@joshuafolkken/kit 1.1050.0 → 1.1128.0

package/scripts/build/hook-bundle-stamp.ts

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
+
+// What a hook build was made from, so a later launch can tell whether `dist/hooks/` still matches the
+// source it runs beside (joshuafolkken/kit#2984). `dist/` is git-ignored and rebuilt only by
+// `pnpm build`, so without this record an edited guard keeps running its old bundle with nothing to
+// say so — and a lane's bundles are copied from the main checkout, whose source can differ.
+//
+// **The record is a content digest, not a timestamp.** A copy (`lane-cache.ts`) or a fresh checkout
+// rewrites every mtime while leaving the content alone, and a digest is the only comparison that
+// neither rebuilds on that nor misses an edit that kept the old mtime.
+//
+// **The digest is taken from the bytes the build read, never re-read from disk afterwards.** A source
+// edited while the build runs would otherwise be recorded as built, and its stale bundle read as fresh.
+//
+// This module is loaded by plain `node` on every hook launch (`scripts/hooks/hook-bundle-ready.ts`),
+// so it imports `node:` built-ins and `#scripts/*` subpaths alone — nothing slow to load.
+
+const STAMP_NAME = 'inputs.json'
+const DIGEST_ALGORITHM = 'sha256'
+const JSON_INDENT = '\t'
+
+interface HookBundleStamp {
+	digest: string
+	inputs: Array<string>
+	outputs: Array<string>
+}
+
+// Package-relative input path → the bytes the build read for it.
+type HookSources = ReadonlyMap<string, Uint8Array>
+
+// Code-unit order, so the digest does not depend on the locale of the machine that computes it.
+function by_code_unit(left: string, right: string): number {
+	if (left === right) return 0
+
+	return left < right ? -1 : 1
+}
+
+// Inputs are hashed in sorted order with their names, so a rename or a reorder changes the digest.
+function digest_of(sources: HookSources): string {
+	const hash = createHash(DIGEST_ALGORITHM)
+
+	for (const input of [...sources.keys()].toSorted(by_code_unit)) {
+		hash.update(`${input}\0`).update(sources.get(input) ?? new Uint8Array())
+	}
+
+	return hash.digest('hex')
+}
+
+// The record for a build that read `sources` and emitted `outputs`, as the text to write.
+function stamp_text(sources: HookSources, outputs: ReadonlyArray<string>): string {
+	const stamp: HookBundleStamp = {
+		digest: digest_of(sources),
+		inputs: [...sources.keys()],
+		outputs: outputs.map((output) => path.basename(output)),
+	}
+
+	return `${JSON.stringify(stamp, undefined, JSON_INDENT)}\n`
+}
+
+// Undefined when an input is gone: a deleted input cannot match any digest.
+function read_sources(
+	package_directory: string,
+	inputs: ReadonlyArray<string>,
+): HookSources | undefined {
+	const sources = new Map<string, Uint8Array>()
+
+	for (const input of inputs) {
+		const file_path = path.join(package_directory, input)
+		if (!existsSync(file_path)) return undefined
+		sources.set(input, readFileSync(file_path))
+	}
+
+	return sources
+}
+
+function is_string_array(value: unknown): value is Array<string> {
+	return Array.isArray(value) && value.every((item) => typeof item === 'string')
+}
+
+function is_stamp(value: unknown): value is HookBundleStamp {
+	if (!json_value.is_record(value) || typeof value['digest'] !== 'string') return false
+
+	return is_string_array(value['inputs']) && is_string_array(value['outputs'])
+}
+
+// A record of any other shape — hand-edited, truncated, or from an older format — reads as no record.
+function read_stamp(out_directory: string): HookBundleStamp | undefined {
+	const stamp_path = path.join(out_directory, STAMP_NAME)
+	if (!existsSync(stamp_path)) return undefined
+	const stamp = json_value.parse_or_undefined(readFileSync(stamp_path, 'utf8'))
+
+	return is_stamp(stamp) ? stamp : undefined
+}
+
+// Fresh only when the record exists, every output it lists is still there, and the listed inputs hash
+// to the recorded digest — a missing or deleted input counts as stale.
+function is_fresh(out_directory: string, package_directory: string): boolean {
+	const stamp = read_stamp(out_directory)
+	if (!stamp?.outputs.every((output) => existsSync(path.join(out_directory, output)))) return false
+	const sources = read_sources(package_directory, stamp.inputs)
+
+	return sources !== undefined && digest_of(sources) === stamp.digest
+}
+
+const hook_bundle_stamp = { is_fresh, STAMP_NAME, stamp_text }
+
+export type { HookSources }
+export { hook_bundle_stamp }

