wizz-method 1.4.0 → 1.5.0

package/tools/installer/core/manifest-generator.js

@@ -56,7 +56,14 @@ class ManifestGenerator {
     this.updatedModules = allModules; // Include ALL modules (including custom) for scanning
 
     this.wizzDir = wizzDir;
-    this.wizzFolderName = path.basename(wizzDir); // Get the actual folder name (e.g., '_wizz' or 'wizz')
+    // The folder name embedded into skill-manifest.csv's `path` column must be
+    // the FINAL name, not necessarily wizzDir's current basename: a fresh
+    // install (A14, atomic install) calls generateManifests while wizzDir is
+    // still the `_wizz.tmp-<pid>/` scaffold, ahead of the tmp→real rename.
+    // The installer passes `options.wizzFolderName` (the real, post-swap
+    // name) in that case; everything else (updates, direct callers that
+    // don't pass the option) keeps deriving it from the directory itself.
+    this.wizzFolderName = options.wizzFolderName || path.basename(wizzDir);
     this.allInstalledFiles = installedFiles;
 
     if (!Object.prototype.hasOwnProperty.call(options, 'ides')) {

package/tools/installer/core/manifest.js

@@ -11,6 +11,65 @@ const execFileAsync = promisify(execFile);
 const NPM_LOOKUP_TIMEOUT_MS = 10_000;
 const NPM_PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
 
+// Retry pontual (1 re-tentativa, backoff curto) para o lookup no registry npm.
+// Só re-tenta em erro de rede transitório (timeout, ECONNRESET, ENOTFOUND,
+// EAI_AGAIN, 5xx). Erros lógicos (4xx, JSON inválido) não são re-tentados.
+const NPM_LOOKUP_RETRY_DELAY_MS = 300;
+const TRANSIENT_ERROR_CODES = new Set(['ECONNRESET', 'ENOTFOUND', 'EAI_AGAIN', 'ETIMEDOUT']);
+
+function isTransientNetworkError(error) {
+  if (!error) return false;
+  if (typeof error.statusCode === 'number') return error.statusCode >= 500;
+  if (error.code && TRANSIENT_ERROR_CODES.has(error.code)) return true;
+  return /timed out/i.test(error.message || '');
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// Uma única tentativa de GET no registry npm; rejeita em erro de rede,
+// timeout ou status 5xx (para o wrapper com retry decidir).
+function fetchNpmRegistryOnce(packageName, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const url = `https://registry.npmjs.org/${encodeURIComponent(packageName)}`;
+    const request = https.get(url, (res) => {
+      let data = '';
+      res.on('data', (chunk) => (data += chunk));
+      res.on('end', () => {
+        if (res.statusCode >= 500) {
+          const err = new Error(`npm registry returned ${res.statusCode} for ${packageName}`);
+          err.statusCode = res.statusCode;
+          reject(err);
+          return;
+        }
+        resolve(data);
+      });
+    });
+
+    request.setTimeout(timeoutMs, () => {
+      request.destroy();
+      const err = new Error(`npm registry request timed out for ${packageName}`);
+      err.code = 'ETIMEDOUT';
+      reject(err);
+    });
+
+    request.on('error', reject);
+  });
+}
+
+// Wrapper com 1 re-tentativa em erro transitório. Erro não-transitório
+// (ex.: 4xx, resposta malformada) propaga direto, sem retry.
+async function fetchNpmRegistryWithRetry(packageName, timeoutMs) {
+  try {
+    return await fetchNpmRegistryOnce(packageName, timeoutMs);
+  } catch (error) {
+    if (!isTransientNetworkError(error)) throw error;
+    await delay(NPM_LOOKUP_RETRY_DELAY_MS);
+    return fetchNpmRegistryOnce(packageName, timeoutMs);
+  }
+}
+
 function isValidNpmPackageName(packageName) {
   return typeof packageName === 'string' && NPM_PACKAGE_NAME_PATTERN.test(packageName);
 }
@@ -364,28 +423,14 @@ class Manifest {
         });
         return stdout.trim();
       } catch {
-        // Fallback to npm registry API
-        return new Promise((resolve) => {
-          const request = https.get(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, (res) => {
-            let data = '';
-            res.on('data', (chunk) => (data += chunk));
-            res.on('end', () => {
-              try {
-                const pkg = JSON.parse(data);
-                resolve(pkg['dist-tags']?.latest || pkg.version || null);
-              } catch {
-                resolve(null);
-              }
-            });
-          });
-
-          request.setTimeout(NPM_LOOKUP_TIMEOUT_MS, () => {
-            request.destroy();
-            resolve(null);
-          });
-
-          request.on('error', () => resolve(null));
-        });
+        // Fallback to npm registry API (com 1 retry pontual em falha transitória)
+        try {
+          const data = await fetchNpmRegistryWithRetry(packageName, NPM_LOOKUP_TIMEOUT_MS);
+          const pkg = JSON.parse(data);
+          return pkg['dist-tags']?.latest || pkg.version || null;
+        } catch {
+          return null;
+        }
       }
     } catch {
       return null;

