@hublo/sentinel 1.1.0 → 1.1.1

package/dist/bin/sentinel.js

@@ -16,7 +16,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-FA6N4XCP.js";
+} from "../chunk-NHRBD2UJ.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-FA6N4XCP.js → chunk-NHRBD2UJ.js}

@@ -1183,7 +1183,7 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { join as join18 } from "path";
 
 // src/core/config/deferred-rules.ts
@@ -2989,22 +2989,72 @@ function downgradedRulesFor(preset) {
   return downgradedFor(preset);
 }
 
+// src/roles/lint/module-baseline.ts
+var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
+var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
+var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
+function holdsFrom(errorCounts) {
+  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
+}
+function renderBaseline(holds, version) {
+  const entries = holds.map(
+    ({ rule, count }) => `    // ${count} violation${count === 1 ? "" : "s"} when this module adopted
+    ${JSON.stringify(rule)}: "warn"`
+  ).join(",\n");
+  return [
+    "{",
+    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
+    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
+    "  // and returns to `error` on its own.",
+    "  //",
+    "  // These rules are held at `warn` because this module ALREADY violated them when it",
+    "  // adopted. They still run and still report; they just cannot fail the build for code",
+    "  // that was there before the migration. Fix them and re-run `--init --lint` to get the",
+    "  // preset severity back.",
+    '  "rules": {',
+    entries,
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+function extendsWithBaseline(current, hasHolds) {
+  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
+}
+function describeHolds(holds) {
+  if (holds.length === 0) return "";
+  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
+  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
+  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
+  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
+}
+
 // src/roles/lint/parse-diagnostics.ts
 function ruleId(code) {
   const inner = /\(([^)]+)\)/.exec(code);
   return inner?.[1] ?? code;
 }
-function parseOxlintDiagnostics(stdout) {
+function configRuleId(code) {
+  const match = /^([^(]+)\(([^)]+)\)$/.exec(code.trim());
+  if (!match) return code.trim();
+  const plugin = match[1] ?? "";
+  const rule = match[2] ?? "";
+  return plugin === "eslint" ? rule : `${plugin}/${rule}`;
+}
+function rawDiagnostics(stdout) {
   const start = stdout.indexOf("{");
   if (start === -1) return [];
-  let parsed;
   try {
-    parsed = JSON.parse(stdout.slice(start));
+    const parsed = JSON.parse(stdout.slice(start));
+    return parsed.diagnostics ?? [];
   } catch {
     return [];
   }
+}
+function parseOxlintDiagnostics(stdout) {
   const out = [];
-  for (const entry of parsed.diagnostics ?? []) {
+  for (const entry of rawDiagnostics(stdout)) {
     const span = entry.labels?.[0]?.span;
     out.push({
       file: typeof entry.filename === "string" ? entry.filename : "",
@@ -3017,6 +3067,17 @@ function parseOxlintDiagnostics(stdout) {
   }
   return out;
 }
+function errorCountsByConfigRule(stdout) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const entry of rawDiagnostics(stdout)) {
+    if (entry.severity !== "error") continue;
+    const code = typeof entry.code === "string" ? entry.code : "";
+    const id = configRuleId(code);
+    if (!id) continue;
+    counts.set(id, (counts.get(id) ?? 0) + 1);
+  }
+  return counts;
+}
 
