@joshuafolkken/kit 1.1178.0 → 1.1240.0

package/scripts/run/{run-wake.ts → wake/run-wake.ts}

@@ -3,8 +3,8 @@ import { backlog_budget } from '#scripts/backlog/backlog-budget'
 import { process_identity } from '#scripts/josh/process-identity'
 import { process_owner_schema } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
+import type { CarryRead } from '#scripts/run/carry/run-carry'
 import { z } from 'zod'
-import type { CarryRead } from './run-carry'
 
 // joshuafolkken/kit#1719. joshuafolkken/kit#1714 made a `backlogrun`'s budget survive the session cut
 // and left out the one thing that starts the next session, so the record was carried and the
@@ -126,14 +126,6 @@ interface RunWake {
 	// session that is merely slow is still doing the run's work, and a supervisor that killed what it
 	// could not account for would destroy exactly the work it exists to keep going.
 	woke_pid?: number | undefined
-	// When the wait on a still-running predecessor began. **It is its own field rather than a second
-	// use of `woke_at`, and that is the whole of the bound working as described.** Marked on `woke_at`,
-	// the first pass of a wait was the last one that could see the predecessor exit — every later pass
-	// read the mark as an outstanding wake and answered `pending` — so a predecessor that ended two
-	// seconds after the hold still cost the full grace window on a supervisor whose point is not to
-	// stall. Kept apart, the predecessor's liveness is read on every pass and the mark only bounds how
-	// long the wait may last.
-	held_at?: string | undefined
 	// The transcript ids of every session this supervisor forced with `--session-id`
 	// (joshuafolkken/kit#2407). `josh time --run` attributes a whiff only to a session in this list, so
 	// an unrelated read-only session that moved while the supervisor was alive is no longer counted
@@ -164,7 +156,6 @@ type WakeDecision =
 	| { kind: 'idle' }
 	| { kind: 'wait' }
 	| { kind: 'pending' }
-	| { kind: 'hold' }
 	| { kind: 'failed' }
 	| { kind: 'stop'; reason: WakeStopReason }
 
@@ -172,16 +163,16 @@ interface WakeDecisionInput {
 	read: CarryRead
 	woke_at: string | undefined
 	attempts: number
-	// Whether the process named on the carry record is still running. **A cut is the run's last write,
-	// not the moment its process is gone** — so a supervisor that woke the instant it saw the hand-off
-	// could have the new session answered `busy`, because `run-carry.ts` → `classify_claim` tests
-	// `is_foreign_live_owner` before it tests the hand-off. Answered `busy`, the woken session stops
-	// without claiming anything, and the supervisor would eventually call its own wake a failure and end
-	// the run. So the predecessor is waited out first.
+	// Whether the process named on the carry record is still running — read only for a record no cut
+	// handed off, where it tells a session at work from a crashed one (`decide_not_handed_off`).
+	//
+	// **A handed-off record is launched from whether its cutting process lives or not**
+	// (joshuafolkken/kit#3363). The supervisor used to wait that process out, for up to the grace
+	// window, because `run-carry.ts` → `classify_claim` once tested liveness before the hand-off and
+	// would have answered the successor `busy`. joshuafolkken/kit#1935 put the hand-off first, so the
+	// wait guarded nothing — and an interactive session outlives its own cut, so every cut paid the
+	// whole ten minutes before the driver started.
 	is_owner_live: boolean
-	// When the wait on that predecessor began, so the wait can be bounded without spending the mark
-	// that measures a launch.
-	held_at: string | undefined
 	// **Whether a woken session would find anything to do** (joshuafolkken/kit#2417). Before this the
 	// decision read the carry record alone, so a session was launched whether or not the backlog held a
 	// runnable issue or a lane was free — and a session that found nothing ended without touching
@@ -198,7 +189,6 @@ const WAKE_DECISION: WakeDecision = { kind: 'wake' }
 const IDLE_DECISION: WakeDecision = { kind: 'idle' }
 const WAIT_DECISION: WakeDecision = { kind: 'wait' }
 const PENDING_DECISION: WakeDecision = { kind: 'pending' }
-const HOLD_DECISION: WakeDecision = { kind: 'hold' }
 const FAILED_DECISION: WakeDecision = { kind: 'failed' }
 
