tickmarkr 1.90.2 → 1.90.4

package/dist/cli/commands/doctor.d.ts

@@ -28,4 +28,31 @@ export declare function applyRunnerIgnore(cwd: string): {
     action: "none" | "wrote" | "manual";
     detail: string;
 };
+/**
+ * Q140s(b) / operator directive (D-OBS-10): the repo's package manager must resolve in
+ * THIS process's environment — the same class of environment the daemon spawns gates
+ * into. Dossier run 1: pnpm lived only in the operator's interactive PATH; every gate
+ * died on `Unable to find package manager binary` / `spawnSync pnpm ENOENT`, the reds
+ * were baseline-forgiven, and no suite ever ran. A which(1)-grade check at doctor time
+ * turns that into preflight information.
+ */
+export declare function packageManagerFinding(cwd: string, probe?: (pm: string) => boolean): {
+    verdict: "pass" | "fail";
+    detail: string;
+} | undefined;
+/**
+ * Q142s: tickmarkr guarded every binary except its own. Exhibit (operator machine,
+ * 2026-08-12): an orphaned npm-prefix root at ~/.local held tickmarkr AND tkr at
+ * 1.85.0 beside the live 1.90.3 — two seats disagreed about the tool's version and
+ * were BOTH right about their own PATH order (a consultant reported "no verify
+ * command" — verify shipped in 1.90.0 — while the overseer saw it present). Checks
+ * EVERY bin name the package declares: the first sweep of that machine missed `tkr`.
+ */
+export declare function selfShadowFinding(ownVersion: string, cwd?: string, resolve?: (bin: string, cwd: string) => {
+    resolved?: string;
+    all: string[];
+}, versionOf?: (path: string) => string | undefined): {
+    verdict: "pass" | "fail";
+    detail: string;
+} | undefined;
 export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[], opts?: DoctorOpts): Promise<string>;

package/dist/cli/commands/doctor.js

@@ -1,7 +1,10 @@
 import { writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { detectPackageManager } from "../../gates/baseline.js";
+import { version } from "./version.js";
+import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, resolveShellBinary, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, claudeCode, resolveClaudeAliasIdentity } from "../../adapters/claude-code.js";
 import { BANNER, dim, fail, kvRow, legend, ok, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir, stateDirName } from "../../graph/graph.js";
@@ -149,6 +152,59 @@ export function applyRunnerIgnore(cwd) {
     writeFileSync(file, original); // verify failed: never leave a half-fix behind
     return { action: "manual", detail: finding.detail };
 }
+/**
+ * Q140s(b) / operator directive (D-OBS-10): the repo's package manager must resolve in
+ * THIS process's environment — the same class of environment the daemon spawns gates
+ * into. Dossier run 1: pnpm lived only in the operator's interactive PATH; every gate
+ * died on `Unable to find package manager binary` / `spawnSync pnpm ENOENT`, the reds
+ * were baseline-forgiven, and no suite ever ran. A which(1)-grade check at doctor time
+ * turns that into preflight information.
+ */
+export function packageManagerFinding(cwd, probe = (pm) => spawnSync(pm, ["--version"], { stdio: "ignore", shell: false }).error === undefined) {
+    if (!existsSync(join(cwd, "package.json")))
+        return undefined;
+    const pm = detectPackageManager(cwd);
+    if (probe(pm))
+        return { verdict: "pass", detail: `${pm} (detected) resolves in this environment` };
+    return {
+        verdict: "fail",
+        detail: `repo uses ${pm} but the binary does not resolve in this environment — every auto-detected gate command will die before running any suite (fix: corepack enable, or install ${pm} on the daemon's PATH)`,
+    };
+}
+/**
+ * Q142s: tickmarkr guarded every binary except its own. Exhibit (operator machine,
+ * 2026-08-12): an orphaned npm-prefix root at ~/.local held tickmarkr AND tkr at
+ * 1.85.0 beside the live 1.90.3 — two seats disagreed about the tool's version and
+ * were BOTH right about their own PATH order (a consultant reported "no verify
+ * command" — verify shipped in 1.90.0 — while the overseer saw it present). Checks
+ * EVERY bin name the package declares: the first sweep of that machine missed `tkr`.
+ */
+export function selfShadowFinding(ownVersion, cwd = process.cwd(), resolve = resolveShellBinary, versionOf = (p) => {
+    const r = spawnSync(p, ["version"], { encoding: "utf8", timeout: 5_000, shell: false });
+    return r.status === 0 ? r.stdout.trim().split("\n")[0] : undefined;
+}) {
+    const hits = new Map(); // path -> version
+    for (const bin of ["tickmarkr", "tkr"]) {
+        for (const p of resolve(bin, cwd).all) {
+            if (!hits.has(p))
+                hits.set(p, versionOf(p) ?? "?");
+        }
+    }
+    if (hits.size === 0)
+        return undefined; // no install on PATH (repo checkout) — nothing to shadow
+    const stale = [...hits].filter(([, v]) => v !== ownVersion);
+    if (stale.length === 0) {
+        return { verdict: "pass", detail: `single install root at ${ownVersion} (${[...hits.keys()].join(", ")})` };
+    }
+    const listing = stale.map(([p, v]) => `${p} → ${v}`).join(", ");
+    // One mismatched hit and it's the one running? Impossible — it would report ownVersion.
+    // Mismatch therefore means a SECOND root: a shell or daemon with a different PATH
+    // order runs a different tickmarkr than this one, silently.
+    return {
+        verdict: "fail",
+        detail: `stale tickmarkr/tkr binaries on PATH: ${listing} (running ${ownVersion}) — a seat with different PATH order silently runs the old binary; remove the stale install root`,
+    };
+}
 export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(), opts = {}) {
     if (_argv.length === 1 && _argv[0] === "--refresh-catalog") {
         const refreshed = await refreshCatalogCommand({ repoRoot: cwd, now: opts.catalogNow });
@@ -240,6 +296,14 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             rows.push(alignedStatusRow(runnerIgnore.verdict, "test-runner", runnerIgnore.detail));
         }
     }
+    // Q140s(b): the repo's package manager must resolve where gates spawn (D-OBS-10).
+    const pmRow = packageManagerFinding(cwd);
+    if (pmRow)
+        rows.push(alignedStatusRow(pmRow.verdict, "package-manager", pmRow.detail));
+    // Q142s: tickmarkr's own binary gets the shadow check every adapter binary already had.
+    const shadowRow = selfShadowFinding(await version(), cwd);
+    if (shadowRow)
+        rows.push(alignedStatusRow(shadowRow.verdict, "tickmarkr-binary", shadowRow.detail));
     // v1.22 T5: workspace-trust pre-flight — per installed adapter: trusted | seeded | action-required | n/a.
     // action-required names the exact one-time command (or dialog) the operator must run once.
     rows.push(legend("workspace trust:"));

