superpowers-manager 0.7.3 → 0.9.0

package/dist/commands/prepare.js

@@ -1,36 +1,24 @@
-import { mkdir, stat } from "node:fs/promises";
-import { dirname, isAbsolute, join, sep } from "node:path";
+import { mkdir } from "node:fs/promises";
+import { dirname, join, sep } from "node:path";
 import { atomicReplaceDir } from "../atomic.js";
 import { oneLine } from "../cli-arguments.js";
 import { computeEffectiveSelection } from "../effective-selection.js";
 import { runGit } from "../git.js";
+import { isDirectory } from "../safe-path.js";
 import { SafetyError } from "../safety-error.js";
-import { fetchExactCommit, gitSafeSource } from "../upstream.js";
-import { upstreamCacheRoot } from "../upstream-workspace.js";
+import { fetchExactCommit, gitSafeSource, upstreamCacheRoot, } from "../upstream.js";
 import { BOUNDED_EXECUTABLE, launchFailureMessage, resolveValidator, runValidator, displayPath, } from "../validator.js";
-import { withWorkspace, workspaceRemovalFailure } from "../workspace.js";
+import { withWorkspaceReporting, } from "../workspace.js";
+import { invoke } from "./adapter-call.js";
 import { replayOutcome } from "./probe.js";
 import { runWithMutation } from "./mutation.js";
 // Every message this module writes is hand-written here. The cause is attached
 // for debuggability and never reaches a stream: oneLine (src/cli-arguments.ts)
 // reads .message only. Same arrangement as hookError
-// (`src/harnesses/codex/hooks.ts:44::function hookError`).
+// (`src/harnesses/codex/hooks.ts:45::function hookError`).
 function prepareError(message, cause) {
     return new SafetyError("prepare", message, { cause });
 }
-// `[ -d ]` — `git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/prepare:50::if [ -d`. A regular file named `.git` is what a git
-// worktree or `clone --separate-git-dir` leaves behind; `-e` would take the
-// fetch branch and let git follow its `gitdir:` pointer, where the shell took
-// the clone branch. `src/upstream.ts:332::if (!(await isDirectory` makes the
-// same distinction.
-async function directoryExists(path) {
-    try {
-        return (await stat(path)).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
 // mkdir throws raw ErrnoExceptions. Every command-owned call goes through here
 // so the message on the stream is this module's, not Node's.
 async function owned(message, fn) {
@@ -70,34 +58,13 @@ function disclosureLine(resolution) {
     return `[superpowers-manager: running external validator ${configured}${via} -> ${displayPath(resolution.resolved)}]\n`;
 }
 const NO_VALIDATOR_OUTPUT = { stdout: "", stderr: "" };
-function validStagingLeaf(value) {
-    return (value.length > 0 &&
-        value !== "." &&
-        value !== ".." &&
-        !value.includes("/") &&
-        !value.includes("\\"));
-}
-async function gatherPrepare(ctx) {
+async function gatherPrepare(ctx, location) {
     // Collect outcomes without writing so output failures cannot be classified as
     // inspection failures. Replay collected outcomes after gathering completes.
     const env = ctx.env;
-    const cwd = process.cwd();
-    const cache = upstreamCacheRoot(ctx.root, env, cwd);
+    const cache = upstreamCacheRoot(ctx.root, env);
     const cacheParent = dirname(cache);
     const adapterContext = { root: ctx.root, env };
-    let location;
-    try {
-        location = ctx.adapter.preparationLocation(adapterContext);
-    }
-    catch (cause) {
-        throw prepareError("cannot determine preparation location", cause);
-    }
-    if (!isAbsolute(location.destinationRoot)) {
-        throw prepareError("adapter returned a non-absolute preparation destination");
-    }
-    if (!validStagingLeaf(location.stagingLeaf)) {
-        throw prepareError("adapter returned an invalid preparation staging leaf");
-    }
     const pluginRoot = location.destinationRoot;
     const executableValidator = env.SUPERPOWERS_VALIDATOR_EXECUTABLE || "";
     const tmpParent = dirname(pluginRoot);
