fix(init): ask for a reinstall only when a dependency pin moves, and stop calling @latest the baked specifier

A CI, hook, or script pin is a launcher line with nothing to reinstall, so the stale-pin notice and the init recipe now ask for a dependency reinstall only when a package.json dependency pin is among the stale ones. The package-manager docblock now gives a pinned release as the baked specifier example.

Author: theCodeDrift

packages/cli/src/agent/init.md

@@ -83,8 +83,10 @@ first step, not the whole job.
    or commit on your own; the git operations are theirs.
 
 3. **Offer to bump every stale pin.** For each `pinnedCli` entry, offer
-   the user the update to the installed CLI, along with reinstalling
-   dependencies. When the installed CLI is a nightly and the pin names
+   the user the update to the installed CLI. A pin in a `package.json`
+   dependency field also needs dependencies reinstalled; a script, CI, or
+   hook pin is a launcher line, and editing it is the whole fix. When the
+   installed CLI is a nightly and the pin names
    `@taskless/cli`, or the reverse, the move switches package, since a
    nightly version only exists on the nightly package. When `migrated`
    is present with `from` above `0`, say plainly that CI breaks without

packages/cli/src/install/pinned-cli.ts

@@ -472,13 +472,22 @@ export function getPinnedCliNotice(
     options.migrated !== undefined && options.migrated.from > 0
       ? options.migrated
       : undefined;
+  // Only a dependency pin has anything to reinstall. A script, CI, or hook pin
+  // is a launcher line, and editing it is the whole fix.
+  const reinstall = pins.some((pin) =>
+    (DEPENDENCY_FIELDS as readonly string[]).includes(pin.location)
+  );
   const consequence =
     upgraded === undefined
       ? `Anything that runs these pins (a script, CI, a git hook) runs a CLI older than this project expects and will likely fail. ` +
-        `Offer to update them as shown as part of this change, then reinstall dependencies.`
+        (reinstall
+          ? `Offer to update them as shown as part of this change, then reinstall dependencies.`
+          : `Offer to update them as shown as part of this change.`)
       : `This upgrade migrated .taskless/ from schema version ${String(upgraded.from)} to ${String(upgraded.to)}, and a CLI that predates that schema refuses the project (SCAFFOLD_VERSION_MISMATCH). ` +
         `CI, scripts, and git hooks that run these pins will break on the push that carries the migrated files. ` +
-        `Offer to update them as shown and reinstall dependencies, in the same commit as .taskless/.`;
+        (reinstall
+          ? `Offer to update them as shown and reinstall dependencies, in the same commit as .taskless/.`
+          : `Offer to update them as shown, in the same commit as .taskless/.`);
   return renderNoticeBox("UPDATE PINNED TASKLESS VERSIONS", [
     `This project pins a Taskless CLI older than ${cliVersion}, the version that just ran here:`,
     { items: pins.map((pin) => describePin(pin, cliVersion)) },

packages/cli/src/util/package-manager.ts

@@ -6,8 +6,10 @@ import { buildInvocation, isProductionInvocation } from "./invocation";
  * How the CLI answers "what would the reader type to run me again?"
  *
  * The answer has two halves that come from different places. The **package
- * specifier** (`@taskless/cli@latest`, `@taskless/cli-nightly@0.11.0-…`) is a
- * build-time fact, baked in by `scripts/build-target.ts`. The **launcher**
+ * specifier** (`@taskless/cli@0.11.2`, `@taskless/cli-nightly@0.11.0-…`) is a
+ * build-time fact, baked in by `scripts/build-target.ts`: every published
+ * build pins its own version, and `@latest` survives only in
+ * `readmeSpecifier()`. The **launcher**
  * (`npx`, `pnpm dlx`) is a runtime fact, and the only honest source for it is
  * the path this process was launched from.
  *

packages/cli/test/pinned-cli.test.ts

@@ -588,6 +588,24 @@ describe("getPinnedCliNotice", () => {
     expect(notice).not.toContain("likely");
   });
 
+  it("asks for a reinstall only when a dependency pin moves", () => {
+    expect(pinnedNotice([releasePin], "0.11.2")).toContain(
+      "reinstall dependencies"
+    );
+    // A CI or hook pin is a launcher line: there is nothing to reinstall.
+    const ciPin: PinnedCli = {
+      manifest: ".github/workflows/ci.yml",
+      location: "line 12",
+      name: "@taskless/cli",
+      spec: "0.10.2",
+      installed: null,
+    };
+    expect(pinnedNotice([ciPin], "0.11.2")).not.toContain("reinstall");
+    expect(
+      pinnedNotice([ciPin], "0.11.2", { migrated: { from: 5, to: 9 } })
+    ).not.toContain("reinstall");
+  });
+
   it("does not call a fresh install an upgrade", () => {
     // A fresh `init` creates `.taskless/` by migrating from schema 0.
     const notice = pinnedNotice([releasePin], "0.11.2", {