@stigmer/cli 3.18.0-dev.20260918103812 → 3.18.0

package/src/local/seedpack/apply.ts

@@ -1,199 +0,0 @@
-// In-process seedpack apply.
-//
-// The TS equivalent of Go's seedpackbootstrap.Apply, with one deliberate
-// improvement: instead of shelling out to `stigmer apply` as a subprocess, this
-// drives the same in-process declarative-apply path that `stigmer apply` uses —
-// one code path, no recursion guard, no second process.
-//
-// Two phases respect the resource hierarchy (mirrors the Go bootstrap):
-//   1. organizations/ via file mode — the org must exist before its members.
-//   2. the project (stigmer.yaml + agents/skills/mcp-servers/workflows) via the
-//      declarative reconciler, under the target org.
-//
-// Idempotent, with the applied-hash truth living with the backend it describes
-// (cloud#429): every apply stamps the content hash as a reserved label on the
-// seedpack Project, and cloud-mode runs skip by reading that label back — so
-// any machine (operator laptop, CI) sees the same applied state. Local mode
-// keeps the original marker file (the local data dir lives and dies with the
-// local backend, so a local file IS backend-scoped state there).
-
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { create } from "@bufbuild/protobuf";
-import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
-import type { Stigmer } from "@stigmer/sdk";
-import { applyItem, resolveApplyItems } from "../../resources/apply/apply.js";
-import { applyDeclarative, detectTrack } from "../../resources/apply/declarative.js";
-import type { ControllerFn } from "../../resources/apply/handlers.js";
-import {
-  extractSeedpack,
-  hashSeedpackContent,
-  readMarker,
-  resolveSeedpackContent,
-  type SeedpackContent,
-  writeMarker,
-} from "./content.js";
-
-const DEFAULT_ORG = "stigmer";
-const ORG_ENV_VAR = "STIGMER_SEEDPACK_ORG";
-
-/**
- * Reserved label on the seedpack Project recording the last applied content
- * hash (cloud#429). Writing a NEW value requires `can_write_reserved_labels`
- * (the seeding identity's capability); re-sending an unchanged value is an
- * echo the cloud guard passes for any caller — so re-applies of identical
- * content are never treated as reserved-label writes.
- */
-export const SEEDPACK_HASH_LABEL = "stigmer.ai/seedpack-hash";
-
-/**
- * The seedpack Project's slug. The server derives it from the manifest's
- * `metadata.name` in `seedpack/stigmer.yaml` — "stigmer-seedpack" is already
- * slug-shaped, so name and slug coincide. Pinned by a test against the real
- * content so a rename there fails loudly here.
- */
-export const SEEDPACK_PROJECT_SLUG = "stigmer-seedpack";
-
-export interface SeedpackApplyDeps {
-  /** Raw command-controller accessor (full-proto apply, preserves metadata.id). */
-  readonly controller: ControllerFn;
-  /** High-level client for skill push + post-apply MCP discovery. */
-  readonly stigmer: Stigmer;
-  /** Human progress lines (stderr). */
-  readonly info: (line: string) => void;
-  /** Warnings (stderr). */
-  readonly warn: (line: string) => void;
-}
-
-export interface SeedpackApplyOptions {
-  /** Directory holding the idempotency marker (local mode only). */
-  readonly markerDir: string;
-  /** Target org slug. Defaults to STIGMER_SEEDPACK_ORG, then "stigmer". */
-  readonly org?: string;
-  /** Re-apply even when the content hash is unchanged. */
-  readonly force?: boolean;
-  /** Pre-resolved content (injectable for tests); resolved on demand otherwise. */
-  readonly content?: SeedpackContent;
-  readonly home?: string;
-  /**
-   * Cloud mode: the idempotency truth is the {@link SEEDPACK_HASH_LABEL} on the
-   * server's seedpack Project, read via {@link readServerSeedpackHash} — the
-   * local marker is neither read nor written, so a stateless machine (CI, a
-   * second operator laptop) still skips unchanged content correctly.