 // The three carry reads that are not `carried`, each mapped to why the supervisor stops. `none` is the
@@ -220,7 +210,6 @@ const run_wake_schema = process_owner_schema.extend({
 	// reads as "no attempt has been made yet" and would restart the retry count on every pass.
 	attempts: z.number().optional(),
 	woke_pid: z.number().optional(),
-	held_at: z.string().optional(),
 	spawned: z.array(z.string()).optional(),
 	idle_since: z.string().optional(),
 	profile: agent_role_profile.PROFILE_SCHEMA.optional(),
@@ -279,32 +268,10 @@ function decide_not_handed_off(input: WakeDecisionInput): WakeDecision {
 	return decide_launch(input)
 }
 
-// Only before the first launch for this cut. Once a wake is out, the record's owner is whatever the
-// woken session declares, and waiting on it again would stall the grace window indefinitely.
-//
-// **The wait is bounded, and the bound is not decoration.** The owner is the agent process of the
-// session that cut, and an interactive one often outlives its own cut — waited on without a bound, the
-// supervisor would pend every interval for the record's whole life, wake nothing, and end on `expired`,
-// which sends no warning. That is a silent overnight failure, which is worse than the `busy` race this
-// wait exists to avoid: a `busy` merely costs one attempt, and attempts are retried. So the wait is
-// marked when it starts and expires into an ordinary wake through the same grace window everything
-// else uses.
-//
-// **And the wait ends the moment the predecessor does, because its liveness is read on every pass.**
-// The bound is the ceiling on the wait, never its length: a predecessor that exits two seconds after
-// the hold is waited two seconds. That is what `held_at` is a separate field for — marked on `woke_at`,
-// this test could not fire a second time, so every wait cost the whole ceiling.
-function is_predecessor_exiting(input: WakeDecisionInput): boolean {
-	if (input.woke_at !== undefined || !input.is_owner_live) return false
-
-	return input.held_at === undefined || !is_overdue(input.held_at, input.now)
-}
-
-// The whole policy, in four lines. Nothing else in this module decides whether to wake.
+// The whole policy, in three lines. Nothing else in this module decides whether to wake.
 function decide(input: WakeDecisionInput): WakeDecision {
 	if (input.read.kind !== 'carried') return { kind: 'stop', reason: STOP_REASONS[input.read.kind] }
 	if (input.read.carry.is_handed_off !== true) return decide_not_handed_off(input)
-	if (is_predecessor_exiting(input)) return HOLD_DECISION
 
 	return decide_launch(input)
 }
@@ -367,10 +334,9 @@ function is_supervisor_live(wake: RunWake): boolean {
 // inside the grace window would otherwise see no wake mark, launch a second session for the *same*
 // cut, count it as another cut served, and leave two sessions racing for one record. The invocation
 // has to match — a different one is a different run, and its state is not this one's.
-// **`woke_pid` and `held_at` come across too.** Without the first, a restart inside the grace window
-// that then spends its retries reports "the last one was none" in the warning — the one fact the
-// warning exists to hand the person, dropped exactly where it is needed. Without the second, a restart
-// restarts the bounded wait, which is the ceiling sliding by another road.
+// **`woke_pid` comes across too.** Without it, a restart inside the grace window that then spends its
+// retries reports "the last one was none" in the warning — the one fact the warning exists to hand the
+// person, dropped exactly where it is needed.
 function carried_state(existing: RunWake | undefined, invocation: string): Partial<RunWake> {
 	if (existing?.invocation !== invocation) return { woke: NO_WAKES }
 
@@ -379,7 +345,6 @@ function carried_state(existing: RunWake | undefined, invocation: string): Parti
 		woke_at: existing.woke_at,
 		attempts: existing.attempts,
 		woke_pid: existing.woke_pid,
-		held_at: existing.held_at,
 		// **`spawned` carries across too, or a restart mid-run would lose the ids of every session it
 		// already started** (joshuafolkken/kit#2407) — and `josh time --run`, reading the record after
 		// the restart, would under-count the whiffs and read the loss as a saving.
@@ -447,24 +412,12 @@ function count_wake(wake: RunWake, now: Date, pid: number, session_id: string):
 		spawned,
 		woke_at,
 		woke_pid: pid,
-		held_at: undefined,
 		idle_since: undefined,
 	}
 }
 
