@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/run/wake/run-wake-finish.ts

@@ -0,0 +1,137 @@
+import { telegram_notify } from '#scripts/notify/telegram-notify'
+import { run_event_stream } from '#scripts/run/event/run-event-stream'
+import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
+import { run_stranded_detect, type WatchedRun } from '#scripts/run/run-stranded-detect'
+import type { WakeStopReason } from './run-wake'
+import type { WakeContext } from './run-wake-describe'
+import { run_wake_loop, type LoopStop } from './run-wake-loop'
+
+// How a `run:wake --loop` supervisor ends: which stops reach a person, what the warning says, the
+// `stranded` event it leaves, and the verdict and exit code it ends on. The CLI that runs the loop is
+// `run-wake-cli.ts`.
+
+const SUCCESS_EXIT_CODE = 0
+const FAILURE_EXIT_CODE = 1
+
+// The command rather than one entry point: the supervisor continues a `queue` as readily as a
+// `backlogrun`, and a warning that named the wrong one would send the reader looking at a run that is
+// not the one that stopped.
+const WARNING_TITLE = 'run:wake supervisor'
+const WARNING_RECOVERY = `Check the wake command, then restart with \`pnpm josh run:wake --start\`.`
+// **The stop reasons that reach a person, and what each one tells them.** A reason mapped to
+// `undefined` is one where nothing went wrong: `ended` is the run finishing through `run:carry --end`,
+// `stopped` is a person's own `--stop` or a supervisor being superseded, and a warning channel that
+// fired on those is one that stops being read.
+//
+// **`unreadable` warns**, because it ends the supervisor while a carry record is still sitting there
+// handed off, so the run would otherwise be left asleep with nothing anywhere saying so.
+// **Every reason is listed, and the silent two are listed as `undefined`.** A partial map would let a
+// fifth stop reason compile straight past this and reach nobody, which is the defect class this
+// section exists to close.
+const STOP_BODIES: Record<WakeStopReason, string | undefined> = {
+	ended: undefined,
+	stopped: undefined,
+	reload: undefined,
+	failed: 'The supervisor could not continue the run and has stopped.',
+	unreadable:
+		'The carry record could not be read, so the supervisor stopped rather than guess at it.',
+}
+
+// The log is named in the warning rather than only in `--list`, because the person reading a warning
+// at three in the morning is the one who needs to know where to look next.
+function log_hint(context: WakeContext): string {
+	return `The output of every session this supervisor started is in ${context.log_target}.`
+}
+
+// The log hint goes ahead of the note: the Telegram length limit cuts the tail, and a long failure note
+// (stdout tail plus stderr tail) would otherwise take the one line that says where to look next.
+function warning_body(stop: LoopStop, body: string, context: WakeContext): string {
+	return [body, log_hint(context), stop.note].filter(Boolean).join('\n')
+}
+
+// Whether the warning reached a person — the answer `record_failure` leaves its marker on.
+async function warn_of_stop(stop: LoopStop, body: string, context: WakeContext): Promise<boolean> {
+	return await telegram_notify.warn({
+		issue_title: WARNING_TITLE,
+		body: warning_body(stop, body, context),
+		recovery: WARNING_RECOVERY,
+	})
+}
+
+// **A failed supervisor that leaves the run stranded says so on the stream, with its cause.** Nothing
+// else writes there when the supervisor gives up, so a reader of the events would see the last merge
+// and a run that looks as if it were still watching. The cause is the note's first line — the
+// driver's own `error …` — because the rest is a stderr tail the log already holds.
+//
+// **Only a strand, and only one a person was told of.** A `failed` stop is not always a strand: a
+// `run:carry --end` under a live driver fails it too, and that run ended cleanly. And the event is the
+// marker `run_stranded_detect` holds its own notification back on, so it is left only when the warning
+// was sent — after a failed send the stop-time detector still finds no marker, and notifies.
+function is_strand_told(stop: LoopStop, watched: WatchedRun, is_warned: boolean): boolean {
+	if (!is_warned || stop.reason !== run_wake_loop.FAILED_REASON) return false
+
+	return run_stranded_detect.is_left_stranded(watched)
+}
+
+async function record_failure(
+	stop: LoopStop,
+	watched: WatchedRun,
+	is_warned: boolean,
+): Promise<void> {
+	if (!is_strand_told(stop, watched, is_warned)) return
+
+	const [cause = ''] = (stop.note ?? '').split('\n', 1)
+
+	await run_event_stream_emit.emit(
+		run_event_stream.EVENT_KIND.STRANDED,
+		`The supervisor failed and stopped watching the run — ${cause}`,
+	)
+}
+
+// **Only a failed wake exits non-zero; `unreadable` warns but exits zero.** The
+// verdict-and-exit-code table in `docs/josh-commands-run.md` → `run:wake` is a contract callers branch on,
+// and what that one needs is the notification, not a different exit code.
+function exit_code_of(reason: WakeStopReason): number {
+	return reason === run_wake_loop.FAILED_REASON ? FAILURE_EXIT_CODE : SUCCESS_EXIT_CODE
+}
+
+// Which stops reach a person, and what each one says — `undefined` for the two where nothing went
+// wrong. It is a function rather than a bare lookup so the decision can be asserted for every reason
+// the loop can end on.
+function stop_body(reason: WakeStopReason): string | undefined {
+	return STOP_BODIES[reason]
+}
+
+// `started_at` is the run this supervisor took on — what `record_failure` tells an ended run by once
+// the carry record that held it no longer reads.
+async function warn_and_record(
+	stop: LoopStop,
+	body: string,
+	context: WakeContext,
+	started_at: string,
+): Promise<void> {
+	console.error(stop.note ?? body)
+	const is_warned = await warn_of_stop(stop, body, context)
+
+	await record_failure(stop, { ...context, started_at }, is_warned)
+}
+
+// A failure that reached nobody is the defect, so the Telegram goes out before the verdict is printed.
+async function finish(stop: LoopStop, context: WakeContext, started_at: string): Promise<number> {
+	const body = stop_body(stop.reason)
+
+	if (body !== undefined) await warn_and_record(stop, body, context, started_at)
+
+	console.info(stop.reason)
+
+	return exit_code_of(stop.reason)
+}
+
+const run_wake_finish = {
+	finish,
+	record_failure,
+	stop_body,
+	warning_body,
+}
+
+export { run_wake_finish }

