@joshuafolkken/kit 1.1094.0 → 1.1128.0

package/scripts/init/init.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env tsx
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { resolve_local_bin } from '#scripts/build/local-bin'
@@ -7,6 +7,7 @@ import { doctor_io } from '#scripts/doctor/doctor-io'
 import { error_text } from '#scripts/lib/error-message'
 import { package_version_schema, with_package_manager_schema } from '#scripts/lib/schemas'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { pack_hook } from '#scripts/safe-chain/pack-hook'
 import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { did_refuse_self_run } from '#scripts/self-sync-guard/self-sync-refusal'
@@ -14,10 +15,11 @@ import { sync } from '#scripts/sync/sync'
 import { package_manager_version } from '#scripts/version/package-manager-version'
 import { execaSync } from 'execa'
 import { z } from 'zod'
-import { init_actions, PRETTIER_CONFIG_JS, type FileAction } from './init-actions'
+import { init_actions, PRETTIER_CONFIG_JS } from './init-actions'
 import { init_ai_copy } from './init-ai-copy'
 import { init_basic } from './init-basic'
 import { init_bootstrap } from './init-bootstrap'
+import { init_file_action } from './init-file-action'
 import { init_install } from './init-install'
 import { init_logic } from './init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from './init-paths'
@@ -27,69 +29,10 @@ import { project_profile, type ProjectProfile, type ProjectShape } from './proje
 const PACKAGE_JSON = 'package.json'
 const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
 const LEFTHOOK_BIN = 'lefthook'
-const SAMPLE_INDENT_WIDTH = 4
 const ARGUMENT_START_INDEX = 2
-const SAMPLE_INDENT = ' '.repeat(SAMPLE_INDENT_WIDTH)
 const INSTALL_HINT = '→ run `pnpm install` to install what package.json lists'
 const INIT_USAGE = 'josh init [--profile basic|full] [--no-install]'
 
-function write_new_file(action: FileAction, destination_path: string): void {
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, action.create())
-	console.info(`  ✔ created   ${action.dest}`)
-}
-
-function show_sample(action: FileAction): void {
-	console.info(`  ⚠ exists    ${action.dest} — add manually:`)
-	console.info('')
-	console.info(action.create().replaceAll(/^/gmu, () => SAMPLE_INDENT))
-}
-
-// A file that already holds the sample needs nothing added, so only one that differs gets it shown.
-function report_unchanged(action: FileAction, existing: string): void {
-	const is_sample_missing = existing !== action.create()
-
-	if (is_sample_missing && action.should_show_sample_when_unchanged === true) show_sample(action)
-	else console.info(`  ✔ unchanged ${action.dest}`)
-}
-
-function merge_existing_file(
-	merge_function: (existing: string) => string,
-	destination_path: string,
-	action: FileAction,
-): void {
-	const existing = readFileSync(destination_path, 'utf8')
-	const merged = merge_function(existing)
-
-	if (merged === existing) {
-		report_unchanged(action, existing)
-
-		return
-	}
-
-	writeFileSync(destination_path, merged)
-	console.info(`  ✔ updated   ${action.dest}`)
-}
-
-function execute_file_action(action: FileAction): void {
-	const destination_path = path.join(PROJECT_ROOT, action.dest)
-	const is_existing = existsSync(destination_path)
-
-	if (!is_existing) {
-		write_new_file(action, destination_path)
-
-		return
-	}
-
-	if (action.merge === undefined) {
-		show_sample(action)
-
-		return
-	}
-
-	merge_existing_file(action.merge, destination_path, action)
-}
-
 const engine_pin_schema = z.looseObject({ name: z.string(), version: z.string() })
 
 const published_development_engines_schema = z.looseObject({
@@ -124,10 +67,10 @@ function get_kit_self_dependency(): Record<string, string> {
 }
 
