amorphous-cli 0.3.9 → 0.3.11

package/lib/agent-contract.test.mjs

@@ -54,6 +54,8 @@ test('setup copies the skill, and an edited contract is left alone', () => {
   assert.match(skill, /View members can open the live abstract and load its guides/)
   assert.match(skill, /Use members can use the live abstract and submit source recommendations/)
   assert.match(skill, /Only owners and editors can pull and edit source/)
+  assert.match(skill, /Only push, preview, publish, invite, or notify when the person asks for that action/i)
+  assert.match(skill, /Use `publish --live` only when they explicitly ask to make the version live/i)
   assert.match(skill, /visibility anyone/i)
   assert.match(skill, /anyone can add shared records/i)
   assert.match(skill, /Do not run context again during this task/)

package/lib/config.mjs

@@ -1,16 +1,46 @@
 import { readFileSync, existsSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join, relative, resolve, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
-export function loadDotEnv(cwd = process.cwd()) {
+const CLI_PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+
+function isWithin(root, path) {
+  const fromRoot = relative(resolve(root), resolve(path))
+  return fromRoot === '' || (fromRoot !== '..' && !fromRoot.startsWith(`..${sep}`))
+}
+
+function localRepositoryRoot(packageRoot) {
+  const root = resolve(packageRoot, '..')
+  try {
+    const appPackage = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+    const cliPackage = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'))
+    if (appPackage.name === 'amorphous' && cliPackage.name === 'amorphous-cli' && resolve(root, 'cli') === resolve(packageRoot)) {
+      return root
+    }
+  } catch {
+    /* The published CLI has no enclosing Amorphous app repository. */
+  }
+  return null
+}
+
+export function loadDotEnv(cwd = process.cwd(), options = {}) {
+  const packageRoot = options.packageRoot || CLI_PACKAGE_ROOT
+  const explicitRoot = options.amorphousRoot ?? process.env.AMORPHOUS_ROOT
   const roots = []
-  if (process.env.AMORPHOUS_ROOT) roots.push(process.env.AMORPHOUS_ROOT)
-  let dir = cwd
-  for (let i = 0; i < 8; i++) {
-    roots.push(dir)
-    const parent = join(dir, '..')
-    if (parent === dir) break
-    dir = parent
+  if (explicitRoot) {
+    roots.push(explicitRoot)
+  } else {
+    const repoRoot = localRepositoryRoot(packageRoot)
+    if (!repoRoot || !isWithin(repoRoot, cwd)) return
+    let dir = resolve(cwd)
+    for (let i = 0; i < 8; i++) {
+      roots.push(dir)
+      if (dir === repoRoot) break
+      const parent = dirname(dir)
+      if (parent === dir || !isWithin(repoRoot, parent)) break
+      dir = parent
+    }
   }
   for (const base of roots) {
     const path = join(base, '.env')

