@joshuafolkken/kit 1.3041.0 → 1.3092.0

package/dist/commands/chunk-736NECRD.js

@@ -0,0 +1,16 @@
+import {
+  git_gh_issue_write
+} from "./chunk-4F4KARQN.js";
+
+// scripts/issue/issue-park.ts
+async function apply(issue, label, body) {
+  const is_labelled = await git_gh_issue_write.issue_add_label(issue, label);
+  if (!is_labelled) return { is_labelled, is_commented: false };
+  const is_commented = await git_gh_issue_write.issue_try_comment(issue, body);
+  return { is_labelled, is_commented };
+}
+var issue_park = { apply };
+
+export {
+  issue_park
+};

package/dist/commands/chunk-77LEKVEE.js

@@ -0,0 +1,32 @@
+import {
+  time_transcript_line
+} from "./chunk-YSLGWRQN.js";
+import {
+  cost_blocks,
+  time_shell
+} from "./chunk-LHKXJD6L.js";
+
+// scripts/rules/tail-commands.ts
+function is_bash_use(block) {
+  return block.type === cost_blocks.TOOL_USE_TYPE && block.name === cost_blocks.BASH_TOOL;
+}
+function bash_commands_of(line) {
+  const parsed = time_transcript_line.parse_line(line);
+  if (parsed === void 0) return [];
+  return parsed.blocks.filter((block) => is_bash_use(block)).map((block) => time_shell.bash_command(block.input));
+}
+function prior_bash_commands(tail) {
+  return tail.split("\n").flatMap((line) => bash_commands_of(line));
+}
+function answered(text, is_call, token) {
+  const blocks = time_transcript_line.parse_text(text).flatMap((line) => line.blocks);
+  const call_ids = new Set(
+    blocks.filter((block) => is_call(time_shell.bash_command(block.input))).map((block) => block.id)
+  );
+  return blocks.some((block) => call_ids.has(block.result_id) && block.token_lines.includes(token));
+}
+var tail_commands = { answered, is_bash_use, prior_bash_commands };
+
+export {
+  tail_commands
+};

package/dist/commands/chunk-7CX5VYOL.js

@@ -0,0 +1,50 @@
+import {
+  issue_number_shape
+} from "./chunk-G75GWNNY.js";
+
+// scripts/run/handoff/run-handoff-args.ts
+var BRIEF_FLAG = "--brief-file";
+var BACKLOG_KEYWORD = "backlogrun";
+var NOT_FOUND = -1;
+var FLAG_AND_VALUE = 2;
+var RETROSPECTIVE_KEYWORD = "retrospective";
+var TYPED_KEYWORDS = ["kickoff", "fullrun", "halfrun", "prrun"];
+var WORKFLOW_KEYWORDS = [...TYPED_KEYWORDS, RETROSPECTIVE_KEYWORD];
+var KEYWORDS = [...TYPED_KEYWORDS, BACKLOG_KEYWORD];
+var WORKFLOW_KEYWORD_TOKENS = WORKFLOW_KEYWORDS;
+function is_workflow_keyword(token) {
+  return WORKFLOW_KEYWORD_TOKENS.includes(token);
+}
+function refused(note) {
+  return { kind: "refused", note };
+}
+function workflow_of(keyword, rest) {
+  const at = rest.indexOf(BRIEF_FLAG);
+  const brief_file = at === NOT_FOUND ? void 0 : rest[at + 1];
+  if (brief_file === void 0 || brief_file.startsWith("-")) {
+    return refused(`${keyword} needs ${BRIEF_FLAG} <path>`);
+  }
+  const entry = [...rest.slice(0, at), ...rest.slice(at + FLAG_AND_VALUE)];
+  if (entry.includes(BRIEF_FLAG)) return refused(`${BRIEF_FLAG} is given more than once`);
+  const line = [keyword, ...entry.map((token) => issue_number_shape.issue_token(token))].join(" ");
+  return { kind: "workflow", keyword, line, brief_file };
+}
+function retrospective_of(rest) {
+  if (rest.length > 0) return refused(`${RETROSPECTIVE_KEYWORD} takes no other argument`);
+  const keyword = RETROSPECTIVE_KEYWORD;
+  return { kind: "workflow", keyword, line: keyword, brief_file: void 0 };
+}
+function parse(argv) {
+  const [keyword, ...rest] = argv;
+  if (keyword === BACKLOG_KEYWORD) return { kind: "backlogrun", rest };
+  if (keyword === RETROSPECTIVE_KEYWORD) return retrospective_of(rest);
+  if (!is_workflow_keyword(keyword)) {
+    return refused(`expected one of ${WORKFLOW_KEYWORDS.join(", ")}, ${BACKLOG_KEYWORD}`);
+  }
+  return workflow_of(keyword, rest);
+}
+var run_handoff_args = { BACKLOG_KEYWORD, KEYWORDS, RETROSPECTIVE_KEYWORD, parse };
+
+export {
+  run_handoff_args
+};