 // src/core/config/read-adoption.ts
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
@@ -3549,6 +3610,7 @@ function moduleEslintDependencies(cwd) {
 }
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+var CAPTURE_MAX_BUFFER = 64 * 1024 * 1024;
 function summariseByPlugin2(rules) {
   const counts = /* @__PURE__ */ new Map();
   for (const name of deferredRuleNames(rules)) {
@@ -3612,7 +3674,8 @@ var OxlintAdapter = class extends BaseAdapter {
     const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
-      env
+      env,
+      maxBuffer: CAPTURE_MAX_BUFFER
     });
     return result.status ?? 1;
   }
@@ -3638,6 +3701,85 @@ var OxlintAdapter = class extends BaseAdapter {
     if (!oxlint) return;
     const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
     this.fixPass(ctx, oxlint, env);
+    this.writeModuleBaseline(ctx, oxlint, env);
+  }
+  /**
+   * Measure what THIS module already violates, and hold exactly those rules at `warn`.
+   *
+   * Runs after the autofix pass on purpose: a rule the fixer can clear is not debt, and
+   * holding it back would freeze a severity over code that was about to be correct anyway.
+   * What is left is the debt that needs a human, which is what the promise is about.
+   *
+   * WITH type information, unlike the fix pass. That costs time on a large module, and it is
+   * not optional: the two rules that first broke this promise in the monorepo were
+   * `jsx-a11y/no-noninteractive-tabindex` and `typescript/no-duplicate-type-constituents`,
+   * and measuring without types would have missed the second and shipped the same bug with
+   * more ceremony. Adoption happens once; a wrong promise is permanent.
+   *
+   * Never fails adoption. A module that adopted correctly must not be reported as broken
+   * because a measurement could not run — the worst case is the previous behaviour, a red
+   * build the developer can see, rather than a silent half-adoption they cannot.
+   */
+  writeModuleBaseline(ctx, oxlint, env) {
+    const configPath = join18(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join18(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync16(configPath)) return;
+    let config;
+    try {
+      config = parseJsonc(
+        readFileSync14(configPath, "utf8"),
+        LINT_CONFIG_FILE
+      );
+    } catch {
+      return;
+    }
+    const current = Array.isArray(config.extends) ? config.extends : [];
+    const measurePath = join18(ctx.cwd, LINT_MEASURE_FILE);
+    let measured;
+    try {
+      writeFileSync2(
+        measurePath,
+        `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
+`
+      );
+      measured = spawnSync2(
+        oxlint,
+        [
+          "-c",
+          LINT_MEASURE_FILE,
+          ...canRunTypeAware(ctx.cwd) ? ["--type-aware"] : [],
+          "-f",
+          "json",
+          "."
+        ],
+        { cwd: ctx.cwd, encoding: "utf8", env, maxBuffer: CAPTURE_MAX_BUFFER }
+      );
+    } finally {
+      rmSync(measurePath, { force: true });
+    }
+    if (measured.error || !(measured.stdout ?? "").includes('"diagnostics"')) {
+      process.stderr.write(
+        `  ${palette(process.stderr).warn(
+          `could not measure this module's existing violations, so ${LINT_BASELINE_FILE} was left as it was. Run \`sentinel --init --lint\` again after \`pnpm install\`.`
+        )}
+`
+      );
+      return;
+    }
+    const holds = holdsFrom(errorCountsByConfigRule(measured.stdout ?? ""));
+    const next = extendsWithBaseline(current, holds.length > 0);
+    if (holds.length > 0) {
+      writeFileSync2(baselinePath, renderBaseline(holds, readOwnPackage().version));
+      process.stderr.write(`  ${palette(process.stderr).warn(describeHolds(holds))}
+`);
+    } else {
+      rmSync(baselinePath, { force: true });
+    }
+    if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
+      config.extends = next;
+      writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
+`);
+    }
   }
   async run(ctx) {
     if (!existsSync16(join18(ctx.cwd, LINT_CONFIG_FILE))) {
@@ -3753,7 +3895,8 @@ var OxlintAdapter = class extends BaseAdapter {
     const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
-      env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) }
+      env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) },
+      maxBuffer: CAPTURE_MAX_BUFFER
     });
     if (result.error) {
       return { ok: false, code: 1, metrics: { error: result.error.message } };
@@ -4573,7 +4716,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync17, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve3, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -4694,14 +4837,14 @@ function preparePlan(cwd, plan2) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync2(tempPath, contents);
+  writeFileSync3(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan2) {
   const changed = preparePlan(cwd, plan2).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync(file.absolutePath, { force: true });
+      rmSync2(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -4912,4 +5055,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-FA6N4XCP.js.map
+//# sourceMappingURL=chunk-NHRBD2UJ.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-FA6N4XCP.js";
+} from "./chunk-NHRBD2UJ.js";
 export {
   BaseAdapter,
   all,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",