@joshuafolkken/kit 1.1178.0 → 1.1229.0

package/scripts/safe-chain/project-config.ts

@@ -8,7 +8,6 @@ import { z } from 'zod'
 
 const WORKSPACE_FILE = 'pnpm-workspace.yaml'
 const PROJECT_CONFIG_FILE = '.aikido'
-const NPMRC_FILE = '.npmrc'
 const EXCLUSIONS_FIELD = 'minimumPackageAgeExclusions'
 const AGE_FIELD = 'minimumPackageAgeHours'
 const MINUTES_PER_HOUR = 60
@@ -78,18 +77,22 @@ function replace_safe_chain_block(existing: string, safe_chain: Record<string, u
 }
 
 // Safe Chain enforces its own minimum package age (48 hours by default), so CI refused lockfiles pnpm
-// had resolved under `.npmrc`'s shorter window (kit #2743). `.npmrc` is the source: its minutes are
-// floored to whole hours so Safe Chain is never stricter than pnpm, and an undeclared window writes
-// nothing; an explicit `0` opt-out is written as 0 so an earlier synchronized age cannot outlive it.
-function package_age_hours(npmrc: string): number | undefined {
-	const minutes = release_age.parse_declared_minimum_release_age(npmrc)
+// had resolved under pnpm's shorter window (kit #2743). The workspace's `minimumReleaseAge` is the
+// source: its minutes are floored to whole hours so Safe Chain is never stricter than pnpm, and an
+// undeclared window writes nothing; an explicit `0` opt-out is written as 0 so an earlier
+// synchronized age cannot outlive it.
+function package_age_hours(workspace: string): number | undefined {
+	const minutes = release_age.parse_declared_minimum_release_age(workspace)
 	if (minutes === undefined) return undefined
 
 	return Math.floor(minutes / MINUTES_PER_HOUR)
 }
 
-function merge_age(safe_chain: Record<string, unknown>, npmrc: string): Record<string, unknown> {
-	const hours = package_age_hours(npmrc)
+function merge_age(
+	safe_chain: Record<string, unknown>,
+	workspace: string,
+): Record<string, unknown> {
+	const hours = package_age_hours(workspace)
 	if (hours === undefined) return safe_chain
 
 	return { ...safe_chain, [AGE_FIELD]: hours }
@@ -107,22 +110,24 @@ function merge_exclusions(
 function has_nothing_to_write(
 	existing: string,
 	exclusions: ReadonlyArray<string>,
-	npmrc: string,
+	workspace: string,
 ): boolean {
-	return existing.length === 0 && exclusions.length === 0 && package_age_hours(npmrc) === undefined
+	return (
+		existing.length === 0 && exclusions.length === 0 && package_age_hours(workspace) === undefined
+	)
 }
 
 function read_exclusions(workspace: string): ReadonlyArray<string> {
 	return workspace_schema.parse(yaml_document.parse_yaml(workspace)).minimumReleaseAgeExclude ?? []
 }
 
-function merge_project_config(existing: string, workspace: string, npmrc = ''): string {
+function merge_project_config(existing: string, workspace: string): string {
 	const exclusions = read_exclusions(workspace)
 	const aikido = yaml_document.parse_yaml(existing)
 	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
-	const merged = merge_age(merge_exclusions(safe_chain, exclusions), npmrc)
+	const merged = merge_age(merge_exclusions(safe_chain, exclusions), workspace)
 	if (JSON.stringify(merged) === JSON.stringify(safe_chain)) return existing
-	if (has_nothing_to_write(existing, exclusions, npmrc)) return existing
+	if (has_nothing_to_write(existing, exclusions, workspace)) return existing
 
 	return replace_safe_chain_block(existing, merged)
 }
@@ -133,8 +138,7 @@ function sync_project_config(root: string): boolean {
 	const config_path = path.join(root, PROJECT_CONFIG_FILE)
 	const existing = file_reader.read_file_or_empty(config_path)
 	const workspace = readFileSync(workspace_path, 'utf8')
-	const npmrc = file_reader.read_file_or_empty(path.join(root, NPMRC_FILE))
-	const merged = merge_project_config(existing, workspace, npmrc)
+	const merged = merge_project_config(existing, workspace)
 	if (merged === existing) return false
 	writeFileSync(config_path, merged)
 

