@joshuafolkken/kit 1.1050.0 → 1.1128.0

package/scripts/run/run-stranded-detect.ts

@@ -1,4 +1,4 @@
-import { telegram_notify } from '#scripts/git/telegram-notify'
+import { telegram_notify } from '#scripts/notify/telegram-notify'
 import { run_carry, type CarryRead, type RunCarry } from './run-carry'
 import { run_event_stream } from './run-event-stream'
 import { run_event_stream_emit } from './run-event-stream-emit'
@@ -128,7 +128,7 @@ async function run_stranded_check(): Promise<void> {
 	}
 }
 
-const run_stranded_detect = { DEFAULT_PORTS, detect_and_report, gather, report, run_stranded_check }
+const run_stranded_detect = { detect_and_report, run_stranded_check }
 
 export { run_stranded_detect }
 export type { DetectPorts, RecordTargets }

package/scripts/run/run-tail-cli.ts

@@ -22,7 +22,6 @@ import { run_tail, type TailSection } from './run-tail'
 // step for a line written on the default branch outside any issue's run.
 
 const ARGV_OFFSET = 2
-const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
 const USAGE = 'Usage: josh run:tail [<issue-number> ...]'
@@ -33,21 +32,27 @@ interface Step {
 	argv: (issues: ReadonlyArray<string>) => ReadonlyArray<string>
 }
 
-// The steps in the order a run closes on: any ledger line the run's own commit did not carry
-// (joshuafolkken/kit#2763) is committed first so the recurrence count is on main — on most runs the
-// flush answers `clean` — the citations are read for the completion report, and the release scope is
-// decided last.
-const FLUSH_STEP: Step = {
-	header: run_tail.OBSERVATIONS_HEADER,
-	argv: () => ['observations:flush'],
-}
+// The steps in the order a run closes on: the checkout returns to the default branch, any ledger line
+// the run's own commit did not carry (joshuafolkken/kit#2763) is committed so the recurrence count is on
+// main — on most runs the flush answers `clean` — the citations are read for the completion report, and
+// the release scope is decided last.
+//
+// **The return comes first because the flush refuses anywhere else** (joshuafolkken/kit#2979). A run
+// closes right after its merge, still on the feature branch it shipped from, and `josh ship` reaches
+// this report with nothing in between — so the flush stopped a merged run as failed. `main:sync` is the
+// step a person used to type after the fact; it fast-forwards the local default branch before the
+// checkout, so a ledger line appended after the merge is carried along rather than refused.
+const LEDGER_STEPS: ReadonlyArray<Step> = [
+	{ header: run_tail.SYNC_HEADER, argv: () => ['main:sync'] },
+	{ header: run_tail.OBSERVATIONS_HEADER, argv: () => ['observations:flush'] },
+]
 const REPORT_STEPS: ReadonlyArray<Step> = [
 	{ header: run_tail.CITATIONS_HEADER, argv: (issues) => ['issue:cite', ...issues] },
 	{ header: run_tail.RELEASE_HEADER, argv: () => ['release:scope'] },
 ]
 
 function steps_for(is_lane_child: boolean): ReadonlyArray<Step> {
-	return is_lane_child ? REPORT_STEPS : [FLUSH_STEP, ...REPORT_STEPS]
+	return is_lane_child ? REPORT_STEPS : [...LEDGER_STEPS, ...REPORT_STEPS]
 }
 
 // Numbers only — a target `issue:cite` reads as an issue, so a stray flag is refused rather than
@@ -75,6 +80,7 @@ async function close_run(issues: ReadonlyArray<string>): Promise<ReadonlyArray<T
 
 	const is_lane_child = lane_child_marker.is_child_of(process.cwd())
 
+	// eslint-disable-next-line no-await-in-loop -- the tail steps run in their declared order
 	for (const step of steps_for(is_lane_child)) sections.push(await run_step(step, issues))
 
 	return sections
@@ -100,7 +106,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 	process.exitCode = await run(argv)
 }
 
-const run_tail_cli = { SUCCESS_EXIT_CODE, USAGE, close_run, main, parse_issues, run }
+const run_tail_cli = { run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/run/run-tail.ts

@@ -9,6 +9,7 @@
 // each step's output under a header and answers the exit code from the collected codes, so a test pins
 // the composite without a ledger ever being committed or a release ever read.
 
