@joshuafolkken/kit 1.1094.0 → 1.1136.0

package/scripts/init/initial-commit.ts

@@ -0,0 +1,24 @@
+import { start_exec } from './start-exec'
+
+// The first commit of a new repository, shared by `josh start` and `josh dogfood:commit` so neither
+// keeps a copy of how it is made.
+
+const DEFAULT_BRANCH = 'main'
+
+function create_repository(root: string): void {
+	start_exec.run('git', ['init', `--initial-branch=${DEFAULT_BRANCH}`], root)
+}
+
+function commit_all(root: string): void {
+	start_exec.run('git', ['add', '--all'], root)
+	// The first commit of a new repository has no branch to come from, so the hook that keeps commits
+	// off main — installed by the initialize step in a full project — would refuse the only commit
+	// that has to land there.
+	start_exec.run('git', ['commit', '--no-verify', '--message', 'Initial commit'], root)
+	// A repository created by an older `git init` may name its unborn branch `master`.
+	start_exec.run('git', ['branch', '--move', '--force', DEFAULT_BRANCH], root)
+}
+
+const initial_commit = { create_repository, commit_all }
+
+export { initial_commit }

package/scripts/init/kit-written-paths.ts

@@ -1,3 +1,4 @@
+import { PACK_HOOK_FILE } from '#scripts/safe-chain/pack-hook'
 import { PROJECT_CONFIG_FILE } from '#scripts/safe-chain/project-config'
 import { managed_config_scope } from '#scripts/sync/managed-config-scope'
 import { BASIC_PRETTIER_CONFIG } from './init-actions'
@@ -13,6 +14,7 @@ const SETUP_ONLY_PATHS: ReadonlySet<string> = new Set([
 	CLAUDE_MD_FILENAME,
 	BASIC_PRETTIER_CONFIG,
 	PROJECT_CONFIG_FILE,
+	PACK_HOOK_FILE,
 	MANIFEST_FILE,
 	LOCKFILE,
 ])

package/scripts/init/project-profile.ts

@@ -1,9 +1,9 @@
 import { existsSync, readdirSync, readFileSync, type Dirent } from 'node:fs'
 import path from 'node:path'
 import { repo_origin } from '#scripts/discovery/repo-origin'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { json_value } from '#scripts/lib/json-value'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
-import { execaSync } from 'execa'
 
 type ProjectProfile = 'basic' | 'full'
 
@@ -159,12 +159,9 @@ function scan_files(root: string): { has_web: boolean; has_typescript: boolean }
 }
 
 function has_github_remote(root: string): boolean {
-	const result = execaSync('git', ['config', '--get', 'remote.origin.url'], {
-		cwd: root,
-		reject: false,
-	})
+	const url = git_spawn_sync.origin_url(root)
 
-	return result.exitCode === 0 && repo_origin.parse_origin_url(result.stdout) !== undefined
+	return url !== undefined && repo_origin.parse_origin_url(url) !== undefined
 }
 
 function inspect_project(root: string, requested?: ProjectProfile): ProjectShape {

package/scripts/init/start-exec.ts

@@ -1,10 +1,21 @@
 import { git_gh_exec } from '#scripts/gh/git-gh-exec'
+import { git_location_environment } from '#scripts/git/git-location-environment'
 import { execaSync } from 'execa'
 
 // The three spawn shapes every `josh start` step uses, shared by `start-steps.ts`, the setup pull
 // request step and the `josh init` hint so none of them keeps a copy of its own.
+//
+// The three git-driving shapes below act on `root`, so `cwd` has to mean it: an inherited `GIT_DIR` and friends beat `cwd`
+// and would carry a `git init` or commit into whichever repository a calling hook was firing in
+// (joshuafolkken/kit#3151).
+function root_environment(): Record<string, string | undefined> {
+	return git_location_environment.location_free_environment()
+}
+
 function succeeds(command: string, args: ReadonlyArray<string>, root: string): boolean {
-	return execaSync(command, args, { cwd: root, reject: false }).exitCode === 0
+	return (
+		execaSync(command, args, { cwd: root, env: root_environment(), reject: false }).exitCode === 0
+	)
 }
 
