pi-usereq 0.47.0 → 0.49.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.49.0](https://github.com/Ogekuri/PI-useReq/compare/v0.48.0..v0.49.0) - 2026-07-13
+### 🚜  Changes
+- Reorder command summary: Configuration before User's Request [useReq] *(prompts)*
+  - Move the User's Request line after the Configuration block in the bundled prompt-backed command invocation summary so sections render as Command, Configuration, then User's Request, each separated by one blank line. Add REQ-353 and TST-131, update renderPromptCommandSummary in src/core/prompts.ts, and regenerate REFERENCES.md.
+
+## [0.48.0](https://github.com/Ogekuri/PI-useReq/compare/v0.47.0..v0.48.0) - 2026-07-13
+### 🐛  Bug Fixes
+- approve scripts at correct install root [useReq] *(install-static-checkers)*
+  - getConsumerInstallRoot preferred INIT_CWD over npm_config_local_prefix.
+  - pi runs 'npm install --prefix <root>' from its own cwd, so INIT_CWD is the
+  - caller cwd, not the install root; the allowScripts approval was written to
+  - the wrong project (or nowhere) and 'npm warn allow-scripts' persisted on
+  - every 'pi update --extensions'.
+  - Swap priority to prefer npm_config_local_prefix (the real install root in
+  - both --prefix and plain installs), falling back to INIT_CWD.
+  - Add reproducer unit test; update WORKFLOW.md call-trace description.
+  - Satisfies DES-020, REQ-352.
+
 ## [0.47.0](https://github.com/Ogekuri/PI-useReq/compare/v0.46.0..v0.47.0) - 2026-07-13
 ### 🐛  Bug Fixes
 - Fix packages file.
@@ -636,6 +654,8 @@
 - \[0.45.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.45.0
 - \[0.46.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.46.0
 - \[0.47.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.47.0
+- \[0.48.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.48.0
+- \[0.49.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.49.0
 
 [0.1.0]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.1.0
 [0.2.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.1.0..v0.2.0
@@ -682,3 +702,5 @@
 [0.45.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.44.0..v0.45.0
 [0.46.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.45.0..v0.46.0
 [0.47.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.46.0..v0.47.0
+[0.48.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.47.0..v0.48.0
+[0.49.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.48.0..v0.49.0

package/README.md

@@ -1,4 +1,4 @@
-# PI-useReq/pi-usereq (0.47.0)
+# PI-useReq/pi-usereq (0.49.0)
 
 <p align="center">
   <img src="https://img.shields.io/badge/python-3.11%2B-3776AB?style=flat-square&logo=python&logoColor=white" alt="Python 3.11+">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-usereq",
-  "version": "0.47.0",
+  "version": "0.49.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Ogekuri/PI-useReq.git"

package/pi-usereq/docs/REFERENCES.md

@@ -3444,12 +3444,12 @@ import { readBundledInstruction, readBundledPrompt } from "./resources.js";
 
 ### fn `export function renderPromptCommandSummary(` (L385-425)
 - @brief Builds the on-screen command invocation summary for one bundled prompt-backed `req-<prompt>` command.
-- @details Renders the command name without the `req-` prefix in uppercase, the user request arguments, and the active configuration fields (`docs-dir`, `src-dir`, `tests-dir`, enabled context files, `AUTO_GIT_COMMIT`, effective `GIT_WORKTREE_ENABLED`, `GIT_WORKTREE_PREFIX`, enabled static-check languages, and `enabled-tools`) so the TUI shows only a compact summary while the full rendered prompt is delivered hidden to the LLM agent. Static-check languages are emitted in canonical `DEFAULT_STATIC_CHECK_LANGUAGES` order; enabled tools are emitted in documented menu order via `comparePiUsereqStartupToolNames`. The `context files`, `static code checks`, and `enabled tools` fields render the literal `none` placeholder whenever their respective enabled-item list is empty so the summary never shows a blank value. Runtime is O(l + t log t) where l is language count and t is enabled-tool count. No external state is mutated.
+- @details Renders the command name without the `req-` prefix in uppercase, the user request arguments, and the active configuration fields (`docs-dir`, `src-dir`, `tests-dir`, enabled context files, `AUTO_GIT_COMMIT`, effective `GIT_WORKTREE_ENABLED`, `GIT_WORKTREE_PREFIX`, enabled static-check languages, and `enabled-tools`) so the TUI shows only a compact summary while the full rendered prompt is delivered hidden to the LLM agent. Static-check languages are emitted in canonical `DEFAULT_STATIC_CHECK_LANGUAGES` order; enabled tools are emitted in documented menu order via `comparePiUsereqStartupToolNames`. The `context files`, `static code checks`, and `enabled tools` fields render the literal `none` placeholder whenever their respective enabled-item list is empty so the summary never shows a blank value. Sections are emitted in the order `Command:`, `Configuration:` with its bullet list, then `User's Request:`, each separated by one blank line. Runtime is O(l + t log t) where l is language count and t is enabled-tool count. No external state is mutated.
 - @param[in] promptName {string} Bundled prompt name without the `req-` prefix.
 - @param[in] args {string} User request arguments passed to the slash command.
 - @param[in] config {UseReqConfig} Effective project configuration supplying directory, git, static-check, and tool fields.
 - @return {string} Multi-line command invocation summary text.
-- @satisfies REQ-335, REQ-336, REQ-337, REQ-338
+- @satisfies REQ-335, REQ-336, REQ-337, REQ-338, REQ-353
 
 ## Symbol Index
 |Symbol|Kind|Vis|Lines|Sig|

package/pi-usereq/docs/REQUIREMENTS.md

@@ -1,7 +1,7 @@
 ---
 title: "PI-useReq Requirements"
 description: Software requirements specification
-version: "0.0.77"
+version: "0.0.78"
 date: "2026-07-13"
 author: "OpenAI Codex"
 scope:
@@ -168,6 +168,7 @@ PI-useReq is a TypeScript pi extension plus companion Node CLI and standalone ex
 - **REQ-336**: MUST render the command invocation summary with the command name without the `req-` prefix in uppercase and the user request arguments.
 - **REQ-337**: MUST include `docs-dir`, `src-dir`, `tests-dir`, enabled context files, `AUTO_GIT_COMMIT`, effective `GIT_WORKTREE_ENABLED`, `GIT_WORKTREE_PREFIX`, enabled static-check languages, and `enabled-tools` in the command invocation summary.
 - **REQ-338**: MUST render `none` for the command invocation summary `context files`, `static code checks`, and `enabled tools` fields whenever their respective enabled-item list is empty.
+- **REQ-353**: MUST render the command invocation summary sections in the order `Command:`, `Configuration:` with its bullet list, then `User's Request:`, separated by one blank line between consecutive sections.
 - **REQ-008**: MUST provide a `Language static code checkers` submenu that adds, views, confirms-before-removes, and resets global Command checker entries, plus toggles local per-language enablement.
 - **REQ-160**: MUST hardcode `Command` as the only user-configurable static-check module and omit module-selection UI from static-check configuration menus.
 - **REQ-161**: MUST hide `Dummy` from user-configurable static-check menus while preserving existing-config parsing and debug-driver support for `Dummy` entries.
@@ -543,6 +544,7 @@ PI-useReq is a TypeScript pi extension plus companion Node CLI and standalone ex
 - **TST-119**: MUST verify `%%CONTEXT_FILES%%` replacement emits one section per enabled existing file in the documented order and omits disabled or missing files.
 - **TST-120**: MUST verify `%%CONTEXT_FILES%%` sections use the file-name heading, the pre-substituted HTML file reference, and four-backtick `markdown` fences around raw content.
 - **TST-122**: MUST verify the command invocation summary renders `none` for `context files`, `static code checks`, and `enabled tools` when no items are enabled in each respective category.
+- **TST-131**: MUST verify the command invocation summary renders sections in the order `Command:`, `Configuration:`, then `User's Request:`, with one blank line between consecutive sections.
 - **TST-123**: MUST verify `resolveCheckerExecutable` probes bundled `node_modules/.bin` paths before `PATH` scan.
 - **TST-124**: MUST verify `scripts/install-static-checkers.ts` always returns exit code `0` regardless of probe or install outcomes.
 - **TST-125**: MUST verify `session_start` emits one warning notification for missing enabled checkers without aborting or transitioning workflow state.

package/pi-usereq/docs/WORKFLOW.md

@@ -1309,7 +1309,7 @@
 - Internal Call-Trace Tree:
   - `main(...)`: when invoked as the npm `postinstall` lifecycle, best-effort write consumer-root name-only `allowScripts` approvals, then probe each bundled npm checker, attempt best-effort install on miss, print native-checker guidance, and return `0` [`scripts/install-static-checkers.ts`]
     - `approvePendingInstallScripts(...)`: best-effort write name-only `allowScripts` approvals into the consumer-root `package.json` for installed packages declaring install lifecycle scripts before probing [`scripts/install-static-checkers.ts`]
-      - `getConsumerInstallRoot(...)`: resolve the consumer install root from the npm `INIT_CWD` or `npm_config_local_prefix` lifecycle environment [`scripts/install-static-checkers.ts`]
+      - `getConsumerInstallRoot(...)`: resolve the consumer install root preferring the npm `npm_config_local_prefix` install root (correct under pi `npm install --prefix <root>` flows) over the `INIT_CWD` caller-cwd fallback [`scripts/install-static-checkers.ts`]
       - `collectNodeModulesPackages(...)`: scan consumer-root `node_modules` and parse each readable package manifest [`scripts/install-static-checkers.ts`]
       - `selectInstallScriptPackageNames(...)`: select package names declaring `preinstall`, `install`, or `postinstall` scripts [`scripts/install-static-checkers.ts`]
       - `mergeAllowScriptsEntries(...)`: merge name-only approvals into the existing `allowScripts` map while preserving prior entries and explicit denials [`scripts/install-static-checkers.ts`]

package/scripts/install-static-checkers.ts

@@ -71,12 +71,13 @@ export interface InstallScriptApprovalDeps {
 
 /**
  * @brief Resolves the consumer install root that owns the active npm install transaction.
- * @details During an npm lifecycle script npm sets `INIT_CWD` to the invocation directory and `npm_config_local_prefix` to the resolved project prefix; both point at the true consumer root instead of the installed package directory that is the postinstall `process.cwd()`. Returns the first available value so the approval flow writes the consumer-root `package.json` allowScripts map instead of the nested `node_modules/<pkg>` directory. Runtime is O(1). No external state is mutated.
+ * @details During an npm lifecycle script npm sets `npm_config_local_prefix` to the resolved project prefix (the directory holding the `package.json` npm operates on) and `INIT_CWD` to the npm invocation directory. The pi extension host drives installs with `npm install <pkg> --prefix <installRoot>` from its own caller cwd, so in that flow `INIT_CWD` is the host caller cwd, NOT the install root, while `npm_config_local_prefix` equals the install root in both `--prefix` and plain `cd <root> && npm install` flows. Therefore `npm_config_local_prefix` MUST be selected first; `INIT_CWD` is retained only as a fallback for npm versions or flows that leave the prefix unset. Selecting `INIT_CWD` first would resolve the caller project (or a nonexistent path), so the `allowScripts` approval would be written to the wrong `package.json` (or nowhere) and the `npm warn allow-scripts` warning would persist on every extension update. Runtime is O(1). No external state is mutated.
  * @param[in] env {NodeJS.ProcessEnv} Environment map read for npm lifecycle path variables.
- * @return {string | undefined} Consumer install root, or `undefined` when not running inside an npm lifecycle.
+ * @return {string | undefined} Consumer install root, preferring `npm_config_local_prefix` then `INIT_CWD`, or `undefined` when not running inside an npm lifecycle.
+ * @satisfies DES-020, REQ-352
  */
 export function getConsumerInstallRoot(env: NodeJS.ProcessEnv = process.env): string | undefined {
-  return env.INIT_CWD || env.npm_config_local_prefix || undefined;
+  return env.npm_config_local_prefix || env.INIT_CWD || undefined;
 }
 
 /**

package/src/core/prompts.ts

@@ -375,12 +375,12 @@ export const PROMPT_COMMAND_SUMMARY_CUSTOM_TYPE = "pi-usereq-prompt-command";
 
 /**
  * @brief Builds the on-screen command invocation summary for one bundled prompt-backed `req-<prompt>` command.
- * @details Renders the command name without the `req-` prefix in uppercase, the user request arguments, and the active configuration fields (`docs-dir`, `src-dir`, `tests-dir`, enabled context files, `AUTO_GIT_COMMIT`, effective `GIT_WORKTREE_ENABLED`, `GIT_WORKTREE_PREFIX`, enabled static-check languages, and `enabled-tools`) so the TUI shows only a compact summary while the full rendered prompt is delivered hidden to the LLM agent. Static-check languages are emitted in canonical `DEFAULT_STATIC_CHECK_LANGUAGES` order; enabled tools are emitted in documented menu order via `comparePiUsereqStartupToolNames`. The `context files`, `static code checks`, and `enabled tools` fields render the literal `none` placeholder whenever their respective enabled-item list is empty so the summary never shows a blank value. Runtime is O(l + t log t) where l is language count and t is enabled-tool count. No external state is mutated.
+ * @details Renders the command name without the `req-` prefix in uppercase, the user request arguments, and the active configuration fields (`docs-dir`, `src-dir`, `tests-dir`, enabled context files, `AUTO_GIT_COMMIT`, effective `GIT_WORKTREE_ENABLED`, `GIT_WORKTREE_PREFIX`, enabled static-check languages, and `enabled-tools`) so the TUI shows only a compact summary while the full rendered prompt is delivered hidden to the LLM agent. Static-check languages are emitted in canonical `DEFAULT_STATIC_CHECK_LANGUAGES` order; enabled tools are emitted in documented menu order via `comparePiUsereqStartupToolNames`. The `context files`, `static code checks`, and `enabled tools` fields render the literal `none` placeholder whenever their respective enabled-item list is empty so the summary never shows a blank value. Sections are emitted in the order `Command:`, `Configuration:` with its bullet list, then `User's Request:`, each separated by one blank line. Runtime is O(l + t log t) where l is language count and t is enabled-tool count. No external state is mutated.
  * @param[in] promptName {string} Bundled prompt name without the `req-` prefix.
  * @param[in] args {string} User request arguments passed to the slash command.
  * @param[in] config {UseReqConfig} Effective project configuration supplying directory, git, static-check, and tool fields.
  * @return {string} Multi-line command invocation summary text.
- * @satisfies REQ-335, REQ-336, REQ-337, REQ-338
+ * @satisfies REQ-335, REQ-336, REQ-337, REQ-338, REQ-353
  */
 export function renderPromptCommandSummary(
   promptName: string,
@@ -408,8 +408,6 @@ export function renderPromptCommandSummary(
   const lines: string[] = [
     `Command: ${promptName.toUpperCase()}`,
     "",
-    `User's Request: ${args}`,
-    "",
     "Configuration:",
     `- document dir:        ${config["docs-dir"]}`,
     `- source-code dirs:    ${config["src-dir"].join(", ")}`,
@@ -420,6 +418,8 @@ export function renderPromptCommandSummary(
     `- worktree prefix:     ${config.GIT_WORKTREE_PREFIX}`,
     `- static code checks:  ${enabledLanguages}`,
     `- enabled tools:       ${enabledTools}`,
+    "",
+    `User's Request: ${args}`,
   ];
   return lines.join("\n");
 }

package/tests/static-check-bundled.test.ts

@@ -153,6 +153,32 @@ test("getConsumerInstallRoot falls back to npm_config_local_prefix and then unde
   }
 });
 
+test("getConsumerInstallRoot prefers npm_config_local_prefix over INIT_CWD for --prefix installs", () => {
+  // Reproducer for `pi update --extensions` `npm warn allow-scripts`: the pi host runs
+  // `npm install <pkg> --prefix <installRoot>` from its own caller cwd, so INIT_CWD is the
+  // caller cwd while npm_config_local_prefix is the real install root. Resolving INIT_CWD
+  // first writes the allowScripts approval to the wrong project (or nowhere) and the warning
+  // persists on every extension update.
+  const previousInitCwd = process.env.INIT_CWD;
+  const previousPrefix = process.env.npm_config_local_prefix;
+  try {
+    process.env.INIT_CWD = "/tmp/pi-usereq-caller-cwd";
+    process.env.npm_config_local_prefix = "/tmp/pi-usereq-install-root";
+    assert.equal(getConsumerInstallRoot(), "/tmp/pi-usereq-install-root");
+  } finally {
+    if (previousInitCwd === undefined) {
+      delete process.env.INIT_CWD;
+    } else {
+      process.env.INIT_CWD = previousInitCwd;
+    }
+    if (previousPrefix === undefined) {
+      delete process.env.npm_config_local_prefix;
+    } else {
+      process.env.npm_config_local_prefix = previousPrefix;
+    }
+  }
+});
+
 test("selectInstallScriptPackageNames returns only packages with lifecycle scripts", () => {
   const packages: NodeModulesPackage[] = [
     { name: "has-postinstall", scripts: { postinstall: "node install.js" } },