@theholocron/cli 5.0.0-alpha.167 → 5.0.0-alpha.169

package/dist/cli.mjs

@@ -4,7 +4,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSyn
 import { homedir, hostname, tmpdir, userInfo } from "node:os";
 import path, { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { checkbox, confirm, input, select } from "@inquirer/prompts";
-import { KNOWN_WORKFLOWS, createAlexignore, createAlexrc, createAstromech, createCommitMsg, createDependabot, createDevmoji, createEditorconfig, createEditorconfigChecker, createHeader, createLabeler, createPreCommit, createPrePush, createPrepareCommitMsg, createYamlignore, createYamllint, deployOnRelease, extractPreviewConfig, readWorkspacePackages, reusableTemplates } from "@theholocron/astromech";
+import { KNOWN_WORKFLOWS, createAlexignore, createAlexrc, createAstromech, createCommitMsg, createDependabot, createDevmoji, createEditorconfig, createEditorconfigChecker, createHeader, createLabeler, createPreCommit, createPrePush, createPrepareCommitMsg, createYamlignore, createYamllint, defaultListDirs, defaultPaths, defaultReadJson, deployOnRelease, extractPreviewConfig, readWorkspacePackages, reusableTemplates, workspacePackages } from "@theholocron/astromech";
 import { loadTasksConfig } from "@theholocron/astromech/config";
 import { lintCommitMsgFile } from "@theholocron/astromech/lint";
 import { LOG_LEVELS, NoopAnalyticsSink, NoopErrorSink, redactObject } from "@theholocron/observability/core";
@@ -5217,6 +5217,106 @@ const STALE_LABELS = [
 //#region src/templates/dco.yml
 var dco_default = "allowRemediationCommits:\n  individual: true\n";
 //#endregion
+//#region src/commands/preview-deploy-paths/preview-deploy-paths.ts
+/** `realpathSync`, falling back to the unresolved input on a path that doesn't exist (e.g. a test fixture). */
+function tryRealpath(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* `delivery.previewDeploy`'s package directory plus its `workspace:*`
+* dependencies' directories (holocron#1023) — the reusable workflow's
+* `paths` input, so a PR touching only an unrelated package in the
+* monorepo skips the actual deploy work instead of spinning up a Vercel
+* preview for every PR regardless of relevance. `undefined` for a
+* root-level consumer (`cwd: "."` or omitted) -- every PR already IS a PR
+* to that package, no filter needed -- or when `cwd` doesn't resolve to
+* any known workspace package (soft-skip; the caller leaves `paths`
+* unset rather than guessing).
+*/
+function resolvePreviewDeployPaths(gitRoot, cwdValue) {
+	if (!cwdValue || cwdValue === ".") return void 0;
+	const all = workspacePackages(gitRoot, {
+		readJson: defaultReadJson,
+		listDirs: defaultListDirs
+	});
+	const target = tryRealpath(resolve(gitRoot, cwdValue));
+	const pkg = all.find((candidate) => tryRealpath(candidate.dir) === target);
+	if (!pkg) return void 0;
+	return defaultPaths(gitRoot, pkg, all);
+}
+/**
+* Returns `tasks` unchanged unless it has a `delivery.previewDeploy` entry
+* with a non-root `with.cwd` and no `with.paths` of its own -- in which
+* case that one entry gets an auto-computed `paths` (see
+* {@link resolvePreviewDeployPaths}), added without mutating the input.
+* An explicit `with.paths` from the repo's own config always wins; this
+* only fills in what the repo didn't already specify.
