@joshuafolkken/kit 1.1229.0 → 1.1370.0

package/scripts/git/git-closes-keyword.ts

@@ -1,7 +1,7 @@
 // Captures the number, so the one pattern answers every question asked of a PR body: whether the
-// linked issue will auto-close, which issue that is when the invocation did not say
-// (joshuafolkken/kit#1539), and whether a merged pull request closes a child a `backlogrun` judged
-// unfinished (joshuafolkken/kit#2769). A second pattern would be two readings of "closes #N" to disagree.
+// linked issue will auto-close, which issue that is when the invocation did not say,
+// and whether a merged pull request closes a child a `backlogrun` judged
+// unfinished. A second pattern would be two readings of "closes #N" to disagree.
 const CLOSES_PATTERN = /closes\s+#(\d+)/iu
 
 function parse_closes_issue_number(body: string | undefined): string | undefined {

package/scripts/git/git-command.ts

@@ -1,3 +1,4 @@
+import { SUITE_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { PORCELAIN_FLAG, UNTRACKED_FILES_FLAG } from './constants'
 import { git_diff_reads } from './git-diff-reads'
 import { create_spawn_error } from './git-execa-error'
@@ -10,7 +11,7 @@ async function branch(): Promise<string> {
 	return await git_spawn.read(['rev-parse', '--abbrev-ref', 'HEAD'])
 }
 
-// **The untracked-files mode is passed rather than inherited** (joshuafolkken/kit#1381). Every
+// **The untracked-files mode is passed rather than inherited**. Every
 // reader of this output depends on the `??` lines being there: `git-staging.ts` stages exactly those,
 // and `hook-gate-reuse.ts` reads an empty output as "this push carries the recorded tree". A person
 // with `status.showUntrackedFiles=no` in their git config — a common setting on large repositories —
@@ -18,8 +19,8 @@ async function branch(): Promise<string> {
 // pre-push hook reuses a record for a commit that does not contain them. Naming the mode makes the
 // reading answer to this codebase rather than to whoever ran it.
 //
-// **`all` rather than `normal`, so a new file is named even inside an untracked directory**
-// (joshuafolkken/kit#2724). `normal` collapses it to `?? docs/maintainers/`, and every reader that
+// **`all` rather than `normal`, so a new file is named even inside an untracked directory**.
+// `normal` collapses it to `?? docs/maintainers/`, and every reader that
 // recognizes the observation ledger by its path then misses it: `git-staging.ts` stages the directory
 // — ledger included — into an unrelated pull request, and the flush refuses the directory as "other
 // changes".
@@ -33,7 +34,7 @@ async function status(directory?: string): Promise<string> {
 // The absolute path every other git command's output is relative to. Asking git rather than reading
 // `process.cwd()` is the whole point: run from a subdirectory, joining a repository-relative path
 // onto the working directory resolves to nothing, and a digest map built that way collapses to
-// "every file absent" — which compares *equal* to another such map (joshuafolkken/kit#1241).
+// "every file absent" — which compares *equal* to another such map.
 async function repository_root(): Promise<string> {
 	const result = git_spawn_sync.toplevel()
 	if (result.exit_code !== 0) throw create_spawn_error('rev-parse', result.exit_code)
@@ -43,8 +44,7 @@ async function repository_root(): Promise<string> {
 
 // The commit this checkout is sitting on, as opposed to `change_base_commit`'s commit a change is
 // measured against. Read by `josh review:brief` to say which tree a review was
-// briefed on, so a review that read a different one can be told apart from one that read this one
-// (joshuafolkken/kit#1522).
+// briefed on, so a review that read a different one can be told apart from one that read this one.
 async function head_commit(): Promise<string> {
 	return await git_spawn.read(['rev-parse', 'HEAD'])
 }
@@ -53,9 +53,9 @@ async function head_commit(): Promise<string> {
 // same path; in a linked work tree the first is `<repo>/.git/worktrees/<name>` and the second is
 // `<repo>/.git`, and the commit-message file lives under the first. Asking git rather than assuming
 // a directory named `.git` is what makes a bare repository and a `--separate-git-dir` clone answer
-// correctly too (joshuafolkken/kit#1106).
+// correctly too.
 // Exported so a caller that must ask the same question **synchronously** asks it with the same
-// arguments rather than a second spelling of them (joshuafolkken/kit#1864). `git_spawn` is
+// arguments rather than a second spelling of them. `git_spawn` is
 // asynchronous throughout and a `PreToolUse` guard is synchronous by contract, so the one place that
 // needs it runs these arguments itself — sharing the list is what keeps that from becoming a clone.
 const GIT_DIRECTORY_ARGUMENTS: ReadonlyArray<string> = [
@@ -76,7 +76,7 @@ async function diff_cached(file_path: string): Promise<string> {
 }
 