package/scripts/run/wake/run-wake-loop.ts

@@ -1,3 +1,4 @@
+import { error_text } from '#scripts/lib/error-message'
 import type { CarryRead } from '#scripts/run/carry/run-carry'
 import {
 	run_wake,
@@ -22,8 +23,10 @@ import type { LaunchResult } from './run-wake-session'
 
 const STOPPED_REASON: WakeStopReason = 'stopped'
 const FAILED_REASON: WakeStopReason = 'failed'
+const RELOAD_REASON: WakeStopReason = 'reload'
 const NO_ATTEMPTS = 0
 const STOPPED_BY_PERSON: LoopStop = { reason: STOPPED_REASON, note: undefined }
+const CODE_CHANGED: LoopStop = { reason: RELOAD_REASON, note: undefined }
 
 interface LoopPorts {
 	// The carry record, re-read every pass rather than cached: it is written by the parent loop of a
@@ -47,10 +50,16 @@ interface LoopPorts {
 	wake: (invocation: string, session_id: string, material: string) => LaunchResult
 	sleep: (milliseconds: number) => Promise<void>
 	now: () => Date
+	// Closes again a lane a process outlived, once the process is gone (`lane_close.retry_closes`), and
+	// withdraws a lane whose issue was closed as not planned (`lane_withdraw_closed.withdraw_closed`).
+	retry_closes: () => Promise<void>
+	// Whether the code this process loaded differs from the code on disk now (`run-wake-code.ts`).
+	is_code_stale: () => Promise<boolean>
 }
 
-// `released`: the carry record ended while the driver paused, so there is nothing to hand on and the
-// next pass decides from the record how the run ends.
+// `released`: the carry record ended while the driver paused, or the driver's window was spent, so
+// there is nothing to hand on and the next pass decides from the record whether the run ends, reloads
+// or drives on.
 type DriveResult =
 	| { kind: 'finished' }
 	| { kind: 'released' }
@@ -151,15 +160,38 @@ async function decide_pass(wake: RunWake, ports: LoopPorts): Promise<WakeDecisio
 	return run_wake.decide({ ...input, has_work: await ports.has_work(input.read) })
 }
 
