@joshuafolkken/kit 1.1035.0 → 1.1094.0

package/scripts/run/run-stranded-cli.ts

@@ -24,8 +24,4 @@ async function main(): Promise<void> {
 	process.exitCode = SUCCESS_EXIT_CODE
 }
 
-const run_stranded_cli = { main }
-
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { run_stranded_cli }

package/scripts/run/run-stranded-detect.ts

@@ -1,4 +1,4 @@
-import { telegram_notify } from '#scripts/git/telegram-notify'
+import { telegram_notify } from '#scripts/notify/telegram-notify'
 import { run_carry, type CarryRead, type RunCarry } from './run-carry'
 import { run_event_stream } from './run-event-stream'
 import { run_event_stream_emit } from './run-event-stream-emit'
@@ -128,7 +128,7 @@ async function run_stranded_check(): Promise<void> {
 	}
 }
 
-const run_stranded_detect = { DEFAULT_PORTS, detect_and_report, gather, report, run_stranded_check }
+const run_stranded_detect = { detect_and_report, run_stranded_check }
 
 export { run_stranded_detect }
 export type { DetectPorts, RecordTargets }

package/scripts/run/run-tail-cli.ts

@@ -22,7 +22,6 @@ import { run_tail, type TailSection } from './run-tail'
 // step for a line written on the default branch outside any issue's run.
 
 const ARGV_OFFSET = 2
-const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
 const USAGE = 'Usage: josh run:tail [<issue-number> ...]'
@@ -33,21 +32,27 @@ interface Step {
 	argv: (issues: ReadonlyArray<string>) => ReadonlyArray<string>
 }
 
-// The steps in the order a run closes on: any ledger line the run's own commit did not carry
-// (joshuafolkken/kit#2763) is committed first so the recurrence count is on main — on most runs the
-// flush answers `clean` — the citations are read for the completion report, and the release scope is
-// decided last.
-const FLUSH_STEP: Step = {
-	header: run_tail.OBSERVATIONS_HEADER,
-	argv: () => ['observations:flush'],
-}
+// The steps in the order a run closes on: the checkout returns to the default branch, any ledger line
+// the run's own commit did not carry (joshuafolkken/kit#2763) is committed so the recurrence count is on
+// main — on most runs the flush answers `clean` — the citations are read for the completion report, and
+// the release scope is decided last.
+//
+// **The return comes first because the flush refuses anywhere else** (joshuafolkken/kit#2979). A run
+// closes right after its merge, still on the feature branch it shipped from, and `josh ship` reaches
+// this report with nothing in between — so the flush stopped a merged run as failed. `main:sync` is the
+// step a person used to type after the fact; it fast-forwards the local default branch before the
+// checkout, so a ledger line appended after the merge is carried along rather than refused.
+const LEDGER_STEPS: ReadonlyArray<Step> = [
+	{ header: run_tail.SYNC_HEADER, argv: () => ['main:sync'] },
+	{ header: run_tail.OBSERVATIONS_HEADER, argv: () => ['observations:flush'] },
+]
 const REPORT_STEPS: ReadonlyArray<Step> = [
 	{ header: run_tail.CITATIONS_HEADER, argv: (issues) => ['issue:cite', ...issues] },
 	{ header: run_tail.RELEASE_HEADER, argv: () => ['release:scope'] },
 ]
 
 function steps_for(is_lane_child: boolean): ReadonlyArray<Step> {
-	return is_lane_child ? REPORT_STEPS : [FLUSH_STEP, ...REPORT_STEPS]
+	return is_lane_child ? REPORT_STEPS : [...LEDGER_STEPS, ...REPORT_STEPS]
 }
 
 // Numbers only — a target `issue:cite` reads as an issue, so a stray flag is refused rather than
@@ -75,6 +80,7 @@ async function close_run(issues: ReadonlyArray<string>): Promise<ReadonlyArray<T
 
 	const is_lane_child = lane_child_marker.is_child_of(process.cwd())
 
+	// eslint-disable-next-line no-await-in-loop -- the tail steps run in their declared order
 	for (const step of steps_for(is_lane_child)) sections.push(await run_step(step, issues))
 
 	return sections
@@ -100,7 +106,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 	process.exitCode = await run(argv)
 }
 
-const run_tail_cli = { SUCCESS_EXIT_CODE, USAGE, close_run, main, parse_issues, run }
+const run_tail_cli = { run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/run/run-tail.ts

@@ -9,6 +9,7 @@
 // each step's output under a header and answers the exit code from the collected codes, so a test pins
 // the composite without a ledger ever being committed or a release ever read.
 