 // One branch from `origin`, fetched by name. `gh pr checkout` did this itself after resolving the
-// head branch through GraphQL, which a cloud session is answered 403 for (joshuafolkken/kit#1022);
+// head branch through GraphQL, which a cloud session is answered 403 for;
 // the resolution moved to REST and the fetch is spelled out here instead of being re-wrapped.
 //
 // The refspec is written out rather than left to the remote's configuration. A bare branch name is
@@ -84,61 +84,73 @@ async function diff_cached(file_path: string): Promise<string> {
 // clone, and every `actions/checkout` checkout, narrow it to one branch, and there a bare name
 // updates `FETCH_HEAD` alone. The `checkout` and the fast-forward that follow both read
 // `refs/remotes/origin/<branch>`, so naming the destination is what keeps them working off this
-// repository's own machine (joshuafolkken/kit#1029). `+` allows a forced update, matching what the
+// repository's own machine. `+` allows a forced update, matching what the
 // default refspec does.
 async function fetch_branch(branch_name: string): Promise<string> {
 	const refspec = `+refs/heads/${branch_name}:refs/remotes/origin/${branch_name}`
 
-	return await git_spawn.read(['fetch', 'origin', refspec])
+	return await git_spawn.read_remote(['fetch', 'origin', refspec])
 }
 
 // The fast-forward `gh pr checkout` ran after its fetch, for the case the branch is already local.
 // Without it a second `josh sdp <pr>` run works on the commit the first one left behind: the pin
 // sync reads a stale `.github/workflows` and either reports "already in sync" or commits onto a base
-// that `push` then rejects (joshuafolkken/kit#1029).
+// that `push` then rejects.
 //
 // `--ff-only` is the whole point — a branch that has diverged fails loudly rather than growing a
 // merge commit nobody asked for, which is the behavior the CLI had.
+//
+// It moves the working tree, so it runs the `post-merge` hook and takes a suite's budget for it.
 async function merge_fast_forward(branch_name: string): Promise<string> {
-	return await git_spawn.read(['merge', '--ff-only', `origin/${branch_name}`])
+	return await git_spawn.read(['merge', '--ff-only', `origin/${branch_name}`], SUITE_TIMEOUT_MS)
 }
 
-// The same fast-forward for a branch that is *not* checked out, so no file in the working tree moves
-// (joshuafolkken/kit#2462). A plain refspec refuses a non-fast-forward update, and git refuses it
+// The same fast-forward for a branch that is *not* checked out, so no file in the working tree moves.
+// A plain refspec refuses a non-fast-forward update, and git refuses it
 // outright for a branch checked out in any work tree — both are failures, never a rewrite.
 async function fast_forward_local(branch_name: string): Promise<string> {
-	return await git_spawn.read(['fetch', 'origin', `${branch_name}:${branch_name}`])
+	return await git_spawn.read_remote(['fetch', 'origin', `${branch_name}:${branch_name}`])
 }
 
 // The merge `josh main:merge` runs, and the deliberate opposite of the one above: **no `--ff-only`**,
-// because the branch it is called on has diverged whenever the command is worth typing at all
-// (joshuafolkken/kit#1659). Naming the strategy here is the whole fix — `git pull` decides it from
+// because the branch it is called on has diverged whenever the command is worth typing at all.
+// Naming the strategy here is the whole fix — `git pull` decides it from
 // `pull.rebase` / `pull.ff`, and with neither set it decides nothing and aborts.
 //
 // `with_output` rather than `read`: a merge that conflicts has to put git's own report in front of
 // the person, which is what the `git pull` this replaced did.
 //
 // `message` replaces git's default merge message, which carries no `#N` and is therefore refused
-// by the `commit-msg` hook on an issue branch (joshuafolkken/kit#2439).
+// by the `commit-msg` hook on an issue branch.
+//
+// The budget is a suite's, not a local git command's: the merge commit runs the `commit-msg` hook,
+// which is not git's own work.
 async function merge_branch(branch_name: string, message?: string): Promise<void> {
 	const message_arguments = message === undefined ? [] : ['-m', message]
 
-	await git_spawn.with_output('merge', [...message_arguments, `origin/${branch_name}`])
+	await git_spawn.with_output('merge', [...message_arguments, `origin/${branch_name}`], {
+		timeout_ms: SUITE_TIMEOUT_MS,
+	})
 }
 
