@smoothbricks/cli 0.10.0 → 0.10.2

package/src/monorepo/lockfile.test.ts

@@ -0,0 +1,157 @@
+import { afterAll, describe, expect, it } from 'bun:test';
+import { execSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import fc from 'fast-check';
+import { syncBunLockfileVersions, validateBunLockfileVersions } from './lockfile.js';
+
+const cleanupRoots: string[] = [];
+afterAll(() => {
+  for (const root of cleanupRoots) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+function git(root: string, args: string): string {
+  return execSync(`git ${args}`, {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GIT_CONFIG_GLOBAL: '/dev/null',
+      GIT_CONFIG_SYSTEM: '/dev/null',
+      GIT_AUTHOR_NAME: 'fixture',
+      GIT_AUTHOR_EMAIL: 'fixture@invalid',
+      GIT_COMMITTER_NAME: 'fixture',
+      GIT_COMMITTER_EMAIL: 'fixture@invalid',
+    },
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+}
+
+interface FixtureOptions {
+  packageVersion: string;
+  lockVersion: string;
+  stableTag?: string;
+}
+
+function makeFixtureRepo(options: FixtureOptions): string {
+  const root = mkdtempSync(join(tmpdir(), 'smoo-lockfile-'));
+  cleanupRoots.push(root);
+  git(root, 'init -q');
+  git(root, 'commit -q --allow-empty -m init');
+  writeFileSync(
+    join(root, 'package.json'),
+    JSON.stringify({ name: 'fixture-root', version: '0.0.0', private: true, workspaces: ['packages/*'] }),
+  );
+  mkdirSync(join(root, 'packages', 'foo'), { recursive: true });
+  writeFixturePackage(root, options.packageVersion);
+  writeFixtureLock(root, options.lockVersion);
+  if (options.stableTag) {
+    git(root, `tag ${options.stableTag}`);
+  }
+  return root;
+}
+
+function writeFixturePackage(root: string, version: string): void {
+  writeFileSync(
+    join(root, 'packages', 'foo', 'package.json'),
+    JSON.stringify({ name: '@fixture/foo', version, nx: { name: 'foo' } }),
+  );
+}
+
+function writeFixtureLock(root: string, version: string): void {
+  writeFileSync(
+    join(root, 'bun.lock'),
+    [
+      '{',
+      '  "lockfileVersion": 1,',
+      '  "workspaces": {',
+      '    "": { "name": "fixture-root" },',
+      '    "packages/foo": {',
+      '      "name": "@fixture/foo",',
+      `      "version": "${version}",`,
+      '    },',
+      '  },',
+      '}',
+      '',
+    ].join('\n'),
+  );
+}
+
+function lockVersionIn(root: string): string {
+  const match = readFileSync(join(root, 'bun.lock'), 'utf8').match(/"packages\/foo":\s*\{[^}]*"version":\s*"([^"]+)"/);
+  if (!match) throw new Error('fixture lockfile lost its workspace entry');
+  return match[1] as string;
+}
+
+describe('bun.lock workspace version sync', () => {
+  it('a bun-install revert of the release-synced version fails validation', () => {
+    // The b3298fc4c shape: package.json holds the next prerelease, a stable tag
+    // exists, and `bun install` rewrote the lockfile back to the prerelease.
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(validateBunLockfileVersions(root)).toBe(1);
+  });
+
+  it('sync restores the latest stable tag version and validation passes', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.2');
+    expect(validateBunLockfileVersions(root)).toBe(0);
+  });
+
+  it('a never-published prerelease package falls back to its manifest version', () => {
+    // The new-workspace-package shape (e.g. cowshed): no stable tag exists yet.
+    const root = makeFixtureRepo({ packageVersion: '0.2.0-next.0', lockVersion: '0.2.0-next.0' });
+    expect(validateBunLockfileVersions(root)).toBe(0);
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(0);
+  });
+
+  it('a stable manifest version is required verbatim in the lockfile', () => {
+    const root = makeFixtureRepo({ packageVersion: '0.1.0', lockVersion: '0.0.9' });
+    expect(validateBunLockfileVersions(root)).toBe(1);
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.0');
+  });
+
+  it('stage: true stages the healed bun.lock', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(1);
+    expect(git(root, 'diff --cached --name-only')).toContain('bun.lock');
+  });
+
+  it('stage: true leaves a clean lockfile unstaged', () => {
+    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
+    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(0);
+    expect(git(root, 'diff --cached --name-only').trim()).toBe('');
+  });
+
+  it('property: after sync, validation always passes', () => {
+    const version = fc
+      .tuple(fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.option(fc.nat({ max: 5 })))
+      .map(([major, minor, patch, next]) => `${major}.${minor}.${patch}${next === null ? '' : `-next.${next}`}`);
+    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
+    fc.assert(
+      fc.property(version, version, (packageVersion, lockVersion) => {
+        writeFixturePackage(root, packageVersion);
+        writeFixtureLock(root, lockVersion);
+        syncBunLockfileVersions(root, { log: false });
+        return validateBunLockfileVersions(root) === 0;
+      }),
+      { numRuns: 25 },
+    );
+  });
+});