+// A lane whose close a process outlived ends once the process is gone (joshuafolkken/kit#4300), and
+// a lane whose issue was closed as not planned is withdrawn (joshuafolkken/kit#4915). A failed retry
+// is the next pass's to try again, never a reason to stop the run.
+async function retry_closes(ports: LoopPorts): Promise<void> {
+	try {
+		await ports.retry_closes()
+	} catch (error) {
+		error_text.trace_swallowed('run_wake_loop.retry_closes', error)
+	}
+}
+
 // The record is re-read at the top of every pass rather than carried in a variable, so a `--stop` that
 // removed it ends the loop at the next interval and a `--list` reads what the loop actually wrote.
 // One pass: decide, act, write the result back. `undefined` means carry on to the next interval.
+//
+// **A pass boundary is where the supervisor reloads its code** (joshuafolkken/kit#4509): no driver
+// is running and no session is being launched, so a successor on the new code takes over without
+// stopping any lane. A record already removed ends the loop before this pass is reached, and a carry
+// record that ended or became unreadable stops the run before the code is checked, so a reload never
+// hands a finished run to a successor.
 async function run_pass(
 	target: string,
 	wake: RunWake,
 	ports: LoopPorts,
 ): Promise<LoopStop | undefined> {
-	const outcome = await step(wake, await decide_pass(wake, ports), ports)
+	const decision = await decide_pass(wake, ports)
+
+	if (decision.kind !== 'stop' && (await ports.is_code_stale())) return CODE_CHANGED
+
+	await retry_closes(ports)
+
+	const outcome = await step(wake, decision, ports)
 
 	if (outcome.kind === 'stop') return outcome.stop
 
@@ -197,6 +229,7 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 
 const run_wake_loop = {
 	FAILED_REASON,
+	RELOAD_REASON,
 	run_loop,
 }
 

package/scripts/run/wake/run-wake-main.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { run_wake_cli } from './run-wake-cli'
+
+// The `josh run:wake` entry, and the script `--start` spawns with `--loop`. It is kept apart from
+// `run-wake-cli.ts` because `backlogrun-cli.ts` and `backlogrun-restart.ts` import that one: a bundle
+// is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186).
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = await run_wake_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/run/wake/run-wake-ports.ts

@@ -0,0 +1,98 @@
+import { randomUUID } from 'node:crypto'
+import type { AgentProfile } from '#scripts/agent/agent-role-profile'
+import { lane_close } from '#scripts/lane/lane-close'
+import { lane_withdraw_closed } from '#scripts/lane/lane-withdraw-closed'
+import { poll } from '#scripts/lib/poll'
+import { run_carry } from '#scripts/run/carry/run-carry'
+import { run_event_setup } from '#scripts/run/event/run-event-setup'
+import { run_headless } from '#scripts/run/run-headless'
+import type { WakeContext } from './run-wake-describe'
+import { run_wake_driver } from './run-wake-driver'
+import { run_wake_handoff } from './run-wake-handoff'
+import type { LoopPorts } from './run-wake-loop'
+import { run_wake_session, type LaunchResult } from './run-wake-session'
+
+// The production ports of the supervisor's loop (`run-wake-loop.ts` → `LoopPorts`), and the session
+// launch they wake through.
+
+// **The note covers both ways `wake_argv` answers `undefined`**, because it cannot tell them apart and
+// a message that named only the first would accuse a legitimate invocation of carrying unsafe text.