+const SYNC_HEADER = '=== sync ==='
 const OBSERVATIONS_HEADER = '=== observations ==='
 const CITATIONS_HEADER = '=== citations ==='
 const RELEASE_HEADER = '=== release ==='
@@ -52,6 +53,7 @@ const run_tail = {
 	CITATIONS_HEADER,
 	OBSERVATIONS_HEADER,
 	RELEASE_HEADER,
+	SYNC_HEADER,
 	exit_code,
 	format_report,
 	section_body,

package/scripts/run/run-tidy-lanes.ts

@@ -1,7 +1,8 @@
 import { git_spawn } from '#scripts/git/git-spawn'
-import { git_stash } from '#scripts/git/git-stash'
+import { git_stash } from '#scripts/git/stash/git-stash'
 import { lane_close } from '#scripts/lane/lane-close'
 import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
+import { error_text } from '#scripts/lib/error-message'
 import { run_hold } from './run-hold'
 import { run_tidy, type Outcome, type Verdict } from './run-tidy'
 
@@ -31,7 +32,9 @@ async function has_unpushed(directory: string): Promise<boolean> {
 		])
 
 		return count !== '0'
-	} catch {
+	} catch (error) {
+		error_text.trace_swallowed('run_tidy_lanes.has_unpushed', error)
+
 		return true
 	}
 }
@@ -96,6 +99,7 @@ async function tidy_lanes(is_merged: IsMerged): Promise<Array<Outcome>> {
 	const lanes = await lane_registry.list_lanes()
 
 	for (const lane of lanes) {
+		// eslint-disable-next-line no-await-in-loop -- a close prunes the worktree list the next one reads
 		const outcome = await tidy_lane(lane, is_merged)
 
 		if (outcome !== undefined) outcomes.push(outcome)

package/scripts/run/run-tidy-stashes.ts

@@ -1,6 +1,6 @@
-import { git_stash, type StashEntry } from '#scripts/git/git-stash'
-import { stash_orphans } from '#scripts/git/stash-orphans'
-import { stash_sweep_lock } from '#scripts/git/stash-sweep-lock'
+import { git_stash, type StashEntry } from '#scripts/git/stash/git-stash'
+import { stash_orphans } from '#scripts/git/stash/stash-orphans'
+import { stash_sweep_lock } from '#scripts/git/stash/stash-sweep-lock'
 import { bounded_pool } from '#scripts/lib/bounded-pool'
 import { observation_ledger } from '#scripts/observations/observation-ledger'
 import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
@@ -18,20 +18,19 @@ const GONE_REASON = 'already dropped by another run'
 const BUSY_REASON = 'another run held the stash sweep lock'
 
 // An entry cut before joshuafolkken/kit#2919 holds its lines at an old single-file path, so the lines
-// of every ledger path it touches are carried to the current ledger.
+// of every ledger path it touches are carried to the current ledger. The reads are independent, and the
+// lines come back in path order however the reads finish.
 async function added_ledger_lines(
 	hash: string,
 	ledger_paths: ReadonlyArray<string>,
 ): Promise<Array<string>> {
-	const added: Array<string> = []
-
-	for (const ledger_path of ledger_paths) {
-		const lines = await git_stash.added_lines(hash, ledger_path)
-
-		added.push(...lines)
-	}
+	const added = await bounded_pool.bounded_map(
+		ledger_paths,
+		READ_CONCURRENCY,
+		async (ledger_path) => await git_stash.added_lines(hash, ledger_path),
+	)
 
-	return added
+	return added.flat()
 }
 
 // How many ledger lines went into the running work tree's ledger before the drop. The duplicate check
@@ -107,6 +106,7 @@ async function tidy_entries(
 	const outcomes: Array<Outcome> = []
 
 	for (const entry of entries) {
+		// eslint-disable-next-line no-await-in-loop -- drops shift the stash stack and append to the same ledger
 		const outcome = await tidy_entry(entry, merged)
 
 		if (outcome !== undefined) outcomes.push(outcome)

package/scripts/run/run-wake-cli.ts

@@ -3,8 +3,8 @@ import { randomUUID } from 'node:crypto'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import type { AgentProfile } from '#scripts/agent/agent-role-profile'
-import { telegram_notify } from '#scripts/git/telegram-notify'
 import { cli_flags } from '#scripts/lib/cli-flags'
+import { telegram_notify } from '#scripts/notify/telegram-notify'
 import { run_carry, type CarryRead } from './run-carry'
 import { run_event_stream } from './run-event-stream'
 import { run_headless } from './run-headless'
@@ -119,14 +119,6 @@ function note_to_stderr(note: string): void {
 	console.error(`wake: ${note}`)
 }
 
