@spardutti/claude-skills 2.25.1 → 2.25.3

package/bin/cli.mjs

@@ -273,6 +273,7 @@ async function main() {
         });
         if (doScaffold) {
           const installs = [];
+          const apiInstalls = [];
           const vitest = [];
           for (const n of stryker) {
             const r = await scaffoldStryker(CWD, n.rel);
@@ -284,7 +285,9 @@ async function main() {
             }
             // A project that already runs Stryker needs neither the install nor
             // the vitest exclude repeated at it; it only lacked the ignorer.
-            if (!n.ignorerOnly) {
+            if (n.ignorerOnly) {
+              apiInstalls.push(r.apiInstall);
+            } else {
               installs.push(r.install);
               vitest.push(r.vitest);
             }
@@ -300,9 +303,10 @@ async function main() {
           // The ignorer imports @stryker-mutator/api, which npm hoists by
           // accident and pnpm does not. Missing, it prints one WARN PluginLoader
           // line, loads nothing, and every className mutant comes back survived.
-          if (stryker.some((n) => n.ignorerOnly)) {
+          if (apiInstalls.length > 0) {
             console.log(`\n  ${chalk.yellow("!")} ${chalk.bold("The ignorer needs its own dependency:")}`);
-            console.log(`      ${chalk.cyan("add @stryker-mutator/api as a dev dependency")} ${chalk.dim("— pnpm does not hoist it, and without it the ignorer silently does not load")}`);
+            for (const c of apiInstalls) console.log(`      ${chalk.cyan(c)}`);
+            console.log(`      ${chalk.dim("without it the ignorer silently does not load")}`);
           }
         }
       }

package/lib/scaffold-stryker.mjs

@@ -78,9 +78,11 @@ async function exists(p) {
 // npm's flat node_modules hoists it so the import resolves by accident, and
 // pnpm's isolated store does not. The failure is one WARN PluginLoader line and
 // an ignorer that never loads, so every class-name mutant comes back survived.
-async function installCommand(dir, rel) {
-  const pnpm = await exists(join(dir, "pnpm-lock.yaml"));
-  const pkgs = "@stryker-mutator/core @stryker-mutator/vitest-runner @stryker-mutator/api";
+// A workspace keeps its lockfile at the root, not in apps/web, so asking only
+// the sub-project hands a pnpm monorepo an npm command.
+async function installCommand(projectDir, dir, rel, pkgs) {
+  const pnpm =
+    (await exists(join(projectDir, "pnpm-lock.yaml"))) || (await exists(join(dir, "pnpm-lock.yaml")));
   return pnpm
     ? `pnpm --dir ${rel || "."} add -D ${pkgs}`
     : `npm --prefix ${rel || "."} i -D ${pkgs}`;
@@ -185,7 +187,17 @@ export async function scaffoldStryker(projectDir, rel) {
     kept,
     patched,
     unreadable,
-    install: await installCommand(dir, rel),
+    install: await installCommand(
+      projectDir,
+      dir,
+      rel,
+      "@stryker-mutator/core @stryker-mutator/vitest-runner @stryker-mutator/api",
+    ),
+    // A project that already runs Stryker has the other two packages and needs
+    // only this one, which nothing depends on directly. Printed as a command
+    // rather than a sentence: the sentence made every reader guess their own
+    // package manager and path.
+    apiInstall: await installCommand(projectDir, dir, rel, "@stryker-mutator/api"),
     // Stryker copies the whole project into .stryker-tmp/sandbox-*/, so every
     // test file briefly exists twice and the runner collects both. They pass,
     // so a doubled test count is the only symptom. Spread configDefaults.exclude

package/lib/setup-hook.mjs

@@ -685,6 +685,15 @@ CHANGED=$( { git diff "$BASE"...HEAD --name-only 2>/dev/null
              git diff HEAD --name-only 2>/dev/null
              git ls-files --others --exclude-standard 2>/dev/null; } | sort -u )
 
+# Only the files this gate can actually read go into the key. It used to be every
+# changed file, so a version bump in package.json or a line in a changelog threw
+# away a receipt the gate would have re-earned unchanged — fifteen minutes of
+# mutation testing to prove nothing about the file that moved, at the one moment
+# a release is trying to ship. An ignored extension is one no check here opens,
+# so it cannot change a verdict. Unknown extensions stay in, because UNPROVEN is
+# a verdict about exactly those.
+KEYED=$(printf '%s\\n' "$CHANGED" | grep -viE "\\.($GAUNTLET_IGNORE_EXT)$")
+
 # The repo path plus the names and contents of the changed files, in a fixed
 # order. The path is in there because the key is otherwise pure content: two
 # repos holding the same file would share a receipt, and one would be waved
@@ -693,7 +702,7 @@ CHANGED=$( { git diff "$BASE"...HEAD --name-only 2>/dev/null
 # the moment it was committed. This is identical either side of a commit, and
 # changes the instant any of those files is edited.
 RECEIPT_KEY=$( { printf '%s\\n' "$PROJECT_DIR"
-                 printf '%s\\n' "$CHANGED" | while IFS= read -r f; do
+                 printf '%s\\n' "$KEYED" | while IFS= read -r f; do
                    [ -n "$f" ] || continue
                    printf '%s\\n' "$f"
                    [ -f "$f" ] && cat "$f"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.25.1",
+  "version": "2.25.3",
   "description": "Guardrails for Claude Code — best-practice skills, planning commands, and delivery gates.",
   "type": "module",
   "repository": {