 function read_output(
@@ -12,7 +23,7 @@ function read_output(
 	args: ReadonlyArray<string>,
 	root: string,
 ): string | undefined {
-	const result = execaSync(command, args, { cwd: root, reject: false })
+	const result = execaSync(command, args, { cwd: root, env: root_environment(), reject: false })
 
 	return result.exitCode === 0 ? result.stdout.trim() : undefined
 }
@@ -20,7 +31,9 @@ function read_output(
 // Every step spawned here dials GitHub directly, past a scanner's loopback proxy, the same as every
 // other `gh` spawn under scripts/ (joshuafolkken/kit#2436); a local `git` step is unaffected by it.
 function run(command: string, args: ReadonlyArray<string>, root: string): void {
-	execaSync(command, args, { ...git_gh_exec.direct_environment(), cwd: root, stdio: 'inherit' })
+	const environment = { ...root_environment(), ...git_gh_exec.direct_environment().env }
+
+	execaSync(command, args, { env: environment, cwd: root, stdio: 'inherit' })
 }
 
 // A caller's own initialize command stands in for the in-process `josh init`, so it keeps the

package/scripts/init/start-steps.ts

@@ -1,10 +1,12 @@
 import path from 'node:path'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { error_text } from '#scripts/lib/error-message'
 import { repository_labels } from '#scripts/repo/repository-labels'
 import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
 import { parseCommandString } from 'execa'
 import { main as init_main } from './init'
 import { PACKAGE_DIR } from './init-paths'
+import { initial_commit } from './initial-commit'
 import { kit_setup_state } from './kit-setup-state'
 import type { ProjectProfile, ProjectShape } from './project-profile'
 import { start_exec } from './start-exec'
@@ -22,7 +24,6 @@ interface RunContext extends StepContext {
 	baseline: ReadonlyArray<string> | undefined
 }
 
-const DEFAULT_BRANCH = 'main'
 const GH_INSTALL_HINT =
 	'GitHub CLI (gh) is not installed. Install it from https://cli.github.com/, run gh auth login, then run josh start again. Nothing was changed.'
 const GH_AUTH_HINT =
@@ -44,7 +45,7 @@ function read_git_state(root: string, shape: ProjectShape): GitState {
 		}
 	}
 
-	const has_origin = succeeds('git', ['remote', 'get-url', 'origin'], root)
+	const has_origin = git_spawn_sync.origin_url(root) !== undefined
 	const branch = read_output('git', ['symbolic-ref', '--short', 'HEAD'], root)
 	const has_commits = succeeds('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], root)
 	const has_kit_committed = kit_setup_state.is_kit_committed(root)
@@ -69,7 +70,7 @@ function self_run_refusal(root: string): string | undefined {
 }
 
 function create_git_repository(context: StepContext): void {
-	run('git', ['init', `--initial-branch=${DEFAULT_BRANCH}`], context.root)
+	initial_commit.create_repository(context.root)
 }
 
 // The same setup `josh init` runs, called rather than copied, with the profile the user confirmed.
@@ -89,13 +90,7 @@ function initialize(context: StepContext): void {
 }
 
 function commit_all(context: StepContext): void {
-	run('git', ['add', '--all'], context.root)
-	// The first commit of a new repository has no branch to come from, so the hook that keeps commits
-	// off main — installed by the initialize step in a full project — would refuse the only commit
-	// that has to land there.
-	run('git', ['commit', '--no-verify', '--message', 'Initial commit'], context.root)
-	// A repository created by an older `git init` may name its unborn branch `master`.
-	run('git', ['branch', '--move', '--force', DEFAULT_BRANCH], context.root)
+	initial_commit.commit_all(context.root)
 }
 
 function create_github_repository(context: StepContext): void {
@@ -118,13 +113,15 @@ async function open_setup_pull_request(context: RunContext): Promise<void> {
 	await start_setup_pr.open(context.root, context.baseline)
 }
 
