wyvrnpm 2.4.1 → 2.8.1

package/src/build/recipe.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { substituteTemplateAll } = require('../options');
+const { readRecipeConf }        = require('../conf');
 
 /**
  * The `build` section of a source-repo `wyvrn.json` tells wyvrnpm how to
@@ -60,15 +61,22 @@ const SUPPORTED_SYSTEMS = new Set(['cmake']);
  * no options), any `${options.*}` token in the recipe also fails fast —
  * recipes don't get to reference undeclared options.
  *
+ * When `manifestForConfCollisionCheck` is supplied, PLAN-CONF.md §4.7's
+ * collision detection runs: any `-DKEY=...` in `build.configure` whose
+ * KEY is ALSO declared in recipe-level `conf.cmake.cache` is a hard
+ * error. Recipes pick ONE route, avoiding silent duplication.
+ *
  * @param {object|null|undefined} rawBuild
  * @param {Record<string, any>|null} [effectiveOptions]
+ * @param {object|null} [manifestForConfCollisionCheck]
  * @returns {{ system: string, generators: string[], configure: string[],
  *            buildArgs: string[], installDir: string, sourceSubdir: string,
  *            requiredTools: string[] }}
- * @throws {Error} when `system` is set but not supported, or when a
- *                 `${options.<name>}` template references an undeclared option
+ * @throws {Error} when `system` is set but not supported, when a
+ *                 `${options.<name>}` template references an undeclared option,
+ *                 or when `build.configure` collides with `conf.cmake.cache`.
  */
-function normalizeRecipe(rawBuild, effectiveOptions = null) {
+function normalizeRecipe(rawBuild, effectiveOptions = null, manifestForConfCollisionCheck = null) {
   const b = rawBuild ?? {};
   const system = b.system ?? DEFAULT_RECIPE.system;
   if (!SUPPORTED_SYSTEMS.has(system)) {
@@ -124,6 +132,31 @@ function normalizeRecipe(rawBuild, effectiveOptions = null) {
     'build.buildArgs',
   );
 
+  // PLAN-CONF.md §4.7: recipe-side collision between `build.configure`
+  // `-DKEY=...` args and declared `conf.cmake.cache.KEY` is a hard
+  // error. Forces the author to pick one route; avoids silent
+  // duplication where one route wins opaquely.
+  if (manifestForConfCollisionCheck) {
+    const recipeConfFlat = readRecipeConf(manifestForConfCollisionCheck);
+    const confCacheKeys = new Set(
+      Object.keys(recipeConfFlat)
+        .filter((k) => k.startsWith('cmake.cache.'))
+        .map((k) => k.slice('cmake.cache.'.length)),
+    );
+    if (confCacheKeys.size > 0) {
+      for (const arg of configure) {
+        const m = arg.match(/^-D([^=]+)=/);
+        if (m && confCacheKeys.has(m[1])) {
+          throw new Error(
+            `recipe collision: "${m[1]}" is set in both ` +
+            `build.configure (as ${JSON.stringify(arg)}) and ` +
+            `conf.cmake.cache. Pick one route — see claude/PLAN-CONF.md §4.7.`,
+          );
+        }
+      }
+    }
+  }
+
   return {
     system,
     generators,

package/src/commands/build.js

@@ -10,6 +10,8 @@ const { readManifest } = require('../manifest');
 const { normalizeRecipe, hasBuildRecipe } = require('../build/recipe');
 const { loadMsvcEnv }  = require('../build/msvc-env');
 const { archToVsPlatform, isVisualStudioGenerator } = require('../toolchain');
+const { parseCliConf } = require('../conf');
+const { LOCAL_OVERLAY_FILENAME } = require('../conf');
 const install          = require('./install');
 const log              = require('../logger');
 
