@timekast/factory 1.28.1 → 2.0.1

package/dist/commands/status.js

@@ -11,14 +11,20 @@
  *     installed version with "(versión remota no disponible — sin conexión)" +
  *     exit 0, NOT an unhandled exception.
  *
- * The latest-version query IS the only network seam — tests inject
+ * The latest-version query IS the only network seam of `computeStatus` — tests inject
  * `deps.fetchLatest` so the engine runs with no `gh` and no network.
+ *
+ * ADOPT-004: `runStatus` adds the repo's vault MODE (`bóveda` · `declinado` · `sin decidir` ·
+ * `no aplica`) and, in `bóveda`, the vault ↔ Vercel DRIFT by display hash — as a separate,
+ * bounded, degradable step (`inspectRepoVault`), never inside `computeStatus`, which `vault adopt`
+ * also runs as its "brain up to date" precondition.
  */
 import { execa } from 'execa';
 import { FACTORY_REPO } from '../lib/constants.js';
 import { hasLockfile, readLockfile } from '../lib/lockfile.js';
 import { compare } from '../lib/semver.js';
 import { isKitReleaseTag } from '../lib/unpack.js';
+import { inspectRepoVault, renderRepoVault, } from '../lib/vault-adopt.js';
 /**
  * The BETA channel banner (BETA-005). Emitted by `status` and `doctor` when the
  * lockfile is on the beta channel (`lockfile.beta === true`) so the dev always
@@ -166,9 +172,13 @@ function renderStatus(result) {
  */
 export async function runStatus(deps = {}, flags = { json: false }) {
     const result = await computeStatus(deps);
+    const vault = await inspectRepoVault(deps.rootDir ?? process.cwd(), deps.drift);
     if (flags.json) {
-        process.stdout.write(`${JSON.stringify(result)}\n`);
+        const report = { ...result, vault };
+        process.stdout.write(`${JSON.stringify(report)}\n`);
         return;
     }
     renderStatus(result);
+    // The mode is reported; `status` never suggests `vault adopt` (that is `doctor`'s job).
+    console.log(`\n${renderRepoVault(vault, { suggestAdopt: false }).join('\n')}`);
 }

package/dist/commands/ticket.js

@@ -27,7 +27,7 @@
  *
  * The body travels over STDIN (`--body-file -` + `{ input }`), the same discipline
  * as `gh secret set` in `provision.ts`: it never lands in argv (visible in the
- * process table of the multi-tenant Agent Server) and never hits the argv limit.
+ * process table of a shared host) and never hits the argv limit.
  *
  * CREDENTIALS: none new. The command reuses the developer's own `gh` session via
  * the shared `runPreflight` (gh installed → authenticated → org member). A failed
@@ -96,9 +96,9 @@ export function parseTicketPushFlags(argv) {
  *
  *   - `startsWith('project/factory')` accepts `project/factory-backup/…`.
  *   - git versions symlinks, so a file with a perfectly legitimate ticket name can
- *     point at `~/.claude/.env` — the org rail (VERCEL_TOKEN, NEON_API_KEY,
- *     CLOUDFLARE_API_TOKEN, RESEND_API_KEY, BACKLOG_ADMIN_TOKEN). Publishing that
- *     to a shared repo is the failure this guard exists to prevent.
+ *     point at a secrets file outside the repo (a person's shell config, an old
+ *     local copy of the org tokens…). Publishing that to a shared repo is the
+ *     failure this guard exists to prevent.
  *
  * Unlike `assertSafeTrackedPath` (whose input is a release manifest), this input
  * comes from the user AND the file gets opened and published — string checks do

package/dist/commands/update.js

@@ -33,12 +33,13 @@
  * `update` NEVER touches `src/` — files outside the lockfile/manifest are
  * invisible (design §9 out-of-scope).
