fix(cli): cap only included workspace manifests, and don't let update guess a migration

Author: theCodeDrift

.changeset/init-stale-cli-pins.md

@@ -2,4 +2,4 @@
 "@taskless/cli": patch
 ---
 
-`taskless init` names any `package.json` pin of `@taskless/cli` or `@taskless/cli-nightly` that would run an older CLI than the one that just ran (a dependency whose installed build or range is behind, or a script spelling out an older version), with the version to move it to, and offers the bump. Scripts, CI and git hooks run that pin, and a CLI older than the project's `.taskless/` refuses the layout. The install does not edit `package.json`. The workspace packages a project declares (`pnpm-workspace.yaml`, or the `workspaces` field) are read as well as the root, and a dependency is judged by the version that package actually runs: its own `node_modules` link, else the hoisted one. `init --json` and `info --json` both carry the pins as `pinnedCli`, each naming its `manifest`, and plain `info` lists them. The `init` (topic v4), `info` (topic v2) and `update` (topic v14) recipes tell an agent to offer the bump, and `update` now reads the pins from `info --json` rather than re-running `init`.
+`taskless init` names any `package.json` pin of `@taskless/cli` or `@taskless/cli-nightly` that would run an older CLI than the one that just ran (a dependency whose installed build or range is behind, or a script spelling out an older version), with the version to move it to, and offers the bump. Scripts, CI and git hooks run that pin, and a CLI older than the project's `.taskless/` refuses the layout. The install does not edit `package.json`. The workspace packages a project declares (`pnpm-workspace.yaml`, or the `workspaces` field) are read as well as the root, and a dependency is judged by the version that package actually runs: its own `node_modules` link, else the hoisted one. `init --json` and `info --json` both carry the pins as `pinnedCli`, each naming its `manifest`, and plain `info` lists them. The `init` (topic v4), `info` (topic v2) and `update` (topic v15) recipes tell an agent to offer the bump, and `update` now reads the pins from `info --json` rather than re-running `init`.

openspec/changes/archive/2026-10-05-stale-cli-pins-workspaces/proposal.md

@@ -32,7 +32,7 @@ command, and `update` already runs `info --json` in step 1.
   every line, the root included.
 - `info --json` carries `pinnedCli` in the same shape; plain `info` lists the
   pins.
-- Recipes: `update` topic v14 reads the pins from `info --json` in step 4.
+- Recipes: `update` topic v15 reads the pins from `info --json` in step 4.
   `info` topic v2 documents the field and a step to offer the bump. `init`
   topic v4 documents `manifest`.
 - The existing `init-stale-cli-pins` changeset is extended. #443 has not been

openspec/changes/archive/2026-10-05-stale-cli-pins-workspaces/tasks.md

@@ -19,7 +19,7 @@
 
 ## 4. Recipes and changeset
 
-- [x] 4.1 `update` v14 reads pins from `info --json`; `info` v2; `init` v4.
+- [x] 4.1 `update` v15 reads pins from `info --json`; `info` v2; `init` v4.
 - [x] 4.2 Extend the `init-stale-cli-pins` changeset.
 
 ## 5. Tests

packages/cli/src/agent/update.md

@@ -1,4 +1,4 @@
-# Topic: update     (CLI v%(CLI_VERSION)s / topic v14)
+# Topic: update     (CLI v%(CLI_VERSION)s / topic v15)
 
 ## You are here
 This is `update`. It tells you what an upgrade changed for the rules
@@ -67,13 +67,16 @@ that you finished.
 
    If the upgrade also migrated an existing `.taskless/` (`init` printed
    a migration, or `init --json` carried `migrated` with `from` above
-   `0`; if you did not see that output, assume it did), this is not
-   optional advice: a CLI that predates the new schema refuses the
-   project with `SCAFFOLD_VERSION_MISMATCH`, so CI breaks on the push
-   that carries the migrated files. The bump belongs in that same
-   commit. Without a
-   migration the pin still reads the layout, but checks rules against
-   engines this walk has moved past.
+   `0`), this is not optional advice: a CLI that predates the new
+   schema refuses the project with `SCAFFOLD_VERSION_MISMATCH`, so CI
+   breaks on the push that carries the migrated files. The bump belongs
+   in that same commit. Without a migration the pin still reads the
+   layout, but checks rules against engines this walk has moved past.
+
+   `info --json` does not say whether a migration ran. If you did not
+   see `init`'s output yourself, treat the bump as required, but say
+   that you cannot tell whether `.taskless/` was migrated; do not name
+   schema versions you have not read.
 
    Offer the user the bump to the installed version, along with
    reinstalling dependencies. Do not make it silently: a pin can be

packages/cli/src/install/pinned-cli.ts

@@ -208,7 +208,9 @@ async function listWorkspaceManifests(
 ): Promise<string[]> {
   const included = new Set<string>();
   const excluded = new Set<string>();
-  let read = 0;
+  // Only inclusions count toward the cap: they are what gets read later. A
+  // broad `!**/fixtures` costing the same budget would leave real packages
+  // listed after it unread, and the silence would look like "nothing stale".
   for (const raw of await readWorkspacePatterns(cwd, root)) {
     const negated = raw.startsWith("!");
     const pattern = posix
@@ -226,10 +228,9 @@ async function listWorkspaceManifests(
       exclude: (path) => SKIPPED_DIRECTORIES.has(basename(path)),
     })) {
       (negated ? excluded : included).add(entry.split(sep).join("/"));
-      read += 1;
-      if (read >= MAX_WORKSPACE_MANIFESTS) break;
+      if (included.size >= MAX_WORKSPACE_MANIFESTS) break;
     }
-    if (read >= MAX_WORKSPACE_MANIFESTS) break;
+    if (included.size >= MAX_WORKSPACE_MANIFESTS) break;
   }
   // A `.` pattern names the root, which is read on its own.
   included.delete("package.json");