@@ -29,8 +31,10 @@ const log              = require('../logger');
  * @returns {{ stale: boolean, reason: string }}
  */
 function isToolchainStale({ rootDir, manifestPath }) {
-  const lockPath      = path.join(path.dirname(manifestPath), 'wyvrn.lock');
-  const toolchainPath = path.join(rootDir, 'wyvrn_internal', 'wyvrn_toolchain.cmake');
+  const lockPath         = path.join(path.dirname(manifestPath), 'wyvrn.lock');
+  const toolchainPath    = path.join(rootDir, 'wyvrn_internal', 'wyvrn_toolchain.cmake');
+  const localOverlayPath = path.join(rootDir, LOCAL_OVERLAY_FILENAME);
+  const presetPath       = path.join(rootDir, 'CMakePresets.json');
 
   if (!fs.existsSync(toolchainPath)) {
     return { stale: true, reason: 'toolchain-missing' };
@@ -44,6 +48,19 @@ function isToolchainStale({ rootDir, manifestPath }) {
   if (lockMtime > toolchainMtime) {
     return { stale: true, reason: 'lock-newer-than-toolchain' };
   }
+
+  // PLAN-CONF.md §7: if wyvrn.local.json was edited after the preset was
+  // written, the preset's cacheVariables no longer reflect the consumer's
+  // intent. Re-run install (which regenerates the preset) rather than
+  // silently running a stale configure.
+  if (fs.existsSync(localOverlayPath) && fs.existsSync(presetPath)) {
+    const overlayMtime = fs.statSync(localOverlayPath).mtimeMs;
+    const presetMtime  = fs.statSync(presetPath).mtimeMs;
+    if (overlayMtime > presetMtime) {
+      return { stale: true, reason: 'local-overlay-newer-than-preset' };
+    }
+  }
+
   return { stale: false, reason: 'fresh' };
 }
 
@@ -89,10 +106,38 @@ function resolveBinaryDir({ rootDir, presetName }) {
  * @param {{ presetName: string, generator?: string|null, vsPlatform?: string|null }} args
  * @returns {string[]}
  */
-function buildConfigureArgs({ presetName, generator = null, vsPlatform = null }) {
+function buildConfigureArgs({
+  presetName,
+  generator = null,
+  vsPlatform = null,
+  confSets = null,
+  confUnsets = null,
+}) {
   const args = ['--preset', presetName];
   if (generator)  args.push('-G', generator);
   if (vsPlatform) args.push('-A', vsPlatform);
+
+  // PLAN-CONF.md §7: CLI --conf at build time applies as -D / -U
+  // overrides on top of whatever's baked into the preset. We do NOT
+  // silently regenerate the preset — that's a separate install.
+  // Confined to the cmake.cache namespace; other namespaces have
+  // different sinks (phase 3) and don't apply to `cmake --preset`.
+  if (confSets) {
+    const prefix = 'cmake.cache.';
+    for (const key of Object.keys(confSets).sort()) {
+      if (!key.startsWith(prefix)) continue;
+      const cmakeKey = key.slice(prefix.length);
+      args.push('-D', `${cmakeKey}=${confSets[key]}`);
+    }
+  }
+  if (confUnsets) {
+    const prefix = 'cmake.cache.';
+    for (const key of [...confUnsets].sort()) {
+      if (!key.startsWith(prefix)) continue;
+      args.push('-U', key.slice(prefix.length));
+    }
+  }
+
   return args;
 }
 
@@ -273,10 +318,26 @@ async function build(argv) {
     }
   }
 
+  // CLI --conf → -D / -U passthrough (PLAN-CONF.md §7). The preset's
+  // baked-in cacheVariables (from the last install) already reflect the
+  // recipe + local-overlay layers; CLI conf layers on top for this
+  // invocation only.
+  let cliConfSets, cliConfUnsets;
+  try {
+    const cli = parseCliConf(argv.conf);
+    cliConfSets   = cli.sets;
+    cliConfUnsets = cli.unsets;
+  } catch (err) {
+    log.error(`--conf parse error: ${err.message}`);
+    process.exit(1);
+  }
+
   const configureArgs = buildConfigureArgs({
     presetName,
     generator:  argv.generator,
     vsPlatform,
+    confSets:   cliConfSets,
+    confUnsets: cliConfUnsets,
   });
   log.info(`cmake ${configureArgs.join(' ')}`);
   await runCmake(configureArgs, cmakeEnv);

