pi-aia-asf 0.17.1 → 0.17.3

package/CHANGELOG.md

@@ -7,13 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.17.1] - 2026-11-07
+## [0.17.3] - 2026-11-07
 
 ### Added
 
-- (describe changes for 0.17.1)
+- (describe changes for 0.17.3)
+
+## [0.17.2] - 2026-11-07
+
+### Fixed — the tools were installed but never found
 
-## [0.17.0] - 2026-11-07
+0.17.1 declared the toolchain as dependencies and then looked for it in
+`<pi-aia-asf>/node_modules`, which does not exist in the layout pi installs: npm
+**hoists** a package's dependencies into the shared `node_modules` one level up.
+Every tool therefore read as missing, the gate fell back to a system `eslint` (v8,
+which rejects `--no-config-lookup`), and eight metrics came back as errors — the
+same blindness as before, with a different message.
+
+- Resolution now walks the real `node_modules` chain from ASF's package directory
+  upward, exactly as node resolves, so a hoisted install is found. `require.resolve`
+  is only a last resort: on Debian it escaped the install entirely and returned
+  `/usr/share/nodejs/eslint`.
+- Packages with no `main` field (jscpd) can never be found by `require.resolve`;
+  the directory walk finds them.
+- A regression test builds the hoisted layout on disk and asserts all five tools
+  resolve inside the install prefix, with ASF's copy winning over PATH.
+
+## [0.17.1] - 2026-11-07
 
 ### Added — the health gate ships its own toolchain
 

package/lib/code-health/tools.mjs

@@ -14,9 +14,10 @@
  *   3. PATH — a global install
  */
 
-import { existsSync, statSync } from "node:fs";
+import { existsSync, statSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
 
 /** ASF's package root (this file is <root>/lib/code-health/tools.mjs). */
 export const ASF_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
@@ -38,14 +39,66 @@ function isExecutable(p) {
   }
 }
 
-function findBin(base, name) {
-  const p = join(base, "node_modules", ".bin", name);
-  return isExecutable(p) ? p : null;
+/**
+ * Locate an installed package's root directory, the way node itself would.
+ *
+ * A literal `<base>/node_modules/<name>` check is wrong for the layout pi
+ * actually installs: npm HOISTS pi-aia-asf's dependencies into a shared
+ * node_modules one level up, so the package dir has no node_modules of its own
+ * and every tool looked missing — which silently fell through to a system eslint
+ * (v8, no flat config) and to eight skips again. require.resolve walks up the
+ * real module paths, so it finds the hoisted copy.
+ */
+function findPkgDir(base, name) {
+  // The ancestor walk comes FIRST: it is exactly node's own node_modules
+  // resolution, and require.resolve can escape the install entirely (a Debian
+  // NODE_PATH found /usr/share/nodejs/eslint before the copy that shipped with
+  // pi-aia-asf — the gate would then measure with eslint 8 and fail to run).
+  let dir2 = base;
+  for (let i = 0; i < 8; i++) {
+    const candidate = join(dir2, "node_modules", name);
+    if (existsSync(join(candidate, "package.json"))) {
+      try {
+        return { dir: candidate, meta: JSON.parse(readFileSync(join(candidate, "package.json"), "utf-8")) };
+      } catch { return { dir: candidate, meta: {} }; }
+    }
+    const up = dirname(dir2);
+    if (up === dir2) break;
+    dir2 = up;
+  }
+  try {
+    const req = createRequire(join(base, "package.json"));
+    let dir = dirname(req.resolve(name));
+    for (let i = 0; i < 6; i++) {
+      const pj = join(dir, "package.json");
+      if (existsSync(pj)) {
+        try {
+          const meta = JSON.parse(readFileSync(pj, "utf-8"));
+          if (meta.name === name) return { dir, meta };
+        } catch { /* keep walking */ }
+      }
+      const up = dirname(dir);
+      if (up === dir) break;
+      dir = up;
+    }
+  } catch { /* packages with no `main` (jscpd) cannot be resolved by name */ }
+  const literal = join(base, "node_modules", name);
+  if (existsSync(literal)) {
+    try {
+      return { dir: literal, meta: JSON.parse(readFileSync(join(literal, "package.json"), "utf-8")) };
+    } catch { return { dir: literal, meta: {} }; }
+  }
+  return null;
 }
 
-function findPkg(base, name) {
-  const p = join(base, "node_modules", name);
-  return existsSync(p) ? p : null;
+/** The executable a package declares in its own `bin` field. */
+function binFromPkg(found, binName) {
+  if (!found) return null;
+  const bin = found.meta?.bin;
+  const rel = typeof bin === "string" ? bin : bin?.[binName];
+  if (!rel) return null;
+  const p = join(found.dir, rel);
+  return isExecutable(p) ? p : null;
 }
 
 function findOnPath(name) {
@@ -67,9 +120,9 @@ function findOnPath(name) {
  *            bins:Record<string,string|null>, pkgs:Record<string,string|null>,
  *            sources:Record<string,string>}}
  */
-export function resolveTools(projectRoot) {
+export function resolveTools(projectRoot, { asfRoot = ASF_ROOT } = {}) {
   const bases = [
-    { dir: ASF_ROOT, source: "asf" },
+    { dir: asfRoot, source: "asf" },
     { dir: projectRoot, source: "project" },
   ];
   const bins = {};
@@ -80,7 +133,7 @@ export function resolveTools(projectRoot) {
     if (spec.bin) {
       bins[key] = null;
       for (const b of bases) {
-        const found = findBin(b.dir, spec.bin);
+        const found = binFromPkg(findPkgDir(b.dir, spec.pkg), spec.bin);
         if (found) {
           bins[key] = found;
           sources[key] = b.source;
@@ -98,9 +151,9 @@ export function resolveTools(projectRoot) {
     if (spec.pkg) {
       pkgs[key] = null;
       for (const b of bases) {
-        const found = findPkg(b.dir, spec.pkg);
+        const found = findPkgDir(b.dir, spec.pkg);
         if (found) {
-          pkgs[key] = found;
+          pkgs[key] = found.dir;
           if (!sources[key]) sources[key] = b.source;
           break;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-aia-asf",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "description": "Ai Applied Agentic Software Factory — codifies the full software development flow: intake, research, spec capture, adversarial analysis, planning with approval gates, test-first implementation, and release. Requires pi-vigilant, pi-smart-web-search, pi-smart-fetch, and pi-aia-browser.",
   "keywords": [
     "pi-package",