package/dist/gates/baseline.d.ts

@@ -37,6 +37,15 @@ export declare function freshFailures(entry: BaselineCommand | undefined, raw: s
     failing: string[];
     unreadable: boolean;
 };
+export type PackageManager = "npm" | "pnpm" | "yarn" | "bun";
+/**
+ * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.
+ * The `packageManager` field is authoritative (corepack's own contract); lockfiles
+ * break ties; npm is only the LAST resort. Dossier exhibit: auto-detected
+ * `npm run -s test` on a repo whose engines said `"npm": "please-use-pnpm"` — turbo
+ * then failed to resolve pnpm and every gate died on environment, not code.
+ */
+export declare function detectPackageManager(repoRoot: string): PackageManager;
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;
 /**
  * The ceiling a battery runs under: whichever is larger of the shipped constant and the slack applied

package/dist/gates/baseline.js

@@ -123,17 +123,50 @@ export function freshFailures(entry, raw) {
     const fresh = current.filter((f) => !known.has(f) && (!FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ")));
     return { failing: fresh.filter((f) => f !== UNRECOGNIZED_FAILURE), unreadable: current.includes(UNRECOGNIZED_FAILURE) };
 }
+/**
+ * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.
+ * The `packageManager` field is authoritative (corepack's own contract); lockfiles
+ * break ties; npm is only the LAST resort. Dossier exhibit: auto-detected
+ * `npm run -s test` on a repo whose engines said `"npm": "please-use-pnpm"` — turbo
+ * then failed to resolve pnpm and every gate died on environment, not code.
+ */
+export function detectPackageManager(repoRoot) {
+    const pkgPath = join(repoRoot, "package.json");
+    try {
+        const pm = JSON.parse(readFileSync(pkgPath, "utf8")).packageManager;
+        const name = pm?.split("@")[0];
+        if (name === "pnpm" || name === "yarn" || name === "bun" || name === "npm")
+            return name;
+    }
+    catch { /* no or unparseable manifest: lockfiles decide */ }
+    if (existsSync(join(repoRoot, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(repoRoot, "yarn.lock")))
+        return "yarn";
+    if (existsSync(join(repoRoot, "bun.lock")) || existsSync(join(repoRoot, "bun.lockb")))
+        return "bun";
+    return "npm";
+}
+// Silent where the manager supports it everywhere (npm -s; pnpm's global -s), bare
+// where a flag would break a major version (yarn berry rejects run -s; bun is quiet).
+const RUN_PREFIX = {
+    npm: "npm run -s",
+    pnpm: "pnpm -s run",
+    yarn: "yarn run",
+    bun: "bun run",
+};
 export function detectGateCommands(repoRoot, cfg) {
     const out = {};
     const pkgPath = join(repoRoot, "package.json");
     const scripts = existsSync(pkgPath)
         ? (JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {})
         : {};
+    const runPrefix = RUN_PREFIX[detectPackageManager(repoRoot)];
     for (const name of ["build", "test", "lint"]) {
         if (cfg.gates[name])
             out[name] = cfg.gates[name];
         else if (scripts[name])
-            out[name] = `npm run -s ${name}`;
+            out[name] = `${runPrefix} ${name}`;
     }
     return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.90.2",
+  "version": "1.90.4",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",