package/dist/commands/chunk-7DGHFBU7.js

@@ -0,0 +1,247 @@
+import {
+  git_common_directory
+} from "./chunk-JPMAW2VZ.js";
+import {
+  PROJECT_ROOT
+} from "./chunk-3CCGKX7Y.js";
+
+// scripts/security/security-audit-logic.ts
+import path from "node:path";
+var BINARY_NAME = "osv-scanner";
+var LOCKFILE_PATH = "pnpm-lock.yaml";
+var MANAGED_TOOL_SEGMENTS = ["node_modules", ".cache", "josh-tools"];
+var WINDOWS_PLATFORM = "win32";
+var WINDOWS_BINARY_SUFFIX = ".exe";
+var INSTALL_INSTRUCTIONS = [
+  "",
+  "Install options:",
+  "  Managed: pnpm josh audit:provision",
+  "  macOS:  brew install osv-scanner",
+  "  Go:     go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest",
+  '  Docker: docker run --rm -v "$PWD:/src" ghcr.io/google/osv-scanner --lockfile=/src/pnpm-lock.yaml',
+  "",
+  "Docs: https://google.github.io/osv-scanner/"
+].join("\n");
+function build_scanner_arguments(lockfile_path) {
+  return [`--lockfile=${lockfile_path}`];
+}
+function build_managed_binary_path(project_root, platform) {
+  const suffix = platform === WINDOWS_PLATFORM ? WINDOWS_BINARY_SUFFIX : "";
+  return path.join(project_root, ...MANAGED_TOOL_SEGMENTS, `${BINARY_NAME}${suffix}`);
+}
+function format_missing_binary_error(binary_name) {
+  return `${binary_name} is not installed.
+${INSTALL_INSTRUCTIONS}`;
+}
+var security_audit_logic = {
+  BINARY_NAME,
+  LOCKFILE_PATH,
+  build_managed_binary_path,
+  build_scanner_arguments,
+  format_missing_binary_error
+};
+
+// scripts/security/security-audit-provision-logic.ts
+var SCANNER_VERSION = "2.6.0";
+var MINIMUM_SCANNER_VERSION = SCANNER_VERSION;
+var RELEASE_BASE_URL = "https://github.com/google/osv-scanner/releases/download";
+var WINDOWS_PLATFORM2 = "win32";
+var WINDOWS_ASSET_SUFFIX = ".exe";
+var SESSION_DOWNLOAD_TIMEOUT_MS = 6e4;
+var FORCED_DOWNLOAD_TIMEOUT_MS = 6e5;
+function build_download_timeout(is_forced) {
+  return is_forced ? FORCED_DOWNLOAD_TIMEOUT_MS : SESSION_DOWNLOAD_TIMEOUT_MS;
+}
+var MS_PER_HOUR = 36e5;
+var HOURS_BEFORE_RETRY = 6;
+var RETRY_INTERVAL_MS = HOURS_BEFORE_RETRY * MS_PER_HOUR;
+var PLATFORM_NAMES = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows"
+};
+var ARCHITECTURE_NAMES = {
+  arm64: "arm64",
+  x64: "amd64"
+};
+var ASSET_CHECKSUMS = {
+  "osv-scanner_darwin_amd64": "60c5296637e977b28eeda5c7f13573e447659a632922737f94d11fa7e30ad6ca",
+  "osv-scanner_darwin_arm64": "98c460dcd37de25819babd757d04542045b6243113e209edcd4d89fedb0256b4",
+  "osv-scanner_linux_amd64": "ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108",
+  "osv-scanner_linux_arm64": "2c71403eb443d05891c4f268c3ad771cf4f16e5443463fd7851ef8f454d3c7e4",
+  "osv-scanner_windows_amd64.exe": "e0ed7644118b717b028c249ee9d3515024e55e8510747ca08906eb96765354d6",
+  "osv-scanner_windows_arm64.exe": "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
+};
+function build_asset_name(platform, architecture) {
+  const platform_name = PLATFORM_NAMES[platform];
+  const architecture_name = ARCHITECTURE_NAMES[architecture];
+  if (platform_name === void 0 || architecture_name === void 0) return void 0;
+  const suffix = platform === WINDOWS_PLATFORM2 ? WINDOWS_ASSET_SUFFIX : "";
+  return `${security_audit_logic.BINARY_NAME}_${platform_name}_${architecture_name}${suffix}`;
+}
+function build_download_url(asset_name) {
+  return `${RELEASE_BASE_URL}/v${SCANNER_VERSION}/${asset_name}`;
