@homeflare/config 0.11.0 → 0.11.1

package/src/hooks/oxfmt-config.ts

@@ -0,0 +1,67 @@
+/**
+ * Which `.oxfmtrc.*` file governs this repo — so the hook can name it explicitly.
+ *
+ * ⛔ BUG, MEASURED 2026-09-23 (homeflare-desktop docs agent): the shared pre-commit ran
+ *   bare `oxfmt`, and bare `oxfmt` auto-discovers only `.oxfmtrc.json` and `.oxfmtrc.jsonc`.
+ *   Checked against the pinned oxfmt 0.68.0 directly: a repo with only `.oxfmtrc.mjs` and
+ *   no `-c` prints "No config found, using defaults" and formats with oxfmt's built-in
+ *   style, silently — even though `oxfmt --help` lists `.ts/.mts/.cts/.js/.mjs/.cjs` as
+ *   valid `--config` targets. Desktop's fix was renaming to `.oxfmtrc.json`; this fixes the
+ *   hook so a repo does not have to.
+ * ★ WHY A FILE SCAN, NOT A PACKAGE.JSON READ. The repo's own `format`/`check` script names
+ *   the config it wants (or relies on auto-discovery finding `.oxfmtrc.json`), but its exact
+ *   invocation shape varies per repo. Finding the config file on disk and handing it to
+ *   oxfmt directly gets the same result without parsing an arbitrary shell command.
+ * ⛔ EVERY `.oxfmtrc.*` LIVES AT THE REPO ROOT TODAY (checked: every repo in the estate has
+ *   exactly one, at root — no nested per-package overrides). Explicit `-c` disables oxfmt's
+ *   own nested-config search (measured: a nested `.oxfmtrc.json` was ignored once `-c` named
+ *   the root one), so this only scans `root` itself — it would misfire on a repo that added a
+ *   package-level override, which none currently do.
+ */
+import { readdir } from 'node:fs/promises';
+
+/** Auto-discovered by bare `oxfmt` — nothing for the hook to pass. */
+const AUTO_DISCOVERED = ['.oxfmtrc.json', '.oxfmtrc.jsonc'];
+
+/**
+ * Accepted by `oxfmt -c/--config` (per `oxfmt --help`, oxfmt 0.68.0) but never found on its
+ * own — checked empirically for each extension. Listed in the order `--help` documents them.
+ */
+const NEEDS_EXPLICIT_CONFIG = [
+  '.oxfmtrc.ts',
+  '.oxfmtrc.mts',
+  '.oxfmtrc.cts',
+  '.oxfmtrc.js',
+  '.oxfmtrc.mjs',
+  '.oxfmtrc.cjs',
+];
+
+export type OxfmtConfigResolution =
+  /** `.oxfmtrc.json` or `.oxfmtrc.jsonc` exists — bare oxfmt already finds it. */
+  | { readonly kind: 'auto' }
+  /** No `.oxfmtrc.*` at all — let oxfmt use its built-in defaults, as today. */
+  | { readonly kind: 'none' }
+  /** Exactly one config oxfmt would not find unaided — pass it with `-c`. */
+  | { readonly kind: 'explicit'; readonly path: string }
+  /**
+   * Two or more configs, none of them auto-discovered — bare oxfmt (and a repo's own
+   * bare `bun run format`) would silently fall back to defaults too, honouring neither.
+   * Guessing which one the repo meant would just move the silent-defaults bug here.
+   */
+  | { readonly kind: 'ambiguous'; readonly files: readonly string[] };
+
+/** Every `.oxfmtrc.*` file actually present at `root`, in a fixed, deterministic order. */
+async function present(root: string, names: readonly string[]): Promise<readonly string[]> {
+  const entries = new Set(await readdir(root).catch(() => []));
+  return names.filter((name) => entries.has(name));
+}
+
+export async function resolveOxfmtConfig(root: string): Promise<OxfmtConfigResolution> {
+  if ((await present(root, AUTO_DISCOVERED)).length > 0) return { kind: 'auto' };
+
+  const explicit = await present(root, NEEDS_EXPLICIT_CONFIG);
+  const [only, ...rest] = explicit;
+  if (only === undefined) return { kind: 'none' };
+  if (rest.length === 0) return { kind: 'explicit', path: `${root}/${only}` };
+  return { kind: 'ambiguous', files: explicit };
+}

package/src/hooks/report.ts

@@ -52,6 +52,21 @@ export async function capture(cmd: readonly string[]): Promise<string> {
   return (await probe(cmd)).stdout;
 }
 
