@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/scripts/gate/moved-paths.ts

@@ -0,0 +1,67 @@
+import { git_spawn } from '#scripts/git/git-spawn'
+import { file_map_stamp, type FileMapStamp } from '#scripts/josh/file-map-stamp'
+import type { GateTree } from './gate-tree'
+
+// Every path whose content can differ from the tree a green record was taken on — the one reading the
+// gate's per-check reuse (`check-reuse.ts`) and the scoped checks' since-green narrowing
+// (`since-green.ts`) both act on, so the two can never disagree about what moved.
+//
+// **What moved is the union of two diffs**. The changed-file map is a diff against the merge base, so a
+// path absent from both maps holds the merge base's content — and the base's own diff
+// (`git diff <recorded> <current>`) names every path that content moved for, which is what a main sync
+// brought in. A path in either map whose digest differs is the other half
+// (`file_map_stamp.changed_since`).
+
+const NAME_SEPARATOR = '\0'
+const BASE_DIFF = ['diff', '--name-only', '--no-renames', '-z'] as const
+
+async function base_diff(from: string, to: string): Promise<ReadonlyArray<string> | undefined> {
+	if (from === to) return []
+
+	try {
+		const names = await git_spawn.read([...BASE_DIFF, from, to])
+
+		return names.split(NAME_SEPARATOR).filter((name) => name !== '')
+	} catch {
+		return undefined
+	}
+}
+
+// The two diffs apart: `synced` is what a main sync brought in, `changed` the paths whose digest moved.
+// A path can be in both.
+interface MovedParts {
+	changed: ReadonlyArray<string>
+	synced: ReadonlyArray<string>
+}
+
+// `undefined` when the record cannot be compared: no base on either side, or a tree map that came back
+// empty — also what `gate-tree.ts` answers when git could not be read, so it describes no tree.
+async function moved_parts(stamp: FileMapStamp, tree: GateTree): Promise<MovedParts | undefined> {
+	const is_unread = Object.keys(tree.files).length === 0
+
+	if (is_unread || stamp.base === undefined || tree.base === undefined) return undefined
+
+	const synced = await base_diff(stamp.base, tree.base)
+
+	if (synced === undefined) return undefined
+
+	return { changed: file_map_stamp.changed_since(stamp, tree.files), synced }
+}
+
+function union_of(parts: MovedParts): ReadonlyArray<string> {
+	return [...new Set([...parts.changed, ...parts.synced])]
+}
+
+async function moved_since(
+	stamp: FileMapStamp,
+	tree: GateTree,
+): Promise<ReadonlyArray<string> | undefined> {
+	const parts = await moved_parts(stamp, tree)
+
+	return parts === undefined ? undefined : union_of(parts)
+}
+
+const moved_paths = { moved_parts, moved_since, union_of }
+
+export type { MovedParts }
+export { moved_paths }

package/scripts/gate/pre-commit-type-check.ts

@@ -3,6 +3,7 @@ import { fileURLToPath } from 'node:url'
 import type { FileMapStamp } from '#scripts/josh/file-map-stamp'
 import { resolve_spawn_exit } from '#scripts/lib/spawn-exit'
 import { execa } from 'execa'
+import { core_budget } from './core-budget'
 import { gate_skip } from './gate-skip'
 import { gate_tree, type GateTree } from './gate-tree'
 import { hook_gate_reuse } from './hook-gate-reuse'
@@ -143,6 +144,18 @@ async function run_type_check(): Promise<number> {
 	return resolve_spawn_exit(PNPM, result)
 }
 
+// **The type check claims the place `josh check` claims** (joshuafolkken/kit#3944), so lefthook's
+// parallel commit hooks stop reaching other lanes' admission as foreign load. Only a miss reserves:
+// a reused record runs nothing, and a claim there could make a commit wait out a full ledger for a
+// check it then skips.
+async function run_reserved_type_check(): Promise<number> {
+	return await core_budget.with_command_reservation(
+		core_budget.CORE_WEIGHTS.type_check,
+		run_type_check,
+		{ memory_mb: core_budget.MEMORY_MB.type_check, command: 'pre-commit type check' },
+	)
+}
+
 function unexpected_arguments(extra_arguments: ReadonlyArray<string>): ReadonlyArray<string> {
 	return extra_arguments.filter((argument) => argument !== gate_skip.FORCE_FLAG)
 }
@@ -161,7 +174,7 @@ async function run_pre_commit_type_check(
 
 	const reusable = await reusable_green_commit(await read_commit_tree(), extra_arguments, source)
 