-   */
-  readonly useServerHash?: boolean;
-}
-
-export interface SeedpackApplyResult {
-  /** True when the seedpack was applied; false when skipped as up to date. */
-  readonly applied: boolean;
-  /** The current content hash (stored in the marker on a successful apply). */
-  readonly hash: string;
-  /** The resolved target org. */
-  readonly org: string;
-}
-
-/** Resolve the target org: explicit option > env var > "stigmer". */
-export function resolveSeedpackOrg(explicit?: string): string {
-  if (explicit !== undefined && explicit !== "") return explicit;
-  const env = process.env[ORG_ENV_VAR];
-  if (env !== undefined && env !== "") return env;
-  return DEFAULT_ORG;
-}
-
-/** Compute the current seedpack content hash without applying (drives `status`). */
-export function seedpackContentHash(opts: Pick<SeedpackApplyOptions, "content" | "home"> = {}): string {
-  const content = opts.content ?? resolveSeedpackContent({ home: opts.home });
-  return hashSeedpackContent(content.dir);
-}
-
-/**
- * Read the applied content hash recorded on the backend's seedpack Project,
- * or null when it cannot be proven (project absent — never applied — or the
- * read failed). Null means "apply": the apply itself is idempotent server-side,
- * so an unprovable state costs one redundant pass, never a skipped update.
- */
-export async function readServerSeedpackHash(stigmer: Stigmer, org: string): Promise<string | null> {
-  try {
-    const project = await stigmer.project.getByReference({ org, slug: SEEDPACK_PROJECT_SLUG });
-    return project.metadata?.labels?.[SEEDPACK_HASH_LABEL] ?? null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Apply the seedpack to the backend the deps connect to. Returns `applied:false`
- * (without touching the backend beyond the cloud-mode hash read) when the
- * recorded hash already matches the content hash and `force` is not set.
- */
-export async function applySeedpack(deps: SeedpackApplyDeps, opts: SeedpackApplyOptions): Promise<SeedpackApplyResult> {
-  const org = resolveSeedpackOrg(opts.org);
-  const content = opts.content ?? resolveSeedpackContent({ home: opts.home });
-  const hash = hashSeedpackContent(content.dir);
-
-  const appliedHash = opts.useServerHash === true
-    ? await readServerSeedpackHash(deps.stigmer, org)
-    : readMarker(opts.markerDir);
-  if (opts.force !== true && appliedHash === hash) {
-    return { applied: false, hash, org };
-  }
-
-  deps.info("Applying system resources (seedpack)…");
-  const stage = mkdtempSync(join(tmpdir(), "stigmer-seedpack-"));
-  try {
-    extractSeedpack(content.dir, stage);
-    await applyOrganizations(deps, stage);
-    await applyProject(deps, stage, org, hash);
-    // The Project label written above is the cloud-mode record; the marker
-    // stays the local-mode one. Never both — two records of one fact drift.
-    if (opts.useServerHash !== true) {
-      writeMarker(opts.markerDir, hash);
-    }
-  } finally {
-    rmSync(stage, { recursive: true, force: true });
-  }
-
-  deps.info("System resources applied successfully");
-  return { applied: true, hash, org };
-}
-
-// Phase 1: organizations via file mode. Organizations sit above the project and
-// carry no org context themselves, so they apply with an empty org.
-async function applyOrganizations(deps: SeedpackApplyDeps, stageDir: string): Promise<void> {
-  const orgDir = join(stageDir, "organizations");
-  let items: ReturnType<typeof resolveApplyItems>;
-  try {
-    items = resolveApplyItems(orgDir);
-  } catch {
-    return; // No organizations to apply.
-  }
-  for (const item of items) {
-    const outcome = await applyItem(deps.controller, item, "", false);
-    if (outcome.warning !== undefined) deps.warn(outcome.warning);
-  }
-}
-
-// Phase 2: the project (agents, skills, MCP servers, workflows) via the shared
-// declarative reconciler — the same path `stigmer apply` runs for a user project.
-//
-// The content hash is stamped as a reserved label on the Project HERE, in the
-// seedpack path only — general `stigmer apply` never writes reserved labels.
-// The stamp rides the project apply that happens anyway, so recording the hash
-// costs no extra RPC and can never succeed while the apply failed.
