staysfixed 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -4,6 +4,43 @@ All notable changes to this project are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the version
 numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.2] — 2026-08-30
+
+Found the same way as 0.7.1, one step further along: install from npm into an
+empty folder, run `init`, then run `doctor` on what `init` just wrote.
+
+### Fixed
+
+- **`doctor` read the commented-out examples in a settings file as settings.**
+  `staysfixed init` comments out every option that does not apply to your
+  project rather than leaving it out, so nothing is hidden from the person
+  reading the file — and `doctor` searched the raw text. On a folder holding one
+  script and nothing else it announced *"Electron desktop apps: **Covered.** It
+  opens release/mac-arm64/Your App.app"*, and an Android app beside it, both read
+  out of comments and both false.
+
+  A surface reported as covered when nothing will ever be walked on it is the
+  worst answer this tool can give, because every clean result after it is
+  believed. Comments are taken away before anything is read out of the file now,
+  with strings respected so an address keeps its two slashes — and the file is
+  still never loaded, because a settings file may be JavaScript and doctor must
+  not run somebody's code to answer a question about their machine.
+
+## [0.7.1] — 2026-08-30
+
+Found by installing 0.7.0 from npm into an empty folder and running it the way a
+stranger would, which is the only way this was ever going to be found.
+
+### Fixed
+
+- **`init` asked for a build step on a script that runs straight from source.** A
+  plain Node command-line tool is recorded as "not built", because there is
+  nothing to build — and that was read as "it has not been built yet". So a fresh
+  install told its owner to go and name the command that builds a file sitting
+  right there, in the same breath as offering to run it. Being sent shopping for
+  nothing is the fastest way to make somebody stop reading the page, and this
+  project's README promises it never happens. A test holds it shut.
+
 ## [0.7.0] — 2026-08-30
 
 The release where the front door was found to be locked.
@@ -81,6 +118,11 @@ printed, which is the only way this kind of mistake is ever found.
 - **It reported Docker as present because the command was on the path**, on a
   machine where Docker Desktop was shut and nothing it promises would have worked.
   It asks the engine for its version now.
+- **It said an iPhone app "cannot be done here at all" on a Mac with Xcode and
+  three simulator runtimes on it.** The real reason was that this repository has
+  no iPhone app in it, which is not a limit of the machine. Those two reasons are
+  two different sentences now, and the object carries
+  `surfaces[].notInThisProject` so an agent can tell them apart too.
 - No probe in `doctor` uses a shell variable or a loop any more. One machine in
   this config reaches Windows through an OpenSSH server that hands the command down
   through a second shell, and every `$p` is expanded to nothing before the shell

package/README.md

@@ -364,6 +364,8 @@ to ask the question a different way.
 | Ask a machine `command -v powershell.exe` over ssh to find out whether Windows sits behind it — a question that answers "no" on a machine with Windows right there, because that path is added by an interactive login shell and ssh does not run one. It also read a **refusal** as an answer, so `github.com` was listed as a machine to run checks on, and as a Windows desktop | Asks the filesystem for the three places PowerShell actually lives, using the one list the code that later drives it uses. Reads standard output only, and matches the whole line, so a host that quotes your command back cannot answer for itself |
 | Name only the first eight machines in an ssh config and drop the rest without a word | Dials sixteen, and anything past that is named as not dialled rather than left out |
 | Report Docker as present because the command is on the path, on a Mac where Docker Desktop is shut and nothing it promises would work | Asks the engine for its version, and says "installed but not answering" when that is the truth |
+| Read the **commented-out examples** in a settings file as settings. `staysfixed init` comments out every option that does not apply to your project, so nothing is hidden from you — and doctor searched the raw text. On a folder holding one script it announced "Electron desktop apps: **Covered.** It opens release/mac-arm64/Your App.app", and an Android app beside it. A surface called covered when nothing will ever be walked on it is the worst answer this tool can give | Comments are taken away before anything is read out of the file, with strings respected so an address keeps its two slashes. The file is still never loaded — doctor must not run your code to answer a question about your machine |
+| Ask for a build step on a plain command-line tool. A script that runs from source is recorded as "not built", because there is nothing to build, and that was read as "it has not been built yet" — so a fresh install told its owner to name the command that builds a file sitting right there, in the same breath as offering to run it | Nothing is asked for when there is nothing to build, or when a command to run it has already been worked out |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "staysfixed",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Prove that what already worked still works after an agent changed the code. Picture checks, guards for fixed bugs, a pre-release walkthrough, and known-good markers — as a CLI and as an MCP server.",
   "type": "module",
   "license": "MIT",