 // Each config `init` generates runs a CLI or imports types the consumer has to resolve itself:
-// `prettier.config.js` → prettier, `cspell.config.yaml` → cspell, `playwright.config.ts` →
-// @types/node (with @playwright/test among the peers), `lefthook.yml` → lefthook. Without them the
-// first `josh gate` after `pnpm install` fails (joshuafolkken/kit#2710).
-const TOOL_DEVELOPMENT_DEPENDENCIES = ['prettier', 'cspell', '@types/node']
+// `cspell.config.yaml` → cspell, `playwright.config.ts` → @types/node, `lefthook.yml` → lefthook.
+// Prettier, its preset plugins and @playwright/test come in as peers. Without them the first
+// `josh gate` after `pnpm install` fails (joshuafolkken/kit#2710).
+const TOOL_DEVELOPMENT_DEPENDENCIES = ['cspell', '@types/node']
 const LEFTHOOK_DEVELOPMENT_DEPENDENCY = 'lefthook'
 
 function tool_dependency_names(has_git: boolean): ReadonlyArray<string> {
@@ -164,9 +107,8 @@ function apply_dependency_merges(content: string, has_git = true): string {
 			? suggested
 			: Object.fromEntries(Object.entries(suggested).filter(([key]) => key !== 'prepare')),
 	)
-	const with_prettier = init_logic.merge_prettier_plugin_development_deps(merged)
 	const with_toolchain = init_logic.merge_development_dependencies(
-		with_prettier,
+		merged,
 		get_toolchain_development_dependencies(has_git),
 	)
 	const with_secretlint = init_logic.merge_secretlint_development_deps(with_toolchain)
@@ -262,7 +204,7 @@ function run_config_file_actions(shape: ProjectShape): void {
 	}
 
 	for (const action of init_actions.build_file_actions(shape)) {
-		execute_file_action(action)
+		init_file_action.execute_file_action(action, PROJECT_ROOT)
 	}
 }
 
@@ -305,6 +247,7 @@ function initialize_project(shape: ProjectShape): void {
 	merge_project_package_json(shape)
 
 	run_ai_file_actions(shape)
+	pack_hook.sync_pack_hook(PROJECT_ROOT, PACKAGE_DIR)
 	if (shape.profile === 'full') project_config.sync_project_config(PROJECT_ROOT)
 }
 

package/scripts/init/kit-written-paths.ts

@@ -1,3 +1,4 @@
+import { PACK_HOOK_FILE } from '#scripts/safe-chain/pack-hook'
 import { PROJECT_CONFIG_FILE } from '#scripts/safe-chain/project-config'
 import { managed_config_scope } from '#scripts/sync/managed-config-scope'
 import { BASIC_PRETTIER_CONFIG } from './init-actions'
@@ -13,6 +14,7 @@ const SETUP_ONLY_PATHS: ReadonlySet<string> = new Set([
 	CLAUDE_MD_FILENAME,
 	BASIC_PRETTIER_CONFIG,
 	PROJECT_CONFIG_FILE,
+	PACK_HOOK_FILE,
 	MANIFEST_FILE,
 	LOCKFILE,
 ])

package/scripts/init/project-profile.ts

@@ -1,9 +1,9 @@
 import { existsSync, readdirSync, readFileSync, type Dirent } from 'node:fs'
 import path from 'node:path'
 import { repo_origin } from '#scripts/discovery/repo-origin'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { json_value } from '#scripts/lib/json-value'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
-import { execaSync } from 'execa'
 
 type ProjectProfile = 'basic' | 'full'
 
@@ -159,12 +159,9 @@ function scan_files(root: string): { has_web: boolean; has_typescript: boolean }
 }
 
 function has_github_remote(root: string): boolean {
-	const result = execaSync('git', ['config', '--get', 'remote.origin.url'], {
-		cwd: root,
-		reject: false,
-	})
+	const url = git_spawn_sync.origin_url(root)
 
-	return result.exitCode === 0 && repo_origin.parse_origin_url(result.stdout) !== undefined
+	return url !== undefined && repo_origin.parse_origin_url(url) !== undefined
 }
 
 function inspect_project(root: string, requested?: ProjectProfile): ProjectShape {

package/scripts/init/start-steps.ts

@@ -1,4 +1,5 @@
 import path from 'node:path'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { error_text } from '#scripts/lib/error-message'
 import { repository_labels } from '#scripts/repo/repository-labels'
 import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
@@ -44,7 +45,7 @@ function read_git_state(root: string, shape: ProjectShape): GitState {
 		}
 	}
 
