create-cmp-cli 0.14.0 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-cmp-cli",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Create production mobile apps (Android + iOS, one Kotlin codebase) with AI \u2014 the delivery harness for Compose Multiplatform, the current generation of cross-platform (Google-backed KMP, iOS stable since May 2025). A deterministic, non-interactive generator that scaffolds a green-building app in minutes, then holds AI-driven changes to a machine-enforced verify lane with a committed evidence receipt. Every app carries a device-free UI preview loop (real screens rendered headlessly on save; changed-screen attribution and compile-error surfacing for coding agents, a live gallery for humans) plus agent-first docs (CLAUDE.md + AGENTS.md). Installs the `create-cmp` command.",
   "type": "module",
   "bin": {

package/packages/harness/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-cmp-harness",
-  "version": "0.14.0",
-  "description": "The create-cmp verify lane — the machine-owned harness code every stamped app carries byte-identical: evidence receipts, spec coverage, approvals, conformance reporting, golden trees, a11y, and the preview/inspector libs. Dependency-free ESM, vendored into each generated project so the lane runs offline with no install step, and content-hashed so a receipt can name the exact lane that issued it.",
+  "version": "0.14.1",
+  "description": "The create-cmp verify lane \u2014 the machine-owned harness code every stamped app carries byte-identical: evidence receipts, spec coverage, approvals, conformance reporting, golden trees, a11y, and the preview/inspector libs. Dependency-free ESM, vendored into each generated project so the lane runs offline with no install step, and content-hashed so a receipt can name the exact lane that issued it.",
   "type": "module",
   "main": "src/verify.mjs",
   "exports": {

package/packages/harness/src/verify.mjs

@@ -93,6 +93,14 @@ Flags:
                                   with --profile ci (or release) it runs
                                   inside the lane and lands on the receipt.
                                   Never combinable with --fast
+  --no-journal                   skip the qa/flight-recorder.jsonl append.
+                                  qa/watch.mjs passes this on every
+                                  save-triggered run: journalling each save
+                                  would add hundreds of committed lines a day
+                                  and leave a permanently dirty tree inside
+                                  the loop the recorder exists to observe. The
+                                  gap is disclosed in the retrospective's own
+                                  output
   --json                         print the receipt as JSON instead of the
                                   human-readable step-by-step log
   --help, -h                     print this usage and exit 0 without
@@ -116,7 +124,13 @@ if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
   process.exit(0);
 }
 
-const RECOGNIZED_FLAGS = new Set(["--profile", "--json", "--fast", "--determinism"]);
+// Every flag this file CONSUMES must be listed here, or the strict check below
+// rejects it. `--no-journal` was consumed but unlisted in 0.13.0, which meant
+// qa/watch.mjs — whose spawn passes exactly these flags — exited 2 on every
+// save without ever running the lane. test/verify-flags.test.mjs now pins
+// consumed ⊆ recognized and watch's spawn ⊆ recognized so the class cannot
+// recur.
+const RECOGNIZED_FLAGS = new Set(["--profile", "--json", "--fast", "--determinism", "--no-journal"]);
 for (let i = 0; i < rawArgs.length; i += 1) {
   const arg = rawArgs[i];
   if (arg === "--profile") {

package/src/commands/upgrade.mjs

@@ -43,7 +43,8 @@ import { consent } from "../bootstrap/exec.mjs";
 import { loadRegistry, latestSet, getSet } from "../lib/registry.mjs";
 import { planUpgrade, BACKUP_SUFFIX } from "../lib/upgrade.mjs";
 import { writeHarnessLock, checkHarnessIntegrity, describeIntegrity } from "../../packages/harness/src/lib/harness-lock.mjs";
-import { LOCAL_PATCH_PATH } from "../lib/harness-upgrade.mjs";
+import { LOCAL_PATCH_PATH, stampBaseWith } from "../lib/harness-upgrade.mjs";
+import { buildTokenMap } from "../lib/tokens.mjs";
 import {
   planHarnessUpgrade,
   applyHarnessPlan,
@@ -341,11 +342,28 @@ async function harnessPlanAndApply({ flags, record, projectDir, targetDir, tmpRo
     templateDir: baseTemplateDir,
     verify: false,
   });
-  const plan = planHarnessUpgrade({ baseDir, newDir, projectDir });
+  // Engines before 0.14.0 ran lane code through the token stamper, so an app
+  // stamped by one carries `Fuelled` where the base template says
+  // `__APP_NAME__`. Without this the migration would report the engine's own
+  // substitution as if the app had forked the lane.
+  const plan = planHarnessUpgrade({
+    baseDir,
+    newDir,
+    projectDir,
+    stampBase: stampBaseWith(buildTokenMap(configFromSpecRecord(record, projectDir))),
+  });
 
