@joshuafolkken/kit 1.1178.0 → 1.1240.0

package/scripts/time-runtime/time-tool-call.ts

@@ -0,0 +1,160 @@
+import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
+import { time_background } from './time-background'
+import { time_bundle_call } from './time-bundle-call'
+import { time_markers, type PhaseMarker } from './time-markers'
+import { time_shell } from './time-shell'
+import { time_single_check } from './time-single-check'
+import { time_transcript_line } from './time-transcript-line'
+import { time_writes } from './time-writes'
+
+// Reading a `tool_use` block into the label a span carries — split out of `time-spans.ts` when it
+// reached its line limit (joshuafolkken/kit#3264). `time_spans` re-exports `UNKNOWN_TOOL` and
+// `to_tool_call` under the names they always had, so the move changed no call site.
+
+const { NO_MESSAGE_ID } = time_transcript_line
+
+const UNKNOWN_TOOL = 'unknown'
+
+// What a tool span is labelled with. `josh_command` is empty for everything that is not a
+// `pnpm josh <cmd>` invocation, and the report drops empty labels rather than printing a bucket.
+//
+// `marker` names the workflow boundary the call is, for the phase breakdown that slices the same
+// spans by stage (joshuafolkken/kit#1269). It is carried here rather than re-derived later because
+// the tool's *input* is what decides it, and a span keeps no input — only the label read off it.
+//
+// `is_bundleable` and `targets` are carried for exactly that reason too (joshuafolkken/kit#1344).
+// Whether a call could have gone out beside another, and what it names, are both read off the input —
+// so a module asking about them after the fact would have nothing to read. `time-bundle-call.ts`
+// decides both; the rule each one follows is stated there.
+//
+// `check_key` is the fourth, and the third time this reason has applied (joshuafolkken/kit#1383). Two
+// runs of one verification check are the same call only if they named the same files, and the files
+// are in the input — so `josh_command` alone cannot say, and nothing downstream could recover it.
+// `time-single-check.ts` decides it.
+//
+// `message_id` is the fifth, and it is the one that says which *turn* a call belongs to
+// (joshuafolkken/kit#1406). It is read off the line the `tool_use` block sat on rather than off the
+// result that closes the span, because a `tool_result` line carries no message id at all — so a span
+// that did not keep it here could never be attributed to the turn that issued it.
+//
+// `writes` is the sixth, and it is what `targets` could not say (joshuafolkken/kit#1472). `targets`
+// names what a call mentioned; `marker` says a call was *an* edit but not of what, and for a tool
+// outside `BUNDLEABLE_TOOLS` it arrived with no target at all. So a consumer subtracting edits from
+// reads — `investigation-reads.ts` — had nothing to subtract for `MultiEdit` / `NotebookEdit`, and
+// nothing at all to tell an in-place `sed -i` from the `sed -n` it shares a label with.
+// `time-writes.ts` decides it, from the input this span is about to discard.
+// `issue` is the seventh, and it is the one `branch` could not carry (joshuafolkken/kit#1617). Under
+// lanes the session writing the transcript stays on the default branch while the work runs in a linked
+// work tree, so `branch` names no issue on any line of the run; the `in-progress` label call does, and
+// like every field above it that answer is read off the *input* a span is about to discard.
+// `time_markers.NO_ISSUE` for every call that declares nothing, which is all but one call per run.
+interface ToolCall {
+	label: string
+	josh_command: string
+	// Every josh subcommand the call ran, where `josh_command` is only the first (joshuafolkken/kit#1883).
+	// A chained `pnpm josh lint:related && pnpm josh test:related` carries both; the count tables expand
+	// it so the ones `josh_command` drops are still counted.