-	const has_origin = succeeds('git', ['remote', 'get-url', 'origin'], root)
+	const has_origin = git_spawn_sync.origin_url(root) !== undefined
 	const branch = read_output('git', ['symbolic-ref', '--short', 'HEAD'], root)
 	const has_commits = succeeds('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], root)
 	const has_kit_committed = kit_setup_state.is_kit_committed(root)

package/scripts/issue/defect-rate-cli.ts

@@ -1,16 +1,24 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { git_gh_exec } from '#scripts/gh/git-gh-exec'
-import { parse_json_array_or_undefined } from '#scripts/git/parse-json-array'
+import { parse_json } from '#scripts/git/parse-json-array'
 import { issue_label_schema } from '#scripts/git/schemas'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { z } from 'zod'
 import { defect_rate, type DefectRate, type RateIssue } from './defect-rate'
 
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const PER_PAGE = '100'
+const FIRST_PAGE = 1
+const SECOND_PAGE = 2
+// The search API serves at most this many results, so a window past it holds no further page.
+const SEARCH_RESULT_CEILING = 1000
+// The search API allows 30 requests a minute; both searches together stay at the ~10 requests the
+// sequential walk made, so this bounds only how many are in flight at once.
+const PAGE_CONCURRENCY = 4
 const USAGE = 'Usage: pnpm josh defect:rate [--days <n>]'
 const UNKNOWN_REPO_MESSAGE =
 	'Could not read this repository from `git remote`, so no issue can be searched — check `gh auth status` and that this is a checkout with an `origin` remote.'
@@ -33,7 +41,7 @@ const search_item_schema = z.object({
 	labels: z.array(issue_label_schema),
 })
 
-// One page of `search/issues`. `--paginate --slurp` hands back every page as one array.
+// One page of `search/issues`.
 const search_page_schema = z.object({
 	total_count: z.number(),
 	incomplete_results: z.boolean(),
@@ -48,22 +56,60 @@ interface SearchResult {
 }
 
 function read_days(argv: ReadonlyArray<string>): number | undefined {
-	try {
-		const { values } = parseArgs({ args: [...argv], options: OPTIONS, strict: true })
-		const raw = values.days ?? String(defect_rate.DEFAULT_WINDOW_DAYS)
+	const values = cli_flags.values_of(argv, OPTIONS)
 
-		if (!DAYS_PATTERN.test(raw)) return undefined
+	if (values === undefined) return undefined
 
-		const days = Number(raw)
+	const raw = values.days ?? String(defect_rate.DEFAULT_WINDOW_DAYS)
 
-		return days <= MAX_WINDOW_DAYS ? days : undefined
-	} catch {
-		return undefined
-	}
+	if (!DAYS_PATTERN.test(raw)) return undefined
+
+	const days = Number(raw)
+
+	return days <= MAX_WINDOW_DAYS ? days : undefined
+}
+
+function search_path(query: string, page: number = FIRST_PAGE): string {
+	const parameters = new URLSearchParams({ q: query, per_page: PER_PAGE })
+
+	if (page !== FIRST_PAGE) parameters.set('page', String(page))
+
+	return `search/issues?${parameters.toString()}`
 }
 
-function search_path(query: string): string {
-	return `search/issues?${new URLSearchParams({ q: query, per_page: PER_PAGE }).toString()}`
+// How many pages the search holds, read off the first page's own count. Bounded by the API's
+// ceiling, past which GitHub serves no page at all — so this asks for exactly the pages `gh api
+// --paginate` used to walk to.
+function page_count(first: SearchPage): number {
+	return Math.ceil(Math.min(first.total_count, SEARCH_RESULT_CEILING) / Number(PER_PAGE))
+}
+
+async function read_page(query: string, page: number): Promise<SearchPage | undefined> {
+	const raw = await git_gh_exec.exec_gh_api({ path: search_path(query, page) })
+
+	return parse_json.parse_json_object_safe(raw, search_page_schema)
+}
+
+// Every page of one search. joshuafolkken/kit#3103: `--paginate` follows each page's `next` link, so
+// a two-week window of ~5 pages cost ~1.5 s a page, one after another, on every `backlog:plan`. The
+// first page names the total, so the rest are fetched together; any page that does not read fails
+// the whole search, as a failed `--paginate` did.
+async function read_pages(query: string): Promise<ReadonlyArray<SearchPage> | undefined> {
+	const first = await read_page(query, FIRST_PAGE)
+
+	if (first === undefined) return undefined
+
+	const rest_numbers = Array.from(
+		{ length: Math.max(page_count(first) - FIRST_PAGE, 0) },
+		(_value, index) => index + SECOND_PAGE,
+	)
+	const rest = await bounded_pool.bounded_map(
+		rest_numbers,
+		PAGE_CONCURRENCY,
+		async (page) => await read_page(query, page),
+	)
+
+	return rest.every((page) => page !== undefined) ? [first, ...rest] : undefined
 }
 