+const SYNC_HEADER = '=== sync ==='
 const OBSERVATIONS_HEADER = '=== observations ==='
 const CITATIONS_HEADER = '=== citations ==='
 const RELEASE_HEADER = '=== release ==='
@@ -52,6 +53,7 @@ const run_tail = {
 	CITATIONS_HEADER,
 	OBSERVATIONS_HEADER,
 	RELEASE_HEADER,
+	SYNC_HEADER,
 	exit_code,
 	format_report,
 	section_body,

package/scripts/run/run-tidy-lanes.ts

@@ -1,5 +1,5 @@
 import { git_spawn } from '#scripts/git/git-spawn'
-import { git_stash } from '#scripts/git/git-stash'
+import { git_stash } from '#scripts/git/stash/git-stash'
 import { lane_close } from '#scripts/lane/lane-close'
 import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
 import { run_hold } from './run-hold'
@@ -96,6 +96,7 @@ async function tidy_lanes(is_merged: IsMerged): Promise<Array<Outcome>> {
 	const lanes = await lane_registry.list_lanes()
 
 	for (const lane of lanes) {
+		// eslint-disable-next-line no-await-in-loop -- a close prunes the worktree list the next one reads
 		const outcome = await tidy_lane(lane, is_merged)
 
 		if (outcome !== undefined) outcomes.push(outcome)

package/scripts/run/run-tidy-stashes.ts

@@ -1,6 +1,6 @@
-import { git_stash, type StashEntry } from '#scripts/git/git-stash'
-import { stash_orphans } from '#scripts/git/stash-orphans'
-import { stash_sweep_lock } from '#scripts/git/stash-sweep-lock'
+import { git_stash, type StashEntry } from '#scripts/git/stash/git-stash'
+import { stash_orphans } from '#scripts/git/stash/stash-orphans'
+import { stash_sweep_lock } from '#scripts/git/stash/stash-sweep-lock'
 import { bounded_pool } from '#scripts/lib/bounded-pool'
 import { observation_ledger } from '#scripts/observations/observation-ledger'
 import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
@@ -18,20 +18,19 @@ const GONE_REASON = 'already dropped by another run'
 const BUSY_REASON = 'another run held the stash sweep lock'
 
 // An entry cut before joshuafolkken/kit#2919 holds its lines at an old single-file path, so the lines
-// of every ledger path it touches are carried to the current ledger.
+// of every ledger path it touches are carried to the current ledger. The reads are independent, and the
+// lines come back in path order however the reads finish.
 async function added_ledger_lines(
 	hash: string,
 	ledger_paths: ReadonlyArray<string>,
 ): Promise<Array<string>> {
-	const added: Array<string> = []
-
-	for (const ledger_path of ledger_paths) {
-		const lines = await git_stash.added_lines(hash, ledger_path)
-
-		added.push(...lines)
-	}
+	const added = await bounded_pool.bounded_map(
+		ledger_paths,
+		READ_CONCURRENCY,
+		async (ledger_path) => await git_stash.added_lines(hash, ledger_path),
+	)
 
-	return added
+	return added.flat()
 }
 
 // How many ledger lines went into the running work tree's ledger before the drop. The duplicate check
@@ -107,6 +106,7 @@ async function tidy_entries(
 	const outcomes: Array<Outcome> = []
 
 	for (const entry of entries) {
+		// eslint-disable-next-line no-await-in-loop -- drops shift the stash stack and append to the same ledger
 		const outcome = await tidy_entry(entry, merged)
 
 		if (outcome !== undefined) outcomes.push(outcome)

package/scripts/run/run-wake-cli.ts

@@ -3,8 +3,8 @@ import { randomUUID } from 'node:crypto'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import type { AgentProfile } from '#scripts/agent/agent-role-profile'
-import { telegram_notify } from '#scripts/git/telegram-notify'
 import { cli_flags } from '#scripts/lib/cli-flags'
+import { telegram_notify } from '#scripts/notify/telegram-notify'
 import { run_carry, type CarryRead } from './run-carry'
 import { run_event_stream } from './run-event-stream'
 import { run_headless } from './run-headless'
@@ -226,7 +226,7 @@ async function warn_of_stop(stop: LoopStop, body: string, context: WakeContext):
 }
 
