fix: bsh sync writes into the pnpm store instead of the project root

[natemoo-re]

Symptom

In a project using pnpm's default isolated node_modules layout, pnpm bsh sync reports success (Synced 8 skills to skills/) but nothing appears at the project root. The output — skills/ symlinks, the AGENTS.md sentinel block, and the .gitignore section — lands inside the store instead:

node_modules/.pnpm/@bomb.sh+tools@0.5.4_<hash>/node_modules/skills/
node_modules/.pnpm/@bomb.sh+tools@0.5.4_<hash>/node_modules/AGENTS.md
node_modules/.pnpm/@bomb.sh+tools@0.5.4_<hash>/node_modules/.gitignore

Observed with @bomb.sh/tools@0.5.4 on pnpm 10.7.0 / Node 24 (bombshell-dev/cooper).

Cause

findParentPackage started from findPackageJSON(import.meta.url) and walked up looking for the nearest enclosing package.json. Under pnpm, import.meta.url resolves through the node_modules/@bomb.sh/tools symlink to the real location inside node_modules/.pnpm/<hash>/node_modules/@bomb.sh/tools, so the first "parent" it finds is a neighbor in the store, and the store directory becomes the sync root. Hoisted layouts (npm, node-linker=hoisted) walk up to the actual project, which is why only pnpm's default layout is affected.

Fix

Resolve the project from the invocation context instead of the package's physical location: INIT_CWD (set by pnpm/npm to the directory the script was run from, surviving package-script cwd rewrites) with a fallback to cwd(), then findPackageJSON from there. A candidate named @bomb.sh/tools returns null, preserving the existing skip when running inside this repo.

Verified end to end: from a scratch project with the fixed CLI, sync writes skills/, AGENTS.md, and .gitignore at that project's root; running inside this repo still prints the skip message. Two unit tests cover the INIT_CWD resolution and the self-package guard.

[changeset-bot]

🦋 Changeset detected

Latest commit: 2fc95df

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@bomb.sh/tools	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@bomb.sh/tools@46

commit: 2fc95df