 function to_result(pages: ReadonlyArray<SearchPage>): SearchResult {
@@ -83,12 +129,7 @@ function to_result(pages: ReadonlyArray<SearchPage>): SearchResult {
 
 async function search(query: string): Promise<SearchResult | undefined> {
 	try {
-		const raw = await git_gh_exec.exec_gh_api({
-			path: search_path(query),
-			should_paginate: true,
-			should_slurp: true,
-		})
-		const pages = parse_json_array_or_undefined(raw, search_page_schema)
+		const pages = await read_pages(query)
 
 		return pages === undefined ? undefined : to_result(pages)
 	} catch {

package/scripts/issue/issue-backlinks.ts

@@ -4,12 +4,13 @@
 // undetected. This classifies an origin issue's filed backlinks into one of four fixed words
 // (joshuafolkken/kit#2123). The headings are the single source's, pinned by the document test.
 
+import { markdown_section } from './markdown-section'
+
 const ORIGIN_HEADING = '## Origin'
 const UPSTREAM_ISSUES_HEADING = '## Upstream issues'
 const UPSTREAM_CANDIDATE_HEADING = '## Upstream candidate'
 const CHECKBOX_PATTERN = /^\s*-\s*\[[ xX]\]/u
 const WRONG_UPSTREAM_HEADING_PATTERN = /^##\s+Upstream\b/iu
-const SUBHEADING_PATTERN = /^##\s/u
 const BARE_REFERENCE_PATTERN = /^#\d+$/u
 const DIGITS_PATTERN = /^\d+$/u
 const REFERENCE_MARK = '#'
@@ -27,31 +28,23 @@ interface UpstreamEntry {
 	body: string
 }
 
-function trimmed_lines(body: string): ReadonlyArray<string> {
-	return body.split('\n').map((line) => line.trimEnd())
-}
-
+// A heading inside a code fence is example text, so neither lookup counts one (joshuafolkken/kit#3066).
 function has_heading(body: string, heading: string): boolean {
-	return trimmed_lines(body).some((line) => line.trim() === heading)
+	return markdown_section.has_line(body, heading)
 }
 
 // The lines under `heading`, up to the next `##` heading; `undefined` when the heading is absent.
 function section_lines(body: string, heading: string): ReadonlyArray<string> | undefined {
-	const lines = trimmed_lines(body)
-	const start = lines.findIndex((line) => line.trim() === heading)
-	if (start === -1) return undefined
-
-	const rest = lines.slice(start + 1)
-	const end = rest.findIndex((line) => SUBHEADING_PATTERN.test(line.trim()))
+	if (!has_heading(body, heading)) return undefined
 
-	return end === -1 ? rest : rest.slice(0, end)
+	return markdown_section.section_lines(body, heading)
 }
 
 // A heading that looks like the upstream one but is not exactly it (`## Upstream`, `## Upstreams`,
 // wrong case) — the grep the template promises would miss it, so it is a wrong-heading rather than a
 // missing one. `## Upstream candidate` is a legitimate separate heading and is excluded.
 function has_wrong_upstream_heading(body: string): boolean {
-	return trimmed_lines(body).some((line) => {
+	return markdown_section.unfenced_lines(body).some((line) => {
 		const heading = line.trim()
 		if (heading === UPSTREAM_ISSUES_HEADING || heading === UPSTREAM_CANDIDATE_HEADING) return false
 

package/scripts/issue/issue-cite.ts

@@ -46,14 +46,19 @@ function citation_line(slug: string, number: string, summary: string): string {
 // and the plain `#N` only when the repository could not be read at all.
 type IssueCiter = (number: string) => string
 
