Merge remote-tracking branch 'origin/main' into relprep/1-feat-ts-engine-implement-registry-json

# Conflicts:
#	crates/hm-dsl-engine/src/detect.rs

Author: markovejnovic

.claude/skills/write-pipeline/SKILL.md

@@ -29,7 +29,7 @@ Write, modify, or extend Harmont CI pipelines defined in `.hm/pipeline.py` (Pyth
    Read it carefully. It covers correct vs. incorrect approaches, when to use toolchains vs. raw shell, and common anti-patterns.
 
 2. If you need the full API reference for a specific toolchain or feature, fetch the relevant page (append `.md` to any docs.harmont.dev URL for raw Markdown):
-   - Toolchain reference: `https://docs.harmont.dev/pipeline-sdk/reference/toolchains/<name>.md` (rust, python, npm, go, cmake, zig, elixir, ruby, etc.)
+   - Toolchain reference: `https://docs.harmont.dev/pipeline-sdk/reference/toolchains/<name>.md` (rust, python, js, go, cmake, zig, elixir, etc.)
    - Chains and steps: `https://docs.harmont.dev/pipeline-sdk/reference/chains.md`
    - Triggers: `https://docs.harmont.dev/pipeline-sdk/reference/triggers.md`
    - Caching: `https://docs.harmont.dev/pipeline-sdk/reference/cache.md`
@@ -40,15 +40,15 @@ Write, modify, or extend Harmont CI pipelines defined in `.hm/pipeline.py` (Pyth
    ```
    WebFetch https://docs.harmont.dev/examples/<language>.md
    ```
-   Available examples: rust, go, cmake, zig, nextjs, python-uv, ruby, elixir
+   Available examples: rust, go, cmake, zig, nextjs, python-uv, elixir
 
 ## Procedure
 
-1. **Identify the project's language and build system.** Look at the project root for `Cargo.toml` (Rust), `package.json` (JS/TS), `pyproject.toml` or `setup.py` (Python), `go.mod` (Go), `CMakeLists.txt` (C/C++), `mix.exs` (Elixir), `build.zig` (Zig), `Gemfile` (Ruby).
+1. **Identify the project's language and build system.** Look at the project root for `Cargo.toml` (Rust), `package.json` (JS/TS), `pyproject.toml` or `setup.py` (Python), `go.mod` (Go), `CMakeLists.txt` (C/C++), `mix.exs` (Elixir), `build.zig` (Zig).
 
 2. **Check for an existing pipeline.** Look for `.hm/pipeline.py` or `.hm/pipeline.ts`. If none exists, pick the DSL that matches the project's ecosystem before asking the user to confirm:
    - **TypeScript DSL** if the project already has `package.json`, `tsconfig.json`, or is primarily TypeScript/JavaScript (the team is already comfortable with the TS toolchain).
-   - **Python DSL** for everything else — Rust, Go, C/C++, Elixir, Zig, Ruby, Python, or mixed-language projects (Python is the simpler, more universal choice).
+   - **Python DSL** for everything else — Rust, Go, C/C++, Elixir, Zig, Python, or mixed-language projects (Python is the simpler, more universal choice).
    - Present your recommendation and rationale, then let the user override if they prefer the other DSL.
    Then either run `hm init --template <kind>` to scaffold or write the pipeline file directly.
 
@@ -57,7 +57,7 @@ Write, modify, or extend Harmont CI pipelines defined in `.hm/pipeline.py` (Pyth
 4. **Write or modify the pipeline.** Follow the patterns guide strictly:
    - Prefer toolchains over raw `sh()` calls when a toolchain exists for the language.
    - Use `.fork()` for steps that can run in parallel.
-   - Set triggers (`push`, `pull_request`, `schedule`) appropriate to the project.
+   - Set triggers (`push`, `pull_request`) appropriate to the project.
    - Use `default_image: "ubuntu:24.04"` unless the project needs something specific.
    - Set `env: {"CI": "true"}` on the pipeline.
 

.github/workflows/release.yml

@@ -34,25 +34,46 @@ jobs:
           VERSION="${GITHUB_REF_NAME#v}"
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
 
-          # Bump crate versions
+          # Bump crate versions. Every workspace member that harmont-cli
+          # depends on (directly or transitively) must be published, so each
+          # one needs the tagged version stamped in.
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-util/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-pipeline-ir/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-config/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-plugin-protocol/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-render/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-vm/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-exec/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-plugin-cloud/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-dsl-engine/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm/Cargo.toml
 
