@joshuafolkken/kit 1.1094.0 → 1.1136.0

package/scripts/test/test-declared.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env tsx
 import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
 import { project_checks } from '#scripts/gate/project-checks'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { test_declared_changed } from './test-declared-changed'
 import { test_declared_logic, type Verdict } from './test-declared-logic'
 import { test_declared_match, type MatchResult } from './test-declared-match'
@@ -55,13 +55,9 @@ interface Options {
 // The parsed flags, or `undefined` when an unknown one was passed — the strict parse is what turns a
 // typo into a refusal rather than a silent re-print of the verdict.
 function parse(argv: ReadonlyArray<string>): Options | undefined {
-	try {
-		const { values } = parseArgs({ args: [...argv], options: PARSE_ARGS_OPTIONS, strict: true })
+	const values = cli_flags.values_of(argv, PARSE_ARGS_OPTIONS)
 
-		return { is_help: values.help, is_match: values.match }
-	} catch {
-		return undefined
-	}
+	return values === undefined ? undefined : { is_help: values.help, is_match: values.match }
 }
 
 // The next command a verdict leaves to run, or `undefined` when there is nothing to do next. Only

package/scripts/test/test-related.ts

@@ -26,12 +26,7 @@ import { test_unit_guard } from './test-unit-guard'
 function conclusive_tree(before: GateTree | undefined): GateTree | undefined {
 	if (before === undefined) return undefined
 
-	const action = test_unit_guard.resolve_guard_action(
-		test_unit_guard.is_vitest_installed(process.cwd()),
-		test_unit_guard.has_unit_tests(process.cwd()),
-	)
-
-	return action === 'run' ? before : undefined
+	return test_unit_guard.guard_action(process.cwd()) === 'run' ? before : undefined
 }
 
 async function run_related_tests(command_arguments: ReadonlyArray<string>): Promise<number> {

package/scripts/test/test-unit-guard.ts

@@ -79,6 +79,24 @@ function has_unit_tests(project_directory: string): boolean {
 	return matches.length > 0
 }
 
+// The guard's decision for one project, asked here once so the run, the scoped record and the gate's
+// precondition can never disagree about whether this project's vitest runs (joshuafolkken/kit#3136).
+function guard_action(project_directory: string): GuardAction {
+	return resolve_guard_action(
+		is_vitest_installed(project_directory),
+		has_unit_tests(project_directory),
+		project_checks.is_basic(project_directory),
+	)
+}
+
+// **A skip is the project having no unit suite, so no unit check can ever vouch for its tree.** The
+// failing branch is not one: it is a broken suite, and it is left to fail where it is reported.
+function is_skipping(project_directory: string): boolean {
+	const action = guard_action(project_directory)
+
+	return action === SKIP_ACTION || action === SKIP_NO_TESTS_ACTION
+}
+
 // A lane's port allocation belongs to its development and preview servers, not to unit fixtures.
 // Passing it into Vitest makes every case that deliberately omits or replaces the seed inherit the
 // checkout's seat instead. Keep the rest of the caller's environment, including CI and PATH guards.
@@ -155,13 +173,7 @@ async function run_guarded_vitest(
 	command_label: string = UNIT_COMMAND_LABEL,
 	announcement?: string,
 ): Promise<number> {
-	const is_installed = is_vitest_installed(project_directory)
-	const has_tests = has_unit_tests(project_directory)
-	const action = resolve_guard_action(
-		is_installed,
-		has_tests,
-		project_checks.is_basic(project_directory),
-	)
+	const action = guard_action(project_directory)
 
 	if (action !== 'run') return report_no_run(action, command_label)
 	if (announcement !== undefined) process.stdout.write(`${announcement}\n`)
@@ -185,6 +197,8 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
 
 const test_unit_guard = {
 	SKIP_MARKER,
+	guard_action,
+	is_skipping,
 	resolve_guard_action,
 	is_vitest_installed,
 	has_unit_tests,

package/scripts/time-runtime/time-spans.ts

@@ -138,6 +138,9 @@ interface ToolCall {
 	// second write to one file is independent work, a read of a file just written is not
 	// (joshuafolkken/kit#1509).
 	is_writing: boolean
+	// The conservative write answer `is_read_only_call` asks of a live call, carried so a reader of the
+	// transcript asks the same read-only question as the guard (joshuafolkken/kit#3139).
+	may_write: boolean
 	// Whether this is a subagent launch whose prompt builds on an earlier launch's finding
 	// (joshuafolkken/kit#1854). Carried for the reason every field here is — the prompt it is read from
 	// is the input, and a span keeps none. `time-agent-bundles.ts` reads it.
@@ -474,6 +477,7 @@ function to_spans(events: ReadonlyArray<TimelineEvent>, finished: FinishedAt): A
 		is_bundleable: event.is_bundleable,
 		targets: event.targets,
 		is_writing: event.is_writing,
+		may_write: event.may_write,
 		has_prior_reference: event.has_prior_reference,
 		writes: event.writes,
 		message_id: event.message_id,

