@userreason/wizard 0.3.2 → 0.3.3

package/README.md

@@ -197,10 +197,11 @@ creating a session or local effects.
 Malformed protocol data and already-started setups never fall back silently.
 Server rollout flags remain off by default; publication is a separate release.
 
-The browser owns workspace/site selection, optional choices, local-plan approval,
+The browser owns workspace/site selection, optional choices, installation options,
 finish and cancellation. Source analysis, suggested drafts and the Agent test
 remain implemented but are hidden and skipped while their rollout flags are off. The local runner executes only approved typed effects
-using the separate owner-only setup capability. It does not read or replace
+using the separate owner-only setup capability. Press **Continue** on the setup
+options to begin installation; there is no separate local-change review screen. It does not read or replace
 normal CLI credentials. Stopping the local process leaves the setup resumable;
 cancelling in the browser does not undo completed edits or delete created drafts.
 Terminal results list verified, failed and manual outcomes separately.
@@ -221,7 +222,7 @@ skill never grants ongoing CLI access. Authorize continuing access separately
 with `userreason login --open` when wanted. Standalone CLI survey tools remain
 available outside onboarding.
 
-The production profile for wizard 0.3.2 selects `@userreason/js@0.5.3` and
+The production profile for wizard 0.3.3 selects `@userreason/js@0.5.3` and
 `@userreason/cli@0.2.1`. New installs use those exact versions; an installed
 stable patch in the same release line is reused. Earlier SDK 0.4 and CLI 0.1
 releases are upgraded when installation is selected. Browser setup is the default and requires a server advertising the capability.

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as createWizardRequire } from 'node:module'; import { fileURLToPath as wizardFileURLToPath } from 'node:url'; import { dirname as wizardDirname } from 'node:path'; const require = createWizardRequire(import.meta.url); const __filename = wizardFileURLToPath(import.meta.url); const __dirname = wizardDirname(__filename);
 import {
   runBrowserWizard
-} from "./chunk-CSZW2ULJ.js";
+} from "./chunk-FWEZ2ZWN.js";
 import {
   clearInstallation,
   resolveInstallation,
@@ -26,7 +26,7 @@ import {
   beginFirstSurveyPreparation,
   offerFirstSurvey
 } from "./chunk-ZHJV247H.js";
-import "./chunk-Q5U5UOQN.js";
+import "./chunk-5EAHX5BX.js";
 import "./chunk-4INLEQE2.js";
 import {
   offerAgentSkill,

package/dist/{chunk-Q5U5UOQN.js → chunk-5EAHX5BX.js}

@@ -41,8 +41,9 @@ import {
 import { basename } from "node:path";
 
 // src/setup-plan.ts
-import { randomUUID } from "node:crypto";
-import { lstat, readdir, readFile } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
 var relativeName = (project, path) => relative(project.directory, path).replaceAll("\\", "/");
 var metadata = (files) => files.map((file2) => ({ path: file2.path, before_hash: file2.before === null ? null : setupHash(file2.before), after_hash: setupHash(file2.after) }));
@@ -170,10 +171,27 @@ async function prepare(project, session, profile, config, operations = [], manua
   }
   return { wire: { project_fingerprint: session.project_fingerprint, choices_digest: setupDigest(session.choices), effects: operations.map((item) => item.effect), ...manual.length ? { manual_steps: manual } : {} }, operations };
 }
-async function snapshot(project) {
+async function snapshotFile(path, expected, signal) {
+  const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || before.dev !== expected.dev || before.ino !== expected.ino)
+      throw new SetupError("setup_files_changed", "A project file changed while checking package installation.");
+    const hash = createHash("sha256");
+    for await (const chunk of handle.createReadStream({ autoClose: false, signal })) hash.update(chunk);
+    const after = await handle.stat();
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
+      throw new SetupError("setup_files_changed", "A project file changed while checking package installation.");
+    return hash.digest("hex");
+  } finally {
+    await handle.close();
+  }
+}
+async function snapshot(project, signal) {
   const result = {}, stack = [""];
-  let entries = 0, bytes = 0;
+  let entries = 0;
   while (stack.length) {
+    signal.throwIfAborted();
     const folder = stack.pop();
     for (const entry of await readdir(join(project.directory, folder), { withFileTypes: true })) {
       if (++entries > 2e4) throw new SetupError("setup_files_changed", "Project scanning exceeds the bounded review budget.");
@@ -185,11 +203,7 @@ async function snapshot(project) {
         continue;
       }
       if (info.isDirectory()) stack.push(path);
-      else if (info.isFile()) {
-        bytes += info.size;
-        if (info.size > 2e7 || bytes > 64e6) throw new SetupError("setup_files_changed", "Project scanning exceeds the bounded byte budget.");
-        result[path] = setupHash(await readFile(join(project.directory, path)));
-      }
+      else if (info.isFile()) result[path] = await snapshotFile(join(project.directory, path), info, signal);
     }
   }
   return result;
@@ -224,7 +238,7 @@ function setupRuntime(project, apiOrigin, selectedProfile = packageProfile()) {
       }
       if (operation.effect.package_manager !== current.packageManager) throw new SetupError("setup_command_mismatch", "The package manager differs from the reviewed command.");
       for (const item of operation.effect.packages) if (item.version !== (item.name === "@userreason/js" ? profile.sdkVersion : profile.cliVersion)) throw new SetupError("setup_package_version", "The approved package version differs from this local package profile.");
-      const before = await snapshot(project);
+      const before = await snapshot(project, signal);
       for (const file2 of operation.files.filter((file3) => file3.path !== "package.json")) await writeSetupFile(project.directory, file2);
       for (const item of operation.effect.packages) {
         signal.throwIfAborted();
@@ -234,7 +248,7 @@ function setupRuntime(project, apiOrigin, selectedProfile = packageProfile()) {
       const actual = await readSetupFile(project.directory, manifest.path);
       if (!actual || setupDigest(JSON.parse(actual)) !== setupDigest(JSON.parse(manifest.after))) throw new Error("The package manager made unexpected manifest changes");
       await writeSetupFile(project.directory, { ...manifest, before: actual });
-      const after = await snapshot(project), allowed = /* @__PURE__ */ new Set([...operation.files.map((file2) => file2.path), ...(operation.effect.managed_outputs ?? []).map((file2) => file2.path)]);
+      const after = await snapshot(project, signal), allowed = /* @__PURE__ */ new Set([...operation.files.map((file2) => file2.path), ...(operation.effect.managed_outputs ?? []).map((file2) => file2.path)]);
       for (const path of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) if (!allowed.has(path) && before[path] !== after[path]) throw new Error("The package manager changed an unreviewed project file");
       return "verified";
     },