+	josh_commands: ReadonlyArray<string>
+	check_key: string
+	marker: PhaseMarker
+	is_bundleable: boolean
+	targets: ReadonlyArray<string>
+	// Carried beside `targets` because sharing a target means something different depending on it: a
+	// second write to one file is independent work, a read of a file just written is not
+	// (joshuafolkken/kit#1509).
+	is_writing: boolean
+	// The conservative write answer `is_read_only_call` asks of a live call, carried so a reader of the
+	// transcript asks the same read-only question as the guard (joshuafolkken/kit#3139).
+	may_write: boolean
+	// Whether this is a subagent launch whose prompt builds on an earlier launch's finding
+	// (joshuafolkken/kit#1854). Carried for the reason every field here is — the prompt it is read from
+	// is the input, and a span keeps none. `time-agent-bundles.ts` reads it.
+	has_prior_reference: boolean
+	writes: ReadonlyArray<string>
+	message_id: string
+	issue: number
+	// The background run this call reads the output of, and `''` for every other call
+	// (joshuafolkken/kit#1662). It is the eighth field carried for the reason the seven above are:
+	// the id sits in the command string, which a span does not keep, and it is the only thing that
+	// says a `tail` two turns later is the join of a command started minutes ago.
+	reads_background: string
+}
+
+const NO_CALL: ToolCall = {
+	label: '',
+	josh_command: '',
+	josh_commands: [],
+	check_key: time_single_check.NO_CHECK,
+	marker: time_markers.NO_MARKER,
+	message_id: NO_MESSAGE_ID,
+	writes: [],
+	issue: time_markers.NO_ISSUE,
+	reads_background: time_background.NO_BACKGROUND,
+	...time_bundle_call.not_bundleable(),
+}
+const UNKNOWN_CALL: ToolCall = {
+	label: UNKNOWN_TOOL,
+	josh_command: '',
+	josh_commands: [],
+	check_key: time_single_check.NO_CHECK,
+	marker: time_markers.NO_MARKER,
+	message_id: NO_MESSAGE_ID,
+	writes: [],
+	issue: time_markers.NO_ISSUE,
+	reads_background: time_background.NO_BACKGROUND,
+	...time_bundle_call.not_bundleable(),
+}
+
+// Everything but Bash: the tool's own name is the label, and nothing it runs is a shell command to
+// read a check key, a josh command or a declared issue off.
+function non_bash_call(name: string, input: unknown, message_id: string): ToolCall {
+	return {
+		label: name,
+		josh_command: '',
+		josh_commands: [],
+		check_key: time_single_check.NO_CHECK,
+		marker: time_markers.tool_marker(name, input),
+		message_id,
+		writes: time_writes.tool_writes(name, input),
+		issue: time_markers.NO_ISSUE,
+		// A non-Bash tool joins a backgrounded command too — `BashOutput` carries the shell id in a
+		// field of its own, `Monitor` names the same `…/tasks/<id>.output` path in a command — so the
+		// same reader is asked here rather than the field being left empty for every tool but `Bash`.
+		reads_background: time_background.read_id_of(input),
+		...time_bundle_call.tool_facts(name, input),
+	}
+}
+
+function bash_call(input: unknown, message_id: string): ToolCall {
+	const command = time_shell.bash_command(input)
+	const josh_command = time_shell.josh_command_of(command)
+
+	return {
+		label: time_shell.bash_label(command),
+		josh_command,
+		josh_commands: time_shell.josh_commands_of(command),
+		check_key: time_single_check.check_key(josh_command, command),
+		marker: time_markers.bash_marker(command),
+		message_id,
+		writes: time_writes.bash_writes(command),
+		issue: time_markers.bash_issue(command),
+		reads_background: time_background.read_id_of(input),
+		...time_bundle_call.bash_facts(command),
+	}
+}
+
+function to_tool_call(name: string, input: unknown, message_id: string): ToolCall {
+	if (name !== cost_blocks.BASH_TOOL) return non_bash_call(name, input, message_id)
+
+	return bash_call(input, message_id)
+}
+
+const time_tool_call = {
+	UNKNOWN_TOOL,
+	NO_CALL,
+	UNKNOWN_CALL,
+	to_tool_call,
+}
+
+export type { ToolCall }
+export { time_tool_call }