@@ -109,30 +76,14 @@ async function gatherPrepare(ctx) {
         message,
     });
     const selection = ctx.selection ?? (await computeEffectiveSelection(ctx.root, env));
-    let prefetch;
-    try {
-        prefetch = await ctx.adapter.validatePreparationBeforeFetch(adapterContext);
-    }
-    catch {
-        return {
-            outcome: failed(ctx.adapter.presentation.callFailure("prepare", adapterContext)
-                .unexpected),
-            cleanupWarning: null,
-        };
-    }
-    outcomes.push(prefetch.outcome);
-    if (!prefetch.outcome.ok)
-        return { outcome: failed(null), cleanupWarning: null };
-    if (prefetch.status !== 0) {
-        return {
-            outcome: failed(ctx.adapter.presentation.callFailure("prepare", adapterContext)
-                .invalidStatus),
-            cleanupWarning: null,
-        };
+    // callFailure only formats strings; computing it once up front is safe.
+    const failure = ctx.adapter.presentation.callFailure("prepare", adapterContext);
+    const prefetch = await invoke(() => ctx.adapter.validatePreparationBeforeFetch(adapterContext), failure, outcomes);
+    if (!prefetch.ok) {
+        return { value: failed(prefetch.message), cleanupWarning: null };
     }
     await owned(`cannot create directory: ${tmpParent}`, () => mkdir(tmpParent, { recursive: true }));
-    let cleanupWarning = null;
-    const outcome = await withWorkspace(tmpParent, ".superpowers.prepare.", async (workspace) => {
+    return await withWorkspaceReporting(tmpParent, ".superpowers.prepare.", async (workspace) => {
         const candidate = join(workspace, location.stagingLeaf);
         await owned(`cannot create directory: ${cacheParent}`, () => mkdir(cacheParent, { recursive: true }));
         if (selection.selectionMode === "pinned") {
@@ -140,7 +91,12 @@ async function gatherPrepare(ctx) {
         }
         else {
             const source = gitSafeSource(selection.effectiveSource);
-            if (await directoryExists(join(cache, ".git"))) {
+            // `[ -d ]` — `git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/prepare:50::if [ -d`. A regular file named `.git` is what a git
+            // worktree or `clone --separate-git-dir` leaves behind; `-e` would take the
+            // fetch branch and let git follow its `gitdir:` pointer, where the shell took
+            // the clone branch. `src/upstream.ts:323::if (!(await isDirectory` makes the
+            // same distinction.
+            if (await isDirectory(join(cache, ".git"))) {
                 const fetched = await runGit([
                     "-C",
                     cache,
@@ -175,34 +131,23 @@ async function gatherPrepare(ctx) {
         if (checkedOut.status !== 0) {
             return failed(`cannot check out upstream commit: ${selection.desiredCommit}`);
         }
-        let prepared;
-        try {
-            prepared = await ctx.adapter.prepareCandidate({
-                upstreamRoot: cache,
-                workspaceRoot: workspace,
-                candidateRoot: candidate,
-                selection,
-            }, adapterContext);
-        }
-        catch {
-            return failed(ctx.adapter.presentation.callFailure("prepare", adapterContext)
-                .unexpected);
-        }
-        outcomes.push(prepared.outcome);
-        if (prepared.status !== 0 || !prepared.outcome.ok) {
-            return failed(prepared.outcome.ok
-                ? ctx.adapter.presentation.callFailure("prepare", adapterContext)
-                    .invalidStatus
-                : null);
-        }
-        if (prepared.outcome.result.root !== candidate) {
+        const prepared = await invoke(() => ctx.adapter.prepareCandidate({
+            upstreamRoot: cache,
+            workspaceRoot: workspace,
+            candidateRoot: candidate,
+            selection,
+        }, adapterContext), failure, outcomes);
+        if (!prepared.ok)