package/src/monorepo/lockfile.ts

@@ -5,6 +5,8 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 
 export interface SyncBunLockfileVersionsOptions {
   log?: boolean;
+  /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+  stage?: boolean;
 }
 
 // Temporary Bun workaround. Delete this sync function, validateBunLockfileVersions,
@@ -16,6 +18,12 @@ export interface SyncBunLockfileVersionsOptions {
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
+//
+// Any `bun install` rewrites the workspace versions from package.json, reverting
+// this sync between releases. The pre-commit hook therefore runs
+// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
+// healed at the commit that would otherwise carry it — validation must never
+// fail a committer for drift a routine `bun install` introduced.
 export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVersionsOptions = {}): number {
   const log = options.log ?? true;
   const lockfilePath = join(root, 'bun.lock');
@@ -59,10 +67,15 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   }
   if (updated > 0) {
     writeFileSync(lockfilePath, lockfile);
+    if (options.stage) {
+      execSync('git add bun.lock', { cwd: root, stdio: ['pipe', 'pipe', 'pipe'] });
+    }
   }
-  if (log) {
+  if (log || updated > 0) {
     console.log(
-      updated > 0 ? `Updated ${updated} workspace version(s) in bun.lock` : 'All workspace versions already in sync.',
+      updated > 0
+        ? `Updated ${updated} workspace version(s) in bun.lock${options.stage ? ' (staged)' : ''}`
+        : 'All workspace versions already in sync.',
     );
   }
   return updated;

package/src/monorepo/managed-files.test.ts

@@ -93,6 +93,19 @@ describe('managed-file inline local blocks', () => {
     );
   });
 
+  it('preserves marker indentation when refreshing nested configuration', () => {
+    const markerIndent = '      ';
+    const current = [
+      'patterns:',
+      "      - '*.html'",
+      `${markerIndent}${INLINE_LOCAL_BEGIN}`,
+      "      - '!**/templates/*.html'",
+      `${markerIndent}${INLINE_LOCAL_END}`,
+    ].join('\n');
+    const { withoutInline, blocks } = extractInlineLocalBlocksForTest(current);
+    expect(reinsertInlineLocalBlocksForTest(withoutInline, blocks)).toBe(current);
+  });
+
   it("reinserting refuses when the anchor no longer appears — never silently drops the repo's customization", () => {
     const fresh = ['a:', '  - one', 'b:'].join('\n'); // '  - two' is gone
     expect(() => reinsertInlineLocalBlocksForTest(fresh, [{ anchor: '  - two', lines: '  - repo-owned' }])).toThrow(

package/src/monorepo/managed-files.ts

@@ -50,6 +50,7 @@ export const INLINE_LOCAL_END = '# smoo-local-end';
 interface InlineLocalBlock {
   anchor: string;
   lines: string;
+  markerIndent?: string;
 }
 
