Merge remote-tracking branch 'origin/main' into cq/hm-exec-replace-raw-string-literal-job-state-mat-6

# Conflicts:
#	crates/hm-exec/src/cloud/watch.rs

Author: markovejnovic

.claude/skills/write-pipeline/SKILL.md

@@ -29,7 +29,7 @@ Write, modify, or extend Harmont CI pipelines defined in `.hm/pipeline.py` (Pyth
    Read it carefully. It covers correct vs. incorrect approaches, when to use toolchains vs. raw shell, and common anti-patterns.
 
 2. If you need the full API reference for a specific toolchain or feature, fetch the relevant page (append `.md` to any docs.harmont.dev URL for raw Markdown):
-   - Toolchain reference: `https://docs.harmont.dev/pipeline-sdk/reference/toolchains/<name>.md` (rust, python, npm, go, cmake, zig, elixir, ruby, etc.)
+   - Toolchain reference: `https://docs.harmont.dev/pipeline-sdk/reference/toolchains/<name>.md` (rust, python, js, go, cmake, zig, elixir, etc.)
    - Chains and steps: `https://docs.harmont.dev/pipeline-sdk/reference/chains.md`
    - Triggers: `https://docs.harmont.dev/pipeline-sdk/reference/triggers.md`
    - Caching: `https://docs.harmont.dev/pipeline-sdk/reference/cache.md`
@@ -40,15 +40,15 @@ Write, modify, or extend Harmont CI pipelines defined in `.hm/pipeline.py` (Pyth
    ```
    WebFetch https://docs.harmont.dev/examples/<language>.md
    ```
-   Available examples: rust, go, cmake, zig, nextjs, python-uv, ruby, elixir
+   Available examples: rust, go, cmake, zig, nextjs, python-uv, elixir
 
 ## Procedure
 
-1. **Identify the project's language and build system.** Look at the project root for `Cargo.toml` (Rust), `package.json` (JS/TS), `pyproject.toml` or `setup.py` (Python), `go.mod` (Go), `CMakeLists.txt` (C/C++), `mix.exs` (Elixir), `build.zig` (Zig), `Gemfile` (Ruby).
+1. **Identify the project's language and build system.** Look at the project root for `Cargo.toml` (Rust), `package.json` (JS/TS), `pyproject.toml` or `setup.py` (Python), `go.mod` (Go), `CMakeLists.txt` (C/C++), `mix.exs` (Elixir), `build.zig` (Zig).
 
 2. **Check for an existing pipeline.** Look for `.hm/pipeline.py` or `.hm/pipeline.ts`. If none exists, pick the DSL that matches the project's ecosystem before asking the user to confirm:
    - **TypeScript DSL** if the project already has `package.json`, `tsconfig.json`, or is primarily TypeScript/JavaScript (the team is already comfortable with the TS toolchain).
-   - **Python DSL** for everything else — Rust, Go, C/C++, Elixir, Zig, Ruby, Python, or mixed-language projects (Python is the simpler, more universal choice).
+   - **Python DSL** for everything else — Rust, Go, C/C++, Elixir, Zig, Python, or mixed-language projects (Python is the simpler, more universal choice).
    - Present your recommendation and rationale, then let the user override if they prefer the other DSL.
    Then either run `hm init --template <kind>` to scaffold or write the pipeline file directly.
 
@@ -57,7 +57,7 @@ Write, modify, or extend Harmont CI pipelines defined in `.hm/pipeline.py` (Pyth
 4. **Write or modify the pipeline.** Follow the patterns guide strictly:
    - Prefer toolchains over raw `sh()` calls when a toolchain exists for the language.
    - Use `.fork()` for steps that can run in parallel.
-   - Set triggers (`push`, `pull_request`, `schedule`) appropriate to the project.
+   - Set triggers (`push`, `pull_request`) appropriate to the project.
    - Use `default_image: "ubuntu:24.04"` unless the project needs something specific.
    - Set `env: {"CI": "true"}` on the pipeline.
 