  */
-import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { execa } from 'execa';
 import prompts from 'prompts';
 import { applyPlan, clearUpdateState, defaultBackupDir, hasUpdateState, readUpdateState, validateStagedManifest, writeUpdateState, } from '../lib/atomic-swap.js';
+import { applyClaudeMdRetrofit, assessClaudeMd, reportClaudeMd, } from '../lib/claude-md.js';
 import { collectClaudePaths } from '../lib/claude-paths.js';
 import { CLIError } from '../lib/cli-error.js';
 import { CLAUDE_MD_FILE, GITATTRIBUTES_FILE, LOCKFILE_FILE, PRETTIERIGNORE_FILE, PROFILES, TIMEKAST_DIR, } from '../lib/constants.js';
@@ -50,6 +51,7 @@ import { runPreflight } from '../lib/preflight.js';
 import { printProvisionPointer } from '../lib/provision-pointer.js';
 import { printRetrofitReminder } from '../lib/retrofit-reminder.js';
 import { hasProvisionState } from '../lib/provision-state.js';
+import { loginCommand } from '../lib/rail.js';
 import { detectRepo } from '../lib/repo-detection.js';
 import { downloadBetaProfileTarball, downloadProfileTarball, stageProfileTarball, } from '../lib/unpack.js';
 /** Parse `update`'s argv slice into flags. Unknown flags are ignored here. */
@@ -283,7 +285,15 @@ function buildPlan(diff, theirsConflicts) {
     const deletes = diff.deleteSilent.map((e) => e.path);
     return { writes, deletes };
 }
-/** `--verify`: report disk-vs-lockfile drift, modify nothing. */
+/**
+ * `--verify`: report disk-vs-lockfile drift, modify nothing.
+ *
+ * It also emits the A/B/C census of the repo's `CLAUDE.md` (PROJ-006) — the step the
+ * plan asks to run over the fleet BEFORE applying the retrofit for real. That is why
+ * the A/B/C discriminator was defined over the LOCKFILE: this path returns before
+ * `acquire`, so there is no incoming manifest and no network here — only the local
+ * lockfile and the disk.
+ */
 function runVerify(rootDir) {
     if (!hasLockfile(rootDir)) {
         throw new CLIError('No hay lockfile que verificar. Corre `factory update` primero.');
@@ -303,18 +313,23 @@ function runVerify(rootDir) {
     }
     if (missing.length === 0 && drifted.length === 0) {
         console.log('✔ El estado del disco coincide con el lockfile. Sin discrepancias.');
-        return;
     }
-    console.log('Discrepancias respecto al lockfile (no se modificó nada):');
-    for (const p of missing)
-        console.log(`  • faltante en disco: ${p}`);
-    for (const p of drifted)
-        console.log(`  • modificado localmente: ${p}`);
+    else {
+        console.log('Discrepancias respecto al lockfile (no se modificó nada):');
+        for (const p of missing)
+            console.log(`  • faltante en disco: ${p}`);
+        for (const p of drifted)
+            console.log(`  • modificado localmente: ${p}`);
+    }
+    // The census. Reported on BOTH branches: a repo with a spotless brain can still be
+    // the one whose `CLAUDE.md` needs the INDEX line (case B is a drift the summary
+    // above already listed, but case C is what a human has to act on).
+    reportClaudeMd(assessClaudeMd(rootDir, lock), 'preview');
 }
 /**
  * After a clean update, optionally commit the refreshed brain (local, NEVER push).
  * Decision (`commit-decision.ts`): `--no-commit`→skip · `--commit`→commit · interactive
- * → prompt y/n · headless → commit by default (the Agent Server needs it). Stages ONLY
+ * → prompt y/n · headless → commit by default (a headless run needs it). Stages ONLY
  * what the update touched (the applied manifest paths + lockfile + package.json +
  * .gitattributes) — never `git add -A`. Best-effort: no identity / no repo → warn + skip.
  */
@@ -395,16 +410,25 @@ async function runResume(rootDir, flags) {
         newLock.beta = true;
     else
         delete newLock.beta;
+    // Same pre-swap classification as a normal run (PROJ-006). A LEGACY resume has no
+    // prior lockfile, so there is no recorded hash to tell a virgin CLAUDE.md from an
+    // edited one — the retrofit sits that case out rather than guess.