package/scripts/cases/cases-cli.ts

@@ -41,7 +41,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const cases_cli = { USAGE, main, run }
+const cases_cli = { run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/cases/cases-logic.ts

@@ -90,7 +90,7 @@ const VOCABULARY: ReadonlyArray<string> = [
 	NONE,
 ]
 
-const cases = { BOUNDARIES, NONE, VOCABULARY, boundaries_in, cases_for }
+const cases = { NONE, VOCABULARY, boundaries_in, cases_for }
 
 export type { Boundary }
 export { cases }

package/scripts/ci/composite-actions.ts

@@ -0,0 +1,30 @@
+import { existsSync, readdirSync } from 'node:fs'
+
+// A local composite action is one directory under `.github/actions`, and GitHub resolves
+// `uses: ./.github/actions/<name>` to that directory's `action.yml` (or `action.yaml`). Workflow
+// scanners that read `.github/workflows` read these files too: `.github/actions/setup-pnpm` holds
+// the pnpm/setup pin and the safe-chain installer pin kit's workflows used to carry inline
+// (joshuafolkken/kit#2982).
+const ACTIONS_DIRECTORY = '.github/actions'
+const ACTION_FILE_NAMES = ['action.yml', 'action.yaml']
+
+function as_is(relative_path: string): string {
+	return relative_path
+}
+
+// Relative paths, resolved for the file-system calls through `resolve` — the identity for a
+// consumer's working directory, `package_path` for kit's own package.
+function list(resolve: (relative_path: string) => string = as_is): Array<string> {
+	if (!existsSync(resolve(ACTIONS_DIRECTORY))) return []
+
+	return readdirSync(resolve(ACTIONS_DIRECTORY))
+		.toSorted((left, right) => left.localeCompare(right))
+		.flatMap((name) =>
+			ACTION_FILE_NAMES.map((file_name) => `${ACTIONS_DIRECTORY}/${name}/${file_name}`),
+		)
+		.filter((relative_path) => existsSync(resolve(relative_path)))
+}
+
+const composite_actions = { list }
+
+export { composite_actions }

package/scripts/ci/pr-classification.ts

@@ -1,13 +1,13 @@
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
-import { git_gh_exec } from '#scripts/git/git-gh-exec'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
 import {
 	BREAKING_CHANGE_LABEL as BREAKING,
 	BUGFIX_LABEL as BUGFIX,
 	RELEASE_CLASSIFICATION_NAMES as CLASSIFICATION_LABELS,
 	ENHANCEMENT_LABEL,
 	type ReleaseClassification,
-} from '#scripts/git/issue-labels'
+} from '#scripts/issue/issue-labels'
 import { error_text } from '#scripts/lib/error-message'
 import { z } from 'zod'
 
@@ -144,4 +144,4 @@ export { pr_classification }
 export {
 	RELEASE_CLASSIFICATION_NAMES as CLASSIFICATION_LABELS,
 	type ReleaseClassification,
-} from '#scripts/git/issue-labels'
+} from '#scripts/issue/issue-labels'

package/scripts/claude/workflow-destination.ts

@@ -6,8 +6,17 @@
 // Matches a consumer workflow destination, absolute or repo-relative, on either separator.
 const WORKFLOW_DESTINATION_PATTERN = /(?:^|[/\\])\.github[/\\]workflows[/\\][^/\\]+\.ya?ml$/u
 
