@erclx/canon 5.68.0 → 5.69.0

package/src/commands/tasks.ts

@@ -3,6 +3,13 @@ import type { Command } from 'commander'
 import { execa } from 'execa'
 import { gitEnv } from '@/git/env'
 import { type AnswersOutcome, planAnswers } from '@/tasks/answers'
+import {
+  DEFAULT_LAUNCH_WAIT_SECONDS,
+  type LaunchOutcome,
+  type LaunchWait,
+  readLaunchable,
+  waitForLaunchable,
+} from '@/tasks/launch-wait'
 import {
   type BoardOutcome,
   type BoardRefused,
@@ -112,6 +119,12 @@ interface AnswersCommandOptions {
   readonly root?: string
 }
 
+interface LaunchableCommandOptions {
+  readonly json?: boolean
+  readonly root?: string
+  readonly wait?: string | true
+}
+
 interface BranchCommandOptions {
   readonly json?: boolean
   readonly root?: string
@@ -414,6 +427,72 @@ export function register(program: Command): void {
       process.exitCode = await runAnswers(plan, opts)
     })
 
+  tasks
+    .command('launchable')
+    .description(
+      'Report whether a row has a linked plan the dispatch may launch',
+    )
+    .argument('<task>', 'Task filename stem, as in v28.1-trigger-escalation')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--json', 'Emit a machine-readable record on stdout')
+    .option('--root <path>', 'Board root, defaulting to the main worktree')
+    .option(
+      '--wait [seconds]',
+      `Hold until the row is launchable, default ${DEFAULT_LAUNCH_WAIT_SECONDS}`,
+    )
+    .addHelpText(
+      'after',
+      [
+        '',
+        "Resolves the task's Plan: line and runs the plan-answers gate on the",
+        'plan it names, in one read. It keys on the line rather than on the',
+        'plan file, since a planner links a plan only after it validates, so a',
+        'plan still being written never reads as landed. It answers planning',
+        'alone: the branch and claim checks stay in the dispatch runbook.',
+        '',
+        'The record carries task, plan, launchable, and open, the last three',
+        'named as plan-answers names them. Read `reason`:',
+        '  unlinked    the task carries no Plan: line yet',
+        '  open        the plan still holds a question for the operator',
+        '  launchable  the plan waits on nobody',
+        '',
+        '`--wait [seconds]` re-reads every 30 seconds until the row is',
+        'launchable or the deadline passes. `reason` then reads `launchable`',
+        'or `timeout`, the record carries the last reading, and',
+        '`waitedSeconds` is added. A refusal ends the wait at once. A wait',
+        'past 600 seconds outlasts a foreground shell call, so run it in the',
+        'background and act on the wake.',
+        '',
+        'Refusals, read off `reason`:',
+        '  no-board       the project carries no .canon/tasks/',
+        '  no-match       no task carries that stem exactly',
+        '  ambiguous      several tasks start with the name, so pass one in full',
+        '  several-plans  the Plan: line links more than one plan',
+        '  no-plan        the Plan: line names no file',
+        '  archived       the Plan: line points into the plans archive',
+        '  bad-input      the Plan: line carries an empty target',
+        '  bad-wait       --wait takes a whole number of seconds above zero',
+        '',
+        'Exit codes:',
+        '  0  the row is launchable',
+        '  1  refused, with the reason on stderr or in the JSON record',
+        '  2  the row is unlinked or open, or the wait reached its deadline',
+        '',
+        'It reports and never writes. Branch on `reason` rather than on the',
+        'exit code, which a shell function wrapping canon can flatten to zero.',
+        '',
+        'Examples:',
+        '  canon tasks launchable v28.1-trigger-escalation',
+        '  canon tasks launchable v28.1-trigger-escalation --json',
+        '  canon tasks launchable v28.1-trigger-escalation --wait --json',
+        '  canon tasks launchable v28.1-trigger-escalation --wait 900 --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (task: string, opts: LaunchableCommandOptions) => {
+      process.exitCode = await runLaunchable(task, opts)
+    })
+
   tasks
     .command('plan-branch')
     .description('Derive the branch name a dispatch and a worker both take')
@@ -1827,6 +1906,110 @@ function reportAnswers(
   return EXIT_FINDINGS
 }
 