+// Both checkouts run the `post-checkout` hook — a `pnpm install` in some consumers — so they take the
+// budget of a suite rather than a local git command's, which would end them inside that hook with the
+// branch already created.
 async function checkout_b(branch_name: string): Promise<string> {
-	return await git_spawn.read(['checkout', '-b', branch_name])
+	return await git_spawn.read(['checkout', '-b', branch_name], SUITE_TIMEOUT_MS)
 }
 
 async function checkout(branch_name: string): Promise<string> {
-	return await git_spawn.read(['checkout', branch_name])
+	return await git_spawn.read(['checkout', branch_name], SUITE_TIMEOUT_MS)
 }
 
+// A commit runs the `pre-commit` and `commit-msg` hooks — a type check among them — so it takes the
+// budget of the suite those hooks may run rather than a local git command's.
 async function commit(message: string): Promise<void> {
-	await git_spawn.with_output('commit', ['-m', message])
+	await git_spawn.with_output('commit', ['-m', message], { timeout_ms: SUITE_TIMEOUT_MS })
 }
 
-// **`-d` rather than `-D`, and that is the safety rather than a preference** (joshuafolkken/kit#1785).
+// **`-d` rather than `-D`, and that is the safety rather than a preference**.
 // The one caller is a rollback that removes a branch it created moments earlier, so `-d`'s refusal to
 // delete a branch holding an unmerged commit is exactly the net it wants: a rollback can never be the
 // thing that destroys a commit.
@@ -148,7 +160,7 @@ async function delete_branch(branch_name: string): Promise<void> {
 
 // How many commits `tip` holds that `base` does not. **`0` is the answer that distinguishes a flush
 // branch carrying the only copy of an appended line from one an aborted flush merely left behind**,
-// and the two get opposite advice (joshuafolkken/kit#1785).
+// and the two get opposite advice.
 // **Output that is not a count throws rather than parsing to `0`.** `Number('')` is `0`, and `0` is
 // the answer that says a branch holds nothing — so a read that came back empty or unparseable would
 // report "nothing is stranded" about a branch nobody measured, which is the one wrong answer that
@@ -180,8 +192,9 @@ function is_upstream_not_set_error(error: unknown): boolean {
 const NO_VERIFY_FLAG = '--no-verify'
 
 // Both pushes go through `git_push_transport` rather than `git_spawn.with_output`, which is
-// what gives them a timeout and an SSH keepalive the local git commands beside them do not need
-// (joshuafolkken/kit#1251). The thrown error keeps the same `cause.exit_code` shape, so the 128
+// what gives them a transfer's timeout and an SSH keepalive the local git commands beside them do not
+// need.
+// The thrown error keeps the same `cause.exit_code` shape, so the 128
 // fallback below reads it exactly as it did.
 async function push_with_upstream(
 	branch_name: string,
@@ -190,8 +203,8 @@ async function push_with_upstream(
 	await git_push_transport.push([...verify_flags, '--set-upstream', 'origin', branch_name])
 }
 
-// **The push budget bounds the transfer alone** (joshuafolkken/kit#3300). The pre-push hook runs once,
-// unbounded, before either push and outside the `try`; both transfers then skip it with `--no-verify`,
+// **The push budget bounds the transfer alone**. The pre-push hook runs once,
+// on a suite's budget of its own, before either push and outside the `try`; both transfers then skip it with `--no-verify`,
 // so neither the timeout retry nor the `--set-upstream` fallback repeats it, and a failed hook is not
 // mistaken for a missing upstream. A git too old to run the hook ahead leaves it to the push, as before.
 async function push(): Promise<void> {
@@ -212,15 +225,14 @@ async function push(): Promise<void> {
 	}
 }
 
-// **`--ff-only` is named here rather than read out of whoever's git configuration is in force**
-// (joshuafolkken/kit#1683). A bare `git pull` decides its strategy from `pull.rebase` / `pull.ff`,
+// **`--ff-only` is named here rather than read out of whoever's git configuration is in force**.
+// A bare `git pull` decides its strategy from `pull.rebase` / `pull.ff`,
 // and with neither set — the state of a checkout nobody has configured — it decides nothing and
 // aborts the moment the two sides have each moved:
 //
 //     fatal: Need to specify how to reconcile divergent branches
 //
-// This is joshuafolkken/kit#1659's defect at the second of that issue's two `git pull` sites, left
-// there deliberately because the callers and the conditions differ. Every caller turns out to want
+// Every caller wants
 // the same thing: it is on the default branch, bringing it up to date before doing something else —
 // `main-sync.ts` for `josh ms`, `release-cli.ts` / `release-publish.ts` around the release pull
 // request, `scripts-ai/prep.ts` before it snapshots the overrides, and `git-branch.ts` →
@@ -237,7 +249,7 @@ async function pull_fast_forward(): Promise<void> {
 // Every local branch matching a `git branch --list` pattern, one name per line. The boolean below is
 // this same read, expressed on top of it rather than beside it: `run:hold`'s preflight check needs the name
 // itself, because the pull request an interrupted run left behind is keyed by its head branch and the
-// slug is not derivable from an issue number alone (joshuafolkken/kit#926).
+// slug is not derivable from an issue number alone.
 const SHORT_NAME_FORMAT = '--format=%(refname:short)'
 const REMOTES_FLAG = '--remotes'
 