-function read_arguments(argv: ReadonlyArray<string>): ParsedValues | undefined {
-	return cli_flags.parse_or_undefined({ args: [...argv], options: OPTIONS, strict: true })?.values
-}
-
-function text_of(value: string | boolean | undefined): string | undefined {
-	return typeof value === 'string' ? value : undefined
-}
-
 function to_interval_ms(value: string | boolean | undefined): number | undefined {
 	if (typeof value !== 'string') return DEFAULT_INTERVAL_SECONDS * MS_PER_SECOND
 	if (!INTERVAL_PATTERN.test(value)) return undefined
@@ -226,7 +218,7 @@ async function warn_of_stop(stop: LoopStop, body: string, context: WakeContext):
 }
 
 // **Only a failed wake exits non-zero, and the two reasons that newly warn do not**
-// (joshuafolkken/kit#1746). The verdict-and-exit-code table in `docs/josh-commands.md` is a contract
+// (joshuafolkken/kit#1746). The verdict-and-exit-code table in `docs/josh-commands-automation.md` is a contract
 // callers branch on; what `expired` and `unreadable` were missing is the notification, not a different
 // exit code, and changing both at once would break a caller to fix a silence.
 function exit_code_of(reason: WakeStopReason): number {
@@ -379,14 +371,14 @@ async function dispatch(
 	interval_ms: number,
 ): Promise<number> {
 	if (values.loop === true) return await loop(context, interval_ms)
-	if (values.start === true) return start(context, text_of(values.interval))
+	if (values.start === true) return start(context, cli_flags.string_of(values.interval))
 	if (values.stop === true) return stop_supervisor(context)
 
 	return list(context)
 }
 
 async function run(argv: ReadonlyArray<string>): Promise<number> {
-	const values = read_arguments(argv)
+	const values = cli_flags.values_of(argv, OPTIONS)
 
 	if (values === undefined || group_count(values) !== ONE_GROUP) return usage()
 
@@ -410,7 +402,6 @@ const run_wake_cli = {
 	NONE_VERDICT,
 	RUNNING_VERDICT,
 	STALE_VERDICT,
-	STARTED_VERDICT,
 	STOPPED_VERDICT,
 	SUPERVISING_VERDICT,
 	UNKNOWN_VERDICT,

package/scripts/run/run-wake-loop.ts

@@ -199,10 +199,12 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 	let wake = run_wake.read_own_wake(target)
 
 	while (wake !== undefined) {
+		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
 		const stop = await run_pass(target, wake, ports)
 
 		if (stop !== undefined) return stop
 
+		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
 		await ports.sleep(next_interval(run_wake.read_own_wake(target), interval_ms, ports.now()))
 		wake = run_wake.read_own_wake(target)
 	}
@@ -213,10 +215,8 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 const run_wake_loop = {
 	FAILED_REASON,
 	MAX_BACKOFF_FACTOR,
-	STOPPED_REASON,
 	next_interval,
 	run_loop,
-	step,
 }
 
 export type { DriveResult, LoopPorts, LoopStop }

package/scripts/run/run-wake.ts

@@ -1,6 +1,7 @@
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 import { backlog_budget } from '#scripts/backlog/backlog-budget'
 import { process_identity } from '#scripts/josh/process-identity'
+import { process_owner_schema } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { z } from 'zod'
 import type { CarryRead } from './run-carry'
@@ -209,11 +210,9 @@ const STOP_REASONS: Record<'none' | 'expired' | 'unreadable', WakeStopReason> =
 	unreadable: 'unreadable',
 }
 
-const run_wake_schema = z.object({
+const run_wake_schema = process_owner_schema.extend({
 	invocation: z.string(),
 	started_at: z.string(),
-	pid: z.number(),
-	process_start: z.string().optional(),
 	woke: z.number(),
 	woke_at: z.string().optional(),
 	// **Every optional field of `RunWake` has to be listed here.** `z.object` strips what it does not
@@ -583,7 +582,6 @@ const run_wake = {
 	IDLE_CEILING_MS,
 	MAX_WAKE_ATTEMPTS,
 	WAKE_GRACE_MS,
-	WAKE_PREFIX,
 	claim,
 	count_claim,
 	count_wake,

package/scripts/run/run-watcher-guard-cli.ts

@@ -30,8 +30,4 @@ async function main(): Promise<void> {
 	process.exitCode = await run()
 }
 