 // **Only a failed wake exits non-zero, and the two reasons that newly warn do not**
-// (joshuafolkken/kit#1746). The verdict-and-exit-code table in `docs/josh-commands.md` is a contract
+// (joshuafolkken/kit#1746). The verdict-and-exit-code table in `docs/josh-commands-automation.md` is a contract
 // callers branch on; what `expired` and `unreadable` were missing is the notification, not a different
 // exit code, and changing both at once would break a caller to fix a silence.
 function exit_code_of(reason: WakeStopReason): number {
@@ -290,7 +290,7 @@ function start(context: WakeContext, interval: string | undefined): number {
 	const existing = run_wake.read_wake(context.wake_target)
 
 	if (existing !== undefined && run_wake.is_supervisor_live(existing)) {
-		console.error(run_wake_describe.describe_wake(existing, context))
+		console.error(run_wake_describe.describe_wake_cited(existing, context))
 
 		return report(RUNNING_VERDICT)
 	}
@@ -342,7 +342,7 @@ function list(context: WakeContext): number {
 
 	if (wake === undefined) return report(NONE_VERDICT)
 
-	console.error(run_wake_describe.describe_wake(wake, context))
+	console.error(run_wake_describe.describe_wake_cited(wake, context))
 
 	return report(run_wake.is_supervisor_live(wake) ? SUPERVISING_VERDICT : STALE_VERDICT)
 }
@@ -410,7 +410,6 @@ const run_wake_cli = {
 	NONE_VERDICT,
 	RUNNING_VERDICT,
 	STALE_VERDICT,
-	STARTED_VERDICT,
 	STOPPED_VERDICT,
 	SUPERVISING_VERDICT,
 	UNKNOWN_VERDICT,

package/scripts/run/run-wake-describe.ts

@@ -1,4 +1,6 @@
 import { agent_role_profile } from '#scripts/agent/agent-role-profile'
+import { gh_spawn } from '#scripts/gh/gh-spawn'
+import { issue_citation } from '#scripts/rules/issue-citation'
 import { run_carry, type CarryRead } from './run-carry'
 import { run_event_stream } from './run-event-stream'
 import { run_liveness } from './run-liveness'
@@ -9,6 +11,7 @@ import { run_wake, type RunWake } from './run-wake'
 // record reads back to a person lives here, one cohesive block.
 
 const UNKNOWN_CUTS = 'an unreadable number of'
+const REPO_LOOKUP_TIMEOUT_MS = 10_000
 const STOP_COMMAND = 'pnpm josh run:wake --stop'
 
 // The three paths every verb needs: the carry record it reads, its own record, and the work tree a
@@ -91,7 +94,22 @@ function describe_wake(wake: RunWake, context: WakeContext): string {
 		.join('\n')
 }
 
-const run_wake_describe = { STOP_COMMAND, describe_wake }
+// The description as a person reads it, every issue on it a number-link (joshuafolkken/kit#2943). The
+// invocation and the newest event both name issues (`backlogrun #1 #2`, `#1904 merged`), and a report
+// that copies them bare is what the Stop guard sends back. The repository is asked here, bounded, rather
+// than in the context every verb resolves: only the two describing verbs print it, and a lookup that
+// does not answer leaves the description as it was rather than withholding it.
+function cite_description(description: string, repo: string | undefined): string {
+	return repo === undefined ? description : issue_citation.linkify(description, repo)
+}
+
+function describe_wake_cited(wake: RunWake, context: WakeContext): string {
+	const repo = gh_spawn.get_repo_name_with_owner_within(REPO_LOOKUP_TIMEOUT_MS)
+
+	return cite_description(describe_wake(wake, context), repo)
+}
+
+const run_wake_describe = { STOP_COMMAND, cite_description, describe_wake, describe_wake_cited }
 
 export type { WakeContext }
 export { run_wake_describe }

package/scripts/run/run-wake-loop.ts

@@ -199,10 +199,12 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 	let wake = run_wake.read_own_wake(target)
 
 	while (wake !== undefined) {
+		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
 		const stop = await run_pass(target, wake, ports)
 
