@joshuafolkken/kit 1.1050.0 → 1.1094.0

package/scripts/build/build-hooks.ts

@@ -1,12 +1,27 @@
 #!/usr/bin/env tsx
-import { readdirSync, rmSync } from 'node:fs'
+import {
+	mkdirSync,
+	mkdtempSync,
+	readdirSync,
+	readFileSync,
+	renameSync,
+	rmSync,
+	writeFileSync,
+} from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { hook_bundle_stamp } from '#scripts/build/hook-bundle-stamp'
 import { error_text } from '#scripts/lib/error-message'
-import { build } from 'esbuild'
+import { build, type OnLoadArgs, type OutputFile, type Plugin, type PluginBuild } from 'esbuild'
 
 const PACKAGE_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..')
 const OUT_DIR = path.join(PACKAGE_DIR, 'dist', 'hooks')
+const { STAMP_NAME } = hook_bundle_stamp
+const CHUNK_PREFIX = 'chunk-'
+const STAGING_PREFIX = '.hooks-staging-'
+// esbuild compiles a plugin filter as a Go regexp, which rejects the `u` flag.
+// eslint-disable-next-line require-unicode-regexp
+const ANY_PATH = /.*/
 
 // Each Claude Code hook is bundled to its own `dist/hooks/<name>.js`, so a consumer (and kit itself)
 // invokes `node dist/hooks/<name>.js` directly — no `pnpm` launch and no `tsx` re-spawn from the
@@ -60,20 +75,76 @@ function outfile_for(bundle: HookBundle): string {
 // The output directory is flat (every entry and chunk sits at its top level), so a file whose name
 // this build did not emit is a leftover of an earlier one.
 function prune_stale_outputs(out_directory: string, outputs: ReadonlyArray<string>): void {
-	const live = new Set(outputs.map((output) => path.basename(output)))
+	const live = new Set([...outputs.map((output) => path.basename(output)), STAMP_NAME])
 
 	for (const name of readdirSync(out_directory)) {
 		if (!live.has(name)) rmSync(path.join(out_directory, name), { recursive: true, force: true })
 	}
 }
 
+// Every file the build loads is read here, so the stamp digests the exact bytes that were bundled —
+// a source edited mid-build is recorded as what it was, and the next launch rebuilds it.
+function source_recorder(sources: Map<string, Uint8Array>): Plugin {
+	return {
+		name: 'hook-source-recorder',
+		setup(plugin_build: PluginBuild): void {
+			plugin_build.onLoad({ filter: ANY_PATH, namespace: 'file' }, function load(args: OnLoadArgs) {
+				const contents = readFileSync(args.path)
+
+				sources.set(path.relative(PACKAGE_DIR, args.path), contents)
+
+				return { contents, loader: 'default' }
+			})
+		},
+	}
+}
+
+function is_chunk(file: OutputFile): boolean {
+	return path.basename(file.path).startsWith(CHUNK_PREFIX)
+}
+
+// Shared chunks first, then the entries that import them: an entry swapped in before its chunks
+// would fail to load in a hook launched at that moment.
+function is_chunk_first(left: OutputFile, right: OutputFile): number {
+	return Number(is_chunk(right)) - Number(is_chunk(left))
+}
+
+// Each file is written into a private staging directory and renamed into place, so a hook never
+// reads a half-written bundle and two builds running side by side never write one file at once.
+function place(staging: string, target: string, contents: Uint8Array | string): void {
+	const temporary = path.join(staging, path.basename(target))
+
+	writeFileSync(temporary, contents)
+	renameSync(temporary, target)
+}
+
+function place_build(out_directory: string, files: ReadonlyArray<OutputFile>, stamp: string): void {
+	mkdirSync(out_directory, { recursive: true })
+	const staging = mkdtempSync(path.join(path.dirname(out_directory), STAGING_PREFIX))
+
+	try {
+		for (const file of files.toSorted(is_chunk_first)) place(staging, file.path, file.contents)
+		prune_stale_outputs(
+			out_directory,
+			files.map((file) => file.path),
+		)
+		place(staging, path.join(out_directory, STAMP_NAME), stamp)
+	} finally {
+		rmSync(staging, { recursive: true, force: true })
+	}
+}
+
 // With `splitting: true` every build emits freshly hashed `chunk-*.js` files, so without a cleanup
 // the chunks of every earlier build pile up beside the live ones and ship in any local pack
-// (joshuafolkken/kit#2885). The cleanup runs after the build rather than emptying the directory
-// first: this checkout's own settings.json launches `node dist/hooks/<name>.js` on every tool call,
-// and an emptied directory would make a hook launched mid-build fail to load and its guard fail open.
+// (joshuafolkken/kit#2885). The cleanup runs after the new files are in place rather than emptying
+// the directory first: this checkout's own settings.json launches `node dist/hooks/<name>.js` on
+// every tool call, and an emptied directory would make a hook launched mid-build fail to load and its
+// guard fail open. The source digest is placed last (`hook-bundle-stamp.ts`), so a launch only reads
+// the bundles as fresh once every one of them is in place (joshuafolkken/kit#2984).
 async function build_hooks(out_directory: string = OUT_DIR): Promise<void> {
-	const { metafile } = await build({
+	const sources = new Map<string, Uint8Array>()
+	const { outputFiles: files } = await build({
+		absWorkingDir: PACKAGE_DIR,
 		entryPoints: HOOK_BUNDLES.map((bundle) => entry_point(bundle)),
 		outdir: out_directory,
 		bundle: true,
@@ -82,10 +153,15 @@ async function build_hooks(out_directory: string = OUT_DIR): Promise<void> {
 		format: 'esm',
 		target: 'node22',
 		packages: 'external',
-		metafile: true,
+		write: false,
+		plugins: [source_recorder(sources)],
 	})
+	const stamp = hook_bundle_stamp.stamp_text(
+		sources,
+		files.map((file) => file.path),
+	)
 