.github/workflows/release.yml

@@ -34,25 +34,46 @@ jobs:
           VERSION="${GITHUB_REF_NAME#v}"
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
 
-          # Bump crate versions
+          # Bump crate versions. Every workspace member that harmont-cli
+          # depends on (directly or transitively) must be published, so each
+          # one needs the tagged version stamped in.
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-util/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-pipeline-ir/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-config/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-plugin-protocol/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-render/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-vm/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-exec/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-plugin-cloud/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-dsl-engine/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm/Cargo.toml
 
           # Rewrite workspace.dependencies pins so dependents resolve to the
           # tagged version (cargo publish strips path deps; the version field
           # is what consumers will receive).
-          sed -i "s|hm-util            = { path = \"crates/hm-util\",            version = \"0.0.0-dev\" }|hm-util            = { path = \"crates/hm-util\",            version = \"$VERSION\" }|" Cargo.toml
-          sed -i "s|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"0.0.0-dev\" }|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-exec           = { path = \"crates/hm-exec\",            version = \"0.0.0-dev\" }|hm-exec           = { path = \"crates/hm-exec\",            version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"0.0.0-dev\" }|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-cloud    = { path = \"crates/hm-plugin-cloud\",    version = \"0.0.0-dev\" }|hm-plugin-cloud    = { path = \"crates/hm-plugin-cloud\",    version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"0.0.0-dev\" }|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-util            = { path = \"crates/hm-util\",            version = \"0.0.0-dev\" }|hm-util            = { path = \"crates/hm-util\",            version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-config          = { path = \"crates/hm-config\",          version = \"0.0.0-dev\" }|hm-config          = { path = \"crates/hm-config\",          version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-dsl-engine      = { path = \"crates/hm-dsl-engine\",     version = \"0.0.0-dev\" }|hm-dsl-engine      = { path = \"crates/hm-dsl-engine\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-render          = { path = \"crates/hm-render\",          version = \"0.0.0-dev\" }|hm-render          = { path = \"crates/hm-render\",          version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-vm              = { path = \"crates/hm-vm\",              version = \"0.0.0-dev\" }|hm-vm              = { path = \"crates/hm-vm\",              version = \"$VERSION\" }|" Cargo.toml
 
           cargo check --workspace --exclude hm-fixtures
 
+      - name: Publishability guard (dry-run package the whole graph)
+        # Fail fast before any real `cargo publish` if the dependency graph
+        # isn't publishable — e.g. a publishable crate depending on a
+        # `publish = false` crate, or a missing version bump. `cargo package
+        # --workspace` resolves sibling path deps locally (no index lookup,
+        # unlike `cargo publish --dry-run`, which the not-yet-published deps
+        # would fail), so it catches exactly the publish=false / unpublished-dep
+        # class of regression. `--no-verify` skips the per-crate rebuild;
+        # `cargo check --workspace` above already proved it compiles.
+        run: cargo package --workspace --exclude hm-fixtures --allow-dirty --no-verify
+
       - name: Publish hm-util
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-util/$VERSION" > /dev/null 2>&1; then
@@ -75,6 +96,17 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
+      - name: Publish hm-config
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-config/$VERSION" > /dev/null 2>&1; then
+            echo "hm-config@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-config --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
       - name: Publish hm-plugin-protocol
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-plugin-protocol/$VERSION" > /dev/null 2>&1; then
@@ -86,6 +118,39 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
+      - name: Publish hm-render
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-render/$VERSION" > /dev/null 2>&1; then
+            echo "hm-render@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-render --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish hm-vm
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-vm/$VERSION" > /dev/null 2>&1; then
+            echo "hm-vm@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-vm --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish hm-exec
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-exec/$VERSION" > /dev/null 2>&1; then
+            echo "hm-exec@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-exec --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
       - name: Publish hm-plugin-cloud
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-plugin-cloud/$VERSION" > /dev/null 2>&1; then

CHANGELOG.md

@@ -36,6 +36,8 @@
 - **DSL:** Fix example Python pipelines to use current API (`hm.js.project()` instead of removed `hm.npm()`/`hm.bun()`) ([#77][pr77])
 - **DSL:** Use correct Zig download URL for >= 0.14.1 and bump default to 0.14.1 ([`1bf727e`][c1bf727e])
 - **CLI:** Fix `hm pipelines` returning errors on repos without pipeline files ([#34][pr34])
+- **CLI:** `hm init --force` no longer wipes the entire `.hm/` directory; it now overwrites only the target template file, preserving `config.toml` and any co-resident pipelines.
+- **CLI:** `hm init` no longer silently overwrites customized `.claude/skills/*/SKILL.md` files; edited skills are skipped with a warning unless `--force` is passed.
 