package/src/v2/doctor.js

@@ -668,6 +668,59 @@ function hasModule(cwd, name) {
   }
 }
 
+/**
+ * The settings file with everything commented out taken away.
+ *
+ * `staysfixed init` writes a settings file whose whole point is that the options which do
+ * NOT apply to your project are commented out rather than left out, so nothing is hidden
+ * from the person reading it. Doctor reads that file as TEXT — never by loading it, because
+ * a settings file may be JavaScript and doctor must not run somebody's code to answer a
+ * question about their machine — and it used to search the raw text.
+ *
+ * Which means it found the examples. On a folder containing one `cli.js` and nothing else,
+ * doctor announced "Electron desktop apps: Covered. It opens release/mac-arm64/Your App.app"
+ * and "An Android app is here", both read out of commented-out lines, and both false. A
+ * surface reported as covered when nothing will ever be walked on it is the worst answer
+ * this tool can give.
+ *
+ * Strings are respected, so an address like "http://localhost:3000" survives: the two
+ * slashes inside it are not the start of a comment.
+ *
+ * @param {string} text
+ * @returns {string}   The same text with comments blanked, line numbering unchanged.
+ */
+export function withoutComments(text) {
+  let out = '';
+  /** @type {"code"|"line"|"block"|"'"|'"'|'`'} */
+  let mode = 'code';
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    const next = text[i + 1];
+    if (mode === 'code') {
+      if (c === '/' && next === '/') { mode = 'line'; out += '  '; i += 1; continue; }
+      if (c === '/' && next === '*') { mode = 'block'; out += '  '; i += 1; continue; }
+      if (c === "'" || c === '"' || c === '`') mode = /** @type {any} */ (c);
+      out += c;
+      continue;
+    }
+    if (mode === 'line') {
+      if (c === '\n') { mode = 'code'; out += c; continue; }
+      out += ' ';
+      continue;
+    }
+    if (mode === 'block') {
+      if (c === '*' && next === '/') { mode = 'code'; out += '  '; i += 1; continue; }
+      out += c === '\n' ? c : ' ';
+      continue;
+    }
+    // Inside a string. A backslash escapes whatever comes next, quote included.
+    if (c === '\\') { out += c + (next ?? ''); i += 1; continue; }
+    if (c === mode) mode = 'code';
+    out += c;
+  }
+  return out;
+}
+
 /**
  * Is there a desktop app in this project to check?
  *
@@ -687,7 +740,10 @@ function findDesktopApp(cwd) {
   const configFile = findConfigFile(cwd);
   if (configFile) {
     try {
-      const text = readFileSync(configFile, 'utf8');
+      // Comments taken away first. See `withoutComments`: the examples in a settings file
+      // are commented out on purpose, and reading them as settings reported a desktop app
+      // in a folder that contains one script.
+      const text = withoutComments(readFileSync(configFile, 'utf8'));
       const named = /["']?binary["']?\s*:\s*["'`]([^"'`]+)["'`]/.exec(text);
       if (named) return { where: named[1], how: 'your settings name it under app.binary' };
       if (/["']?kind["']?\s*:\s*["'`]electron["'`]/.test(text)) {
@@ -761,7 +817,9 @@ async function phoneApps(root, configFile) {
   let settings = '';
   if (configFile) {
     try {
-      settings = readFileSync(configFile, 'utf8');
+      // Comments taken away first, for the same reason `findDesktopApp` does it: a
+      // commented-out `apk:` line is an example, not an Android app.
+      settings = withoutComments(readFileSync(configFile, 'utf8'));
     } catch {
       settings = '';
     }

package/src/v2/init.js

@@ -432,7 +432,17 @@ function productNeeds(product, project) {
   // A command-line program that has to be built before it can be run. This is what a product
   // nothing in package.json names looks like on a fresh clone: the source is there, the
   // program is real, and the file that would be run does not exist yet.
-  if (product.kind === 'cli' && !product.built.found) {
+  //
+  // `built.found === false` is NOT that on its own, and reading it as though it were sent a
+  // plain Node command-line tool's owner shopping for a build step it does not have. A
+  // script that runs straight from source is recorded as `found: false, how: "nothing to
+  // build — it runs from source"`, and this file used to ask a person to "name the command
+  // that builds it" about a file that was sitting right there and that the very same run
+  // had already worked out how to run. Two signals rule it out, and either is enough: the
+  // detector saying there is nothing to build, and a command already worked out for it.
+  const nothingToBuild = /nothing to build/i.test(String(product.built.how ?? ''));
+  const alreadyRunnable = Array.isArray(suggest.commands) && suggest.commands.length > 0;
+  if (product.kind === 'cli' && !product.built.found && !nothingToBuild && !alreadyRunnable) {
     const build = typeof suggest.buildWith === 'string' ? String(suggest.buildWith) : null;
     needs.push({
       what: `${product.name}, built`,