package/src/commands/cache.js

@@ -0,0 +1,189 @@
+'use strict';
+
+// F12: source-build cache inspection + targeted pruning.
+//
+// `wyvrnpm cache list [pattern]` prints a human-readable table (or JSON
+// with --format json) of everything in the machine-wide source-build
+// cache at `%LOCALAPPDATA%\wyvrnpm\bc\`.
+//
+// `wyvrnpm cache prune` removes cache entries per a policy:
+//   --keep-last N      retain N most-recently-touched per (name,version)
+//   --older-than 30d   also remove entries older than the threshold
+//   --pattern <glob>   restrict to matching package names
+//   --dry-run          print what would go, remove nothing
+//
+// The existing `wyvrnpm clean --build-cache` nukes everything; this is
+// the targeted alternative for teams whose `--upload-built` cache has
+// ballooned.
+
+const {
+  listCacheEntries,
+  computePruneSet,
+  removeCacheEntries,
+  parseDurationToCutoff,
+  getBuildCacheRoot,
+} = require('../build/cache');
+const log = require('../logger');
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  const units = ['KB', 'MB', 'GB', 'TB'];
+  let size = n / 1024, i = 0;
+  while (size >= 1024 && i < units.length - 1) { size /= 1024; i++; }
+  return `${size.toFixed(size >= 100 ? 0 : 1)} ${units[i]}`;
+}
+
+function formatMtime(ms) {
+  if (!ms) return '<unknown>';
+  return new Date(ms).toISOString().replace('T', ' ').slice(0, 16);
+}
+
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^${escaped.replace(/\*/g, '.*').replace(/\?/g, '.')}$`);
+}
+
+function patternFor(argPattern, positional) {
+  const src = argPattern ?? positional ?? null;
+  return src ? globToRegExp(src) : null;
+}
+
+// ---------------------------------------------------------------------------
+// list
+// ---------------------------------------------------------------------------
+
+/**
+ * wyvrnpm cache list [pattern] [--format json|text]
+ *
+ * @param {object} argv
+ */
+function list(argv) {
+  const entries = listCacheEntries();
+  const regex   = patternFor(argv.pattern, argv._?.[1]);
+  const filtered = regex ? entries.filter((e) => regex.test(e.name)) : entries;
+
+  // Newest first — matches what `ls -lt` users expect.
+  filtered.sort((a, b) => b.mtimeMs - a.mtimeMs);
+
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:       'cache-list',
+      cacheRoot:     getBuildCacheRoot(),
+      totalEntries:  filtered.length,
+      totalBytes:    filtered.reduce((s, e) => s + e.sizeBytes, 0),
+      entries:       filtered.map((e) => ({
+        name:        e.name,
+        version:     e.version,
+        profileHash: e.profileHash,
+        sizeBytes:   e.sizeBytes,
+        mtime:       new Date(e.mtimeMs).toISOString(),
+        hasArtefact: e.hasArtefact,
+        uploadCount: e.uploads.length,
+      })),
+    }, null, 2) + '\n');
+    return;
+  }
+
+  log.info(`Cache root : ${getBuildCacheRoot()}`);
+  if (filtered.length === 0) {
+    log.info('  (empty)');
+    return;
+  }
+
+  const rows = filtered.map((e) => [
+    e.name,
+    e.version,
+    e.profileHash,
+    formatBytes(e.sizeBytes),
+    formatMtime(e.mtimeMs),
+    e.uploads.length > 0 ? `${e.uploads.length}` : '-',
