@theokit/sdk-tools 0.26.2 → 0.26.3

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.26.3
+
+### Patch Changes
+
+- 8790f70: Refuse a `workspace:` range before it can reach npm.
+
+  Five of this repo's twelve publishable packages declare internal dependencies as `workspace:^`, which
+  is correct on disk and becomes an unrecoverable defect if the publish goes out through a tool that
+  does not rewrite it: `pnpm` resolves the protocol while packing, `npm` ships the manifest verbatim.
+  A version published that way fails to install for everyone and cannot be corrected — only
+  deprecated.
+
+  Every publishable package now runs the guard in `prepublishOnly`, so it fires whichever way the
+  publish is invoked, and `pnpm release` runs it once across the repo before `changeset publish`.
+
+  Note for anyone reading a published manifest: the `prepublishOnly` entry points at a path inside
+  this repository. It never runs for a consumer — the hook only fires when the package itself is
+  published — and guarding the entry point that a hand-run `npm publish` actually uses was worth the
+  cosmetic wart of shipping the line.
+
 ## 0.26.2
 
 ### Patch Changes

package/dist/index.cjs

@@ -793,12 +793,12 @@ function checkPathScope(path, projectRoot) {
     throw err;
   }
 }
-var SEGMENTOS_SENSIVEIS = /* @__PURE__ */ new Set([".env", ".git", "node_modules", ".theo"]);
-function ehProibidoEmQualquerProfundidade(path) {
+var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([".env", ".git", "node_modules", ".theo"]);
+function isForbiddenAtAnyDepth(path) {
   const segs = path.replace(/\\/g, "/").split("/").filter(Boolean);
   return segs.some((s) => {
     if (s === ".env.example") return false;
-    return SEGMENTOS_SENSIVEIS.has(s) || /^\.env\./.test(s);
+    return SENSITIVE_SEGMENTS.has(s) || /^\.env\./.test(s);
   });
 }
 
@@ -1586,7 +1586,7 @@ function createListDirTool(opts) {
     }),
     handler: async ({ path }, ctx) => {
       const relative3 = path === "" || path === "." ? "." : path;
-      const verdict = decidirEscopo(relative3, path, opts.allowAbsolute === true);
+      const verdict = decideScope(relative3, path, opts.allowAbsolute === true);
       if (verdict.error !== void 0) return verdict.error;
       if (verdict.absoluteRoot !== void 0) {
         return listViaLocalFs(verdict.absoluteRoot, ".", path, max);
@@ -1599,14 +1599,14 @@ function createListDirTool(opts) {
     }
   });
 }
-function decidirEscopo(relative3, original, allowAbsolute) {
+function decideScope(relative3, original, allowAbsolute) {
   const refuse = (error) => ({
     error: JSON.stringify({ ok: false, error, path: original })
   });
   if (relative3 !== "." && pathSafety.isForbiddenPath(relative3)) return refuse("forbidden_path");
   if (!path.isAbsolute(relative3)) return {};
   if (!allowAbsolute) return refuse("path_traversal");
-  if (ehProibidoEmQualquerProfundidade(relative3)) return refuse("forbidden_path");
+  if (isForbiddenAtAnyDepth(relative3)) return refuse("forbidden_path");
   return { absoluteRoot: relative3 };
 }
 async function listViaLocalFs(projectRoot, relative3, originalPath, max) {
@@ -1769,10 +1769,10 @@ function createPlanModeTool(options) {
 }
 
 // src/question.ts
-function askerDoContexto(context) {
+function askerFromContext(context) {
   if (typeof context !== "object" || context === null) return void 0;
-  const candidato = context.askUser;
-  return typeof candidato === "function" ? candidato : void 0;
+  const candidate = context.askUser;
+  return typeof candidate === "function" ? candidate : void 0;
 }
 function createQuestionTool(opts) {
   const timeoutMs = opts.timeoutMs ?? 3e5;
@@ -1787,7 +1787,7 @@ function createQuestionTool(opts) {
       required: ["question"]
     },
     handler: async (input, ctx) => {
-      const askUser = askerDoContexto(ctx?.context) ?? opts.askUser;
+      const askUser = askerFromContext(ctx?.context) ?? opts.askUser;
       if (askUser === void 0) {
         return JSON.stringify({
           ok: false,
@@ -1824,7 +1824,7 @@ function forbiddenReadError(path$1, allowAbsolute) {
   if (pathSafety.isForbiddenPath(path$1)) {
     return JSON.stringify({ ok: false, error: "forbidden_path", path: path$1 });
   }
-  if (allowAbsolute && path.isAbsolute(path$1) && ehProibidoEmQualquerProfundidade(path$1)) {
+  if (allowAbsolute && path.isAbsolute(path$1) && isForbiddenAtAnyDepth(path$1)) {
     return JSON.stringify({ ok: false, error: "forbidden_path", path: path$1 });
   }
   return null;