+// The second is the one a person actually meets: a `queue` whose references carry a `owner/repo#`
+// prefix is a grammar this supervisor does not rebuild, and `queue.md` → "The session boundary" is why
+// such a queue begins no record in the first place.
+const UNSAFE_INVOCATION_NOTE =
+	'the carried invocation is not one this supervisor can continue — it is neither a backlogrun nor a queue it can rebuild, or it carries text that may not be passed to a command line'
+
+function note_to_stderr(note: string): void {
+	console.error(`wake: ${note}`)
+}
+
+// **A session that started is said on the stream.** The driver's `waiting on judgment` is the moment it
+// asked; from here a session is at work on the answer, until the supervisor's next hand-off.
+function say_session_running(context: WakeContext): void {
+	run_event_setup.emit_to(context.event_target, run_event_setup.STAGE.SESSION, new Date())
+}
+
+function wake_session(
+	context: WakeContext,
+	invocation: string,
+	profile: AgentProfile,
+	session: { id: string; material: string },
+): LaunchResult {
+	const built = run_wake_session.wake_argv(invocation, profile, context.worktree, session)
+
+	if (built === undefined) return { kind: 'failed', note: UNSAFE_INVOCATION_NOTE }
+	if (built.kind === 'rejected') return { kind: 'failed', note: built.note }
+
+	// The headless mark is what lets the stop hook hold this session's turn open while its lanes run —
+	// under `claude -p` a turn-end is the process's end (`run-headless.ts`).
+	const environment = run_headless.environment()
+	const target = { cwd: context.worktree, env: environment, log_path: context.log_target }
+	const result = run_wake_session.launch({ argv: built.argv, ...target, profile }, note_to_stderr)
+
+	if (result.kind === 'launched') say_session_running(context)
+
+	return result
+}
+
+// The lanes the supervisor ends each pass: closes left incomplete, and lanes whose issue was closed as
+// not planned (`lane-withdraw-closed.ts`), each withdrawal said on stderr.
+async function retry_closes(): Promise<void> {
+	await lane_close.retry_closes()
+	const notes = await lane_withdraw_closed.withdraw_closed()
+
+	for (const note of notes) note_to_stderr(note)
+}
+
+// **A record this supervisor owns itself is not a session at work.** A failed driver leaves the record
+// adopted for this process, so reading that owner as live would have every restarted pass wait on
+// itself and never drive again.
+//
+// `is_code_stale` defaults to never: only the supervisor's own `--loop` watches its code
+// (`run-wake-code.ts`).
+function ports_for(
+	context: WakeContext,
+	profile: AgentProfile,
+	is_code_stale: () => Promise<boolean> = async () => false,
+): LoopPorts {
+	return {
+		is_code_stale,
+		read_carry: () => run_carry.read_carry(context.carry_target),
+		is_owner_live: (read) => read.kind === 'carried' && run_carry.is_held_by_another(read.carry),
+		has_work: async () => true,
+		new_session_id: () => randomUUID(),
+		hand_off: () => {
+			run_wake_handoff.hand_off(context.carry_target)
+		},
+		drive: async () => await run_wake_driver.drive(context.carry_target),
+		wake: (invocation, session_id, material) =>
+			wake_session(context, invocation, profile, { id: session_id, material }),
+		sleep: poll.sleep,
+		now: () => new Date(),
+		retry_closes,
+	}
+}
+
+const run_wake_ports = { note_to_stderr, ports_for }
+
+export { run_wake_ports }

