@yagni-app/code-staging 1.1.4-staging.1412.1 → 1.1.4-staging.1414.1

package/dist/cli.d.ts

@@ -14,6 +14,14 @@
  */
 import { type OutputFormat } from "./outputFormat.js";
 import { promptKeepOrRemoveWorktree } from "./worktreeExitPrompt.js";
+/**
+ * The stderr warning for a failed shadow-package build: fail-soft stands
+ * (never block a launch), but never silent — an un-rebranded session is
+ * exactly what the user is least able to self-diagnose (chrome reads "pi",
+ * the resume command says "pi --session …"). One helper, not one per catch
+ * site, so the message cannot drift between the two launch paths.
+ */
+export declare function shadowFailureWarning(err: unknown): string;
 /**
  * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
  * input aligns with the chat/output area (`outputPad`) and the status bar.

package/dist/cli.js

@@ -46,6 +46,16 @@ import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveSes
 import { credentialsFromProfile, getActiveProfileName, listProfiles, migrateLegacyCredentials, persistProfileTokenRotation, profilePath, readActiveProfile, useProfile, } from "./profiles.js";
 // Present as "yagni" in process listings, not "node".
 process.title = DISTRIBUTION.commandName;
+/**
+ * The stderr warning for a failed shadow-package build: fail-soft stands
+ * (never block a launch), but never silent — an un-rebranded session is
+ * exactly what the user is least able to self-diagnose (chrome reads "pi",
+ * the resume command says "pi --session …"). One helper, not one per catch
+ * site, so the message cannot drift between the two launch paths.
+ */
+export function shadowFailureWarning(err) {
+    return `Could not prepare the YAGNI Code package shadow; this session will show "pi" branding: ${err instanceof Error ? err.message : String(err)}\n`;
+}
 /** The one-time Claude-compat trust question, asked on the launch TTY. */
 async function confirmOnTty(question) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -230,9 +240,11 @@ async function runDefault(passthroughArgs) {
             realPiDir: resolvePiPackageDir(),
             shadowDir: piPackageDir(),
             name: PI_CONFIG_NAME,
+            onNote: (m) => process.stderr.write(`[yagni] ${m}\n`),
         });
     }
-    catch {
+    catch (err) {
+        process.stderr.write(shadowFailureWarning(err));
         shadowPiDir = undefined;
     }
     // Zero-config Claude Code compat: wire this repo's (and the user's)
@@ -436,9 +448,11 @@ async function runWorktreeLaunch(passthroughArgs, worktreeName, loadSessionWorkt
             realPiDir: resolvePiPackageDir(),
             shadowDir: piPackageDir(),
             name: PI_CONFIG_NAME,
+            onNote: (m) => process.stderr.write(`[yagni] ${m}\n`),
         });
     }
-    catch {
+    catch (err) {
+        process.stderr.write(shadowFailureWarning(err));
         shadowPiDir = undefined;
     }
     let compat = { argv: [], env: {} };

package/dist/piPackage.d.ts

@@ -8,8 +8,12 @@
  * reinstall) or copying pi wholesale, we generate a tiny shadow dir that:
  *
  *   - owns its own `package.json` (pi's, with `piConfig.name` injected), and
- *   - symlinks `dist/` (+ CHANGELOG/README/docs/examples) back to the real pi
- *     package, so asset/theme resolution still finds the real files.
+ *   - links `dist/` (+ CHANGELOG/README/docs/examples) back to the real pi
+ *     package, so asset/theme resolution still finds the real files. The link
+ *     is a symlink where privileges allow; on stock Windows
+ *     (`CreateSymbolicLinkW` needs `SeCreateSymbolicLinkPrivilege`) dirs fall
+ *     back to junctions (privilege-free) and any entry that still can't be
+ *     linked is copied.
  *
  * The launcher points `PI_PACKAGE_DIR` at this dir. Regenerated every launch so
  * a pi upgrade or store-path move can never leave a stale package.json or a
@@ -22,6 +26,16 @@ export interface ShadowPiPackageOptions {
     shadowDir: string;
     /** The `piConfig.name` to inject — what pi shows as its app name. */
     name: string;
+    /**
+     * Diagnostic sink for a copy fallback (no link form worked, so the shadow
+     * materialized as real copies — slower to rebuild each launch, and able to
+     * serve stale content between refreshes). Called ONCE per build, naming
+     * the first copied DIR entry (file copies are silent everywhere — on
+     * stock Windows they are the normal case). Omit to stay silent; this
+     * module never touches stderr itself, so embedded consumers (the desktop
+     * driver) can't be surprised by output they can't suppress.
+     */
+    onNote?: (message: string) => void;
 }
 /**
  * Materialize (idempotently) the shadow pi package and return its path.