-// Starts the clock on a wait without launching anything. `attempts` is deliberately untouched, so the
-// bounded wait costs no retry: what it buys is that the wait expires into an ordinary wake instead of
-// running until the carry record does.
-//
-// **Marked once, so the ceiling does not slide.** A mark rewritten on every pass would measure from the
-// latest pass rather than from the start of the wait, and a predecessor that never exits would then be
-// waited on for ever — the unbounded wait this bound exists to prevent, arrived at by another road.
-function mark_wait(wake: RunWake, now: Date): RunWake {
-	return wake.held_at === undefined ? { ...wake, held_at: now.toISOString() } : wake
-}
-
-// Starts the idle stretch a deferred launch is bounded by (joshuafolkken/kit#2417). Marked once, for
-// the reason `mark_wait` is: rewritten each pass, the ceiling would slide and never be reached.
+// Starts the idle stretch a deferred launch is bounded by (joshuafolkken/kit#2417). Marked once:
+// rewritten each pass, the ceiling would slide and never be reached.
 function mark_idle(wake: RunWake, now: Date): RunWake {
 	return wake.idle_since === undefined ? { ...wake, idle_since: now.toISOString() } : wake
 }
@@ -489,7 +442,6 @@ function count_claim(wake: RunWake): RunWake {
 		woke,
 		woke_at: undefined,
 		attempts: undefined,
-		held_at: undefined,
 		idle_since: undefined,
 	}
 }
@@ -589,7 +541,6 @@ const run_wake = {
 	fresh_wake,
 	is_supervisor_live,
 	mark_idle,
-	mark_wait,
 	parse_wake,
 	read_own_wake,
 	read_wake,

package/scripts/safe-chain/preinstall-command.ts

@@ -1,38 +1,37 @@
-// `setup-ci` only writes shims and adds them to PATH on a CI runner, so a local `pnpm install` is
-// scanned only when the developer has enabled safe-chain's own shell integration. That integration
-// runs pnpm behind safe-chain's registry proxy and hands `GLOBAL_AGENT_HTTP_PROXY` to it, which a bare
-// pnpm never sets — the one signal a lifecycle script can read (joshuafolkken/kit#2707).
-const SETUP_CI_CMD = 'pnpm dlx @aikidosec/safe-chain setup-ci'
-const LEGACY_PREINSTALL_RE = /^pnpm dlx @aikidosec\/safe-chain(?:@\S+)? setup-ci$/u
+// The `preinstall` kit writes fetches nothing: it only checks that safe-chain is scanning the install
+// and warns when it is not (joshuafolkken/kit#3269). It used to run `pnpm dlx @aikidosec/safe-chain
+// setup-ci`, which downloaded an unverified package on every install and — `setup-ci` acting only on
+// a CI runner, where kit installs with `--ignore-scripts` — protected nothing. safe-chain's shell
+// integration runs pnpm behind its registry proxy and hands `GLOBAL_AGENT_HTTP_PROXY` to it, which a
+// bare pnpm never sets — the one signal a lifecycle script can read (joshuafolkken/kit#2707).
+const INSTALL_GUIDE_ANCHOR = 'installing-safe-chain'
+const INSTALL_GUIDE_URL = `https://github.com/joshuafolkken/kit/blob/main/SECURITY.md#${INSTALL_GUIDE_ANCHOR}`
+// `.pnpmfile.mjs` recognizes the command by the package name, so the hint names it.
 const INTEGRATION_HINT =
-	'Warning: safe-chain is not scanning this install because its shell integration is not active.' +
-	' Install safe-chain (https://github.com/AikidoSec/safe-chain#installation) or run: safe-chain setup' +
+	'Warning: safe-chain (@aikidosec/safe-chain) is not scanning this install because its shell' +
+	` integration is not active. Install it with the hash-verified steps at ${INSTALL_GUIDE_URL}` +
 	' - then restart your terminal.'
 // `preinstall` runs before any dependency is installed, kit included, so the check is plain Node with
 // no imports. It never fails the install and stays silent on CI, where the runner is set up instead.
 // The source avoids double quotes, `$` and backticks so the shell passes it to Node verbatim.
 const LOCAL_INTEGRATION_CHECK_SOURCE = `if(!process.env.CI&&!process.env.GLOBAL_AGENT_HTTP_PROXY)console.warn('${INTEGRATION_HINT}')`
-const LOCAL_INTEGRATION_CHECK_CMD = `node -e "${LOCAL_INTEGRATION_CHECK_SOURCE}"`
+const SAFE_CHAIN_CMD = `node -e "${LOCAL_INTEGRATION_CHECK_SOURCE}"`
+// Every `preinstall` an earlier kit wrote: `setup-ci` alone, pinned or not, or followed by the
+// `node -e` check of any earlier wording.
+const LEGACY_PREINSTALL_RE =
+	/^pnpm dlx @aikidosec\/safe-chain(?:@\S+)? setup-ci(?: && node -e "[^"]*")?$/u
 
