@theholocron/cli 5.0.0-alpha.166 → 5.0.0-alpha.168

package/dist/cli.mjs

@@ -5217,6 +5217,50 @@ const STALE_LABELS = [
 //#region src/templates/dco.yml
 var dco_default = "allowRemediationCommits:\n  individual: true\n";
 //#endregion
+//#region src/commands/workflow-source-marker/workflow-source-marker.ts
+/** `# Source package: <path>` line at the head of a generated thin-caller workflow — see {@link resolvePkgRelPath}. */
+const SOURCE_PACKAGE_MARKER = /^# Source package: (.+)$/m;
+/** Strip control characters (including ANSI escapes) before a value reaches a printed error message. */
+function sanitizeForDisplay(value) {
+	return value.replace(/[\x00-\x1f\x7f]/g, "");
+}
+/**
+* Repo-root-relative path of the PACKAGE a workflow-writing command run is
+* scoped to — the directory holding the discovered `holocron.config.*`
+* (`configFilepath`), not necessarily `--cwd` itself. `loadConfig()` walks
+* up to find the config from any subdirectory ("every command is usable
+* from any subdirectory of a repo, not only its exact root"), so a `--cwd`
+* one level too deep would otherwise stamp a different marker than a later
+* run from the package's own root and misfire the collision check this
+* feeds (holocron#1026).
+*
+* "." for a root invocation, "apps/sentinel" for a subpackage. Normalized
+* to forward slashes so the same package produces the same marker on
+* Windows and POSIX. Throws if the result contains a line break — a path
+* containing one could otherwise break out of the `# Source package: `
+* comment line and inject arbitrary workflow YAML when the generated
+* content is later written. Not reachable through this CLI's own flows
+* (no code path writes a config file whose directory name contains a line
+* break), but cheap to reject outright rather than trust the filesystem.
+*/
+function resolvePkgRelPath(gitRoot, configFilepath) {
+	let root;
+	try {
+		root = realpathSync(gitRoot);
+	} catch {
+		root = gitRoot;
+	}
+	let configDir;
+	try {
+		configDir = realpathSync(dirname(configFilepath));
+	} catch {
+		configDir = dirname(configFilepath);
+	}
+	const pkgRelPath = (relative(root, configDir) || ".").split(sep).join("/");
+	if (/[\r\n]/.test(pkgRelPath)) throw new Error(`refusing to use a package path containing a line break: ${JSON.stringify(pkgRelPath)}`);
+	return pkgRelPath;
+}
+//#endregion
 //#region src/commands/setup/agent-prompts-data.ts
 /**
 * Canonical AI engineering workflow role prompts.
@@ -5877,14 +5921,35 @@ async function installSkills({ agent, skills, repoRoot }) {
 	try {
 		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
 	} catch {
-		if (spawnSync("pnpm", [
+		const atWorkspaceRoot = await isWorkspaceRoot(repoRoot);
+		let result = spawnSync("pnpm", [
 			"add",
 			"-D",
+			...atWorkspaceRoot ? ["-w"] : [],
 			"@theholocron/skills"
 		], {
 			cwd: repoRoot,
-			stdio: "inherit"
-		}).status !== 0) throw new Error("failed to auto-install @theholocron/skills");
+			stdio: [
+				"inherit",
+				"inherit",
+				"pipe"
+			],
+			encoding: "utf8"
+		});
+		if (result.status !== 0 && !atWorkspaceRoot && result.stderr?.includes("ERR_PNPM_ADDING_TO_ROOT")) {
+			process.stderr.write(result.stderr);
+			result = spawnSync("pnpm", [
+				"add",
+				"-D",
+				"-w",
+				"@theholocron/skills"
+			], {
+				cwd: repoRoot,
+				stdio: "inherit",
+				encoding: "utf8"
+			});
+		} else if (result.status !== 0 && result.stderr) process.stderr.write(result.stderr);
+		if (result.status !== 0) throw new Error("failed to auto-install @theholocron/skills");
 		try {
 			skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
 		} catch {
@@ -6040,6 +6105,10 @@ async function runSetup(input) {
 	const steps = [];
 	const repo = config.repo;
 	const effectivePreset = repo?.protection;
