@stardeck-customer-apps/compose 0.14.0 → 0.14.1

package/dist/cli.js

@@ -2259,10 +2259,12 @@ var modulePermissionClaimSchema = import_zod.z.object({
   /** Human label for the deployment auth config row. */
   description: descriptionSchema,
   /**
-   * The default organization roles that hold this key when the platform
-   * first registers it on an app (a Blueprint fork, a Module install). Admin
-   * holds every key without being listed; External Viewer never holds one.
-   * Changing a role's grants afterwards is the organization's business.
+   * The standard organization roles that hold this key. The platform sets them on every app
+   * (a Blueprint fork, a Module install or uninstall, every Blueprint update), so this list is
+   * the truth: a role added here gains the key, a role removed loses it, and nobody can edit a
+   * standard role's grants on a Module key. Admin holds every key without being listed;
+   * External Viewer never holds one. An organization that wants different access duplicates the
+   * standard role and edits the copy.
    */
   roles: import_zod.z.array(import_zod.z.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
@@ -3982,6 +3984,7 @@ var JSON_SECRET_PAIR = new RegExp(
   "g"
 );
 var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
+var SHELL_QUOTE_CONTINUATION = String.raw`\''`;
 function redactSecrets(text) {
   return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
@@ -4827,6 +4830,9 @@ function enhancementImport(owner, peer) {
 function scopeLabel(scope) {
   return scope.kind === "root" ? "root" : `enhancement:${scope.peer}`;
 }
+function endpointMarkerOwnsStub(marker, stub) {
+  return stub != null && marker?.kind === "endpoint" && marker.owner === stub.owner;
+}
 function formatEndpointMarker(owner, scope) {
   return `// ${MODULE_STUB_MARKER} owner=${owner} scope=${scopeLabel(scope)}`;
 }
@@ -5528,7 +5534,7 @@ function planCompositionArtifacts(input) {
     const legacy = parseLegacyApiAdapter(pagePath, content);
     const plannedRoute = plannedRouteByPath.get(pagePath);
     const plannedEndpoint = plannedEndpointByPath.get(pagePath);
-    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (marker != null && marker.kind === "endpoint" && marker.owner === plannedEndpoint.owner && scopeLabel(marker.scope) === scopeLabel(plannedEndpoint.scope) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
+    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (endpointMarkerOwnsStub(marker, plannedEndpoint) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
     if (isExactPlannedMatch) {
       continue;
     }
@@ -5671,9 +5677,7 @@ function planCompositionArtifacts(input) {
     }
     if (marker.kind === "endpoint") {
       const stub = endpointStubByPath.get(path5);
-      const ownerMatches = stub != null && marker.owner === stub.owner;
-      const scopeMatches = stub != null && scopeLabel(marker.scope) === scopeLabel(stub.scope);
-      if (!ownerMatches || !scopeMatches) {
+      if (!endpointMarkerOwnsStub(marker, stub)) {
         return {
           ok: false,
           error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
@@ -6316,39 +6320,24 @@ async function assertNoRootRoutesWhenMountsEmpty(context, moduleName) {
     );
   }
 }
-async function assertNoEnhancementRoutes(context, moduleName) {
-  const enhancementsDir = `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements`;
-  const enhancementEntries = await listImmediateEntries(context.sandbox, enhancementsDir, {
-    optional: true,
-    label: `enhancements for ${moduleName}`
-  });
-  for (const entry of enhancementEntries) {
-    if (entry.kind !== "dir") continue;
-    const sliceRoutes = `${enhancementsDir}/${entry.name}/routes`;
-    const sliceProbe = await context.sandbox.exec(
-      [
-        `p=${shellQuote(sliceRoutes)}`,
-        `if test -L "$p" || test -e "$p"; then exit 2; else exit 0; fi`
-      ].join("\n"),
-      { raiseOnError: false }
-    );
-    if (sliceProbe.exitCode === 2) {
+async function assertNoEnhancementRoutePaths(context, paths) {
+  const kinds = await classifySandboxPathPresenceKindMany(context, paths, "enhancement-route-kind");