package/scripts/run/wake/run-wake-session.ts

@@ -9,6 +9,7 @@ import { claude_agent_argv } from '#scripts/agent/claude-agent-argv'
 import { backlogrun_launch } from '#scripts/backlog/backlogrun-launch'
 import { detached_launch, type LaunchArgv } from '#scripts/run/detached-launch'
 import { run_invocation } from '#scripts/run/run-invocation'
+import { run_wake_caffeinate } from './run-wake-caffeinate'
 
 // How the supervisor starts things: the next agent session, and — at `--start` — its own detached
 // self. Both go through one `launch`, because the two differ only in what is being run.
@@ -164,6 +165,7 @@ const run_wake_session = {
 	WAKE_FLAGS,
 	ensure_log: detached_launch.ensure_log,
 	is_safe_argv: detached_launch.is_safe_argv,
+	keep_awake: run_wake_caffeinate.keep_awake,
 	launch: detached_launch.launch,
 	chosen_profile,
 	scheduler_profile,

package/scripts/run/wake/run-wake-takeover.ts

@@ -0,0 +1,66 @@
+import { process_identity } from '#scripts/josh/process-identity'
+import { poll } from '#scripts/lib/poll'
+import { MS_PER_SECOND } from '#scripts/lib/timeouts'
+import { run_wake } from './run-wake'
+import { run_wake_stop } from './run-wake-stop'
+
+// Whether the successor a reload launched took the run over (joshuafolkken/kit#4509).
+//
+// **A spawn is not a take-over.** A successor that dies at load — a `main:sync` that pulled main but
+// whose reinstall failed — was still `launched`, and reading that as the hand-over would leave the run
+// with nobody watching it and nothing saying so. The successor claims the wake record before anything
+// else (`run-wake-await.ts`), so its pid on that record is the proof; its death, or no claim within the
+// bound, is a reload that failed.
+
+const TAKEOVER_INTERVAL_MS = MS_PER_SECOND
+// A cold `tsx` start claims within seconds; the bound is generous so a loaded machine is not a failure.
+const TAKEOVER_ATTEMPTS = 120
+
+type TakeoverResult = 'taken' | 'died' | 'unclaimed'
+
+interface TakeoverPorts {
+	holder_pid: () => number | undefined
+	is_alive: (pid: number) => boolean
+	stop: (pid: number) => void
+	sleeper?: (duration_ms: number) => Promise<void>
+}
+
+function ports_of(wake_target: string): TakeoverPorts {
+	return {
+		holder_pid: () => run_wake.read_wake(wake_target)?.pid,
+		is_alive: process_identity.is_live_pid,
+		stop: run_wake_stop.signal,
+	}
+}
+
+function result_of(pid: number, ports: TakeoverPorts): TakeoverResult {
+	if (ports.holder_pid() === pid) return 'taken'
+
+	return ports.is_alive(pid) ? 'unclaimed' : 'died'
+}
+
+// **A successor still unclaimed at the bound is stopped**, so the failed reload's warning says what is
+// true: left running, it would claim the run later and supervise one the warning and the board call
+// stranded.
+async function await_takeover(
+	pid: number,
+	ports: TakeoverPorts,
+	attempts: number = TAKEOVER_ATTEMPTS,
+): Promise<TakeoverResult> {
+	await poll.poll_until(async () => result_of(pid, ports) !== 'unclaimed', {
+		attempts,
+		interval_ms: TAKEOVER_INTERVAL_MS,
+		...(ports.sleeper && { sleeper: ports.sleeper }),
+	})
+
+	const result = result_of(pid, ports)
+
+	if (result === 'unclaimed') ports.stop(pid)
+
+	return result
+}
+
+const run_wake_takeover = { await_takeover, ports_of }
+
+export type { TakeoverPorts, TakeoverResult }
+export { run_wake_takeover }

package/scripts/run/wake/run-wake.ts

@@ -1,5 +1,6 @@
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 import { backlog_budget } from '#scripts/backlog/backlog-budget'
+import { durable_state } from '#scripts/josh/durable-state'
 import { process_identity } from '#scripts/josh/process-identity'
 import { process_owner_schema } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
@@ -16,7 +17,7 @@ import { z } from 'zod'
 
 const WAKE_PREFIX = 'josh-run-wake-'
 // The output of every session this starts, appended per repository so a silent death is diagnosable.
-const WAKE_LOG_PREFIX = 'josh-run-wake-log-'
+const WAKE_LOG_PREFIX = durable_state.PREFIX.WAKE_LOG
 const WAKE_LOG_SUFFIX = '.log'
 // How long a woken session has to claim the carry record — the only launch-failure detector, since a
 // claim also catches a session that dies in boot or never picks the run up. It covers a slow cold start.
@@ -53,7 +54,8 @@ interface RunWake {
 	idle_since?: string | undefined
 }
 
-type WakeStopReason = 'ended' | 'unreadable' | 'failed' | 'stopped'
+// `reload`: the supervisor's code changed on disk, so it hands the run to a successor on that code.
+type WakeStopReason = 'ended' | 'unreadable' | 'failed' | 'stopped' | 'reload'
 
 // `superseded`: another supervisor holds the record and this process is the replaced one.
 type WakeTidyResult = 'absent' | 'removed' | 'superseded'
@@ -152,7 +154,7 @@ function wake_path(git_directory: string): string {
 }
 
 function wake_log_path(git_directory: string): string {
-	return stamp_file.stamp_path(WAKE_LOG_PREFIX, git_directory, WAKE_LOG_SUFFIX)
+	return durable_state.path(WAKE_LOG_PREFIX, git_directory, WAKE_LOG_SUFFIX)
 }
 
 function parse_wake(raw: string): RunWake | undefined {

package/scripts/safe-chain/ci-installer-pin.ts

@@ -1,5 +1,7 @@
 import { createHash } from 'node:crypto'
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
 import { composite_actions } from '#scripts/ci/composite-actions'
 import { execaSync } from 'execa'
 
@@ -16,6 +18,9 @@ const VERSION_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_VERSION:[ \t]*)(?<value>\
 const SHA256_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_SHA256:[ \t]*)(?<value>\S+)[ \t]*$/mu
 const VALUE_GROUP = 'value'
 const DOWNLOAD_TIMEOUT_MS = 30_000
+const REPOSITORY = 'AikidoSec/safe-chain'
+const INSTALLER_NAME = 'install-safe-chain.sh'
+const ATTESTATION_FAILURE = 'could not be verified against its release attestation'
 
 interface InstallerPin {
 	version: string
@@ -23,7 +28,7 @@ interface InstallerPin {
 }
 
 function installer_url(version: string): string {
-	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
+	return `https://github.com/${REPOSITORY}/releases/download/${version}/${INSTALLER_NAME}`
 }
 