+// One issue, named from what the caller holds — the single decision every listing's citation goes
+// through (joshuafolkken/kit#3099), so a renderer holding one title never re-derives the fallback.
+function reference(slug: string | undefined, number: string, title: string | undefined): string {
+	if (slug === undefined) return `#${number}`
+
+	return title === undefined
+		? `[#${number}](${issue_url(slug, number)})`
+		: citation_line(slug, number, title)
+}
+
 function citer(slug: string | undefined, titles: ReadonlyMap<string, string>): IssueCiter {
 	return function cite(number: string): string {
-		if (slug === undefined) return `#${number}`
-		const title = titles.get(number)
-
-		return title === undefined
-			? `[#${number}](${issue_url(slug, number)})`
-			: citation_line(slug, number, title)
+		return reference(slug, number, titles.get(number))
 	}
 }
 
@@ -111,6 +116,7 @@ const issue_cite = {
 	missing_line,
 	no_repo_line,
 	parse_target,
+	reference,
 	unreadable_line,
 }
 

package/scripts/issue/issue-file.ts

@@ -1,6 +1,7 @@
-import { parseArgs } from 'node:util'
+import type { parseArgs } from 'node:util'
 import { epic_issue } from '#scripts/epic/epic-issue'
 import { github_issue_url } from '#scripts/gh/github-issue-url'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { issue_backlinks } from './issue-backlinks'
 import { issue_classification } from './issue-classification'
 import { DEPTH_LABEL_ORDER, FILING_ROUTE_LABELS, has_label_name } from './issue-labels'
@@ -103,19 +104,11 @@ function arguments_of(values: ParsedValues, title: string | undefined): FileArgu
 	return { title, body_file, ...labelled, labels: values.label ?? [], repo: values.repo }
 }
 
-// An unknown flag makes `parseArgs` throw; caught so the answer is the usage line, not a stack trace.
+// An unknown flag is `undefined` rather than a throw, so the answer is the usage line, not a stack trace.
 function parse(argv: ReadonlyArray<string>): FileArguments | undefined {
-	try {
-		const { values, positionals } = parseArgs({
-			args: [...argv],
-			options: OPTIONS,
-			allowPositionals: true,
-		})
+	const parsed = cli_flags.arguments_of(argv, OPTIONS)
 
-		return arguments_of(values, positionals[0])
-	} catch {
-		return undefined
-	}
+	return parsed === undefined ? undefined : arguments_of(parsed.values, parsed.positionals[0])
 }
 
 // A classification label is the body's to declare, so an extra `--label` naming one the body does not

package/scripts/issue/markdown-section.ts

@@ -52,13 +52,16 @@ function has_line(body: string, text: string): boolean {
 	return has_unfenced_line(body, text)
 }
 
-// The lines between `heading` and the next `## ` heading, trimmed of the heading line itself; an empty
-// array when the heading is absent. A heading matched inside a sentence is not the section heading, so
-// only a line that is exactly the heading opens the section.
-function section_lines(body: string, heading: string): ReadonlyArray<string> {
+// The lines between the first unfenced line `is_target` accepts and the next unfenced `## ` heading,
+// trimmed of the heading line itself; an empty array when no line is accepted. A `## ` line inside a
+// code fence is example text, so it neither opens nor closes a section (joshuafolkken/kit#3066).
+function section_lines_matching(
+	body: string,
+	is_target: (line: string) => boolean,
+): ReadonlyArray<string> {
 	const lines = body.split('\n')
 	const visible = unfenced_lines(body)
-	const start = visible.findIndex((line) => is_the_heading(line, heading))
+	const start = visible.findIndex((line) => is_target(line))
 
 	if (start === -1) return []
 
@@ -68,6 +71,18 @@ function section_lines(body: string, heading: string): ReadonlyArray<string> {
 	return end === -1 ? rest : rest.slice(0, end)
 }
 