+  for (const sliceRoutes of paths) {
+    const kind = kinds.get(sliceRoutes);
+    if (kind === "absent") continue;
+    if (kind !== "unreadable" && kind !== void 0) {
       throw new Error(
         `[ModuleRail] composition artifacts: enhancement slice routes/ are forbidden at ${sliceRoutes}`
       );
     }
-    if (sliceProbe.exitCode !== 0) {
-      const detail = typeof sliceProbe.error === "string" && sliceProbe.error.trim() || sliceProbe.output.trim() || `exit ${sliceProbe.exitCode}`;
-      throw new Error(
-        `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: ${redactSecrets(detail)}`
-      );
-    }
+    throw new Error(
+      `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: entry-kind:${kind ?? "missing"}`
+    );
   }
 }
-async function discoverModuleRouteEntries(context, moduleName) {
+async function discoverRootRouteEntries(context, moduleName) {
   const modulePath = `${MODULES_SANDBOX_DIR}/${moduleName}`;
   const routesDir = `${modulePath}/routes`;
-  await assertNoEnhancementRoutes(context, moduleName);
   const quotedRoutes = shellQuote(routesDir);
   const listResult = await context.sandbox.exec(
     [
@@ -6802,7 +6791,8 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
         `# Leaf is missing. A missing intermediate parent means the path is simply`,
         `# absent (new nested writes). Only an existing-but-inaccessible parent`,
         `# is unreadable \u2014 never conflate ENOENT parents with EACCES.`,
-        `parent=$(dirname -- "$p")`,
+        // Probe paths are nested repo-relative paths; do not spawn dirname per missing file.
+        `parent=\${p%/*}`,
         `if test ! -e "$parent" && test ! -L "$parent"; then`,
         `  printf 'entry-kind:absent\\t%s\\n' "$p"`,
         `elif ls -ld -- "$parent" >/dev/null 2>&1; then`,
@@ -7347,14 +7337,21 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     manifestsByName
   );
   const routeEntriesByOwner = {};
+  await assertNoEnhancementRoutePaths(
+    context,
+    moduleRuntimeFacts.flatMap(
+      ({ moduleName, onDiskEnhancementDirs }) => onDiskEnhancementDirs.map(
+        (peer) => `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements/${peer}/routes`
+      )
+    )
+  );
   for (const moduleName of composedNames) {
     const manifest = manifestsByName[moduleName];
-    await assertNoEnhancementRoutes(context, moduleName);
     if (manifest.mounts.length === 0) {
       await assertNoRootRoutesWhenMountsEmpty(context, moduleName);
       routeEntriesByOwner[moduleName] = [];
     } else {
-      routeEntriesByOwner[moduleName] = await discoverModuleRouteEntries(context, moduleName);
+      routeEntriesByOwner[moduleName] = await discoverRootRouteEntries(context, moduleName);
     }
   }
   const existingGeneratedPaths = await listExistingGeneratedStubPaths(context);

package/dist/index.js

@@ -2097,6 +2097,7 @@ var JSON_SECRET_PAIR = new RegExp(
   "g"
 );
 var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
+var SHELL_QUOTE_CONTINUATION = String.raw`\''`;
 function redactSecrets(text) {
   return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
@@ -2388,10 +2389,12 @@ var modulePermissionClaimSchema = import_zod2.z.object({
   /** Human label for the deployment auth config row. */
   description: descriptionSchema,
   /**
-   * The default organization roles that hold this key when the platform
-   * first registers it on an app (a Blueprint fork, a Module install). Admin
-   * holds every key without being listed; External Viewer never holds one.
-   * Changing a role's grants afterwards is the organization's business.
+   * The standard organization roles that hold this key. The platform sets them on every app
+   * (a Blueprint fork, a Module install or uninstall, every Blueprint update), so this list is
+   * the truth: a role added here gains the key, a role removed loses it, and nobody can edit a
+   * standard role's grants on a Module key. Admin holds every key without being listed;
+   * External Viewer never holds one. An organization that wants different access duplicates the
+   * standard role and edits the copy.