@@ -286,7 +298,7 @@ function exclude_pathspec(file_path: string): string {
 	return `:(exclude,top)${file_path}`
 }
 
-// Every tracked modification, minus the paths the caller names (joshuafolkken/kit#1756). **The
+// Every tracked modification, minus the paths the caller names. **The
 // positive pathspec is not decoration**: a pathspec list made only of exclusions matches nothing at
 // all, so `ALL_PATHS_PATHSPEC` is what the exclusions are subtracted from. The one caller is
 // `git-staging.ts`, which keeps the observation ledger out of every ordinary commit.
@@ -302,18 +314,18 @@ async function add_path(file_path: string): Promise<void> {
 
 // Main's own line of history. Both reads below restrict themselves to it, and for one reason: a
 // child's commits are merged into main rather than being main's, so a walk that follows every parent
-// answers about everything ever merged instead of about main (joshuafolkken/kit#1169).
+// answers about everything ever merged instead of about main.
 const FIRST_PARENT_FLAG = '--first-parent'
 
 // The commits that touched `file_path` along `tip`'s own first-parent line, newest first.
 // **`--first-parent` is what keeps the answer about main's history rather than about everything ever
 // merged into it**: a child's own commits are not main's, and the version question
-// (joshuafolkken/kit#1169) is asked of main.
+// is asked of main.
 //
 // **`tip` is not decoration.** `--first-parent` only reads as "main's line" when the walk starts on
 // main; started on a feature branch it walks that branch's commits first, and any merge main took
 // after the branch was cut is not an ancestor at all. A caller that is not on main names the ref it
-// means — `origin/main`, say — rather than inheriting `HEAD` (joshuafolkken/kit#1486).
+// means — `origin/main`, say — rather than inheriting `HEAD`.
 async function log_first_parent(
 	limit: number,
 	file_path: string,
@@ -344,7 +356,7 @@ async function show_file(spec: string): Promise<string> {
 // merges made *inside* a pull request branch — GitHub's "Update branch" button, or a local
 // `git merge main` before pushing. Measured on this repository, `HEAD~200..HEAD` counts 201 merges
 // unrestricted and 200 along the first-parent line, so one such merge is already in the last two
-// hundred commits and would have inflated a release by a whole minor (joshuafolkken/kit#1169).
+// hundred commits and would have inflated a release by a whole minor.
 const MERGE_COUNT_ARGUMENTS: ReadonlyArray<string> = [
 	'rev-list',
 	'--count',
@@ -374,8 +386,8 @@ const git_command = {
 	head_commit,
 	git_directories,
 	diff_cached,
-	// The default branch, the change base and every reading against it are `git-diff-reads.ts`'s
-	// (joshuafolkken/kit#3264), re-exported here so no call site, mock or spy moved with them.
+	// The default branch, the change base and every reading against it are `git-diff-reads.ts`'s,
+	// re-exported here so no call site, mock or spy moved with them.
 	...git_diff_reads,
 	fetch_branch,
 	merge_fast_forward,

package/scripts/git/git-common-directory.ts

@@ -3,7 +3,7 @@ import { git_utilities } from './constants'
 import { git_command } from './git-command'
 import { git_location_environment, GIT_LOCATION_VARIABLES } from './git-location-environment'
 
-// The one synchronous read of a checkout's two git directories (joshuafolkken/kit#2986) — the same
+// The one synchronous read of a checkout's two git directories — the same
 // `GIT_DIRECTORY_ARGUMENTS` `git_command.git_directories` asks asynchronously, so the two spellings
 // cannot name different directories. It had been run in three places with three timeouts and no
 // memory of the answer, though a `PreToolUse` hook may ask it several times in one call.
@@ -20,8 +20,8 @@ const PROBE_TIMEOUT_MS = 5000
 const answers = new Map<string, ReadonlyArray<string>>()
 