-	prune_stale_outputs(out_directory, Object.keys(metafile.outputs))
+	place_build(out_directory, files, stamp)
 }
 
 async function main(): Promise<void> {

package/scripts/build/hook-bundle-stamp.ts

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
+
+// What a hook build was made from, so a later launch can tell whether `dist/hooks/` still matches the
+// source it runs beside (joshuafolkken/kit#2984). `dist/` is git-ignored and rebuilt only by
+// `pnpm build`, so without this record an edited guard keeps running its old bundle with nothing to
+// say so — and a lane's bundles are copied from the main checkout, whose source can differ.
+//
+// **The record is a content digest, not a timestamp.** A copy (`lane-cache.ts`) or a fresh checkout
+// rewrites every mtime while leaving the content alone, and a digest is the only comparison that
+// neither rebuilds on that nor misses an edit that kept the old mtime.
+//
+// **The digest is taken from the bytes the build read, never re-read from disk afterwards.** A source
+// edited while the build runs would otherwise be recorded as built, and its stale bundle read as fresh.
+//
+// This module is loaded by plain `node` on every hook launch (`scripts/hooks/hook-bundle-ready.ts`),
+// so it imports `node:` built-ins and `#scripts/*` subpaths alone — nothing slow to load.
+
+const STAMP_NAME = 'inputs.json'
+const DIGEST_ALGORITHM = 'sha256'
+const JSON_INDENT = '\t'
+
+interface HookBundleStamp {
+	digest: string
+	inputs: Array<string>
+	outputs: Array<string>
+}
+
+// Package-relative input path → the bytes the build read for it.
+type HookSources = ReadonlyMap<string, Uint8Array>
+
+// Code-unit order, so the digest does not depend on the locale of the machine that computes it.
+function by_code_unit(left: string, right: string): number {
+	if (left === right) return 0
+
+	return left < right ? -1 : 1
+}
+
+// Inputs are hashed in sorted order with their names, so a rename or a reorder changes the digest.
+function digest_of(sources: HookSources): string {
+	const hash = createHash(DIGEST_ALGORITHM)
+
+	for (const input of [...sources.keys()].toSorted(by_code_unit)) {
+		hash.update(`${input}\0`).update(sources.get(input) ?? new Uint8Array())
+	}
+
+	return hash.digest('hex')
+}
+
+// The record for a build that read `sources` and emitted `outputs`, as the text to write.
+function stamp_text(sources: HookSources, outputs: ReadonlyArray<string>): string {
+	const stamp: HookBundleStamp = {
+		digest: digest_of(sources),
+		inputs: [...sources.keys()],
+		outputs: outputs.map((output) => path.basename(output)),
+	}
+
+	return `${JSON.stringify(stamp, undefined, JSON_INDENT)}\n`
+}
+
+// Undefined when an input is gone: a deleted input cannot match any digest.
+function read_sources(
+	package_directory: string,
+	inputs: ReadonlyArray<string>,
+): HookSources | undefined {
+	const sources = new Map<string, Uint8Array>()
+
+	for (const input of inputs) {
+		const file_path = path.join(package_directory, input)
+		if (!existsSync(file_path)) return undefined
+		sources.set(input, readFileSync(file_path))
+	}
+
+	return sources
+}
+
+function is_string_array(value: unknown): value is Array<string> {
+	return Array.isArray(value) && value.every((item) => typeof item === 'string')
+}
+
+function is_stamp(value: unknown): value is HookBundleStamp {
+	if (!json_value.is_record(value) || typeof value['digest'] !== 'string') return false
+
+	return is_string_array(value['inputs']) && is_string_array(value['outputs'])
+}
+
+// A record of any other shape — hand-edited, truncated, or from an older format — reads as no record.
+function read_stamp(out_directory: string): HookBundleStamp | undefined {
+	const stamp_path = path.join(out_directory, STAMP_NAME)
+	if (!existsSync(stamp_path)) return undefined
+	const stamp = json_value.parse_or_undefined(readFileSync(stamp_path, 'utf8'))
+
+	return is_stamp(stamp) ? stamp : undefined
+}
+
+// Fresh only when the record exists, every output it lists is still there, and the listed inputs hash
+// to the recorded digest — a missing or deleted input counts as stale.
+function is_fresh(out_directory: string, package_directory: string): boolean {
+	const stamp = read_stamp(out_directory)
+	if (!stamp?.outputs.every((output) => existsSync(path.join(out_directory, output)))) return false
+	const sources = read_sources(package_directory, stamp.inputs)
+
+	return sources !== undefined && digest_of(sources) === stamp.digest
+}
+
+const hook_bundle_stamp = { is_fresh, STAMP_NAME, stamp_text }
+
+export type { HookSources }
+export { hook_bundle_stamp }