package/lib/config.test.mjs

@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { loadDotEnv } from './config.mjs'
+
+function withEnv(values, run) {
+  const previous = Object.fromEntries(Object.keys(values).map((name) => [name, process.env[name]]))
+  for (const [name, value] of Object.entries(values)) {
+    if (value === undefined) delete process.env[name]
+    else process.env[name] = value
+  }
+  try {
+    return run()
+  } finally {
+    for (const [name, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[name]
+      else process.env[name] = value
+    }
+  }
+}
+
+test('published CLI ignores an unrelated project .env by default', () => {
+  const root = mkdtempSync(join(tmpdir(), 'amorphous-config-'))
+  const project = join(root, 'project')
+  const packageRoot = join(root, 'npm-cache', 'amorphous-cli')
+  mkdirSync(project, { recursive: true })
+  mkdirSync(packageRoot, { recursive: true })
+  writeFileSync(join(project, '.env'), 'APP_ORIGIN=https://amorphous.test\n')
+
+  try {
+    withEnv({ APP_ORIGIN: undefined, AMORPHOUS_ROOT: undefined }, () => {
+      loadDotEnv(project, { packageRoot })
+      assert.equal(process.env.APP_ORIGIN, undefined)
+    })
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('repository source CLI loads the repository .env for local development', () => {
+  const root = mkdtempSync(join(tmpdir(), 'amorphous-config-'))
+  const cliRoot = join(root, 'cli')
+  mkdirSync(cliRoot, { recursive: true })
+  writeFileSync(join(root, 'package.json'), JSON.stringify({ name: 'amorphous' }))
+  writeFileSync(join(cliRoot, 'package.json'), JSON.stringify({ name: 'amorphous-cli' }))
+  writeFileSync(join(root, '.env'), 'APP_ORIGIN=https://amorphous.test\n')
+
+  try {
+    withEnv({ APP_ORIGIN: undefined, AMORPHOUS_ROOT: undefined }, () => {
+      loadDotEnv(root, { packageRoot: cliRoot })
+      assert.equal(process.env.APP_ORIGIN, 'https://amorphous.test')
+    })
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('AMORPHOUS_ROOT explicitly opts a published CLI into a local .env', () => {
+  const root = mkdtempSync(join(tmpdir(), 'amorphous-config-'))
+  const project = join(root, 'project')
+  const localRoot = join(root, 'local-app')
+  const packageRoot = join(root, 'npm-cache', 'amorphous-cli')
+  mkdirSync(project, { recursive: true })
+  mkdirSync(localRoot, { recursive: true })
+  mkdirSync(packageRoot, { recursive: true })
+  writeFileSync(join(localRoot, '.env'), 'APP_ORIGIN=https://amorphous.test\n')
+
+  try {
+    withEnv({ APP_ORIGIN: undefined, AMORPHOUS_ROOT: undefined }, () => {
+      loadDotEnv(project, { packageRoot, amorphousRoot: localRoot })
+      assert.equal(process.env.APP_ORIGIN, 'https://amorphous.test')
+    })
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amorphous-cli",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "mcpName": "io.github.amorphous-one/amorphous",
   "description": "Make whatever you want, yourself, with your own agent, or with others.",
   "type": "module",

package/skill/amorphous/SKILL.md

@@ -36,11 +36,11 @@ A private record belongs to the signed-in person who wrote it. The abstract does
 
 After `setup`, invite them to describe what they want made. Build it for them.
 Prefer `amorphous-cli serve` while you edit. Open the URL and leave it running. It reloads when the files change, and it is the easiest way for them to look at the work.
-They tell you when to push, preview, publish, or invite. Do those when they ask.
+Only push, preview, publish, invite, or notify when the person asks for that action. Use `publish --live` only when they explicitly ask to make the version live.
 
 ## Start
 
-Run CLI commands as `npx --yes amorphous-cli@latest <command>`; this uses the latest CLI without a global install. The command examples below abbreviate that prefix as `amorphous-cli`. If a command prints `Run: npx --yes amorphous-cli@latest setup`, run that line, then repeat the command. If you are not signed in, run `npx --yes amorphous-cli@latest login`. Show the person the link it prints and ask them to finish in the browser. Do not ask for an email or a code.
+Run CLI commands as `npx --yes amorphous-cli@latest <command>`; this uses the latest CLI without a global install. The published CLI ignores `.env` files in the current project and uses the hosted app. To explicitly use local settings, set `AMORPHOUS_ROOT` to the local Amorphous repo root. The command examples below abbreviate that prefix as `amorphous-cli`. If a command prints `Run: npx --yes amorphous-cli@latest setup`, run that line, then repeat the command. If you are not signed in, run `npx --yes amorphous-cli@latest login`. Show the person the link it prints and ask them to finish in the browser. Do not ask for an email or a code.
 
 Then choose the path that matches the request:
 
@@ -61,7 +61,7 @@ When they ask:
 - `amorphous-cli push` sends the source. `amorphous-cli push --data` also sends the records in this folder.
 - `amorphous-cli guide save abstract` explicitly saves changes to the shared guide (owner/editor only). `amorphous-cli guide save private` explicitly saves this signed-in person's private guide. A stale revision is refused; reload context and resolve the conflict before saving. Ordinary `push`, `recommend`, and `publish` never save or include either guide.
 - `amorphous-cli preview` and open that URL.
-- `amorphous-cli publish --live`
+- `amorphous-cli publish` creates a version. Add `--live` only when they explicitly ask to make that version live.
 - Collaborators who should propose source for the owner to review can use `amorphous-cli recommend --note "..."`. It does not change the live abstract; the owner reviews and chooses Publish live or Decline.
 - `amorphous-cli invite <email> use` or `edit` or `view`. It emails them a link and prints that link. They open it and sign in with that email.
 - `amorphous-cli notify` emails members that the published version changed. It does not publish. Do that only when they ask.