+            return failed(prepared.message);
+        const candidateResult = prepared.result.outcome.result;
+        if (candidateResult.root !== candidate) {
             return failed("adapter returned an unexpected preparation root");
         }
-        if (prepared.outcome.result.commit !== selection.desiredCommit) {
+        if (candidateResult.commit !== selection.desiredCommit) {
             return failed("adapter returned an unexpected preparation commit");
         }
-        if (prepared.outcome.result.compatibility.kind === "unsupported") {
-            return failed(prepared.outcome.result.compatibility.reason);
+        if (candidateResult.compatibility.kind === "unsupported") {
+            return failed(candidateResult.compatibility.reason);
         }
         let validator = NO_VALIDATOR_OUTPUT;
         if (executableValidator.length > 0) {
@@ -248,7 +193,7 @@ async function gatherPrepare(ctx) {
         // the workspace on return, and the candidate lives in it.
         //
         // atomicReplaceDir delegates to beginDirectoryPublication, whose outer
-        // catch (`src/atomic.ts:319::if (cause`) wraps every non-SafetyError
+        // catch (`src/atomic.ts:315::if (cause`) wraps every non-SafetyError
         // into a SafetyError, so the callee owns every failure on this path and
         // re-emitting its own diagnostic is the sanctioned form of interpolation.
         // The hand-written prefix carries the live root, which the callee's message
@@ -271,28 +216,17 @@ async function gatherPrepare(ctx) {
             resolvedRef: selection.resolvedRef,
             commit: selection.desiredCommit,
         };
-    }, {
-        // Suppresses withWorkspace's throw on a POST-SUCCESS cleanup failure, so
-        // the PrepareOutcome the callback already computed still reaches
-        // runPrepare instead of being discarded. The reporter runs synchronously,
-        // as the option requires (`src/workspace.ts:103-106::Must`).
-        onCleanupFailure: (path) => {
-            cleanupWarning = workspaceRemovalFailure(path);
-        },
     });
-    return { outcome, cleanupWarning };
 }
 export async function runPrepare(argv, ctx) {
-    return await runWithMutation("prepare", ctx, async (scoped) => performPrepare(argv, scoped));
+    // argv is ignored: scripts/prepare never read "$@". Probe, by contrast,
+    // rejects extra arguments in the CLI parser.
+    return await runWithMutation("prepare", ctx, async (scoped, location) => performPrepare(scoped, location));
 }
-async function performPrepare(argv, ctx) {
-    // scripts/prepare never reads "$@", so extra arguments are ignored. This is a
-    // deliberate asymmetry with probe, whose shell original rejected unknown
-    // arguments and whose arity therefore moved into parseArgs in slice 2.
-    void argv;
+async function performPrepare(ctx, location) {
     let run;
     try {
-        run = await gatherPrepare(ctx);
+        run = await gatherPrepare(ctx, location);
     }
     catch (cause) {
         // Reader wrappers supply their own diagnostics. The saved-selection read
@@ -302,7 +236,7 @@ async function performPrepare(argv, ctx) {
         ctx.stderr.write(`error: ${oneLine(cause)}\n`);
         return 1;
     }
-    const { outcome, cleanupWarning } = run;
+    const { value: outcome, cleanupWarning } = run;
     for (const each of outcome.outcomes)
         replayOutcome(each, ctx);
     if (outcome.validator.stdout.length > 0) {
@@ -328,7 +262,7 @@ async function performPrepare(argv, ctx) {
         // completed before cleanup ran, so it is not being reported as unverified
         // -- but something did still go wrong, and AGENTS.md's fail-closed rule
         // extends to it. Mirrors
-        // `src/commands/install.ts:446::if (cleanupWarning`.
+        // `src/commands/install.ts:372::if (cleanupWarning`.
         ctx.stderr.write(`error: ${cleanupWarning}\n`);
         return 1;
     }