 [pr33]: https://github.com/harmont-dev/harmont-cli/pull/33
 [pr34]: https://github.com/harmont-dev/harmont-cli/pull/34

Cargo.lock

@@ -132,8 +132,8 @@ def ci(project: hm.Target[PythonToolchain]) -> tuple[hm.Step, ...]:
 <summary><b>TypeScript</b></summary>
 
 ```typescript
-import { pipeline, push, type PipelineDefinition } from "harmont";
-import { python } from "harmont/toolchains";
+import { pipeline, push, type PipelineDefinition } from "@harmont/hm";
+import { python } from "@harmont/hm/toolchains";
 
 const project = python({ path: "." });
 

README.md

@@ -36,23 +36,30 @@ test changes to the export script.
 
 Versioning is **driven by git tags on the public mirror**. The release
 workflow in `.github/workflows/release.yml` triggers on any tag matching
-`v*`, seds the version from the tag into all three crates' `Cargo.toml`
-files plus the `workspace.dependencies` pins, and publishes
-`hm-plugin-protocol`, `hm-plugin-sdk`, and `harmont-cli` to crates.io in
-that order. The bundled WASM plugins (`hm-plugin-docker`,
-`hm-plugin-output-human`, `hm-plugin-output-json`, `hm-plugin-cloud`)
-and `hm-fixtures` are not published — they ship embedded inside the
-`hm` binary.
+`v*`, seds the version from the tag into every publishable crate's
+`Cargo.toml` plus the `workspace.dependencies` pins, runs
+`cargo package --workspace` as a fail-fast guard (it resolves sibling
+path deps locally, so it catches the `publish = false` /
+unpublished-dep class of regression without needing the deps on the
+index yet — which `cargo publish --dry-run` would), then publishes the
+crates to crates.io in dependency (topological) order:
+
+```
+hm-util → hm-pipeline-ir → hm-config → hm-plugin-protocol → hm-render
+→ hm-vm → hm-exec → hm-plugin-cloud → hm-dsl-engine → harmont-cli
+```
+
+`harmont-cli` (the `hm` binary) depends on every other crate, so they
+must all reach crates.io first — including `hm-vm`, which carries the
+local Docker backend. `hm-fixtures` is test-only and not published.
 
 ### Prerequisites (one-time)
 
 - `CRATES_IO_TOKEN` set as a repository secret on
   https://github.com/harmont-dev/harmont-cli/settings/secrets/actions.
-  Generate it from https://crates.io/me with the `publish-update` scope
-  on `hm-plugin-protocol`, `hm-plugin-sdk`, and `harmont-cli`.
-- The three crates exist on crates.io (first publish only requires
-  `publish-new` scope). After the initial publish, narrow the token to
-  `publish-update`.
+  Generate it from https://crates.io/me. The first release needs the
+  `publish-new` scope (the crates do not yet exist on crates.io); after
+  the initial publish, narrow the token to `publish-update`.
 
 ### Per-release procedure
 
@@ -72,9 +79,8 @@ and `hm-fixtures` are not published — they ship embedded inside the
    https://github.com/harmont-dev/harmont-cli/actions/workflows/release.yml.
    Each crate's publish step skips if the version is already on
    crates.io, so re-running after a partial success is safe.
-5. After the workflow completes, verify on crates.io:
-   - https://crates.io/crates/hm-plugin-protocol/1.2.3
-   - https://crates.io/crates/hm-plugin-sdk/1.2.3
+5. After the workflow completes, verify the leaf crate on crates.io
+   (it depends on all the others, so its presence implies theirs):
    - https://crates.io/crates/harmont-cli/1.2.3
 
 ### Tagging in the monorepo (optional)

RELEASING.md

@@ -33,8 +33,13 @@ fn load() -> CredentialFile {
 fn save(file: &CredentialFile) -> Result<()> {
     let p = path()?;
     let serialized = toml::to_string_pretty(file).context("serializing credentials")?;
-    hm_util::os::fs::blocking::write_atomic_restricted(&p, serialized.as_bytes(), 0o600, 0o700)
-        .with_context(|| format!("writing {}", p.display()))?;
+    hm_util::os::fs::blocking::write_atomic_restricted(
+        &p,
+        serialized.as_bytes(),
+        hm_util::os::fs::FileMode(0o600),
+        hm_util::os::fs::DirMode(0o700),
+    )
+    .with_context(|| format!("writing {}", p.display()))?;
     Ok(())
 }
 

crates/hm-config/src/creds.rs

@@ -15,13 +15,43 @@ pub mod creds;
 