-const run_watcher_guard_cli = { run }
-
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { run_watcher_guard_cli }

package/scripts/run/run-watcher-guard.ts

@@ -1,13 +1,16 @@
 import { lane_registry } from '#scripts/lane/lane-registry'
+import { run_headless } from './run-headless'
 import { run_progress_clock } from './run-progress-clock'
 
-// A watcher that stopped while children are still in-flight leaves the parent blind to completions
-// for up to the full heartbeat interval. This guard detects that state so a hook can refuse the
-// calls that follow a missed restart (joshuafolkken/kit#2113).
+// A watcher that stopped while children are still in-flight leaves the run's event stream without a
+// heartbeat and the parent without the wake an arrival would deliver. This guard detects that state so
+// a hook can refuse the calls that follow a missed restart (joshuafolkken/kit#2113).
 //
 // **Staleness threshold is `TICK_MULTIPLIER` watcher ticks.** The watcher pings its life record on
 // every tick (every 30 s), so a gap wider than three ticks means the process has almost certainly
-// stopped: either the bound expired or the session was cut without a restart. Three gives one missed
+// stopped: it exited on an arrival, its bound expired, or the session was cut without a restart. A
+// report is no longer one of those (joshuafolkken/kit#3102) — `--wait` streams its reports and keeps
+// running — so a restart is owed only after an exit the parent was woken for. Three gives one missed
 // tick of slack before the guard fires.
 //
 // **It watches no relay** (joshuafolkken/kit#2492). A session following the run's event stream after a
@@ -23,25 +26,29 @@ const STALE_THRESHOLD_S = STALE_THRESHOLD_MS / MS_PER_SECOND
 
 const STALE_NOTE =
 	`Lane children are in-flight but the progress watcher has not pinged in the last ` +
-	`${String(STALE_THRESHOLD_S)}s — run \`pnpm josh run:progress --wait\` in the background before proceeding`
+	`${String(STALE_THRESHOLD_S)}s — run \`pnpm josh run:progress --wait\` in the background before proceeding. ` +
+	'It reports to the run event stream on its own and exits only when newly runnable work arrives, so ' +
+	'start it once and relay nothing'
 
 type GuardResult = { kind: 'ok' } | { kind: 'stale'; note: string }
 
 const OK_RESULT: GuardResult = { kind: 'ok' }
 
-// The lanes a parent is still waiting on. A stranded lane has no child working in it, so it is not
-// in-flight — the one definition both this guard and the headless stop rule read (`run-headless.ts`).
-async function has_lanes_in_flight(): Promise<boolean> {
-	const all_lanes = await lane_registry.list_lanes()
+// **Only the run that opened the lanes owes them a watcher** (joshuafolkken/kit#2965). The lane listing
+// is machine-wide, so a session with no run of its own — an investigation, a `fullrun` beside a batch —
+// used to be refused for another run's lanes. The session that drives the live `backlogrun` carry
+// record is the one that dispatched them; every other session passes.
+async function owes_watcher(): Promise<boolean> {
+	if (!(await run_headless.is_backlog_parent())) return false
 
-	return all_lanes.some((lane) => !lane.is_stranded)
+	return await lane_registry.has_lanes_in_flight()
 }
 
 // `life_target` is the path returned by `run_progress_read.stamp_target()` or
 // `run_progress_clock.life_target_of(git_directory)`. Passed in rather than resolved here so the
 // caller can use whichever resolution fits its sync/async context.
 async function check(life_target: string): Promise<GuardResult> {
-	if (!(await has_lanes_in_flight())) return OK_RESULT
+	if (!(await owes_watcher())) return OK_RESULT
 
 	if (run_progress_clock.is_life_fresh(life_target, STALE_THRESHOLD_MS)) return OK_RESULT
 
@@ -52,7 +59,6 @@ const run_watcher_guard = {
 	STALE_NOTE,
 	STALE_THRESHOLD_MS,
 	check,
-	has_lanes_in_flight,
 }
 
 export type { GuardResult }

package/scripts/run/run-watcher-hook.ts

@@ -81,6 +81,6 @@ async function watcher_hook_reason(
 	return await stale_reason(transcript, now_ms)
 }
 