 /** Pull inline local blocks out of a managed section, returning the section
@@ -76,7 +77,12 @@ function extractInlineLocalBlocks(managed: string): { withoutInline: string; blo
       if (i >= lines.length) {
         throw new Error(`${INLINE_LOCAL_BEGIN} anchored on "${anchor}" has no matching ${INLINE_LOCAL_END}`);
       }
-      blocks.push({ anchor, lines: blockLines.join('\n') });
+      const markerIndent = line.slice(0, line.length - line.trimStart().length);
+      blocks.push({
+        anchor,
+        lines: blockLines.join('\n'),
+        ...(markerIndent === '' ? {} : { markerIndent }),
+      });
       i += 1; // skip the END marker line itself
       continue;
     }
@@ -102,7 +108,14 @@ function reinsertInlineLocalBlocks(content: string, blocks: InlineLocalBlock[]):
           'template — reconcile the repo-owned block manually',
       );
     }
-    lines.splice(index + 1, 0, INLINE_LOCAL_BEGIN, ...block.lines.split('\n'), INLINE_LOCAL_END);
+    const markerIndent = block.markerIndent ?? '';
+    lines.splice(
+      index + 1,
+      0,
+      `${markerIndent}${INLINE_LOCAL_BEGIN}`,
+      ...block.lines.split('\n'),
+      `${markerIndent}${INLINE_LOCAL_END}`,
+    );
   }
   return lines.join('\n');
 }
@@ -388,9 +401,11 @@ function readCiPushBranches(packageJson: unknown): string[] {
 }
 
 function recordValue(value: unknown): Record<string, unknown> | undefined {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : undefined;
+  return isRecord(value) ? value : undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
 
 function renderYamlFlowList(values: string[]): string {

package/src/monorepo/package-policy.test.ts

@@ -70,21 +70,7 @@ describe('root smoo monorepo policy', () => {
       expect(rootPackage).toMatchObject({ nx: { includedScripts: [] } });
       expect(nxJson.namedInputs).toEqual(validNamedInputs());
       expect(nxJson.targetDefaults).toEqual(validTargetDefaults());
-      expect(nxJson.plugins).toEqual([
-        {
-          plugin: '@nx/js/typescript',
-          options: {
-            typecheck: { targetName: 'typecheck' },
-            build: {
-              targetName: 'tsc-js',
-              configName: 'tsconfig.lib.json',
-              buildDepsName: 'build-deps',
-              watchDepsName: 'watch-deps',
-            },
-          },
-        },
-        '@smoothbricks/nx-plugin',
-      ]);
+      expect(nxJson.plugins).toEqual(['@smoothbricks/nx-plugin']);
       expect(validateRootPackagePolicy(root)).toBe(0);
       expect(validateNxReleaseConfig(root)).toBe(0);
     } finally {
@@ -167,7 +153,7 @@ describe('root smoo monorepo policy', () => {
     }
   });
 
-  it('explains Nx plugin conventions when nx.json is not configured', async () => {
+  it('explains SmoothBricks Nx plugin conventions when nx.json is not configured', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-package-policy-'));
     try {
       await writeJson(join(root, 'package.json'), validRootPackage());
@@ -177,10 +163,8 @@ describe('root smoo monorepo policy', () => {
       });
       const errors = captureConsoleErrors();
 
-      expect(validateNxReleaseConfig(root)).toBe(2);
+      expect(validateNxReleaseConfig(root)).toBe(1);
 
-      expect(errors.join('\n')).toContain('Official Nx owns TypeScript library inference');
-      expect(errors.join('\n')).toContain('tsconfig.lib.json produces tsc-js');
       expect(errors.join('\n')).toContain('Smoo relies on this plugin to infer convention targets');
       expect(errors.join('\n')).not.toContain('Fix:');
     } finally {
@@ -188,7 +172,7 @@ describe('root smoo monorepo policy', () => {
     }
   });
 
-  it('explains why TypeScript build targetName is tsc-js', async () => {
+  it('rejects the official Nx TypeScript plugin because it bypasses ttsc transforms', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-package-policy-'));
     try {
       await writeJson(join(root, 'package.json'), validRootPackage());
@@ -206,8 +190,8 @@ describe('root smoo monorepo policy', () => {
 
       expect(validateNxReleaseConfig(root)).toBe(1);
 