+const BAD_WAIT = '--wait takes a whole number of seconds above zero.'
+
+interface BadWait {
+  readonly ok: false
+  readonly reason: 'bad-wait'
+  readonly message: string
+}
+
+async function runLaunchable(
+  task: string,
+  opts: LaunchableCommandOptions,
+): Promise<number> {
+  const emitJson = opts.json ?? false
+  const root = opts.root ?? (await mainWorktreeRoot())
+
+  let waitSeconds: number | undefined
+  if (opts.wait === true) {
+    waitSeconds = DEFAULT_LAUNCH_WAIT_SECONDS
+  } else if (opts.wait !== undefined) {
+    if (!/^\d+$/.test(opts.wait) || Number(opts.wait) === 0) {
+      const refused: BadWait = {
+        ok: false,
+        reason: 'bad-wait',
+        message: BAD_WAIT,
+      }
+      return reportLaunchable(refused, emitJson, root)
+    }
+    waitSeconds = Number(opts.wait)
+  }
+
+  const outcome =
+    waitSeconds === undefined
+      ? await readLaunchable(root, task)
+      : await waitForLaunchable(root, task, {
+          waitSeconds,
+          clock: {
+            now: () => Date.now(),
+            sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
+          },
+        })
+
+  return reportLaunchable(outcome, emitJson, root)
+}
+
+function reportLaunchable(
+  outcome: LaunchOutcome | LaunchWait | BadWait,
+  emitJson: boolean,
+  root: string,
+): number {
+  if (!outcome.ok) {
+    intro('canon tasks launchable')
+    logStep('Refused')
+    logError(outcome.message)
+    outro()
+
+    if (emitJson) {
+      process.stdout.write(
+        `${JSON.stringify({
+          ok: false,
+          reason: outcome.reason,
+          message: outcome.message,
+          ...('waitedSeconds' in outcome && {
+            waitedSeconds: outcome.waitedSeconds,
+          }),
+          root,
+        })}\n`,
+      )
+    }
+    return 1
+  }
+
+  const code = outcome.launchable ? 0 : EXIT_FINDINGS
+
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify({ ...outcome, root })}\n`)
+    return code
+  }
+
+  intro('canon tasks launchable')
+  logStep(outcome.task)
+
+  if (outcome.plan === undefined) {
+    logWarn('carries no Plan: line yet, so no plan has landed.')
+  } else if (outcome.launchable) {
+    logInfo(`${outcome.plan} waits on nobody, so the dispatch may launch it.`)
+  } else {
+    for (const question of outcome.open) {
+      logWarn(`${question.label} ${question.why}`)
+    }
+    logError(`${outcome.plan} still waits on the operator.`)
+  }
+
+  if ('waitedSeconds' in outcome) {
+    logInfo(
+      outcome.reason === 'timeout'
+        ? `not launchable within ${outcome.waitedSeconds}s`
+        : `launchable after ${outcome.waitedSeconds}s`,
+    )
+  }
+
+  outro()
+  return code
+}
+
 async function runBranch(
   plan: string,
   opts: BranchCommandOptions,

package/src/gate/stages.ts

@@ -402,9 +402,9 @@ export const STAGES: readonly Stage[] = [
     checks: [
       {
         kind: 'cli',
-        argv: ['gov', 'audit', '--gate'],
+        argv: ['gov', 'audit', '--gate', '--touched'],
         failure:
-          'A rule in a gated folder is past a shape limit or short of its ledger. Run bun src/cli.ts gov audit.',
+          'A rule in a gated folder is past a shape limit or short of its ledger. Run bun src/cli.ts gov audit --touched.',
       },
     ],
   },

package/src/gov/audit.ts

@@ -1,6 +1,6 @@
 import { existsSync, statSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
-import { join, relative, resolve, sep } from 'node:path'
+import { join, normalize, relative, resolve, sep } from 'node:path'
 import { listRuleFiles } from '@/gov/payload'
 