package/scripts/cases/cases-cli.ts

@@ -41,7 +41,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const cases_cli = { USAGE, main, run }
+const cases_cli = { run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/cases/cases-logic.ts

@@ -90,7 +90,7 @@ const VOCABULARY: ReadonlyArray<string> = [
 	NONE,
 ]
 
-const cases = { BOUNDARIES, NONE, VOCABULARY, boundaries_in, cases_for }
+const cases = { NONE, VOCABULARY, boundaries_in, cases_for }
 
 export type { Boundary }
 export { cases }

package/scripts/ci/composite-actions.ts

@@ -0,0 +1,30 @@
+import { existsSync, readdirSync } from 'node:fs'
+
+// A local composite action is one directory under `.github/actions`, and GitHub resolves
+// `uses: ./.github/actions/<name>` to that directory's `action.yml` (or `action.yaml`). Workflow
+// scanners that read `.github/workflows` read these files too: `.github/actions/setup-pnpm` holds
+// the pnpm/setup pin and the safe-chain installer pin kit's workflows used to carry inline
+// (joshuafolkken/kit#2982).
+const ACTIONS_DIRECTORY = '.github/actions'
+const ACTION_FILE_NAMES = ['action.yml', 'action.yaml']
+
+function as_is(relative_path: string): string {
+	return relative_path
+}
+
+// Relative paths, resolved for the file-system calls through `resolve` — the identity for a
+// consumer's working directory, `package_path` for kit's own package.
+function list(resolve: (relative_path: string) => string = as_is): Array<string> {
+	if (!existsSync(resolve(ACTIONS_DIRECTORY))) return []
+
+	return readdirSync(resolve(ACTIONS_DIRECTORY))
+		.toSorted((left, right) => left.localeCompare(right))
+		.flatMap((name) =>
+			ACTION_FILE_NAMES.map((file_name) => `${ACTIONS_DIRECTORY}/${name}/${file_name}`),
+		)
+		.filter((relative_path) => existsSync(resolve(relative_path)))
+}
+
+const composite_actions = { list }
+
+export { composite_actions }

