageFile) || packageFile}`,
+          "stderr"
+        );
+      }
+      if (merged)
+        ui.hint(
+          `the scaffold merge is still staged; undo it with: git -C ${relative5(cwd, ws.rnessDir) || "."} merge --abort`,
+          "stderr"
+        );
       if (/minimum.?release.?age|NO_MATURE/i.test(message))
         ui.hint(
           "pnpm refuses versions published less than 24 h ago: add '@rness/cli' under minimumReleaseAgeExclude in .rness/pnpm-workspace.yaml",
@@ -4187,33 +4455,14 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
     ui.gitIsSilent = true;
     const code = await syncBlocks(ui, ws.root, basename5(ws.root));
     if (code !== 0) return code;
-    const rel = relative5(cwd, ws.rnessDir) || ".";
-    const next = [
-      `git -C ${rel} add -A && git -C ${rel} commit -m "chore: rness ${target}"`,
-      "# teammates: git pull \u2014 the next rness command installs it"
-    ];
-    if (ui.session) {
-      ui.note("Next steps", next);
-      ui.outro(`${label} runs @rness/cli ${target}`);
-    } else
-      process.stdout.write(
-        [
-          "",
-          status("upgraded", `${label} to @rness/cli ${target}`),
-          "",
-          "Next:",
-          ...next.map((line) => `  ${line}`),
-          ""
-        ].join("\n")
-      );
-    return 0;
+    return finish(ui, cwd, ws.rnessDir, label, target);
   } catch (e) {
     return reportError(e);
   }
 }
 
 // src/core/blocks.ts
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var PROBLEM = /* @__PURE__ */ new Set(["stale", "malformed"]);
 async function checkBlocks({
   root,
@@ -4230,7 +4479,7 @@ async function checkBlocks({
     warnings: checks.filter((c) => !PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
     checks
   });
-  if (!await exists(join20(root, "org"))) return derive();
+  if (!await exists(join21(root, "org"))) return derive();
   const targets = [
     { scope: null, dir: root, depth: 0, file: "AGENTS.md", label: "AGENTS.md" },
     { scope: null, dir: root, depth: 0, file: "CLAUDE.md", label: "CLAUDE.md" }
@@ -4239,7 +4488,7 @@ async function checkBlocks({
     const segments = entry.path.split("/");
     targets.push({
       scope: name,
-      dir: join20(root, ...segments),
+      dir: join21(root, ...segments),
       depth: segments.length,
       file: "AGENTS.md",
       label: `${entry.path}/AGENTS.md`
@@ -4254,7 +4503,7 @@ async function checkBlocks({
       );
       continue;
     }
-    const text = await readOrNull(join20(t.dir, t.file));
+    const text = await readOrNull(join21(t.dir, t.file));
     const lines = text === null ? [] : text.split(/\r?\n/);
     const found = findBlock(lines);
     if (found.kind === "none") {
@@ -4294,7 +4543,7 @@ async function checkBlocks({
 }
 
 // src/core/contract.ts
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var STATUSES = {
   adr: ["Proposed", "Accepted", "Rejected", "Superseded"],
   specs: [
@@ -4313,7 +4562,7 @@ async function checkContract(rnessDir) {
   const problems = [];
   for (const name of COLLECTIONS) {
     const allowed = STATUSES[name];
-    const items = await collectMarkdown(join21(rnessDir, name));
+    const items = await collectMarkdown(join22(rnessDir, name));
     for (const item of items) {
       const where = `${name}/${item.rel}`;
       if (SKIP.has(where)) continue;
@@ -4375,11 +4624,25 @@ async function validateCommand(opts, deps = {}) {
         );
       else if (o.status === "invalid")
         problems.push(`${o.label}: ${o.detail ?? "unreadable"}`);
+    const scaffoldWarnings = [];
+    if (await isRepository2(ws.rnessDir) && !await isShallow(ws.rnessDir)) {
+      const pin = await readPin(ws.rnessDir);
+      const base = await findScaffoldBase(ws.rnessDir);
+      if (base === null || base.version === null)
+        scaffoldWarnings.push(
+          `the scaffold is not tracked in .rness yet: run ${rnessCommand()} upgrade`
+        );
+      else if (pin !== null && EXACT_VERSION.test(pin.spec) && pin.spec !== base.version)
+        scaffoldWarnings.push(
+          `the @rness/cli ${pin.spec} scaffold is not merged here: run ${rnessCommand()} upgrade`
+        );
+    }
     const ui = await makeUi(deps.terminal ?? defaultTerminal);
     if (!ui.session) {
       for (const p of problems) process.stderr.write(`${p}
 `);
-      for (const w of blocks.warnings) process.stderr.write(`${warn(w)}
+      for (const w of [...blocks.warnings, ...scaffoldWarnings])
+        process.stderr.write(`${warn(w)}
 `);
       if (problems.length > 0) return 1;
       process.stdout.write("context ok\n");
@@ -4400,6 +4663,7 @@ async function validateCommand(opts, deps = {}) {
     for (const o of targets)
       if (o.status === "unchanged") ui.line("current", o.label);
     for (const p of problems) if (!blocks.problems.includes(p)) ui.error(p);
+    for (const w of scaffoldWarnings) ui.warn(w);
     ui.outro(
       problems.length > 0 ? "Context mismatch" : "Context OK",
       problems.length > 0 ? "error" : "done"
@@ -4551,7 +4815,7 @@ function buildProgram(state) {
   });
   return program;
 }
-async function run(argv) {
+async function run2(argv) {
   const state = { code: 0 };
   const program = buildProgram(state);
   if (argv.length === 0) {
@@ -4678,8 +4942,8 @@ export {
   STATUSES,
   checkContract,
   validateCommand,
-  run,
+  run2 as run,
   OWN_COMMANDS,
   catchUp
 };
-//# sourceMappingURL=chunk-VYP4L7BQ.js.map
+//# sourceMappingURL=chunk-VQMX52HT.js.map