package/scripts/sync/sync-ai-files.ts

@@ -71,7 +71,7 @@ function sync_workspace_yaml(
 	destination_path: string,
 	is_force = false,
 ): boolean {
-	const template = readFileSync(template_path, 'utf8')
+	const template = init_ai_copy.read_workspace_template(template_path, destination_path)
 	const existing = is_force ? '' : file_reader.read_file_or_empty(destination_path)
 	const merged = init_logic.merge_workspace_yaml(existing, template)
 

package/scripts/sync/sync-configs.ts

@@ -29,7 +29,8 @@ function sync_with_merge(
 	console.info(`  ✔ synced    ${destination_name}`)
 }
 
-// Append-only, and deliberately so: a `_authToken` line in the consumer's file is left alone.
+// Removes only the exact settings lines earlier kit releases wrote, which pnpm 12 ignores in
+// `.npmrc` (joshuafolkken/kit#3267); every other line, a `_authToken` line included, is left alone.
 // Sync used to remove the env-var form, which broke every project that had opted its project
 // .npmrc in via `npmrcAuthFile` — there the line is the live credential, and the opt-in itself
 // can live in a deploy platform's dashboard where sync cannot see it (joshuafolkken/kit#759).

package/scripts/sync/sync.ts

@@ -192,12 +192,23 @@ function sync_prepare_lefthook_warning(destination_path: string): void {
 	)
 }
 
+// The `preinstall` earlier kits wrote fetched safe-chain on every install (joshuafolkken/kit#3269);
+// `josh init` replaces it, and this covers everyone already initialized.
+function sync_safe_chain_preinstall(destination_path: string): void {
+	sync_package_json_with(
+		destination_path,
+		(existing) => init_logic.upgrade_safe_chain_preinstall(existing),
+		'  ✔ synced    preinstall safe-chain check',
+	)
+}
+
 // Every migration an already-initialized consumer needs applied to its own manifest, run as one
 // group so the next one is added here rather than at the call site.
 function sync_package_json_migrations(destination_path: string): void {
 	sync_package_manager_version(destination_path)
 	sync_secretlint_development_deps(destination_path)
 	sync_prepare_lefthook_warning(destination_path)
+	sync_safe_chain_preinstall(destination_path)
 }
 
 // Two distributed artifacts each depend on a repository setting kit cannot write, and both reports
@@ -230,8 +241,8 @@ function sync_project_artifacts(is_force: boolean): void {
 
 	sync_sonar_with_template(name_with_owner, is_force)
 	sync_config_files()
-	// After `sync_config_files`, which may add the `.npmrc` window `.aikido`'s age is derived from
-	// (joshuafolkken/kit#2743).
+	// After `sync_ai_copy_all`, which may add the `pnpm-workspace.yaml` window `.aikido`'s age is
+	// derived from (joshuafolkken/kit#2743, #3267).
 	project_config.sync_project_config(PROJECT_ROOT)
 	sync_package_json_migrations(path.join(PROJECT_ROOT, PACKAGE_JSON))
 	report_repository_settings(name_with_owner)
@@ -277,6 +288,8 @@ const sync = {
 	sync_package_manager_version,
 	sync_secretlint_development_deps,
 	sync_prepare_lefthook_warning,
+	sync_safe_chain_preinstall,
+	sync_package_json_migrations,
 	migrate_prettierrc: did_migrate_prettierrc,
 }
 

package/scripts/test/unit-worker-share.ts

@@ -227,6 +227,7 @@ async function with_run_marker<T>(run: () => Promise<T>): Promise<T> {
 const unit_worker_share = {
 	MIN_WORKERS,
 	NESTED_KEY,
+	NESTED_VALUE,
 	RUN_PREFIX,
 	SOLO_RUNS,
 	current_share,