 /**
@@ -57,6 +57,19 @@ export const PRACTICE_FOLDERS: readonly string[] = [
   'tooling',
 ]
 
+/**
+ * The folders whose rules record house decisions. Their ledger is checked
+ * wherever one exists and owed only by a rule the branch touched, since the
+ * reasoning behind an older bullet was never written down and no backfill
+ * recovers it.
+ */
+export const CORE_FOLDERS: readonly string[] = [
+  'canon',
+  'claude',
+  'code',
+  'writing',
+]
+
 const SHIPPED_RULES = join('governance', 'rules')
 const LEDGERS = join('governance', 'ledger')
 
@@ -316,29 +329,41 @@ export function compareLedger(
     .filter((entry) => entry.bullets !== entry.rows)
 }
 
-/** Where a rule's ledger lives, or nothing when its folder carries none. */
-function ledgerPath(file: string): string | undefined {
+/**
+ * Where a rule's ledger lives and whether its absence is a finding, or nothing
+ * when its folder carries none.
+ */
+function ledgerFor(
+  file: string,
+  touched: ReadonlySet<string>,
+): { path: string; owed: boolean } | undefined {
   const prefix = `${SHIPPED_RULES}${sep}`
   if (!file.startsWith(prefix)) return undefined
   const rest = file.slice(prefix.length)
   const folder = rest.split(sep)[0]
-  if (!PRACTICE_FOLDERS.includes(folder)) return undefined
-  return join(LEDGERS, rest)
+  const path = join(LEDGERS, rest)
+  if (PRACTICE_FOLDERS.includes(folder)) return { path, owed: true }
+  if (CORE_FOLDERS.includes(folder)) return { path, owed: touched.has(file) }
+  return undefined
 }
 
 async function readLedger(
   root: string,
   file: string,
   groups: readonly HeadingCount[],
+  touched: ReadonlySet<string>,
 ): Promise<LedgerReading> {
-  const path = ledgerPath(file)
-  if (path === undefined) return { status: 'not-required' }
+  const ledger = ledgerFor(file, touched)
+  if (ledger === undefined) return { status: 'not-required' }
+  const { path } = ledger
 
   let text: string
   try {
     text = await readFile(resolve(root, path), 'utf8')
   } catch {
-    return { status: 'missing', path }
+    return ledger.owed
+      ? { status: 'missing', path }
+      : { status: 'not-required' }
   }
 
   return {
@@ -352,14 +377,22 @@ async function readLedger(
  * Measures every rule this tree authors, or the files named.
  *
  * A tree holding `governance/rules/` is a canon checkout, read across both
- * authored corpora with a ledger asked of each outside-practice rule. Any
- * other tree is a target, read at `.claude/rules/project/` alone with no
+ * authored corpora with a ledger asked of each outside-practice rule and of
+ * each core rule in `touched`, and checked for any core rule carrying one.
+ * Any other tree is a target, read at `.claude/rules/project/` alone with no
  * ledger asked, since ledgers never ship.
+ *
+ * `touched` holds paths relative to the root, and leaving it out reads no core
+ * rule as touched.
  */
 export async function readRuleAudit(
   root: string,
   paths: readonly string[] = [],
+  options: { readonly touched?: readonly string[] } = {},
 ): Promise<RuleAuditReport> {
+  const touched = new Set(
+    (options.touched ?? []).map((path) => normalize(path)),
+  )
   const scope = existsSync(resolve(root, SHIPPED_RULES)) ? 'canon' : 'target'
   const corpus = scope === 'canon' ? CANON_CORPUS : TARGET_CORPUS
 
