mandrel 2.15.0 → 2.17.0

package/lib/cli/version-helpers.js

@@ -16,6 +16,13 @@
  * Builtins only — this module is imported from both the CLI surface
  * (`lib/cli/`) and the doctor registry which runs before third-party
  * packages are guaranteed to be present.
+ *
+ * The two filesystem-touching helpers below take the module's injectable
+ * seam as their optional final `fsImpl` parameter, defaulting to the real
+ * `node:fs` (`.agents/rules/test-seams.md` rules 1-2);
+ * `resolveConsumerPinVersion` forwards that seam to
+ * `resolveConsumerPinSpec` rather than re-acquiring `fs` itself (rule 4).
+ * Every other export here is pure, so it needs no seam of its own.
  */
 
 import nodeFs from 'node:fs';

package/lib/migrations/steps/2.2.0-retire-epic-ac-tags.js

@@ -40,10 +40,11 @@ const TAG_LINE_RE = /^(\s*)(@\S+(?:\s+@\S+)*)\s*$/;
  * Recursively collect `.feature` file paths under `root`.
  *
  * @param {string} root
- * @param {typeof nodeFs} fsImpl
+ * @param {typeof nodeFs} [fsImpl] Filesystem seam; defaults to the real
+ *   `node:fs` per `.agents/rules/test-seams.md` rule 1.
  * @returns {string[]}
  */
-function collectFeatureFiles(root, fsImpl) {
+function collectFeatureFiles(root, fsImpl = nodeFs) {
   /** @type {string[]} */
   const found = [];
   /** @type {string[]} */
@@ -71,11 +72,13 @@ function collectFeatureFiles(root, fsImpl) {
 
 /**
  * @param {unknown} ctx
- * @param {typeof nodeFs} fsImpl
+ * @param {typeof nodeFs} [fsImpl] Filesystem seam; forwarded to
+ *   {@link collectFeatureFiles} rather than re-acquired there
+ *   (`.agents/rules/test-seams.md` rule 4).
  * @returns {string[]} Absolute paths of every `.feature` file under the
  *   canonical feature roots that exist in the consumer tree.
  */
-function resolveFeatureFiles(ctx, fsImpl) {
+function resolveFeatureFiles(ctx, fsImpl = nodeFs) {
   const projectRoot = ctx?.projectRoot ?? process.cwd();
   return CANONICAL_FEATURE_ROOTS.flatMap((root) =>
     collectFeatureFiles(path.join(projectRoot, root), fsImpl),
@@ -119,10 +122,12 @@ export const retireEpicAcTags = {
     '(their reconciler consumer was deleted in the v2 Epic removal)',
   /**
    * @param {{ projectRoot?: string, fs?: typeof nodeFs }} [ctx]
+   * @param {typeof nodeFs} [fsImpl] Optional final filesystem seam; defaults
+   *   to `ctx.fs` when the migration runner threads one, else the real
+   *   `node:fs` (`.agents/rules/test-seams.md` rule 1).
    * @returns {boolean}
    */
-  detect(ctx) {
-    const fsImpl = ctx?.fs ?? nodeFs;
+  detect(ctx, fsImpl = ctx?.fs ?? nodeFs) {
     return resolveFeatureFiles(ctx, fsImpl).some((file) => {
       try {
         return EPIC_AC_TAG_RE.test(fsImpl.readFileSync(file, 'utf8'));
@@ -133,10 +138,12 @@ export const retireEpicAcTags = {
   },
   /**
    * @param {{ projectRoot?: string, fs?: typeof nodeFs }} [ctx]
+   * @param {typeof nodeFs} [fsImpl] Optional final filesystem seam; defaults
+   *   to `ctx.fs` when the migration runner threads one, else the real
+   *   `node:fs` (`.agents/rules/test-seams.md` rule 1).
    * @returns {void}
    */
-  apply(ctx) {
-    const fsImpl = ctx?.fs ?? nodeFs;
+  apply(ctx, fsImpl = ctx?.fs ?? nodeFs) {
     for (const file of resolveFeatureFiles(ctx, fsImpl)) {
       /** @type {string} */
       let content;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.15.0",
+  "version": "2.17.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",
@@ -110,6 +110,10 @@
       "optional": true
     }
   },
+  "//": {
+    "overrides.js-yaml": "COUPLED to devDependencies.markdownlint-cli2 — do not bump either alone, and do NOT drop this override. It is load-bearing: markdownlint-cli2 0.22.x pulls js-yaml 4.1.1, which carries GHSA-52cp-r559-cp3m (high) and GHSA-h67p-54hq-rp68 (moderate); removing the override was measured to reintroduce both (1 high + 1 moderate), while with it in place `npm audit` is clean. An npm override also wins over a transitive package's own pin, so this tree-wide ^4.2.0 is imposed on every js-yaml consumer regardless of what they declare — and markdownlint-cli2 0.23.x declares an exact js-yaml 5.2.1. A dry-run bump confirmed the trap: markdownlint-cli2 0.23.1 resolves against js-yaml 4.3.0, two majors off what it declares, silently. The only safe move is to raise this override and bump markdownlint-cli2 in ONE reviewed commit (first confirming cosmiconfig, under @commitlint/cli, tolerates the same major). renovate.json excludes markdownlint-cli2 from devDependency auto-merge so that pair cannot drift apart unattended.",
+    "dependencies.js-yaml": "States the SAME range as overrides.js-yaml above. The two are deliberate duplicates — npm has no way to reference the direct range from the overrides block — so they MUST move in lockstep; changing one without the other silently splits the direct and transitive resolutions."
+  },
   "overrides": {
     "js-yaml": "^4.2.0",
     "markdown-it": "^14.2.0"