package/scripts/version/effective-upstream.ts

@@ -1,13 +1,11 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import path from 'node:path'
+import { ancestor_directories } from '#scripts/lib/ancestor-directories'
 import { json_value } from '#scripts/lib/json-value'
 import { package_named_version_schema } from '#scripts/lib/schemas'
 
 const PACKAGE_JSON = 'package.json'
-// Node module paths never nest anywhere near this deep; the bound only guards against an unexpected
-// filesystem cycle so the walk-up cannot loop forever.
-const MAX_WALK_DEPTH = 64
 
 // Options for `resolve_effective_upstream_version`. `resolve_marker` is a subpath specifier used for
 // `createRequire().resolve()` when the package root itself is not directly resolvable — e.g. kit does
@@ -31,26 +29,10 @@ function read_matching_version(manifest_path: string, package_name: string): str
 	return parsed.data.version
 }
 
-// The directory itself and each of its ancestors up to the filesystem root, nearest-first. Bounded
-// by MAX_WALK_DEPTH so an unexpected filesystem cycle cannot produce an unbounded list.
-function ancestor_directories(start_directory: string): Array<string> {
-	const directories: Array<string> = []
-	let current = start_directory
-
-	for (let depth = 0; depth < MAX_WALK_DEPTH; depth += 1) {
-		directories.push(current)
-		const parent = path.dirname(current)
-		if (parent === current) break
-		current = parent
-	}
-
-	return directories
-}
-
 // Walk up from a resolved file's directory to the package root, returning the version of the first
 // ancestor package.json whose `name` matches the target — or undefined when no matching root exists.
 function walk_up_for_version(start_directory: string, package_name: string): string | undefined {
-	for (const directory of ancestor_directories(start_directory)) {
+	for (const directory of ancestor_directories.list(start_directory)) {
 		const version = read_matching_version(path.join(directory, PACKAGE_JSON), package_name)
 		if (version !== undefined) return version
 	}