@@ -421,7 +454,11 @@ export async function readRuleAudit(
   for (const abs of files) {
     const file = relative(root, abs)
     const { groups, ...shape } = measureRule(await readFile(abs, 'utf8'))
-    rules.push({ file, ...shape, ledger: await readLedger(root, file, groups) })
+    rules.push({
+      file,
+      ...shape,
+      ledger: await readLedger(root, file, groups, touched),
+    })
   }
 
   return { kind: 'measured', scope, corpus, rules }

package/src/gov/detect.ts

@@ -253,7 +253,7 @@ function isLiteral(pattern: string): boolean {
 
 /**
  * A literal pattern is also tested on disk, since evidence such as
- * `.canon/canvas` sits in a folder a target's own `.gitignore` excludes, and
+ * `.canon/board` sits in a folder a target's own `.gitignore` excludes, and
  * the git listing never carries it.
  */
 function matchEntry(

package/src/markdown/scope.ts

@@ -136,8 +136,6 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/build-in-slices/references/adopted.md',
   'claude/skills/canon-cli/REQUIREMENT.md',
   'claude/skills/canon-cli/SKILL.md',
-  'claude/skills/canon-feedback-triage/REQUIREMENT.md',
-  'claude/skills/canon-feedback-triage/SKILL.md',
   'claude/skills/canon-feedback/REQUIREMENT.md',
   'claude/skills/canon-feedback/SKILL.md',
   'claude/skills/canon-feedback/references/template.md',
@@ -202,10 +200,10 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/document-repair/REQUIREMENT.md',
   'claude/skills/document-repair/SKILL.md',
   'claude/skills/document-repair/references/batches.md',
-  'claude/skills/pick-by-eye/REQUIREMENT.md',
-  'claude/skills/pick-by-eye/SKILL.md',
-  'claude/skills/pick-by-eye/references/board.md',
-  'claude/skills/pick-by-eye/references/live-arms.md',
+  'claude/skills/design-pick/REQUIREMENT.md',
+  'claude/skills/design-pick/SKILL.md',
+  'claude/skills/design-pick/references/board.md',
+  'claude/skills/design-pick/references/live-arms.md',
   'claude/skills/write-doc/REQUIREMENT.md',
   'claude/skills/write-doc/SKILL.md',
   'claude/skills/write-doc/references/context.md',
@@ -229,10 +227,6 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/design-identity/REQUIREMENT.md',
   'claude/skills/design-identity/SKILL.md',
   'claude/skills/design-identity/references/card-route.md',
-  'claude/skills/plan-ready/REQUIREMENT.md',
-  'claude/skills/plan-ready/SKILL.md',
-  'claude/skills/plan-ready/references/assembly.md',
-  'claude/skills/plan-ready/references/ready.md',
   'claude/skills/git-branch/REQUIREMENT.md',
   'claude/skills/git-branch/SKILL.md',
   'claude/skills/git-branch/references/branch.md',
@@ -391,10 +385,10 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/test-first/references/adopted.md',
   'claude/skills/ui-checklist/REQUIREMENT.md',
   'claude/skills/ui-checklist/SKILL.md',
-  'claude/skills/ux-audit/REQUIREMENT.md',
-  'claude/skills/ux-audit/SKILL.md',
-  'claude/skills/ux-measure/REQUIREMENT.md',
-  'claude/skills/ux-measure/SKILL.md',
+  'claude/skills/ui-audit/REQUIREMENT.md',
+  'claude/skills/ui-audit/SKILL.md',
+  'claude/skills/ui-measure/REQUIREMENT.md',
+  'claude/skills/ui-measure/SKILL.md',
   'claude/skills/write-human/REQUIREMENT.md',
   'claude/skills/write-human/SKILL.md',
   'claude/skills/write-human/references/adopted.md',
@@ -404,6 +398,7 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/youtube-transcripts/SKILL.md',
   '.claude/skills/internal-claude/REQUIREMENT.md',
   '.claude/skills/internal-docs/REQUIREMENT.md',
+  '.claude/skills/internal-feedback-triage/REQUIREMENT.md',
   '.claude/skills/internal-governance/REQUIREMENT.md',
   '.claude/skills/internal-rule-audit/REQUIREMENT.md',
   '.claude/skills/internal-sandbox-check/REQUIREMENT.md',