-      expect(errors.join('\n')).toContain('build.targetName must be tsc-js');
-      expect(errors.join('\n')).toContain('build is reserved for aggregate targets');
+      expect(errors.join('\n')).toContain('plugins must not configure @nx/js/typescript');
+      expect(errors.join('\n')).toContain('Smoo owns transformer-aware TypeScript targets');
       expect(errors.join('\n')).not.toContain('Fix:');
     } finally {
       await rm(root, { recursive: true, force: true });
@@ -1100,21 +1084,7 @@ function validConfiguredNxJson(): Record<string, unknown> {
     ...validNxJson(),
     namedInputs: validNamedInputs(),
     targetDefaults: validTargetDefaults(),
-    plugins: [
-      {
-        plugin: '@nx/js/typescript',
-        options: {
-          typecheck: { targetName: 'typecheck' },
-          build: {
-            targetName: 'tsc-js',
-            configName: 'tsconfig.lib.json',
-            buildDepsName: 'build-deps',
-            watchDepsName: 'watch-deps',
-          },
-        },
-      },
-      '@smoothbricks/nx-plugin',
-    ],
+    plugins: ['@smoothbricks/nx-plugin'],
   };
 }
 

package/src/monorepo/publish-workflow.ts

@@ -1,3 +1,5 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
 
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';

package/src/monorepo/tool-validation.test.ts

@@ -12,12 +12,13 @@ import {
 
 const registryVersions: Record<string, string[]> = {
   '@biomejs/biome': ['2.3.5'],
-  '@nx/js': ['22.5.4'],
-  '@smoothbricks/nx-plugin': ['0.0.1'],
+  '@nx/js': ['23.1.0'],
+  '@smoothbricks/nx-plugin': ['0.3.0'],
   eslint: ['9.39.1'],
   'eslint-stdout': ['1.1.1', '1.1.2'],
-  nx: ['22.5.4'],
+  nx: ['23.1.0'],
   prettier: ['3.6.1'],
+  ttsc: ['0.18.4'],
   typescript: ['5.9.3'],
 };
 
@@ -25,7 +26,7 @@ const realFetch = globalThis.fetch;
 
 describe('tool configuration validation', () => {
   beforeEach(() => {
-    globalThis.fetch = mockRegistryFetch as typeof fetch;
+    globalThis.fetch = mockRegistryFetch;
   });
 
   afterEach(() => {
@@ -67,7 +68,7 @@ describe('tool configuration validation', () => {
       expect(rootPackage.devDependencies['@smoothbricks/cli']).toBeUndefined();
       expect(rootPackage.devDependencies['@smoothbricks/nx-plugin']).toBe('workspace:*');
       expect(rootPackage.devDependencies['eslint-stdout']).toBe('workspace:*');
-      expect(rootPackage.devDependencies.nx).toBe('22.5.4');
+      expect(rootPackage.devDependencies.nx).toBe('23.1.0');
       expect(rootPackage.workspaces).toContain('tooling');
       expect(toolingPackage.name).toBe('@smoothbricks/tooling');
       expect(toolingPackage.dependencies['@smoothbricks/cli']).toBe('workspace:*');
@@ -89,13 +90,14 @@ describe('tool configuration validation', () => {
         workspaces: ['packages/*', 'tooling'],
         devDependencies: {
           '@biomejs/biome': '^3.0.0',
-          '@nx/js': '22.6.0',
-          '@smoothbricks/nx-plugin': '^0.1.0',
+          '@nx/js': '23.2.0',
+          '@smoothbricks/nx-plugin': '^0.4.0',
           '@types/bun': '1.3.99',
           eslint: '^10.0.0',
           'eslint-stdout': await currentEslintStdoutRange(),
-          nx: '23.0.0',
+          nx: '24.0.0',
           prettier: '^3.7.0',
+          ttsc: '^0.19.0',
           typescript: '^6.0.0',
         },
       });
@@ -132,6 +134,35 @@ describe('tool configuration validation', () => {
     }
   });
 