+*/
+function withAutoPreviewDeployPaths(tasks, gitRoot) {
+	return tasks.map((entry) => {
+		if (typeof entry === "string" || entry.name !== "delivery.previewDeploy") return entry;
+		const cwdValue = entry.with?.["cwd"];
+		if (typeof cwdValue !== "string" || entry.with?.["paths"] !== void 0) return entry;
+		const paths = resolvePreviewDeployPaths(gitRoot, cwdValue);
+		if (!paths) return entry;
+		return {
+			...entry,
+			with: {
+				...entry.with,
+				paths
+			}
+		};
+	});
+}
+//#endregion
+//#region src/commands/workflow-source-marker/workflow-source-marker.ts
+/** `# Source package: <path>` line at the head of a generated thin-caller workflow — see {@link resolvePkgRelPath}. */
+const SOURCE_PACKAGE_MARKER = /^# Source package: (.+)$/m;
+/** Strip control characters (including ANSI escapes) before a value reaches a printed error message. */
+function sanitizeForDisplay(value) {
+	return value.replace(/[\x00-\x1f\x7f]/g, "");
+}
+/**
+* Repo-root-relative path of the PACKAGE a workflow-writing command run is
+* scoped to — the directory holding the discovered `holocron.config.*`
+* (`configFilepath`), not necessarily `--cwd` itself. `loadConfig()` walks
+* up to find the config from any subdirectory ("every command is usable
+* from any subdirectory of a repo, not only its exact root"), so a `--cwd`
+* one level too deep would otherwise stamp a different marker than a later
+* run from the package's own root and misfire the collision check this
+* feeds (holocron#1026).
+*
+* "." for a root invocation, "apps/sentinel" for a subpackage. Normalized
+* to forward slashes so the same package produces the same marker on
+* Windows and POSIX. Throws if the result contains a line break — a path
+* containing one could otherwise break out of the `# Source package: `
+* comment line and inject arbitrary workflow YAML when the generated
+* content is later written. Not reachable through this CLI's own flows
+* (no code path writes a config file whose directory name contains a line
+* break), but cheap to reject outright rather than trust the filesystem.
+*/
+function resolvePkgRelPath(gitRoot, configFilepath) {
+	let root;
+	try {
+		root = realpathSync(gitRoot);
+	} catch {
+		root = gitRoot;
+	}
+	let configDir;
+	try {
+		configDir = realpathSync(dirname(configFilepath));
+	} catch {
+		configDir = dirname(configFilepath);
+	}
+	const pkgRelPath = (relative(root, configDir) || ".").split(sep).join("/");
+	if (/[\r\n]/.test(pkgRelPath)) throw new Error(`refusing to use a package path containing a line break: ${JSON.stringify(pkgRelPath)}`);
+	return pkgRelPath;
+}
+//#endregion
 //#region src/commands/setup/agent-prompts-data.ts
 /**
 * Canonical AI engineering workflow role prompts.
@@ -6061,6 +6161,11 @@ async function runSetup(input) {
 	const steps = [];
 	const repo = config.repo;
 	const effectivePreset = repo?.protection;
+	const setupGitRoot = findRootSync(input.context.repoRoot, ".git", {
+		fallback: "start",
+		realpath: true
+	});
+	const setupPkgRelPath = resolvePkgRelPath(setupGitRoot, input.loaded.filepath);
 	const hooksEnabled = input.hooks ?? (typeof config.hooks === "boolean" ? config.hooks : typeof config.hooks === "object" ? config.hooks.prePush !== false : effectivePreset === "strict");
 	print(style.header(`Holocron setup — ${config.name}${dryRun ? " (dry-run)" : ""}`));
 	print(style.dim(`  config: ${input.loaded.filepath}`));
@@ -6109,7 +6214,7 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
-	const tasks = config.tasks;
+	const tasks = config.tasks && config.tasks.length > 0 ? withAutoPreviewDeployPaths(config.tasks, setupGitRoot) : config.tasks;
 	if (loader.has("source") && tasks && tasks.length > 0) {
 		const source = loader.get("source");
 		print(style.step("workflows"));
@@ -6140,7 +6245,7 @@ async function runSetup(input) {
 			if (content === void 0) continue;
 			const step = content.includes("workflows/preview.yml@main") ? `write workflow ${name} (with preview)` : `write workflow ${name}`;