package/dist/commands/probe.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 import { assertFailureWritable, writeAdapterFailure, } from "../adapter-result.js";
 import { oneLine } from "../cli-arguments.js";
 import { computeEffectiveSelection } from "../effective-selection.js";
@@ -96,13 +97,17 @@ export async function gatherProbe(ctx) {
     if (!controlAfter.ok)
         return { status: 1, outcomes, message: controlAfter.message };
     const after = await ctx.coordination.observeResources(resources);
-    if (JSON.stringify(before) !== JSON.stringify(after) ||
-        JSON.stringify(prepared.result.outcome.result) !==
-            JSON.stringify(preparedAfter.result.outcome.result) ||
-        JSON.stringify(installed.result.outcome.result) !==
-            JSON.stringify(installedAfter.result.outcome.result) ||
-        JSON.stringify(control.result.outcome.result) !==
-            JSON.stringify(controlAfter.result.outcome.result)) {
+    if (!isDeepStrictEqual([
+        before,
+        prepared.result.outcome.result,
+        installed.result.outcome.result,
+        control.result.outcome.result,
+    ], [
+        after,
+        preparedAfter.result.outcome.result,
+        installedAfter.result.outcome.result,
+        controlAfter.result.outcome.result,
+    ])) {
         return {
             status: 1,
             outcomes,
@@ -141,14 +146,10 @@ export async function gatherProbe(ctx) {
         },
     };
 }
-export async function runProbe(argv, ctx) {
-    // The CLI parser rejects these inputs first. Keep this guard for direct
-    // in-process callers, which do not necessarily pass through that parser.
-    const porcelain = argv.length === 1 && argv[0] === "--porcelain";
-    if (!porcelain && argv.length !== 0) {
-        ctx.stderr.write(PROBE_USAGE);
-        return 2;
-    }
+// Runs the probe and reports a failed gather the way every probing command
+// does: `error:` for a throw, replay of every collected outcome, then the
+// command-level message. null means the caller must return 1.
+export async function probeFacts(ctx) {
     let outcome;
     try {
         outcome = await gatherProbe(ctx);
@@ -159,7 +160,7 @@ export async function runProbe(argv, ctx) {
         // `src/selection-store.ts:116-121::if (cause instanceof SafetyError && cause.module === "selection") {`.
         // oneLine() bounds any inherited git or filesystem diagnostic to one line.
         ctx.stderr.write(`error: ${oneLine(cause)}\n`);
-        return 1;
+        return null;
     }
     // Replay before reporting a command-level result on either path.
     for (const each of outcome.outcomes)
@@ -170,9 +171,22 @@ export async function runProbe(argv, ctx) {
         if (outcome.message !== null) {
             ctx.stderr.write(`error: ${outcome.message}\n`);
         }
-        return 1;
+        return null;
     }
-    const rendered = ctx.adapter.presentation.renderProbe(outcome.facts);
+    return outcome.facts;
+}
+export async function runProbe(argv, ctx) {
+    // The CLI parser rejects these inputs first. Keep this guard for direct
+    // in-process callers, which do not necessarily pass through that parser.
+    const porcelain = argv.length === 1 && argv[0] === "--porcelain";
+    if (!porcelain && argv.length !== 0) {
+        ctx.stderr.write(PROBE_USAGE);
+        return 2;
+    }
+    const facts = await probeFacts(ctx);
+    if (facts === null)
+        return 1;
+    const rendered = ctx.adapter.presentation.renderProbe(facts);
     ctx.stdout.write(porcelain ? rendered.porcelain : rendered.human);
-    return outcome.facts.resourceState === "recovery-required" ? 1 : 0;
+    return facts.resourceState === "recovery-required" ? 1 : 0;
 }