+// A local composite action is a workflow file too: it pins actions of its own, the distributed
+// `dependabot.yml` bumps it (`/.github/actions/*`), and the next sync writes it back — so it needs
+// the same pins and the same managed stamp as the workflow that calls it (joshuafolkken/kit#3013).
+const COMPOSITE_ACTION_DESTINATION_PATTERN =
+	/(?:^|[/\\])\.github[/\\]actions[/\\][^/\\]+[/\\]action\.ya?ml$/u
+
 function is_workflow_destination(destination: string): boolean {
-	return WORKFLOW_DESTINATION_PATTERN.test(destination)
+	return (
+		WORKFLOW_DESTINATION_PATTERN.test(destination) ||
+		COMPOSITE_ACTION_DESTINATION_PATTERN.test(destination)
+	)
 }
 
 export { is_workflow_destination }

package/scripts/clone/clone-fingerprint.ts

@@ -85,7 +85,6 @@ function fingerprints_for(source: string, site: FileSite): Array<Fingerprint> {
 }
 
 const clone_fingerprint = {
-	WINDOW_SIZE,
 	normalize,
 	is_significant,
 	significant_lines,

package/scripts/clone/clone-scan-cli.ts

@@ -32,7 +32,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const clone_scan_cli = { USAGE, main, run }
+const clone_scan_cli = { USAGE, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/clone/clone-scan.ts

@@ -153,6 +153,6 @@ function format_report(groups: ReadonlyArray<CloneGroup>): string {
 	return [header, ...groups.map((group) => format_group(group))].join('\n')
 }
 
-const clone_scan = { CLEAN_VERDICT, CLONES_PREFIX, scan, format_site, format_group, format_report }
+const clone_scan = { CLEAN_VERDICT, CLONES_PREFIX, scan, format_report }
 
 export { clone_scan }

package/scripts/config-merge/json-format.ts

@@ -120,7 +120,6 @@ function format_package_json(value: unknown): string {
 }
 
 const json_format = {
-	inline_short_arrays,
 	format_json,
 	format_package_json,
 }

package/scripts/config-merge/parse-jsonc.ts

@@ -1,14 +1,44 @@
 import { json_object_schema } from '#scripts/lib/schemas'
-import strip_json_comments from 'strip-json-comments'
+import { parseTree, printParseErrorCode, type Node, type ParseError } from 'jsonc-parser'
 
 // Every managed JSON config kit reads (tsconfig.json, package.json, .vscode/*.json) may legally
 // carry comments and trailing commas — TypeScript and VS Code both parse them as JSONC — so a plain
 // `JSON.parse` would throw on files consumers hand-authored. Single-sourced here because the
 // config-merge library and the init/sync merge helpers both need the exact same tolerant read.
+
+// Built from the tree rather than with jsonc-parser's own `parse` / `getNodeValue`, which assign each
+// key: a `"__proto__"` key would become the object's prototype instead of the own property
+// `JSON.parse` keeps, and the spread-and-stringify write-back would then drop it from the file.
+// `Object.fromEntries` defines properties, so every key stays data.
+function property_key(property: Node): string {
+	return String(property.children?.[0]?.value)
+}
+
+function node_value(node: Node | undefined): unknown {
+	if (node === undefined) return undefined
+	const children = node.children ?? []
+	if (node.type === 'array') return children.map((child) => node_value(child))
+	if (node.type !== 'object') return node.value
+
+	return Object.fromEntries(
+		children.map((property) => [property_key(property), node_value(property.children?.[1])]),
+	)
+}
+
+// jsonc-parser recovers from errors and returns a best-effort tree, so any reported error is
+// rethrown: a malformed document must fail the read the way `JSON.parse` would, not merge partially.
 function parse_jsonc(content: string): Record<string, unknown> {
-	const stripped = strip_json_comments(content, { trailingCommas: true })
+	const errors: Array<ParseError> = []
+	const tree = parseTree(content, errors, { allowTrailingComma: true })
+	const [first_error] = errors
+
+	if (first_error !== undefined) {
+		throw new SyntaxError(
+			`Invalid JSONC: ${printParseErrorCode(first_error.error)} at offset ${String(first_error.offset)}`,
+		)
+	}
 