package/src/migrate/record-layout.ts

@@ -88,8 +88,9 @@ const RENDER = [SCRATCH, 'render'] as const
  * Every move this migration makes, as record-relative paths.
  *
  * The first two rows are batch 2's. The rest are batch 3's, in the order the
- * intake's review-folder pass listed them. A later batch appends here rather
- * than adding a second table.
+ * intake's review-folder pass listed them, then the design board, moved to
+ * the `.canon/board` folder Frameboard names. A later batch appends here
+ * rather than adding a second table.
  */
 export const RECORD_LAYOUT_MOVES: readonly RecordLayoutMove[] = [
   { kind: 'folder', from: ['review', 'memory'], to: ['memory', 'review'] },
@@ -130,6 +131,7 @@ export const RECORD_LAYOUT_MOVES: readonly RecordLayoutMove[] = [
     picks: ['picks'],
     evidence: ['evidence'],
   },
+  { kind: 'folder', from: ['canvas'], to: ['board'] },
 ]
 
 function resolveRecord(root: string, segments: readonly string[]): string {
@@ -346,7 +348,7 @@ function entriesOf(dir: string, isDirectory: boolean): string[] {
 }
 
 /**
- * What `pick-by-eye` Step 6 writes into the folder it archives a choice to:
+ * What `design-pick` Step 6 writes into the folder it archives a choice to:
  * a capture per canvas frame, named `arm-<id>`. A design handoff marks a pick
  * folder an earlier skill wrote. A folder carrying neither is evidence.
  */

package/src/migrate/skill-names.ts

@@ -54,6 +54,15 @@ import { defineRenameRules, type RenameRules } from '@/migrate/rename'
  * target on the oldest spelling lands in one pass rather than two.
  * `draft-ready` alone keys on its namespaced forms below rather than here.
  *
+ * Four skills then moved into the family their job belongs to. `pick-by-eye`
+ * was the one step of the design flow without the `design-` prefix, so it
+ * became `design-pick`. `ui-record` filmed footage while "record" already
+ * named the design record, so it became `ui-film`. `ux-audit` and
+ * `ux-measure` were the only `ux-` skills beside the `ui-` ones, so they
+ * became `ui-audit` and `ui-measure`. `draft-and-pick`, `claude-ux-audit`,
+ * and `claude-ux-measure` are retargeted onto the new names for the same
+ * reason `claude-ui-test` was.
+ *
  * Every name takes two words. Ten of these would have landed as a bare single
  * word under a plain strip, and a bare word such as `review` or `docs` is a
  * substring of ordinary prose with no token left for a later sweep to find.
@@ -92,8 +101,10 @@ export const SKILL_NAME_MAP: Readonly<Record<string, string>> = {
   'claude-teach': 'teach-workspace',
   'claude-ui-test': 'ui-checklist',
   'ui-test': 'ui-checklist',
-  'claude-ux-audit': 'ux-audit',
-  'claude-ux-measure': 'ux-measure',
+  'claude-ux-audit': 'ui-audit',
+  'claude-ux-measure': 'ui-measure',
+  'ux-audit': 'ui-audit',
+  'ux-measure': 'ui-measure',
   'claude-worker': 'role-worker',
   'claude-worktree': 'session-worktree',
   'canon-screencast': 'script-screencast',
@@ -110,8 +121,10 @@ export const SKILL_NAME_MAP: Readonly<Record<string, string>> = {
   'draft-figure': 'draw-figure',
   'draft-identity': 'design-identity',
   'draft-slides': 'make-deck',
-  'draft-and-pick': 'pick-by-eye',
+  'draft-and-pick': 'design-pick',
   'draft-screencast': 'script-screencast',
+  'pick-by-eye': 'design-pick',
+  'ui-record': 'ui-film',
 }
 
