@joshuafolkken/kit 1.872.0

package/scripts-ai/git-workflow.ts

@@ -0,0 +1,246 @@
+#!/usr/bin/env tsx
+import { parseArgs } from 'node:util'
+import { git_branch } from '../scripts/git/git-branch'
+import { git_commit } from '../scripts/git/git-commit'
+import { git_error } from '../scripts/git/git-error'
+import { git_issue, type IssueInfo } from '../scripts/git/git-issue'
+import { git_pr } from '../scripts/git/git-pr'
+import { git_prompt, type WorkflowConfirmations } from '../scripts/git/git-prompt'
+import { git_push } from '../scripts/git/git-push'
+import { git_staging } from '../scripts/git/git-staging'
+import { cli_body } from '../scripts/josh/cli-body'
+import { test_red_commit } from '../scripts/test/test-red-commit'
+
+const SKIP_MESSAGES = {
+	commit: '💡 Commit skipped.',
+	push: '💡 Push skipped.',
+	pr: '💡 PR skipped.',
+} as const
+
+function display_help(): void {
+	console.info(`
+🚀 Git Workflow Script
+
+Usage:
+  jf-git [issue] [suffix] [options]
+
+Arguments:
+  issue             Title and issue number (e.g., "feat: add login #42")
+                    If provided, the script runs in non-interactive mode.
+  suffix            Optional text to append to the commit message.
+                    Multiple words are joined with spaces.
+
+Options:
+  --skip-commit     Skip the commit step.
+  --skip-push       Skip the push step.
+  --skip-pr         Skip the PR creation step.
+  --body <text>     Extra text appended after "closes #N" in the PR body.
+  --body-file <p>   Read that text from a file (\`-\` = stdin); use it when it holds a backtick or \`$\`.
+  -y, --yes         Run non-interactively: skip confirmations and, when no issue
+                    argument is given, derive the issue info from the current branch.
+  -h, --help        Display this help message.
+
+Examples:
+  jf-git "fix: bug #12" --skip-pr
+  jf-git "better auth #67" "fix ci"   # commit: "better auth #67 fix ci"
+  jf-git -h
+	`)
+}
+
+async function execute_commit_step(
+	commit_message: string,
+	confirmations: WorkflowConfirmations,
+): Promise<void> {
+	if (confirmations.commit) {
+		await git_commit.commit(commit_message)
+	} else {
+		console.info(SKIP_MESSAGES.commit)
+	}
+}
+
+async function execute_push_step(confirmations: WorkflowConfirmations): Promise<void> {
+	if (confirmations.push) {
+		await git_push.push()
+	} else {
+		console.info(SKIP_MESSAGES.push)
+	}
+}
+
+async function execute_pr_step(
+	issue_info: IssueInfo,
+	confirmations: WorkflowConfirmations,
+	extra_body?: string,
+): Promise<void> {
+	if (confirmations.pr) {
+		await git_pr.create_with_issue_info(issue_info, extra_body)
+	} else {
+		console.info(SKIP_MESSAGES.pr)
+	}
+}
+
+async function run_workflow_steps(
+	issue_info: IssueInfo,
+	confirmations: WorkflowConfirmations,
+	commit_message_override?: string,
+	extra_body?: string,
+): Promise<void> {
+	const commit_message = commit_message_override ?? issue_info.commit_message
+
+	if (confirmations.commit) await test_red_commit.assert_reproduces(issue_info.number)
+	await execute_commit_step(commit_message, confirmations)
+	await execute_push_step(confirmations)
+	await execute_pr_step(issue_info, confirmations, extra_body)
+}
+
+/* eslint-disable @typescript-eslint/naming-convention */
+interface CliArguments {
+	values: {
+		'skip-commit'?: boolean
+		'skip-push'?: boolean
+		'skip-pr'?: boolean
+		yes?: boolean
+		help?: boolean
+		body?: string
+		'body-file'?: string
+	}
+	positionals: Array<string>
+}
+/* eslint-enable @typescript-eslint/naming-convention */
+
+function parse_cli_arguments(): CliArguments {
+	return parseArgs({
+		options: {
+			'skip-commit': { type: 'boolean' },
+			'skip-push': { type: 'boolean' },
+			'skip-pr': { type: 'boolean' },
+			yes: { type: 'boolean', short: 'y' },