package/scripts/version/latest-corepack.ts

@@ -11,12 +11,12 @@
  * major equals the `packageManager` pin keeps both invariants: never below the adopted
  * major, and advancing while that major is the current one.
  *
- * The `minimum-release-age` quarantine is applied natively from `.npmrc` (kit#768).
- * safe-chain filters the registry only when the process tree was launched through one of
- * its wrapped shell commands, so `josh latest` and `pnpm josh latest` used to resolve
+ * The `minimumReleaseAge` quarantine is applied natively from `pnpm-workspace.yaml` (kit#768,
+ * #3267). safe-chain filters the registry only when the process tree was launched through one
+ * of its wrapped shell commands, so `josh latest` and `pnpm josh latest` used to resolve
  * different answers and the pin oscillated. Reading the window from the repo-managed
- * `.npmrc` and filtering by publish timestamp makes the resolution identical in every
- * invocation context; right after a pnpm release the answer is simply the previous
+ * `pnpm-workspace.yaml` and filtering by publish timestamp makes the resolution identical in
+ * every invocation context; right after a pnpm release the answer is simply the previous
  * release, exactly as the filtered view behaved.
  *
  * The resolved version is floored at the current `packageManager` pin: a filtered registry
@@ -30,14 +30,19 @@
  * manifest that arrived with the two fields out of step kept the pnpm dual-declaration
  * warning forever. The alignment is idempotent, so running it unconditionally is free.
  *
- * Registry and pnpm failures stay non-fatal: they are logged and swallowed (exit 0)
- * so the rest of the `josh latest` chain (`latest:update`, `audit`) keeps running.
+ * A failed bump exits non-zero with its cause, the manifest restored (#3361). It used to be
+ * swallowed as a skip, so `latest:scope --record` marked the run fresh and a pnpm that could not
+ * self-update (the Corepack shim refuses it) stayed pinned silently. `josh latest` runs this step
+ * last, right before the record, so the dependency update and the audit still finish and only the
+ * record is withheld. A registry answer not newer than the pin, or nothing aged past the
+ * quarantine window yet, remains a non-fatal skip.
  *
  * Usage: tsx scripts/version/latest-corepack.ts
  */
 import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { json_value } from '#scripts/lib/json-value'
+import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import semver from 'semver'
 import { z } from 'zod'
@@ -49,14 +54,23 @@ const PACKAGE_MANAGER_RE = /"packageManager"\s*:\s*"pnpm@(\d+)(?:[^\d]|$)/u
 const PINNED_VERSION_RE = /"packageManager"\s*:\s*"pnpm@([^"+]+)/u
 const TARGET_PREFIX = 'pnpm@'
 const FAILURE_EXIT_CODE = 1
-const NPMRC_PATH = '.npmrc'
-const VIEW_TIMEOUT_MS = 30_000
+const WORKSPACE_PATH = 'pnpm-workspace.yaml'
 const SHA512_BYTES = 64
 const INTEGRITY_RE = /^sha512-([A-Za-z0-9+/]+={0,2})$/u
 const PACKAGE_MANAGER_VALUE_RE = /("packageManager"\s*:\s*")pnpm@[^"]+(")/u
+
+// `target` is undefined both when the registry did not answer and when it answered but nothing has
+// aged past the quarantine window yet; only the first is a failure (#3361).
+interface TargetResolution {
+	target: string | undefined
+	is_registry_reachable: boolean
+}
+
 const PNPM_DEVELOPMENT_MANAGER_SCHEMA = z.object({ name: z.literal('pnpm'), version: z.string() })
 const DEV_ENGINES_SCHEMA = z.object({ packageManager: PNPM_DEVELOPMENT_MANAGER_SCHEMA })
 const DEV_ENGINES_PNPM_SCHEMA = z.object({ devEngines: DEV_ENGINES_SCHEMA.optional() })
+const COREPACK_REMEDY =
+	'pnpm runs through the Corepack shim, where pnpm 11+ refuses self-update (ERR_PNPM_CANT_SELF_UPDATE_IN_COREPACK). Run `corepack disable pnpm`, install a standalone pnpm (https://pnpm.io/installation), then rerun josh latest.'
 
 function extract_development_engines_version(package_json_content: string): string | undefined {
 	const parsed = DEV_ENGINES_PNPM_SCHEMA.safeParse(
@@ -121,29 +135,40 @@ function extract_times_json(stdout: string): Record<string, string> | undefined
 function query_release_times(): Record<string, string> | undefined {
 	const result = execaSync('pnpm', ['view', 'pnpm', 'time', '--json'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
 
 	return extract_times_json(result.stdout)
 }
 
+function to_resolution(
+	version: string | undefined,
+	is_registry_reachable: boolean,
+): TargetResolution {
+	const target = version === undefined ? undefined : `${TARGET_PREFIX}${version}`
+
+	return { target, is_registry_reachable }
+}
+
 // Ask the registry for the newest pnpm release on the pinned major that has aged past the
-// quarantine window. Returns undefined when the query fails or nothing qualifies yet.
-function query_major_latest_version(major: string): string | undefined {
+// quarantine window.
+function resolve_major_target(major: string): TargetResolution {
 	const times = query_release_times()
-	if (times === undefined) return undefined
+	if (times === undefined) return to_resolution(undefined, false)
 