-async function applyProject(deps: SeedpackApplyDeps, stageDir: string, org: string, contentHash: string): Promise<void> {
-  const detect = detectTrack(stageDir);
-  if (detect.track !== "declarative" || detect.project === undefined) {
-    throw new Error(`seedpack is not a declarative project (detected '${detect.track}')`);
-  }
-  detect.project.metadata ??= create(ApiResourceMetadataSchema, {});
-  detect.project.metadata.labels[SEEDPACK_HASH_LABEL] = contentHash;
-  await applyDeclarative(detect, {
-    controller: deps.controller,
-    stigmer: deps.stigmer,
-    org,
-    info: deps.info,
-    warn: deps.warn,
-  });
-}

package/src/local/seedpack/content.test.ts

@@ -1,169 +0,0 @@
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { classify, ExitCode } from "../../errors/index.js";
-import {
-  acquireSeedpack,
-  extractSeedpack,
-  hashSeedpackContent,
-  listContentFiles,
-  readMarker,
-  resolveSeedpackContent,
-  SEEDPACK_ENTRIES,
-  writeMarker,
-} from "./content.js";
-
-// Build a minimal seedpack content tree with one non-canonical sibling (tools/)
-// to prove the canonical-entry filtering.
-function makeFixture(): string {
-  const dir = mkdtempSync(join(tmpdir(), "seedpack-content-"));
-  writeFileSync(join(dir, "stigmer.yaml"), "kind: Project\n");
-  mkdirSync(join(dir, "organizations"), { recursive: true });
-  writeFileSync(join(dir, "organizations", "stigmer.yaml"), "kind: Organization\n");
-  mkdirSync(join(dir, "skills", "demo"), { recursive: true });
-  writeFileSync(join(dir, "skills", "demo", "SKILL.md"), "---\nname: demo\n---\n");
-  mkdirSync(join(dir, "agents"), { recursive: true });
-  writeFileSync(join(dir, "agents", "a.yaml"), "kind: Agent\n");
-  // Non-canonical siblings that must never be hashed/extracted.
-  mkdirSync(join(dir, "tools"), { recursive: true });
-  writeFileSync(join(dir, "tools", "gen.sh"), "echo hi\n");
-  mkdirSync(join(dir, "icons"), { recursive: true });
-  writeFileSync(join(dir, "icons", "logo.svg"), "<svg/>\n");
-  return dir;
-}
-
-let fixture: string;
-beforeEach(() => {
-  fixture = makeFixture();
-});
-afterEach(() => {
-  rmSync(fixture, { recursive: true, force: true });
-});
-
-describe("listContentFiles", () => {
-  it("lists only canonical entries, lexically sorted", () => {
-    const files = listContentFiles(fixture);
-    expect(files).toEqual([
-      "agents/a.yaml",
-      "organizations/stigmer.yaml",
-      "skills/demo/SKILL.md",
-      "stigmer.yaml",
-    ]);
-    expect(files.some((f) => f.startsWith("tools/") || f.startsWith("icons/"))).toBe(false);
-  });
-});
-
-describe("hashSeedpackContent", () => {
-  it("is deterministic and sha256-prefixed", () => {
-    expect(hashSeedpackContent(fixture)).toBe(hashSeedpackContent(fixture));
-    expect(hashSeedpackContent(fixture)).toMatch(/^sha256:[0-9a-f]{16}$/);
-  });
-
-  it("changes when content changes but ignores non-canonical files", () => {
-    const before = hashSeedpackContent(fixture);
-    writeFileSync(join(fixture, "tools", "extra.sh"), "noise\n");
-    expect(hashSeedpackContent(fixture)).toBe(before);
-    writeFileSync(join(fixture, "agents", "b.yaml"), "kind: Agent\n");
-    expect(hashSeedpackContent(fixture)).not.toBe(before);
-  });
-});
-
-describe("extractSeedpack", () => {
-  it("copies only canonical entries and hashes identically to the source", () => {
-    const dest = mkdtempSync(join(tmpdir(), "seedpack-extract-"));
-    try {
-      extractSeedpack(fixture, dest);
-      for (const entry of readdirSync(dest)) {
