@userreason/wizard 0.3.1 → 0.3.3

package/README.md

@@ -36,7 +36,7 @@ terminal. The [first survey guide](https://docs.userreason.com/get-started/first
 walks through creating and publishing a survey. Installing the SDK does not
 publish a survey.
 
-In development mode (`--dev`), onboarding opens in the browser by default.
+Onboarding opens in the browser by default in production and development (`--dev`).
 Survey suggestions and the Agent test step are paused in production and development.
 Setup does not prepare or upload application source for recommendations, and it
 neither offers nor creates suggested drafts. The terminal flow skips the
@@ -178,7 +178,8 @@ package builds. With a published package, select the development API:
 npx -y @userreason/wizard@latest --dev
 ```
 
-Production still requires `--browser-setup`. Compatible builds also support:
+Production and development both use browser setup by default. `--browser-setup`
+remains an optional explicit alias. Compatible builds also support:
 
 ```sh
 npx -y @userreason/wizard@latest --browser-setup
@@ -196,10 +197,11 @@ creating a session or local effects.
 Malformed protocol data and already-started setups never fall back silently.
 Server rollout flags remain off by default; publication is a separate release.
 
-The browser owns workspace/site selection, optional choices, local-plan approval,
+The browser owns workspace/site selection, optional choices, installation options,
 finish and cancellation. Source analysis, suggested drafts and the Agent test
 remain implemented but are hidden and skipped while their rollout flags are off. The local runner executes only approved typed effects
-using the separate owner-only setup capability. It does not read or replace
+using the separate owner-only setup capability. Press **Continue** on the setup
+options to begin installation; there is no separate local-change review screen. It does not read or replace
 normal CLI credentials. Stopping the local process leaves the setup resumable;
 cancelling in the browser does not undo completed edits or delete created drafts.
 Terminal results list verified, failed and manual outcomes separately.
@@ -220,11 +222,11 @@ skill never grants ongoing CLI access. Authorize continuing access separately
 with `userreason login --open` when wanted. Standalone CLI survey tools remain
 available outside onboarding.
 
-The production profile for wizard 0.3.1 selects `@userreason/js@0.5.3` and
+The production profile for wizard 0.3.3 selects `@userreason/js@0.5.3` and
 `@userreason/cli@0.2.1`. New installs use those exact versions; an installed
 stable patch in the same release line is reused. Earlier SDK 0.4 and CLI 0.1
-releases are upgraded when installation is selected. Browser setup still
-requires explicit `--browser-setup` and a server advertising the capability.
+releases are upgraded when installation is selected. Browser setup is the default and requires a server advertising the capability.
+Use `--terminal-setup` for the terminal flow.
 
 Browser-guided installation prints package-manager failures in the connected
 terminal, including failed registry requests when npm provides them. Diagnostic

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as createWizardRequire } from 'node:module'; import { fileURLToPath as wizardFileURLToPath } from 'node:url'; import { dirname as wizardDirname } from 'node:path'; const require = createWizardRequire(import.meta.url); const __filename = wizardFileURLToPath(import.meta.url); const __dirname = wizardDirname(__filename);
 import {
   runBrowserWizard
-} from "./chunk-CSZW2ULJ.js";
+} from "./chunk-FWEZ2ZWN.js";
 import {
   clearInstallation,
   resolveInstallation,
@@ -26,7 +26,7 @@ import {
   beginFirstSurveyPreparation,
   offerFirstSurvey
 } from "./chunk-ZHJV247H.js";
-import "./chunk-Q5U5UOQN.js";
+import "./chunk-5EAHX5BX.js";
 import "./chunk-4INLEQE2.js";
 import {
   offerAgentSkill,
@@ -97,7 +97,7 @@ var help = `UserReason installation wizard
 
 userreason-wizard [--directory PATH] [--origin URL]
 