 		if (stop !== undefined) return stop
 
+		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
 		await ports.sleep(next_interval(run_wake.read_own_wake(target), interval_ms, ports.now()))
 		wake = run_wake.read_own_wake(target)
 	}
@@ -213,10 +215,8 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 const run_wake_loop = {
 	FAILED_REASON,
 	MAX_BACKOFF_FACTOR,
-	STOPPED_REASON,
 	next_interval,
 	run_loop,
-	step,
 }
 
 export type { DriveResult, LoopPorts, LoopStop }

package/scripts/run/run-wake.ts

@@ -1,6 +1,7 @@
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 import { backlog_budget } from '#scripts/backlog/backlog-budget'
 import { process_identity } from '#scripts/josh/process-identity'
+import { process_owner_schema } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { z } from 'zod'
 import type { CarryRead } from './run-carry'
@@ -209,11 +210,9 @@ const STOP_REASONS: Record<'none' | 'expired' | 'unreadable', WakeStopReason> =
 	unreadable: 'unreadable',
 }
 
-const run_wake_schema = z.object({
+const run_wake_schema = process_owner_schema.extend({
 	invocation: z.string(),
 	started_at: z.string(),
-	pid: z.number(),
-	process_start: z.string().optional(),
 	woke: z.number(),
 	woke_at: z.string().optional(),
 	// **Every optional field of `RunWake` has to be listed here.** `z.object` strips what it does not
@@ -583,7 +582,6 @@ const run_wake = {
 	IDLE_CEILING_MS,
 	MAX_WAKE_ATTEMPTS,
 	WAKE_GRACE_MS,
-	WAKE_PREFIX,
 	claim,
 	count_claim,
 	count_wake,

package/scripts/run/run-watcher-guard-cli.ts

@@ -30,8 +30,4 @@ async function main(): Promise<void> {
 	process.exitCode = await run()
 }
 
-const run_watcher_guard_cli = { run }
-
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { run_watcher_guard_cli }

package/scripts/run/run-watcher-guard.ts

@@ -1,4 +1,5 @@
 import { lane_registry } from '#scripts/lane/lane-registry'
+import { run_headless } from './run-headless'
 import { run_progress_clock } from './run-progress-clock'
 
 // A watcher that stopped while children are still in-flight leaves the parent blind to completions
@@ -29,19 +30,21 @@ type GuardResult = { kind: 'ok' } | { kind: 'stale'; note: string }
 
 const OK_RESULT: GuardResult = { kind: 'ok' }
 
-// The lanes a parent is still waiting on. A stranded lane has no child working in it, so it is not
-// in-flight — the one definition both this guard and the headless stop rule read (`run-headless.ts`).
-async function has_lanes_in_flight(): Promise<boolean> {
-	const all_lanes = await lane_registry.list_lanes()
+// **Only the run that opened the lanes owes them a watcher** (joshuafolkken/kit#2965). The lane listing
+// is machine-wide, so a session with no run of its own — an investigation, a `fullrun` beside a batch —
+// used to be refused for another run's lanes. The session that drives the live `backlogrun` carry
+// record is the one that dispatched them; every other session passes.
+async function owes_watcher(): Promise<boolean> {
+	if (!(await run_headless.is_backlog_parent())) return false
 
-	return all_lanes.some((lane) => !lane.is_stranded)
+	return await lane_registry.has_lanes_in_flight()
 }
 
 // `life_target` is the path returned by `run_progress_read.stamp_target()` or
 // `run_progress_clock.life_target_of(git_directory)`. Passed in rather than resolved here so the
 // caller can use whichever resolution fits its sync/async context.
 async function check(life_target: string): Promise<GuardResult> {
-	if (!(await has_lanes_in_flight())) return OK_RESULT
+	if (!(await owes_watcher())) return OK_RESULT
 
 	if (run_progress_clock.is_life_fresh(life_target, STALE_THRESHOLD_MS)) return OK_RESULT
 
@@ -52,7 +55,6 @@ const run_watcher_guard = {
 	STALE_NOTE,
 	STALE_THRESHOLD_MS,
 	check,
-	has_lanes_in_flight,
 }
 
 export type { GuardResult }

package/scripts/run/run-watcher-hook.ts

@@ -81,6 +81,6 @@ async function watcher_hook_reason(
 	return await stale_reason(transcript, now_ms)
 }
 