package/dist/commands/uninstall.js

@@ -1,15 +1,9 @@
 import { tmpdir } from "node:os";
 import { oneLine } from "../cli-arguments.js";
-import { withWorkspace, workspaceRemovalFailure } from "../workspace.js";
-import { GatherFailure, callAdapter, } from "./adapter-call.js";
+import { withWorkspaceReporting, } from "../workspace.js";
+import { GatherFailure, invoke, writeOutput } from "./adapter-call.js";
 import { runWithMutation } from "./mutation.js";
 import { replayOutcome } from "./probe.js";
-async function invoke(call, failure, outcomes) {
-    const result = await callAdapter(call, failure);
-    if (result.result !== null)
-        outcomes.push(result.result.outcome);
-    return result;
-}
 // Collect outcomes without writing so output failures cannot be classified as
 // inspection failures. Replay collected outcomes after gathering completes.
 async function gatherUninstall(ctx) {
@@ -17,9 +11,8 @@ async function gatherUninstall(ctx) {
     // Kept outside the workspace callback so a workspace failure preserves every
     // outcome collected before it.
     const outcomes = [];
-    let cleanupWarning = null;
     try {
-        const outcome = await withWorkspace(parent, "superpowers-manager.uninstall.", async (workspace) => {
+        return await withWorkspaceReporting(parent, "superpowers-manager.uninstall.", async (workspace) => {
             const env = { ...ctx.env, TMPDIR: workspace };
             const failed = (message) => ({
                 status: 1,
@@ -59,44 +52,30 @@ async function gatherUninstall(ctx) {
                 outcomes,
                 output: ctx.adapter.presentation.renderRemovalCompletion(ownership, removalInput),
             };
-        }, {
-            // Suppresses withWorkspace's throw on a POST-SUCCESS cleanup failure,
-            // so the UninstallOutcome the callback already computed still comes
-            // back as `outcome` instead of being discarded. Runs synchronously,
-            // as the option requires (src/workspace.ts).
-            onCleanupFailure: (path) => {
-                cleanupWarning = workspaceRemovalFailure(path);
-            },
         });
-        return { outcome, cleanupWarning };
     }
     catch (cause) {
-        // Reachable only for mkdtemp failure, with nothing collected yet: this
-        // callback never throws -- every ctx.adapter throw is already caught
-        // inside invoke(), and presenceFlag/
-        // reportLegacyState are pure (src/harnesses/codex/lifecycle.ts's header comment) -- so a
-        // post-success cleanup failure is handled by onCleanupFailure above and
-        // cannot reach here. Wrapping with `outcomes` anyway keeps the class
-        // total over its declared contract rather than assuming the callback's
-        // purity at the throw site.
+        // Reachable only for mkdtemp failure, with nothing collected yet: the
+        // callback never throws (every ctx.adapter throw is caught inside
+        // invoke()), and a post-success cleanup failure comes back as
+        // cleanupWarning. Wrapping with `outcomes` anyway keeps the class total
+        // over its declared contract rather than assuming the callback's purity at
+        // the throw site.
         throw new GatherFailure("uninstall gather failed", cause, outcomes);
     }
 }
 export async function runUninstall(argv, ctx) {
-    return await runWithMutation("uninstall", ctx, async (scoped) => performUninstall(argv, scoped));
+    // argv is ignored: scripts/uninstall never reads "$@".
+    return await runWithMutation("uninstall", ctx, async (scoped) => performUninstall(scoped));
 }
-async function performUninstall(argv, ctx) {
-    // scripts/uninstall never reads "$@", so extra arguments are silently
-    // ignored -- the same asymmetry runPrepare documents at its own
-    // `void argv;`.
-    void argv;
+async function performUninstall(ctx) {
     let run;
     try {
         run = await gatherUninstall(ctx);
     }
     catch (cause) {
-        // Replay collected outcomes before reporting a gather failure. The
-        // cleanup reporter retains post-success cleanup failures as data.
+        // Replay collected outcomes before reporting a gather failure. A
+        // post-success cleanup failure arrives as cleanupWarning, not here.
         const outcomes = cause instanceof GatherFailure ? cause.outcomes : [];
         for (const outcome of outcomes)
             replayOutcome(outcome, ctx);
@@ -104,7 +83,7 @@ async function performUninstall(argv, ctx) {
         ctx.stderr.write(`error: ${oneLine(inner)}\n`);
         return 1;
     }
-    const { outcome, cleanupWarning } = run;
+    const { value: outcome, cleanupWarning } = run;
     // Replay before reporting a command-level result on either path.
     for (const each of outcome.outcomes)
         replayOutcome(each, ctx);
@@ -115,19 +94,12 @@ async function performUninstall(argv, ctx) {
         if (outcome.message !== null) {
             ctx.stderr.write(`error: ${outcome.message}\n`);
         }
-        if (outcome.output !== null) {
-            for (const line of outcome.output.stdout)
-                ctx.stdout.write(`${line}\n`);
-            for (const line of outcome.output.stderr)
-                ctx.stderr.write(`${line}\n`);
-        }
+        if (outcome.output !== null)
+            writeOutput(outcome.output, ctx);
         status = 1;
     }
     else {
-        for (const line of outcome.output.stdout)
-            ctx.stdout.write(`${line}\n`);
-        for (const line of outcome.output.stderr)
-            ctx.stderr.write(`${line}\n`);
+        writeOutput(outcome.output, ctx);
         status = 0;
     }
     if (cleanupWarning !== null) {