+  it('preserves an installable CLI range when the running CLI is a linked prerelease', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
+    try {
+      const configuredRange = '^0.10.1';
+      const runningRange = await currentCliRange();
+      const expectedRange = runningRange.includes('-') ? configuredRange : runningRange;
+      await writeJson(join(root, 'package.json'), {
+        name: '@fixture/app',
+        version: '0.0.0',
+        private: true,
+        workspaces: ['packages/*', 'tooling'],
+      });
+      await writeJson(join(root, 'tooling/package.json'), {
+        name: '@fixture/tooling',
+        private: true,
+        dependencies: { '@smoothbricks/cli': configuredRange },
+      });
+
+      const context = readToolContext(root);
+      expect(context.policy.cliDependencyRange).toBe(expectedRange);
+      applyToolingPackageDefaults(root, context.policy);
+
+      const toolingPackage = JSON.parse(await readFile(join(root, 'tooling/package.json'), 'utf8'));
+      expect(toolingPackage.dependencies['@smoothbricks/cli']).toBe(expectedRange);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it('uses workspace smoo in the SmoothBricks codebase repo', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
     try {
@@ -161,10 +192,11 @@ describe('tool configuration validation', () => {
         workspaces: ['packages/*', 'tooling'],
         devDependencies: {
           '@biomejs/biome': '^3.0.0',
-          '@nx/js': '22.6.0',
+          '@nx/js': '23.2.0',
           eslint: '^10.0.0',
-          nx: '23.0.0',
+          nx: '24.0.0',
           prettier: '^3.7.0',
+          ttsc: '^0.19.0',
           typescript: '^6.0.0',
         },
       });
@@ -195,20 +227,23 @@ async function currentEslintStdoutRange(): Promise<string> {
   return `^${latestPatchVersion('eslint-stdout', pkg.version) ?? pkg.version}`;
 }
 
-function mockRegistryFetch(input: Parameters<typeof fetch>[0]): Promise<Response> {
-  const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
-  const packageName = decodeURIComponent(new URL(url).pathname.slice(1));
-  const versions = registryVersions[packageName];
-  if (!versions) {
-    return Promise.resolve(new Response('{}', { status: 404 }));
-  }
-  return Promise.resolve(
-    new Response(JSON.stringify({ versions: Object.fromEntries(versions.map((version) => [version, {}])) }), {
-      status: 200,
-      headers: { 'content-type': 'application/json' },
-    }),
-  );
-}
+const mockRegistryFetch = Object.assign(
+  (input: string | URL | Request): Promise<Response> => {
+    const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+    const packageName = decodeURIComponent(new URL(url).pathname.slice(1));
+    const versions = registryVersions[packageName];
+    if (!versions) {
+      return Promise.resolve(new Response('{}', { status: 404 }));
+    }
+    return Promise.resolve(
+      new Response(JSON.stringify({ versions: Object.fromEntries(versions.map((version) => [version, {}])) }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+  },
+  { preconnect: realFetch.preconnect },
+) satisfies typeof fetch;
 
 function latestPatchVersion(packageName: string, version: string): string | null {
   const [major, minor] = version.split('.');

package/src/monorepo/tool-validation.ts

@@ -25,11 +25,11 @@ export interface ToolContext {
 
 const rootDevDependencies: RequiredDependency[] = [
   { name: '@biomejs/biome', fallbackVersion: '^2.3.5', minimumVersion: '2.3.0', prefix: '^' },
-  { name: '@nx/js', fallbackVersion: '22.0.3', minimumVersion: '22.0.0' },
+  { name: '@nx/js', fallbackVersion: '23.1.0', minimumVersion: '23.1.0' },
   {
     name: '@smoothbricks/nx-plugin',
-    fallbackVersion: '^0.0.1',
-    minimumVersion: '0.0.1',
+    fallbackVersion: '^0.3.0',
+    minimumVersion: '0.3.0',
     prefix: '^',
     useWorkspaceRangeInCodebase: true,
   },
@@ -41,8 +41,11 @@ const rootDevDependencies: RequiredDependency[] = [
     prefix: '^',
     useWorkspaceRangeInCodebase: true,
   },
-  { name: 'nx', fallbackVersion: '22.5.4', minimumVersion: '22.5.0' },
+  { name: 'nx', fallbackVersion: '23.1.0', minimumVersion: '23.1.0' },
   { name: 'prettier', fallbackVersion: '^3.6.1', minimumVersion: '3.6.0', prefix: '^' },
+  { name: 'ttsc', fallbackVersion: '^0.18.4', minimumVersion: '0.18.4', prefix: '^' },
+  // Nx and typescript-eslint still load the TypeScript 5.x JavaScript API.
+  // Compilation is exclusively delegated to ttsc by the Nx plugin targets.
   { name: 'typescript', fallbackVersion: '^5.9.3', minimumVersion: '5.9.0', prefix: '^' },
 ];
 