-const run_watcher_hook = { SWITCH_ENV_KEY, STAMP_PREFIX, watcher_hook_reason }
+const run_watcher_hook = { transcript_of, watcher_hook_reason }
 
 export { run_watcher_hook }

package/scripts/safe-chain/ci-installer-pin.ts

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { composite_actions } from '#scripts/ci/composite-actions'
 import { execaSync } from 'execa'
 
 // Where the workflows that install safe-chain on the runner live. Each carries the release and the
@@ -25,13 +26,18 @@ function installer_url(version: string): string {
 	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
 }
 
+// The local composite actions follow the workflows: kit's own pin lives in
+// `.github/actions/setup-pnpm`, which every kit workflow installs through (joshuafolkken/kit#2982).
 function list_workflows(): Array<string> {
-	return WORKFLOW_DIRECTORIES.filter((directory) => existsSync(directory)).flatMap((directory) =>
-		readdirSync(directory)
-			.filter((file_name) => WORKFLOW_FILE_RE.test(file_name))
-			.toSorted((left, right) => left.localeCompare(right))
-			.map((file_name) => `${directory}/${file_name}`),
+	const workflows = WORKFLOW_DIRECTORIES.filter((directory) => existsSync(directory)).flatMap(
+		(directory) =>
+			readdirSync(directory)
+				.filter((file_name) => WORKFLOW_FILE_RE.test(file_name))
+				.toSorted((left, right) => left.localeCompare(right))
+				.map((file_name) => `${directory}/${file_name}`),
 	)
+
+	return [...workflows, ...composite_actions.list()]
 }
 
 function extract_pinned_version(content: string): string | undefined {

package/scripts/safe-chain/project-config.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { file_reader } from '#scripts/lib/read-file'
+import { yaml_document } from '#scripts/lib/yaml-document'
 import { release_age } from '#scripts/version/release-age'
-import { yaml_document } from '#scripts/yaml/yaml-document'
 import { dump } from 'js-yaml'
 import { z } from 'zod'
 

package/scripts/security/security-audit-provision-logic.ts

@@ -191,7 +191,6 @@ function format_below_floor(version: string): string {
 }
 
 const security_audit_provision_logic = {
-	FORCED_DOWNLOAD_TIMEOUT_MS,
 	RETRY_INTERVAL_MS,
 	SESSION_DOWNLOAD_TIMEOUT_MS,
 	SCANNER_VERSION,

package/scripts/security/security-audit-provision.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { error_text } from '#scripts/lib/error-message'
+import { timed_fetch } from '#scripts/lib/timed-fetch'
 import { security_audit } from './security-audit'
 import { security_audit_logic } from './security-audit-logic'
 import { security_audit_provision_logic, type ScannerAsset } from './security-audit-provision-logic'
@@ -33,7 +34,7 @@ interface ProvisionOutcome {
 // catch-all would drop the release URL out of the message that names where the fetch went.
 async function download(url: string, timeout_ms: number): Promise<DownloadOutcome> {
 	try {
-		const response = await fetch(url, { signal: AbortSignal.timeout(timeout_ms) })
+		const response = await timed_fetch(url, {}, timeout_ms)
 		if (!response.ok) return { reason: `HTTP ${String(response.status)}` }
 
 		return { content: Buffer.from(await response.arrayBuffer()), reason: '' }
@@ -180,6 +181,6 @@ async function main(): Promise<void> {
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
 
-const security_audit_provision = { attempt, download, install, main, provision, report }
+const security_audit_provision = { attempt, provision, report }
 
 export { security_audit_provision }

package/scripts/security/security-audit.ts

@@ -137,7 +137,6 @@ const security_audit = {
 	meets_floor,
 	resolve_scanner,
 	run_scanner,
-	scanner_version,
 }
 
 export { security_audit }

package/scripts/security/security-updates-logic.ts

@@ -120,7 +120,6 @@ function format_security_updates_report(
 }
 
 const security_updates_logic = {
-	SETTING_LABEL,
 	enable_command,
 	classify_security_updates,
 	is_exposed,

package/scripts/sonar/sonar-hotspots-cli.ts

@@ -1,9 +1,5 @@
 #!/usr/bin/env tsx
-import { existsSync, readFileSync } from 'node:fs'
-import path from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { git_command } from '#scripts/git/git-command'
-import { error_text } from '#scripts/lib/error-message'
 import { managed_config_scope } from '#scripts/sync/managed-config-scope'
 import { z } from 'zod'
 import {
@@ -12,6 +8,7 @@ import {
 	type HotspotDisposition,
 	type HotspotFetch,
 } from './sonar-hotspots'
+import { sonar_project } from './sonar-project'
 