---browser-setup (browser-guided setup; default for development onboarding)
+--browser-setup (browser-guided setup; default for onboarding)
 --terminal-setup (use terminal onboarding instead)
 --resume-setup UUID (resume this project's saved browser setup)
 --browser-origin ORIGIN (trusted dashboard origin for a custom API)
@@ -214,7 +214,7 @@ async function main() {
   if (values["resume-setup"]) uuid(values["resume-setup"], "Setup ID");
   const terminalFlags = ["refresh", "dry-run", "install", "skip-install", "integrate", "skip-integrate", "agent-note", "skip-agent-note", "agent-skill", "skip-agent-skill", "global-cli", "skip-global-cli", "cli-access", "skip-cli-access", "workspace", "workspace-name", "site", "site-name", "origin", "environment", "force", "diff", "session-only", "client-id", "credential-store"];
   const hasTerminalFlags = terminalFlags.some((key) => values[key] !== void 0 && values[key] !== false);
-  const browserMode = explicitBrowserMode || developmentApi && !values["terminal-setup"] && !hasTerminalFlags && !values.yes && !values.json;
+  const browserMode = explicitBrowserMode || !values["terminal-setup"] && !hasTerminalFlags && !values.yes && !values.json;
   if (values["browser-origin"]) {
     if (!browserMode) throw new Error("--browser-origin requires browser setup");
     apiUrl(values["browser-origin"], "Browser origin");

package/dist/{chunk-Q5U5UOQN.js → chunk-5EAHX5BX.js}

@@ -41,8 +41,9 @@ import {
 import { basename } from "node:path";
 
 // src/setup-plan.ts
-import { randomUUID } from "node:crypto";
-import { lstat, readdir, readFile } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
 var relativeName = (project, path) => relative(project.directory, path).replaceAll("\\", "/");
 var metadata = (files) => files.map((file2) => ({ path: file2.path, before_hash: file2.before === null ? null : setupHash(file2.before), after_hash: setupHash(file2.after) }));
@@ -170,10 +171,27 @@ async function prepare(project, session, profile, config, operations = [], manua
   }
   return { wire: { project_fingerprint: session.project_fingerprint, choices_digest: setupDigest(session.choices), effects: operations.map((item) => item.effect), ...manual.length ? { manual_steps: manual } : {} }, operations };
 }
-async function snapshot(project) {
+async function snapshotFile(path, expected, signal) {
+  const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || before.dev !== expected.dev || before.ino !== expected.ino)
+      throw new SetupError("setup_files_changed", "A project file changed while checking package installation.");
+    const hash = createHash("sha256");
+    for await (const chunk of handle.createReadStream({ autoClose: false, signal })) hash.update(chunk);
+    const after = await handle.stat();
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
+      throw new SetupError("setup_files_changed", "A project file changed while checking package installation.");
+    return hash.digest("hex");
+  } finally {
+    await handle.close();
+  }
+}
+async function snapshot(project, signal) {
   const result = {}, stack = [""];
-  let entries = 0, bytes = 0;
+  let entries = 0;
   while (stack.length) {
+    signal.throwIfAborted();
     const folder = stack.pop();
     for (const entry of await readdir(join(project.directory, folder), { withFileTypes: true })) {
       if (++entries > 2e4) throw new SetupError("setup_files_changed", "Project scanning exceeds the bounded review budget.");
@@ -185,11 +203,7 @@ async function snapshot(project) {
         continue;
       }
       if (info.isDirectory()) stack.push(path);
-      else if (info.isFile()) {
-        bytes += info.size;
-        if (info.size > 2e7 || bytes > 64e6) throw new SetupError("setup_files_changed", "Project scanning exceeds the bounded byte budget.");
-        result[path] = setupHash(await readFile(join(project.directory, path)));
-      }
+      else if (info.isFile()) result[path] = await snapshotFile(join(project.directory, path), info, signal);
     }
   }
   return result;
@@ -224,7 +238,7 @@ function setupRuntime(project, apiOrigin, selectedProfile = packageProfile()) {
       }
       if (operation.effect.package_manager !== current.packageManager) throw new SetupError("setup_command_mismatch", "The package manager differs from the reviewed command.");
       for (const item of operation.effect.packages) if (item.version !== (item.name === "@userreason/js" ? profile.sdkVersion : profile.cliVersion)) throw new SetupError("setup_package_version", "The approved package version differs from this local package profile.");
-      const before = await snapshot(project);
+      const before = await snapshot(project, signal);
       for (const file2 of operation.files.filter((file3) => file3.path !== "package.json")) await writeSetupFile(project.directory, file2);
       for (const item of operation.effect.packages) {
         signal.throwIfAborted();
@@ -234,7 +248,7 @@ function setupRuntime(project, apiOrigin, selectedProfile = packageProfile()) {
       const actual = await readSetupFile(project.directory, manifest.path);
       if (!actual || setupDigest(JSON.parse(actual)) !== setupDigest(JSON.parse(manifest.after))) throw new Error("The package manager made unexpected manifest changes");
       await writeSetupFile(project.directory, { ...manifest, before: actual });
-      const after = await snapshot(project), allowed = /* @__PURE__ */ new Set([...operation.files.map((file2) => file2.path), ...(operation.effect.managed_outputs ?? []).map((file2) => file2.path)]);
+      const after = await snapshot(project, signal), allowed = /* @__PURE__ */ new Set([...operation.files.map((file2) => file2.path), ...(operation.effect.managed_outputs ?? []).map((file2) => file2.path)]);
       for (const path of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) if (!allowed.has(path) && before[path] !== after[path]) throw new Error("The package manager changed an unreviewed project file");
       return "verified";
     },