package/dist/commands/unpin.js

@@ -1,6 +1,7 @@
 import { lstat, unlink } from "node:fs/promises";
 import { oneLine } from "../cli-arguments.js";
 import { selectionStatePath } from "../effective-selection.js";
+import { isErrno } from "../safe-path.js";
 import { selectionError } from "../selection.js";
 import { readConfigRef } from "../upstream.js";
 const NOT_REGULAR = "selection state path is not a regular file; remove it manually after inspecting";
@@ -24,7 +25,7 @@ async function attemptUnpin(ctx) {
             return await lstat(path);
         }
         catch (cause) {
-            if (cause.code === "ENOENT")
+            if (isErrno(cause, "ENOENT"))
                 return null;
             throw selectionError(`cannot inspect selection state: ${path}`);
         }

package/dist/commands/update.js

@@ -1,37 +1,16 @@
-// Update delegates adapter calls to probe, prepare, and install. Those
-// mutating commands own their workspaces, so update opens none itself.
-import { oneLine } from "../cli-arguments.js";
-import { runInstall, writeOutput } from "./install.js";
-import { gatherProbe, replayOutcome } from "./probe.js";
+import { writeOutput } from "./adapter-call.js";
+import { runInstall } from "./install.js";
+import { probeFacts } from "./probe.js";
 import { runPrepare } from "./prepare.js";
 import { runWithMutation } from "./mutation.js";
 export async function runUpdate(argv, ctx) {
-    return await runWithMutation("update", ctx, async (scoped) => performUpdate(argv, scoped));
+    // argv is ignored: scripts/update never reads "$@".
+    return await runWithMutation("update", ctx, async (scoped) => performUpdate(scoped));
 }
-async function performUpdate(argv, ctx) {
-    // scripts/update never reads "$@", so extra arguments are silently
-    // ignored -- the same asymmetry runPrepare and runInstall document.
-    void argv;
-    let probe;
-    try {
-        probe = await gatherProbe(ctx);
-    }
-    catch (cause) {
-        // Gathering does not write, so this catch cannot misclassify an output
-        // failure. oneLine() bounds any inherited diagnostic to one line.
-        ctx.stderr.write(`error: ${oneLine(cause)}\n`);
+async function performUpdate(ctx) {
+    const facts = await probeFacts(ctx);
+    if (facts === null)
         return 1;
-    }
-    // Replay first, on both paths, before any decision -- clause 1.
-    for (const outcome of probe.outcomes)
-        replayOutcome(outcome, ctx);
-    if (probe.status === 1) {
-        if (probe.message !== null) {
-            ctx.stderr.write(`error: ${probe.message}\n`);
-        }
-        return 1;
-    }
-    const facts = probe.facts;
     if (facts.ownership.installEligibility.kind === "blocked") {
         writeOutput(facts.ownership.installEligibility.output, ctx);
         return 1;

