cursedbelt-core 1.1.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "1.1.0",
+	"version": "1.2.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split \u2014 isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",
@@ -356,7 +356,7 @@
 	},
 	"dependencies": {
 		"@leeoniya/ufuzzy": "^1.0.19",
-		"cwip": "^3.0.2"
+		"cwip": "^4.1.0"
 	},
 	"peerDependencies": {
 		"zod": "^4.4.0"

package/src/leafSubpathsImportNothing.spec.ts

@@ -152,8 +152,10 @@ const sourceOf = (subpath: string): string => {
  * Resolution here is therefore explicit rather than inherited. The redirected root is
  * used when it lies outside the repo (the normal case — the runner always sets
  * `$FORGE_STATE`, and the preload's sweep then cleans up after a killed run). When it
- * does not, this hops to `$HOME`, which `resolveTestTmpRoot` refuses for the general
- * default and which this check genuinely requires: an isolated root is the whole
+ * does not, this hops to `$FORGE_STATE/test-scratch.noindex` — or, with no generation
+ * in the environment, `~/.code/test-scratch.noindex`, which is where this machine keeps
+ * everything it builds for itself. `resolveTestTmpRoot` refuses `$HOME` for the general
+ * default and this check genuinely requires an isolated root: that isolation is the whole
  * measurement. Stale siblings are swept by mtime, the same way the preload does it,
  * so the hop cannot accumulate.
  */
@@ -171,7 +173,17 @@ const fixtureRoot = (): string => {
         'a check that cannot isolate itself is not a passing check',
     );
   }
-  const outside = `${home}/.${pkg.name}-leaf-fixture.noindex`;
+  // 🔴 Under `$FORGE_STATE`, or under `~/.code` — never a dotted directory of its own in
+  // `$HOME`. Measured 2026-09-17: this hop had left three `~/.cursedbelt*-leaf-fixture.noindex`
+  // trees in the owner's home directory, indistinguishable at a glance from the forty a Mac's
+  // real software puts there, and the sweep below only ever cleaned their INSIDES. A check that
+  // tidies up after itself and still leaves its address behind for ever is the shape this
+  // generation's home-dir rule exists to stop; `tools/check-home-dir.ts` now fails on it.
+  const state = process.env.FORGE_STATE?.trim();
+  const outside =
+    state !== undefined && state !== '' && !`${state}/`.startsWith(REPO_PREFIX)
+      ? `${state}/test-scratch.noindex/${pkg.name}-leaf-fixture`
+      : `${home}/.code/test-scratch.noindex/${pkg.name}-leaf-fixture`;
   try {
     const cutoff = Date.now() - 6 * 60 * 60 * 1000;
     for (const entry of readdirSync(outside)) {

package/src/shippedFilesAreTracked.spec.ts

@@ -0,0 +1,69 @@
+/**
+ * 🔴 `bun publish` packs the WORKING DIRECTORY, not the git index — so a package can
+ * ship a file the repo does not have.
+ *
+ * ── What this cost, 2026-09-15 ─────────────────────────────────────────────────────
+ * The cursedbelt split (task 148) moved two integration specs into this package from
+ * `cursedbelt`. `git add -u .` stages only files git already knows about, so both were
+ * committed nowhere — and `bun run verify` was green *because they were present on disk*,
+ * which is the same reason nobody noticed. `1.0.2` went to the registry carrying two
+ * `src/` files that existed in no commit, and `git status` said `tracked-dirty=0`.
+ *
+ * "The tree is clean" and "everything that ships is committed" are different claims, and
+ * only the first one is what people actually check. npm versions are immutable, so the
+ * window to notice closes at publish time.
+ *
+ * ── Why this shape ─────────────────────────────────────────────────────────────────
+ * It asks git, for exactly the directories `package.json#files` promises to ship, which
+ * of those paths git does not track. That is narrower than "any untracked file" on
+ * purpose: scratch files, `.agent.noindex/`, a half-written script and an uncommitted
+ * lockfile are all legitimate states for a working tree and reddening on them would teach
+ * people to skip this. A file INSIDE the published surface is the only case where
+ * untracked means "about to ship something no one can review or revert".
+ *
+ * 🔴 It must run from a real checkout to mean anything, so it refuses rather than passes
+ * when `git` cannot answer — a check that silently degrades to green is worse than none.
+ */
+import { describe, expect, test } from 'bun:test';
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import pkg from '../package.json';
+
+const repoRoot = fileURLToPath(new URL('..', import.meta.url));
+
+/** The directories `files` promises to ship, minus build output nobody commits. */
+const shippedDirs = (): string[] =>
+	((pkg as { files?: string[] }).files ?? []).filter((f) => f !== 'dist' && existsSync(`${repoRoot}/${f}`));
+
+const git = (...args: string[]): { ok: boolean; out: string } => {
+	const r = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });
+	return { ok: r.status === 0, out: (r.stdout ?? '').trim() };
+};
+
+describe('every file inside the published surface is tracked', () => {
+	test('git can answer at all — a degraded check must refuse, not pass', () => {
+		expect(git('rev-parse', '--is-inside-work-tree').ok, 'not a git checkout, so this check proves nothing').toBe(true);
+	});
+
+	test('package.json names a shippable directory to scan', () => {
+		// Vacuity guard: an empty `files`, or one naming only `dist`, makes the assertion
+		// below pass while scanning nothing at all.
+		expect(shippedDirs().length, '`files` names no committed directory — nothing would be scanned').toBeGreaterThan(0);
+	});
+
+	test('no untracked file sits inside a directory `files` ships', () => {
+		// --others = untracked; --exclude-standard honours .gitignore, so deliberately
+		// ignored paths (.agent.noindex, node_modules) are not offences.
+		const { ok, out } = git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
+		expect(ok, 'git ls-files failed').toBe(true);
+		const untracked = out === '' ? [] : out.split('\n');
+		expect(
+			untracked,
+			'these would be PUBLISHED but exist in no commit — `bun publish` packs the working directory, not the index,\n' +
+				'so the registry would carry code nobody can review, diff or revert, and npm versions are immutable.\n' +
+				'Commit them (or add them to .gitignore if they genuinely must not ship):\n  ' +
+				untracked.join('\n  '),
+		).toEqual([]);
+	});
+});