package/scripts/time-runtime/time-background.ts

@@ -49,7 +49,11 @@ const NO_FINISH = 0
 
 // The launch's own result body, which is the only place the harness writes the id it assigns. Read
 // as a derived fact and the body discarded, exactly as `has_failure_line` and `followup_stages` are.
-const LAUNCH_PATTERN = /running in background with ID:\s*([\w-]+)/iu
+// **A foreground call that outran its timeout is a launch too** (joshuafolkken/kit#3304): the harness
+// moves it to the background and says so as `moved to the background (ID: <id>)`. Missing that spelling
+// let the #3273 lane child end its turn on a running task the stop hook never saw.
+const LAUNCH_PATTERN =
+	/(?:running in background with ID:|moved to the background \(ID:)\s*([\w-]+)/iu
 // A backgrounded subagent's launch result, which names its id on an `agentId:` line of its own.
 const AGENT_LAUNCH_PATTERN = /^Async agent launched[\s\S]*?\bagentId:\s*([\w-]+)/u
 // The notice the harness writes when a task it took into the background ends

package/scripts/time-runtime/time-instant.ts

@@ -10,7 +10,9 @@
 // clone `CLAUDE.md` prohibits, and the two copies would disagree the first time one of them learned
 // to accept another format.
 function parse_instant(raw: string | null | undefined): number | undefined {
-	const parsed = Date.parse(raw ?? '')
+	if (raw === null || raw === undefined) return undefined
+
+	const parsed = Date.parse(raw)
 
 	return Number.isNaN(parsed) ? undefined : parsed
 }

package/scripts/time-runtime/time-spans.ts

@@ -1,16 +1,14 @@
 import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
 import type { FollowupStage } from '#scripts/followup/git-followup-stages'
 import { time_background } from './time-background'
-import { time_bundle_call } from './time-bundle-call'
 import { time_followup_stage } from './time-followup-stage'
-import { time_markers, type PhaseMarker } from './time-markers'
 import { time_reported_failure } from './time-reported-failure'
 import { time_shell } from './time-shell'
-import { time_single_check } from './time-single-check'
+import { time_tool_call, type ToolCall } from './time-tool-call'
 import { time_transcript_line, type Block, type TranscriptLine } from './time-transcript-line'
-import { time_writes } from './time-writes'
 
 const { NO_MESSAGE_ID, parse_line } = time_transcript_line
+const { NO_CALL, UNKNOWN_CALL, UNKNOWN_TOOL, to_tool_call } = time_tool_call
 
 // Turning a session transcript into timed spans (joshuafolkken/kit#1267).
 //
@@ -24,6 +22,10 @@ const { NO_MESSAGE_ID, parse_line } = time_transcript_line
 // the move changed no call site. `cost_blocks`' three type constants are still imported rather than
 // restated.
 //
+// **Reading a `tool_use` block into a `ToolCall` is `time-tool-call.ts`'s** since
+// joshuafolkken/kit#3264, when this file reached its length limit again. `UNKNOWN_TOOL` and
+// `to_tool_call` are re-exported below, so that move changed no call site either.
+//
 // **The partition is by gap, not by pair.** Every span is the interval between two consecutive
 // events, classified by the *later* one: a span ending at an assistant line is model wait, one
 // ending at a tool result is that tool's execution, one ending at a user prompt is human wait.
@@ -34,7 +36,6 @@ const { NO_MESSAGE_ID, parse_line } = time_transcript_line
 
 const ASSISTANT_TYPE = 'assistant'
 const USER_TYPE = 'user'
-const UNKNOWN_TOOL = 'unknown'
 
 type SpanCategory = 'model' | 'tool' | 'human'
 
@@ -90,96 +91,6 @@ const NO_RESULT: ResultFacts = {
 	followup_stages: time_followup_stage.NO_STAGES,
 }
 