-const markdown_section = { section_lines, has_line, has_unfenced_line }
+// A heading matched inside a sentence is not the section heading, so only a line that is exactly the
+// heading opens the section.
+function section_lines(body: string, heading: string): ReadonlyArray<string> {
+	return section_lines_matching(body, (line) => is_the_heading(line, heading))
+}
+
+const markdown_section = {
+	section_lines,
+	section_lines_matching,
+	unfenced_lines,
+	has_line,
+	has_unfenced_line,
+}
 
 export { markdown_section }

package/scripts/issue/measure-rerun-cli.ts

@@ -1,26 +1,52 @@
 #!/usr/bin/env tsx
 import { execSync } from 'node:child_process'
-import { readFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
+import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { parse_json_object_safe } from '#scripts/git/parse-json-array'
 import { error_text } from '#scripts/lib/error-message'
 import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
+import { z } from 'zod'
 import { baseline_measure, type Baseline } from './baseline-measure'
 
-// `josh measure:rerun <path>` — read a behavior-change Issue body after merge, re-run each baseline
+// `josh measure:rerun <N>` — read a behavior-change Issue body after merge, re-run each baseline
 // command, and print the before/after pair (joshuafolkken/kit#2212). A value that did not move means
 // the premise the rule rested on is refuted, so a line is appended to the observation ledger — reusing
 // that append-only, same-key mechanism rather than a second one.
+//
+// **The baseline is shell, and the body is written by whoever filed the Issue** (joshuafolkken/kit#3064).
+// A baseline needs pipes and loops (`git log … | wc -l`, `for d in $(ls …)`), so an allow-list of
+// commands cannot make it safe; what can is who wrote it. The input is therefore the Issue number, not
+// a file, so the author's `author_association` arrives with the body from the same REST read, and only
+// a body written by someone with write access to the repository is run.
 
 const FAILURE_EXIT_CODE = 1
-const USAGE = 'Usage: josh measure:rerun <path-to-issue-body>'
+const ARGV_OFFSET = 2
+const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
+const ISSUE_FIELDS = 'body,author_association'
+const TRUSTED_ASSOCIATIONS: ReadonlySet<string> = new Set(['OWNER', 'MEMBER', 'COLLABORATOR'])
+const TRUSTED_LIST = [...TRUSTED_ASSOCIATIONS].join(' / ')
+const UNKNOWN_ASSOCIATION = 'unknown'
+const USAGE = 'Usage: josh measure:rerun <issue-number>'
 const NO_BASELINE = 'no `command → value` baseline found in ## ベースライン — nothing to re-run'
 const DATE_END = 10
-
-// The command's stdout, trimmed to one value. A failing command yields its message so the pair still
-// prints rather than aborting the whole re-measurement.
+// One baseline command's budget — the same minute `josh-harness.ts` gives one command it spawns. A
+// baseline is a count or a digest that answers in seconds, so a command still running after a minute
+// is stuck, and without a bound it would hold the whole re-measurement open with nothing printed.
+const MEASURE_TIMEOUT_MS = 60_000
+const issue_schema = z.object({
+	body: z.string().nullish(),
+	author_association: z.string().nullish(),
+})
+
+type IssueFields = z.infer<typeof issue_schema>
+type BodyRead = { kind: 'trusted'; body: string } | { kind: 'refused'; reason: string }
+
+// The command's stdout, trimmed to one value. A failing or timed-out command yields its message so the
+// pair still prints and the remaining baselines still run, rather than aborting the whole
+// re-measurement.
 function measure(command: string): string {
 	try {
-		return execSync(command, { encoding: 'utf8' }).trim()
+		return execSync(command, { encoding: 'utf8', timeout: MEASURE_TIMEOUT_MS }).trim()
 	} catch (error) {
 		return `(command failed: ${error_text.message_of(error)})`
 	}
@@ -56,8 +82,35 @@ function today(now: Date): string {
 	return now.toISOString().slice(0, DATE_END)
 }
 