 // The local composite actions follow the workflows: kit's own pin lives in
@@ -50,7 +55,7 @@ function rewrite_pin(content: string, pin: InstallerPin): string {
 		.replace(SHA256_RE, (_match, key: string) => `${key}${pin.sha256}`)
 }
 
-function fetch_installer_sha256(version: string): string | undefined {
+function fetch_installer(version: string): Uint8Array | undefined {
 	// `--proto =https` keeps the release redirect from being followed onto plain HTTP.
 	const result = execaSync('curl', ['--proto', '=https', '-fsSL', installer_url(version)], {
 		encoding: 'buffer',
@@ -61,7 +66,41 @@ function fetch_installer_sha256(version: string): string | undefined {
 	})
 	if (result.exitCode !== 0 || result.stdout.length === 0) return undefined
 
-	return createHash('sha256').update(result.stdout).digest('hex')
+	return result.stdout
+}
+
+// joshuafolkken/kit#4669: the hash recorded is the one the release's GitHub attestation signs, not
+// whatever the download happened to return. `gh release verify-asset` checks the signed attestation
+// GitHub issued when the release was published, so a release asset swapped afterwards fails here.
+function verify_installer(version: string, installer: Uint8Array): boolean {
+	const directory = mkdtempSync(path.join(tmpdir(), 'safe-chain-installer-'))
+	const installer_path = path.join(directory, INSTALLER_NAME)
+
+	try {
+		writeFileSync(installer_path, installer)
+		const result = execaSync(
+			'gh',
+			['release', 'verify-asset', version, installer_path, '--repo', REPOSITORY],
+			{
+				reject: false,
+				timeout: DOWNLOAD_TIMEOUT_MS,
+			},
+		)
+
+		return result.exitCode === 0
+	} finally {
+		rmSync(directory, { recursive: true, force: true })
+	}
+}
+
+// The hash to record, or why there is none — a pin is written only from a verified installer.
+function fetch_installer_sha256(version: string): { sha256: string } | { failure: string } {
+	const installer = fetch_installer(version)
+	if (installer === undefined) return { failure: 'could not be downloaded' }
+	// A missing or signed-out `gh` lands here too: no verification means no pin, whatever the reason.
+	if (!verify_installer(version, installer)) return { failure: ATTESTATION_FAILURE }
+
+	return { sha256: createHash('sha256').update(installer).digest('hex') }
 }
 
 // The workflows whose pin lags `latest` — a missing file or one without the pin is not a target.
@@ -83,15 +122,17 @@ function sync(latest: string, workflow_paths: ReadonlyArray<string> = list_workf
 	const targets = stale_workflows(latest, workflow_paths)
 	if (targets.length === 0) return
 
-	const sha256 = fetch_installer_sha256(latest)
+	const fetched = fetch_installer_sha256(latest)
 
-	if (sha256 === undefined) {
-		console.warn(`\n⚠ Could not download the safe-chain ${latest} installer; CI pin left as is`)
+	if ('failure' in fetched) {
+		console.warn(`\n⚠ The safe-chain ${latest} installer ${fetched.failure}; CI pin left as is`)
 
 		return
 	}
 
-	for (const workflow_path of targets) write_pin(workflow_path, { version: latest, sha256 })
+	for (const workflow_path of targets) {
+		write_pin(workflow_path, { version: latest, sha256: fetched.sha256 })
+	}
 }
 
 const ci_installer_pin = {

package/scripts/safe-chain/pack-hook.ts

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync, rmSync } from 'node:fs'
 import path from 'node:path'
+import { package_manifest } from '#scripts/lib/package-manifest'
 import { file_reader } from '#scripts/lib/read-file'
 import { file_content } from '#scripts/sync/file-content'
 import { z } from 'zod'
@@ -14,7 +15,6 @@ import { z } from 'zod'
 // `pnpmfileChecksum`, which fails a frozen install until the lockfile is refreshed.
 const PACK_HOOK_FILE = '.pnpmfile.mjs'
 const MANAGED_LINE = '// josh-managed-pnpmfile: @joshuafolkken/kit'
-const MANIFEST_FILE = 'package.json'
 // pnpm loads `.pnpmfile.mjs` in preference to `.pnpmfile.cjs`, and neither once a `pnpmfile` setting
 // names another file — so writing ours beside either would silently drop the project's hooks, or
 // report a hook pnpm never runs.
@@ -77,7 +77,7 @@ const MESSAGES: Readonly<Record<PackHookResult, string | undefined>> = {
 }
 