package/tools/installer/core/module-config-writer.js

@@ -0,0 +1,110 @@
+/**
+ * Per-module `config.yaml` generation.
+ *
+ * Extracted from `Installer.generateModuleConfigs` (installer god-object
+ * breakup, A15/A17, auditoria 2026-07-07, item 3.1). Pure-ish function: the
+ * only state it needs from the caller is a `trackFile` callback (in place of
+ * the original `this.installedFiles.add`).
+ */
+const path = require('node:path');
+const fs = require('../fs-native');
+const { getProjectRoot } = require('../project-root');
+
+/**
+ * Generate clean config.yaml files for each installed module.
+ * @param {string} wizzDir - WIZZ installation directory
+ * @param {Object} moduleConfigs - Collected configuration values
+ * @param {Object} deps - Injected dependencies
+ * @param {(filePath: string) => void} deps.trackFile - Records a written file as installed
+ */
+async function generateModuleConfigs(wizzDir, moduleConfigs, { trackFile }) {
+  const yaml = require('yaml');
+
+  // Extract core config values to share with other modules
+  const coreConfig = moduleConfigs.core || {};
+
+  // Get all installed module directories
+  const entries = await fs.readdir(wizzDir, { withFileTypes: true });
+  const nonModuleDirs = new Set(['_config', '_memory', 'memory', 'docs', 'scripts', 'custom']);
+  const installedModules = entries.filter((entry) => entry.isDirectory() && !nonModuleDirs.has(entry.name)).map((entry) => entry.name);
+
+  // Generate config.yaml for each installed module
+  for (const moduleName of installedModules) {
+    const modulePath = path.join(wizzDir, moduleName);
+
+    // Get module-specific config or use empty object if none
+    const config = moduleConfigs[moduleName] || {};
+
+    if (await fs.pathExists(modulePath)) {
+      const configPath = path.join(modulePath, 'config.yaml');
+
+      // Create header
+      const packageJson = require(path.join(getProjectRoot(), 'package.json'));
+      const header = `# ${moduleName.toUpperCase()} Module Configuration
+# Generated by Wizz Method installer
+# Version: ${packageJson.version}
+# Date: ${new Date().toISOString()}
+
+`;
+
+      // For non-core modules, add core config values directly
+      let finalConfig = { ...config };
+      let coreSection = '';
+
+      if (moduleName !== 'core' && coreConfig && Object.keys(coreConfig).length > 0) {
+        // Add core values directly to the module config
+        // These will be available for reference in the module
+        finalConfig = {
+          ...config,
+          ...coreConfig, // Spread core config values directly into the module config
+        };
+
+        // Create a comment section to identify core values
+        coreSection = '\n# Core Configuration Values\n';
+      }
+
+      // Clean the config to remove any non-serializable values (like functions)
+      const cleanConfig = structuredClone(finalConfig);
+
+      // Convert config to YAML
+      let yamlContent = yaml.stringify(cleanConfig, {
+        indent: 2,
+        lineWidth: 0,
+        minContentWidth: 0,
+      });
+
+      // If we have core values, reorganize the YAML to group them with their comment
+      if (coreSection && moduleName !== 'core') {
+        // Split the YAML into lines
+        const lines = yamlContent.split('\n');
+        const moduleConfigLines = [];
+        const coreConfigLines = [];
+
+        // Separate module-specific and core config lines
+        for (const line of lines) {
+          const key = line.split(':')[0].trim();
+          if (Object.prototype.hasOwnProperty.call(coreConfig, key)) {
+            coreConfigLines.push(line);
+          } else {
+            moduleConfigLines.push(line);
+          }
+        }
+
+        // Rebuild YAML with module config first, then core config with comment
+        yamlContent = moduleConfigLines.join('\n');
+        if (coreConfigLines.length > 0) {
+          yamlContent += coreSection + coreConfigLines.join('\n');
+        }
+      }
+
+      // Write the clean config file with POSIX-compliant final newline
+      const content = header + yamlContent;
+      await fs.writeFile(configPath, content.endsWith('\n') ? content : content + '\n', 'utf8');
+
+      // Track the config file in installedFiles
+      trackFile(configPath);
+    }
+  }
+}
+
+module.exports = { generateModuleConfigs };