-	if (reusable === undefined) return await run_type_check()
+	if (reusable === undefined) return await run_reserved_type_check()
 
 	process.stdout.write(`${format_skip(reusable.taken_at)}\n`)
 

package/scripts/gate/project-checks.ts

@@ -1,4 +1,4 @@
-import { existsSync, globSync, readFileSync } from 'node:fs'
+import { existsSync, globSync } from 'node:fs'
 import path from 'node:path'
 import { find_local_bin_upwards } from '#scripts/build/local-bin'
 import { doctor_consumer } from '#scripts/doctor/doctor-consumer'
@@ -6,10 +6,10 @@ import { own_formatter } from '#scripts/init/own-formatter'
 import { project_profile } from '#scripts/init/project-profile'
 import { ancestor_directories } from '#scripts/lib/ancestor-directories'
 import { json_value } from '#scripts/lib/json-value'
+import { package_manifest } from '#scripts/lib/package-manifest'
 import { NOT_USED_MARKER, SKIP_MARKER } from '#scripts/test/skip-marker'
 import { z } from 'zod'
 
-const PACKAGE_JSON = 'package.json'
 const IGNORED_DIRS = new Set([
 	'node_modules',
 	'.git',
@@ -48,7 +48,7 @@ const object_schema = z.record(z.string(), z.unknown())
 function project_root(directory: string): string {
 	return (
 		ancestor_directories.nearest(directory, (candidate) =>
-			existsSync(path.join(candidate, PACKAGE_JSON)),
+			existsSync(package_manifest.manifest_path(candidate)),
 		) ?? directory
 	)
 }
@@ -86,16 +86,9 @@ function is_basic_manifest(manifest: unknown): boolean {
 	return project_profile.parse_profile(josh['profile']) === 'basic'
 }
 
-// The try covers the read alone — a missing or unreadable manifest — since the parse already answers
-// `undefined` for text that is not JSON.
+// A missing, unreadable or non-JSON manifest answers `undefined`; the shape is each caller's question.
 function read_manifest(directory: string): unknown {
-	try {
-		const manifest_path = path.join(project_root(directory), PACKAGE_JSON)
-
-		return json_value.parse_or_undefined(readFileSync(manifest_path, 'utf8'))
-	} catch {
-		return undefined
-	}
+	return package_manifest.read_manifest_if_valid(project_root(directory), z.unknown())
 }
 
 function is_basic(directory: string): boolean {

package/scripts/gate/scoped-green.ts

@@ -12,14 +12,14 @@ import { gate_tree, type GateTree } from './gate-tree'
 // tree neither check has read return their findings one round trip at a time; one call running both
 // checks first returns most of them at once.
 //
-// **It fixes when the checks run, never whether they run, and never what they check.** Nothing here
-// skips a check, narrows one, or reinterprets its output — a green record buys ordering and nothing
-// else, and `josh gate` still runs its four checks exactly as before. It never *reuses* a scoped
-// check's result in place of re-running it.
+// **It fixes when the checks run, never whether they run.** Nothing here skips a check or
+// reinterprets its output, and `josh gate` still runs its four checks exactly as before. The one other
+// reader is the checks' own re-run, which narrows to what moved since this record (`since-green.ts`).
 //
 // **The judgement is the gate's own, not a second one.** "There is a record and nothing it covers has
 // moved" is `review_brief.matching_stamp` plus the base equality `gate_skip.reusable_green_gate`
-// already compares, over the same `FileMapStamp` shape written to the same kind of file. A second
+// already compares and the inputs fingerprint each record carries (`verification-inputs.ts`), over the
+// same `FileMapStamp` shape written to the same kind of file. A second
 // definition of "this tree is unchanged" is the clone `CLAUDE.md` prohibits, and it is exactly where
 // two commands would start disagreeing about one working tree.
 //
@@ -95,7 +95,11 @@ function checks_of(sources: ScopedSources): ReadonlyArray<ScopedCheck> {
 function describes_tree(check: ScopedCheck, tree: Record<string, string>, base: string): boolean {
 	const stamp = review_brief.matching_stamp(check.stamp.read(check.source), tree)
 
-	return stamp !== undefined && file_map_stamp.describes_base(stamp, base)
+	return (
+		stamp !== undefined &&
+		file_map_stamp.describes_base(stamp, base) &&
+		check.stamp.describes_inputs(stamp)
+	)
 }
 