           # Rewrite workspace.dependencies pins so dependents resolve to the
           # tagged version (cargo publish strips path deps; the version field
           # is what consumers will receive).
-          sed -i "s|hm-util            = { path = \"crates/hm-util\",            version = \"0.0.0-dev\" }|hm-util            = { path = \"crates/hm-util\",            version = \"$VERSION\" }|" Cargo.toml
-          sed -i "s|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"0.0.0-dev\" }|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-exec           = { path = \"crates/hm-exec\",            version = \"0.0.0-dev\" }|hm-exec           = { path = \"crates/hm-exec\",            version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"0.0.0-dev\" }|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-cloud    = { path = \"crates/hm-plugin-cloud\",    version = \"0.0.0-dev\" }|hm-plugin-cloud    = { path = \"crates/hm-plugin-cloud\",    version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"0.0.0-dev\" }|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-util            = { path = \"crates/hm-util\",            version = \"0.0.0-dev\" }|hm-util            = { path = \"crates/hm-util\",            version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-config          = { path = \"crates/hm-config\",          version = \"0.0.0-dev\" }|hm-config          = { path = \"crates/hm-config\",          version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-dsl-engine      = { path = \"crates/hm-dsl-engine\",     version = \"0.0.0-dev\" }|hm-dsl-engine      = { path = \"crates/hm-dsl-engine\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-render          = { path = \"crates/hm-render\",          version = \"0.0.0-dev\" }|hm-render          = { path = \"crates/hm-render\",          version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-vm              = { path = \"crates/hm-vm\",              version = \"0.0.0-dev\" }|hm-vm              = { path = \"crates/hm-vm\",              version = \"$VERSION\" }|" Cargo.toml
 
           cargo check --workspace --exclude hm-fixtures
 
+      - name: Publishability guard (dry-run package the whole graph)
+        # Fail fast before any real `cargo publish` if the dependency graph
+        # isn't publishable — e.g. a publishable crate depending on a
+        # `publish = false` crate, or a missing version bump. `cargo package
+        # --workspace` resolves sibling path deps locally (no index lookup,
+        # unlike `cargo publish --dry-run`, which the not-yet-published deps
+        # would fail), so it catches exactly the publish=false / unpublished-dep
+        # class of regression. `--no-verify` skips the per-crate rebuild;
+        # `cargo check --workspace` above already proved it compiles.
+        run: cargo package --workspace --exclude hm-fixtures --allow-dirty --no-verify
+
       - name: Publish hm-util
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-util/$VERSION" > /dev/null 2>&1; then
@@ -75,6 +96,17 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
+      - name: Publish hm-config
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-config/$VERSION" > /dev/null 2>&1; then
+            echo "hm-config@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-config --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
       - name: Publish hm-plugin-protocol
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-plugin-protocol/$VERSION" > /dev/null 2>&1; then
@@ -86,6 +118,39 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
+      - name: Publish hm-render
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-render/$VERSION" > /dev/null 2>&1; then
+            echo "hm-render@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-render --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish hm-vm
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-vm/$VERSION" > /dev/null 2>&1; then
+            echo "hm-vm@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-vm --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish hm-exec
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-exec/$VERSION" > /dev/null 2>&1; then
+            echo "hm-exec@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-exec --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
       - name: Publish hm-plugin-cloud
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-plugin-cloud/$VERSION" > /dev/null 2>&1; then

.hm/ci.py

@@ -20,14 +20,18 @@ def shared_base() -> hm.Step:
 
 @hm.target()
 def rust_project(shared_base: hm.Target[hm.Step]) -> tuple[hm.Step, ...]:
-    project = hm.rust.project(path=".", base=shared_base)
+    # Build esbuild into the image first: hm-dsl-engine's build.rs shells out
+    # to esbuild at compile time to embed the TypeScript SDK bundle. Without it
+    # the build emits an 18-byte stub and the bundled_sources tests fail (CLI-37).
+    # Installing Node here also lets the JS-runtime-gated render tests actually
+    # run instead of self-skipping.
+    ts_deps = hm.js.project(
+        path="crates/hm-dsl-engine/harmont-ts",
+        base=shared_base,
+    ).install()
+    project = hm.rust.project(path=".", base=ts_deps)
     return hm.group([
-        project.test(flags=("--lib",), packages=("harmont-cli",)),
-        project.test(
-            flags=("--test", "cmd_init"),
-            packages=("harmont-cli",),
-            label=":test_tube: init template roundtrip",
-        ),
+        project.test(),  # cargo test --workspace --locked — every package
         project.clippy(),
         project.fmt(),
     ])

CHANGELOG.md

@@ -36,6 +36,8 @@
 - **DSL:** Fix example Python pipelines to use current API (`hm.js.project()` instead of removed `hm.npm()`/`hm.bun()`) ([#77][pr77])
 - **DSL:** Use correct Zig download URL for >= 0.14.1 and bump default to 0.14.1 ([`1bf727e`][c1bf727e])
 - **CLI:** Fix `hm pipelines` returning errors on repos without pipeline files ([#34][pr34])
+- **CLI:** `hm init --force` no longer wipes the entire `.hm/` directory; it now overwrites only the target template file, preserving `config.toml` and any co-resident pipelines.
+- **CLI:** `hm init` no longer silently overwrites customized `.claude/skills/*/SKILL.md` files; edited skills are skipped with a warning unless `--force` is passed.
 