package/tools/installer/core/preflight-tools-check.js

@@ -0,0 +1,82 @@
+/**
+ * Preflight check for `git`/`curl` in PATH (Tarefa 3.5c da auditoria,
+ * parte 2 item D6: "dependência de git/curl no PATH não checada antes dos
+ * installs → mensagem amigável em vez de stderr cru").
+ *
+ * `git` is a hard dependency of the install flow: official/custom module
+ * fetch and the changelog/version resolution all shell out to `git clone`/
+ * `git fetch`/`git rev-parse` deep inside custom-module-manager.js and
+ * external-manager.js. Without this check, a missing `git` surfaces as a
+ * raw `Command failed: git clone ...` / `ENOENT` stack trace from wherever
+ * the first git call happens to live — this check fails fast, once, with a
+ * plain-language message instead.
+ *
+ * `curl` is only used by specific optional CLI `install:` commands in
+ * skills-registry.yaml (e.g. `curl ... | sh`), which are opt-in and
+ * user-triggered, never run automatically during a plain install. Missing
+ * `curl` is therefore a warning, not a blocking error.
+ *
+ * Deliberately NOT wired into tools/installer/core/installer.js (that file
+ * is in scope for a separate god-object extraction pass) — this is called
+ * directly from the CLI entry point (commands/install.js), same pattern as
+ * ../core/wsl-node-check.js.
+ */
+const { execFileSync } = require('node:child_process');
+const prompts = require('../prompts');
+
+/**
+ * @param {string} bin
+ * @param {(bin: string, args: string[]) => Buffer} runner injectable for tests
+ * @returns {boolean}
+ */
+function isOnPath(bin, runner = defaultRunner) {
+  try {
+    runner(bin, ['--version']);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function defaultRunner(bin, args) {
+  return execFileSync(bin, args, { stdio: 'pipe' });
+}
+
+/**
+ * @param {{ runner?: Function }} [deps] injectable for tests
+ * @returns {{ git: boolean, curl: boolean }}
+ */
+function detectRequiredTools(deps = {}) {
+  const runner = deps.runner || defaultRunner;
+  return {
+    git: isOnPath('git', runner),
+    curl: isOnPath('curl', runner),
+  };
+}
+
+async function checkRequiredTools(deps = {}) {
+  const detection = detectRequiredTools(deps);
+
+  if (!detection.git) {
+    await prompts.log.error(
+      [
+        '`git` was not found on your PATH.',
+        '',
+        'The Wizz Method installer needs git to fetch official and custom modules.',
+        'Install git (https://git-scm.com/downloads) and rerun this command.',
+      ].join('\n'),
+    );
+    process.exit(1);
+  }
+
+  if (!detection.curl) {
+    await prompts.log.warn(
+      '`curl` was not found on your PATH. Most of the installer works fine without it, ' +
+        'but some optional CLI installs from the registry (skills-registry.yaml `install:` commands) shell out to curl and will fail until it is installed.',
+    );
+  }
+
+  return detection;
+}
+
+module.exports = { checkRequiredTools, detectRequiredTools, isOnPath };