-	// The project's own `.npmrc`, deliberately not the upward walk the version check uses: `josh
-	// latest` reads `package.json` and writes the pnpm pin relative to the working directory, so it
-	// has no subdirectory case — and honouring a user-level policy here could freeze pnpm bumps in a
-	// project that declares none (joshuafolkken/kit#808).
-	return release_age.select_aged_version(
+	// The project's own `pnpm-workspace.yaml`, deliberately not the upward walk the version check
+	// uses: `josh latest` reads `package.json` and writes the pnpm pin relative to the working
+	// directory, so it has no subdirectory case — and honouring an ancestor's policy here could freeze
+	// pnpm bumps in a project that declares none (joshuafolkken/kit#808).
+	const version = release_age.select_aged_version(
 		times,
 		major,
-		release_age.read_minimum_release_age(NPMRC_PATH),
+		release_age.read_minimum_release_age(WORKSPACE_PATH),
 		Date.now(),
 	)
+
+	return to_resolution(version, true)
 }
 
 function parse_latest_version(stdout: string): string | undefined {
@@ -156,31 +181,47 @@ function parse_latest_version(stdout: string): string | undefined {
 function query_latest_version(): string | undefined {
 	const result = execaSync('pnpm', ['view', 'pnpm', 'version', '--json'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
 
 	return parse_latest_version(result.stdout)
 }
 
-// The value handed to pnpm self-update: an exact registry-resolved version on the pinned
-// major, the latest exact version when no major can be read from package.json, or undefined when
-// the registry could not answer (the caller skips non-fatally).
-function resolve_corepack_target(major: string | undefined): string | undefined {
-	const version = major === undefined ? query_latest_version() : query_major_latest_version(major)
-	if (version === undefined) return undefined
+// The target handed to pnpm self-update: an exact registry-resolved version on the pinned major, or
+// the latest exact version when no major can be read from package.json. The latest-version query
+// has no quarantine selection, so resolving nothing there always means the registry did not answer.
+function resolve_target(major: string | undefined): TargetResolution {
+	if (major !== undefined) return resolve_major_target(major)
+	const version = query_latest_version()
+
+	return to_resolution(version, version !== undefined)
+}
 
-	return `pnpm@${version}`
+function resolve_corepack_target(major: string | undefined): string | undefined {
+	return resolve_target(major).target
 }
 
-// Non-fatal skip message shared by both skip paths: keep the josh latest chain
-// (latest:update, audit) running instead of aborting on a bump failure.
+// Non-fatal skip message for a registry answer with nothing to adopt — nothing to bump, nothing failed.
 function warn_skip(reason: string): void {
-	console.warn(`⚠ Skipped pnpm bump (${reason}); the chain continues.`)
+	console.warn(`⚠ Skipped pnpm bump (${reason}).`)
+}
+
+// Every failure path ends here, so the exit status the `josh latest` chain stops on is one value.
+function fail_bump(reason: string): number {
+	console.error(
+		`✖ pnpm bump failed (${reason}); the run is not recorded, so the next josh latest retries it.`,
+	)
+
+	return FAILURE_EXIT_CODE
 }
 
-function warn_unresolved(major: string | undefined): void {
-	warn_skip(`no pnpm ${major ?? ''} release resolvable from the registry`)
+// Corepack exports COREPACK_ROOT to the package manager it launches, and pnpm 11+ refuses
+// `self-update` under it (ERR_PNPM_CANT_SELF_UPDATE_IN_COREPACK), so the remedy is named there.
+function fail_self_update(status: number, environment: NodeJS.ProcessEnv = process.env): number {
+	if (environment['COREPACK_ROOT'] !== undefined) console.error(COREPACK_REMEDY)
+
+	return fail_bump(`pnpm self-update exited ${String(status)}`)
 }
 
 function run_pnpm_update(target: string): number {
@@ -193,17 +234,6 @@ function run_pnpm_update(target: string): number {
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }
 