 // With an explicit `cwd`, the git location variables are cleared so that directory is what git answers
-// for: a hook exports `GIT_DIR`, which beats `cwd` and would name the hook's checkout instead
-// (joshuafolkken/kit#2515). Without one the environment is kept, so the read resolves the same
+// for: a hook exports `GIT_DIR`, which beats `cwd` and would name the hook's checkout instead.
+// Without one the environment is kept, so the read resolves the same
 // checkout as the asynchronous `git_directories`.
 function probe_environment(cwd: string | undefined): NodeJS.ProcessEnv {
 	if (cwd === undefined) return process.env

package/scripts/git/git-diff-reads.ts

@@ -1,8 +1,8 @@
 import { git_spawn } from './git-spawn'
 
 // The default branch, the base a change is measured against, and every "changed" reading taken
-// against that base — split out of `git-command.ts` when it reached its line limit
-// (joshuafolkken/kit#3264). `git_command` re-exports each one under the name it always had, so the
+// against that base — split out of `git-command.ts` when it reached its line limit.
+// `git_command` re-exports each one under the name it always had, so the
 // move changed no call site and no suite that mocks or spies on `git_command`.
 
 const REFS_REMOTES_ORIGIN_PREFIX = 'refs/remotes/origin/'
@@ -26,8 +26,8 @@ async function get_default_branch(): Promise<string> {
 
 const MERGE_BASE_COMMAND = 'merge-base'
 
-// **The ref the default branch is actually at**, which is not the same thing as its name
-// (joshuafolkken/kit#1535). `get_default_branch` returns the bare name, and git resolves that to the
+// **The ref the default branch is actually at**, which is not the same thing as its name.
+// `get_default_branch` returns the bare name, and git resolves that to the
 // *local* `refs/heads/<default>` — a ref nothing in this workflow advances, because merges happen on
 // GitHub and the default branch is checked out in no work tree. This is the single source both the
 // lane's start point and `change_base` below resolve through, so a lane cut from
@@ -59,7 +59,7 @@ async function default_branch_reference(): Promise<string> {
 // against, in place of the default branch itself.
 //
 // **A two-dot `git diff <default-branch>` compares a moving *ref* to the working tree, and in a
-// linked work tree that ref is shared with every other lane** (joshuafolkken/kit#1527). So when one
+// linked work tree that ref is shared with every other lane**. So when one
 // lane merges, an unmerged lane's diff picks that lane's files up in reverse: files this branch
 // never touched arrive in `josh review:brief`'s target list, in the digest map `josh gate` stamps,
 // and in `josh review:round2`'s fix delta.
@@ -96,24 +96,24 @@ async function diff_main(file_path: string): Promise<string> {
 
 // Names only, for callers that classify a change rather than read it — `josh review:level` decides
 // the review depth from the paths alone, and reading the whole diff to get them would be the
-// expensive half of the thing it exists to make cheaper (joshuafolkken/kit#966).
+// expensive half of the thing it exists to make cheaper.
 //
 // `core.quotePath=false` is not cosmetic. With git's default, a path containing any non-ASCII byte
 // comes back C-quoted — `"prompts/\343\202\263.md"` — and a classifier testing `startsWith('prompts/')`
 // against a string that begins with a quote character answers no. `review:level` fails safe there
 // (non-inert wins), but a classifier that answered `skip` would drop a change it is meant to catch,
-// so the quoting is turned off at the source every reader shares (joshuafolkken/kit#907).
+// so the quoting is turned off at the source every reader shares.
 const NO_PATH_QUOTING: ReadonlyArray<string> = ['-c', 'core.quotePath=false']
 
 // Repository-root-relative paths, whatever the checkout is configured to prefer. `diff.relative` is
 // a per-repository setting a person may have turned on for their own reading, and with it `git diff
 // --name-only` run from a subdirectory prints cwd-relative paths — which every caller of this
-// reading then joins onto the repository root (joshuafolkken/kit#1257). The flag pins the spelling
+// reading then joins onto the repository root. The flag pins the spelling
 // at the source rather than leaving each caller to discover the configuration.
 const NO_RELATIVE_PATHS = '--no-relative'
 
 // **Rename detection is turned off because this listing is a description of a tree, not a summary of
-// a change** (joshuafolkken/kit#1533). With git's default `diff.renames=true`, a rename prints only
+// a change**. With git's default `diff.renames=true`, a rename prints only
 // its *destination*: `git diff --name-only <base>` across a commit that moved `scripts/init-logic.ts`
 // to `scripts/init/init-logic.ts` names the second path and never the first.
 //
@@ -139,10 +139,9 @@ const NO_RENAME_DETECTION = '--no-renames'
 // The commit `change_base` resolves to. Every "changed" reading below is a diff against it, so a set
 // of changed paths — or a map of their digests — means nothing without it: fetch an advanced default
 // branch and rebase onto it, and each digest can stay identical while the rest of the tree is
-// replaced by code no check has read (joshuafolkken/kit#1328). A rebase still invalidates a stamp
+// replaced by code no check has read. A rebase still invalidates a stamp
 // taken against it — the rebase moves `HEAD`, and with it the merge base — while another lane
-// merging into the shared default branch no longer does, because it moves neither
-// (joshuafolkken/kit#1527).
+// merging into the shared default branch no longer does, because it moves neither.
 async function change_base_commit(): Promise<string> {
 	return await git_spawn.read(['rev-parse', await change_base()])
 }
@@ -187,10 +186,10 @@ async function diff_main_numstat(): Promise<string> {
 