package/scripts/ci/pr-classification.ts

@@ -1,13 +1,13 @@
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
-import { git_gh_exec } from '#scripts/git/git-gh-exec'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
 import {
 	BREAKING_CHANGE_LABEL as BREAKING,
 	BUGFIX_LABEL as BUGFIX,
 	RELEASE_CLASSIFICATION_NAMES as CLASSIFICATION_LABELS,
 	ENHANCEMENT_LABEL,
 	type ReleaseClassification,
-} from '#scripts/git/issue-labels'
+} from '#scripts/issue/issue-labels'
 import { error_text } from '#scripts/lib/error-message'
 import { z } from 'zod'
 
@@ -144,4 +144,4 @@ export { pr_classification }
 export {
 	RELEASE_CLASSIFICATION_NAMES as CLASSIFICATION_LABELS,
 	type ReleaseClassification,
-} from '#scripts/git/issue-labels'
+} from '#scripts/issue/issue-labels'

package/scripts/claude/workflow-destination.ts

@@ -6,8 +6,17 @@
 // Matches a consumer workflow destination, absolute or repo-relative, on either separator.
 const WORKFLOW_DESTINATION_PATTERN = /(?:^|[/\\])\.github[/\\]workflows[/\\][^/\\]+\.ya?ml$/u
 
+// A local composite action is a workflow file too: it pins actions of its own, the distributed
+// `dependabot.yml` bumps it (`/.github/actions/*`), and the next sync writes it back — so it needs
+// the same pins and the same managed stamp as the workflow that calls it (joshuafolkken/kit#3013).
+const COMPOSITE_ACTION_DESTINATION_PATTERN =
+	/(?:^|[/\\])\.github[/\\]actions[/\\][^/\\]+[/\\]action\.ya?ml$/u
+
 function is_workflow_destination(destination: string): boolean {
-	return WORKFLOW_DESTINATION_PATTERN.test(destination)
+	return (
+		WORKFLOW_DESTINATION_PATTERN.test(destination) ||
+		COMPOSITE_ACTION_DESTINATION_PATTERN.test(destination)
+	)
 }
 
 export { is_workflow_destination }

package/scripts/clone/clone-fingerprint.ts

@@ -85,7 +85,6 @@ function fingerprints_for(source: string, site: FileSite): Array<Fingerprint> {
 }
 
 const clone_fingerprint = {
-	WINDOW_SIZE,
 	normalize,
 	is_significant,
 	significant_lines,

package/scripts/clone/clone-scan-cli.ts

@@ -32,7 +32,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const clone_scan_cli = { USAGE, main, run }
+const clone_scan_cli = { USAGE, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/clone/clone-scan.ts

@@ -153,6 +153,6 @@ function format_report(groups: ReadonlyArray<CloneGroup>): string {
 	return [header, ...groups.map((group) => format_group(group))].join('\n')
 }
 
-const clone_scan = { CLEAN_VERDICT, CLONES_PREFIX, scan, format_site, format_group, format_report }
+const clone_scan = { CLEAN_VERDICT, CLONES_PREFIX, scan, format_report }
 
 export { clone_scan }

package/scripts/config-merge/json-format.ts

@@ -120,7 +120,6 @@ function format_package_json(value: unknown): string {
 }
 
 const json_format = {
-	inline_short_arrays,
 	format_json,
 	format_package_json,
 }

package/scripts/config-merge/patch-yaml-list.ts

@@ -1,5 +1,5 @@
 import { string_array_schema } from '#scripts/lib/schemas'
-import { yaml_document } from '#scripts/yaml/yaml-document'
+import { yaml_document } from '#scripts/lib/yaml-document'
 import { dump, type DumpOptions } from 'js-yaml'
 import { list_patch, type ListEntryMatcher } from './list-patch'
 

package/scripts/cost-runtime/codex-usage.ts

@@ -1,5 +1,6 @@
 import { globSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 import { cost_transcript } from './cost-transcript'
 import type { OverMeasurement } from './cost-verdict'
@@ -23,14 +24,6 @@ const TOKEN_COUNT_SCHEMA = z.looseObject({
 