-// The target is an already-resolved exact version, so a non-zero status here is a
-// genuine pnpm or network failure; a later run retries. Returns whether a skip
-// happened.
-function did_warn_skip(status: number): boolean {
-	if (status === 0) return false
-
-	warn_skip(`pnpm self-update exited ${String(status)}`)
-
-	return true
-}
-
 // Realign `devEngines.packageManager.version` with the `packageManager` pin so the two
 // fields keep matching (pnpm suppresses the dual-declaration warning only on an exact
 // match). Runs on every path, not just after a successful bump: a repository that arrives
@@ -224,7 +254,7 @@ function restore_package_json(
 	package_json_path: string = PACKAGE_JSON_PATH,
 ): void {
 	writeFileSync(package_json_path, content)
-	console.info('✔ Restored package.json pin (pnpm bump skipped)')
+	console.info('✔ Restored package.json pin (pnpm bump failed)')
 }
 
 function decode_integrity(encoded: string): string | undefined {
@@ -247,7 +277,7 @@ function extract_encoded_integrity(stdout: string): string | undefined {
 function query_integrity(target: string): string | undefined {
 	const result = execaSync('pnpm', ['view', target, 'dist.integrity', '--json'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
 
@@ -292,35 +322,19 @@ function notify_skipped_bump(target: string, pinned_version: string): void {
 	warn_skip(`registry answered ${target}, below the pinned ${pinned_version}`)
 }
 
-// Resolve the pnpm target with the pin floor applied. Undefined means the bump was
-// skipped and the reason has already been logged.
-function resolve_floored_target(original: string, major: string | undefined): string | undefined {
-	const target = resolve_corepack_target(major)
-
-	if (target === undefined) {
-		warn_unresolved(major)
-
-		return undefined
-	}
-
-	const pinned_version = extract_pinned_version(original)
-	if (!is_target_not_newer_than_pin(target, pinned_version)) return target
-
-	notify_skipped_bump(target, pinned_version ?? '')
-
-	return undefined
-}
-
-function restore_after_update(original: string, target: string, integrity: string): void {
+function restore_after_update(original: string, target: string, integrity: string): number {
 	try {
 		restore_integrity(target, integrity)
+
+		return 0
 	} catch {
 		restore_package_json(original)
-		warn_skip('pnpm self-update wrote an unexpected pin')
+
+		return fail_bump('pnpm self-update wrote an unexpected pin')
 	}
 }
 
-function pin_unpinned_manifest(original: string, target: string, integrity: string): void {
+function pin_unpinned_manifest(original: string, target: string, integrity: string): number {
 	const manifest = z.record(z.string(), z.unknown()).parse(json_value.parse_or_undefined(original))
 	const pinned = JSON.stringify(
 		{ ...manifest, packageManager: `${target}+${integrity}` },
@@ -334,53 +348,71 @@ function pin_unpinned_manifest(original: string, target: string, integrity: stri
 	)
 
 	const result = execaSync('pnpm', ['--version'], { reject: false })
-	if (result.exitCode === 0 && result.stdout.trim() === target.slice(TARGET_PREFIX.length)) return
+	if (result.exitCode === 0 && result.stdout.trim() === target.slice(TARGET_PREFIX.length)) return 0
 
 	restore_package_json(original)
-	warn_skip('the newly pinned pnpm version could not start')
-}
 
-function update_pinned_manifest(original: string, target: string, integrity: string): void {
-	const is_skipped = did_warn_skip(run_pnpm_update(target))
+	return fail_bump('the newly pinned pnpm version could not start')
+}
 
-	if (is_skipped) {
-		restore_package_json(original)
+// The target is an already-resolved exact version, so a non-zero status here is a genuine
+// pnpm, Corepack or network failure.
+function update_pinned_manifest(original: string, target: string, integrity: string): number {
+	const status = run_pnpm_update(target)
+	if (status === 0) return restore_after_update(original, target, integrity)
 
-		return
-	}
+	restore_package_json(original)
 
-	restore_after_update(original, target, integrity)
+	return fail_self_update(status)
 }
 