-// What was already changed before a caller's initialize command ran, read only when the setup pull
-// request will need to tell that command's files from the user's own (#2872).
+// What was already changed before the setup ran, read whenever a setup pull request will follow, so
+// it can tell the setup's files from the user's own (#2872). Kit's own `josh init` needs it as much as
+// a caller's command: its `josh format` rewrites the project's own sources, which kit cannot name, and
+// leaving them out failed the pull request's Prettier check (joshuafolkken/kit#3136).
 function baseline_of(
 	steps: ReadonlyArray<StartStep>,
 	context: StepContext,
 ): ReadonlyArray<string> | undefined {
-	if (context.init_command === undefined || !steps.includes('setup_pr')) return undefined
+	if (!steps.includes('setup_pr')) return undefined
 
 	return start_setup_pr.changed_paths(context.root)
 }

package/scripts/issue/defect-rate-cli.ts

@@ -1,16 +1,24 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { git_gh_exec } from '#scripts/gh/git-gh-exec'
-import { parse_json_array_or_undefined } from '#scripts/git/parse-json-array'
+import { parse_json } from '#scripts/git/parse-json-array'
 import { issue_label_schema } from '#scripts/git/schemas'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { z } from 'zod'
 import { defect_rate, type DefectRate, type RateIssue } from './defect-rate'
 
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const PER_PAGE = '100'
+const FIRST_PAGE = 1
+const SECOND_PAGE = 2
+// The search API serves at most this many results, so a window past it holds no further page.
+const SEARCH_RESULT_CEILING = 1000
+// The search API allows 30 requests a minute; both searches together stay at the ~10 requests the
+// sequential walk made, so this bounds only how many are in flight at once.
+const PAGE_CONCURRENCY = 4
 const USAGE = 'Usage: pnpm josh defect:rate [--days <n>]'
 const UNKNOWN_REPO_MESSAGE =
 	'Could not read this repository from `git remote`, so no issue can be searched — check `gh auth status` and that this is a checkout with an `origin` remote.'
@@ -33,7 +41,7 @@ const search_item_schema = z.object({
 	labels: z.array(issue_label_schema),
 })
 
-// One page of `search/issues`. `--paginate --slurp` hands back every page as one array.
+// One page of `search/issues`.
 const search_page_schema = z.object({
 	total_count: z.number(),
 	incomplete_results: z.boolean(),
@@ -48,22 +56,60 @@ interface SearchResult {
 }
 
 function read_days(argv: ReadonlyArray<string>): number | undefined {
-	try {
-		const { values } = parseArgs({ args: [...argv], options: OPTIONS, strict: true })
-		const raw = values.days ?? String(defect_rate.DEFAULT_WINDOW_DAYS)
+	const values = cli_flags.values_of(argv, OPTIONS)
 
-		if (!DAYS_PATTERN.test(raw)) return undefined
+	if (values === undefined) return undefined
 
-		const days = Number(raw)
+	const raw = values.days ?? String(defect_rate.DEFAULT_WINDOW_DAYS)
 
-		return days <= MAX_WINDOW_DAYS ? days : undefined
-	} catch {
-		return undefined
-	}
+	if (!DAYS_PATTERN.test(raw)) return undefined
+
+	const days = Number(raw)
+
+	return days <= MAX_WINDOW_DAYS ? days : undefined
+}
+
+function search_path(query: string, page: number = FIRST_PAGE): string {
+	const parameters = new URLSearchParams({ q: query, per_page: PER_PAGE })
+
+	if (page !== FIRST_PAGE) parameters.set('page', String(page))
+
+	return `search/issues?${parameters.toString()}`
 }
 
-function search_path(query: string): string {
-	return `search/issues?${new URLSearchParams({ q: query, per_page: PER_PAGE }).toString()}`
+// How many pages the search holds, read off the first page's own count. Bounded by the API's
+// ceiling, past which GitHub serves no page at all — so this asks for exactly the pages `gh api
+// --paginate` used to walk to.
+function page_count(first: SearchPage): number {
+	return Math.ceil(Math.min(first.total_count, SEARCH_RESULT_CEILING) / Number(PER_PAGE))
+}
+
+async function read_page(query: string, page: number): Promise<SearchPage | undefined> {
+	const raw = await git_gh_exec.exec_gh_api({ path: search_path(query, page) })
+
+	return parse_json.parse_json_object_safe(raw, search_page_schema)
+}
+
+// Every page of one search. joshuafolkken/kit#3103: `--paginate` follows each page's `next` link, so
+// a two-week window of ~5 pages cost ~1.5 s a page, one after another, on every `backlog:plan`. The
+// first page names the total, so the rest are fetched together; any page that does not read fails
+// the whole search, as a failed `--paginate` did.
+async function read_pages(query: string): Promise<ReadonlyArray<SearchPage> | undefined> {
+	const first = await read_page(query, FIRST_PAGE)
+
+	if (first === undefined) return undefined
+
+	const rest_numbers = Array.from(
+		{ length: Math.max(page_count(first) - FIRST_PAGE, 0) },
+		(_value, index) => index + SECOND_PAGE,
+	)
+	const rest = await bounded_pool.bounded_map(
+		rest_numbers,
+		PAGE_CONCURRENCY,
+		async (page) => await read_page(query, page),
+	)
+
+	return rest.every((page) => page !== undefined) ? [first, ...rest] : undefined
 }
 