-async function rerun(body_path: string, now: Date): Promise<number> {
-	const baselines = baseline_measure.parse_baselines(await readFile(body_path, 'utf8'))
+async function read_issue(issue_number: string): Promise<IssueFields | undefined> {
+	const json = await git_gh_issue_read.issue_view_json(issue_number, ISSUE_FIELDS)
+
+	return json === undefined ? undefined : parse_json_object_safe(json, issue_schema)
+}
+
+// The body, only when its author can write to the repository. A read that fails is refused as well:
+// an unknown author is not a trusted one.
+async function read_trusted_body(issue_number: string): Promise<BodyRead> {
+	const issue = await read_issue(issue_number)
+
+	if (issue === undefined) {
+		return { kind: 'refused', reason: `could not read issue #${issue_number}` }
+	}
+
+	const association = issue.author_association ?? UNKNOWN_ASSOCIATION
+
+	if (!TRUSTED_ASSOCIATIONS.has(association)) {
+		return {
+			kind: 'refused',
+			reason: `refusing to run the baseline of #${issue_number}: its author is ${association}, not ${TRUSTED_LIST}`,
+		}
+	}
+
+	return { kind: 'trusted', body: issue.body ?? '' }
+}
+
+async function rerun(body: string, now: Date): Promise<number> {
+	const baselines = baseline_measure.parse_baselines(body)
 
 	if (baselines.length === 0) {
 		console.error(NO_BASELINE)
@@ -76,14 +129,22 @@ async function rerun(body_path: string, now: Date): Promise<number> {
 	return 0
 }
 
-async function run(body_path: string | undefined, now: Date): Promise<number> {
-	if (body_path === undefined) {
+async function run(issue_number: string | undefined, now: Date): Promise<number> {
+	if (issue_number === undefined || !ISSUE_NUMBER_PATTERN.test(issue_number)) {
 		console.error(USAGE)
 
 		return FAILURE_EXIT_CODE
 	}
 
-	return await rerun(body_path, now)
+	const read = await read_trusted_body(issue_number)
+
+	if (read.kind === 'refused') {
+		console.error(read.reason)
+
+		return FAILURE_EXIT_CODE
+	}
+
+	return await rerun(read.body, now)
 }
 
 async function main(argv: ReadonlyArray<string>): Promise<void> {
@@ -92,8 +153,6 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 
 const measure_rerun_cli = { run }
 
-const ARGV_OFFSET = 2
-
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 
 export { measure_rerun_cli }

package/scripts/josh/josh-commands-project.ts

@@ -40,7 +40,7 @@ const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 	},
 	'registry:migrate': {
 		script: 'scripts/registry-migration/migrate.ts',
-		description: 'Migrate a kit-only project from GitHub Packages to public npm',
+		description: 'Migrate a project from GitHub Packages to public npm',
 		category: 'Project',
 		reference: ['', 'developer', ['files', 'network', 'processes']],
 	},

package/scripts/josh/josh-commands-workflow.ts

@@ -89,7 +89,7 @@ const WORKFLOW_COMMANDS: Record<string, CommandEntry> = {
 		script: 'scripts/issue/measure-rerun-cli.ts',
 		description: 'Re-run a merged issue’s baseline command and print the before/after pair',
 		category: 'Workflow',
-		reference: ['<path>', 'automation', ['processes', 'files']],
+		reference: ['<issue-number>', 'automation', ['network', 'processes', 'files']],
 	},
 	// A script rather than an `sh -c` chain, because it has a precondition to enforce: run inside a
 	// linked work tree it would hijack the default branch from every other one (joshuafolkken/kit#1535).

package/scripts/josh/run-github-prerequisite.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import path from 'node:path'
 import { repo_origin } from '#scripts/discovery/repo-origin'
-import { execaSync } from 'execa'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 
 const GITHUB_RUN_COMMANDS = new Set([
 	'run:entry',
@@ -19,11 +19,8 @@ function explanation(root: string, command: string): string | undefined {
 		return `${command} requires Git and a GitHub origin. Run git init and add a GitHub origin first.`
 	}
 
-	const result = execaSync('git', ['config', '--get', 'remote.origin.url'], {
-		cwd: root,
-		reject: false,
-	})
-	if (result.exitCode === 0 && repo_origin.parse_origin_url(result.stdout)) return undefined
+	const url = git_spawn_sync.origin_url(root)
+	if (url !== undefined && repo_origin.parse_origin_url(url)) return undefined
 
 	return `${command} requires a GitHub origin. Add an origin pointing to GitHub first.`
 }