   const anythingToDo = printHarnessReport(plan);
   if (!anythingToDo) {
     ok("Engine-owned files are fully up to date — nothing to apply.");
+    // Still advance the record. An app that is ALREADY at the new engine is as
+    // upgraded as it can be, and leaving engineVersion stale here would keep
+    // the very defect this write-back exists to fix: the next run would fetch
+    // an obsolete merge base and re-litigate changes that already landed. Not
+    // on a dry run — that promises to write nothing.
+    if (flags["dry-run"] !== true && writeBackEngineVersion(projectDir, currentVersion)) {
+      ok(`create-cmp.json engineVersion → ${colors.bold(currentVersion)}`);
+    }
     return 0;
   }
 

package/src/lib/harness-upgrade.mjs

@@ -40,7 +40,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 
 import { listFiles } from "./fsutil.mjs";
-import { isBinaryPath } from "./tokens.mjs";
+import { isBinaryPath, replaceTokens } from "./tokens.mjs";
 import { BACKUP_SUFFIX } from "./upgrade.mjs";
 import { isHarnessFile } from "../../packages/harness/src/lib/harness-region.mjs";
 
@@ -178,6 +178,23 @@ export function mergeThreeWay(theirs, base, next) {
  *        null when the path is in neither base nor new (app-authored — invisible)
  */
 
+
+/**
+ * A `stampBase` function for an app's recorded config — reproduces what a
+ * pre-0.14.0 engine would have written into that app's lane, so a file the
+ * stamper touched is not mistaken for a local edit. Binary-safe: content that
+ * does not round-trip through UTF-8 is returned unchanged.
+ * @param {Array<[string,string]>} tokenMap from buildTokenMap(config)
+ * @returns {(base: Buffer) => Buffer}
+ */
+export function stampBaseWith(tokenMap) {
+  return (base) => {
+    const text = base.toString("utf8");
+    if (!Buffer.from(text, "utf8").equals(base)) return base;
+    return Buffer.from(replaceTokens(text, tokenMap), "utf8");
+  };
+}
+
 /** Where a preserved local patch to machine-owned lane code is written. */
 export const LOCAL_PATCH_PATH = "qa/harness-local.patch";
 
@@ -253,7 +270,7 @@ export function diffPatch(base, theirs, relPath) {
  * @param {Function} [params.merge] injectable three-way merge (classifier only)
  * @returns {{bucket:string, write:Buffer|null, sidecar:null, remove:boolean, patch?:string}|null}
  */
-export function decideRegionFile({ relPath, base, next, theirs, merge = mergeThreeWay }) {
+export function decideRegionFile({ relPath, base, next, theirs, merge = mergeThreeWay, stampBase = null }) {
   const eq = (a, b) => a !== null && b !== null && a.equals(b);
   const replace = (bucket, extra = {}) => ({
     bucket,
@@ -274,6 +291,19 @@ export function decideRegionFile({ relPath, base, next, theirs, merge = mergeThr
   if (base === null) return replace("region-patched", { patch: "" }); // no base to diff against
   if (eq(theirs, base)) return replace("region-clean");
 