 function to_result(pages: ReadonlyArray<SearchPage>): SearchResult {
@@ -83,12 +129,7 @@ function to_result(pages: ReadonlyArray<SearchPage>): SearchResult {
 
 async function search(query: string): Promise<SearchResult | undefined> {
 	try {
-		const raw = await git_gh_exec.exec_gh_api({
-			path: search_path(query),
-			should_paginate: true,
-			should_slurp: true,
-		})
-		const pages = parse_json_array_or_undefined(raw, search_page_schema)
+		const pages = await read_pages(query)
 
 		return pages === undefined ? undefined : to_result(pages)
 	} catch {

package/scripts/issue/issue-backlinks.ts

@@ -4,12 +4,13 @@
 // undetected. This classifies an origin issue's filed backlinks into one of four fixed words
 // (joshuafolkken/kit#2123). The headings are the single source's, pinned by the document test.
 
+import { markdown_section } from './markdown-section'
+
 const ORIGIN_HEADING = '## Origin'
 const UPSTREAM_ISSUES_HEADING = '## Upstream issues'
 const UPSTREAM_CANDIDATE_HEADING = '## Upstream candidate'
 const CHECKBOX_PATTERN = /^\s*-\s*\[[ xX]\]/u
 const WRONG_UPSTREAM_HEADING_PATTERN = /^##\s+Upstream\b/iu
-const SUBHEADING_PATTERN = /^##\s/u
 const BARE_REFERENCE_PATTERN = /^#\d+$/u
 const DIGITS_PATTERN = /^\d+$/u
 const REFERENCE_MARK = '#'
@@ -27,31 +28,23 @@ interface UpstreamEntry {
 	body: string
 }
 
-function trimmed_lines(body: string): ReadonlyArray<string> {
-	return body.split('\n').map((line) => line.trimEnd())
-}
-
+// A heading inside a code fence is example text, so neither lookup counts one (joshuafolkken/kit#3066).
 function has_heading(body: string, heading: string): boolean {
-	return trimmed_lines(body).some((line) => line.trim() === heading)
+	return markdown_section.has_line(body, heading)
 }
 
 // The lines under `heading`, up to the next `##` heading; `undefined` when the heading is absent.
 function section_lines(body: string, heading: string): ReadonlyArray<string> | undefined {
-	const lines = trimmed_lines(body)
-	const start = lines.findIndex((line) => line.trim() === heading)
-	if (start === -1) return undefined
-
-	const rest = lines.slice(start + 1)
-	const end = rest.findIndex((line) => SUBHEADING_PATTERN.test(line.trim()))
+	if (!has_heading(body, heading)) return undefined
 
-	return end === -1 ? rest : rest.slice(0, end)
+	return markdown_section.section_lines(body, heading)
 }
 
 // A heading that looks like the upstream one but is not exactly it (`## Upstream`, `## Upstreams`,
 // wrong case) — the grep the template promises would miss it, so it is a wrong-heading rather than a
 // missing one. `## Upstream candidate` is a legitimate separate heading and is excluded.
 function has_wrong_upstream_heading(body: string): boolean {
-	return trimmed_lines(body).some((line) => {
+	return markdown_section.unfenced_lines(body).some((line) => {
 		const heading = line.trim()
 		if (heading === UPSTREAM_ISSUES_HEADING || heading === UPSTREAM_CANDIDATE_HEADING) return false
 

package/scripts/issue/issue-cite.ts

@@ -46,14 +46,19 @@ function citation_line(slug: string, number: string, summary: string): string {
 // and the plain `#N` only when the repository could not be read at all.
 type IssueCiter = (number: string) => string
 