 /**
@@ -190,6 +203,10 @@ export const RENAMED_DRAFT_POINTERS: readonly string[] = [
  * what shipped or what a session ran under whatever name was current then, so
  * rewriting one makes it testify to a release or a run that never happened.
  *
+ * A replay fixture is excluded on the same argument. It records a real
+ * project's tree as that project held it, so a rewrite changes what the replay
+ * proves.
+ *
  * The record archives need no entry here. They are gitignored, so the tracked
  * listing every sweep reads never reaches them.
  */
@@ -197,7 +214,7 @@ export const SKILL_NAME_RULES: RenameRules = defineRenameRules({
   replacements: { ...SKILL_NAME_MAP, ...SKILL_CITATION_MAP },
   keepMarker: 'canon-keep-retired',
   wholeToken: true,
-  excludedPrefixes: ['scripts/eval/result-'],
+  excludedPrefixes: ['scripts/eval/result-', 'sandbox/fixtures/replay/'],
   excludedPaths: [
     'CHANGELOG.md',
     'src/migrate/skill-names.ts',

package/src/records/validate.ts

@@ -250,6 +250,7 @@ const PLAN_SECTIONS = [
   'Constraints',
   'Files to touch',
   'Design references',
+  'Reference images',
   'Verification',
   'Risks',
   'Review focus',

package/src/sandbox/headless/dispatch-shim.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Run by the claude wrapper installDispatchShim writes in src/sandbox/headless/dispatch.ts.
+# $1 is the real claude binary, and everything after it is the caller's arguments.
+real="$1"
+shift
+
+for arg in "$@"; do
+  case "$arg" in
+  --bg | --background)
+    echo "canon sandbox harness: refusing $arg. A sandbox run may not dispatch a background session, so this shim stands first on PATH in place of the real claude binary. Drive the refusal the fixture asks for, or run this outside the harness." >&2
+    exit 64
+    ;;
+  esac
+done
+exec "$real" "$@"

package/src/sandbox/headless/dispatch.ts

@@ -8,6 +8,11 @@ import {
 } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const DISPATCH_SHIM = fileURLToPath(
+  new URL('dispatch-shim.sh', import.meta.url),
+)
 
 /*
  * The bound on a nested background dispatch, and the recording behind it.
@@ -31,9 +36,11 @@ import { join } from 'node:path'
  * The prevention. Writes a `claude` that refuses a background dispatch by flag
  * name and delegates everything else, for the runner to place first on the PATH
  * of the session it spawns. It stays a bash file, since it stands in for a
- * binary any shell in the session may exec.
+ * binary any shell in the session may exec. The refusal lives in
+ * `dispatch-shim.sh`, so the shell gate lints it, and the `claude` written here
+ * is a two-line wrapper that runs it with the real binary as its first argument.
  *
- * The real binary is baked into the file rather than passed through the
+ * The real binary is baked into the wrapper rather than passed through the
  * environment. An env var carrying it would sit in the spawned session's own
  * environment, which hands any arm the exact string that walks around the shim.
  *
@@ -46,22 +53,13 @@ import { join } from 'node:path'
  * backstops.
  */
 export function installDispatchShim(dir: string, real: string): void {
-  const shim = [
+  const wrapper = [
     '#!/usr/bin/env bash',
-    '# Generated by installDispatchShim in src/sandbox/headless/dispatch.ts.',
-    'for arg in "$@"; do',
-    '  case "$arg" in',
-    '  --bg | --background)',
-    '    echo "canon sandbox harness: refusing $arg. A sandbox run may not dispatch a background session, so this shim stands first on PATH in place of the real claude binary. Drive the refusal the fixture asks for, or run this outside the harness." >&2',
-    '    exit 64',
-    '    ;;',
-    '  esac',
-    'done',
-    `exec ${shellQuote(real)} "$@"`,
+    `exec bash ${shellQuote(DISPATCH_SHIM)} ${shellQuote(real)} "$@"`,
     '',
   ].join('\n')
 