+  // The app's copy may be what its OWN engine produced rather than what the
+  // base tree holds, because engines before 0.14.0 ran lane code through the
+  // token stamper. Such an app carries `Fuelled` where the base template says
+  // `__APP_NAME__` — a difference the engine created, not the app. Asking
+  // "does this match the base as THIS app would have had it stamped?" is the
+  // accurate form of "did the app never touch it", and it needs no version
+  // comparison: for a 0.14.0+ base there is nothing left to stamp, so the
+  // check simply never fires.
+  if (stampBase !== null) {
+    const asStamped = stampBase(base);
+    if (eq(theirs, asStamped)) return replace("region-clean");
+  }
+
   // The app edited lane code. Is that edit already carried by the new engine?
   // A clean three-way merge landing exactly on `next` means the local change
   // contributed nothing beyond it — the hand-mirror case.
@@ -283,10 +313,10 @@ export function decideRegionFile({ relPath, base, next, theirs, merge = mergeThr
   return replace("region-patched", { patch: diffPatch(base, theirs, relPath) });
 }
 
-export function decideFile({ relPath, base, next, theirs, merge = mergeThreeWay }) {
+export function decideFile({ relPath, base, next, theirs, merge = mergeThreeWay, stampBase = null }) {
   // Machine-owned lane files answer a different question — see decideRegionFile.
   if (isHarnessFile(relPath) && !(base === null && next === null)) {
-    return decideRegionFile({ relPath, base, next, theirs, merge });
+    return decideRegionFile({ relPath, base, next, theirs, merge, stampBase });
   }
   const none = (bucket) => ({ bucket, write: null, sidecar: null, remove: false });
   const write = (bucket, content) => ({ bucket, write: content, sidecar: null, remove: false });
@@ -355,7 +385,7 @@ function toRel(root, abs) {
  *            sidecar?:Buffer|null, remove?:boolean}>,
  *            counts: Record<string, number>}}
  */
-export function planHarnessUpgrade({ baseDir, newDir, projectDir, merge = mergeThreeWay }) {
+export function planHarnessUpgrade({ baseDir, newDir, projectDir, merge = mergeThreeWay, stampBase = null }) {
   const rels = new Set();
   for (const f of listFiles(baseDir)) rels.add(toRel(baseDir, f));
   for (const f of listFiles(newDir)) rels.add(toRel(newDir, f));
@@ -390,6 +420,7 @@ export function planHarnessUpgrade({ baseDir, newDir, projectDir, merge = mergeT
       next: readIfPresent(newDir, relPath),
       theirs: readIfPresent(projectDir, relPath),
       merge,
+      stampBase,
     });
     if (decision === null) continue;
     counts[decision.bucket] = (counts[decision.bucket] ?? 0) + 1;

package/template/qa/verify.mjs

@@ -93,6 +93,14 @@ Flags:
                                   with --profile ci (or release) it runs
                                   inside the lane and lands on the receipt.
                                   Never combinable with --fast
+  --no-journal                   skip the qa/flight-recorder.jsonl append.
+                                  qa/watch.mjs passes this on every
+                                  save-triggered run: journalling each save
+                                  would add hundreds of committed lines a day
+                                  and leave a permanently dirty tree inside
+                                  the loop the recorder exists to observe. The
+                                  gap is disclosed in the retrospective's own
+                                  output
   --json                         print the receipt as JSON instead of the
                                   human-readable step-by-step log
   --help, -h                     print this usage and exit 0 without
@@ -116,7 +124,13 @@ if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
   process.exit(0);
 }
 
-const RECOGNIZED_FLAGS = new Set(["--profile", "--json", "--fast", "--determinism"]);
+// Every flag this file CONSUMES must be listed here, or the strict check below
+// rejects it. `--no-journal` was consumed but unlisted in 0.13.0, which meant
+// qa/watch.mjs — whose spawn passes exactly these flags — exited 2 on every
+// save without ever running the lane. test/verify-flags.test.mjs now pins
+// consumed ⊆ recognized and watch's spawn ⊆ recognized so the class cannot
+// recur.
+const RECOGNIZED_FLAGS = new Set(["--profile", "--json", "--fast", "--determinism", "--no-journal"]);
 for (let i = 0; i < rawArgs.length; i += 1) {
   const arg = rawArgs[i];
   if (arg === "--profile") {

package/template/.gradle/buildOutputCleanup/cache.properties

@@ -1,2 +0,0 @@
-#Mon Jul 06 18:20:40 WAT 2026
-gradle.version=8.11.1