+// One issue, named from what the caller holds — the single decision every listing's citation goes
+// through (joshuafolkken/kit#3099), so a renderer holding one title never re-derives the fallback.
+function reference(slug: string | undefined, number: string, title: string | undefined): string {
+	if (slug === undefined) return `#${number}`
+
+	return title === undefined
+		? `[#${number}](${issue_url(slug, number)})`
+		: citation_line(slug, number, title)
+}
+
 function citer(slug: string | undefined, titles: ReadonlyMap<string, string>): IssueCiter {
 	return function cite(number: string): string {
-		if (slug === undefined) return `#${number}`
-		const title = titles.get(number)
-
-		return title === undefined
-			? `[#${number}](${issue_url(slug, number)})`
-			: citation_line(slug, number, title)
+		return reference(slug, number, titles.get(number))
 	}
 }
 
@@ -111,6 +116,7 @@ const issue_cite = {
 	missing_line,
 	no_repo_line,
 	parse_target,
+	reference,
 	unreadable_line,
 }
 

package/scripts/issue/issue-file.ts

@@ -1,6 +1,7 @@
-import { parseArgs } from 'node:util'
+import type { parseArgs } from 'node:util'
 import { epic_issue } from '#scripts/epic/epic-issue'
 import { github_issue_url } from '#scripts/gh/github-issue-url'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { issue_backlinks } from './issue-backlinks'
 import { issue_classification } from './issue-classification'
 import { DEPTH_LABEL_ORDER, FILING_ROUTE_LABELS, has_label_name } from './issue-labels'
@@ -103,19 +104,11 @@ function arguments_of(values: ParsedValues, title: string | undefined): FileArgu
 	return { title, body_file, ...labelled, labels: values.label ?? [], repo: values.repo }
 }
 
-// An unknown flag makes `parseArgs` throw; caught so the answer is the usage line, not a stack trace.
+// An unknown flag is `undefined` rather than a throw, so the answer is the usage line, not a stack trace.
 function parse(argv: ReadonlyArray<string>): FileArguments | undefined {
-	try {
-		const { values, positionals } = parseArgs({
-			args: [...argv],
-			options: OPTIONS,
-			allowPositionals: true,
-		})
+	const parsed = cli_flags.arguments_of(argv, OPTIONS)
 
-		return arguments_of(values, positionals[0])
-	} catch {
-		return undefined
-	}
+	return parsed === undefined ? undefined : arguments_of(parsed.values, parsed.positionals[0])
 }
 
 // A classification label is the body's to declare, so an extra `--label` naming one the body does not

package/scripts/issue/issue-read-cli.ts

@@ -129,6 +129,7 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 	issue_report_failures.print_blocks(
 		reports.flatMap((report) => issue_blocks(report)),
 		BLOCK_SEPARATOR,
+		`issue:read ${issue_numbers.join(' ')}`,
 	)
 
 	return issue_report_failures.report_failures(reports, FAILURE_TERMS)

package/scripts/issue/issue-report-failures.ts

@@ -1,3 +1,5 @@
+import { capped_output } from '#scripts/document/capped-print'
+
 // The failure report `issue:read` and `issue:state` share (joshuafolkken/kit#3046). Both read a batch
 // of numbers, print a block for each one that answered, and name every one that did not; only the
 // result kind that counts as an answer and what a gap must not be mistaken for differ between them.
@@ -22,10 +24,12 @@ interface FailureTerms<K extends string> {
 	misreading: string
 }
 
-function print_blocks(blocks: ReadonlyArray<string>, separator: string): void {
+// Under the Bash output cap, or as part files past it — a batch of long threads is the shape that
+// overflowed (joshuafolkken/kit#3143).
+function print_blocks(blocks: ReadonlyArray<string>, separator: string, label: string): void {
 	if (blocks.length === 0) return
 
-	console.info(blocks.join(separator))
+	capped_output.capped_print(blocks.join(separator), label)
 }
 
 // A number that resolves to nothing is an answer — a typo, or another repository's number quoted in

package/scripts/issue/issue-state-cli.ts

@@ -188,7 +188,7 @@ function print_states(reports: ReadonlyArray<IssueReport>): void {
 	const should_attribute = reports.length > 1
 	const blocks = reports.flatMap((report) => state_blocks(report, should_attribute))
 