-function with_local_check(setup_command: string): string {
-	return `${setup_command} && ${LOCAL_INTEGRATION_CHECK_CMD}`
-}
-
-// Upgrade a `preinstall` kit wrote before the check existed, pinned version included; any other
-// value is the consumer's own and is left exactly as it is.
+// Replace a `preinstall` kit wrote earlier; any other value is the consumer's own and is left exactly
+// as it is.
 function migrate_preinstall(value: string): string {
-	if (!LEGACY_PREINSTALL_RE.test(value)) return value
-
-	return with_local_check(value)
+	return LEGACY_PREINSTALL_RE.test(value) ? SAFE_CHAIN_CMD : value
 }
 
-const SAFE_CHAIN_CMD = with_local_check(SETUP_CI_CMD)
-
 const safe_chain_preinstall = {
 	SAFE_CHAIN_CMD,
-	LOCAL_INTEGRATION_CHECK_CMD,
 	LOCAL_INTEGRATION_CHECK_SOURCE,
 	INTEGRATION_HINT,
+	INSTALL_GUIDE_ANCHOR,
 	migrate_preinstall,
 }
 

package/scripts/safe-chain/project-config.ts

@@ -8,7 +8,6 @@ import { z } from 'zod'
 
 const WORKSPACE_FILE = 'pnpm-workspace.yaml'
 const PROJECT_CONFIG_FILE = '.aikido'
-const NPMRC_FILE = '.npmrc'
 const EXCLUSIONS_FIELD = 'minimumPackageAgeExclusions'
 const AGE_FIELD = 'minimumPackageAgeHours'
 const MINUTES_PER_HOUR = 60
@@ -78,18 +77,22 @@ function replace_safe_chain_block(existing: string, safe_chain: Record<string, u
 }
 
 // Safe Chain enforces its own minimum package age (48 hours by default), so CI refused lockfiles pnpm
-// had resolved under `.npmrc`'s shorter window (kit #2743). `.npmrc` is the source: its minutes are
-// floored to whole hours so Safe Chain is never stricter than pnpm, and an undeclared window writes
-// nothing; an explicit `0` opt-out is written as 0 so an earlier synchronized age cannot outlive it.
-function package_age_hours(npmrc: string): number | undefined {
-	const minutes = release_age.parse_declared_minimum_release_age(npmrc)
+// had resolved under pnpm's shorter window (kit #2743). The workspace's `minimumReleaseAge` is the
+// source: its minutes are floored to whole hours so Safe Chain is never stricter than pnpm, and an
+// undeclared window writes nothing; an explicit `0` opt-out is written as 0 so an earlier
+// synchronized age cannot outlive it.
+function package_age_hours(workspace: string): number | undefined {
+	const minutes = release_age.parse_declared_minimum_release_age(workspace)
 	if (minutes === undefined) return undefined
 
 	return Math.floor(minutes / MINUTES_PER_HOUR)
 }
 
-function merge_age(safe_chain: Record<string, unknown>, npmrc: string): Record<string, unknown> {
-	const hours = package_age_hours(npmrc)
+function merge_age(
+	safe_chain: Record<string, unknown>,
+	workspace: string,
+): Record<string, unknown> {
+	const hours = package_age_hours(workspace)
 	if (hours === undefined) return safe_chain
 
 	return { ...safe_chain, [AGE_FIELD]: hours }
@@ -107,22 +110,24 @@ function merge_exclusions(
 function has_nothing_to_write(
 	existing: string,
 	exclusions: ReadonlyArray<string>,
-	npmrc: string,
+	workspace: string,
 ): boolean {
-	return existing.length === 0 && exclusions.length === 0 && package_age_hours(npmrc) === undefined
+	return (
+		existing.length === 0 && exclusions.length === 0 && package_age_hours(workspace) === undefined
+	)
 }
 
 function read_exclusions(workspace: string): ReadonlyArray<string> {
 	return workspace_schema.parse(yaml_document.parse_yaml(workspace)).minimumReleaseAgeExclude ?? []
 }
 