    */
   roles: import_zod2.z.array(import_zod2.z.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
@@ -4837,6 +4840,9 @@ function enhancementImport(owner, peer) {
 function scopeLabel(scope) {
   return scope.kind === "root" ? "root" : `enhancement:${scope.peer}`;
 }
+function endpointMarkerOwnsStub(marker, stub) {
+  return stub != null && marker?.kind === "endpoint" && marker.owner === stub.owner;
+}
 function formatEndpointMarker(owner, scope) {
   return `// ${MODULE_STUB_MARKER} owner=${owner} scope=${scopeLabel(scope)}`;
 }
@@ -5538,7 +5544,7 @@ function planCompositionArtifacts(input) {
     const legacy = parseLegacyApiAdapter(pagePath, content);
     const plannedRoute = plannedRouteByPath.get(pagePath);
     const plannedEndpoint = plannedEndpointByPath.get(pagePath);
-    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (marker != null && marker.kind === "endpoint" && marker.owner === plannedEndpoint.owner && scopeLabel(marker.scope) === scopeLabel(plannedEndpoint.scope) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
+    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (endpointMarkerOwnsStub(marker, plannedEndpoint) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
     if (isExactPlannedMatch) {
       continue;
     }
@@ -5681,9 +5687,7 @@ function planCompositionArtifacts(input) {
     }
     if (marker.kind === "endpoint") {
       const stub = endpointStubByPath.get(path4);
-      const ownerMatches = stub != null && marker.owner === stub.owner;
-      const scopeMatches = stub != null && scopeLabel(marker.scope) === scopeLabel(stub.scope);
-      if (!ownerMatches || !scopeMatches) {
+      if (!endpointMarkerOwnsStub(marker, stub)) {
         return {
           ok: false,
           error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path4} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
@@ -6326,39 +6330,24 @@ async function assertNoRootRoutesWhenMountsEmpty(context, moduleName) {
     );
   }
 }
-async function assertNoEnhancementRoutes(context, moduleName) {
-  const enhancementsDir = `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements`;
-  const enhancementEntries = await listImmediateEntries(context.sandbox, enhancementsDir, {
-    optional: true,
-    label: `enhancements for ${moduleName}`
-  });
-  for (const entry of enhancementEntries) {
-    if (entry.kind !== "dir") continue;
-    const sliceRoutes = `${enhancementsDir}/${entry.name}/routes`;
-    const sliceProbe = await context.sandbox.exec(
-      [
-        `p=${shellQuote(sliceRoutes)}`,
-        `if test -L "$p" || test -e "$p"; then exit 2; else exit 0; fi`
-      ].join("\n"),
-      { raiseOnError: false }
-    );
-    if (sliceProbe.exitCode === 2) {
+async function assertNoEnhancementRoutePaths(context, paths) {
+  const kinds = await classifySandboxPathPresenceKindMany(context, paths, "enhancement-route-kind");
+  for (const sliceRoutes of paths) {
+    const kind = kinds.get(sliceRoutes);
+    if (kind === "absent") continue;
+    if (kind !== "unreadable" && kind !== void 0) {
       throw new Error(
         `[ModuleRail] composition artifacts: enhancement slice routes/ are forbidden at ${sliceRoutes}`
       );
     }
-    if (sliceProbe.exitCode !== 0) {
-      const detail = typeof sliceProbe.error === "string" && sliceProbe.error.trim() || sliceProbe.output.trim() || `exit ${sliceProbe.exitCode}`;
-      throw new Error(
-        `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: ${redactSecrets(detail)}`
-      );
-    }
+    throw new Error(
+      `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: entry-kind:${kind ?? "missing"}`
+    );
   }
 }
-async function discoverModuleRouteEntries(context, moduleName) {
+async function discoverRootRouteEntries(context, moduleName) {
   const modulePath = `${MODULES_SANDBOX_DIR}/${moduleName}`;
   const routesDir = `${modulePath}/routes`;
-  await assertNoEnhancementRoutes(context, moduleName);
   const quotedRoutes = shellQuote(routesDir);
   const listResult = await context.sandbox.exec(
     [
@@ -6812,7 +6801,8 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
         `# Leaf is missing. A missing intermediate parent means the path is simply`,
         `# absent (new nested writes). Only an existing-but-inaccessible parent`,
         `# is unreadable \u2014 never conflate ENOENT parents with EACCES.`,
-        `parent=$(dirname -- "$p")`,
+        // Probe paths are nested repo-relative paths; do not spawn dirname per missing file.