package/dist/domain/refs.js

@@ -12,9 +12,6 @@ export const COMMIT_INPUT_RE = /^[0-9A-Fa-f]{40}$/;
 export function isTagRef(value) {
     return TAG_RE.test(value);
 }
-export function isCommit(value) {
-    return COMMIT_RE.test(value);
-}
 export function normalizeCommitInput(value) {
     return COMMIT_INPUT_RE.test(value) ? value.toLowerCase() : null;
 }

package/dist/effective-selection.js

@@ -1,5 +1,5 @@
 // `selectionError` already exists at
-// `src/selection.ts:41::export function selectionError` and tags errors with
+// `src/selection.ts:34::export function selectionError` and tags errors with
 // module "selection". Import it rather than defining a second one.
 import { normalizeSaved, selectionError, validateSource, } from "./selection.js";
 import { readSelectionState } from "./selection-store.js";
@@ -67,7 +67,6 @@ export async function computeEffectiveSelection(root, env) {
     let selectionOrigin;
     let selectionMode;
     let requestedRef;
-    let usesSavedPin = false;
     if (env.SUPERPOWERS_REF) {
         selectionOrigin = "environment";
         selectionMode = "override";
@@ -77,19 +76,6 @@ export async function computeEffectiveSelection(root, env) {
         selectionOrigin = "user-config";
         selectionMode = "pinned";
         requestedRef = saved.saved_requested_ref;
-        usesSavedPin = true;
-    }
-    else if (saved.saved_mode === "track-latest") {
-        selectionOrigin = "user-config";
-        selectionMode = "track-latest";
-        requestedRef = "latest-release";
-    }
-    else {
-        selectionOrigin = "package-default";
-        selectionMode = "default";
-        requestedRef = await readConfigRef(root, env);
-    }
-    if (usesSavedPin) {
         return {
             selectionOrigin,
             selectionMode,
@@ -104,6 +90,16 @@ export async function computeEffectiveSelection(root, env) {
             saved,
         };
     }
+    else if (saved.saved_mode === "track-latest") {
+        selectionOrigin = "user-config";
+        selectionMode = "track-latest";
+        requestedRef = "latest-release";
+    }
+    else {
+        selectionOrigin = "package-default";
+        selectionMode = "default";
+        requestedRef = await readConfigRef(root, env);
+    }
     const resolution = await resolveRef(effectiveSource, requestedRef);
     // `Resolution` (src/upstream.ts) is { kind, ref, commit } — the
     // resolved ref field is named `ref`, not `resolvedRef`.

package/dist/git-tree.js

@@ -1,10 +1,10 @@
 import { execFile } from "node:child_process";
 import { chmod, mkdir, symlink, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { ARTIFACT_RECEIPT } from "./artifact-tree.js";
 import { COMMIT_RE } from "./domain/refs.js";
-import { assertNoFollowType, assertSymlinkTargetContained, } from "./safe-path.js";
+import { assertNoFollowType, assertSymlinkTargetContained, isContained, } from "./safe-path.js";
 import { SafetyError } from "./safety-error.js";
 const exec = promisify(execFile);
 const DECODER = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
@@ -66,13 +66,11 @@ export async function materializeGitTree(repository, commit, destination) {
         }
         for (const entry of entries.filter((entry) => entry.mode === "120000")) {
             const target = DECODER.decode(await gitBytes(repository, ["cat-file", "blob", entry.oid]));
-            const path = join(destination, entry.path), suffix = relative(resolve(destination), resolve(dirname(path), target));
+            const path = join(destination, entry.path);
             if (!target ||
                 target.includes("\0") ||
                 isAbsolute(target) ||
-                suffix === ".." ||
-                suffix.startsWith("../") ||
-                isAbsolute(suffix))
+                !isContained(resolve(destination), resolve(dirname(path), target)))
                 throw new Error("link escape");
             await symlink(target, path);
         }