-// What a tool span is labelled with. `josh_command` is empty for everything that is not a
-// `pnpm josh <cmd>` invocation, and the report drops empty labels rather than printing a bucket.
-//
-// `marker` names the workflow boundary the call is, for the phase breakdown that slices the same
-// spans by stage (joshuafolkken/kit#1269). It is carried here rather than re-derived later because
-// the tool's *input* is what decides it, and a span keeps no input — only the label read off it.
-//
-// `is_bundleable` and `targets` are carried for exactly that reason too (joshuafolkken/kit#1344).
-// Whether a call could have gone out beside another, and what it names, are both read off the input —
-// so a module asking about them after the fact would have nothing to read. `time-bundle-call.ts`
-// decides both; the rule each one follows is stated there.
-//
-// `check_key` is the fourth, and the third time this reason has applied (joshuafolkken/kit#1383). Two
-// runs of one verification check are the same call only if they named the same files, and the files
-// are in the input — so `josh_command` alone cannot say, and nothing downstream could recover it.
-// `time-single-check.ts` decides it.
-//
-// `message_id` is the fifth, and it is the one that says which *turn* a call belongs to
-// (joshuafolkken/kit#1406). It is read off the line the `tool_use` block sat on rather than off the
-// result that closes the span, because a `tool_result` line carries no message id at all — so a span
-// that did not keep it here could never be attributed to the turn that issued it.
-//
-// `writes` is the sixth, and it is what `targets` could not say (joshuafolkken/kit#1472). `targets`
-// names what a call mentioned; `marker` says a call was *an* edit but not of what, and for a tool
-// outside `BUNDLEABLE_TOOLS` it arrived with no target at all. So a consumer subtracting edits from
-// reads — `investigation-reads.ts` — had nothing to subtract for `MultiEdit` / `NotebookEdit`, and
-// nothing at all to tell an in-place `sed -i` from the `sed -n` it shares a label with.
-// `time-writes.ts` decides it, from the input this span is about to discard.
-// `issue` is the seventh, and it is the one `branch` could not carry (joshuafolkken/kit#1617). Under
-// lanes the session writing the transcript stays on the default branch while the work runs in a linked
-// work tree, so `branch` names no issue on any line of the run; the `in-progress` label call does, and
-// like every field above it that answer is read off the *input* a span is about to discard.
-// `time_markers.NO_ISSUE` for every call that declares nothing, which is all but one call per run.
-interface ToolCall {
-	label: string
-	josh_command: string
-	// Every josh subcommand the call ran, where `josh_command` is only the first (joshuafolkken/kit#1883).
-	// A chained `pnpm josh lint:related && pnpm josh test:related` carries both; the count tables expand
-	// it so the ones `josh_command` drops are still counted.
-	josh_commands: ReadonlyArray<string>
-	check_key: string
-	marker: PhaseMarker
-	is_bundleable: boolean
-	targets: ReadonlyArray<string>
-	// Carried beside `targets` because sharing a target means something different depending on it: a
-	// second write to one file is independent work, a read of a file just written is not
-	// (joshuafolkken/kit#1509).
-	is_writing: boolean
-	// The conservative write answer `is_read_only_call` asks of a live call, carried so a reader of the
-	// transcript asks the same read-only question as the guard (joshuafolkken/kit#3139).
-	may_write: boolean
-	// Whether this is a subagent launch whose prompt builds on an earlier launch's finding
-	// (joshuafolkken/kit#1854). Carried for the reason every field here is — the prompt it is read from
-	// is the input, and a span keeps none. `time-agent-bundles.ts` reads it.
-	has_prior_reference: boolean
-	writes: ReadonlyArray<string>
-	message_id: string
-	issue: number
-	// The background run this call reads the output of, and `''` for every other call
-	// (joshuafolkken/kit#1662). It is the eighth field carried for the reason the seven above are:
-	// the id sits in the command string, which a span does not keep, and it is the only thing that
-	// says a `tail` two turns later is the join of a command started minutes ago.
-	reads_background: string
-}
-
-const NO_CALL: ToolCall = {
-	label: '',
-	josh_command: '',
-	josh_commands: [],
-	check_key: time_single_check.NO_CHECK,
-	marker: time_markers.NO_MARKER,
-	message_id: NO_MESSAGE_ID,
-	writes: [],
-	issue: time_markers.NO_ISSUE,
-	reads_background: time_background.NO_BACKGROUND,
-	...time_bundle_call.not_bundleable(),
-}
-const UNKNOWN_CALL: ToolCall = {
-	label: UNKNOWN_TOOL,
-	josh_command: '',
-	josh_commands: [],
-	check_key: time_single_check.NO_CHECK,
-	marker: time_markers.NO_MARKER,
-	message_id: NO_MESSAGE_ID,
-	writes: [],
-	issue: time_markers.NO_ISSUE,
-	reads_background: time_background.NO_BACKGROUND,
-	...time_bundle_call.not_bundleable(),
-}
-
 // `ended_ms` is the absolute instant the span closed, so `[ended_ms - duration_ms, ended_ms]` is the
 // interval it occupied. A duration alone cannot say *when*, and two things need that: the CI wait,
 // which is the part of the PR-open→merge window no span covers (joshuafolkken/kit#1268), and the
@@ -242,50 +153,6 @@ interface Timeline {
 	spans: Array<Span>
 }
 