-function merge_project_config(existing: string, workspace: string, npmrc = ''): string {
+function merge_project_config(existing: string, workspace: string): string {
 	const exclusions = read_exclusions(workspace)
 	const aikido = yaml_document.parse_yaml(existing)
 	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
-	const merged = merge_age(merge_exclusions(safe_chain, exclusions), npmrc)
+	const merged = merge_age(merge_exclusions(safe_chain, exclusions), workspace)
 	if (JSON.stringify(merged) === JSON.stringify(safe_chain)) return existing
-	if (has_nothing_to_write(existing, exclusions, npmrc)) return existing
+	if (has_nothing_to_write(existing, exclusions, workspace)) return existing
 
 	return replace_safe_chain_block(existing, merged)
 }
@@ -133,8 +138,7 @@ function sync_project_config(root: string): boolean {
 	const config_path = path.join(root, PROJECT_CONFIG_FILE)
 	const existing = file_reader.read_file_or_empty(config_path)
 	const workspace = readFileSync(workspace_path, 'utf8')
-	const npmrc = file_reader.read_file_or_empty(path.join(root, NPMRC_FILE))
-	const merged = merge_project_config(existing, workspace, npmrc)
+	const merged = merge_project_config(existing, workspace)
 	if (merged === existing) return false
 	writeFileSync(config_path, merged)
 

package/scripts/sync/sync-ai-files.ts

@@ -71,7 +71,7 @@ function sync_workspace_yaml(
 	destination_path: string,
 	is_force = false,
 ): boolean {
-	const template = readFileSync(template_path, 'utf8')
+	const template = init_ai_copy.read_workspace_template(template_path, destination_path)
 	const existing = is_force ? '' : file_reader.read_file_or_empty(destination_path)
 	const merged = init_logic.merge_workspace_yaml(existing, template)
 

package/scripts/sync/sync-configs.ts

@@ -29,7 +29,8 @@ function sync_with_merge(
 	console.info(`  ✔ synced    ${destination_name}`)
 }
 
-// Append-only, and deliberately so: a `_authToken` line in the consumer's file is left alone.
+// Removes only the exact settings lines earlier kit releases wrote, which pnpm 12 ignores in
+// `.npmrc` (joshuafolkken/kit#3267); every other line, a `_authToken` line included, is left alone.
 // Sync used to remove the env-var form, which broke every project that had opted its project
 // .npmrc in via `npmrcAuthFile` — there the line is the live credential, and the opt-in itself
 // can live in a deploy platform's dashboard where sync cannot see it (joshuafolkken/kit#759).

package/scripts/sync/sync.ts

@@ -192,12 +192,23 @@ function sync_prepare_lefthook_warning(destination_path: string): void {
 	)
 }
 
+// The `preinstall` earlier kits wrote fetched safe-chain on every install (joshuafolkken/kit#3269);
+// `josh init` replaces it, and this covers everyone already initialized.
+function sync_safe_chain_preinstall(destination_path: string): void {
+	sync_package_json_with(
+		destination_path,
+		(existing) => init_logic.upgrade_safe_chain_preinstall(existing),
+		'  ✔ synced    preinstall safe-chain check',
+	)
+}
+
 // Every migration an already-initialized consumer needs applied to its own manifest, run as one
 // group so the next one is added here rather than at the call site.
 function sync_package_json_migrations(destination_path: string): void {
 	sync_package_manager_version(destination_path)
 	sync_secretlint_development_deps(destination_path)
 	sync_prepare_lefthook_warning(destination_path)
+	sync_safe_chain_preinstall(destination_path)
 }
 