package/scripts/version/version-commands.ts

@@ -24,6 +24,8 @@ import { version_targets } from './version-targets'
 const FAILURE_EXIT_CODE = 1
 const ALREADY_UP_TO_DATE = 'Already up to date'
 const NO_QUARANTINE_MINUTES = 0
+// A global install that goes to the network — the same ten minutes `lane-install.ts` gives one.
+const UPGRADE_TIMEOUT_MS = 600_000
 
 // What the local minimum-release-age policy permits for one package. Resolved per package because
 // the newest installable release is a property of that package's own publish history. Returns a hold
@@ -195,8 +197,16 @@ function run_check(config: VersionCommandConfig): void {
 	)
 }
 
+// Through `sh -c` because an upgrade command is the user's own configured string — `pnpm add -g …`,
+// or a chain with `&&` — so it is inside the trust boundary and needs a shell to mean what it says.
+// The bound keeps a registry that never answers from holding `josh version` open forever; a timed-out
+// run has no exit code, so it falls through to the failure code like any other failed step.
 function run_upgrade_command(command: string): number {
-	const result = execaSync('sh', ['-c', command], { stdio: 'inherit', reject: false })
+	const result = execaSync('sh', ['-c', command], {
+		stdio: 'inherit',
+		reject: false,
+		timeout: UPGRADE_TIMEOUT_MS,
+	})
 
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }

package/templates/CLAUDE.basic.md

@@ -1,8 +1,8 @@
 # Project instructions
 
-- 既存のファイルと利用者の設定を尊重し、変更する前に内容を確認する。
-- 変更には検証を付け、実行した結果を報告する。
-- HTML、CSS、JavaScript のファイルがある場合は Prettier で整形する。
-- 画面に見える変更をした場合はブラウザーで表示と操作を確認する。
-- JavaScript または TypeScript の動作を変更した場合は、その動作を確認する自動テストを追加する。
-- Git や GitHub を使う場合だけ、それぞれのワークフローを利用する。
+- Respect existing files and the user's settings, and read a file's contents before changing it.
+- Verify every change, and report the results you actually observed.
+- Format HTML, CSS and JavaScript files with Prettier when the project has any.
+- After a change that is visible on screen, check its display and interaction in a browser.
+- After changing JavaScript or TypeScript behavior, add an automated test that checks that behavior.
+- Use the Git or GitHub workflow only when you use Git or GitHub.

package/templates/workflows/ci.yml

@@ -29,12 +29,11 @@ concurrency:
 # list (e.g. `chromium firefox webkit`) instead of editing this file, which josh sync overwrites.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
-  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
-  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
-  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
-  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+
+# Every job that needs pnpm prepares it through `.github/actions/setup-pnpm`, which `josh sync`
+# writes beside this file: the pnpm version resolution, the store cache, the hash-verified safe-chain
+# installer and the install. kit's own `ci.yml` calls the same action, so the path a consumer runs is
+# the path kit runs (joshuafolkken/kit#3095).
 
 jobs:
   playwright-image:
@@ -126,37 +125,11 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -188,17 +161,10 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # A `basic` project has no `prepare`, no build and no SvelteKit, so the ordered steps below
       # would fail on its first pull request (joshuafolkken/kit#2814). The profile is read from
@@ -399,37 +365,11 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -441,17 +381,10 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-build-cache-e2e-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # --ignore-scripts suppresses the install-time `prepare`, so generated framework
       # files never appear. Playwright >= 1.62 hard-throws when a tsconfig `extends`
@@ -679,6 +612,7 @@ jobs:
       needs.e2e-detect.result == 'success' &&
       (needs.e2e.result == 'success' || needs.e2e.result == 'skipped')
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       contents: write
     steps:

package/templates/workflows/dependabot-auto-merge.yml

@@ -27,6 +27,7 @@ jobs:
   # what stays restricted to Dependabot's own events, on the step below.
   auto-merge:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       # Whether the pull request touches a workflow some upstream package overwrites. Decided from