+}
+function resolve_asset(platform, architecture) {
+  const name = build_asset_name(platform, architecture);
+  if (name === void 0) return void 0;
+  const sha256 = ASSET_CHECKSUMS[name];
+  if (sha256 === void 0) return void 0;
+  return { name, sha256, url: build_download_url(name) };
+}
+function format_already_present(location) {
+  return `osv-scanner is already available (${location}); nothing to provision.`;
+}
+function format_unsupported_platform(platform, architecture) {
+  return `No pinned osv-scanner build for ${platform}/${architecture}; install it manually to run the pre-push audit.`;
+}
+function format_download_failure(url, reason) {
+  return `Could not fetch osv-scanner from ${url}: ${reason}. Run \`pnpm josh audit:provision --force\` to retry with a longer timeout; until then the pre-push audit will report the missing binary.`;
+}
+function format_checksum_mismatch(asset_name, expected, actual) {
+  return `Checksum mismatch for ${asset_name}: expected ${expected}, got ${actual}. Nothing was installed.`;
+}
+function format_installed(target_path) {
+  return `Installed osv-scanner v${SCANNER_VERSION} at ${target_path}.`;
+}
+function format_recent_failure() {
+  return `A previous attempt to provision osv-scanner failed less than ${String(HOURS_BEFORE_RETRY)} hours ago; not retrying at session start. Run \`pnpm josh audit:provision --force\` to try again now.`;
+}
+function format_provision_error(reason) {
+  return `Could not provision osv-scanner: ${reason}. The pre-push audit will report the missing binary.`;
+}
+var SCANNER_VERSION_PATTERN = /osv-scanner version:\s*(\d+\.\d+\.\d+)/u;
+function parse_scanner_version(version_output) {
+  return SCANNER_VERSION_PATTERN.exec(version_output)?.[1];
+}
+function to_version_parts(version) {
+  return version.split(".").map(Number);
+}
+function compare_versions(left, right) {
+  const left_parts = to_version_parts(left);
+  const right_parts = to_version_parts(right);
+  const length = Math.max(left_parts.length, right_parts.length);
+  for (let index = 0; index < length; index += 1) {
+    const difference = (left_parts[index] ?? 0) - (right_parts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+function meets_version_floor(version) {
+  return compare_versions(version, MINIMUM_SCANNER_VERSION) >= 0;
+}
+function format_below_floor(version) {
+  return `osv-scanner ${version} is below the required v${MINIMUM_SCANNER_VERSION}; older builds parse only part of pnpm-lock.yaml, so a clean result here is not proof the lockfile is clean. Run \`pnpm josh audit:provision --force\` to install v${SCANNER_VERSION}.`;
+}
+var security_audit_provision_logic = {
+  RETRY_INTERVAL_MS,
+  SESSION_DOWNLOAD_TIMEOUT_MS,
+  SCANNER_VERSION,
+  MINIMUM_SCANNER_VERSION,
+  build_asset_name,
+  build_download_timeout,
+  build_download_url,
+  format_already_present,
+  format_below_floor,
+  format_checksum_mismatch,
+  format_download_failure,
+  format_installed,
+  format_provision_error,
+  format_recent_failure,
+  format_unsupported_platform,
+  meets_version_floor,
+  parse_scanner_version,
+  resolve_asset
+};
+
+// scripts/security/security-audit.ts
+import { accessSync, constants, statSync } from "node:fs";
+import path2 from "node:path";
+import { execaSync } from "execa";
+var FAILURE_EXIT_CODE = 1;
+var GIT_DIRECTORY_NAME = ".git";