-	issue_report_failures.print_blocks(blocks, BLOCK_SEPARATOR)
+	issue_report_failures.print_blocks(blocks, BLOCK_SEPARATOR, 'issue:state')
 }
 
 async function run(argv: ReadonlyArray<string>): Promise<number> {

package/scripts/issue/markdown-section.ts

@@ -52,13 +52,16 @@ function has_line(body: string, text: string): boolean {
 	return has_unfenced_line(body, text)
 }
 
-// The lines between `heading` and the next `## ` heading, trimmed of the heading line itself; an empty
-// array when the heading is absent. A heading matched inside a sentence is not the section heading, so
-// only a line that is exactly the heading opens the section.
-function section_lines(body: string, heading: string): ReadonlyArray<string> {
+// The lines between the first unfenced line `is_target` accepts and the next unfenced `## ` heading,
+// trimmed of the heading line itself; an empty array when no line is accepted. A `## ` line inside a
+// code fence is example text, so it neither opens nor closes a section (joshuafolkken/kit#3066).
+function section_lines_matching(
+	body: string,
+	is_target: (line: string) => boolean,
+): ReadonlyArray<string> {
 	const lines = body.split('\n')
 	const visible = unfenced_lines(body)
-	const start = visible.findIndex((line) => is_the_heading(line, heading))
+	const start = visible.findIndex((line) => is_target(line))
 
 	if (start === -1) return []
 
@@ -68,6 +71,18 @@ function section_lines(body: string, heading: string): ReadonlyArray<string> {
 	return end === -1 ? rest : rest.slice(0, end)
 }
 
-const markdown_section = { section_lines, has_line, has_unfenced_line }
+// A heading matched inside a sentence is not the section heading, so only a line that is exactly the
+// heading opens the section.
+function section_lines(body: string, heading: string): ReadonlyArray<string> {
+	return section_lines_matching(body, (line) => is_the_heading(line, heading))
+}
+
+const markdown_section = {
+	section_lines,
+	section_lines_matching,
+	unfenced_lines,
+	has_line,
+	has_unfenced_line,
+}
 
 export { markdown_section }

package/scripts/issue/measure-rerun-cli.ts

@@ -1,26 +1,52 @@
 #!/usr/bin/env tsx
 import { execSync } from 'node:child_process'
-import { readFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
+import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { parse_json_object_safe } from '#scripts/git/parse-json-array'
 import { error_text } from '#scripts/lib/error-message'
 import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
+import { z } from 'zod'
 import { baseline_measure, type Baseline } from './baseline-measure'
 
-// `josh measure:rerun <path>` — read a behavior-change Issue body after merge, re-run each baseline
+// `josh measure:rerun <N>` — read a behavior-change Issue body after merge, re-run each baseline
 // command, and print the before/after pair (joshuafolkken/kit#2212). A value that did not move means
 // the premise the rule rested on is refuted, so a line is appended to the observation ledger — reusing
 // that append-only, same-key mechanism rather than a second one.
+//
+// **The baseline is shell, and the body is written by whoever filed the Issue** (joshuafolkken/kit#3064).
+// A baseline needs pipes and loops (`git log … | wc -l`, `for d in $(ls …)`), so an allow-list of
+// commands cannot make it safe; what can is who wrote it. The input is therefore the Issue number, not
+// a file, so the author's `author_association` arrives with the body from the same REST read, and only
+// a body written by someone with write access to the repository is run.
 