 // `josh sonar:hotspots <PR>` — fetch the SonarCloud hotspots on a pull request and print the Step B
 // disposition of each (joshuafolkken/kit#2182).
@@ -24,11 +21,7 @@ import {
 
 const ARGV_OFFSET = 2
 const USAGE = 'Usage: josh sonar:hotspots <PR>'
-const SONAR_HOST = 'https://sonarcloud.io'
 const HOTSPOTS_PATH = '/api/hotspots/search'
-const PROPERTIES_FILE = 'sonar-project.properties'
-const PROJECT_KEY_PREFIX = 'sonar.projectKey='
-const FETCH_TIMEOUT_MS = 10_000
 const FAILURE_EXIT_CODE = 1
 const UNKNOWN_LINE = '?'
 
@@ -44,34 +37,17 @@ const hotspot_schema = z.looseObject({
 })
 const response_schema = z.looseObject({ hotspots: z.array(hotspot_schema).optional() })
 
-function read_project_key(root: string): string | undefined {
-	const file = path.join(root, PROPERTIES_FILE)
-	if (!existsSync(file)) return undefined
-
-	const line = readFileSync(file, 'utf8')
-		.split('\n')
-		.find((entry) => entry.startsWith(PROJECT_KEY_PREFIX))
-
-	return line?.slice(PROJECT_KEY_PREFIX.length).trim()
-}
-
 function hotspots_url(project_key: string, pull_request: string): string {
-	const query = new URLSearchParams({ projectKey: project_key, pullRequest: pull_request })
-
-	return `${SONAR_HOST}${HOTSPOTS_PATH}?${query.toString()}`
+	return sonar_project.api_url(HOTSPOTS_PATH, {
+		projectKey: project_key,
+		pullRequest: pull_request,
+	})
 }
 
 async function fetch_hotspots(url: string): Promise<HotspotFetch> {
-	try {
-		const response = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) })
-		if (!response.ok) return { error: `HTTP ${String(response.status)}` }
-
-		const parsed = response_schema.parse(await response.json())
+	const read = await sonar_project.fetch_json(url, response_schema)
 
-		return { hotspots: parsed.hotspots ?? [] }
-	} catch (error) {
-		return { error: error_text.message_of(error) }
-	}
+	return 'error' in read ? read : { hotspots: read.data.hotspots ?? [] }
 }
 
 function is_managed(component: string): boolean {
@@ -108,23 +84,10 @@ async function fetch_and_print(project_key: string, pull_request: string): Promi
 }
 
 async function run(argv: ReadonlyArray<string>): Promise<number> {
-	const [pull_request] = argv
-
-	if (pull_request === undefined || pull_request.startsWith('-')) {
-		console.error(USAGE)
-
-		return FAILURE_EXIT_CODE
-	}
-
-	const project_key = read_project_key(await git_command.repository_root())
-
-	if (project_key === undefined) {
-		console.error(`no ${PROJECT_KEY_PREFIX} found in ${PROPERTIES_FILE}`)
-
-		return FAILURE_EXIT_CODE
-	}
+	const target = await sonar_project.resolve_target(argv, USAGE)
+	if (target === undefined) return FAILURE_EXIT_CODE
 
-	await fetch_and_print(project_key, pull_request)
+	await fetch_and_print(target.project_key, target.pull_request)
 
 	return 0
 }
@@ -136,12 +99,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 const sonar_hotspots_cli = {
 	fetch_hotspots,
 	format_hotspot,
-	hotspots_url,
-	is_managed,
-	main,
 	print_disposition,
-	read_project_key,
-	run,
 	USAGE,
 }
 

package/scripts/sonar/sonar-hotspots.ts

@@ -95,7 +95,6 @@ const sonar_hotspots = {
 	classify_fetch,
 	classify_hotspot,
 	component_path,
-	HOTSPOT_BRANCHES,
 	UNREADABLE,
 }