 			steps.push(await runStep("source", step, dryRun, async () => {
-				await source.writeWorkflowFile(filename, `${thinCallerHeader()}${content}`);
+				await source.writeWorkflowFile(filename, `${thinCallerHeader()}# Source package: ${setupPkgRelPath}\n\n${content}`);
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -7243,6 +7348,7 @@ async function runSync(input) {
 	} catch {
 		resolvedRepoRoot = input.context.repoRoot;
 	}
+	const pkgRelPath = resolvePkgRelPath(gitRoot, input.loaded.filepath);
 	logger.info({
 		config: config.name,
 		steps: requestedSteps ?? "all",
@@ -7483,7 +7589,8 @@ async function runSync(input) {
 			print(formatSyncStep(steps[steps.length - 1]));
 		}
 		if (stepName === "workflows") {
-			const taskEntries = config.tasks ?? [];
+			const rawTaskEntries = config.tasks ?? [];
+			const taskEntries = rawTaskEntries.length === 0 ? rawTaskEntries : withAutoPreviewDeployPaths(rawTaskEntries, gitRoot);
 			if (taskEntries.length === 0) {
 				steps.push({
 					capability: "local",
@@ -7495,7 +7602,7 @@ async function runSync(input) {
 			} else {
 				const files = createAstromech({
 					cwd: input.context.repoRoot,
-					config: { tasks: config.tasks },
+					config: { tasks: taskEntries },
 					orgContext: {
 						org: config.org,
 						domain: config.domain
@@ -7520,7 +7627,8 @@ async function runSync(input) {
 					if (content === void 0) continue;
 					const step = `sync workflow ${name}${content.includes("workflows/preview.yml@main") ? " (with preview)" : ""}`;
 					steps.push(await runSyncStep("local", step, dryRun, async () => {
-						await writeWorkflowFile(gitRoot, filename, `${workflowHeader()}${content}`);
+						await assertNoPackageCollision(gitRoot, filename, name, pkgRelPath);
+						await writeWorkflowFile(gitRoot, filename, `${workflowHeader()}# Source package: ${pkgRelPath}\n\n${content}`);
 					}));
 					print(formatSyncStep(steps[steps.length - 1]));
 				}
@@ -7783,6 +7891,32 @@ async function writeWorkflowFile(repoRoot, filename, content) {
 	await writeFile(tmpPath, content, "utf8");
 	await rename(tmpPath, join(dir, filename));
 }
+/**
+* Two different monorepo packages opting into the same generic task name
+* (e.g. both `apps/sentinel` and some future `apps/other` configuring
+* `delivery.previewDeploy`) would otherwise overwrite each other's
+* `.github/workflows/<task>.yml` on whichever package's `holocron repo sync`
+* ran last — only one package's behavior would ever actually run in CI,
+* with no signal that the other's was silently dropped (holocron#1026).
+*
+* A file with no marker at all predates this check (or was written before
+* #1026) and is never flagged — only a marker that's present AND disagrees
+* with the current run's own package is a real collision. Any read error
+* other than "file doesn't exist" propagates rather than being treated as
+* "nothing to collide with" — the file may genuinely be unreadable, not
+* missing.
+*/
+async function assertNoPackageCollision(repoRoot, filename, taskName, pkgRelPath) {
+	let existing;
+	try {
+		existing = await readFile(join(repoRoot, ".github", "workflows", filename), "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return;
+		throw err;
+	}
+	const previousPkg = SOURCE_PACKAGE_MARKER.exec(existing)?.[1];
+	if (previousPkg !== void 0 && previousPkg !== pkgRelPath) throw new Error(`task "${taskName}" would overwrite .github/workflows/${filename}, already generated for package "${sanitizeForDisplay(previousPkg)}" — the same task name can't be used by two different packages (holocron#1026). If "${sanitizeForDisplay(previousPkg)}" moved or was renamed to this path, delete .github/workflows/${filename} first and re-run sync; otherwise rename one or give it a different thin-caller filename.`);
+}
 //#endregion
 //#region src/observability/resolve-telemetry/resolve-telemetry.ts
 /**