staysfixed 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the version
 numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.2] — 2026-08-30
+
+Found the same way as 0.7.1, one step further along: install from npm into an
+empty folder, run `init`, then run `doctor` on what `init` just wrote.
+
+### Fixed
+
+- **`doctor` read the commented-out examples in a settings file as settings.**
+  `staysfixed init` comments out every option that does not apply to your
+  project rather than leaving it out, so nothing is hidden from the person
+  reading the file — and `doctor` searched the raw text. On a folder holding one
+  script and nothing else it announced *"Electron desktop apps: **Covered.** It
+  opens release/mac-arm64/Your App.app"*, and an Android app beside it, both read
+  out of comments and both false.
+
+  A surface reported as covered when nothing will ever be walked on it is the
+  worst answer this tool can give, because every clean result after it is
+  believed. Comments are taken away before anything is read out of the file now,
+  with strings respected so an address keeps its two slashes — and the file is
+  still never loaded, because a settings file may be JavaScript and doctor must
+  not run somebody's code to answer a question about their machine.
+
 ## [0.7.1] — 2026-08-30
 
 Found by installing 0.7.0 from npm into an empty folder and running it the way a

package/README.md

@@ -364,6 +364,8 @@ to ask the question a different way.
 | Ask a machine `command -v powershell.exe` over ssh to find out whether Windows sits behind it — a question that answers "no" on a machine with Windows right there, because that path is added by an interactive login shell and ssh does not run one. It also read a **refusal** as an answer, so `github.com` was listed as a machine to run checks on, and as a Windows desktop | Asks the filesystem for the three places PowerShell actually lives, using the one list the code that later drives it uses. Reads standard output only, and matches the whole line, so a host that quotes your command back cannot answer for itself |
 | Name only the first eight machines in an ssh config and drop the rest without a word | Dials sixteen, and anything past that is named as not dialled rather than left out |
 | Report Docker as present because the command is on the path, on a Mac where Docker Desktop is shut and nothing it promises would work | Asks the engine for its version, and says "installed but not answering" when that is the truth |
+| Read the **commented-out examples** in a settings file as settings. `staysfixed init` comments out every option that does not apply to your project, so nothing is hidden from you — and doctor searched the raw text. On a folder holding one script it announced "Electron desktop apps: **Covered.** It opens release/mac-arm64/Your App.app", and an Android app beside it. A surface called covered when nothing will ever be walked on it is the worst answer this tool can give | Comments are taken away before anything is read out of the file, with strings respected so an address keeps its two slashes. The file is still never loaded — doctor must not run your code to answer a question about your machine |
+| Ask for a build step on a plain command-line tool. A script that runs from source is recorded as "not built", because there is nothing to build, and that was read as "it has not been built yet" — so a fresh install told its owner to name the command that builds a file sitting right there, in the same breath as offering to run it | Nothing is asked for when there is nothing to build, or when a command to run it has already been worked out |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "staysfixed",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Prove that what already worked still works after an agent changed the code. Picture checks, guards for fixed bugs, a pre-release walkthrough, and known-good markers — as a CLI and as an MCP server.",
   "type": "module",
   "license": "MIT",

package/src/v2/doctor.js

@@ -668,6 +668,59 @@ function hasModule(cwd, name) {
   }
 }
 
+/**
+ * The settings file with everything commented out taken away.
+ *
+ * `staysfixed init` writes a settings file whose whole point is that the options which do
+ * NOT apply to your project are commented out rather than left out, so nothing is hidden
+ * from the person reading it. Doctor reads that file as TEXT — never by loading it, because
+ * a settings file may be JavaScript and doctor must not run somebody's code to answer a
+ * question about their machine — and it used to search the raw text.
+ *
+ * Which means it found the examples. On a folder containing one `cli.js` and nothing else,
+ * doctor announced "Electron desktop apps: Covered. It opens release/mac-arm64/Your App.app"
+ * and "An Android app is here", both read out of commented-out lines, and both false. A
+ * surface reported as covered when nothing will ever be walked on it is the worst answer
+ * this tool can give.
+ *
+ * Strings are respected, so an address like "http://localhost:3000" survives: the two
+ * slashes inside it are not the start of a comment.
+ *
+ * @param {string} text
+ * @returns {string}   The same text with comments blanked, line numbering unchanged.
+ */
+export function withoutComments(text) {
+  let out = '';
+  /** @type {"code"|"line"|"block"|"'"|'"'|'`'} */
+  let mode = 'code';
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    const next = text[i + 1];
+    if (mode === 'code') {
+      if (c === '/' && next === '/') { mode = 'line'; out += '  '; i += 1; continue; }
+      if (c === '/' && next === '*') { mode = 'block'; out += '  '; i += 1; continue; }
+      if (c === "'" || c === '"' || c === '`') mode = /** @type {any} */ (c);
+      out += c;
+      continue;
+    }
+    if (mode === 'line') {
+      if (c === '\n') { mode = 'code'; out += c; continue; }
+      out += ' ';
+      continue;
+    }
+    if (mode === 'block') {
+      if (c === '*' && next === '/') { mode = 'code'; out += '  '; i += 1; continue; }
+      out += c === '\n' ? c : ' ';
+      continue;
+    }
+    // Inside a string. A backslash escapes whatever comes next, quote included.
+    if (c === '\\') { out += c + (next ?? ''); i += 1; continue; }
+    if (c === mode) mode = 'code';
+    out += c;
+  }
+  return out;
+}
+
 /**
  * Is there a desktop app in this project to check?
  *
@@ -687,7 +740,10 @@ function findDesktopApp(cwd) {
   const configFile = findConfigFile(cwd);
   if (configFile) {
     try {
-      const text = readFileSync(configFile, 'utf8');
+      // Comments taken away first. See `withoutComments`: the examples in a settings file
+      // are commented out on purpose, and reading them as settings reported a desktop app
+      // in a folder that contains one script.
+      const text = withoutComments(readFileSync(configFile, 'utf8'));
       const named = /["']?binary["']?\s*:\s*["'`]([^"'`]+)["'`]/.exec(text);
       if (named) return { where: named[1], how: 'your settings name it under app.binary' };
       if (/["']?kind["']?\s*:\s*["'`]electron["'`]/.test(text)) {
@@ -761,7 +817,9 @@ async function phoneApps(root, configFile) {
   let settings = '';
   if (configFile) {
     try {
-      settings = readFileSync(configFile, 'utf8');
+      // Comments taken away first, for the same reason `findDesktopApp` does it: a
+      // commented-out `apk:` line is an example, not an Android app.
+      settings = withoutComments(readFileSync(configFile, 'utf8'));
     } catch {
       settings = '';
     }