@zenera/cli 1.1.42 → 1.1.43

package/README.md

@@ -115,7 +115,7 @@ in line with it, validate the setup, and run it:
 ```sh
 zen meta run my-project /spec-sync-project
 zen check my-project
-zen run my-project "Summarize this repository and write NOTES.md"
+zen run my-project --here "Summarize this repository and write NOTES.md"
 zen inspect
 ```
 
@@ -127,13 +127,15 @@ than silently guessing. After you answer, apply that feedback with
 ## Run it your way
 
 With no prompt, `zen run` opens the terminal UI. Provide a prompt for a
-one-shot run, or use JSON and batch mode to integrate with other tools:
+one-shot run, or use JSON and batch mode to integrate with other tools. A
+one-shot run works in a fresh directory inside its session; `--here` points it
+at the directory you are in instead:
 
 ```sh
 zen run my-project                         # interactive terminal UI
-zen run my-project "Review the latest changes"
+zen run my-project --here "Review the latest changes"
 git diff | zen run my-project
-zen run my-project "Summarize the changes" --read-only
+zen run my-project --here "Summarize the changes" --read-only
 zen run my-project "Triage these alerts" --json | jq
 zen run batch --input cases.json           # run a set of requests
 ```

package/dist/commands/check.js

@@ -6,7 +6,7 @@ import { duration } from "../narrate.js";
 import { project as resolveProject } from "../resolve.js";
 import { refreshShared } from "../scaffold.js";
 import { bold, count, cyan, dim, green, invalidError, json, progress, red, table, usageError, write, writeAll, yellow, } from "../term.js";
-import { validateProject, } from "../validate.js";
+import { repinDockerfile, validateProject, } from "../validate.js";
 const USAGE = 'zen check [name|dir] [--project <name|dir>] [--fix] [--no-sandbox] [--no-models] [--strict] [--quiet]';
 // ---------------------------------------------------------------------------
 // zen check
@@ -57,8 +57,10 @@ export const check = {
         '(.vscode/ and .github/). They restate how this version of zen behaves,',
         'so a copy left behind by an upgrade is worse than none — they are',
         'replaced whether or not they were edited, and the report that follows is',
-        'of the project as repaired. Nothing else is touched: agents.yaml, the',
-        'prompts, the specification and agents/instructions.md are yours.',
+        'of the project as repaired. It also pins the @zenera/* installs in the',
+        'sandbox Dockerfile to this zen\u2019s version, changing nothing else in it.',
+        'Nothing else is touched: agents.yaml, the prompts, the specification and',
+        'agents/instructions.md are yours.',
         '',
         'The argument is a directory if one is there and a registered project',
         'name otherwise; with neither, the project you are standing in.',
@@ -87,7 +89,7 @@ export const check = {
         // the files that are there now and the exit code answers the repaired
         // project. A fix that left an error behind in the output would be read
         // as a fix that failed.
-        const fixed = values.fix ? refreshShared(dir) : [];
+        const fixed = values.fix ? [...refreshShared(dir), ...repinDockerfile(dir)] : [];
         // Materialised first, so the credential verdicts are the ones a run
         // would reach: a key in the environment and a key in the keyring are
         // the same key by the time the library asks. The project's own `.env`
@@ -329,7 +331,7 @@ function fixedLines(fixed) {
         return [];
     }
     return [
-        `${bold('Replaced')} ${dim(`${count(fixed.length, 'file')} \u2014 ours, not the project's`)}`,
+        `${bold('Fixed')} ${dim(count(fixed.length, 'file'))}`,
         ...fixed.map((f) => `  ${green('wrote')} ${f}`),
         '',
     ];