+	const setupPkgRelPath = resolvePkgRelPath(findRootSync(input.context.repoRoot, ".git", {
+		fallback: "start",
+		realpath: true
+	}), input.loaded.filepath);
 	const hooksEnabled = input.hooks ?? (typeof config.hooks === "boolean" ? config.hooks : typeof config.hooks === "object" ? config.hooks.prePush !== false : effectivePreset === "strict");
 	print(style.header(`Holocron setup — ${config.name}${dryRun ? " (dry-run)" : ""}`));
 	print(style.dim(`  config: ${input.loaded.filepath}`));
@@ -6119,7 +6188,7 @@ async function runSetup(input) {
 			if (content === void 0) continue;
 			const step = content.includes("workflows/preview.yml@main") ? `write workflow ${name} (with preview)` : `write workflow ${name}`;
 			steps.push(await runStep("source", step, dryRun, async () => {
-				await source.writeWorkflowFile(filename, `${thinCallerHeader()}${content}`);
+				await source.writeWorkflowFile(filename, `${thinCallerHeader()}# Source package: ${setupPkgRelPath}\n\n${content}`);
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -7222,6 +7291,7 @@ async function runSync(input) {
 	} catch {
 		resolvedRepoRoot = input.context.repoRoot;
 	}
+	const pkgRelPath = resolvePkgRelPath(gitRoot, input.loaded.filepath);
 	logger.info({
 		config: config.name,
 		steps: requestedSteps ?? "all",
@@ -7499,7 +7569,8 @@ async function runSync(input) {
 					if (content === void 0) continue;
 					const step = `sync workflow ${name}${content.includes("workflows/preview.yml@main") ? " (with preview)" : ""}`;
 					steps.push(await runSyncStep("local", step, dryRun, async () => {
-						await writeWorkflowFile(gitRoot, filename, `${workflowHeader()}${content}`);
+						await assertNoPackageCollision(gitRoot, filename, name, pkgRelPath);
+						await writeWorkflowFile(gitRoot, filename, `${workflowHeader()}# Source package: ${pkgRelPath}\n\n${content}`);
 					}));
 					print(formatSyncStep(steps[steps.length - 1]));
 				}
@@ -7762,6 +7833,32 @@ async function writeWorkflowFile(repoRoot, filename, content) {
 	await writeFile(tmpPath, content, "utf8");
 	await rename(tmpPath, join(dir, filename));
 }
+/**
+* Two different monorepo packages opting into the same generic task name
+* (e.g. both `apps/sentinel` and some future `apps/other` configuring
+* `delivery.previewDeploy`) would otherwise overwrite each other's
+* `.github/workflows/<task>.yml` on whichever package's `holocron repo sync`
+* ran last — only one package's behavior would ever actually run in CI,
+* with no signal that the other's was silently dropped (holocron#1026).
+*
+* A file with no marker at all predates this check (or was written before
+* #1026) and is never flagged — only a marker that's present AND disagrees
+* with the current run's own package is a real collision. Any read error
+* other than "file doesn't exist" propagates rather than being treated as
+* "nothing to collide with" — the file may genuinely be unreadable, not
+* missing.
+*/
+async function assertNoPackageCollision(repoRoot, filename, taskName, pkgRelPath) {
+	let existing;
+	try {
+		existing = await readFile(join(repoRoot, ".github", "workflows", filename), "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return;
+		throw err;
+	}
+	const previousPkg = SOURCE_PACKAGE_MARKER.exec(existing)?.[1];
+	if (previousPkg !== void 0 && previousPkg !== pkgRelPath) throw new Error(`task "${taskName}" would overwrite .github/workflows/${filename}, already generated for package "${sanitizeForDisplay(previousPkg)}" — the same task name can't be used by two different packages (holocron#1026). If "${sanitizeForDisplay(previousPkg)}" moved or was renamed to this path, delete .github/workflows/${filename} first and re-run sync; otherwise rename one or give it a different thin-caller filename.`);
+}
 //#endregion
 //#region src/observability/resolve-telemetry/resolve-telemetry.ts
 /**