 [pr33]: https://github.com/harmont-dev/harmont-cli/pull/33
 [pr34]: https://github.com/harmont-dev/harmont-cli/pull/34

Cargo.lock

@@ -132,8 +132,8 @@ def ci(project: hm.Target[PythonToolchain]) -> tuple[hm.Step, ...]:
 <summary><b>TypeScript</b></summary>
 
 ```typescript
-import { pipeline, push, type PipelineDefinition } from "harmont";
-import { python } from "harmont/toolchains";
+import { pipeline, push, type PipelineDefinition } from "@harmont/hm";
+import { python } from "@harmont/hm/toolchains";
 
 const project = python({ path: "." });
 

README.md

@@ -36,23 +36,30 @@ test changes to the export script.
 
 Versioning is **driven by git tags on the public mirror**. The release
 workflow in `.github/workflows/release.yml` triggers on any tag matching
-`v*`, seds the version from the tag into all three crates' `Cargo.toml`
-files plus the `workspace.dependencies` pins, and publishes
-`hm-plugin-protocol`, `hm-plugin-sdk`, and `harmont-cli` to crates.io in
-that order. The bundled WASM plugins (`hm-plugin-docker`,
-`hm-plugin-output-human`, `hm-plugin-output-json`, `hm-plugin-cloud`)
-and `hm-fixtures` are not published — they ship embedded inside the
-`hm` binary.
+`v*`, seds the version from the tag into every publishable crate's
+`Cargo.toml` plus the `workspace.dependencies` pins, runs
+`cargo package --workspace` as a fail-fast guard (it resolves sibling
+path deps locally, so it catches the `publish = false` /
+unpublished-dep class of regression without needing the deps on the
+index yet — which `cargo publish --dry-run` would), then publishes the
+crates to crates.io in dependency (topological) order:
+
+```
+hm-util → hm-pipeline-ir → hm-config → hm-plugin-protocol → hm-render
+→ hm-vm → hm-exec → hm-plugin-cloud → hm-dsl-engine → harmont-cli
+```
+
+`harmont-cli` (the `hm` binary) depends on every other crate, so they
+must all reach crates.io first — including `hm-vm`, which carries the
+local Docker backend. `hm-fixtures` is test-only and not published.
 
 ### Prerequisites (one-time)
 
 - `CRATES_IO_TOKEN` set as a repository secret on
   https://github.com/harmont-dev/harmont-cli/settings/secrets/actions.
-  Generate it from https://crates.io/me with the `publish-update` scope
-  on `hm-plugin-protocol`, `hm-plugin-sdk`, and `harmont-cli`.
-- The three crates exist on crates.io (first publish only requires
-  `publish-new` scope). After the initial publish, narrow the token to
-  `publish-update`.
+  Generate it from https://crates.io/me. The first release needs the
+  `publish-new` scope (the crates do not yet exist on crates.io); after
+  the initial publish, narrow the token to `publish-update`.
 
 ### Per-release procedure
 
@@ -72,9 +79,8 @@ and `hm-fixtures` are not published — they ship embedded inside the
    https://github.com/harmont-dev/harmont-cli/actions/workflows/release.yml.
    Each crate's publish step skips if the version is already on
    crates.io, so re-running after a partial success is safe.
-5. After the workflow completes, verify on crates.io:
-   - https://crates.io/crates/hm-plugin-protocol/1.2.3
-   - https://crates.io/crates/hm-plugin-sdk/1.2.3
+5. After the workflow completes, verify the leaf crate on crates.io
+   (it depends on all the others, so its presence implies theirs):
    - https://crates.io/crates/harmont-cli/1.2.3
 
 ### Tagging in the monorepo (optional)

RELEASING.md

@@ -33,8 +33,13 @@ fn load() -> CredentialFile {
 fn save(file: &CredentialFile) -> Result<()> {
     let p = path()?;
     let serialized = toml::to_string_pretty(file).context("serializing credentials")?;
-    hm_util::os::fs::blocking::write_atomic_restricted(&p, serialized.as_bytes(), 0o600, 0o700)
-        .with_context(|| format!("writing {}", p.display()))?;
+    hm_util::os::fs::blocking::write_atomic_restricted(
+        &p,
+        serialized.as_bytes(),
+        hm_util::os::fs::FileMode(0o600),
+        hm_util::os::fs::DirMode(0o700),
+    )
+    .with_context(|| format!("writing {}", p.display()))?;
     Ok(())
 }