+var UNKNOWN_VERSION = "unknown";
+function is_binary_available(binary_name) {
+  const result = execaSync(binary_name, ["--version"], { stdio: "ignore", reject: false });
+  return result.exitCode !== void 0;
+}
+function scanner_version(binary_or_path) {
+  const result = execaSync(binary_or_path, ["--version"], { reject: false });
+  if (result.exitCode === void 0) return void 0;
+  return security_audit_provision_logic.parse_scanner_version(result.stdout);
+}
+function meets_floor(binary_or_path) {
+  const version = scanner_version(binary_or_path);
+  return version !== void 0 && security_audit_provision_logic.meets_version_floor(version);
+}
+function is_executable_file(candidate_path) {
+  try {
+    accessSync(candidate_path, constants.X_OK);
+    const stats = statSync(candidate_path);
+    return stats.isFile() && stats.size > 0;
+  } catch {
+    return false;
+  }
+}
+function managed_root(project_root) {
+  const common = git_common_directory.repository(project_root);
+  if (common === void 0 || path2.basename(common) !== GIT_DIRECTORY_NAME) return project_root;
+  return path2.dirname(common);
+}
+function managed_binary_path(project_root, platform) {
+  return security_audit_logic.build_managed_binary_path(managed_root(project_root), platform);
+}
+function managed_scanner(project_root, platform) {
+  const managed_path = managed_binary_path(project_root, platform);
+  return is_executable_file(managed_path) && meets_floor(managed_path) ? managed_path : void 0;
+}
+function resolve_scanner(project_root, platform) {
+  const { BINARY_NAME: BINARY_NAME2 } = security_audit_logic;
+  const has_path_binary = is_binary_available(BINARY_NAME2);
+  if (has_path_binary && meets_floor(BINARY_NAME2)) {
+    return { path: BINARY_NAME2, is_below_floor: false };
+  }
+  const managed = managed_scanner(project_root, platform);
+  if (managed !== void 0) return { path: managed, is_below_floor: false };
+  return has_path_binary ? { path: BINARY_NAME2, is_below_floor: true } : void 0;
+}
+var FORWARDED_OUTPUT = ["inherit", "pipe"];
+function run_scanner(scanner_path) {
+  const { LOCKFILE_PATH: LOCKFILE_PATH2, build_scanner_arguments: build_scanner_arguments2 } = security_audit_logic;
+  const result = execaSync(scanner_path, [...build_scanner_arguments2(LOCKFILE_PATH2)], {
+    stdin: "inherit",
+    stdout: FORWARDED_OUTPUT,
+    stderr: FORWARDED_OUTPUT,
+    reject: false
+  });
+  return result.exitCode ?? FAILURE_EXIT_CODE;
+}
+function warn_below_floor(scanner_path) {
+  const version = scanner_version(scanner_path) ?? UNKNOWN_VERSION;
+  console.warn(security_audit_provision_logic.format_below_floor(version));
+}
+function run() {
+  const { BINARY_NAME: BINARY_NAME2, format_missing_binary_error: format_missing_binary_error2 } = security_audit_logic;
+  const choice = resolve_scanner(PROJECT_ROOT, process.platform);
+  if (choice === void 0) {
+    console.error(format_missing_binary_error2(BINARY_NAME2));
+    return FAILURE_EXIT_CODE;
+  }
+  if (choice.is_below_floor) warn_below_floor(choice.path);
+  return run_scanner(choice.path);
+}
+var security_audit = {
+  is_binary_available,
+  is_executable_file,
+  managed_binary_path,
+  meets_floor,
+  resolve_scanner,
+  run,
+  run_scanner
+};
+
+export {
+  security_audit_logic,
+  security_audit_provision_logic,
+  security_audit
+};