package/tools/installer/core/quick-update.js

@@ -0,0 +1,209 @@
+/**
+ * Quick Update orchestration.
+ *
+ * Extracted from `Installer.quickUpdate` (installer god-object breakup,
+ * A15/A17, auditoria 2026-07-07, item 3.1). Kept as composition rather than
+ * a method on `Installer`: this function takes the `Installer` instance as
+ * an explicit parameter and calls its public surface (`findWizzDir`,
+ * `externalModuleManager`, `manifest`, `install`) instead of inheriting from
+ * it, so it can be tested/reasoned about independently.
+ */
+const path = require('node:path');
+const fs = require('../fs-native');
+const { OfficialModules } = require('../modules/official-modules');
+const { ExistingInstall } = require('./existing-install');
+const { getProjectRoot } = require('../project-root');
+const prompts = require('../prompts');
+
+/**
+ * Quick update: preserves all settings and only prompts for new config fields.
+ * @param {import('./installer').Installer} installer - Installer instance (composition, not inheritance)
+ * @param {Object} config - Configuration with directory
+ * @returns {Object} Update result
+ */
+async function quickUpdate(installer, config) {
+  const projectDir = path.resolve(config.directory);
+  const { wizzDir } = await installer.findWizzDir(projectDir);
+
+  // Check if wizz directory exists
+  if (!(await fs.pathExists(wizzDir))) {
+    throw new Error(`Wizz not installed at ${wizzDir}. Use regular install for first-time setup.`);
+  }
+
+  // Announce the scope up front: Quick Update only refreshes already
+  // installed modules with preserved settings. It never provisions global
+  // skills, MCP servers, or CLIs (see the isQuickUpdate() gate below, in
+  // _installAndConfigure); that only happens on a fresh install or
+  // Modify. Surfacing this before any work starts avoids the confusion of
+  // "I updated and skills didn't come" (see project memory).
+  await prompts.log.info(
+    'Quick Update: atualiza os módulos já instalados com as configurações preservadas. Skills globais, MCPs e CLIs novos não são provisionados neste modo; rode install e escolha "Modify Wizz Installation" para isso.',
+  );
+
+  // Detect existing installation
+  const existingInstall = await ExistingInstall.detect(wizzDir);
+  const installedModules = existingInstall.moduleIds;
+  const configuredIdes = existingInstall.ides;
+  const projectRoot = path.dirname(wizzDir);
+
+  // Get available modules (what we have source for)
+  const availableModulesData = await new OfficialModules().listAvailable();
+  const availableModules = [...availableModulesData.modules];
+
+  // Add external official modules to available modules
+  const externalModules = await installer.externalModuleManager.listAvailable();
+  for (const externalModule of externalModules) {
+    if (installedModules.includes(externalModule.code) && !availableModules.some((m) => m.id === externalModule.code)) {
+      availableModules.push({
+        id: externalModule.code,
+        name: externalModule.name,
+        isExternal: true,
+        fromExternal: true,
+      });
+    }
+  }
+
+  // Add installed custom modules to available modules
+  const { CustomModuleManager } = require('../modules/custom-module-manager');
+  const customMgr = new CustomModuleManager();
+  for (const moduleId of installedModules) {
+    if (!availableModules.some((m) => m.id === moduleId)) {
+      const customSource = await customMgr.findModuleSourceByCode(moduleId, { wizzDir });
+      if (customSource) {
+        availableModules.push({
+          id: moduleId,
+          name: moduleId,
+          isExternal: true,
+          fromCustom: true,
+        });
+      }
+    }
+  }
+
+  const availableModuleIds = new Set(availableModules.map((m) => m.id));
+
+  // Only update modules that are BOTH installed AND available (we have source for)
+  const modulesToUpdate = installedModules.filter((id) => availableModuleIds.has(id));
+  const skippedModules = installedModules.filter((id) => !availableModuleIds.has(id));
+
+  if (skippedModules.length > 0) {
+    await prompts.log.warn(`Skipping ${skippedModules.length} module(s) - no source available: ${skippedModules.join(', ')}`);
+  }
+
+  // Build channel options from the existing manifest FIRST so the config
+  // collector below (which triggers external-module clones via
+  // findModuleSource) knows each module's recorded channel and doesn't
+  // silently redecide it. Without this, modules previously on 'next' or
+  // 'pinned' would trigger a stable-channel tag lookup at config-collection
+  // time, burning GitHub API quota and potentially failing.
+  const manifestData = await installer.manifest.read(wizzDir);