+			help: { type: 'boolean', short: 'h' },
+			body: { type: 'string' },
+			'body-file': { type: 'string' },
+		},
+		allowPositionals: true,
+	})
+}
+
+async function get_workflow_confirmations(
+	is_non_interactive: boolean,
+	values: CliArguments['values'],
+): Promise<WorkflowConfirmations> {
+	if (is_non_interactive) {
+		return {
+			commit: values['skip-commit'] !== true,
+			push: values['skip-push'] !== true,
+			pr: values['skip-pr'] !== true,
+		}
+	}
+
+	return await git_prompt.confirm_workflow_steps()
+}
+
+// `-y`/`--yes` (or an absent TTY) means run unattended: use the --skip-* flags instead of
+// prompting, and derive issue info from the branch when no issue argument was supplied.
+function is_non_interactive_mode(
+	has_issue_input: boolean,
+	values: CliArguments['values'],
+): boolean {
+	return has_issue_input || values.yes === true || !process.stdin.isTTY
+}
+
+function parse_positionals(positionals: Array<string>): {
+	cli_issue_input: string | undefined
+	is_auto_mode: boolean
+	commit_suffix: string | undefined
+} {
+	const [cli_issue_input, ...suffix_parts] = positionals
+
+	return {
+		cli_issue_input,
+		is_auto_mode: cli_issue_input !== undefined,
+		commit_suffix: suffix_parts.length > 0 ? suffix_parts.join(' ').trim() : undefined,
+	}
+}
+
+async function prepare_issue_info(
+	cli_issue_input: string | undefined,
+	is_non_interactive: boolean,
+): Promise<IssueInfo> {
+	const current_branch = await git_branch.current()
+	const issue_info = await git_issue.resolve_and_display({
+		cli_input: cli_issue_input,
+		current_branch,
+		is_non_interactive,
+	})
+	const actual_branch = await git_branch.check_and_create_branch(
+		current_branch,
+		issue_info.branch_name,
+	)
+
+	return { ...issue_info, branch_name: actual_branch }
+}
+
+function build_commit_message(
+	issue_info: IssueInfo,
+	commit_suffix: string | undefined,
+): string | undefined {
+	if (commit_suffix === undefined || commit_suffix.length === 0) return undefined
+
+	return `${issue_info.commit_message} ${commit_suffix}`
+}
+
+// The file form exists because the PR body now carries a live-execution evidence section of commands
+// and their output (joshuafolkken/kit#2446) — text an inline double-quoted `--body` would have the shell
+// evaluate first. Resolved through `cli_body`, the shared reader every `*-file` flag uses.
+function resolve_pr_body(values: CliArguments['values']): string | undefined {
+	return cli_body.resolve({
+		inline: values.body,
+		file_path: values['body-file'],
+		inline_flag: '--body',
+		file_flag: '--body-file',
+	})
+}
+
+async function execute_workflow(
+	values: CliArguments['values'],
+	positionals: Array<string>,
+): Promise<void> {
+	const { cli_issue_input, is_auto_mode, commit_suffix } = parse_positionals(positionals)
+	const is_non_interactive = is_non_interactive_mode(is_auto_mode, values)
+
+	await git_staging.check_and_confirm_staging(values.yes === true)
+
+	const issue_info = await prepare_issue_info(cli_issue_input, is_non_interactive)
+	const confirmations = await get_workflow_confirmations(is_non_interactive, values)
+	const commit_message = build_commit_message(issue_info, commit_suffix)
+
+	await run_workflow_steps(issue_info, confirmations, commit_message, resolve_pr_body(values))
+}
+
+async function main(): Promise<void> {
+	const { values, positionals } = parse_cli_arguments()
+
+	if (values.help === true) {
+		display_help()
+
+		return
+	}
+
+	await execute_workflow(values, positionals)
+}
+
+try {
+	await main()
+	console.info('')
+} catch (error) {
+	git_error.handle(error)
+}
+
+const git_workflow = {
+	parse_positionals,
+	get_workflow_confirmations,
+	prepare_issue_info,
+	is_non_interactive_mode,
+	resolve_pr_body,
+}
+
+export type { CliArguments }
+export { git_workflow }

