@tendrilapp/cli 0.1.26 → 0.1.27

package/dist/tendril.js

@@ -1028,6 +1028,14 @@ function planSet(setDir, component, symbols, opts = {}) {
     const { manifest: existing, raw } = readManifestFile(setDir);
     const wantsNewDefaults = opts.defaults !== void 0 && JSON.stringify(opts.defaults) !== JSON.stringify(existing.defaults ?? {});
     const anythingRecorded = existing.reps.some((r) => RECORD_TOOLS.some((t) => existsSync(path.join(setDir, r.slug, `${t}.json`))));
+    const scopeUpgraded = opts.variantScope === "component-set" && existing.variantScope !== "component-set";
+    if (opts.variantScope === "component-set") {
+      raw["variantScope"] = "component-set";
+      const variants = symbols.map((s) => s.name).filter((n) => n.includes("="));
+      if (variants.length > 0 && (scopeUpgraded || variants.length > (existing.latticeNames ?? []).length)) {
+        raw["latticeNames"] = variants;
+      }
+    }
     if (!wantsNewDefaults || anythingRecorded) {
       if (opts.sample !== true) {
         const known = new Set(existing.reps.map((r) => r.nodeId));
@@ -1049,6 +1057,10 @@ function planSet(setDir, component, symbols, opts = {}) {
           return { manifest: manifest2, plan: { reps: [], notRecorded: [] }, resumed: true, toppedUp: appended.map((a) => ({ slug: a.slug, nodeId: a.nodeId })) };
         }
       }
+      if (scopeUpgraded) {
+        const manifest2 = writeManifest(setDir, raw);
+        return { manifest: manifest2, plan: { reps: [], notRecorded: [] }, resumed: true };
+      }
       return { manifest: existing, plan: { reps: [], notRecorded: [] }, resumed: true };
     }
   }
@@ -1921,7 +1933,7 @@ function tendrilCommand(args) {
   return `${tendrilInvocation()} ${args}`;
 }
 function quoteArg(value) {
-  if (/["`$\\]/.test(value)) throw new Error(`refusing to emit a shell argument containing quote/backslash/backtick/$: ${value}`);
+  if (/["`$]/.test(value)) throw new Error(`refusing to emit a shell argument containing a double quote, backtick or $: ${value}`);
   return /[\s'*?[\]()&;|<>#~]/.test(value) ? `"${value}"` : value;
 }
 var NPX_INVOCATION, cached;
@@ -4314,6 +4326,19 @@ async function runSteps(page, spec, renderPose) {
             // a data-* or a name= is a place to park a string, which is
             // the dodge this check exists to catch.
             const PERCEIVED = ['placeholder', 'alt', 'aria-label', 'title', 'value'];
+            // 'value' counts ONLY where the platform RENDERS it as the
+            // control's text: text-entry inputs, textarea, and the
+            // input-typed buttons whose value IS their label. Nearly
+            // every element carries a value PROPERTY \u2014 a visible
+            // checkbox or <button> with value={sentinel} would satisfy
+            // an unrestricted check while no user ever perceives the
+            // string, which reopens the exact dodge this check exists
+            // to close (post-release review, 2026-08-14). password is
+            // excluded because its value renders as dots, not as the
+            // string. Fail-closed allowlist, not a blocklist.
+            const VALUE_RENDERS = ['text', 'search', 'email', 'url', 'tel', 'number', 'submit', 'reset', 'button'];
+            const valueRenders = (el) =>
+              el instanceof HTMLTextAreaElement || (el instanceof HTMLInputElement && VALUE_RENDERS.includes(el.type));
             const visible = (el) => {
               const r = el.getBoundingClientRect();
               const cs = getComputedStyle(el);
@@ -4326,7 +4351,8 @@ async function runSteps(page, spec, renderPose) {
               PERCEIVED.some((a) => {
                 // The LIVE value for form controls: React's defaultValue
                 // sets the property, and the attribute may never appear.
-                const v = a === 'value' && 'value' in el ? el.value : el.getAttribute(a);
+                if (a === 'value' && !valueRenders(el)) return false;
+                const v = a === 'value' ? el.value : el.getAttribute(a);
                 return typeof v === 'string' && v.includes(needle);
               }),
             );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",