 // Query integrity before mutating the manifest; self-update writes both pins without it.
-function bump_package_manager(original: string, target: string): void {
+function bump_package_manager(original: string, target: string): number {
 	const integrity = query_integrity(target)
+	if (integrity === undefined) return fail_bump(`no integrity for ${target}`)
+	if (!PACKAGE_MANAGER_RE.test(original)) return pin_unpinned_manifest(original, target, integrity)
 
-	if (integrity === undefined) {
-		warn_skip(`no integrity for ${target}`)
+	return update_pinned_manifest(original, target, integrity)
+}
 
-		return
-	}
+// An unreachable registry fails, so the unrecorded run is retried. A reachable one with nothing
+// aged past the quarantine window is the kit#768 skip — like a not-newer answer, there is nothing
+// to adopt yet, and failing would stall every run for up to the whole window.
+function report_unresolved(major: string | undefined, is_registry_reachable: boolean): number {
+	const label = `pnpm ${major ?? ''}`.trimEnd()
+	if (!is_registry_reachable) return fail_bump(`the registry did not answer for ${label}`)
 
-	if (!PACKAGE_MANAGER_RE.test(original)) {
-		pin_unpinned_manifest(original, target, integrity)
+	warn_skip(`no ${label} release has aged past the quarantine window yet`)
 
-		return
+	return 0
+}
+
+// Resolve the pnpm target with the pin floor applied, then bump.
+function bump_to_registry_target(original: string, major: string | undefined): number {
+	const { target, is_registry_reachable } = resolve_target(major)
+	if (target === undefined) return report_unresolved(major, is_registry_reachable)
+
+	const pinned_version = extract_pinned_version(original)
+
+	if (!is_target_not_newer_than_pin(target, pinned_version)) {
+		return bump_package_manager(original, target)
 	}
 
-	update_pinned_manifest(original, target, integrity)
+	notify_skipped_bump(target, pinned_version ?? '')
+
+	return 0
 }
 
-function main(): void {
+function main(): number {
 	const original = readFileSync(PACKAGE_JSON_PATH, 'utf8')
-	const major = extract_pnpm_major(original)
-	const target = resolve_floored_target(original, major)
-	if (target !== undefined) bump_package_manager(original, target)
+	const status = bump_to_registry_target(original, extract_pnpm_major(original))
 
 	sync_development_engines()
+
+	return status
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main()
+if (process.argv[1] === fileURLToPath(import.meta.url)) process.exitCode = main()
 
 const latest_corepack = {
 	extract_pnpm_major,
@@ -388,12 +420,11 @@ const latest_corepack = {
 	is_target_not_newer_than_pin,
 	notify_skipped_bump,
 	extract_times_json,
-	query_major_latest_version,
 	resolve_corepack_target,
 	run_pnpm_update,
 	query_integrity,
 	restore_integrity,
-	did_warn_skip,
+	fail_self_update,
 	sync_development_engines,
 	restore_package_json,
 	main,

package/scripts/version/latest-regression.ts

@@ -1,4 +1,4 @@
-import { package_with_deps_schema } from '#scripts/overrides/schemas'
+import { package_with_deps_schema } from '#scripts/overrides/overrides-schemas'
 import semver from 'semver'
 
 // `pnpm update --latest` sets each range to whatever the registry reports as newest. When a

package/scripts/version/latest-update.ts

@@ -13,7 +13,7 @@ import { overrides_check } from '#scripts/overrides/overrides-logic'
 import { execaSync } from 'execa'
 import { fresh_metadata_cache } from './fresh-metadata-cache'
 import { latest_regression, type VersionRegression } from './latest-regression'
-import { preinstall_version_update } from './preinstall-version-update'
+import { safe_chain_version_update } from './safe-chain-version-update'
 
 const PACKAGE_JSON_PATH = 'package.json'
 const LOCKFILE_PATH = 'pnpm-lock.yaml'
@@ -175,11 +175,11 @@ function main(): void {
 	report_overrides(overrides)
 	report_lockfile_overrides()
 