-// Everything but Bash: the tool's own name is the label, and nothing it runs is a shell command to
-// read a check key, a josh command or a declared issue off.
-function non_bash_call(name: string, input: unknown, message_id: string): ToolCall {
-	return {
-		label: name,
-		josh_command: '',
-		josh_commands: [],
-		check_key: time_single_check.NO_CHECK,
-		marker: time_markers.tool_marker(name, input),
-		message_id,
-		writes: time_writes.tool_writes(name, input),
-		issue: time_markers.NO_ISSUE,
-		// A non-Bash tool joins a backgrounded command too — `BashOutput` carries the shell id in a
-		// field of its own, `Monitor` names the same `…/tasks/<id>.output` path in a command — so the
-		// same reader is asked here rather than the field being left empty for every tool but `Bash`.
-		reads_background: time_background.read_id_of(input),
-		...time_bundle_call.tool_facts(name, input),
-	}
-}
-
-function bash_call(input: unknown, message_id: string): ToolCall {
-	const command = time_shell.bash_command(input)
-	const josh_command = time_shell.josh_command_of(command)
-
-	return {
-		label: time_shell.bash_label(command),
-		josh_command,
-		josh_commands: time_shell.josh_commands_of(command),
-		check_key: time_single_check.check_key(josh_command, command),
-		marker: time_markers.bash_marker(command),
-		message_id,
-		writes: time_writes.bash_writes(command),
-		issue: time_markers.bash_issue(command),
-		reads_background: time_background.read_id_of(input),
-		...time_bundle_call.bash_facts(command),
-	}
-}
-
-function to_tool_call(name: string, input: unknown, message_id: string): ToolCall {
-	if (name !== cost_blocks.BASH_TOOL) return non_bash_call(name, input, message_id)
-
-	return bash_call(input, message_id)
-}
-
 // Identified calls only. A `tool_use` written without an `id` would otherwise be registered under
 // the empty string, where the next result that carries no `tool_use_id` would match it and be
 // labelled with an unrelated tool — a wrong name where `UNKNOWN_TOOL` is the honest one.