-	return json_object_schema.parse(JSON.parse(stripped))
+	return json_object_schema.parse(node_value(tree))
 }
 
 export { parse_jsonc }

package/scripts/config-merge/patch-json-key.ts

@@ -1,5 +1,11 @@
-import { createScanner, findNodeAtLocation, getNodeValue, parseTree, type Node } from 'jsonc-parser'
-import strip_json_comments from 'strip-json-comments'
+import {
+	createScanner,
+	findNodeAtLocation,
+	getNodeValue,
+	parseTree,
+	stripComments,
+	type Node,
+} from 'jsonc-parser'
 import { json_format } from './json-format'
 
 // Set or remove one top-level key while leaving every other byte of the document alone.
@@ -163,13 +169,14 @@ function target_value_end(property: Node | undefined): number | undefined {
 	return value_node === undefined ? undefined : value_node.offset + value_node.length
 }
 
-// Whether the span holds a comment. `strip_json_comments` blanks comments while preserving length
-// and is string-aware, so a `//` inside a string value is not counted — a scanner-based check would
-// need `SyntaxKind`, which is an ambient const enum this project cannot import.
+// Whether the span holds a comment. `stripComments` drops every comment token the scanner finds, so
+// it changes the text exactly when a comment is present, and a `//` inside a string value is not
+// counted — comparing token kinds directly would need `SyntaxKind`, an ambient const enum this
+// project cannot import.
 function contains_comment(content: string, node: Node): boolean {
 	const text = content.slice(node.offset, node.offset + node.length)
 
-	return strip_json_comments(text) !== text
+	return stripComments(text) !== text
 }
 
 // Re-lay-out a property whose trailing comma has just appeared or disappeared. That one column

package/scripts/config-merge/patch-yaml-list.ts

@@ -1,5 +1,5 @@
 import { string_array_schema } from '#scripts/lib/schemas'
-import { yaml_document } from '#scripts/yaml/yaml-document'
+import { yaml_document } from '#scripts/lib/yaml-document'
 import { dump, type DumpOptions } from 'js-yaml'
 import { list_patch, type ListEntryMatcher } from './list-patch'
 

package/scripts/cost-runtime/codex-usage.ts

@@ -1,5 +1,6 @@
 import { globSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 import { cost_transcript } from './cost-transcript'
 import type { OverMeasurement } from './cost-verdict'
@@ -23,14 +24,6 @@ const TOKEN_COUNT_SCHEMA = z.looseObject({
 
 type Environment = Readonly<Record<string, string | undefined>>
 
-function decode(line: string): unknown {
-	try {
-		return JSON.parse(line)
-	} catch {
-		return undefined
-	}
-}
-
 function same_project(cwd: string, target: string): boolean {
 	return cost_transcript.session_cwd(cwd) === cost_transcript.session_cwd(target)
 }
@@ -51,7 +44,7 @@ function measurement_from(
 	target: string,
 	thread_id: string,
 ): OverMeasurement | undefined {
-	const values = content.split('\n').map((line) => decode(line))
+	const values = content.split('\n').map((line) => json_value.parse_or_undefined(line))
 	const metadata = values.flatMap((value) => {
 		const parsed = SESSION_META_SCHEMA.safeParse(value)
 

package/scripts/cost-runtime/cost-attribute.ts

@@ -158,7 +158,6 @@ const cost_attribute = {
 	UNATTRIBUTED_KEY,
 	issue_from_branch,
 	declared_issue,
-	fill,
 	attribute,
 	group_by_issue,
 	records_for_issue,

package/scripts/cost-runtime/cost-cli.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
 import { agent_role_profile, type AgentProvider } from '#scripts/agent/agent-role-profile'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { codex_usage } from './codex-usage'
 import { CONTEXT_CUT_THRESHOLD } from './context-cut-threshold'
 import { cost_corpus } from './cost-corpus'
@@ -103,13 +103,9 @@ const PARSE_ARGS_OPTIONS = {
 } as const
 
 function parse_options(argv: ReadonlyArray<string>): Options | undefined {
-	try {
-		const { values } = parseArgs({ args: [...argv], options: PARSE_ARGS_OPTIONS, strict: true })
+	const values = cli_flags.values_of(argv, PARSE_ARGS_OPTIONS)
 