 // Two distributed artifacts each depend on a repository setting kit cannot write, and both reports
@@ -230,8 +241,8 @@ function sync_project_artifacts(is_force: boolean): void {
 
 	sync_sonar_with_template(name_with_owner, is_force)
 	sync_config_files()
-	// After `sync_config_files`, which may add the `.npmrc` window `.aikido`'s age is derived from
-	// (joshuafolkken/kit#2743).
+	// After `sync_ai_copy_all`, which may add the `pnpm-workspace.yaml` window `.aikido`'s age is
+	// derived from (joshuafolkken/kit#2743, #3267).
 	project_config.sync_project_config(PROJECT_ROOT)
 	sync_package_json_migrations(path.join(PROJECT_ROOT, PACKAGE_JSON))
 	report_repository_settings(name_with_owner)
@@ -277,6 +288,8 @@ const sync = {
 	sync_package_manager_version,
 	sync_secretlint_development_deps,
 	sync_prepare_lefthook_warning,
+	sync_safe_chain_preinstall,
+	sync_package_json_migrations,
 	migrate_prettierrc: did_migrate_prettierrc,
 }
 

package/scripts/test/unit-worker-share.ts

@@ -227,6 +227,7 @@ async function with_run_marker<T>(run: () => Promise<T>): Promise<T> {
 const unit_worker_share = {
 	MIN_WORKERS,
 	NESTED_KEY,
+	NESTED_VALUE,
 	RUN_PREFIX,
 	SOLO_RUNS,
 	current_share,

package/scripts/time-runtime/time-background.ts

@@ -49,7 +49,11 @@ const NO_FINISH = 0
 
 // The launch's own result body, which is the only place the harness writes the id it assigns. Read
 // as a derived fact and the body discarded, exactly as `has_failure_line` and `followup_stages` are.
-const LAUNCH_PATTERN = /running in background with ID:\s*([\w-]+)/iu
+// **A foreground call that outran its timeout is a launch too** (joshuafolkken/kit#3304): the harness
+// moves it to the background and says so as `moved to the background (ID: <id>)`. Missing that spelling
+// let the #3273 lane child end its turn on a running task the stop hook never saw.
+const LAUNCH_PATTERN =
+	/(?:running in background with ID:|moved to the background \(ID:)\s*([\w-]+)/iu
 // A backgrounded subagent's launch result, which names its id on an `agentId:` line of its own.
 const AGENT_LAUNCH_PATTERN = /^Async agent launched[\s\S]*?\bagentId:\s*([\w-]+)/u
 // The notice the harness writes when a task it took into the background ends

package/scripts/time-runtime/time-instant.ts

@@ -10,7 +10,9 @@
 // clone `CLAUDE.md` prohibits, and the two copies would disagree the first time one of them learned
 // to accept another format.
 function parse_instant(raw: string | null | undefined): number | undefined {
-	const parsed = Date.parse(raw ?? '')
+	if (raw === null || raw === undefined) return undefined
+
+	const parsed = Date.parse(raw)
 
 	return Number.isNaN(parsed) ? undefined : parsed
 }

package/scripts/time-runtime/time-spans.ts

@@ -1,16 +1,14 @@
 import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
 import type { FollowupStage } from '#scripts/followup/git-followup-stages'
 import { time_background } from './time-background'
-import { time_bundle_call } from './time-bundle-call'
 import { time_followup_stage } from './time-followup-stage'
-import { time_markers, type PhaseMarker } from './time-markers'
 import { time_reported_failure } from './time-reported-failure'
 import { time_shell } from './time-shell'
-import { time_single_check } from './time-single-check'
+import { time_tool_call, type ToolCall } from './time-tool-call'
 import { time_transcript_line, type Block, type TranscriptLine } from './time-transcript-line'
-import { time_writes } from './time-writes'
 
 const { NO_MESSAGE_ID, parse_line } = time_transcript_line
+const { NO_CALL, UNKNOWN_CALL, UNKNOWN_TOOL, to_tool_call } = time_tool_call
 