@@ -330,17 +333,28 @@ function formatExpectedDependency(policy: ToolPolicy, dependency: RequiredDepend
 
 export function readToolContext(root: string): ToolContext {
   const rootPackage = readPackageJsonObject(join(root, 'package.json'));
-  return { rootPackage, policy: toolPolicy(rootPackage) };
+  const toolingPackage = readJsonObject(join(root, 'tooling', 'package.json'));
+  const configuredCliRange = recordProperty(toolingPackage ?? {}, 'dependencies')?.[cliPackageName];
+  return {
+    rootPackage,
+    policy: toolPolicy(rootPackage, typeof configuredCliRange === 'string' ? configuredCliRange : null),
+  };
 }
 
-function toolPolicy(rootPackage: PackageJson | null): ToolPolicy {
+function toolPolicy(rootPackage: PackageJson | null, configuredCliRange: string | null): ToolPolicy {
   const name = typeof rootPackage?.name === 'string' ? rootPackage.name : null;
   const isCodebase = isSmoothBricksCodebasePackageName(name ?? undefined);
   const toolingName = toolingPackageName(name);
+  // A locally linked prerelease can be newer than every published CLI. Keep an existing
+  // installable range instead of rewriting the consumer manifest to an unpublished version.
+  const publishedCliRange =
+    cliPackageVersion.includes('-') && configuredCliRange && parseVersion(configuredCliRange)
+      ? configuredCliRange
+      : `^${cliPackageVersion}`;
   return {
     isSmoothBricksCodebase: isCodebase,
     toolingPackageName: toolingName,
-    cliDependencyRange: isCodebase ? 'workspace:*' : `^${cliPackageVersion}`,
+    cliDependencyRange: isCodebase ? 'workspace:*' : publishedCliRange,
   };
 }
 

package/src/monorepo/wrangler.test.ts

@@ -21,7 +21,12 @@ describe('firstWranglerEnv', () => {
 describe('applyWranglerDefaults', () => {
   it('injects the wrangler-types target and wires typecheck, idempotently', async () => {
     const root = await createWorkspace([
-      { dir: 'api', name: '@acme/api', toml: '[env.production]\n', nx: { targets: { typecheck: { dependsOn: ['^build'] } } } },
+      {
+        dir: 'api',
+        name: '@acme/api',
+        toml: '[env.production]\n',
+        nx: { targets: { typecheck: { dependsOn: ['^build'] } } },
+      },
     ]);
     try {
       applyWranglerDefaults(root);
@@ -51,7 +56,9 @@ describe('applyWranglerDefaults', () => {
   });
 
   it('omits --env from the command when the wrangler.toml declares no env block', async () => {
-    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\nmain = "src/index.ts"\n' }]);
+    const root = await createWorkspace([
+      { dir: 'api', name: '@acme/api', toml: 'name = "svc"\nmain = "src/index.ts"\n' },
+    ]);
     captureConsoleLogs();
     try {
       applyWranglerDefaults(root);

package/src/release/__tests__/fixture-repo.test.ts

@@ -226,6 +226,14 @@ describe('release planning with fixture git repositories', () => {
     });
   });
 
+  it('kills timed-out fixture Git process groups so descendants cannot hold output pipes open', async () => {
+    await withFixtureRepo(async (root) => {
+      await expect(
+        git(root, ['-c', "alias.hold-pipes=!sh -c 'sleep 30 & exit 0'", 'hold-pipes'], undefined, 100),
+      ).rejects.toThrow('timed out after 100ms');
+    });
+  }, 5_000);
+
   it('repairs a scoped package from its project-name release tag without creating a package-name tag', async () => {
     await withFixtureRepo(async (author) => {
       await writeWorkspace(author);