+    const claudeMd = priorLock
+        ? assessClaudeMd(rootDir, priorLock)
+        : undefined;
     applyPlan(rootDir, state.stagedDir, state.plan, state.backupDir);
     writeLockfile(rootDir, newLock);
     clearUpdateState(rootDir);
+    const claudeMdInserted = claudeMd ? applyClaudeMdRetrofit(rootDir, claudeMd) : false;
     // Maintain dotfiles BEFORE removing the staged dir (the .gitattributes source).
     const pkgMutations = maintainDerivedDotfiles(rootDir, state.stagedDir, newLock.version);
-    await maybeCommitBrain(rootDir, newLock.version, [...state.plan.writes, ...state.plan.deletes], flags);
+    await maybeCommitBrain(rootDir, newLock.version, [...state.plan.writes, ...state.plan.deletes, ...(claudeMdInserted ? [CLAUDE_MD_FILE] : [])], flags);
     rmSync(state.stagedDir, { recursive: true, force: true });
     // A resumed update maintains package.json exactly like a normal one, so it owes the dev the
     // same account of what it moved there (`BND-004`).
     reportPkgMutations(pkgMutations);
+    if (claudeMd)
+        reportClaudeMd(claudeMd, 'applied', claudeMdInserted);
     console.log('✔ `update` retomado y completado.');
     // A resumed update that succeeds completed the setup → show the end-pointer
     // (PVSKILL-002 §8 edge: `--resume` SÍ lo muestra). Suppressed only in headless
@@ -710,9 +734,60 @@ export async function maybeOfferAdopt(rootDir, flags, opts = {}) {
     }));
     if (answer?.adopt === true) {
         console.log('\nCorre:  `factory provision --adopt --team=<teamId>`\n' +
-            '  (asegúrate de tener los tokens en `~/.claude/.env`; impórtalos con `factory secrets <archivo>` primero).');
+            '  (lee los tokens de `rail-timekast` en la bóveda: entra antes con ' +
+            `\`${loginCommand()}\` si tu sesión caducó).`);
     }
 }
+/** The repo's E2E settings file (read by `scripts/tools/e2e-runner.ts`) — dev-owned, never shipped by `update`. */
+export const E2E_CONFIG_FILE = 'e2e.config.json';
+/**
+ * After a successful update, OFFER the empty-branch E2E mode to a repo that has never decided.
+ *
+ * `e2e.config.json` lives at the repo root: `factory new` delivers it (`emptyBranch: true`) and
+ * `update` never creates or touches it, so a repo born before the flag keeps running E2E on a
+ * clone of its parent's data until someone opts in HERE. The answer is persisted either way —
+ * yes → `true`, no → `false` — so the question is asked once, not on every update; Esc writes
+ * nothing and asks again next time. Reverting is editing the value or deleting the file.
+ *
+ * Asked only when it means something: an interactive terminal, no `--yes` (GUI launcher /
+ * headless leave the repo exactly as it was), no decision on disk yet, and a repo that has the
+ * runner (`core` ships none) AND a migrations journal (without one the runner never empties).
+ *
+ * `isTTY`/`prompt` are injectable so the unit test drives every branch without a terminal.
+ */
+export async function maybeOfferEmptyE2EBranch(rootDir, flags, opts = {}) {
+    const isTTY = opts.isTTY ?? Boolean(process.stdout.isTTY);
+    if (flags.yes || !isTTY)
+        return;
+    if (existsSync(path.join(rootDir, E2E_CONFIG_FILE)))
+        return;
+    if (!existsSync(path.join(rootDir, 'scripts/tools/e2e-runner.ts')))
+        return;
+    if (!existsSync(path.join(rootDir, 'src/lib/db/migrations/meta/_journal.json')))
+        return;
+    const log = opts.log ?? ((message) => console.log(message));
+    log('\nE2E con base vacía (nuevo en el kit, opcional):\n' +
+        '  · Gana: cada corrida vacía la branch temporal y aplica TODAS tus migraciones desde 0000, ' +
+        'y ningún spec depende de datos que solo existen en develop.\n' +
+        '  · Implica: un spec que leía datos de develop, o una migración que no construye la base desde cero, ' +
+        'va a tronar. Corre `pnpm test:e2e` después de activarlo.\n' +
+        `  · Se revierte: pon \`"emptyBranch": false\` en \`${E2E_CONFIG_FILE}\` o borra el archivo. ` +
+        'Guía: .claude/docs/retrofits/e2e-empty-branch.md');
+    const ask = opts.prompt ?? prompts;
+    // A cancelled prompt (Esc) returns an empty object → no decision, nothing written.