 // Turning a session transcript into timed spans (joshuafolkken/kit#1267).
 //
@@ -24,6 +22,10 @@ const { NO_MESSAGE_ID, parse_line } = time_transcript_line
 // the move changed no call site. `cost_blocks`' three type constants are still imported rather than
 // restated.
 //
+// **Reading a `tool_use` block into a `ToolCall` is `time-tool-call.ts`'s** since
+// joshuafolkken/kit#3264, when this file reached its length limit again. `UNKNOWN_TOOL` and
+// `to_tool_call` are re-exported below, so that move changed no call site either.
+//
 // **The partition is by gap, not by pair.** Every span is the interval between two consecutive
 // events, classified by the *later* one: a span ending at an assistant line is model wait, one
 // ending at a tool result is that tool's execution, one ending at a user prompt is human wait.
@@ -34,7 +36,6 @@ const { NO_MESSAGE_ID, parse_line } = time_transcript_line
 
 const ASSISTANT_TYPE = 'assistant'
 const USER_TYPE = 'user'
-const UNKNOWN_TOOL = 'unknown'
 
 type SpanCategory = 'model' | 'tool' | 'human'
 
@@ -90,96 +91,6 @@ const NO_RESULT: ResultFacts = {
 	followup_stages: time_followup_stage.NO_STAGES,
 }
 
-// What a tool span is labelled with. `josh_command` is empty for everything that is not a
-// `pnpm josh <cmd>` invocation, and the report drops empty labels rather than printing a bucket.
-//
-// `marker` names the workflow boundary the call is, for the phase breakdown that slices the same
-// spans by stage (joshuafolkken/kit#1269). It is carried here rather than re-derived later because
-// the tool's *input* is what decides it, and a span keeps no input — only the label read off it.
-//
-// `is_bundleable` and `targets` are carried for exactly that reason too (joshuafolkken/kit#1344).
-// Whether a call could have gone out beside another, and what it names, are both read off the input —
-// so a module asking about them after the fact would have nothing to read. `time-bundle-call.ts`
-// decides both; the rule each one follows is stated there.
-//
-// `check_key` is the fourth, and the third time this reason has applied (joshuafolkken/kit#1383). Two
-// runs of one verification check are the same call only if they named the same files, and the files
-// are in the input — so `josh_command` alone cannot say, and nothing downstream could recover it.
-// `time-single-check.ts` decides it.
-//
-// `message_id` is the fifth, and it is the one that says which *turn* a call belongs to
-// (joshuafolkken/kit#1406). It is read off the line the `tool_use` block sat on rather than off the
-// result that closes the span, because a `tool_result` line carries no message id at all — so a span
-// that did not keep it here could never be attributed to the turn that issued it.
-//
-// `writes` is the sixth, and it is what `targets` could not say (joshuafolkken/kit#1472). `targets`
-// names what a call mentioned; `marker` says a call was *an* edit but not of what, and for a tool
-// outside `BUNDLEABLE_TOOLS` it arrived with no target at all. So a consumer subtracting edits from
-// reads — `investigation-reads.ts` — had nothing to subtract for `MultiEdit` / `NotebookEdit`, and
-// nothing at all to tell an in-place `sed -i` from the `sed -n` it shares a label with.
-// `time-writes.ts` decides it, from the input this span is about to discard.
-// `issue` is the seventh, and it is the one `branch` could not carry (joshuafolkken/kit#1617). Under
-// lanes the session writing the transcript stays on the default branch while the work runs in a linked
-// work tree, so `branch` names no issue on any line of the run; the `in-progress` label call does, and
-// like every field above it that answer is read off the *input* a span is about to discard.
-// `time_markers.NO_ISSUE` for every call that declares nothing, which is all but one call per run.
-interface ToolCall {
-	label: string
-	josh_command: string
-	// Every josh subcommand the call ran, where `josh_command` is only the first (joshuafolkken/kit#1883).
-	// A chained `pnpm josh lint:related && pnpm josh test:related` carries both; the count tables expand
-	// it so the ones `josh_command` drops are still counted.
-	josh_commands: ReadonlyArray<string>
-	check_key: string
-	marker: PhaseMarker
-	is_bundleable: boolean
-	targets: ReadonlyArray<string>
-	// Carried beside `targets` because sharing a target means something different depending on it: a
-	// second write to one file is independent work, a read of a file just written is not
-	// (joshuafolkken/kit#1509).
-	is_writing: boolean
-	// The conservative write answer `is_read_only_call` asks of a live call, carried so a reader of the
-	// transcript asks the same read-only question as the guard (joshuafolkken/kit#3139).
-	may_write: boolean
-	// Whether this is a subagent launch whose prompt builds on an earlier launch's finding
-	// (joshuafolkken/kit#1854). Carried for the reason every field here is — the prompt it is read from
-	// is the input, and a span keeps none. `time-agent-bundles.ts` reads it.
-	has_prior_reference: boolean
-	writes: ReadonlyArray<string>
-	message_id: string
-	issue: number
-	// The background run this call reads the output of, and `''` for every other call
-	// (joshuafolkken/kit#1662). It is the eighth field carried for the reason the seven above are:
-	// the id sits in the command string, which a span does not keep, and it is the only thing that
-	// says a `tail` two turns later is the join of a command started minutes ago.
-	reads_background: string
-}
-
-const NO_CALL: ToolCall = {
-	label: '',
-	josh_command: '',
-	josh_commands: [],
-	check_key: time_single_check.NO_CHECK,
-	marker: time_markers.NO_MARKER,
-	message_id: NO_MESSAGE_ID,
-	writes: [],
-	issue: time_markers.NO_ISSUE,
-	reads_background: time_background.NO_BACKGROUND,
-	...time_bundle_call.not_bundleable(),
-}
-const UNKNOWN_CALL: ToolCall = {
-	label: UNKNOWN_TOOL,
-	josh_command: '',
-	josh_commands: [],
-	check_key: time_single_check.NO_CHECK,
-	marker: time_markers.NO_MARKER,
-	message_id: NO_MESSAGE_ID,
-	writes: [],
-	issue: time_markers.NO_ISSUE,
-	reads_background: time_background.NO_BACKGROUND,
-	...time_bundle_call.not_bundleable(),
-}
-
 // `ended_ms` is the absolute instant the span closed, so `[ended_ms - duration_ms, ended_ms]` is the
 // interval it occupied. A duration alone cannot say *when*, and two things need that: the CI wait,
 // which is the part of the PR-open→merge window no span covers (joshuafolkken/kit#1268), and the
@@ -242,50 +153,6 @@ interface Timeline {
 	spans: Array<Span>
 }
 