-        expect(SEEDPACK_ENTRIES).toContain(entry as (typeof SEEDPACK_ENTRIES)[number]);
-      }
-      expect(existsSync(join(dest, "tools"))).toBe(false);
-      expect(hashSeedpackContent(dest)).toBe(hashSeedpackContent(fixture));
-    } finally {
-      rmSync(dest, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("marker", () => {
-  it("round-trips and returns null when absent", () => {
-    const dir = mkdtempSync(join(tmpdir(), "seedpack-marker-"));
-    try {
-      expect(readMarker(dir)).toBeNull();
-      writeMarker(dir, "sha256:abc123");
-      expect(readMarker(dir)).toBe("sha256:abc123");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("resolveSeedpackContent", () => {
-  it("uses the repo seedpack tree in dev", () => {
-    const content = resolveSeedpackContent();
-    expect(content.source).toBe("repo");
-    expect(existsSync(join(content.dir, "stigmer.yaml"))).toBe(true);
-  });
-
-  it("excludes the non-resource canary manifest from the content set", () => {
-    // The CI canary manifest has no `kind`; if it were staged it would break the
-    // declarative-apply bootstrap. It lives in canary/ (outside SEEDPACK_ENTRIES).
-    const files = listContentFiles(resolveSeedpackContent().dir);
-    expect(files.some((f) => f.startsWith("canary/"))).toBe(false);
-    expect(files.some((f) => f.endsWith("credential-manifest.yaml"))).toBe(false);
-  });
-});
-
-describe("acquireSeedpack", () => {
-  it("refuses a non-release (dev) build", () => {
-    const err = (() => {
-      try {
-        acquireSeedpack({ home: fixture, version: "0.0.0-dev" });
-      } catch (e) {
-        return e;
-      }
-    })();
-    expect(classify(err)?.exitCode).toBe(ExitCode.General);
-  });
-
-  // Presence beats acquirability (the server acquirer's rule; the all-in-one
-  // image bakes dev-stamped content npm never published).
-  it("uses already-installed content even for a non-release (dev) build", () => {
-    const home = mkdtempSync(join(tmpdir(), "seedpack-home-"));
-    const pkgDir = join(home, ".stigmer", "runtimes", "0.0.0-dev.abc123", "node_modules", "@stigmer", "seedpack");
-    mkdirSync(pkgDir, { recursive: true });
-    writeFileSync(join(pkgDir, "stigmer.yaml"), "kind: Organization\n");
-
-    let installs = 0;
-    const dir = acquireSeedpack({
-      home,
-      version: "0.0.0-dev.abc123",
-      install: () => {
-        installs += 1;
-      },
-    });
-
-    expect(dir).toBe(pkgDir);
-    expect(installs).toBe(0);
-  });
-
-  it("installs on demand and is idempotent on the second call", () => {
-    const home = mkdtempSync(join(tmpdir(), "seedpack-home-"));
-    let installs = 0;
-    const install = (installDir: string) => {
-      installs += 1;
-      const pkgDir = join(installDir, "node_modules", "@stigmer", "seedpack");
-      mkdirSync(pkgDir, { recursive: true });
-      writeFileSync(join(pkgDir, "stigmer.yaml"), "kind: Project\n");
-    };
-    try {
-      const dir1 = acquireSeedpack({ home, version: "1.2.3", install });
-      const dir2 = acquireSeedpack({ home, version: "1.2.3", install });
-      expect(dir1).toBe(dir2);
-      expect(existsSync(join(dir1, "stigmer.yaml"))).toBe(true);
-      expect(installs).toBe(1);
-    } finally {
-      rmSync(home, { recursive: true, force: true });
-    }
-  });
-});

package/src/local/seedpack/content.ts

@@ -1,222 +0,0 @@
-// Resolution and on-demand acquisition of the seedpack content.
-//
-// The seedpack (system agents, skills, MCP servers, workflows under the
-// "stigmer" org) is the system content every backend is bootstrapped with.