+  ]);
+  const header = ['NAME', 'VERSION', 'PROFILE HASH', 'SIZE', 'MTIME', 'UPLOADS'];
+  const widths = header.map((h, i) =>
+    Math.max(h.length, ...rows.map((r) => String(r[i]).length)),
+  );
+
+  const format = (cells) => cells.map((c, i) => String(c).padEnd(widths[i])).join('  ');
+  console.log('');
+  console.log('  ' + format(header));
+  console.log('  ' + widths.map((w) => '-'.repeat(w)).join('  '));
+  for (const r of rows) console.log('  ' + format(r));
+  console.log('');
+
+  const totalBytes = filtered.reduce((s, e) => s + e.sizeBytes, 0);
+  log.info(`${filtered.length} entries, ${formatBytes(totalBytes)} total`);
+}
+
+// ---------------------------------------------------------------------------
+// prune
+// ---------------------------------------------------------------------------
+
+/**
+ * wyvrnpm cache prune [--keep-last N] [--older-than 30d] [--pattern X] [--dry-run]
+ *
+ * Requires at least one of --keep-last / --older-than to avoid footgun
+ * (use `wyvrnpm clean --build-cache` to wipe everything).
+ *
+ * @param {object} argv
+ */
+function prune(argv) {
+  const hasKeep  = argv.keepLast !== undefined && argv.keepLast !== null;
+  const hasOlder = typeof argv.olderThan === 'string' && argv.olderThan.length > 0;
+
+  if (!hasKeep && !hasOlder) {
+    log.error(
+      'cache prune: specify --keep-last <N> and/or --older-than <duration>.\n' +
+      '  To wipe the entire build cache, use `wyvrnpm clean --build-cache`.',
+    );
+    process.exit(1);
+  }
+
+  const policy = {};
+  if (hasKeep) {
+    const n = Number(argv.keepLast);
+    if (!Number.isInteger(n) || n < 0) {
+      log.error(`--keep-last must be a non-negative integer, got ${argv.keepLast}`);
+      process.exit(1);
+    }
+    policy.keepLast = n;
+  }
+  if (hasOlder) {
+    try { policy.olderThanMs = parseDurationToCutoff(argv.olderThan); }
+    catch (err) { log.error(err.message); process.exit(1); }
+  }
+  if (argv.pattern) {
+    policy.patternRegex = globToRegExp(argv.pattern);
+  }
+
+  const entries  = listCacheEntries();
+  const pruneSet = computePruneSet(entries, policy);
+
+  if (pruneSet.length === 0) {
+    log.info('Nothing to prune under that policy.');
+    return;
+  }
+
+  const totalBytes = pruneSet.reduce((s, e) => s + e.sizeBytes, 0);
+  const verb = argv.dryRun ? 'Would remove' : 'Removing';
+  log.info(`${verb} ${pruneSet.length} cache entr${pruneSet.length === 1 ? 'y' : 'ies'}, ${formatBytes(totalBytes)}:`);
+  for (const e of pruneSet) {
+    console.log(`  - ${e.name}@${e.version} [${e.profileHash}]  ${formatBytes(e.sizeBytes)}  ${formatMtime(e.mtimeMs)}`);
+  }
+
+  if (argv.dryRun) {
+    log.info('(dry-run — nothing deleted)');
+    return;
+  }
+
+  const removed = removeCacheEntries(pruneSet);
+  log.info(`Removed ${removed.length} of ${pruneSet.length} cache entr${pruneSet.length === 1 ? 'y' : 'ies'}`);
+  if (removed.length < pruneSet.length) {
+    log.warn(`${pruneSet.length - removed.length} entr${pruneSet.length - removed.length === 1 ? 'y' : 'ies'} could not be removed (permissions or concurrent access)`);
+  }
+}
+
+module.exports = { list, prune };