-// Everything but Bash: the tool's own name is the label, and nothing it runs is a shell command to
-// read a check key, a josh command or a declared issue off.
-function non_bash_call(name: string, input: unknown, message_id: string): ToolCall {
-	return {
-		label: name,
-		josh_command: '',
-		josh_commands: [],
-		check_key: time_single_check.NO_CHECK,
-		marker: time_markers.tool_marker(name, input),
-		message_id,
-		writes: time_writes.tool_writes(name, input),
-		issue: time_markers.NO_ISSUE,
-		// A non-Bash tool joins a backgrounded command too — `BashOutput` carries the shell id in a
-		// field of its own, `Monitor` names the same `…/tasks/<id>.output` path in a command — so the
-		// same reader is asked here rather than the field being left empty for every tool but `Bash`.
-		reads_background: time_background.read_id_of(input),
-		...time_bundle_call.tool_facts(name, input),
-	}
-}
-
-function bash_call(input: unknown, message_id: string): ToolCall {
-	const command = time_shell.bash_command(input)
-	const josh_command = time_shell.josh_command_of(command)
-
-	return {
-		label: time_shell.bash_label(command),
-		josh_command,
-		josh_commands: time_shell.josh_commands_of(command),
-		check_key: time_single_check.check_key(josh_command, command),
-		marker: time_markers.bash_marker(command),
-		message_id,
-		writes: time_writes.bash_writes(command),
-		issue: time_markers.bash_issue(command),
-		reads_background: time_background.read_id_of(input),
-		...time_bundle_call.bash_facts(command),
-	}
-}
-
-function to_tool_call(name: string, input: unknown, message_id: string): ToolCall {
-	if (name !== cost_blocks.BASH_TOOL) return non_bash_call(name, input, message_id)
-
-	return bash_call(input, message_id)
-}
-
 // Identified calls only. A `tool_use` written without an `id` would otherwise be registered under
 // the empty string, where the next result that carries no `tool_use_id` would match it and be
 // labelled with an unrelated tool — a wrong name where `UNKNOWN_TOOL` is the honest one.