package/templates/workflows/github-release.yml

@@ -1,14 +1,13 @@
 name: GitHub Release
 
 # Creates the GitHub Release, with notes generated from `.github/release.yml`, for each tag
-# `josh release` cuts (joshuafolkken/kit#3007). A repository with a Publish workflow gets its release
-# once that workflow has succeeded for the tag; one without it gets the release when auto-tag.yml
-# announces the tag. kit's own release is the `create-release` job of its publish.yml, which runs the
-# same `josh release:github`, so this file is distributed but never runs in kit.
+# `josh release` cuts (joshuafolkken/kit#3007). It starts when auto-tag.yml announces the tag; a
+# repository with a Publish workflow gets its release once that workflow has succeeded for the tag,
+# waited for inside `josh release:github`. A `workflow_run` on Publish is not used: a Publish run
+# started by the GITHUB_TOKEN never fires one (joshuafolkken/kit#3138). kit's own release is the
+# `create-release` job of its publish.yml, which runs the same `josh release:github`, so this file is
+# distributed but never runs in kit.
 on:
-  workflow_run:
-    workflows: [Publish]
-    types: [completed]
   repository_dispatch:
     types: [new-tag-created]
 
@@ -17,12 +16,6 @@ on:
 
 jobs:
   release:
-    # The Publish run is titled `Publish <tag>`; its head branch is not the tag when it was started by
-    # repository_dispatch, so the title is where the tag is read from.
-    if: >-
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' &&
-      startsWith(github.event.workflow_run.display_title, 'Publish v')) ||
-      github.event_name == 'repository_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 65
     permissions:
@@ -36,30 +29,22 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      # A repository with a Publish workflow is released from the workflow_run above, after its
-      # publication, so the tag announcement is left alone there and one tag never starts two releases.
+      # A repository with a Publish workflow waits for that workflow's `Publish <tag>` run to succeed
+      # before releasing; the announcement is the only trigger, so one tag never starts two releases.
       - name: Select release tag
         id: release
         env:
-          EVENT_NAME: ${{ github.event_name }}
-          RUN_TITLE: ${{ github.event.workflow_run.display_title }}
-          RUN_WORKFLOW: ${{ github.event.workflow_run.workflow_id }}
           DISPATCH_TAG: ${{ github.event.client_payload.tag }}
         run: |
-          if [ "$EVENT_NAME" = workflow_run ]; then
-            echo "tag=${RUN_TITLE#Publish }" >> "$GITHUB_OUTPUT"
-            echo "workflow=$RUN_WORKFLOW" >> "$GITHUB_OUTPUT"
-          elif [ -f .github/workflows/publish.yml ]; then
-            echo "ℹ️ publish.yml releases this tag once it has published, skipping"
-          else
-            echo "tag=$DISPATCH_TAG" >> "$GITHUB_OUTPUT"
+          echo "tag=$DISPATCH_TAG" >> "$GITHUB_OUTPUT"
+          if [ -f .github/workflows/publish.yml ]; then
+            echo "workflow=publish.yml" >> "$GITHUB_OUTPUT"
+            echo "await=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Setup Node.js
         if: steps.release.outputs.tag != ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         if: steps.release.outputs.tag != ''
@@ -79,3 +64,4 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
           RELEASE_WORKFLOW: ${{ steps.release.outputs.workflow }}
+          RELEASE_AWAIT_PUBLISH: ${{ steps.release.outputs.await }}

package/tsconfig.sonar.json

@@ -1,29 +1,11 @@
 {
+	"extends": "@joshuafolkken/kit/tsconfig/base",
 	"compilerOptions": {
-		"target": "ES2020",
-		"module": "ES2020",
-		"lib": ["ES2020", "DOM", "DOM.Iterable"],
-		"moduleResolution": "node",
-		"allowImportingTsExtensions": false,
+		"target": "ES2022",
+		"lib": ["ES2023", "DOM", "DOM.Iterable"],
+		"types": ["node"],
 		"allowJs": true,
 		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
-		"sourceMap": true,
-		"strict": true,
-		"noUncheckedIndexedAccess": true,
-		"noImplicitOverride": true,
-		"noUnusedLocals": true,
-		"noUnusedParameters": true,
-		"exactOptionalPropertyTypes": true,
-		"noFallthroughCasesInSwitch": true,
-		"noImplicitReturns": true,
-		"noPropertyAccessFromIndexSignature": true,
-		"allowUnusedLabels": false,
-		"allowUnreachableCode": false,
-		"isolatedModules": true,
 		"paths": {
 			"$lib": ["./src/lib"],
 			"$lib/*": ["./src/lib/*"]