-  writeFileSync(join(dir, 'claude'), shim, 'utf8')
+  writeFileSync(join(dir, 'claude'), wrapper, 'utf8')
   chmodSync(join(dir, 'claude'), 0o755)
 }
 

package/src/sandbox/stub-gh.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# stub gh
+dir="$STUB_GH_DIR"
+line="$(printf '%q ' "$@")"
+line="${line% }"
+printf '%s\n' "$line" >>"$dir/gh.log"
+
+case "$1" in
+api) exit 0 ;;
+pr)
+  case "$2" in
+  create)
+    count="$(cat "$dir/pr-count" 2>/dev/null || echo 0)"
+    count=$((count + 1))
+    echo "$count" >"$dir/pr-count"
+    echo "https://github.com/$GITHUB_ORG/$STUB_GH_REPO/pull/$count"
+    exit 0
+    ;;
+  close | list) exit 0 ;;
+  esac
+  ;;
+esac
+
+printf '%s\n' "$line" >>"$dir/gh-unknown.log"
+echo "stub gh: unknown call: $line" >&2
+exit 1

package/src/sandbox/stub-remote.ts

@@ -1,14 +1,15 @@
 import { execFileSync } from 'node:child_process'
 import {
   chmodSync,
+  copyFileSync,
   existsSync,
   mkdirSync,
   readdirSync,
   readFileSync,
   rmSync,
-  writeFileSync,
 } from 'node:fs'
 import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 const STUB_ORG = 'stub-org'
 const ANCHOR_REPO = 'canon-sandbox'
@@ -26,34 +27,11 @@ const PINNED_DATE = '2026-01-01T00:00:00Z'
  * Answers the `gh` calls the git scenarios make and fails on any other, so a new
  * call reaches a reader as a red arm rather than a silent pass. Every call is
  * logged as one line, quoted so an argument holding a space stays one argument.
+ * The pull request URL it prints reads `GITHUB_ORG` and `STUB_GH_REPO` from the
+ * environment `createStubRemote` returns, so it follows `STUB_ORG` and
+ * `ANCHOR_REPO`.
  */
-const STUB_GH = `#!/usr/bin/env bash
-# stub gh
-dir="$STUB_GH_DIR"
-line="$(printf '%q ' "$@")"
-line="\${line% }"
-printf '%s\\n' "$line" >>"$dir/gh.log"
-
-case "$1" in
-api) exit 0 ;;
-pr)
-  case "$2" in
-  create)
-    count="$(cat "$dir/pr-count" 2>/dev/null || echo 0)"
-    count=$((count + 1))
-    echo "$count" >"$dir/pr-count"
-    echo "https://github.com/${STUB_ORG}/${ANCHOR_REPO}/pull/$count"
-    exit 0
-    ;;
-  close | list) exit 0 ;;
-  esac
-  ;;
-esac
-
-printf '%s\\n' "$line" >>"$dir/gh-unknown.log"
-echo "stub gh: unknown call: $line" >&2
-exit 1
-`
+const STUB_GH = fileURLToPath(new URL('stub-gh.sh', import.meta.url))
 
 /**
  * Builds a local bare repository and a stub `gh` under `stubDir` and returns the
@@ -75,13 +53,14 @@ export function createStubRemote(stubDir: string): Record<string, string> {
   )
 
   const gh = join(bin, 'gh')
-  writeFileSync(gh, STUB_GH)
+  copyFileSync(STUB_GH, gh)
   chmodSync(gh, 0o755)
 
   return {
     PATH: `${bin}:${process.env.PATH ?? ''}`,
     STUB_GH_DIR: stubDir,
     GITHUB_ORG: STUB_ORG,
+    STUB_GH_REPO: ANCHOR_REPO,
     GIT_CONFIG_COUNT: '1',
     GIT_CONFIG_KEY_0: `url.${remotes}/.insteadOf`,
     GIT_CONFIG_VALUE_0: `https://github.com/${STUB_ORG}/`,