+        `parent=\${p%/*}`,
         `if test ! -e "$parent" && test ! -L "$parent"; then`,
         `  printf 'entry-kind:absent\\t%s\\n' "$p"`,
         `elif ls -ld -- "$parent" >/dev/null 2>&1; then`,
@@ -7357,14 +7347,21 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     manifestsByName
   );
   const routeEntriesByOwner = {};
+  await assertNoEnhancementRoutePaths(
+    context,
+    moduleRuntimeFacts.flatMap(
+      ({ moduleName, onDiskEnhancementDirs }) => onDiskEnhancementDirs.map(
+        (peer) => `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements/${peer}/routes`
+      )
+    )
+  );
   for (const moduleName of composedNames) {
     const manifest = manifestsByName[moduleName];
-    await assertNoEnhancementRoutes(context, moduleName);
     if (manifest.mounts.length === 0) {
       await assertNoRootRoutesWhenMountsEmpty(context, moduleName);
       routeEntriesByOwner[moduleName] = [];
     } else {
-      routeEntriesByOwner[moduleName] = await discoverModuleRouteEntries(context, moduleName);
+      routeEntriesByOwner[moduleName] = await discoverRootRouteEntries(context, moduleName);
     }
   }
   const existingGeneratedPaths = await listExistingGeneratedStubPaths(context);

package/dist/index.mjs

@@ -2078,6 +2078,7 @@ var JSON_SECRET_PAIR = new RegExp(
   "g"
 );
 var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
+var SHELL_QUOTE_CONTINUATION = String.raw`\''`;
 function redactSecrets(text) {
   return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
@@ -2369,10 +2370,12 @@ var modulePermissionClaimSchema = z2.object({
   /** Human label for the deployment auth config row. */
   description: descriptionSchema,
   /**
-   * The default organization roles that hold this key when the platform
-   * first registers it on an app (a Blueprint fork, a Module install). Admin
-   * holds every key without being listed; External Viewer never holds one.
-   * Changing a role's grants afterwards is the organization's business.
+   * The standard organization roles that hold this key. The platform sets them on every app
+   * (a Blueprint fork, a Module install or uninstall, every Blueprint update), so this list is
+   * the truth: a role added here gains the key, a role removed loses it, and nobody can edit a
+   * standard role's grants on a Module key. Admin holds every key without being listed;
+   * External Viewer never holds one. An organization that wants different access duplicates the
+   * standard role and edits the copy.
    */
   roles: z2.array(z2.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
@@ -4818,6 +4821,9 @@ function enhancementImport(owner, peer) {
 function scopeLabel(scope) {
   return scope.kind === "root" ? "root" : `enhancement:${scope.peer}`;
 }
+function endpointMarkerOwnsStub(marker, stub) {
+  return stub != null && marker?.kind === "endpoint" && marker.owner === stub.owner;
+}
 function formatEndpointMarker(owner, scope) {
   return `// ${MODULE_STUB_MARKER} owner=${owner} scope=${scopeLabel(scope)}`;
 }
@@ -5519,7 +5525,7 @@ function planCompositionArtifacts(input) {
     const legacy = parseLegacyApiAdapter(pagePath, content);
     const plannedRoute = plannedRouteByPath.get(pagePath);
     const plannedEndpoint = plannedEndpointByPath.get(pagePath);
-    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (marker != null && marker.kind === "endpoint" && marker.owner === plannedEndpoint.owner && scopeLabel(marker.scope) === scopeLabel(plannedEndpoint.scope) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
+    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (endpointMarkerOwnsStub(marker, plannedEndpoint) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
     if (isExactPlannedMatch) {
       continue;
     }
@@ -5662,9 +5668,7 @@ function planCompositionArtifacts(input) {
     }
     if (marker.kind === "endpoint") {
       const stub = endpointStubByPath.get(path4);
-      const ownerMatches = stub != null && marker.owner === stub.owner;
-      const scopeMatches = stub != null && scopeLabel(marker.scope) === scopeLabel(stub.scope);
-      if (!ownerMatches || !scopeMatches) {
+      if (!endpointMarkerOwnsStub(marker, stub)) {
         return {
           ok: false,
           error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path4} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
@@ -6307,39 +6311,24 @@ async function assertNoRootRoutesWhenMountsEmpty(context, moduleName) {