package/scripts-ai/telegram-test-logic.ts

@@ -0,0 +1,88 @@
+import type { TelegramSendInput, TelegramTaskType } from '../scripts/git/telegram-notify'
+import { cli_body } from '../scripts/josh/cli-body'
+
+/* eslint-disable @typescript-eslint/naming-convention */
+interface CliValues {
+	'task-type'?: string
+	'repo-name'?: string
+	'issue-title'?: string
+	body?: string
+	'body-file'?: string
+	'issue-url'?: string
+	'pr-url'?: string
+}
+/* eslint-enable @typescript-eslint/naming-convention */
+
+interface ResolvedContext {
+	repo_name: string | undefined
+	issue_title: string | undefined
+}
+
+const VALID_TASK_TYPES: ReadonlyArray<TelegramTaskType> = [
+	'planning',
+	'completion',
+	'failure',
+	'warning',
+	'kickoff_retry',
+	'confirmation',
+	'stalled',
+]
+
+const DEFAULT_TASK_TYPE: TelegramTaskType = 'planning'
+
+function parse_task_type(raw: string | undefined): TelegramTaskType {
+	if (raw === undefined) return DEFAULT_TASK_TYPE
+
+	const matched = VALID_TASK_TYPES.find((candidate) => candidate === raw)
+
+	if (matched === undefined) {
+		throw new Error(`Invalid --task-type: ${raw}. Expected one of ${VALID_TASK_TYPES.join(', ')}.`)
+	}
+
+	return matched
+}
+
+// A flag counts as given only when it carries text, so `--issue-title ''` is not an answer. The
+// callers that *skip* a lookup because the flag already answered it read the same predicate, or the
+// two could disagree about an empty string and leave the field blank (joshuafolkken/kit#903).
+// It is `cli_body`'s predicate rather than a second copy: the body flags are resolved there, and two
+// definitions of "given" would let `--body ''` count on one side and not the other.
+const has_flag_value = cli_body.has_value
+
+function coalesce(primary: string | undefined, fallback: string | undefined): string | undefined {
+	if (has_flag_value(primary)) return primary
+
+	return fallback
+}
+
+// `--body-file` is the form to reach for whenever the body carries a backtick or a `$`: inside shell
+// double quotes those are evaluated before this process starts, and the text runs
+// (joshuafolkken/kit#1198). The resolution itself is `cli_body`'s, shared with `josh followup`.
+function normalize_body(values: CliValues): string | undefined {
+	return cli_body.resolve({
+		inline: values.body,
+		file_path: values['body-file'],
+		inline_flag: '--body',
+		file_flag: '--body-file',
+	})
+}
+
+function build_input(input: { values: CliValues; context: ResolvedContext }): TelegramSendInput {
+	return {
+		task_type: parse_task_type(input.values['task-type']),
+		repo_name: coalesce(input.values['repo-name'], input.context.repo_name),
+		issue_title: coalesce(input.values['issue-title'], input.context.issue_title),
+		body: normalize_body(input.values),
+		issue_url: input.values['issue-url'],
+		pr_url: input.values['pr-url'],
+	}
+}
+
+const telegram_test_logic = {
+	build_input,
+	parse_task_type,
+	has_flag_value,
+}
+
+export { telegram_test_logic }
+export type { CliValues, ResolvedContext }

