feat(cli): fail the update when a project needs manual review

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/cli/test/migrate-apis-block.test.ts

@@ -102,6 +102,27 @@ test("a mode block mixing api entries with other content is skipped, not partial
   expect(result.skip).toContain("functions");
 });
 
+test("a legacy bare-body api entry is left alone instead of producing a bogus parse failure", () => {
+  // No request/response/error sections -- this is the legacy bare-body form
+  // that `report-legacy-api-bodies` handles for manual review. Folding it
+  // into `apis { }` as-is would produce source the grammar rejects, so this
+  // migration must leave it untouched rather than attempt the rewrite.
+  const source = `page Hello {
+  ssr {
+    api ssrUsers GET /api/users/ssr {
+      return userNames(users)
+    }
+  }
+
+  view { <main>x</main> }
+}
+`;
+  const result = migrateApisBlock(source) as { source: string; changed: boolean };
+
+  expect(result.changed).toBe(false);
+  expect(result.source).toBe(source);
+});
+
 test("a brace inside a string literal in a section body does not truncate the entry", () => {
   const source = `page P {
   client {

packages/cli/test/migrate-legacy-api-body.test.ts

@@ -112,4 +112,5 @@ test("a full update run leaves a legacy bare body file byte-identical and report
 
   expect(after).toBe(SOURCE);
   expect(report.needsReview.some((entry) => entry.includes("ssrUsers"))).toBe(true);
+  expect(report.parseFailures).toEqual([]);
 });

packages/cli/test/update-exit-code.test.ts

@@ -0,0 +1,81 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { runUpdate } from "../src/update.ts";
+
+const roots: string[] = [];
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function project(name: string): string {
+  const root = mkdtempSync(join(tmpdir(), `wrnexus-update-exit-${name}-`));
+  roots.push(root);
+  mkdirSync(join(root, "app"), { recursive: true });
+  writeFileSync(
+    join(root, "package.json"),
+    JSON.stringify({
+      name: `update-exit-${name}`,
+      dependencies: { "@wrnexus/core": "^0.8.0" },
+      wrnexus: { version: "0.8.0" },
+    }),
+  );
+  return root;
+}
+
+/**
+ * `runUpdate` reports failure via `process.exitCode` (never a real
+ * `process.exit()` call) on this path -- see the existing `--delegated` and
+ * verification-failure branches in `src/update.ts`. `--delegated` skips the
+ * "fetch a newer published CLI" handoff (there is no published 0.9.0 yet),
+ * matching how a real newer CLI re-invokes itself. `--dry-run` keeps the test
+ * offline too: the dry-run path returns before `bun install`/verification
+ * ever run, so no network access is needed to observe the exit code this
+ * task adds.
+ */
+test("a project with a legacy bare body exits non-zero", async () => {
+  const root = project("needs-review");
+  writeFileSync(
+    join(root, "app", "Hello.wrn"),
+    `page Hello {
+  ssr {
+    api ssrUsers GET /api/users/ssr {
+      return userNames(users)
+    }
+  }
+
+  view { <main>x</main> }
+}
+`,
+  );
+
+  const before = process.exitCode;
+  process.exitCode = 0;
+  try {
+    await runUpdate(root, ["--dry-run", "--version=0.9.0", "--delegated"]);
+    expect(process.exitCode).toBeTruthy();
+  } finally {
+    process.exitCode = before ?? 0;
+  }
+});
+
+test("a fully-migratable project exits zero", async () => {
+  const root = project("clean");
+  writeFileSync(
+    join(root, "app", "Hello.wrn"),
+    `page Hello {
+  view { <main>x</main> }
+}
+`,
+  );
+
+  const before = process.exitCode;
+  process.exitCode = 0;
+  try {
+    await runUpdate(root, ["--dry-run", "--version=0.9.0", "--delegated"]);
+    expect(process.exitCode ?? 0).toBe(0);
+  } finally {
+    process.exitCode = before ?? 0;
+  }
+});