package/scripts/time-runtime/time-tool-call.ts

@@ -0,0 +1,160 @@
+import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
+import { time_background } from './time-background'
+import { time_bundle_call } from './time-bundle-call'
+import { time_markers, type PhaseMarker } from './time-markers'
+import { time_shell } from './time-shell'
+import { time_single_check } from './time-single-check'
+import { time_transcript_line } from './time-transcript-line'
+import { time_writes } from './time-writes'
+
+// Reading a `tool_use` block into the label a span carries — split out of `time-spans.ts` when it
+// reached its line limit (joshuafolkken/kit#3264). `time_spans` re-exports `UNKNOWN_TOOL` and
+// `to_tool_call` under the names they always had, so the move changed no call site.
+
+const { NO_MESSAGE_ID } = time_transcript_line
+
+const UNKNOWN_TOOL = 'unknown'
+
+// What a tool span is labelled with. `josh_command` is empty for everything that is not a
+// `pnpm josh <cmd>` invocation, and the report drops empty labels rather than printing a bucket.
+//
+// `marker` names the workflow boundary the call is, for the phase breakdown that slices the same
+// spans by stage (joshuafolkken/kit#1269). It is carried here rather than re-derived later because
+// the tool's *input* is what decides it, and a span keeps no input — only the label read off it.
+//
+// `is_bundleable` and `targets` are carried for exactly that reason too (joshuafolkken/kit#1344).
+// Whether a call could have gone out beside another, and what it names, are both read off the input —
+// so a module asking about them after the fact would have nothing to read. `time-bundle-call.ts`
+// decides both; the rule each one follows is stated there.
+//
+// `check_key` is the fourth, and the third time this reason has applied (joshuafolkken/kit#1383). Two
+// runs of one verification check are the same call only if they named the same files, and the files
+// are in the input — so `josh_command` alone cannot say, and nothing downstream could recover it.
+// `time-single-check.ts` decides it.
+//
+// `message_id` is the fifth, and it is the one that says which *turn* a call belongs to
+// (joshuafolkken/kit#1406). It is read off the line the `tool_use` block sat on rather than off the
+// result that closes the span, because a `tool_result` line carries no message id at all — so a span
+// that did not keep it here could never be attributed to the turn that issued it.
+//
+// `writes` is the sixth, and it is what `targets` could not say (joshuafolkken/kit#1472). `targets`
+// names what a call mentioned; `marker` says a call was *an* edit but not of what, and for a tool
+// outside `BUNDLEABLE_TOOLS` it arrived with no target at all. So a consumer subtracting edits from
+// reads — `investigation-reads.ts` — had nothing to subtract for `MultiEdit` / `NotebookEdit`, and
+// nothing at all to tell an in-place `sed -i` from the `sed -n` it shares a label with.
+// `time-writes.ts` decides it, from the input this span is about to discard.
+// `issue` is the seventh, and it is the one `branch` could not carry (joshuafolkken/kit#1617). Under
+// lanes the session writing the transcript stays on the default branch while the work runs in a linked
+// work tree, so `branch` names no issue on any line of the run; the `in-progress` label call does, and
+// like every field above it that answer is read off the *input* a span is about to discard.
+// `time_markers.NO_ISSUE` for every call that declares nothing, which is all but one call per run.
+interface ToolCall {
+	label: string
+	josh_command: string
+	// Every josh subcommand the call ran, where `josh_command` is only the first (joshuafolkken/kit#1883).
+	// A chained `pnpm josh lint:related && pnpm josh test:related` carries both; the count tables expand
+	// it so the ones `josh_command` drops are still counted.
+	josh_commands: ReadonlyArray<string>
+	check_key: string
+	marker: PhaseMarker
+	is_bundleable: boolean
+	targets: ReadonlyArray<string>
+	// Carried beside `targets` because sharing a target means something different depending on it: a
+	// second write to one file is independent work, a read of a file just written is not
+	// (joshuafolkken/kit#1509).
+	is_writing: boolean
+	// The conservative write answer `is_read_only_call` asks of a live call, carried so a reader of the
+	// transcript asks the same read-only question as the guard (joshuafolkken/kit#3139).
+	may_write: boolean
+	// Whether this is a subagent launch whose prompt builds on an earlier launch's finding
+	// (joshuafolkken/kit#1854). Carried for the reason every field here is — the prompt it is read from
+	// is the input, and a span keeps none. `time-agent-bundles.ts` reads it.
+	has_prior_reference: boolean
+	writes: ReadonlyArray<string>
+	message_id: string
+	issue: number
+	// The background run this call reads the output of, and `''` for every other call
+	// (joshuafolkken/kit#1662). It is the eighth field carried for the reason the seven above are:
+	// the id sits in the command string, which a span does not keep, and it is the only thing that
+	// says a `tail` two turns later is the join of a command started minutes ago.
+	reads_background: string
+}
+
+const NO_CALL: ToolCall = {
+	label: '',
+	josh_command: '',
+	josh_commands: [],
+	check_key: time_single_check.NO_CHECK,
+	marker: time_markers.NO_MARKER,
+	message_id: NO_MESSAGE_ID,
+	writes: [],
+	issue: time_markers.NO_ISSUE,
+	reads_background: time_background.NO_BACKGROUND,
+	...time_bundle_call.not_bundleable(),
+}
+const UNKNOWN_CALL: ToolCall = {
+	label: UNKNOWN_TOOL,
+	josh_command: '',
+	josh_commands: [],
+	check_key: time_single_check.NO_CHECK,
+	marker: time_markers.NO_MARKER,
+	message_id: NO_MESSAGE_ID,
+	writes: [],
+	issue: time_markers.NO_ISSUE,
+	reads_background: time_background.NO_BACKGROUND,
+	...time_bundle_call.not_bundleable(),
+}
+
+// Everything but Bash: the tool's own name is the label, and nothing it runs is a shell command to
+// read a check key, a josh command or a declared issue off.
+function non_bash_call(name: string, input: unknown, message_id: string): ToolCall {
+	return {
+		label: name,
+		josh_command: '',
+		josh_commands: [],
+		check_key: time_single_check.NO_CHECK,
+		marker: time_markers.tool_marker(name, input),
+		message_id,
+		writes: time_writes.tool_writes(name, input),
+		issue: time_markers.NO_ISSUE,
+		// A non-Bash tool joins a backgrounded command too — `BashOutput` carries the shell id in a
+		// field of its own, `Monitor` names the same `…/tasks/<id>.output` path in a command — so the
+		// same reader is asked here rather than the field being left empty for every tool but `Bash`.
+		reads_background: time_background.read_id_of(input),
+		...time_bundle_call.tool_facts(name, input),
+	}
+}
+
+function bash_call(input: unknown, message_id: string): ToolCall {
+	const command = time_shell.bash_command(input)
+	const josh_command = time_shell.josh_command_of(command)
+
+	return {
+		label: time_shell.bash_label(command),
+		josh_command,
+		josh_commands: time_shell.josh_commands_of(command),
+		check_key: time_single_check.check_key(josh_command, command),
+		marker: time_markers.bash_marker(command),
+		message_id,
+		writes: time_writes.bash_writes(command),
+		issue: time_markers.bash_issue(command),
+		reads_background: time_background.read_id_of(input),
+		...time_bundle_call.bash_facts(command),
+	}
+}
+
+function to_tool_call(name: string, input: unknown, message_id: string): ToolCall {
+	if (name !== cost_blocks.BASH_TOOL) return non_bash_call(name, input, message_id)
+
+	return bash_call(input, message_id)
+}
+
+const time_tool_call = {
+	UNKNOWN_TOOL,
+	NO_CALL,
+	UNKNOWN_CALL,
+	to_tool_call,
+}
+
+export type { ToolCall }
+export { time_tool_call }