package/dist/commands/chunk-7E43YW53.js

@@ -0,0 +1,128 @@
+import {
+  test_unit_guard
+} from "./chunk-KWLNK2NJ.js";
+import {
+  review_stamps
+} from "./chunk-XSKJAG72.js";
+import {
+  gate_tree
+} from "./chunk-R36VZIKU.js";
+import {
+  file_map_stamp
+} from "./chunk-M32UPB2D.js";
+import {
+  run_record_path
+} from "./chunk-WL5JHB3I.js";
+import {
+  hook_decision
+} from "./chunk-GB2BRQVL.js";
+
+// scripts/gate/scoped-green.ts
+var SWITCH_ENV_KEY = "JOSH_SCOPED_GREEN";
+var SUCCESS_EXIT_CODE = 0;
+var LINT_SCRIPT = "lint:related";
+var TEST_SCRIPT = "test:related";
+var LINT_COMMAND = `pnpm josh ${LINT_SCRIPT}`;
+var TEST_COMMAND = `pnpm josh ${TEST_SCRIPT}`;
+function checks_of(sources) {
+  const lint = {
+    script: LINT_SCRIPT,
+    command: LINT_COMMAND,
+    stamp: review_stamps.lint_related_stamp,
+    source: sources.lint
+  };
+  const test = {
+    script: TEST_SCRIPT,
+    command: TEST_COMMAND,
+    stamp: review_stamps.test_related_stamp,
+    source: sources.test
+  };
+  return sources.is_unit_skipped ?? test_unit_guard.is_skipping(process.cwd()) ? [lint] : [lint, test];
+}
+function describes_tree(check, tree, base, is_overlooked = run_record_path.is_run_record) {
+  const stamp = check.stamp.read(check.source);
+  return stamp !== void 0 && file_map_stamp.changed_since(stamp, tree).every((relative) => is_overlooked(relative)) && file_map_stamp.describes_base(stamp, base) && check.stamp.describes_inputs(stamp);
+}
+function is_describable(files, base) {
+  return base !== void 0 && Object.keys(files).length > 0;
+}
+function is_answerable(tree, base) {
+  if (!hook_decision.is_switch_enabled(SWITCH_ENV_KEY)) return false;
+  return is_describable(tree, base);
+}
+function stale_checks(tree, base, sources) {
+  if (!is_answerable(tree, base)) return [];
+  return checks_of(sources).filter((check) => !describes_tree(check, tree, base));
+}
+function missing_checks(tree, base, sources = {}) {
+  return stale_checks(tree, base, sources).map((check) => check.command);
+}
+function missing_scripts(tree, base, sources = {}) {
+  return stale_checks(tree, base, sources).map((check) => check.script);
+}
+function overlooks_nothing() {
+  return false;
+}
+function green_scripts(tree, base, sources = {}) {
+  if (!is_answerable(tree, base)) return [];
+  return checks_of(sources).filter((check) => describes_tree(check, tree, base, overlooks_nothing)).map((check) => check.script);
+}
+var REFUSAL_HEADLINE = "\u26D4 scoped checks not green on this tree";
+var REISSUE_STEP = "and reissue this command.";
+var LANE_CHILD_STEP = 'then hand over to `pnpm josh ship --detach --review "<title> #<N>"` rather than reissuing the gate \u2014 this is a dispatched lane child, and ship runs the gate beside the review (`.claude/skills/workflow-commands/chain-rule.md` step 0).';
+function refusal(missing, next_step) {
+  return `${REFUSAL_HEADLINE}: ${missing.join(" and ")} have not passed on the files this branch changed. The gate and review round 1 start together, so a brief composed now describes a tree neither check has read \u2014 joshuafolkken/kit#1503 spent 282 seconds, 31% of the run, picking up one lint rule and one failing test at a time after its review had already started. Run them in one call \u2014 \`${LINT_COMMAND} && ${TEST_COMMAND}\`, measured at 13.8 seconds \u2014 ${next_step} The record fixes when the checks run: only a merge with the default branch sharing nothing with this branch's change is recorded without a run. \`.claude/skills/workflow-commands/chain-rule.md\` \u2192 "Orchestration facts single-sourced here".`;
+}
+function next_step_of(sources) {
+  return sources.is_lane_child === true ? LANE_CHILD_STEP : REISSUE_STEP;
+}
+function refusal_for(tree, base, sources = {}) {
+  const missing = missing_checks(tree, base, sources);
+  return missing.length === 0 ? void 0 : refusal(missing, next_step_of(sources));
+}
+function is_recordable_scope(command_arguments) {
+  return command_arguments.length === 0;
+}
+async function read_before(command_arguments) {
+  if (!is_recordable_scope(command_arguments)) return void 0;
+  return await gate_tree.read_gate_tree();
+}
+function is_unmoved(before, after) {
+  if (before.base !== after.base) return false;
+  return JSON.stringify(before.files) === JSON.stringify(after.files);
+}
+function record_green(stamp, tree, target, blobs) {
+  if (!is_describable(tree.files, tree.base)) return;
+  try {
+    stamp.write(tree.files, target, tree.base, blobs);
+  } catch {
+  }
+}
+async function record_if_green(stamp, record) {
+  const { before, exit_code, target } = record;
+  if (before === void 0 || exit_code !== SUCCESS_EXIT_CODE || !is_unmoved(before, await gate_tree.read_gate_tree())) {
+    return;
+  }
+  record_green(stamp, before, target, record.blobs);
+}
+var scoped_green = {
+  LINT_COMMAND,
+  LINT_SCRIPT,
+  REFUSAL_HEADLINE,
+  SWITCH_ENV_KEY,
+  TEST_COMMAND,
+  TEST_SCRIPT,
+  green_scripts,
+  is_recordable_scope,
+  is_unmoved,
+  missing_checks,
+  missing_scripts,
+  read_before,
+  record_green,
+  record_if_green,
+  refusal_for
+};
+
+export {
+  scoped_green
+};