 function sync_pack_hook(project_root: string, package_directory: string): PackHookResult {
-	const manifest_text = file_reader.read_optional(path.join(project_root, MANIFEST_FILE))
+	const manifest_text = file_reader.read_optional(package_manifest.manifest_path(project_root))
 	const is_private = manifest_text === undefined || !is_published(manifest_text)
 	const result = is_private ? 'private' : apply(project_root, package_directory)
 	const message = MESSAGES[result]

package/scripts/safe-chain/preinstall-command.ts

@@ -17,7 +17,8 @@ const INTEGRATION_HINT =
 const LOCAL_INTEGRATION_CHECK_SOURCE = `if(!process.env.CI&&!process.env.GLOBAL_AGENT_HTTP_PROXY)console.warn('${INTEGRATION_HINT}')`
 const SAFE_CHAIN_CMD = `node -e "${LOCAL_INTEGRATION_CHECK_SOURCE}"`
 // Every `preinstall` an earlier kit wrote: `setup-ci` alone, pinned or not, or followed by the
-// `node -e` check of any earlier wording.
+// `node -e` check of any earlier wording. Removable from kit 2.0.0; consumers still carried `setup-ci`
+// at joshuafolkken/kit#4187.
 const LEGACY_PREINSTALL_RE =
 	/^pnpm dlx @aikidosec\/safe-chain(?:@\S+)? setup-ci(?: && node -e "[^"]*")?$/u
 

package/scripts/safe-chain/project-config.ts

@@ -1,17 +1,16 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { file_reader } from '#scripts/lib/read-file'
 import { yaml_document } from '#scripts/lib/yaml-document'
-import { release_age } from '#scripts/version/release-age'
+import { file_content } from '#scripts/sync/file-content'
+import { release_window } from '#scripts/version/release-window'
 import { dump } from 'js-yaml'
-import { z } from 'zod'
 
 const WORKSPACE_FILE = 'pnpm-workspace.yaml'
 const PROJECT_CONFIG_FILE = '.aikido'
 const EXCLUSIONS_FIELD = 'minimumPackageAgeExclusions'
 const AGE_FIELD = 'minimumPackageAgeHours'
 const MINUTES_PER_HOUR = 60
-const workspace_schema = z.object({ minimumReleaseAgeExclude: z.array(z.string()).optional() })
 
 function read_mapping(value: unknown, label: string): Record<string, unknown> {
 	if (value === undefined) return {}
@@ -82,7 +81,7 @@ function replace_safe_chain_block(existing: string, safe_chain: Record<string, u
 // undeclared window writes nothing; an explicit `0` opt-out is written as 0 so an earlier
 // synchronized age cannot outlive it.
 function package_age_hours(workspace: string): number | undefined {
-	const minutes = release_age.parse_declared_minimum_release_age(workspace)
+	const { minutes } = release_window.parse_release_window(workspace)
 	if (minutes === undefined) return undefined
 
 	return Math.floor(minutes / MINUTES_PER_HOUR)
@@ -117,12 +116,8 @@ function has_nothing_to_write(
 	)
 }
 
-function read_exclusions(workspace: string): ReadonlyArray<string> {
-	return workspace_schema.parse(yaml_document.parse_yaml(workspace)).minimumReleaseAgeExclude ?? []
-}
-
 function merge_project_config(existing: string, workspace: string): string {
-	const exclusions = read_exclusions(workspace)
+	const { exclusions } = release_window.parse_release_window(workspace)
 	const aikido = yaml_document.parse_yaml(existing)
 	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
 	const merged = merge_age(merge_exclusions(safe_chain, exclusions), workspace)
@@ -145,7 +140,7 @@ function sync_project_config(root: string): boolean {
 	const workspace = readFileSync(workspace_path, 'utf8')
 	const merged = merge_project_config(existing, workspace)
 	if (merged === existing) return false
-	writeFileSync(config_path, merged)
+	file_content.write_contained(config_path, merged)
 
 	return true
 }