create-cadmo 0.4.1 → 0.4.2

package/LICENSE

@@ -0,0 +1,25 @@
+Cadmo — licensing
+
+The methodology and documentation in this repository (everything under docs/, templates/,
+and the Markdown files at the root, except where noted) are licensed under the
+
+    Creative Commons Attribution 4.0 International License (CC BY 4.0)
+    https://creativecommons.org/licenses/by/4.0/
+    Full legal code: https://creativecommons.org/licenses/by/4.0/legalcode
+
+You are free to share and adapt the material for any purpose, even commercially, provided you
+give appropriate credit, link to the license, and indicate if changes were made.
+
+Any source code added to this repository (scripts, CLI, tooling) is licensed under the MIT
+License unless a different license is stated in that file's directory:
+
+    MIT License — Copyright (c) 2026 Tiago Torres
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this
+    software and associated documentation files (the "Software"), to deal in the Software
+    without restriction, including without limitation the rights to use, copy, modify, merge,
+    publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+    to whom the Software is furnished to do so, subject to the above copyright notice and this
+    permission notice being included in all copies or substantial portions of the Software.
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
+
+The "Cadmo" name and marks are not licensed here — see TRADEMARK.md.

package/index.js

@@ -40,6 +40,24 @@ if (args.includes('--help') || args.includes('-h')) {
 
 const here = (...p) => path.join(__dirname, 'templates', ...p);
 const cwd = process.cwd();
+const VERSION = require('./package.json').version;
+
+// Every copied MECHANISM carries a sync marker (origin + version) — "which version
+// does this instance run?" must be answerable without diffing (the method's own
+// return-lane rule, applied to its own scaffolder).
+const MARKED = {
+  '.mjs': `// synced from create-cadmo@${VERSION} — files are never overwritten; for fixes, re-run \`npm create cadmo\` in a fresh dir and diff\n`,
+  '.yml': `# synced from create-cadmo@${VERSION} — files are never overwritten; for fixes, re-run \`npm create cadmo\` in a fresh dir and diff\n`,
+};
+function withSyncMarker(src, body) {
+  const marker = MARKED[path.extname(src)];
+  if (!marker) return body;
+  if (body.startsWith('#!')) {
+    const nl = body.indexOf('\n') + 1;
+    return body.slice(0, nl) + marker + body.slice(nl);
+  }
+  return marker + body;
+}
 
 const FILES = [
   ['AGENTS.md', 'AGENTS.md'],
@@ -77,7 +95,7 @@ for (const [src, dest] of plan) {
     console.log(`  ~ would create ${dest}`);
   } else {
     fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.copyFileSync(here(src), target);
+    fs.writeFileSync(target, withSyncMarker(src, fs.readFileSync(here(src), 'utf8')));
     console.log(`  + created   ${dest}`);
   }
   placed++;

package/package.json

@@ -1,37 +1,37 @@
-{
-  "name": "create-cadmo",
-  "version": "0.4.1",
-  "description": "Scaffold the Cadmo method into your project \u2014 a right-sized method for building software with AI as your pair.",
-  "keywords": [
-    "cadmo",
-    "create-cadmo",
-    "spec-driven-development",
-    "ai",
-    "methodology",
-    "framework",
-    "agents",
-    "claude",
-    "scaffold"
-  ],
-  "homepage": "https://github.com/tiagotorres91/cadmo",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tiagotorres91/cadmo.git"
-  },
-  "author": "Tiago Torres",
-  "license": "MIT",
-  "files": [
-    "index.js",
-    "templates/",
-    "README.md"
-  ],
-  "bin": {
-    "create-cadmo": "index.js"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "scripts": {
-    "test": "node --test"
-  }
-}
+{
+  "name": "create-cadmo",
+  "version": "0.4.2",
+  "description": "Scaffold the Cadmo method into your project — a right-sized method for building software with AI as your pair.",
+  "keywords": [
+    "cadmo",
+    "create-cadmo",
+    "spec-driven-development",
+    "ai",
+    "methodology",
+    "framework",
+    "agents",
+    "claude",
+    "scaffold"
+  ],
+  "homepage": "https://github.com/tiagotorres91/cadmo",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tiagotorres91/cadmo.git"
+  },
+  "author": "Tiago Torres",
+  "license": "(MIT AND CC-BY-4.0)",
+  "files": [
+    "index.js",
+    "templates/",
+    "README.md"
+  ],
+  "bin": {
+    "create-cadmo": "index.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test"
+  }
+}

package/templates/spec-drift.mjs

@@ -46,7 +46,7 @@ import { execFileSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { frontMatter, parseWatches as watchesOf, parseReviewed as reviewedOf, globToRegex } from './cadmo-grammar.mjs';
+import { parseWatches as watchesOf, parseReviewed as reviewedOf, globToRegex } from './cadmo-grammar.mjs';
 