 // Files git is not tracking yet. `git diff` never lists them, so a classifier built on the diff
 // alone sees a change that adds a whole new module as an empty one — which is how a run adding new
-// code could have been handed a reduced review level (joshuafolkken/kit#966).
+// code could have been handed a reduced review level.
 //
-// **`--full-name` and the `:/` pathspec are what make this reading agree with the diff beside it**
-// (joshuafolkken/kit#1257). `git diff --name-only` prints repository-root-relative paths for the
+// **`--full-name` and the `:/` pathspec are what make this reading agree with the diff beside it**.
+// `git diff --name-only` prints repository-root-relative paths for the
 // whole tree wherever it is run; `git ls-files --others` prints *cwd*-relative paths and lists only
 // what is below cwd. Read from a subdirectory, the two halves of `changed_paths` therefore came
 // back in two different coordinate systems, and every caller that resolves a path against the

package/scripts/git/git-error.ts

@@ -37,7 +37,7 @@ function display_error_details(cause: unknown): void {
 const FAILURE_EXIT_CODE = 1
 const OPERATION_CANCELLED_MESSAGE = '💡 Operation cancelled.'
 
-// **A library refuses by throwing; only the CLI entry decides the exit code** (joshuafolkken/kit#2985).
+// **A library refuses by throwing; only the CLI entry decides the exit code**.
 // `process.exit()` from an imported module skips every `finally` above it (a lock release included)
 // and truncates a piped stdout, so these modules throw a typed error instead, and `handle` — the catch
 // at each entry — renders it and sets `process.exitCode`.

package/scripts/git/git-execa-error.ts

@@ -14,8 +14,7 @@ function get_exit_code(error: unknown): number | undefined {
 // had printed one line first would otherwise be reported as whatever that line happened to say.
 //
 // It lives here rather than beside either caller because both `gh` and `git push` now pass a
-// timeout, and a second copy of the same three lines is the duplication `CLAUDE.md` prohibits
-// (joshuafolkken/kit#1251).
+// timeout, and a second copy of the same three lines is the duplication `CLAUDE.md` prohibits.
 function has_timed_out(error: unknown): boolean {
 	if (typeof error !== 'object' || error === null || !('timedOut' in error)) return false
 

package/scripts/git/git-issue.ts

@@ -1,4 +1,6 @@
 import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { issue_cite } from '#scripts/issue/issue-cite'
+import { session_cite } from '#scripts/issue/session-cite'
 import { lane_paths } from '#scripts/lane/lane-paths'
 import { SEPARATOR_LINE } from './constants'
 import { git_prompt } from './git-prompt'
@@ -52,7 +54,7 @@ function parse_issue_input(input: string): IssueInfo {
 	const issue_number = extract_issue_number(trimmed_input)
 	const title = extract_issue_title(trimmed_input)
 	const branch_name = create_branch_name(issue_number, title)
-	const commit_message = `${title} #${issue_number}`
+	const commit_message = `${title} ${issue_cite.plain(issue_number)}`
 
 	return {
 		title,
@@ -64,10 +66,10 @@ function parse_issue_input(input: string): IssueInfo {
 
 const BRANCH_NUMBER_PATTERN = /^(\d+)-(.+)$/u
 
-// A lane's branch is `<N>-lane` (joshuafolkken/kit#1490), so its second segment is the fixed word
-// `lane` rather than a slug of the title — de-slugging it produced commit messages like `lane #1465`
-// on joshuafolkken/kit#1586. The shape is recognized through `lane_paths.lane_branch` rather than a
-// second copy of the suffix, so the two ends cannot drift apart (joshuafolkken/kit#1590).
+// A lane's branch is `<N>-lane`, so its second segment is the fixed word
+// `lane` rather than a slug of the title — de-slugging it would produce commit messages like
+// `lane #1465`. The shape is recognized through `lane_paths.lane_branch` rather than a
+// second copy of the suffix, so the two ends cannot drift apart.
 function is_lane_branch(branch_name: string, issue_number: string): boolean {
 	return branch_name === lane_paths.lane_branch(issue_number)
 }
@@ -75,7 +77,7 @@ function is_lane_branch(branch_name: string, issue_number: string): boolean {
 const EXAMPLE_ISSUE_NUMBER = '42'
 
 function argument_hint(issue_number: string): string {
-	return `Provide an issue argument like "title #${issue_number}".`
+	return `Provide an issue argument like "title ${issue_cite.plain(issue_number)}".`
 }
 