-const run_watcher_hook = { SWITCH_ENV_KEY, STAMP_PREFIX, transcript_of, watcher_hook_reason }
+const run_watcher_hook = { transcript_of, watcher_hook_reason }
 
 export { run_watcher_hook }

package/scripts/safe-chain/ci-installer-pin.ts

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { composite_actions } from '#scripts/ci/composite-actions'
 import { execaSync } from 'execa'
 
 // Where the workflows that install safe-chain on the runner live. Each carries the release and the
@@ -25,13 +26,18 @@ function installer_url(version: string): string {
 	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
 }
 
+// The local composite actions follow the workflows: kit's own pin lives in
+// `.github/actions/setup-pnpm`, which every kit workflow installs through (joshuafolkken/kit#2982).
 function list_workflows(): Array<string> {
-	return WORKFLOW_DIRECTORIES.filter((directory) => existsSync(directory)).flatMap((directory) =>
-		readdirSync(directory)
-			.filter((file_name) => WORKFLOW_FILE_RE.test(file_name))
-			.toSorted((left, right) => left.localeCompare(right))
-			.map((file_name) => `${directory}/${file_name}`),
+	const workflows = WORKFLOW_DIRECTORIES.filter((directory) => existsSync(directory)).flatMap(
+		(directory) =>
+			readdirSync(directory)
+				.filter((file_name) => WORKFLOW_FILE_RE.test(file_name))
+				.toSorted((left, right) => left.localeCompare(right))
+				.map((file_name) => `${directory}/${file_name}`),
 	)
+
+	return [...workflows, ...composite_actions.list()]
 }
 
 function extract_pinned_version(content: string): string | undefined {

package/scripts/safe-chain/pack-hook.ts

@@ -0,0 +1,92 @@
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import path from 'node:path'
+import { file_reader } from '#scripts/lib/read-file'
+import { file_content } from '#scripts/sync/file-content'
+import { z } from 'zod'
+
+// kit writes the Safe Chain `preinstall` into every project it sets up, and a package that publishes
+// would ship it: the consumer's pnpm then refuses it as an unapproved build script and `pnpm add`
+// exits 1 (joshuafolkken/kit#3110). kit's own `.pnpmfile.mjs` strips it at pack time
+// (joshuafolkken/kit#2693), so that one file is what a publishing project receives — never a copy of
+// its logic.
+//
+// A private package is left alone: it never packs, and a new pnpmfile changes the lockfile's
+// `pnpmfileChecksum`, which fails a frozen install until the lockfile is refreshed.
+const PACK_HOOK_FILE = '.pnpmfile.mjs'
+const MANAGED_LINE = '// josh-managed-pnpmfile: @joshuafolkken/kit'
+const MANIFEST_FILE = 'package.json'
+// pnpm loads `.pnpmfile.mjs` in preference to `.pnpmfile.cjs`, and neither once a `pnpmfile` setting
+// names another file — so writing ours beside either would silently drop the project's hooks, or
+// report a hook pnpm never runs.
+const LEGACY_HOOK_FILE = '.pnpmfile.cjs'
+const CONFIG_FILES: ReadonlyArray<string> = ['pnpm-workspace.yaml', '.npmrc']
+const PNPMFILE_SETTINGS: ReadonlySet<string> = new Set(['pnpmfile', 'pnpmfiles'])
+const SETTING_KEY_END = /[\s:=]/u
+const manifest_schema = z.looseObject({ private: z.boolean().optional() })
+
+type PackHookResult = 'written' | 'unchanged' | 'private' | 'owned' | 'withdrawn'
+
+function is_published(manifest_text: string): boolean {
+	return manifest_schema.parse(JSON.parse(manifest_text)).private !== true
+}
+
+function sets_pnpmfile(config_text: string): boolean {
+	return config_text
+		.split('\n')
+		.some((line) => PNPMFILE_SETTINGS.has(line.trimStart().split(SETTING_KEY_END, 1)[0] ?? ''))
+}
+
+function has_own_hook_source(project_root: string): boolean {
+	if (existsSync(path.join(project_root, LEGACY_HOOK_FILE))) return true
+
+	return CONFIG_FILES.some((name) =>
+		sets_pnpmfile(file_reader.read_file_or_empty(path.join(project_root, name))),
+	)
+}
+
+function write_hook(destination: string, package_directory: string): PackHookResult {
+	const source = readFileSync(path.join(package_directory, PACK_HOOK_FILE), 'utf8')
+
+	return file_content.write_text_if_changed(destination, source) ? 'written' : 'unchanged'
+}
+
+// A copy kit wrote before the project added its own pnpmfile would still shadow that one.
+function withdraw(destination: string, existing: string | undefined): PackHookResult {
+	if (existing === undefined) return 'owned'
+	rmSync(destination)
+
+	return 'withdrawn'
+}
+
+// A pnpmfile without the managed line is the project's own; overwriting it would drop its hooks.
+function apply(project_root: string, package_directory: string): PackHookResult {
+	const destination = path.join(project_root, PACK_HOOK_FILE)
+	const existing = file_reader.read_optional(destination)
+	if (existing !== undefined && !existing.startsWith(MANAGED_LINE)) return 'owned'
+	if (has_own_hook_source(project_root)) return withdraw(destination, existing)
+
+	return write_hook(destination, package_directory)
+}
+
+const MESSAGES: Readonly<Record<PackHookResult, string | undefined>> = {
+	written: `  ✔ synced    ${PACK_HOOK_FILE} (run \`pnpm install\` to refresh pnpmfileChecksum)`,
+	unchanged: `  ✔ unchanged ${PACK_HOOK_FILE}`,
+	private: undefined,
+	owned: `  ⚠ skipped   ${PACK_HOOK_FILE} — the project has its own pnpmfile; strip the safe-chain preinstall at pack time there`,
+	withdrawn: `  ⚠ removed   ${PACK_HOOK_FILE} — it shadowed the project's own pnpmfile; strip the safe-chain preinstall at pack time there`,
+}
+
+function sync_pack_hook(project_root: string, package_directory: string): PackHookResult {
+	const manifest_text = file_reader.read_optional(path.join(project_root, MANIFEST_FILE))
+	const is_private = manifest_text === undefined || !is_published(manifest_text)
+	const result = is_private ? 'private' : apply(project_root, package_directory)
+	const message = MESSAGES[result]
+	if (message !== undefined) console.info(message)
+
+	return result
+}
+
+const pack_hook = { MANAGED_LINE, sync_pack_hook }
+
+export { pack_hook, PACK_HOOK_FILE }
+export type { PackHookResult }