 // **Whether there is a tree to speak about at all**, asked once and used from both ends: the reader
@@ -161,8 +165,8 @@ function refusal(missing: ReadonlyArray<string>): string {
 		'282 seconds, 31% of the run, picking up one lint rule and one failing test at a time after its ' +
 		'review had already started. Run them in one call — ' +
 		`\`${LINT_COMMAND} && ${TEST_COMMAND}\`, measured at 13.8 seconds — and reissue this command. ` +
-		'The record fixes when the checks run and never whether they run: nothing is skipped, narrowed ' +
-		'or reused because of it. `prompts/review.md` → "The scoped checks answer on the last edit".'
+		'The record fixes when the checks run and never whether they run: nothing is skipped or reused ' +
+		'because of it. `prompts/review.md` → "The scoped checks answer on the last edit".'
 	)
 }
 

package/scripts/gate/since-green.ts

@@ -0,0 +1,62 @@
+import type { FileMapStampAccess } from '#scripts/josh/file-map-stamp'
+import { gate_tree } from './gate-tree'
+import { moved_paths, type MovedParts } from './moved-paths'
+import { verification_inputs } from './verification-inputs'
+
+// **A scoped check re-run reads only what moved since its last green run on this checkout**
+// (joshuafolkken/kit#4393). A lane's ship retry — after a review fix or a preflight stop — re-ran
+// `josh lint:related` and `josh test:related` (the gate's unit step too) over the whole branch diff,
+// though everything outside the fix had been green on the tree before it.
+//
+// **The check is no weaker.** The green record (`scoped-green.ts`) vouches that the check passed over
+// the branch diff of the tree it names; what moved since is every path whose content can differ from
+// that tree (`moved-paths.ts`), a main sync's own changes included. A record written by a narrowed run
+// vouches for the same thing, by the same argument one run earlier.
+//
+// **Whatever cannot be narrowed answers `undefined`**, and the caller reads the whole branch change as
+// before: no record, one that cannot be compared, one written under other tools or environment, or a
+// moved file the check's declaration names a configuration — a file green under the old configuration
+// says nothing under the new one. An empty list is
+// the positive fact that nothing moved: the gate's unit step on the tree the preflight just passed.
+
+// The narrowing line each command prints before it runs, so a since-green run is never read as one
+// over the whole branch.
+function describe(label: string, moved: ReadonlyArray<string>): string {
+	return `${label}: reading only the ${String(moved.length)} file(s) changed since its last green run on this checkout.`
+}
+
+function is_narrowable(label: string, parts: MovedParts | undefined): parts is MovedParts {
+	return parts !== undefined && !verification_inputs.configures(label, moved_paths.union_of(parts))
+}
+
+// What moved with a main sync's part kept apart, for a caller that records how much of its input the
+// sync brought in (`josh test:related`, joshuafolkken/kit#4465). `label` names the gate check whose
+// declaration (`verification-inputs.ts`) the record vouches for.
+async function read_moved_parts(
+	stamp: FileMapStampAccess,
+	label: string,
+	source?: string,
+): Promise<MovedParts | undefined> {
+	const record = stamp.read(source)
+
+	if (record === undefined || !stamp.describes_inputs(record)) return undefined
+
+	const parts = await moved_paths.moved_parts(record, await gate_tree.read_gate_tree())
+
+	return is_narrowable(label, parts) ? parts : undefined
+}
+
+// Repository-root-relative paths, or `undefined` when the caller has to read the whole branch change.
+async function read_moved(
+	stamp: FileMapStampAccess,
+	label: string,
+	source?: string,
+): Promise<ReadonlyArray<string> | undefined> {
+	const parts = await read_moved_parts(stamp, label, source)
+
+	return parts === undefined ? undefined : moved_paths.union_of(parts)
+}
+
+const since_green = { describe, read_moved, read_moved_parts }
+
+export { since_green }

