cursedops 0.19.1 → 0.19.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.19.1",
+	"version": "0.19.3",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/paths.ts

@@ -161,6 +161,13 @@ export function runGenerationLaws(from: string, options: LawsOptions = {}): numb
  * `scripts/paths.ts` rather than copy a thirteenth wrapper; this is the one place it lives now.
  * A gate that ran `check-paths` before scheduling its own `paths` stage would run it twice, and
  * would pass `--force` to a law that has no idea what it means.
+ *
+ * 🔴 A `--` ends this wrapper's flags: it and everything after it go to the law verbatim, because
+ * that is the command a law like `suite-once.ts` wraps. Reading past it took the inner
+ * `forge-paths --only timed.ts` of `forge-paths --only suite-once.ts browser-test -- forge-paths
+ * --only timed.ts browser-test -- bun test …` as this wrapper's, so the wrapped command became a bare
+ * `forge-paths` and the browser suite ran nothing and stamped green (forge task
+ * cursedops-forge-paths-takes-an-inner-only, 2026-10-23).
  */
 export function parseLawsArgv(argv: readonly string[]): { also: string[]; only: string[]; argv: string[] } {
 	const also: string[] = [];
@@ -168,6 +175,10 @@ export function parseLawsArgv(argv: readonly string[]): { also: string[]; only:
 	const rest: string[] = [];
 	for (let i = 0; i < argv.length; i++) {
 		const arg = argv[i] as string;
+		if (arg === "--") {
+			rest.push(...argv.slice(i));
+			break;
+		}
 		const flag = arg === "--also" ? also : arg === "--only" ? only : null;
 		if (flag) {
 			const next = argv[i + 1];

package/src/workerDeploy.ts

@@ -802,6 +802,23 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		return finish({ code: 1, step, detail, commit, dirty });
 	};
 	const step = (message: string): void => log(`\n▸ ${message}`);
+	/**
+	 * 🔴 The clean-tree refusal, asked again where production READS the tree (forge task 3601). It
+	 * was asked once, at the start — and the stage leg is minutes long. On 2026-10-23 the ship's
+	 * station lane passed it clean at 9ab4e676, deployed the stage clean, then built production from
+	 * a session's half-written edit landed in between: `build.json` stamped `9ab4e676 (dirty)`, and
+	 * only the asset budget stopped a production that would have reported one commit and run
+	 * another. So before the production build, and again before anything is uploaded, HEAD must
+	 * still be the commit stamped and the tree must still be clean.
+	 */
+	const moved = (during: string): DeployResult | null => {
+		if (spec.env !== "production") return null;
+		const head = deps.git(["rev-parse", "HEAD"]);
+		const now = deps.git(["status", "--porcelain"]);
+		if (head === commit && now.length === 0) return null;
+		const what = head !== commit ? `HEAD is now ${head.slice(0, 8) || "unreadable"}, not ${commit.slice(0, 8)}` : `it has uncommitted changes:\n${now}`;
+		return stop("tree-moved", `the tree moved ${during} — ${what}\nProduction would report ${commit.slice(0, 8)} and run something else, so nothing was deployed to it. Deploy again once the tree is still.`);
+	};
 	/** What passed under a CPU tail that never attached — decision 6 of the CPU check. */
 	const unmeasured: string[] = [];
 
@@ -879,6 +896,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 			else if (walked !== 0) return stop("stage", `\`${command.join(" ")}\` failed — production was NOT touched.`);
 		}
 	}
+	const beforeBuild = moved(spec.stageFirst?.length || spec.stageWalk?.length ? "while the stage deployed" : "before the build");
+	if (beforeBuild) return beforeBuild;
 	if (spec.build) {
 		step("build");
 		enter("build");
@@ -889,6 +908,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		const why = refusal();
 		if (why) return stop("refusal", `${why} — nothing was deployed.`);
 	}
+	const beforeUpload = moved("while it built");
+	if (beforeUpload) return beforeUpload;
 	const envArgs = wranglerEnvArgs(spec.env);
 	if (spec.databaseName) {
 		const schema = spec.schemaFile ?? "db/schema.sql";