package/scripts/safe-chain/project-config.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { file_reader } from '#scripts/lib/read-file'
+import { yaml_document } from '#scripts/lib/yaml-document'
 import { release_age } from '#scripts/version/release-age'
-import { yaml_document } from '#scripts/yaml/yaml-document'
 import { dump } from 'js-yaml'
 import { z } from 'zod'
 

package/scripts/security/security-audit-provision-logic.ts

@@ -191,7 +191,6 @@ function format_below_floor(version: string): string {
 }
 
 const security_audit_provision_logic = {
-	FORCED_DOWNLOAD_TIMEOUT_MS,
 	RETRY_INTERVAL_MS,
 	SESSION_DOWNLOAD_TIMEOUT_MS,
 	SCANNER_VERSION,

package/scripts/security/security-audit-provision.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { error_text } from '#scripts/lib/error-message'
+import { timed_fetch } from '#scripts/lib/timed-fetch'
 import { security_audit } from './security-audit'
 import { security_audit_logic } from './security-audit-logic'
 import { security_audit_provision_logic, type ScannerAsset } from './security-audit-provision-logic'
@@ -33,7 +34,7 @@ interface ProvisionOutcome {
 // catch-all would drop the release URL out of the message that names where the fetch went.
 async function download(url: string, timeout_ms: number): Promise<DownloadOutcome> {
 	try {
-		const response = await fetch(url, { signal: AbortSignal.timeout(timeout_ms) })
+		const response = await timed_fetch(url, {}, timeout_ms)
 		if (!response.ok) return { reason: `HTTP ${String(response.status)}` }
 
 		return { content: Buffer.from(await response.arrayBuffer()), reason: '' }
@@ -180,6 +181,6 @@ async function main(): Promise<void> {
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
 
-const security_audit_provision = { attempt, download, install, main, provision, report }
+const security_audit_provision = { attempt, provision, report }
 
 export { security_audit_provision }

package/scripts/security/security-audit.ts

@@ -137,7 +137,6 @@ const security_audit = {
 	meets_floor,
 	resolve_scanner,
 	run_scanner,
-	scanner_version,
 }
 
 export { security_audit }

package/scripts/security/security-updates-logic.ts

@@ -120,7 +120,6 @@ function format_security_updates_report(
 }
 
 const security_updates_logic = {
-	SETTING_LABEL,
 	enable_command,
 	classify_security_updates,
 	is_exposed,