 // Never falls back to the branch's own word: `lane` is not a title, and a commit message cannot be
@@ -85,7 +87,7 @@ async function lane_issue_title(branch_name: string, issue_number: string): Prom
 
 	if (title === undefined) {
 		throw new Error(
-			`Cannot read the title of issue #${issue_number} for lane branch "${branch_name}". ${argument_hint(issue_number)}`,
+			`Cannot read the title of issue ${session_cite.issue(issue_number)} for lane branch "${branch_name}". ${argument_hint(issue_number)}`,
 		)
 	}
 
@@ -110,7 +112,7 @@ async function derive_issue_input_from_branch(branch_name: string): Promise<stri
 		? await lane_issue_title(branch_name, number)
 		: slug.replaceAll('-', ' ').trim()
 
-	return `${title} #${number}`
+	return `${title} ${issue_cite.plain(number)}`
 }
 
 async function derive_from_branch(branch_name: string): Promise<IssueInfo> {

package/scripts/git/git-location-environment.ts

@@ -4,11 +4,10 @@
 // git exports them to every hook it runs, so a child process spawned from inside `pre-commit` or
 // `pre-push` inherits a pointer at the repository the hook is firing in. A helper that passes
 // `{ cwd: fixture_directory }` and nothing else therefore writes into the **real** checkout, with no
-// error anywhere: joshuafolkken/kit#1515 found it in `propagate-git`'s probes, and
-// joshuafolkken/kit#1530 found the same shape in `lane-change-base.test.ts`, where it committed a
-// test fixture's own commits onto a lane's live branch during the pre-push gate.
+// error anywhere — a test fixture's own commits can land on a lane's live branch during the pre-push
+// gate.
 //
-// The list is single-sourced here because it now has three consumers that must not drift apart: the
+// The list is single-sourced here because it has three consumers that must not drift apart: the
 // probes that clear it, the fixture that clears it, and the unit-suite guard that refuses a write
 // while any of it is set (`scripts/test/test-repository-guard.ts`).
 //

package/scripts/git/git-ls-remote.ts

@@ -1,8 +1,7 @@
-// How origin is asked whether it carries a branch — the one place that says it
-// (joshuafolkken/kit#1732).
+// How origin is asked whether it carries a branch — the one place that says it.
 //
 // **The pattern is the full ref path, because `ls-remote` matches a pattern against the *tail* of a
-// ref at a slash boundary** (joshuafolkken/kit#1709). A bare name therefore answers for any branch
+// ref at a slash boundary**. A bare name therefore answers for any branch
 // ending in it: `1641-lane` matches `refs/heads/wip/1641-lane`, and `release/v1.2.0` matches
 // `refs/heads/foo/release/v1.2.0`. **`--heads` does not close it** — that limits which refs are
 // considered, not where inside one the pattern may match. Anchored at `refs/heads/`, only the exact
@@ -11,11 +10,10 @@
 // slash.
 //
 // **It is the arguments that are shared, not the spawn.** `git_worktree.ls_remote_branch` runs this
-// asynchronously against the process's own cwd with no timeout, while
-// `propagate_git.has_remote_branch` runs it synchronously against a consumer's path under a remote
-// budget — three differences that belong to those callers. What was duplicated is the knowledge
-// above, and joshuafolkken/kit#1709 fixed it in only one of the two places, which is the defect
-// joshuafolkken/kit#1732 was filed for. Kept in one module, the next such fix reaches both.
+// asynchronously against the process's own cwd, while `propagate_git.has_remote_branch` runs it
+// synchronously against a consumer's path — both under a remote budget, and two differences that
+// belong to those callers. What is shared is the knowledge above:
+// kept in one module, a fix to it reaches both.
 const LS_REMOTE_COMMAND = 'ls-remote'
 const HEADS_FLAG = '--heads'
 const ORIGIN_REMOTE = 'origin'

package/scripts/git/git-pre-push-hook.ts

@@ -1,9 +1,10 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
+import { SUITE_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { git_spawn } from './git-spawn'
 