package/dist/commands/run.js

@@ -33,6 +33,8 @@ export const run = {
         '  --new                  Start a new session without asking which one.',
         '  --input <file>         Read the whole request from JSON. `-` is stdin.',
         '  --workspace <dir>      Directory the agent can read and write.',
+        '                         Default: a fresh one inside the new session.',
+        '  --here                 Same as --workspace with the directory you are in.',
         '  --memory <dir>         Directory the agents remember into.',
         '  --memory-read-only     Recall from it, write nothing back.',
         '  --model <ref>          Use this model instead of the default.',
@@ -59,7 +61,9 @@ export const run = {
         'the answer alone and `2>/dev/null` hides the progress.',
         '',
         'A prompt always starts a new session, so --new is for the TUI, where the',
-        'alternative is being asked which session to continue.',
+        'alternative is being asked which session to continue. Its workspace is a',
+        'fresh, empty directory inside that session; to ask about the files where',
+        'you are, say --here.',
         '',
         '--input names a file holding the whole request - project, input, workspace,',
         'memory - and what it says wins over the same flag on the line. Its paths are',
@@ -98,6 +102,7 @@ export const run = {
         '  zen run                               open the TUI in this project',
         '  zen run acme                          open the TUI in the acme project',
         '  zen run "what changed?"               ask that, print the answer, exit',
+        '  zen run --here "what changed?"        ... about the files in this directory',
         '  git diff | zen run                    take the prompt from stdin',
         '  zen run "what changed?" > out.md      redirect the answer into a file',
         '  zen run --out out.md "what changed?"  write the answer to out.md only',
@@ -118,6 +123,7 @@ export const run = {
             new: { type: 'boolean' },
             input: { type: 'string' },
             workspace: { type: 'string' },
+            here: { type: 'boolean' },
             memory: { type: 'string' },
             'memory-read-only': { type: 'boolean' },
             model: { type: 'string' },
@@ -155,16 +161,20 @@ export const run = {
         if (values.theme !== undefined && !parseChoice(values.theme)) {
             throw usageError(`unknown theme: ${values.theme}`, 'dark, light or auto');
         }
+        if (values.here && values.workspace !== undefined) {
+            throw usageError('--here and --workspace both name the workspace', 'keep one');
+        }
         // With `--input -` the pipe carries the request, not the prompt, so it
         // is read here and never looked at again below.
         const request = values.input ? await readRequest(values.input, ctx.cwd, piped) : undefined;
         const prompt = typed || (request ? '' : (piped ?? ''));
         // A prompt on the command line is a request for an answer, not a
         // conversation to pick up. So it answers the three questions itself:
-        // a fresh session, the directory it was typed in as the workspace,
-        // and no confirmation for it — `zen run acme "what changed?"` should
-        // read the code that is right there. Every flag still wins, and the
-        // TUI, where there is someone to ask, still asks.
+        // a fresh session, a fresh directory inside it as the workspace, and
+        // no confirmation for any of it. Reading the files where it was typed
+        // takes --here: an agent that can write should not land in whatever
+        // directory the shell happened to be in. Every flag still wins, and
+        // the TUI, where there is someone to ask, still asks.
         const input = request ? request.input : prompt;
         const shot = Boolean(prompt) || Boolean(request);
         if (values.events && !shot) {
@@ -175,7 +185,8 @@ export const run = {
             project: request?.project ?? values.project ?? (named ? head : undefined),
             session: values.session,
             fresh: values.new || (shot && !values.session),
-            workspace: request?.workspace ?? values.workspace ?? (shot ? ctx.cwd : undefined),
+            workspace: request?.workspace ?? values.workspace ?? (values.here ? ctx.cwd : undefined),
+            ask: !shot,
             yes: values.yes || shot,
         });
         const engine = await Engine.open({
@@ -234,6 +245,7 @@ const NOT_IN_A_BATCH = [
     ['session', 'every item is a new session of its own'],
     ['new', 'every item is new already'],
     ['workspace', 'they cannot share one; each item gets its own, or names one in the file'],
+    ['here', 'they cannot share one; each item gets its own, or names one in the file'],
     ['plain', 'a batch never draws the TUI'],
     ['theme', 'a batch never draws the TUI'],
     ['events', 'each item already has its own output.json'],

package/dist/resolve.d.ts

@@ -5,6 +5,8 @@ export interface Wanted {
     session?: string;
     fresh?: boolean;
     workspace?: string;
+    /** false to take the session's own workspace without offering a choice */
+    ask?: boolean;
     yes?: boolean;
     cwd: string;
 }