package/scripts/version/effective-upstream.ts

@@ -1,13 +1,11 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import path from 'node:path'
+import { ancestor_directories } from '#scripts/lib/ancestor-directories'
 import { json_value } from '#scripts/lib/json-value'
 import { package_named_version_schema } from '#scripts/lib/schemas'
 
 const PACKAGE_JSON = 'package.json'
-// Node module paths never nest anywhere near this deep; the bound only guards against an unexpected
-// filesystem cycle so the walk-up cannot loop forever.
-const MAX_WALK_DEPTH = 64
 
 // Options for `resolve_effective_upstream_version`. `resolve_marker` is a subpath specifier used for
 // `createRequire().resolve()` when the package root itself is not directly resolvable — e.g. kit does
@@ -31,26 +29,10 @@ function read_matching_version(manifest_path: string, package_name: string): str
 	return parsed.data.version
 }
 
-// The directory itself and each of its ancestors up to the filesystem root, nearest-first. Bounded
-// by MAX_WALK_DEPTH so an unexpected filesystem cycle cannot produce an unbounded list.
-function ancestor_directories(start_directory: string): Array<string> {
-	const directories: Array<string> = []
-	let current = start_directory
-
-	for (let depth = 0; depth < MAX_WALK_DEPTH; depth += 1) {
-		directories.push(current)
-		const parent = path.dirname(current)
-		if (parent === current) break
-		current = parent
-	}
-
-	return directories
-}
-
 // Walk up from a resolved file's directory to the package root, returning the version of the first
 // ancestor package.json whose `name` matches the target — or undefined when no matching root exists.
 function walk_up_for_version(start_directory: string, package_name: string): string | undefined {
-	for (const directory of ancestor_directories(start_directory)) {
+	for (const directory of ancestor_directories.list(start_directory)) {
 		const version = read_matching_version(path.join(directory, PACKAGE_JSON), package_name)
 		if (version !== undefined) return version
 	}