+  const channelOptions = { global: null, nextSet: new Set(), pins: new Map(), warnings: [] };
+  if (manifestData?.modulesDetailed) {
+    const { fetchStableTags, classifyUpgrade, parseGitHubRepo } = require('../modules/channel-resolver');
+    for (const entry of manifestData.modulesDetailed) {
+      if (!entry?.name || !entry?.channel) continue;
+      if (entry.channel === 'pinned' && entry.version) {
+        channelOptions.pins.set(entry.name, entry.version);
+        continue;
+      }
+      if (entry.channel === 'next') {
+        channelOptions.nextSet.add(entry.name);
+        continue;
+      }
+      // Stable: classify the available upgrade. Patches and minors fall
+      // through (stable default picks up the top tag). A major upgrade
+      // requires opt-in, so under quick-update's non-interactive semantics
+      // we pin to the current version to prevent a silent breaking jump.
+      if (entry.channel === 'stable' && entry.version && entry.repoUrl) {
+        const parsed = parseGitHubRepo(entry.repoUrl);
+        if (!parsed) continue;
+        try {
+          const tags = await fetchStableTags(parsed.owner, parsed.repo);
+          if (tags.length === 0) continue;
+          const topTag = tags[0].tag;
+          const cls = classifyUpgrade(entry.version, topTag);
+          if (cls === 'major') {
+            channelOptions.pins.set(entry.name, entry.version);
+            await prompts.log.warn(
+              `${entry.name} ${entry.version} → ${topTag} is a new major release; staying on ${entry.version}. ` +
+                `Run \`wizz install\` (Modify) with \`--pin ${entry.name}=${topTag}\` to accept.`,
+            );
+          }
+        } catch (error) {
+          // Tag lookup failed (offline, rate-limited). Stay on the current
+          // version rather than guessing — the existing cache is already
+          // at that ref, so re-using it keeps the install stable.
+          channelOptions.pins.set(entry.name, entry.version);
+          await prompts.log.warn(`Could not check ${entry.name} for updates (${error.message}); staying on ${entry.version}.`);
+        }
+      }
+    }
+  }
+
+  // Load existing configs and collect new fields (if any)
+  await prompts.log.info('Checking for new configuration options...');
+  const quickModules = new OfficialModules({ channelOptions });
+  await quickModules.loadExistingConfig(projectDir);
+
+  let promptedForNewFields = false;
+
+  const corePrompted = await quickModules.collectModuleConfigQuick('core', projectDir, true);
+  if (corePrompted) {
+    promptedForNewFields = true;
+  }
+
+  for (const moduleName of modulesToUpdate) {
+    if (moduleName === 'core') continue; // Already collected above
+    const modulePrompted = await quickModules.collectModuleConfigQuick(moduleName, projectDir, true);
+    if (modulePrompted) {
+      promptedForNewFields = true;
+    }
+  }
+
+  if (!promptedForNewFields) {
+    await prompts.log.success('All configuration is up to date, no new options to configure');
+  }
+
+  quickModules.collectedConfig._meta = {
+    version: require(path.join(getProjectRoot(), 'package.json')).version,
+    installDate: new Date().toISOString(),
+    lastModified: new Date().toISOString(),
+  };
+
+  // Build config and delegate to install()
+  const installConfig = {
+    directory: projectDir,
+    modules: modulesToUpdate,
+    ides: configuredIdes,
+    coreConfig: quickModules.collectedConfig.core,
+    moduleConfigs: quickModules.collectedConfig,
+    // Forward `--set` overrides so the post-install patch step
+    // (`applySetOverrides`) runs at the end of quick-update too. The
+    // installer.install path applies them after writeCentralConfig.
+    setOverrides: config.setOverrides || {},
+    actionType: 'install',
+    _quickUpdate: true,
+    _preserveModules: skippedModules,
+    _existingModules: installedModules,
+    channelOptions,
+  };
+
+  const installResult = await installer.install(installConfig);
+
+  return {
+    // Quick Update delegates to install() under the hood; propagate its
+    // real success/errors/warnings instead of always reporting success so
+    // a partial failure (e.g. an IDE setup step) isn't hidden behind a
+    // green "Quick update complete!" (see M24 in the installer audit).
+    success: installResult.success,
+    moduleCount: modulesToUpdate.length,
+    hadNewFields: promptedForNewFields,
+    modules: modulesToUpdate,
+    skippedModules: skippedModules,
+    ides: configuredIdes,
+    errors: installResult.errors || 0,
+    warnings: installResult.warnings || 0,
+  };
+}
+
+module.exports = { quickUpdate };