package/scripts/gate/toolchain-inputs.ts

@@ -0,0 +1,115 @@
+import { createHash } from 'node:crypto'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+
+// **The toolchain's inputs, listed once** (joshuafolkken/kit#4496): the files whose content moves what
+// a tool answers while every source stays byte-identical — the installed packages, the eslint config
+// and the TypeScript program's options. Every result kept across runs is discarded when they move:
+// the metrics base cache (`metrics-base-cache.ts`), the hook bundles (`hook-bundle-stamp.ts`), the
+// warm ESLint daemon (`eslint-daemon.ts`) and the gate's verdicts (`verification-inputs.ts`). A file
+// added here reaches all of them.
+//
+// Loaded by plain `node` on every hook launch (`tools/hooks/hook-bundle-ready.ts`), so this module
+// imports `node:` built-ins alone.
+
+// The package manager's manifest, lock and settings files, and the record pnpm rewrites on every
+// install — a consumer's eslint config imports its rules from installed packages.
+const PACKAGE_FILES: ReadonlyArray<string> = [
+	'package.json',
+	'pnpm-lock.yaml',
+	'pnpm-workspace.yaml',
+	'package-lock.json',
+	'yarn.lock',
+	'bun.lock',
+	'bun.lockb',
+	'.npmrc',
+	'node_modules/.modules.yaml',
+]
+// The root entries of the eslint flat config and of the TypeScript program, and the directories of
+// the rule modules and the shared compiler options they import.
+const CONFIG_ENTRIES: ReadonlyArray<RegExp> = [
+	/^eslint\.config\.[cm]?[jt]s$/u,
+	/^tsconfig(?:\.[\w-]+)?\.json$/u,
+]
+const CONFIG_DIRECTORIES: ReadonlySet<string> = new Set(['eslint', 'tsconfig'])
+// A test beside the rule modules configures nothing.
+const TEST_MARKER = '.test.'
+const SEPARATOR = '/'
+const DIGEST_ALGORITHM = 'sha256'
+
+// Code-unit order, so the digest does not depend on the locale of the machine that computes it.
+function by_code_unit(left: string, right: string): number {
+	if (left === right) return 0
+
+	return left < right ? -1 : 1
+}
+
+function to_posix(relative: string): string {
+	return relative.split(path.sep).join(SEPARATOR)
+}
+
+function is_config_entry(name: string): boolean {
+	return CONFIG_ENTRIES.some((entry) => entry.test(name))
+}
+
+function is_config_module(relative: string): boolean {
+	const [top = ''] = relative.split(SEPARATOR, 1)
+
+	return CONFIG_DIRECTORIES.has(top) && !path.basename(relative).includes(TEST_MARKER)
+}
+
+// Whether the root-relative `relative` is a toolchain input.
+function is_input(relative: string): boolean {
+	const posix = to_posix(relative)
+	if (PACKAGE_FILES.includes(posix)) return true
+
+	return is_config_entry(posix) || is_config_module(posix)
+}
+
+// Files only: a directory moves on every entry created in it, an editor's temp file too.
+function modules_under(root: string, directory: string): ReadonlyArray<string> {
+	const absolute = path.join(root, directory)
+	if (!existsSync(absolute)) return []
+
+	return readdirSync(absolute, { recursive: true, withFileTypes: true })
+		.filter((entry) => entry.isFile())
+		.map((entry) => to_posix(path.relative(root, path.join(entry.parentPath, entry.name))))
+		.filter((relative) => is_config_module(relative))
+}
+
+// The root-relative toolchain inputs present under `root`, in code-unit order.
+function paths(root: string): ReadonlyArray<string> {
+	const present = PACKAGE_FILES.filter((relative) => existsSync(path.join(root, relative)))
+	const entries = readdirSync(root).filter((name) => is_config_entry(name))
+	const modules = [...CONFIG_DIRECTORIES].flatMap((directory) => modules_under(root, directory))
+
+	return [...present, ...entries, ...modules].toSorted(by_code_unit)
+}
+
+function read_or_empty(file: string): Uint8Array {
+	try {
+		return readFileSync(file)
+	} catch {
+		return new Uint8Array()
+	}
+}
+
+// **The fingerprint of the toolchain under `root`**: each input's path and content, in code-unit
+// order, so an added, removed, renamed or edited input changes it. A file gone between the listing
+// and its read hashes as empty.
+function digest(root: string): string {
+	const hash = createHash(DIGEST_ALGORITHM)
+
+	for (const relative of paths(root)) {
+		hash
+			.update(`${relative}\0`)
+			.update(read_or_empty(path.join(root, relative)))
+			.update('\0')
+	}
+
+	return hash.digest('hex')
+}
+
+const toolchain_inputs = { digest, is_input, PACKAGE_FILES, paths }
+
+export { toolchain_inputs }