 pub const DEFAULT_API_URL: &str = "https://api.harmont.dev";
 
+/// Derive the SPA (dashboard) base URL from the API base.
+///
+/// The CLI talks to `api.harmont.dev`, but a human clicks through to the
+/// dashboard at `app.harmont.dev`. A watch/login link built from the API host
+/// lands on raw JSON, so every surface that emits a user-clickable URL must map
+/// the host first.
+///
+/// Priority:
+/// 1. `override_url` (e.g. the `HARMONT_APP_URL` env override) when non-empty,
+/// 2. heuristic mapping of `api.` → `app.` on the API host,
+/// 3. the API base itself (last-resort dev fallback for hosts like
+///    `localhost` that have no `api.`/`app.` split).
+///
+/// The returned URL never has a trailing slash.
+#[must_use]
+pub fn app_url(api: &str, override_url: Option<&str>) -> String {
+    if let Some(u) = override_url.map(str::trim).filter(|u| !u.is_empty()) {
+        return u.trim_end_matches('/').to_string();
+    }
+    let api = api.trim_end_matches('/');
+    if let Some(rest) = api.strip_prefix("https://api.") {
+        return format!("https://app.{rest}");
+    }
+    if let Some(rest) = api.strip_prefix("http://api.") {
+        return format!("http://app.{rest}");
+    }
+    api.to_string()
+}
+
 /// Default execution backend for `hm run` when no `--backend`/`--cloud` flag
 /// is given.
 fn default_backend() -> String {
     "docker".to_owned()
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct CloudConfig {
     pub org: Option<String>,
     pub api_url: String,
@@ -37,6 +67,7 @@ impl Default for CloudConfig {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct Preferences {
     pub format: String,
     pub auto_watch: bool,
@@ -52,6 +83,7 @@ impl Default for Preferences {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct Config {
     #[serde(default = "default_backend")]
     pub backend: String,
@@ -131,8 +163,8 @@ impl Config {
         hm_util::os::fs::blocking::write_atomic_restricted(
             path,
             serialized.as_bytes(),
-            0o644,
-            0o700,
+            hm_util::os::fs::FileMode(0o644),
+            hm_util::os::fs::DirMode(0o700),
         )
         .with_context(|| format!("writing {}", path.display()))
     }
@@ -153,6 +185,37 @@ mod tests {
     use super::*;
     use std::io::Write as _;
 
+    #[test]
+    fn app_url_maps_prod_api_to_app() {
+        assert_eq!(app_url(DEFAULT_API_URL, None), "https://app.harmont.dev");
+    }
+
+    #[test]
+    fn app_url_override_wins_and_trims_trailing_slash() {
+        assert_eq!(
+            app_url(DEFAULT_API_URL, Some("http://localhost:5173/")),
+            "http://localhost:5173"
+        );
+    }
+
+    #[test]
+    fn app_url_empty_override_is_ignored() {
+        assert_eq!(
+            app_url(DEFAULT_API_URL, Some("   ")),
+            "https://app.harmont.dev"
+        );
+    }
+
+    #[test]
+    fn app_url_falls_back_to_api_for_unmapped_host() {
+        assert_eq!(
+            app_url("http://localhost:4000", None),
+            "http://localhost:4000"
+        );
+        // http api. → http app.
+        assert_eq!(app_url("http://api.dev.test/", None), "http://app.dev.test");
+    }
+
     #[test]
     fn default_config_values() {
         let cfg = Config::default();
@@ -264,12 +327,11 @@ org = "project-org"
         let tmp = tempfile::tempdir().unwrap();
         let path = tmp.path().join("config.toml");
         let cfg = Config {
-            backend: default_backend(),
             cloud: CloudConfig {
                 org: Some("saved-org".into()),
-                api_url: DEFAULT_API_URL.to_owned(),
+                ..CloudConfig::default()
             },
-            preferences: Preferences::default(),
+            ..Config::default()
         };
         cfg.save_to(&path).unwrap();
 

crates/hm-config/src/lib.rs

@@ -14,6 +14,7 @@ path = "src/lib.rs"
 [dependencies]
 anyhow      = { workspace = true }
 async-trait = { workspace = true }
+derive_more = { workspace = true }
 serde       = { workspace = true }
 serde_json  = { workspace = true }
 include_dir = "0.7"