package/scripts-ai/telegram-test.ts

@@ -0,0 +1,130 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+import { git_error } from '../scripts/git/git-error'
+import { git_gh_issue_read } from '../scripts/git/git-gh-issue-read'
+import { git_gh_repo } from '../scripts/git/git-gh-repo'
+import { github_issue_url, type IssueUrlTarget } from '../scripts/git/github-issue-url'
+import { telegram_notify } from '../scripts/git/telegram-notify'
+import { load_optional_environment } from './environment-loader'
+import { telegram_test_logic, type CliValues, type ResolvedContext } from './telegram-test-logic'
+
+const REPO_NAME_SEPARATOR = '/'
+
+function parse_cli_arguments(): CliValues {
+	const { values } = parseArgs({
+		options: {
+			'task-type': { type: 'string' },
+			'repo-name': { type: 'string' },
+			'issue-title': { type: 'string' },
+			body: { type: 'string' },
+			'body-file': { type: 'string' },
+			'issue-url': { type: 'string' },
+			'pr-url': { type: 'string' },
+		},
+	})
+
+	return values
+}
+
+// The repository this notification is about, for the Telegram header.
+//
+// joshuafolkken/kit#1063: this used to spawn `gh repo view --json nameWithOwner` through a
+// promisified `execFile`, which is why joshuafolkken/kit#1022's survey never counted it — the
+// callee was not `execa` and the file was not `scripts/`. `gh repo view` goes through GraphQL and
+// is answered 403 in a cloud session, so the header simply lost its repository name there.
+//
+// The same fact is already read over REST by `git_gh_repo`, whose failure contract is the
+// `undefined` this caller was already handling, so it is read from there rather than from a second
+// spawn (`CLAUDE.md` → "No clones").
+async function fetch_repo_name(): Promise<string | undefined> {
+	const name_with_owner = await git_gh_repo.repo_get_name_with_owner()
+
+	if (name_with_owner === undefined) return undefined
+
+	return name_with_owner.split(REPO_NAME_SEPARATOR).at(-1)
+}
+
+// The title is read from the repository the URL names, through the same reader every other
+// cross-repository read goes through. Read unqualified, `gh` would answer with the issue of that
+// number in the working directory's repository — a different issue with a different title
+// (joshuafolkken/kit#903).
+//
+// A repository the token cannot read answers the same `undefined` as an issue that does not exist,
+// and the notification would then go out with no title line at all. Say so, so the gap is visible
+// in the console beside the notification it belongs to.
+async function fetch_issue_title(target: IssueUrlTarget | undefined): Promise<string | undefined> {
+	if (target === undefined) return undefined
+
+	const title = await git_gh_issue_read.issue_get_title(target.issue_number, target.name_with_owner)
+
+	if (title === undefined) {
+		console.warn(`⚠️  Could not read ${target.name_with_owner}#${target.issue_number}.`)
+	}
+
+	return title
+}
+
+// An explicit `--issue-title` already answers this, and `build_input` prefers it — so reading one
+// would spend a `gh` call whose result is discarded, and a repository the token cannot read would
+// warn about a notification that is not missing its title.
+async function resolve_issue_title(
+	values: CliValues,
+	target: IssueUrlTarget | undefined,
+): Promise<string | undefined> {
+	if (telegram_test_logic.has_flag_value(values['issue-title'])) return undefined
+
+	return await fetch_issue_title(target)
+}
+
+// Resolution order: an explicit `--repo-name` (applied by `build_input`, which prefers the flag),
+// then the repository the `--issue-url` points at, then the one `--pr-url` points at, then the
+// working directory. The last step is the backwards-compatible one, and it is reached only when
+// there is no URL of either kind to read.
+//
+// `--issue-url` outranks `--pr-url` because it identifies the issue the title is read from as well
+// as the repository. A pull URL answers the repository half only, which is why it is read for
+// `repo_name` and not passed to `resolve_issue_title` — a completion notification carrying only a
+// PR link used to go out under the working directory's repository while its link pointed elsewhere
+// (joshuafolkken/kit#994).
+async function resolve_context(values: CliValues): Promise<ResolvedContext> {
+	const target = github_issue_url.parse(values['issue-url'])
+	const pull_target = github_issue_url.parse_pull(values['pr-url'])
+	const repo_name = target?.repo ?? pull_target?.repo ?? (await fetch_repo_name())
+	const issue_title = await resolve_issue_title(values, target)
+
+	return { repo_name, issue_title }
+}
+
+async function main(): Promise<void> {
+	load_optional_environment()
+	const values = parse_cli_arguments()
+	const context = await resolve_context(values)
+	const input = telegram_test_logic.build_input({ values, context })
+
+	await telegram_notify.send(input)
+}
+
+// **A notification nobody received must not read as success** (joshuafolkken/kit#1564). This command
+// *is* the notification, so a failed send is its result and the exit code has to say so — the state
+// that Issue measured was three lost messages, each printing a warning and exiting 0.
+//
+// `git_error.handle` is what every other script in this directory ends with: it prints the message
+// and exits non-zero. Both the message and the `cause` whose text `handle` also prints reach it
+// already free of the bot token and the chat id — `telegram_notify` redacts each before throwing.
+//
+// Separated from the `import.meta.url` guard so the wiring is reachable from a unit test; the guard
+// itself stays the canonical one the in-process dispatcher matches on.
+async function run_cli(): Promise<void> {
+	try {
+		await main()
+	} catch (error) {
+		git_error.handle(error)
+	}
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await run_cli()
+
+const telegram_test = { fetch_repo_name, fetch_issue_title, resolve_context, run_cli }
+
+export { telegram_test }