package/src/commands/configure.js

@@ -27,8 +27,9 @@ function printSection(title, sources) {
 }
 
 function authLabel(src) {
-  if (src.profile) return `[profile: ${src.profile}]`;
-  if (src.token)   return '[token: ***]';
+  if (src.profile)  return `[profile: ${src.profile}]`;
+  if (src.tokenEnv) return `[token-env: ${src.tokenEnv}]`;
+  if (src.token)    return '[token: ***]';
   return '';
 }
 
@@ -38,12 +39,22 @@ function authLabel(src) {
  */
 function addSource(argv) {
   const { kind, name, url, profile, token } = argv;
+  // yargs delivers --token-env as argv['token-env']; accept both shapes
+  // so programmatic callers with camelCase also work.
+  const tokenEnv = argv.tokenEnv ?? argv['token-env'];
+
+  if (token && tokenEnv) {
+    log.error('Pass --token OR --token-env, not both. --token-env is preferred for CI and shared setups (EVALUATION.md S8).');
+    process.exit(1);
+  }
+
   const config = readConfig();
   const key = kind === 'install' ? 'installSources' : 'publishSources';
 
   const entry = { name, url };
-  if (profile) entry.profile = profile;
-  if (token)   entry.token   = token;
+  if (profile)  entry.profile  = profile;
+  if (token)    entry.token    = token;
+  if (tokenEnv) entry.tokenEnv = tokenEnv;
 
   const idx = config[key].findIndex((s) => s.name === name);
   if (idx !== -1) {

package/src/commands/init.js

@@ -3,8 +3,35 @@
 const fs = require('fs');
 const path = require('path');
 const { defaultManifest, writeManifest } = require('../manifest');
+const { LOCAL_OVERLAY_FILENAME } = require('../conf');
 const log = require('../logger');
 
+// The wyvrn.local.json overlay must never be committed — it is by design
+// per-developer state. init writes a gitignore entry; existing projects
+// get a one-line nudge from install (see install.js) when the file is
+// present but not ignored.
+const GITIGNORE_MARKER_LINE = '# wyvrnpm — per-developer conf overlay (never commit)';
+
+function ensureGitignoreEntry(rootDir) {
+  const gitignorePath = path.join(rootDir, '.gitignore');
+  const desiredLines  = [GITIGNORE_MARKER_LINE, LOCAL_OVERLAY_FILENAME];
+
+  let existing = '';
+  if (fs.existsSync(gitignorePath)) {
+    existing = fs.readFileSync(gitignorePath, 'utf8');
+    const hasEntry = existing.split(/\r?\n/).some((l) => l.trim() === LOCAL_OVERLAY_FILENAME);
+    if (hasEntry) return { action: 'already-present', path: gitignorePath };
+  }
+
+  const needsLeadingNewline = existing.length > 0 && !existing.endsWith('\n');
+  const block = (needsLeadingNewline ? '\n' : '') + desiredLines.join('\n') + '\n';
+  fs.writeFileSync(gitignorePath, existing + block, 'utf8');
+  return {
+    action: existing.length > 0 ? 'appended' : 'created',
+    path:   gitignorePath,
+  };
+}
+
 /**
  * Initialises a new wyvrn.json manifest in the project root.
  * If a manifest already exists the command exits early without overwriting it.
@@ -28,7 +55,16 @@ async function init(argv) {
 
   writeManifest(manifestPath, manifest);
 
+  const gitignore = ensureGitignoreEntry(rootDir);
+  if (gitignore.action === 'created') {
+    log.info(`Created .gitignore at ${gitignore.path} with ${LOCAL_OVERLAY_FILENAME} exclusion`);
+  } else if (gitignore.action === 'appended') {
+    log.info(`Added ${LOCAL_OVERLAY_FILENAME} to ${gitignore.path}`);
+  }
+
   log.success(`Created manifest at ${manifestPath}`);
 }
 
 module.exports = init;
+module.exports.ensureGitignoreEntry  = ensureGitignoreEntry;
+module.exports.GITIGNORE_MARKER_LINE = GITIGNORE_MARKER_LINE;

package/src/commands/install-skill.js

@@ -5,6 +5,7 @@ const os   = require('os');
 const path = require('path');
 const AdmZip = require('adm-zip');
 
+const { assertAllSafeZipEntryNames } = require('../zip-safe');
 const log = require('../logger');
 
 // ---------------------------------------------------------------------------
@@ -72,6 +73,13 @@ function installForClaude({ force, dryRun }) {
   rmrf(destZip);
 
   const zip = new AdmZip(zipPath);
+  // Zip Slip defense-in-depth (EVALUATION.md S2). The shipped .skill zip
+  // is trusted-by-provenance, but validating consistently keeps the
+  // attack surface flat across all extraction call sites.
+  assertAllSafeZipEntryNames(
+    zip.getEntries().map((e) => e.entryName),
+    `${SKILL_NAME}.skill`,
+  );
   zip.extractAllTo(skillsDir, /* overwrite */ true);
   fs.copyFileSync(zipPath, destZip);