package/dist/{chunk-CSZW2ULJ.js → chunk-FWEZ2ZWN.js}

@@ -3,7 +3,7 @@ import {
   connectSetup,
   resumeSetup,
   runSetup
-} from "./chunk-Q5U5UOQN.js";
+} from "./chunk-5EAHX5BX.js";
 import {
   clean,
   openBrowser
@@ -46,14 +46,14 @@ async function runBrowserWizard(input) {
   let connected;
   try {
     connected = input.resumeId ? await resumeSetup(apiOrigin, input.resumeId, project, { signal, measurementDisabled: input.measurementDisabled }) : await connectSetup(apiOrigin, project, async (url, code) => {
-      terminal.block("Continue in your browser", [url, `Verification code: ${code}`, input.development ? "Choose your workspace, site and installation options in the browser." : "Review the project, local changes and source permissions there."]);
+      terminal.block("Continue in your browser", [url, `Verification code: ${code}`, "Choose your workspace, site and installation options in the browser."]);
       if (!input.noOpen && !await openBrowser(url)) terminal.info("Open the link above to continue.");
     }, {
       signal,
       browserOrigin: input.browserOrigin,
-      automaticSetup: input.development,
+      automaticSetup: true,
       measurementDisabled: input.measurementDisabled,
-      ...input.development ? { launcher: { wizard_version: input.version, api_origin: apiOrigin, ...input.profile.kind === "local-development" ? { registry: input.profile.registry } : {} } } : {}
+      launcher: { wizard_version: input.version, api_origin: apiOrigin, ...input.profile.kind === "local-development" ? { registry: input.profile.registry } : {} }
     });
   } catch (error) {
     if (!input.resumeId && error instanceof BrowserSetupUnavailable) return false;

package/dist/setup-flow.js

@@ -5,8 +5,8 @@ import {
   setupResumeCommand,
   setupSampleCommand,
   setupSummary
-} from "./chunk-CSZW2ULJ.js";
-import "./chunk-Q5U5UOQN.js";
+} from "./chunk-FWEZ2ZWN.js";
+import "./chunk-5EAHX5BX.js";
 import "./chunk-4INLEQE2.js";
 import "./chunk-SB3AYQWG.js";
 import "./chunk-LEJFE4U5.js";

package/dist/setup.js

@@ -6,7 +6,7 @@ import {
   resumeSetup,
   runSetup,
   setupRuntime
-} from "./chunk-Q5U5UOQN.js";
+} from "./chunk-5EAHX5BX.js";
 import "./chunk-4INLEQE2.js";
 import "./chunk-SB3AYQWG.js";
 import "./chunk-LEJFE4U5.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@userreason/wizard",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Authenticated UserReason SDK installation wizard",
   "type": "module",
   "license": "UNLICENSED",