+    const answer = (await ask({
+        type: 'confirm',
+        name: 'emptyBranch',
+        message: '¿Activo la base vacía para el E2E de este repo?',
+        initial: false,
+    }));
+    if (typeof answer?.emptyBranch !== 'boolean')
+        return;
+    writeFileSync(path.join(rootDir, E2E_CONFIG_FILE), `${JSON.stringify({ emptyBranch: answer.emptyBranch }, null, 2)}\n`);
+    log(answer.emptyBranch
+        ? `Listo: escribí \`${E2E_CONFIG_FILE}\` con la base vacía activada. Corre \`pnpm test:e2e\` y commitea el archivo.`
+        : `Anotado en \`${E2E_CONFIG_FILE}\` (desactivada): no te lo vuelvo a preguntar. Commitea el archivo.`);
+}
 /**
  * Run `factory update`. Orchestrates the full flow; `deps.acquire` is the only
  * network seam (tests inject a local fixture).
@@ -839,6 +914,10 @@ export async function runUpdate(flags, deps = {}) {
             if (decision === 'theirs')
                 theirsConflicts.push(conflict.path);
         }
+        // 🔴 Classify CLAUDE.md BEFORE the swap (PROJ-006). Case A is "disk == lockfile",
+        // and `applyPlan` may write the incoming version over it — after that, a virgin
+        // CLAUDE.md is indistinguishable from an edited one.
+        const claudeMd = assessClaudeMd(rootDir, oldLock);
         const plan = buildPlan(diff, theirsConflicts);
         const backupDir = defaultBackupDir(tmpRoot);
         // Persist resume state BEFORE applying, so a crash mid-apply is recoverable
@@ -855,12 +934,17 @@ export async function runUpdate(flags, deps = {}) {
         // update uses `stampBirth` alone, so a prior `beta` is cleared by omission.
         writeLockfile(rootDir, flags.beta ? stampBeta(oldLock, manifest) : stampBirth(oldLock, manifest));
         clearUpdateState(rootDir);
+        // The retrofit runs BEFORE the brain commit, so the inserted line travels in the
+        // same commit as the rest of the update (and `CLAUDE.md` joins the staged paths —
+        // in case B it is in `ignoreLocal`, so the plan never names it).
+        const claudeMdInserted = applyClaudeMdRetrofit(rootDir, claudeMd);
         const pkgMutations = maintainDerivedDotfiles(rootDir, stagedDir, manifest.version);
-        await maybeCommitBrain(rootDir, manifest.version, [...plan.writes, ...plan.deletes], flags);
+        await maybeCommitBrain(rootDir, manifest.version, [...plan.writes, ...plan.deletes, ...(claudeMdInserted ? [CLAUDE_MD_FILE] : [])], flags);
         // `theirsConflicts` IS the overwritten-local list: same source whether the dev answered
         // the prompt, passed `--theirs-all`, or ran headless — there is no second path. The
         // package.json mutations ride the SAME closing summary, not three loose notices.
         reportSummary(diff, manifest, theirsConflicts, pkgMutations);
+        reportClaudeMd(claudeMd, 'applied', claudeMdInserted);
         // 🔴 The retrofit reminder, on EVERY applied update and regardless of how conflicts
         // were resolved — `--theirs-all`, `--mine-all`, per-file answers or none at all. A
         // retrofit is not a conflict: it is work this command never attempted, living outside
@@ -871,6 +955,7 @@ export async function runUpdate(flags, deps = {}) {
         // that just arrived from the ones that were already sitting there. A legacy repo carries
         // `0.0.0`, so every guide reads as new — correct: it has seen none of them.
         printRetrofitReminder({ rootDir, fromVersion: oldLock.version, guiSignal: flags.launcher });
+        await maybeOfferEmptyE2EBranch(rootDir, flags);
         // End-pointer to the next step (PVSKILL-002). Reached only after a clean apply;
         // `--verify`/`--resume` short-circuit above (verify NEVER prints), an error path
         // throws earlier, and headless `--yes` is suppressed (CI noise).