package/dist/resolve.js

@@ -137,7 +137,7 @@ export async function chooseWorkspace(session, want) {
         await approve(at, session, want);
         return at;
     }
-    if (!term.isInteractive()) {
+    if (want.ask === false || !term.isInteractive()) {
         return own;
     }
     const chosen = await term.choose('Workspace — what the agent can read and write', [

package/dist/validate.d.ts

@@ -176,4 +176,15 @@ export interface ValidateOptions {
 }
 export declare function validateProject(opts: ValidateOptions): Promise<Report>;
 export declare function availableTools(root: string, config: ProjectConfig): AnyTool<unknown>[];
+/**
+ * Pins every `@zenera/*` install in the project's Dockerfile to this `zen`,
+ * which is what `zen check --fix` does about `sandbox.pin.stale` and
+ * `sandbox.pin.absent`. Only the version after each name is touched, and only
+ * on lines `checkPin` reads, so whatever else the file holds is left alone.
+ *
+ * Returns the project-relative path when the file was rewritten, and nothing
+ * when there is no Dockerfile, it resolves outside the project, or it already
+ * pins this version — a project that does not load is the report's to explain.
+ */
+export declare function repinDockerfile(root: string): string[];
 //# sourceMappingURL=validate.d.ts.map

package/dist/validate.js

@@ -1,8 +1,8 @@
 import { SHAPES, auditModels, credentialFor, envNames, form, resolveBuild, } from '@zenera/engine';
 import { EXA_GROUP, FileSkillProvider, SANDBOX_MOUNT, Sandbox, exaTools, fileTools, frontmatter, projectRegistry, readProjectConfig, sandboxTools, selectTools, toList, } from '@zenera/neo';
-import { existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { probeModels } from "./liveness.js";
 import { BuildError, ensurePodmanReady } from "./podman.js";
 import { ownVersion, staleShared } from "./scaffold.js";
@@ -1315,7 +1315,7 @@ function checkPin(path, rel, add) {
             }
         }
     }
-    const fix = `pin them to ${mine}, the version \`zen --version\` reports`;
+    const fix = `pin them to ${mine}, the version \`zen --version\` reports — \`zen check --fix\` does it`;
     if (stale.size > 0) {
         add({
             severity: 'warning',
@@ -1337,6 +1337,49 @@ function checkPin(path, rel, add) {
         });
     }
 }
+/**
+ * Pins every `@zenera/*` install in the project's Dockerfile to this `zen`,
+ * which is what `zen check --fix` does about `sandbox.pin.stale` and
+ * `sandbox.pin.absent`. Only the version after each name is touched, and only
+ * on lines `checkPin` reads, so whatever else the file holds is left alone.
+ *
+ * Returns the project-relative path when the file was rewritten, and nothing
+ * when there is no Dockerfile, it resolves outside the project, or it already
+ * pins this version — a project that does not load is the report's to explain.
+ */
+export function repinDockerfile(root) {
+    let rel;
+    try {
+        const ref = readProjectConfig(root).config.sandbox?.build?.dockerfile;
+        rel = ref === undefined ? undefined : normalise(root, ref);
+    }
+    catch {
+        return [];
+    }
+    if (rel === undefined) {
+        return [];
+    }
+    const path = join(root, rel);
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const mine = ownVersion();
+    const next = text
+        .split('\n')
+        .map((line) => /^\s*#/.test(line)
+        ? line
+        : line.replace(ZENERA_INSTALL, (_, name) => `@zenera/${name}@${mine}`))
+        .join('\n');
+    if (next === text) {
+        return [];
+    }
+    writeFileSync(path, next);
+    return [rel.split(sep).join('/')];
+}
 /** Written by the smoke test and read back, to prove the mount is real. */
 const SMOKE = 'zen-check';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.42",
+    "version": "1.1.43",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -54,9 +54,9 @@
         "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
         "@openrouter/sdk": "^1.4.25",
-        "@zenera/engine": "^1.1.42",
-        "@zenera/neo": "^1.1.42",
-        "@zenera/view": "^1.1.42",
+        "@zenera/engine": "^1.1.43",
+        "@zenera/neo": "^1.1.43",
+        "@zenera/view": "^1.1.43",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",