package/dist/{chunk-CSZW2ULJ.js → chunk-FWEZ2ZWN.js}

@@ -3,7 +3,7 @@ import {
   connectSetup,
   resumeSetup,
   runSetup
-} from "./chunk-Q5U5UOQN.js";
+} from "./chunk-5EAHX5BX.js";
 import {
   clean,
   openBrowser
@@ -46,14 +46,14 @@ async function runBrowserWizard(input) {
   let connected;
   try {
     connected = input.resumeId ? await resumeSetup(apiOrigin, input.resumeId, project, { signal, measurementDisabled: input.measurementDisabled }) : await connectSetup(apiOrigin, project, async (url, code) => {
-      terminal.block("Continue in your browser", [url, `Verification code: ${code}`, input.development ? "Choose your workspace, site and installation options in the browser." : "Review the project, local changes and source permissions there."]);
+      terminal.block("Continue in your browser", [url, `Verification code: ${code}`, "Choose your workspace, site and installation options in the browser."]);
       if (!input.noOpen && !await openBrowser(url)) terminal.info("Open the link above to continue.");
     }, {
       signal,
       browserOrigin: input.browserOrigin,
-      automaticSetup: input.development,
+      automaticSetup: true,
       measurementDisabled: input.measurementDisabled,
-      ...input.development ? { launcher: { wizard_version: input.version, api_origin: apiOrigin, ...input.profile.kind === "local-development" ? { registry: input.profile.registry } : {} } } : {}
+      launcher: { wizard_version: input.version, api_origin: apiOrigin, ...input.profile.kind === "local-development" ? { registry: input.profile.registry } : {} }
     });
   } catch (error) {
     if (!input.resumeId && error instanceof BrowserSetupUnavailable) return false;

package/dist/setup-flow.js

@@ -5,8 +5,8 @@ import {
   setupResumeCommand,
   setupSampleCommand,
   setupSummary
-} from "./chunk-CSZW2ULJ.js";
-import "./chunk-Q5U5UOQN.js";
+} from "./chunk-FWEZ2ZWN.js";
+import "./chunk-5EAHX5BX.js";
 import "./chunk-4INLEQE2.js";
 import "./chunk-SB3AYQWG.js";
 import "./chunk-LEJFE4U5.js";

package/dist/setup.js

@@ -6,7 +6,7 @@ import {
   resumeSetup,
   runSetup,
   setupRuntime
-} from "./chunk-Q5U5UOQN.js";
+} from "./chunk-5EAHX5BX.js";
 import "./chunk-4INLEQE2.js";
 import "./chunk-SB3AYQWG.js";
 import "./chunk-LEJFE4U5.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@userreason/wizard",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Authenticated UserReason SDK installation wizard",
   "type": "module",
   "license": "UNLICENSED",