 const FAILURE_EXIT_CODE = 1
-const USAGE = 'Usage: josh measure:rerun <path-to-issue-body>'
+const ARGV_OFFSET = 2
+const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
+const ISSUE_FIELDS = 'body,author_association'
+const TRUSTED_ASSOCIATIONS: ReadonlySet<string> = new Set(['OWNER', 'MEMBER', 'COLLABORATOR'])
+const TRUSTED_LIST = [...TRUSTED_ASSOCIATIONS].join(' / ')
+const UNKNOWN_ASSOCIATION = 'unknown'
+const USAGE = 'Usage: josh measure:rerun <issue-number>'
 const NO_BASELINE = 'no `command → value` baseline found in ## ベースライン — nothing to re-run'
 const DATE_END = 10
-
-// The command's stdout, trimmed to one value. A failing command yields its message so the pair still
-// prints rather than aborting the whole re-measurement.
+// One baseline command's budget — the same minute `josh-harness.ts` gives one command it spawns. A
+// baseline is a count or a digest that answers in seconds, so a command still running after a minute
+// is stuck, and without a bound it would hold the whole re-measurement open with nothing printed.
+const MEASURE_TIMEOUT_MS = 60_000
+const issue_schema = z.object({
+	body: z.string().nullish(),
+	author_association: z.string().nullish(),
+})
+
+type IssueFields = z.infer<typeof issue_schema>
+type BodyRead = { kind: 'trusted'; body: string } | { kind: 'refused'; reason: string }
+
+// The command's stdout, trimmed to one value. A failing or timed-out command yields its message so the
+// pair still prints and the remaining baselines still run, rather than aborting the whole
+// re-measurement.
 function measure(command: string): string {
 	try {
-		return execSync(command, { encoding: 'utf8' }).trim()
+		return execSync(command, { encoding: 'utf8', timeout: MEASURE_TIMEOUT_MS }).trim()
 	} catch (error) {
 		return `(command failed: ${error_text.message_of(error)})`
 	}
@@ -56,8 +82,35 @@ function today(now: Date): string {
 	return now.toISOString().slice(0, DATE_END)
 }
 
-async function rerun(body_path: string, now: Date): Promise<number> {
-	const baselines = baseline_measure.parse_baselines(await readFile(body_path, 'utf8'))
+async function read_issue(issue_number: string): Promise<IssueFields | undefined> {
+	const json = await git_gh_issue_read.issue_view_json(issue_number, ISSUE_FIELDS)
+
+	return json === undefined ? undefined : parse_json_object_safe(json, issue_schema)
+}
+
+// The body, only when its author can write to the repository. A read that fails is refused as well:
+// an unknown author is not a trusted one.
+async function read_trusted_body(issue_number: string): Promise<BodyRead> {
+	const issue = await read_issue(issue_number)
+
+	if (issue === undefined) {
+		return { kind: 'refused', reason: `could not read issue #${issue_number}` }
+	}
+
+	const association = issue.author_association ?? UNKNOWN_ASSOCIATION
+
+	if (!TRUSTED_ASSOCIATIONS.has(association)) {
+		return {
+			kind: 'refused',
+			reason: `refusing to run the baseline of #${issue_number}: its author is ${association}, not ${TRUSTED_LIST}`,
+		}
+	}
+
+	return { kind: 'trusted', body: issue.body ?? '' }
+}
+
+async function rerun(body: string, now: Date): Promise<number> {
+	const baselines = baseline_measure.parse_baselines(body)
 
 	if (baselines.length === 0) {
 		console.error(NO_BASELINE)
@@ -76,14 +129,22 @@ async function rerun(body_path: string, now: Date): Promise<number> {
 	return 0
 }
 
-async function run(body_path: string | undefined, now: Date): Promise<number> {
-	if (body_path === undefined) {
+async function run(issue_number: string | undefined, now: Date): Promise<number> {
+	if (issue_number === undefined || !ISSUE_NUMBER_PATTERN.test(issue_number)) {
 		console.error(USAGE)
 
 		return FAILURE_EXIT_CODE
 	}
 
-	return await rerun(body_path, now)
+	const read = await read_trusted_body(issue_number)
+
+	if (read.kind === 'refused') {
+		console.error(read.reason)
+
+		return FAILURE_EXIT_CODE
+	}
+
+	return await rerun(read.body, now)
 }
 
 async function main(argv: ReadonlyArray<string>): Promise<void> {
@@ -92,8 +153,6 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 
 const measure_rerun_cli = { run }
 
-const ARGV_OFFSET = 2
-
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 
 export { measure_rerun_cli }

package/scripts/josh/josh-commands-lane.ts

@@ -59,7 +59,7 @@ const LANE_COMMANDS: Record<string, CommandEntry> = {
 		description:
 			'Block until any of the named in-flight lane children completes; prints which one finished',
 		category: 'AI tools',
-		reference: ['<issue> [<issue>...]', 'automation', ['processes']],
+		reference: ['<issue> [<issue>...] [--owner <pid>]', 'automation', ['files', 'processes']],
 		default_script_arguments: ['await'],
 	},
 	'lane:launch': {