 const BS = String.fromCharCode(92);
 const args = process.argv.slice(2);
@@ -64,12 +64,21 @@ function refExists(ref) {
   } catch { return false; }
 }
 function resolveBase() {
+  // the remote's declared default branch beats any name guess (main-only was a
+  // round-6 finding: a master/trunk repo silently fell through to HEAD~1)
+  try {
+    const ref = execFileSync('git', ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    const name = ref.replace('refs/remotes/', '');
+    if (name && refExists(name)) return name;
+  } catch { /* origin/HEAD not set */ }
   if (refExists('origin/main')) return 'origin/main';
+  if (refExists('origin/master')) return 'origin/master';
   let branch = '';
   try {
     branch = execFileSync('git', ['symbolic-ref', '--short', 'HEAD'], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
   } catch { /* detached HEAD */ }
   if (branch !== 'main' && refExists('main')) return 'main';
+  if (branch !== 'master' && refExists('master')) return 'master';
   if (refExists('HEAD~1')) return 'HEAD~1';
   return EMPTY_TREE;
 }
@@ -94,23 +103,24 @@ function* mdFiles(dir) {
 
 const readSpec = (file) => fs.readFileSync(file, 'utf8');
 
-// Add or update a top-level `reviewed:` key, preserving everything else
-// (including the file's EOL style — a CRLF file must not gain a lone LF line).
+// Add or update a top-level `reviewed:` key, preserving everything else —
+// including the file's EOL style. This edits the raw front-matter block in place
+// instead of splitting/re-joining lines: the join approach leaked lone LF/CR into
+// CRLF files (round-6 finding — the round-4 test covered CRLF in the WATCHED
+// files, not in the spec file receiving the stamp).
 function setReviewed(text, hash) {
   const eol = text.includes('\r\n') ? '\r\n' : '\n';
-  const parsed = frontMatter(text);
-  const rest = text.slice(parsed.end); // '\n---' … onwards
-  let lines = parsed.fm.split(/\r?\n/);
-  let found = false;
-  lines = lines.map((l) => {
-    if (/^reviewed:\s*/.test(l)) { found = true; return `reviewed: ${hash}`; }
-    return l;
-  });
-  if (!found) {
-    if (lines.length && lines[lines.length - 1] === '') lines[lines.length - 1] = `reviewed: ${hash}`;
-    else lines.push(`reviewed: ${hash}`);
+  const m = text.match(/^---\r?\n[\s\S]*?\r?\n---/);
+  if (!m) return text; // no front matter — caller already guards this
+  const block = m[0];
+  let newBlock;
+  if (/^reviewed:[^\r\n]*/m.test(block)) {
+    newBlock = block.replace(/^reviewed:[^\r\n]*/m, 'reviewed: ' + hash);
+  } else {
+    const close = block.match(/\r?\n---$/)[0];
+    newBlock = block.slice(0, block.length - close.length) + eol + 'reviewed: ' + hash + eol + '---';
   }
-  return '---' + lines.join(eol) + rest;
+  return newBlock + text.slice(block.length);
 }
 
 // --- reviewed-state hashing ---
@@ -172,10 +182,12 @@ if (STAMP) {
 
 // --- changed files vs base ---
 // The empty tree has no merge base, so it gets a two-dot diff; refs get three-dot.
+// --no-renames: a rename must surface BOTH sides — reporting only the destination
+// let `git mv src/a.js other/` escape a spec watching src/** (round-6 finding).
 const RANGE = BASE === EMPTY_TREE ? [BASE, 'HEAD'] : [`${BASE}...HEAD`];
 let changed;
 try {
-  changed = execFileSync('git', ['diff', '--name-only', ...RANGE], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })
+  changed = execFileSync('git', ['diff', '--name-only', '--no-renames', ...RANGE], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })
     .split('\n').filter(Boolean);
   if (!BASE_GIVEN) {
     console.log(`spec-drift: no --base given — diffing against ${BASE === EMPTY_TREE ? 'the empty tree (single-commit repo: the whole initial commit)' : BASE}.`);
@@ -187,6 +199,17 @@ try {
   process.exit(2);
 }
 
+// Uncommitted work counts too: /cadmo:done runs this guard BEFORE the commit —
+// a working-tree-only change reporting "in sync" was false safety (round-6 finding).
+// In CI the checkout is clean, so this adds nothing there.
+try {
+  const wt = execFileSync('git', ['status', '--porcelain', '--no-renames'], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })
+    .split('\n').filter(Boolean)
+    .map((l) => l.slice(3).trim())
+    .map((p) => (p.startsWith('"') && p.endsWith('"') ? p.slice(1, -1) : p));
+  for (const p of wt) if (p && !changed.includes(p)) changed.push(p);
+} catch { /* status unavailable — commit-range diff already covers CI */ }
+
 const specs = [];
 for (const f of mdFiles(ROOT)) {
   const text = readSpec(f);