-	// Skipped after a rollback so the tree really is left exactly as it was found — this sync writes
-	// package.json to advance the pinned safe-chain version, which would contradict the notice that
+	// Skipped after a rollback so the tree really is left exactly as it was found — this sync rewrites
+	// the workflows' pinned safe-chain installer, which would contradict the notice that
 	// nothing changed.
 	if (outcome.status === 0 && !outcome.is_rolled_back) {
-		preinstall_version_update.sync(PACKAGE_JSON_PATH)
+		safe_chain_version_update.sync()
 	}
 }
 

package/scripts/version/npm-registry.ts

@@ -1,6 +1,8 @@
 import { json_value } from '#scripts/lib/json-value'
+import { FETCH_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { migrate_logic } from '#scripts/registry-migration/migrate-logic'
 import { execaSync } from 'execa'
+import semver from 'semver'
 import { z } from 'zod'
 import { release_age } from './release-age'
 
@@ -12,7 +14,6 @@ const PUBLIC_REGISTRY = 'https://registry.npmjs.org'
 // The abbreviated packument carries `dist-tags` without every version's full manifest.
 const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json'
 const FULL_ACCEPT = 'application/json'
-const REQUEST_TIMEOUT_MS = 10_000
 const SCOPE_SEPARATOR = '/'
 const ENCODED_SCOPE_SEPARATOR = '%2f'
 const SCOPE_PATTERN = /^@[^/]+(?=\/)/u
@@ -29,7 +30,10 @@ const FETCH_SCRIPT = [
 	'process.stdout.write(await response.text())',
 ].join('\n')
 
-const latest_schema = z.looseObject({ 'dist-tags': z.looseObject({ latest: z.string() }) })
+// A registry-supplied version is used only when it is exactly a semver version — it ends up inside an
+// install command, so `1.0.0;curl…|sh` or any other text is refused at the source, not downstream.
+const version_schema = z.string().refine((value) => semver.valid(value) === value)
+const latest_schema = z.looseObject({ 'dist-tags': z.looseObject({ latest: version_schema }) })
 const times_schema = z.looseObject({ time: release_age.release_times_schema })
 
 // The packument URL for a package name; a scoped name keeps its `@` and encodes the separator, the
@@ -42,7 +46,7 @@ function read_packument(package_name: string, accept: string): unknown {
 	const result = execaSync(
 		process.execPath,
 		['--input-type=module', '-e', FETCH_SCRIPT, packument_url(package_name), accept],
-		{ reject: false, timeout: REQUEST_TIMEOUT_MS },
+		{ reject: false, timeout: FETCH_TIMEOUT_MS },
 	)
 	if (result.exitCode !== 0) return undefined
 
@@ -59,7 +63,7 @@ function is_github_scope(scope: string): boolean {
 	if (is_cached_github !== undefined) return is_cached_github
 	const result = execaSync('pnpm', ['config', 'get', `${scope}${SCOPE_REGISTRY_SUFFIX}`], {
 		reject: false,
-		timeout: REQUEST_TIMEOUT_MS,
+		timeout: FETCH_TIMEOUT_MS,
 	})
 	const is_github = result.exitCode === 0 && migrate_logic.is_github_tarball(result.stdout.trim())
 
@@ -102,6 +106,17 @@ function has_public_version(package_name: string, version: string): boolean {
 	return parsed.success && parsed.data.time[version] !== undefined
 }
 
-const npm_registry = { has_public_version, packument_url, read_latest, read_release_times }
+// The version itself, or nothing when it is not exactly a semver version.
+function valid_version(value: string): string | undefined {
+	return version_schema.safeParse(value).success ? value : undefined
+}
+
+const npm_registry = {
+	has_public_version,
+	packument_url,
+	read_latest,
+	read_release_times,
+	valid_version,
+}
 
 export { npm_registry }