package/scripts/version/latest-corepack.ts

@@ -11,12 +11,12 @@
  * major equals the `packageManager` pin keeps both invariants: never below the adopted
  * major, and advancing while that major is the current one.
  *
- * The `minimum-release-age` quarantine is applied natively from `.npmrc` (kit#768).
- * safe-chain filters the registry only when the process tree was launched through one of
- * its wrapped shell commands, so `josh latest` and `pnpm josh latest` used to resolve
+ * The `minimumReleaseAge` quarantine is applied natively from `pnpm-workspace.yaml` (kit#768,
+ * #3267). safe-chain filters the registry only when the process tree was launched through one
+ * of its wrapped shell commands, so `josh latest` and `pnpm josh latest` used to resolve
  * different answers and the pin oscillated. Reading the window from the repo-managed
- * `.npmrc` and filtering by publish timestamp makes the resolution identical in every
- * invocation context; right after a pnpm release the answer is simply the previous
+ * `pnpm-workspace.yaml` and filtering by publish timestamp makes the resolution identical in
+ * every invocation context; right after a pnpm release the answer is simply the previous
  * release, exactly as the filtered view behaved.
  *
  * The resolved version is floored at the current `packageManager` pin: a filtered registry
@@ -38,6 +38,7 @@
 import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { json_value } from '#scripts/lib/json-value'
+import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import semver from 'semver'
 import { z } from 'zod'
@@ -49,8 +50,7 @@ const PACKAGE_MANAGER_RE = /"packageManager"\s*:\s*"pnpm@(\d+)(?:[^\d]|$)/u
 const PINNED_VERSION_RE = /"packageManager"\s*:\s*"pnpm@([^"+]+)/u
 const TARGET_PREFIX = 'pnpm@'
 const FAILURE_EXIT_CODE = 1
-const NPMRC_PATH = '.npmrc'
-const VIEW_TIMEOUT_MS = 30_000
+const WORKSPACE_PATH = 'pnpm-workspace.yaml'
 const SHA512_BYTES = 64
 const INTEGRITY_RE = /^sha512-([A-Za-z0-9+/]+={0,2})$/u
 const PACKAGE_MANAGER_VALUE_RE = /("packageManager"\s*:\s*")pnpm@[^"]+(")/u
@@ -121,7 +121,7 @@ function extract_times_json(stdout: string): Record<string, string> | undefined
 function query_release_times(): Record<string, string> | undefined {
 	const result = execaSync('pnpm', ['view', 'pnpm', 'time', '--json'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
 
@@ -134,14 +134,14 @@ function query_major_latest_version(major: string): string | undefined {
 	const times = query_release_times()
 	if (times === undefined) return undefined
 
-	// The project's own `.npmrc`, deliberately not the upward walk the version check uses: `josh
-	// latest` reads `package.json` and writes the pnpm pin relative to the working directory, so it
-	// has no subdirectory case — and honouring a user-level policy here could freeze pnpm bumps in a
-	// project that declares none (joshuafolkken/kit#808).
+	// The project's own `pnpm-workspace.yaml`, deliberately not the upward walk the version check
+	// uses: `josh latest` reads `package.json` and writes the pnpm pin relative to the working
+	// directory, so it has no subdirectory case — and honouring an ancestor's policy here could freeze
+	// pnpm bumps in a project that declares none (joshuafolkken/kit#808).
 	return release_age.select_aged_version(
 		times,
 		major,
-		release_age.read_minimum_release_age(NPMRC_PATH),
+		release_age.read_minimum_release_age(WORKSPACE_PATH),
 		Date.now(),
 	)
 }
@@ -156,7 +156,7 @@ function parse_latest_version(stdout: string): string | undefined {
 function query_latest_version(): string | undefined {
 	const result = execaSync('pnpm', ['view', 'pnpm', 'version', '--json'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
 
@@ -179,8 +179,8 @@ function warn_skip(reason: string): void {
 	console.warn(`⚠ Skipped pnpm bump (${reason}); the chain continues.`)
 }
 
-function warn_unresolved(major: string | undefined): void {
-	warn_skip(`no pnpm ${major ?? ''} release resolvable from the registry`)
+function warn_unresolved(major: string | undefined = ''): void {
+	warn_skip(`no pnpm ${major} release resolvable from the registry`)
 }
 
 function run_pnpm_update(target: string): number {
@@ -247,7 +247,7 @@ function extract_encoded_integrity(stdout: string): string | undefined {
 function query_integrity(target: string): string | undefined {
 	const result = execaSync('pnpm', ['view', target, 'dist.integrity', '--json'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined