simt-dev 0.6.3 → 0.7.1

package/src/graph/load.mjs

@@ -117,7 +117,9 @@ async function defaultRegistry(flags) {
  * failure to resolve is a WARNING, not 38 `ENOENT` lines (ADR-014).
  *
  * Memoised per the inputs that decide the answer: the `--workspace` flag, the
- * `SIMT_DEV_WORKSPACE` environment and the user-config location. A single
+ * `SIMT_DEV_WORKSPACE` environment, the user-config location, and the current
+ * directory, whose manifest declares the workspace the variable may point into
+ * (ADR-119). A single
  * first-call-wins promise served one caller's workspace to every later caller with
  * different flags (Q14) — `skills_index({workspace: ws})` followed by
  * `skills_index({})` answered `ws` twice. Callers with the same inputs still share
@@ -129,6 +131,7 @@ export function workspace(flags = {}) {
     flags?.workspace ?? null,
     process.env.SIMT_DEV_WORKSPACE ?? null,
     process.env.XDG_CONFIG_HOME ?? null,
+    process.cwd(),
   ]);
   if (!workspacePromises.has(key)) workspacePromises.set(key, resolveWorkspace(flags));
   return workspacePromises.get(key);
@@ -154,10 +157,15 @@ export async function loadRegistry(path = null, flags = {}) {
   // errors are facts about ABSENCE - no registry here, or more than one and the reader must
   // pick - and are reported as such. A named path that is missing is a different fact: the
   // reader pointed at a file that is not there, and it names that path.
-  let where = path;
+  //
+  // Resolution order for the registry itself (review 0003 Q37): positional path,
+  // then `--registry`, then `SIMT_REGISTRY`, then the default tiers above.
+  const explicit =
+    path ?? flags?.registry ?? process.env.SIMT_REGISTRY ?? process.env.SIMT_DEV_REGISTRY ?? null;
+  let where = explicit;
   let resolveErrors = null;
   let resolvedWorkspace = null;
-  if (path === null) {
+  if (explicit === null) {
     const found = await defaultRegistry(flags);
     where = found.where;
     resolveErrors = found.errors;
@@ -181,7 +189,7 @@ export async function loadRegistry(path = null, flags = {}) {
     registry = JSON.parse(await readFile(where, 'utf8'));
   } catch (error) {
     const message =
-      path === null && error.code === 'ENOENT'
+      explicit === null && error.code === 'ENOENT'
         ? `no skill registry at ${where}; create one there, or name it explicitly`
         : `${where}: unreadable or invalid JSON (${error.message})`;
     return {
@@ -260,6 +268,11 @@ export async function loadRegistry(path = null, flags = {}) {
  * broken registry rather than a wrong pointer, which is exactly backwards.
  */
 function holdsAnyRepo(registry, root) {
+  // Every repo the registry names, vendored or not: the question is whether this
+  // directory is a workspace at all. Filtering out vendored sources made the check
+  // unsatisfiable the moment the last non-vendored skill left the registry - an
+  // all-vendored registry names repos just the same, and a home folder holds none
+  // of them.
   const named = new Set(
     (registry.skills ?? []).flatMap((s) => (s.sources ?? []).map((x) => x.repo)).filter(Boolean),
   );
@@ -282,14 +295,20 @@ export function lintRegistry(registry) {
   const threshold = registry.deferredThreshold ?? 20000;
 
   // --- shape -----------------------------------------------------------------
+  // Every check below assumes arrays of objects. A registry that fails the shape
+  // is already fully described by the shape error; continuing past it only
+  // trades one true error for a crash (`for..of` over `undefined`) or a pile of
+  // secondary noise, so the lint stops here (review 0003 Q35).
   if (!Array.isArray(registry.capabilities) || capabilities.size === 0) {
     err('capabilities: missing or empty');
   }
   if (!Array.isArray(registry.skills) || skills.length === 0) {
     err('skills: missing or empty');
+  }
+  if (errors.length > 0) {
     return { sync: errors, warnings, index };
   }
-  for (const c of registry.capabilities) {
+  for (const c of registry.capabilities ?? []) {
     if (!c.id || !c.summary) err(`capability ${c.id ?? '<no id>'}: needs id and summary`);
   }
 
@@ -449,22 +468,22 @@ function checkRequires(at, skill, index, err) {
     if (!index.has(dep)) err(`${at}: requires unknown skill "${dep}"`);
     if (dep === skill.name) err(`${at}: requires itself`);
   }
-  // Cycle detection over `requires`. Depth is bounded by node count, so an
-  // accidental cycle terminates rather than hanging the lint.
-  const seen = new Set([skill.name]);
-  let frontier = skill.requires ?? [];
-  while (frontier.length > 0) {
-    const next = [];
-    for (const dep of frontier) {
-      if (seen.has(dep)) {
-        err(`requires cycle: ${[...seen].join(' -> ')} -> ${dep}`);
+  // Cycle detection over `requires`, depth-first with a recursion stack. The old
+  // breadth-first walk shared one `seen` set across branches, so a diamond
+  // (a requires b and c; both require d) reported d's second visit as a cycle.
+  // Only a dependency already on the current path is a cycle; a node reached
+  // through two branches is sharing, not looping (review 0003 Q35).
+  const visit = (name, path) => {
+    const stack = [...path, name];
+    for (const dep of index.get(name)?.requires ?? []) {
+      if (stack.includes(dep)) {
+        err(`requires cycle: ${[...stack, dep].join(' -> ')}`);
         return;
       }
-      seen.add(dep);
-      next.push(...(index.get(dep)?.requires ?? []));
+      visit(dep, stack);
     }
-    frontier = next;
-  }
+  };
+  visit(skill.name, []);
 }
 
 function checkAlias(at, skill, index, err) {
@@ -570,6 +589,10 @@ async function lintSourcesOnDisk(registry, workspaceRoot) {
   const warnings = [];
 
   for (const skill of registry.skills ?? []) {
+    // A vendored skill ships with the package; its source is the package root,
+    // not a workspace member. Verifying it against the workspace filesystem is
+    // the wrong check (the path will not exist there by design).
+    if (skill.vendored) continue;
     for (const source of skill.sources ?? []) {
       const at = `${skill.name}: ${source.repo}/${source.path}`;
       if (!source.repo || !source.path) continue;
@@ -644,8 +667,7 @@ export async function measureSkill(full) {
     hasEntry = false;
   }
   if (!hasEntry) {
-    const md = files === 1 ? '' : '';
-    throw Object.assign(new Error(`${full} has no SKILL.md entry point${md}`), { code: 'NO_SKILL_MD' });
+    throw Object.assign(new Error(`${full} has no SKILL.md entry point`), { code: 'NO_SKILL_MD' });
   }
 
   return { bytes, files, flat: false };

package/src/hooks/capability.mjs

@@ -21,7 +21,9 @@
 import { constants as fsConstants } from 'node:fs';
 import { access, readdir, readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { ECOSYSTEMS, manifestPath } from '../projection/manifest.mjs';
+import { ECOSYSTEMS } from '../projection/manifest.mjs';
+import { loadManifest } from '../manifest/schema.mjs';
+import { resolveNodeRunner } from '../ecosystem/node-runner.mjs';
 
 /** Binaries the shared dispatcher shells out to directly, rather than via a script. */
 const BIN_DIR = join('node_modules', '.bin');
@@ -104,10 +106,22 @@ async function probeTool(root, eco) {
 export async function readCapability(root) {
   const capability = { scripts: {}, binaries: [], commands: {}, tools: [], runner: null, error: null };
 
+  // Q31: a package.json names a Node repo, but not which manager it installs
+  // with. The lockfile on disk wins over the `packageManager` field (the field
+  // can disagree; `checkToolchain` reports that), and the field wins over the
+  // npm default — so a `packageManager: pnpm@9` repo resolves pnpm before its
+  // first install, and every consumer below reads the same answer.
+  let packageManager = null;
   try {
     const manifest = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
     capability.scripts = manifest.scripts ?? {};
-    capability.runner = 'npm';
+    packageManager = typeof manifest.packageManager === 'string' ? manifest.packageManager : null;
+    const lockfiles = [];
+    for (const file of ['pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb', 'package-lock.json']) {
+      if (await fileExists(join(root, file))) lockfiles.push(file);
+    }
+    capability.runner = resolveNodeRunner({ lockfiles, packageManager }).id;
+    capability.packageManager = packageManager;
   } catch (error) {
     // A repo with no manifest is a normal shape — a Python or Gradle repo has no
     // package.json at all — so this is reported, never thrown. The gate filter treats
@@ -157,8 +171,7 @@ export async function readCapability(root) {
   // so the only evidence that can prove it is the declaration itself. A repo with no
   // manifest simply has no declared commands.
   try {
-    const manifest = JSON.parse(await readFile(await manifestPath(root), 'utf8'));
-    capability.commands = declaredCommands(manifest);
+    capability.commands = declaredCommands((await loadManifest(root)).manifest);
   } catch {
     capability.commands = {};
   }