-// A lean `npx @stigmer/cli` must not carry ~300 content files (DD-002), so the
-// content ships as `@stigmer/seedpack` and is acquired on demand — the same
-// pattern as `@stigmer/runner-slim` and the managed Temporal binary.
-//
-// Two sources, tried in order (mirrors runtime/runner.ts):
-//   1. A repo-tree checkout (dev): `<repo>/seedpack`.
-//   2. The published `@stigmer/seedpack@<cli-version>`, installed on demand into
-//      ~/.stigmer/runtimes/<version>/ and read from
-//      node_modules/@stigmer/seedpack.
-//
-// The content-hash and extract logic mirror `@stigmer/seedpack` exactly; the CLI
-// reimplements them over a resolved directory so it stays decoupled from the
-// package in the lean install (where the package is not a dependency, only an
-// on-demand artifact). `seedpack/src/index.ts` is the one definition both follow.
-
-import { createHash } from "node:crypto";
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, posix, relative, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-import { CliExitError } from "../../errors/cli-exit-error.js";
-import { ExitCode } from "../../errors/exit-codes.js";
-import { log } from "../../logger.js";
-import { VERSION } from "../../version.js";
-import { runtimesDir } from "../paths.js";
-import {
-  ensureRuntimesRoot,
-  isAcquirableRelease,
-  npmInstallIntoRuntimes,
-  type NpmInstall,
-} from "../runtime/runtimes-install.js";
-
-const SEEDPACK_PACKAGE = "@stigmer/seedpack";
-
-/**
- * The canonical seedpack entries, in apply-safe order. Kept in sync with
- * `SEEDPACK_ENTRIES` in `@stigmer/seedpack` (`seedpack/src/index.ts`, the one
- * definition) — `tools/`, `icons/`, and `canary/` (CI canary metadata, not a
- * resource) are deliberately excluded so the content set (and thus the
- * idempotency hash) is identical across delivery paths.
- */
-export const SEEDPACK_ENTRIES = [
-  "stigmer.yaml",
-  "organizations",
-  "skills",
-  "agents",
-  "workflows",
-  "mcp-servers",
-] as const;
-
-/** Marker file recording the last successfully-applied content hash. */
-export const MARKER_FILE = ".seedpack-bootstrapped";
-
-export interface SeedpackContent {
-  /** Absolute path to the content root (holds stigmer.yaml). */
-  readonly dir: string;
-  /** Where the content came from — surfaced in diagnostics. */
-  readonly source: "repo" | "package";
-}
-
-export interface ResolveSeedpackOptions {
-  home?: string;
-  /** Release version of @stigmer/seedpack to acquire (defaults to the CLI version). */
-  version?: string;
-  /** npm install implementation (injectable for tests). */
-  install?: NpmInstall;
-}
-
-/**
- * Resolve the seedpack content directory: a repo-tree checkout in dev, else the
- * on-demand-acquired `@stigmer/seedpack` package. Throws actionable guidance when
- * acquisition is not possible (non-release build, or a failed/incomplete install).
- */
-export function resolveSeedpackContent(
-  opts: ResolveSeedpackOptions = {},
-): SeedpackContent {
-  const repo = repoSeedpackDir();
-  if (repo !== null) return { dir: repo, source: "repo" };
-  return { dir: acquireSeedpack(opts), source: "package" };
-}
-
-/**
- * Acquire the published `@stigmer/seedpack@<version>` into
- * ~/.stigmer/runtimes/<version>/ (idempotent) and return its package directory.
- * The version is pinned to the CLI's own version so system content stays in
- * lockstep with the control plane it bootstraps.
- *
- * Presence beats acquirability (the server acquirer's rule, stated in
- * runtime/server.ts): installed content is used whatever its version string;
- * only an install we would have to perform is refused for a non-release build.
