#1289 Remove shelled nmr calls from package manifests

[williamthorsen]

What

nmr build no longer reaches nmr through a shell, so a failing package build reports the step that failed instead of the whole nested subtree, and interrupting a run stops what would have followed. Five packages had a build override doing that: kb, lifecycle, mcp, and run-core restated a default nmr already supplies and now resolve build to its built-in ['compile'], and codeassembly's two post-compile steps move into its build:post hook. The warning nmr printed for each, five on every build, goes with them.

A root test keeps the pattern out: It fails when any manifest in the repo, the monorepo root's included, declares a script reaching nmr. It catches the forms nmr's own warning misses, npx nmr and pnpm --recursive exec nmr among them, and exempts the npm lifecycle names along with root's bootstrap.

Why

Debugging a failed build meant reading a whole nested subtree to find the one step that failed, and interrupting the run left the rest of the chain still to come. The warnings that flagged this appeared five at a time on every nmr build, which is how a warning channel stops being read. Nothing needed the overrides in the first place: four of the five restated a default nmr already supplies.

Details

🧪 Tests

• scripts/__tests__/package-scripts.unit.test.ts reads the monorepo root's manifest and every workspace package's, and fails on a script value reaching nmr as a whole token. The root manifest is covered because nmr resolves it as a tier-3 override the way it resolves a package's: at root scope anchorDir is the monorepo root, which is how a root hook such as ci:post runs at all.
• The detector, findShelledNmrScripts, carries direct cases of its own: each runner form it must report (nmr compile, pnpm exec nmr, pnpm --filter x exec nmr, pnpm --recursive exec nmr, npx nmr), each form it must pass over (nmr-compile, nmr-fmt --check, an nmr/bin path segment), and the exempt names. An edit that stopped the pattern matching fails the suite rather than passing it green.
• Exemptions are the npm lifecycle names in every manifest, since nmr resolves none of them as a command and prepublishOnly: "nmr build" is the upstream-sanctioned pattern, plus bootstrap in the root manifest, which builds and deploys from a fresh checkout where the bare nmr binary is not yet on the path.
• Both root suites take their package set from getWorkspacePackageDirs(findMonorepoRoot(...)) in @williamthorsen/nmr/workspace, replacing a hardcoded packages/ path and a readdirSync walk in each. pnpm-workspace.yaml is now the authority on what counts as a package, and a directory holding no manifest is skipped rather than crashing the read.

⚙️ Tooling

• kb, lifecycle, mcp, and run-core drop "build": "nmr compile" and resolve build to nmr's built-in ['compile']. mcp and run-core are left with no scripts block; kb and lifecycle keep prepublishOnly. Publication is unaffected either way, since the reusable publish workflow runs release-kit publish rather than a recursive build.
• codeassembly moves tsx scripts/bundle-skill-helpers.ts and tsx scripts/copy-content.ts out of its build script and into build:post, ahead of rdy compile. Both were already post-compile work, so the hook runs them where they ran before: rdy verify, compile, bundle, copy, rdy compile. A hook rather than a step list, because workspaceScripts has no per-package keying and a tier-2 build list would impose this chain on every package.
• fleet's ":" build stays, an intentional skip whose removal would start compiling a tsx-run server, as do factory's and foreman's vite builds, which invoke no nmr.
• .config/nmr.config.ts needs no entry, contrary to what the warning suggests: resolveScript returns on the package.json hit before reaching the registry, so a config entry stays shadowed while an override remains. Reported upstream as Shelled-nmr diagnostic reports the wrong remedy, no origin, and only half the crossings node-monorepo-tools#656.

Closes #1289

[github-actions]

Dependency audit

Production dependency audit passed.