+/**
+ * Run a command, relaying its stdout live-enough (after it exits) while also handing the
+ * caller the text — gates.ts reads oxfmt's own "on N files" summary from it. `stderr` stays
+ * `inherit`: diagnostics (a parse error, "no files matched") must show immediately, and nothing
+ * here needs to inspect them.
+ */
+export async function runCaptured(
+  cmd: readonly string[],
+): Promise<{ readonly code: number; readonly stdout: string }> {
+  const proc = Bun.spawn([...cmd], { stdout: 'pipe', stderr: 'inherit' });
+  const stdout = await new Response(proc.stdout).text();
+  process.stdout.write(stdout);
+  return { code: await proc.exited, stdout };
+}
+
 /** Capture a command's stdout AND its exit code — git plumbing that answers by status. */
 export async function probe(cmd: readonly string[]): Promise<{ code: number; stdout: string }> {
   const proc = Bun.spawn([...cmd], { stdout: 'pipe', stderr: 'ignore' });

package/src/repo-shape/yaml.ts

@@ -6,9 +6,15 @@
  *   this house are the product. The rendered workflows are written as text with holes;
  *   only the step lists, whose shape varies per repository, go through here.
  *
- * ⚠️ Bun can PARSE YAML natively (`Bun.YAML.parse`) but does not stringify it, measured
- *   against Bun 1.4.0 on 2026-09-22. The tests parse what this writes with `Bun.YAML.parse`
- *   and compare structures, so a malformed emission fails rather than shipping.
+ * ⚠️ Bun.YAML.stringify EXISTS (`Object.keys(Bun.YAML)` is `["parse", "stringify"]`,
+ *   measured against Bun 1.4.0 on 2026-09-23) but its output does not fit these rules:
+ *   (a) a multi-line `run:` comes out as a double-quoted string with `\n` escapes, e.g.
+ *   `run: "echo a\necho b\n"`, not a `|` block scalar; (b) `09:00` comes out UNQUOTED,
+ *   e.g. `cron: 09:00`, the YAML 1.1 sexagesimal trap the `scalar()` comment below guards
+ *   against; (c) a mapping key is followed by a trailing space, e.g. `"steps: \n  - ..."`;
+ *   and (d) a plain JS object has nowhere to attach a comment, so it cannot carry one. The
+ *   tests parse what this writes with `Bun.YAML.parse` and compare structures, so a
+ *   malformed emission fails rather than shipping.
  */
 import type { JobStep } from './shape.ts';
 
@@ -53,13 +59,29 @@ function renderMapping(
   return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);
 }
 
+/**
+ * Trim trailing `\n` characters the way `command.replace(/\n+$/, '')` used to, but
+ * linear instead of backtracking — the same pattern as `normalizeBaseUrl` in
+ * `packages/distilled-netbox/src/credentials.ts`. Exported so a test can compare it
+ * against the old regex directly.
+ *
+ * ⚠️ Linear on purpose: a `/\n+$/` regex backtracks polynomially on a long run of
+ *   "\n" that is not at the end (CodeQL js/polynomial-redos), and `command` here is
+ *   repository-configured step text.
+ */
+export function trimTrailingNewlines(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 10) end--;
+  return value.slice(0, end);
+}
+
 /**
  * ★ BLOCK SCALAR FOR EVERY MULTI-LINE `run:`. A folded or quoted form would join the
  *   lines, and a shell script whose `if` and `then` end up on one line is a syntax error
  *   at job time rather than at lint time. `|` keeps them exactly as written.
  */
 function renderRun(command: string, depth: number): string[] {
-  const lines = command.replace(/\n+$/, '').split('\n');
+  const lines = trimTrailingNewlines(command).split('\n');
   if (lines.length === 1) return [`${indent(depth)}run: ${scalar(lines[0] ?? '')}`];
   return [`${indent(depth)}run: |`, ...lines.map((line) => `${indent(depth + 1)}${line}`)];
 }