-// The pre-push hook, run ahead of the push instead of inside it (joshuafolkken/kit#3300).
+// The pre-push hook, run ahead of the push instead of inside it.
 //
 // **The push budget is a transfer budget, and a hook is not a transfer.** `PUSH_TIMEOUT_MS` was read
 // off what moving objects costs here, but `git push` runs the pre-push hook first and the budget
@@ -13,9 +14,10 @@ import { git_spawn } from './git-spawn'
 // either: lefthook and vitest outlived it, and the retry started a second suite in the same work tree,
 // where each `test-state-guard` read the other's temporary files as a mutation and both failed.
 //
-// So the hook runs here, once, with no budget, and `git_command.push` spawns the bounded transfer that
-// follows with `--no-verify`. The retry then repeats the transfer alone, and a hook that is still
-// running cannot exist for it to overlap.
+// So the hook runs here, once, on a suite's budget rather than a transfer's, and `git_command.push`
+// spawns the bounded transfer that follows with `--no-verify`. The retry then repeats the transfer
+// alone, and a hook that is still running cannot exist for it to overlap: a hook cut at
+// `SUITE_TIMEOUT_MS` fails the push instead of reaching the transfer.
 //
 // **What git hands the hook is reproduced rather than dropped.** `git hook run` executes whatever
 // hook is configured — lefthook's or anyone's — and the arguments and stdin are git's pre-push
@@ -108,12 +110,11 @@ async function run_with_stdin(stdin_line: string): Promise<boolean> {
 		if (!(await can_run_hooks(stdin_path))) return false
 		const url = await git_spawn.read(['remote', 'get-url', REMOTE])
 
-		await git_spawn.with_output('hook', [
-			...to_hook_run_arguments(stdin_path, HOOK_NAME),
-			'--',
-			REMOTE,
-			url,
-		])
+		await git_spawn.with_output(
+			'hook',
+			[...to_hook_run_arguments(stdin_path, HOOK_NAME), '--', REMOTE, url],
+			{ timeout_ms: SUITE_TIMEOUT_MS },
+		)
 
 		return true
 	} finally {

package/scripts/git/git-preflight.ts

@@ -7,10 +7,10 @@ import { git_branch } from './git-branch'
 import { git_command } from './git-command'
 import { git_issue, type IssueInfo } from './git-issue'
 
-// joshuafolkken/kit#2817. A first `josh git -y` was refused once per unmet precondition — the title's
-// issue number, the branch name, the issue's release classification — each only after the stage
-// before it had already staged, switched or pushed. **Every precondition decidable at the start is
-// asked here, before anything changes, and all of them are reported at once.** No rule is new: each
+// A later stage of `josh git -y` refuses on an unmet precondition — the title's issue number, the
+// branch name, the issue's release classification — only after the stage before it has already
+// staged, switched or pushed. **Every precondition decidable at the start is asked here, before
+// anything changes, and all of them are reported at once.** No rule is new: each
 // answer comes from the function the later stage refuses with, so the two cannot drift apart.
 
 interface PreflightInput {
@@ -131,7 +131,7 @@ async function answer(input: PreflightInput): Promise<PreflightAnswer> {
 	return { pr_target, problems: [...problems, ...pr_problems] }
 }
 
-// joshuafolkken/kit#2946: the unmet preconditions as a list, so `josh ship` can ask them before its
+// The unmet preconditions as a list, so `josh ship` can ask them before its
 // review and gate start instead of meeting the refusal at the commit stage.
 async function problems_of(input: PreflightInput): Promise<Array<string>> {
 	const { problems } = await answer(input)

package/scripts/git/git-push-transport.ts

@@ -10,8 +10,8 @@ import { git_ssh_keepalive } from './git-ssh-keepalive'
 
 const MS_PER_SECOND = 1000
 
-// The budget for one `git push`, and the reason a push can no longer wait without end
-// (joshuafolkken/kit#1251). Measured on PR #1244: the commit itself took 0.6 seconds and the push
+// The budget for one `git push`, and the reason a push can no longer wait without end.
+// Measured on PR #1244: the commit itself took 0.6 seconds and the push
 // then sat silent for 8 minutes 13 seconds before it was found by hand and killed — about 9 minutes
 // 50 seconds of a 72-minute run, with no way while waiting to tell a stalled push from a slow one.
 // `execa` has always accepted a `timeout`; the push path never passed one, which left it the single

package/scripts/git/git-remote-branch.ts

@@ -1,7 +1,6 @@
 import { git_worktree } from './git-worktree'
 
-// Does origin still have this branch, and could we even tell? (joshuafolkken/kit#1641; lifted out of
-// `scripts/lane/lane-start-point.ts`, which asked the question first.)
+// Does origin still have this branch, and could we even tell?
 //
 // **The remote-tracking ref is not evidence that the remote still has the branch.** Nothing here
 // prunes it — `lane:close` removes the work tree and the local branch, GitHub deletes the remote