 type Environment = Readonly<Record<string, string | undefined>>
 
-function decode(line: string): unknown {
-	try {
-		return JSON.parse(line)
-	} catch {
-		return undefined
-	}
-}
-
 function same_project(cwd: string, target: string): boolean {
 	return cost_transcript.session_cwd(cwd) === cost_transcript.session_cwd(target)
 }
@@ -51,7 +44,7 @@ function measurement_from(
 	target: string,
 	thread_id: string,
 ): OverMeasurement | undefined {
-	const values = content.split('\n').map((line) => decode(line))
+	const values = content.split('\n').map((line) => json_value.parse_or_undefined(line))
 	const metadata = values.flatMap((value) => {
 		const parsed = SESSION_META_SCHEMA.safeParse(value)
 

package/scripts/cost-runtime/cost-attribute.ts

@@ -158,7 +158,6 @@ const cost_attribute = {
 	UNATTRIBUTED_KEY,
 	issue_from_branch,
 	declared_issue,
-	fill,
 	attribute,
 	group_by_issue,
 	records_for_issue,

package/scripts/cost-runtime/cost-cli.ts

@@ -305,11 +305,8 @@ const cost_cli = {
 	USAGE,
 	parse_options,
 	to_threshold,
-	load_corpus: cost_corpus.load_corpus,
-	attributed: cost_corpus.attributed,
 	run,
 	session_verdict,
-	main,
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))

package/scripts/cost-runtime/cost-corpus.ts

@@ -265,11 +265,9 @@ function mainline_records(pairs: ReadonlyArray<AttributedRecord>): Array<Array<U
 }
 
 const cost_corpus = {
-	accumulate_missing,
 	load_corpus,
 	attribute_corpus,
 	floor_for_issue,
-	dedupe_across_sessions,
 	attributed,
 	mainline_records,
 }

package/scripts/cost-runtime/cost-format.ts

@@ -21,9 +21,6 @@ function format_share(part: number, whole: number): string {
 }
 
 const cost_format = {
-	USD_DECIMALS,
-	PERCENT_SCALE,
-	PERCENT_DECIMALS,
 	format_usd,
 	format_tokens,
 	format_share,

package/scripts/cost-runtime/cost-pricing.ts

@@ -163,7 +163,6 @@ const cost_pricing = {
 	CACHE_WRITE_5M_MULTIPLIER,
 	CACHE_WRITE_1H_MULTIPLIER,
 	CACHE_READ_MULTIPLIER,
-	MODEL_PRICES,
 	resolve_price,
 	estimate_cost,
 	estimate_composition,

package/scripts/cost-runtime/cost-tokens.ts

@@ -74,7 +74,6 @@ function ascii_bytes_to_tokens(bytes: number): number {
 
 const cost_tokens = {
 	ASCII_CHARS_PER_TOKEN,
-	WIDE_TOKENS_PER_CHAR,
 	count_chars,
 	estimate,
 	ascii_bytes_to_tokens,

package/scripts/delegation/delegation-cli.ts

@@ -84,7 +84,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const delegation_cli = { USAGE, print_list, run, main }
+const delegation_cli = { print_list, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/delegation/delegation-policy.ts

@@ -181,7 +181,6 @@ const delegation_policy = {
 	REJECTED_STEPS,
 	find_step,
 	verdict_for,
-	rejection_for,
 	reason_for,
 }
 

package/scripts/delegation/duplicate-read-guard.ts

@@ -216,14 +216,6 @@ const { deny_envelope, DISABLED_VALUES } = hook_decision
 const duplicate_reads = {
 	REASON,
 	NOTICE,
-	SWITCH_ENV_KEY,
-	is_candidate,
-	is_rearmed,
-	is_redundant_reread,
-	is_refusable_call,
-	is_unchanged_reread,
-	last_read_ms,
-	read_target,
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {

package/scripts/delegation/fanout-cli.ts

@@ -54,7 +54,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const fanout_cli = { USAGE, parse_unit, is_refused, run, main }
+const fanout_cli = { parse_unit, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/delegation/fanout.ts

@@ -86,8 +86,6 @@ function fanout_result(units: ReadonlyArray<FanoutUnit>): FanoutResult {
 const fanout = {
 	PARALLEL_VERDICT,
 	SERIAL_VERDICT,
-	MIN_UNITS_TO_PARALLELIZE,
-	overlapping_files,
 	fanout_result,
 }