- */
-export function acquireSeedpack(opts: ResolveSeedpackOptions = {}): string {
-  const home = opts.home ?? homedir();
-  const version = opts.version ?? VERSION;
-
-  const installDir = join(runtimesDir(home), version);
-  const pkgDir = join(installDir, "node_modules", "@stigmer", "seedpack");
-  const marker = join(pkgDir, "stigmer.yaml");
-
-  if (!existsSync(marker)) {
-    if (!isAcquirableRelease(version)) {
-      throw new CliExitError(
-        `cannot acquire ${SEEDPACK_PACKAGE} for a non-release build (${version})`,
-        ExitCode.General,
-        [
-          "Run from the repo (the seedpack/ tree is used directly in dev).",
-          "On-demand acquisition is only available for published releases.",
-        ],
-      );
-    }
-    log.info(`acquiring ${SEEDPACK_PACKAGE}`, { version, dir: installDir });
-    // The same per-version root the server and runner packages install into;
-    // npm install is additive and non-pruning, so the prefix is safely shared.
-    ensureRuntimesRoot(installDir);
-    const install = opts.install ?? npmInstallIntoRuntimes;
-    install(installDir, `${SEEDPACK_PACKAGE}@${version}`);
-  }
-
-  if (!existsSync(marker)) {
-    throw new CliExitError(
-      `${SEEDPACK_PACKAGE} install did not produce ${marker}`,
-      ExitCode.General,
-      [`Remove ${installDir} and retry.`],
-    );
-  }
-  return pkgDir;
-}
-
-/**
- * Deterministic SHA-256 over the canonical content, identical to
- * `@stigmer/seedpack`'s `contentHash` (and the Go algorithm): files walked in
- * lexical order, each contributing its forward-slash relative path, a NUL, and
- * its bytes. Used as the idempotency marker.
- */
-export function hashSeedpackContent(dir: string): string {
-  const hash = createHash("sha256");
-  for (const rel of listContentFiles(dir)) {
-    hash.update(rel);
-    hash.update(NUL);
-    hash.update(readFileSync(join(dir, rel)));
-  }
-  return `sha256:${hash.digest("hex").slice(0, 16)}`;
-}
-
-/**
- * Copy the canonical entries from `srcDir` into `destDir`, producing a clean
- * Stigmer project the declarative-apply path can process directly (never
- * carrying build tooling or assets that happen to sit beside the content).
- */
-export function extractSeedpack(srcDir: string, destDir: string): void {
-  mkdirSync(destDir, { recursive: true });
-  for (const entry of SEEDPACK_ENTRIES) {
-    const src = join(srcDir, entry);
-    if (!existsSync(src)) continue;
-    cpSync(src, join(destDir, entry), { recursive: true });
-  }
-}
-
-const NUL = Uint8Array.of(0);
-
-/** Lexically-sorted, forward-slash relative paths of every file under the canonical entries. */
-export function listContentFiles(root: string): string[] {
-  const files: string[] = [];
-  const walk = (abs: string): void => {
-    for (const dirent of readdirSync(abs, { withFileTypes: true })) {
-      const full = join(abs, dirent.name);
-      if (dirent.isDirectory()) walk(full);
-      else if (dirent.isFile()) files.push(toPosix(relative(root, full)));
-    }
-  };
-  for (const entry of SEEDPACK_ENTRIES) {
-    const abs = join(root, entry);
-    if (!existsSync(abs)) continue;
-    if (statSync(abs).isDirectory()) walk(abs);
-    else files.push(entry);
-  }
-  return files.sort();
-}
-
-/** The stored marker hash for `markerDir`, or null when never applied. */
-export function readMarker(markerDir: string): string | null {
-  try {
-    return readFileSync(join(markerDir, MARKER_FILE), "utf8").trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-/** Persist the applied content hash so a future run can skip unchanged content. */
-export function writeMarker(markerDir: string, hash: string): void {
-  mkdirSync(markerDir, { recursive: true });
-  writeFileSync(join(markerDir, MARKER_FILE), `${hash}\n`);
-}
-
-function toPosix(p: string): string {
-  return sep === posix.sep ? p : p.split(sep).join(posix.sep);
-}
-
-// Walk up from this module to a repo root containing seedpack/stigmer.yaml.
-function repoSeedpackDir(): string | null {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 10; i += 1) {
-    const candidate = join(dir, "seedpack");
-    if (existsSync(join(candidate, "stigmer.yaml"))) return candidate;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}