package/templates/gitignore

@@ -0,0 +1,76 @@
+node_modules
+test-results
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+# .svelte-kit is always machine-generated; ignore it at any depth (e.g. templates/.svelte-kit)
+.svelte-kit/
+/build
+/dist
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+.dev.vars
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+
+# Cloudflare Types
+/worker-configuration.d.ts
+
+# Server config (contains internal infrastructure details)
+.server
+
+# Paraglide
+src/lib/paraglide
+project.inlang/cache/
+
+# SQLite
+*.db
+
+# Storybook
+*storybook.log
+storybook-static
+
+# Verification gate caches (josh lint / josh check / josh cspell:dot), plus the edit hook's own
+# eslint cache (josh format:edited), which is kept apart from the gate's on purpose
+.eslintcache
+.eslintcache.edit
+.eslintcache.related
+.tsbuildinfo
+.cspellcache
+
+# Bundle analysis
+stats-client.html
+stats-server.html
+
+# Playwright
+playwright-report
+e2e/.auth/user.json
+e2e/.auth/worker-*.json
+e2e/.auth/chrome-profile/
+
+# svelte-fast-check cache
+.fast-check
+
+# Overrides snapshot (generated by pnpm overrides:check --save)
+.overrides-snapshot.json
+
+# Run timing history (appended by josh followup on a merged run; read by josh time)
+.time-history.jsonl
+
+# Claude Code runtime artifacts
+.claude/scheduled_tasks.lock
+
+.pnpm-store

package/templates/sonar-project.properties

@@ -0,0 +1,52 @@
+sonar.projectKey={{PROJECT_KEY}}
+sonar.organization={{ORGANIZATION}}
+
+# Pure JavaScript files only
+sonar.lang.patterns.js=**/*.js,**/*.jsx,**/*.cjs,**/*.mjs
+# TypeScript files including .svelte and .vue (which often use TypeScript)
+sonar.lang.patterns.ts=**/*.ts,**/*.tsx,**/*.cts,**/*.mts,**/*.vue,**/*.svelte
+# Exclude .svelte from CSS patterns
+sonar.lang.patterns.css=**/*.css,**/*.less,**/*.scss,**/*.sass
+
+# Disable coverage checks
+sonar.coverage.exclusions=**/*
+
+# Exclude upstream-synced bootstrap scripts and dev/CI tooling from analysis.
+# .claude/ hosts setup shell scripts synced from joshuafolkken/tasks (must not drift).
+# scripts/ hosts git / issue / overrides / telegram workflow tooling — not production code.
+sonar.exclusions=.claude/**,scripts/**
+
+# Suppress "OS command from PATH" hotspots (S4036) on dev/CLI tooling.
+# scripts/ is already fully excluded above; scripts-ai/ stays analyzed but invokes
+# pnpm/git/gh/node via PATH by design, so S4036 is a known false-positive class there.
+#
+# Suppress "path from CLI-controlled data" findings (S8707) on the same dev/CLI
+# tooling. A `*-file` flag takes a path the developer typed on their own command
+# line — the same trust level as the command itself — so there is no untrusted
+# input boundary for the taint analysis to protect, exactly as with S4036.
+sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8
+sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S4036
+sonar.issue.ignore.multicriteria.e1.resourceKey=scripts/**/*
+sonar.issue.ignore.multicriteria.e2.ruleKey=typescript:S4036
+sonar.issue.ignore.multicriteria.e2.resourceKey=scripts-ai/**/*
+sonar.issue.ignore.multicriteria.e3.ruleKey=javascript:S4036
+sonar.issue.ignore.multicriteria.e3.resourceKey=scripts/**/*
+sonar.issue.ignore.multicriteria.e4.ruleKey=javascript:S4036
+sonar.issue.ignore.multicriteria.e4.resourceKey=scripts-ai/**/*
+sonar.issue.ignore.multicriteria.e5.ruleKey=tssecurity:S8707
+sonar.issue.ignore.multicriteria.e5.resourceKey=scripts/**/*
+sonar.issue.ignore.multicriteria.e6.ruleKey=tssecurity:S8707
+sonar.issue.ignore.multicriteria.e6.resourceKey=scripts-ai/**/*
+sonar.issue.ignore.multicriteria.e7.ruleKey=jssecurity:S8707
+sonar.issue.ignore.multicriteria.e7.resourceKey=scripts/**/*
+sonar.issue.ignore.multicriteria.e8.ruleKey=jssecurity:S8707
+sonar.issue.ignore.multicriteria.e8.resourceKey=scripts-ai/**/*
+
+# Files to exclude from the duplicate check.
+# Snapshot files (.snap) contain machine-generated repetitive patterns and are not authored code.
+# Command-registry files (josh-commands-*.ts) are data definitions that follow a fixed schema;
+# structural similarity between entries is inherent and expected, not logic duplication.
+sonar.cpd.exclusions=**/*.test.ts,**/*.spec.ts,**/*.e2e.ts,**/*.snap,**/josh-commands-*.ts
+
+# Use SonarCloud-compatible tsconfig
+sonar.typescript.tsconfigPath=tsconfig.sonar.json