package/dist/piPackage.js

@@ -8,20 +8,24 @@
  * reinstall) or copying pi wholesale, we generate a tiny shadow dir that:
  *
  *   - owns its own `package.json` (pi's, with `piConfig.name` injected), and
- *   - symlinks `dist/` (+ CHANGELOG/README/docs/examples) back to the real pi
- *     package, so asset/theme resolution still finds the real files.
+ *   - links `dist/` (+ CHANGELOG/README/docs/examples) back to the real pi
+ *     package, so asset/theme resolution still finds the real files. The link
+ *     is a symlink where privileges allow; on stock Windows
+ *     (`CreateSymbolicLinkW` needs `SeCreateSymbolicLinkPrivilege`) dirs fall
+ *     back to junctions (privilege-free) and any entry that still can't be
+ *     linked is copied.
  *
  * The launcher points `PI_PACKAGE_DIR` at this dir. Regenerated every launch so
  * a pi upgrade or store-path move can never leave a stale package.json or a
  * dangling symlink behind.
  */
-import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 // Entries pi resolves relative to its package dir. `dist` carries theme + TUI
 // assets + export templates (the load-bearing ones); the rest back /changelog,
-// /about, etc. Each is symlinked only if it exists in the real package.
+// /about, etc. Each is linked only if it exists in the real package.
 const LINKED_ENTRIES = ["dist", "CHANGELOG.md", "README.md", "docs", "examples"];
-function linkInto(shadowDir, realPiDir, entry) {
+function linkInto(shadowDir, realPiDir, entry, onNote) {
     const target = join(realPiDir, entry);
     if (!existsSync(target))
         return;
@@ -30,6 +34,9 @@ function linkInto(shadowDir, realPiDir, entry) {
     // unlinked directly: rmSync stats THROUGH it, so on a dangling link (target
     // checkout deleted) it sees ENOENT, force-swallows it, and leaves the link
     // in place - then symlinkSync throws EEXIST and the rebrand silently drops.
+    // Junctions are lstat-visible as symlinks on POSIX and win32 alike (the
+    // Windows CI lane proved this), so both fall in here and are unlinked
+    // directly — never rmSync'd through into the real pi dist.
     if (isSymlink(linkPath)) {
         unlinkSync(linkPath);
     }
@@ -37,7 +44,39 @@ function linkInto(shadowDir, realPiDir, entry) {
         rmSync(linkPath, { recursive: true, force: true });
     }
     const type = statSync(target).isDirectory() ? "dir" : "file";
-    symlinkSync(target, linkPath, type);
+    try {
+        symlinkSync(target, linkPath, type);
+    }
+    catch (err) {
+        // Stock Windows denies CreateSymbolicLinkW (EPERM) without
+        // SeCreateSymbolicLinkPrivilege. Directory junctions need no privilege,
+        // so retry dirs as junctions (the type is ignored on POSIX); anything
+        // else (files) or a still-denied dir falls back to a copy.
+        if (type === "dir") {
+            try {
+                symlinkSync(target, linkPath, "junction");
+                return;
+            }
+            catch {
+                // fall through to the copy
+            }
+        }
+        // The last resort: a real copy — unguarded cpSync is the throw's own
+        // delivery: a failure here propagates out of ensureShadowPiPackage, so a
+        // half-built shadow (rebranded package.json over a missing dist) never
+        // ships — the launcher's fail-soft catch gives pi the working un-rebranded
+        // package instead of a broken session.
+        cpSync(target, linkPath, { recursive: true, dereference: true, force: true });
+        // Noted for DIR entries only. On stock Windows files can never link (no
+        // privilege-free file equivalent of a junction exists), so CHANGELOG/
+        // README copy on EVERY launch there — noting them would fire the note on
+        // every stock-Windows launch, not just on a degraded build. A dir
+        // falling all the way to a copy is the real signal (the expensive,
+        // load-bearing degradation), so that is what earns the note.
+        if (type === "dir") {
+            onNote(`could not link '${entry}' into the package shadow (${err instanceof Error ? err.message : String(err)}); copied instead`);
+        }
+    }
 }
 function isSymlink(p) {
     try {
@@ -54,7 +93,7 @@ function isSymlink(p) {
  * derive pi's version/name, and a silent fallback would re-leak "pi".
  */
 export function ensureShadowPiPackage(opts) {
-    const { realPiDir, shadowDir, name } = opts;
+    const { realPiDir, shadowDir, name, onNote } = opts;
     const realPkgRaw = readFileSync(join(realPiDir, "package.json"), "utf8");
     const realPkg = JSON.parse(realPkgRaw);
     mkdirSync(shadowDir, { recursive: true });
@@ -63,8 +102,22 @@ export function ensureShadowPiPackage(opts) {
         piConfig: { ...(realPkg.piConfig ?? {}), name },
     };
     writeFileSync(join(shadowDir, "package.json"), `${JSON.stringify(shadowPkg, null, 2)}\n`);
+    // One note per BUILD, not per entry: whichever entry FIRST degrades to a
+    // copy gets named (in practice `dist` — first in LINKED_ENTRIES, and the
+    // load-bearing one), and one line saying the shadow degraded to copies is
+    // all the diagnosis needs — near-identical lines for every later entry
+    // would just be noise.
+    let noted = false;
     for (const entry of LINKED_ENTRIES) {
-        linkInto(shadowDir, realPiDir, entry);
+        if (noted) {
+            linkInto(shadowDir, realPiDir, entry, () => { });
+        }
+        else {
+            linkInto(shadowDir, realPiDir, entry, (message) => {
+                onNote?.(message);
+                noted = true;
+            });
+        }
     }
     return shadowDir;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.4-staging.1412.1",
+  "version": "1.1.4-staging.1414.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "4266630468e144c9ac86fc902b44a9de1b05409f"
+  "yagniSourceSha": "5d3561f59b32cd7bd24dc661dc2cf34bf4b5f40b"
 }