     );
   }
 }
-async function assertNoEnhancementRoutes(context, moduleName) {
-  const enhancementsDir = `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements`;
-  const enhancementEntries = await listImmediateEntries(context.sandbox, enhancementsDir, {
-    optional: true,
-    label: `enhancements for ${moduleName}`
-  });
-  for (const entry of enhancementEntries) {
-    if (entry.kind !== "dir") continue;
-    const sliceRoutes = `${enhancementsDir}/${entry.name}/routes`;
-    const sliceProbe = await context.sandbox.exec(
-      [
-        `p=${shellQuote(sliceRoutes)}`,
-        `if test -L "$p" || test -e "$p"; then exit 2; else exit 0; fi`
-      ].join("\n"),
-      { raiseOnError: false }
-    );
-    if (sliceProbe.exitCode === 2) {
+async function assertNoEnhancementRoutePaths(context, paths) {
+  const kinds = await classifySandboxPathPresenceKindMany(context, paths, "enhancement-route-kind");
+  for (const sliceRoutes of paths) {
+    const kind = kinds.get(sliceRoutes);
+    if (kind === "absent") continue;
+    if (kind !== "unreadable" && kind !== void 0) {
       throw new Error(
         `[ModuleRail] composition artifacts: enhancement slice routes/ are forbidden at ${sliceRoutes}`
       );
     }
-    if (sliceProbe.exitCode !== 0) {
-      const detail = typeof sliceProbe.error === "string" && sliceProbe.error.trim() || sliceProbe.output.trim() || `exit ${sliceProbe.exitCode}`;
-      throw new Error(
-        `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: ${redactSecrets(detail)}`
-      );
-    }
+    throw new Error(
+      `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: entry-kind:${kind ?? "missing"}`
+    );
   }
 }
-async function discoverModuleRouteEntries(context, moduleName) {
+async function discoverRootRouteEntries(context, moduleName) {
   const modulePath = `${MODULES_SANDBOX_DIR}/${moduleName}`;
   const routesDir = `${modulePath}/routes`;
-  await assertNoEnhancementRoutes(context, moduleName);
   const quotedRoutes = shellQuote(routesDir);
   const listResult = await context.sandbox.exec(
     [
@@ -6793,7 +6782,8 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
         `# Leaf is missing. A missing intermediate parent means the path is simply`,
         `# absent (new nested writes). Only an existing-but-inaccessible parent`,
         `# is unreadable \u2014 never conflate ENOENT parents with EACCES.`,
-        `parent=$(dirname -- "$p")`,
+        // Probe paths are nested repo-relative paths; do not spawn dirname per missing file.
+        `parent=\${p%/*}`,
         `if test ! -e "$parent" && test ! -L "$parent"; then`,
         `  printf 'entry-kind:absent\\t%s\\n' "$p"`,
         `elif ls -ld -- "$parent" >/dev/null 2>&1; then`,
@@ -7338,14 +7328,21 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     manifestsByName
   );
   const routeEntriesByOwner = {};
+  await assertNoEnhancementRoutePaths(
+    context,
+    moduleRuntimeFacts.flatMap(
+      ({ moduleName, onDiskEnhancementDirs }) => onDiskEnhancementDirs.map(
+        (peer) => `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements/${peer}/routes`
+      )
+    )
+  );
   for (const moduleName of composedNames) {
     const manifest = manifestsByName[moduleName];
-    await assertNoEnhancementRoutes(context, moduleName);
     if (manifest.mounts.length === 0) {
       await assertNoRootRoutesWhenMountsEmpty(context, moduleName);
       routeEntriesByOwner[moduleName] = [];
     } else {
-      routeEntriesByOwner[moduleName] = await discoverModuleRouteEntries(context, moduleName);
+      routeEntriesByOwner[moduleName] = await discoverRootRouteEntries(context, moduleName);
     }
   }
   const existingGeneratedPaths = await listExistingGeneratedStubPaths(context);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/compose",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Regenerates a Stardeck app's Module-rail artifacts — the six src/*.gen.ts registries and every route/endpoint stub — from src/modules/*/module.json",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -34,7 +34,7 @@
     "build": "rm -rf dist && tsup",
     "dev": "tsup --watch",
     "format": "prettier --write . && oxlint . --fix",
-    "typecheck": "tsgo -p tsconfig.test.json",
+    "typecheck": "node ../../scripts/typecheck.mjs -p tsconfig.test.json",
     "lint": "oxlint src/",
     "test": "vitest run",
     "test:watch": "vitest"