-		return to_options(values)
-	} catch {
-		return undefined
-	}
+	return values === undefined ? undefined : to_options(values)
 }
 
 // An empty corpus is reported, never priced at zero. "No transcript was found" and "this run was
@@ -305,11 +301,8 @@ const cost_cli = {
 	USAGE,
 	parse_options,
 	to_threshold,
-	load_corpus: cost_corpus.load_corpus,
-	attributed: cost_corpus.attributed,
 	run,
 	session_verdict,
-	main,
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))

package/scripts/cost-runtime/cost-corpus.ts

@@ -265,11 +265,9 @@ function mainline_records(pairs: ReadonlyArray<AttributedRecord>): Array<Array<U
 }
 
 const cost_corpus = {
-	accumulate_missing,
 	load_corpus,
 	attribute_corpus,
 	floor_for_issue,
-	dedupe_across_sessions,
 	attributed,
 	mainline_records,
 }

package/scripts/cost-runtime/cost-format.ts

@@ -21,9 +21,6 @@ function format_share(part: number, whole: number): string {
 }
 
 const cost_format = {
-	USD_DECIMALS,
-	PERCENT_SCALE,
-	PERCENT_DECIMALS,
 	format_usd,
 	format_tokens,
 	format_share,

package/scripts/cost-runtime/cost-pricing.ts

@@ -163,7 +163,6 @@ const cost_pricing = {
 	CACHE_WRITE_5M_MULTIPLIER,
 	CACHE_WRITE_1H_MULTIPLIER,
 	CACHE_READ_MULTIPLIER,
-	MODEL_PRICES,
 	resolve_price,
 	estimate_cost,
 	estimate_composition,

package/scripts/cost-runtime/cost-tokens.ts

@@ -74,7 +74,6 @@ function ascii_bytes_to_tokens(bytes: number): number {
 
 const cost_tokens = {
 	ASCII_CHARS_PER_TOKEN,
-	WIDE_TOKENS_PER_CHAR,
 	count_chars,
 	estimate,
 	ascii_bytes_to_tokens,

package/scripts/delegation/delegation-cli.ts

@@ -84,7 +84,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const delegation_cli = { USAGE, print_list, run, main }
+const delegation_cli = { print_list, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/delegation/delegation-policy.ts

@@ -181,7 +181,6 @@ const delegation_policy = {
 	REJECTED_STEPS,
 	find_step,
 	verdict_for,
-	rejection_for,
 	reason_for,
 }
 

package/scripts/delegation/duplicate-read-guard.ts

@@ -216,14 +216,6 @@ const { deny_envelope, DISABLED_VALUES } = hook_decision
 const duplicate_reads = {
 	REASON,
 	NOTICE,
-	SWITCH_ENV_KEY,
-	is_candidate,
-	is_rearmed,
-	is_redundant_reread,
-	is_refusable_call,
-	is_unchanged_reread,
-	last_read_ms,
-	read_target,
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {

package/scripts/delegation/fanout-cli.ts

@@ -54,7 +54,7 @@ function main(argv: ReadonlyArray<string>): void {
 	process.exitCode = run(argv)
 }
 
-const fanout_cli = { USAGE, parse_unit, is_refused, run, main }
+const fanout_cli = { parse_unit, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/delegation/fanout.ts

@@ -86,8 +86,6 @@ function fanout_result(units: ReadonlyArray<FanoutUnit>): FanoutResult {
 const fanout = {
 	PARALLEL_VERDICT,
 	SERIAL_VERDICT,
-	MIN_UNITS_TO_PARALLELIZE,
-	overlapping_files,
 	fanout_result,
 }