package/templates/editor/.github/prompts/spec-sync-project.prompt.md

@@ -127,8 +127,8 @@ the model to compute or remember. Specifically:
   the container is the same one that built it. An unpinned name drifts away from
   the host on the next image build; a stale pin leaves the container holding an
   older `zen` than the session outside it. `zen check` reports both, as
-  `sandbox.pin.absent` and `sandbox.pin.stale`, but will not repair either - the
-  Dockerfile is the project's file, so this edit is yours to make. The pin
+  `sandbox.pin.absent` and `sandbox.pin.stale`, and `zen check --fix` repairs
+  both by rewriting only the version after each `@zenera/*` name. The pin
   follows `zen --version` even when `SPECIFICATION.md` names another number.
   The `zen-spec-sync` skill gives the one question to raise in that case.
 

package/templates/editor/.github/skills/zen-cli/SKILL.md

@@ -70,7 +70,8 @@ guess a flag, and do not read them all.
 zen init                              scaffold a project here, pick a model
 zen check                             validate everything before spending a turn
 zen run                               the TUI
-zen run "what changed?"               one answer, this directory as the workspace
+zen run "what changed?"               one answer, in a fresh session directory
+zen run --here "what changed?"        ... about the files in this directory
 zen run batch --input cases.json      many questions at once, each isolated
 zen inspect --open                    what the model was actually given
 zen inspect graph --dir <run dir>     the same run as a graph you can read

package/templates/editor/.github/skills/zen-cli/references/check.md

@@ -55,7 +55,8 @@ checked too. A word that is neither is a usage error (exit 2), not a report.
   is written once, by `zen init`, and nothing rewrites it afterwards, so it falls
   behind the host on the next upgrade and the container ends up holding a
   different `zen` than the session outside it. Read rather than run, so this one
-  is reported with `--no-sandbox` too.
+  is reported with `--no-sandbox` too. `--fix` rewrites the pins to this `zen`'s
+  version and touches nothing else in the Dockerfile.
 
 ### Findings
 

package/templates/editor/.github/skills/zen-cli/references/run.md

@@ -16,6 +16,7 @@ answers once on stdout and exits.
 | `--new`                 | Start a new session rather than continuing one           |
 | `--input <file>`        | Read the whole request from JSON; `-` is stdin           |
 | `--workspace <dir>`     | What the agent may read and write                        |
+| `--here`                | `--workspace` with the directory you are in              |
 | `--memory <dir>`        | Where the agents remember into, instead of the project's |
 | `--memory-read-only`    | Recall from it; write nothing back                       |
 | `--model <ref>`         | Override the default model for this run                  |
@@ -270,7 +271,7 @@ question of what the agents know without changing what they know.
 
 ### What means nothing in a batch
 
-`--session`, `--new`, `--workspace`, `--plain` and `--theme` are refused by
+`--session`, `--new`, `--workspace`, `--here`, `--plain` and `--theme` are refused by
 name rather than ignored. Every item is a new session of its own, they cannot
 share a workspace, and a batch never draws the TUI.
 
@@ -297,11 +298,18 @@ git diff | zen run "summarise this diff"
 ## What a prompt on the command line implies
 
 A prompt is a request for an answer, not a conversation to pick up, so it
-answers the three questions itself: **a fresh session**, **the directory you are
-in** as the workspace, and **no confirmation**. Every flag still wins -
-`--session`, `--workspace` and `--read-only` override it - and the TUI, where
+answers the three questions itself: **a fresh session**, **a fresh, empty
+directory inside it** (`<session>/workspace/`) as the workspace, and **no
+confirmation**. To have it read and write the directory you are in, say
+`--here` (the same as `--workspace .`). Every flag still wins - `--session`,
+`--workspace`, `--here` and `--read-only` override it - and the TUI, where
 there is someone to ask, still asks.
 
+```
+zen run "draft a release note"            works in sessions/<id>/workspace/
+zen run --here "what changed?"            reads and writes the directory you are in
+```
+
 There is no `resume`. A session continues itself, because its state is what it
 is; `--session <id>` picks which one.