@joshuafolkken/kit 1.881.0 → 1.883.0

package/.github/workflows/ci.yml

@@ -307,7 +307,7 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:
@@ -406,7 +406,7 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:
@@ -615,7 +615,7 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:

package/dist/version/index.js

@@ -962,9 +962,17 @@ function run_upgrade_command(command) {
 }
 function run_all_upgrade_commands(commands) {
   let exit_code = 0;
+  const failed_commands = [];
   for (const command of commands) {
     const code = run_upgrade_command(command);
-    if (code !== 0) exit_code = code;
+    if (code === 0) continue;
+    exit_code = code;
+    failed_commands.push(command);
+  }
+  if (failed_commands.length > 0) {
+    console.error(
+      `Upgrade incomplete; successful steps remain applied. Failed: ${failed_commands.join(", ")}`
+    );
   }
   return exit_code;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.881.0",
+  "version": "1.883.0",
   "name": "@joshuafolkken/kit",
   "type": "module",
   "license": "MIT",
@@ -166,7 +166,7 @@
     }
   },
   "scripts": {
-    "preinstall": "pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci",
+    "preinstall": "pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci",
     "build": "tsx scripts/build/build-bin.ts && tsx scripts/build/build-hooks.ts && tsx scripts/build/build-version.ts && tsx scripts/build/build-config-merge.ts && tsx scripts/build/build-managed-marker.ts && tsx scripts/build/build-self-sync-guard.ts && tsx scripts/build/build-claude-md.ts",
     "josh": "tsx scripts/josh/josh.ts"
   }

package/pnpm-workspace.yaml

@@ -18,12 +18,9 @@ trustLockfile: true
 # `@types/node` and `tsx` are also excluded so routine Dependabot-style bumps are not
 # delayed by the minimum-release-age window.
 #
-# This list governs **pnpm's** `minimum-release-age` only. The `preinstall` hook installs
-# @aikidosec/safe-chain, which applies its own age policy and has no knowledge of these entries — a
-# package listed here is still hidden by safe-chain until it ages in. Pinning a dependency floor to
-# a release that safe-chain still withholds publishes a range no consumer can resolve (kit #742), so
-# `josh ranges` checks every published range against that filtered view — from `josh latest` right
-# after the ranges are rewritten, and again from `prepack` as the last gate before a publish.
+# `josh init` / `josh sync` mirror this list to Safe Chain's .aikido project config (kit #2618).
+# Older Safe Chain shims ignore .aikido and can still hide an excluded release. `josh ranges`
+# checks published dependency ranges through that filtered view before a release (kit #742).
 minimumReleaseAgeExclude:
   - vite
   - '@types/node'

package/scripts/init/init.ts

@@ -6,6 +6,7 @@ import { resolve_local_bin } from '#scripts/build/local-bin'
 import { doctor_io } from '#scripts/doctor/doctor-io'
 import { package_version_schema, with_package_manager_schema } from '#scripts/lib/schemas'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { did_refuse_self_run } from '#scripts/self-sync-guard/self-sync-refusal'
 import { sync } from '#scripts/sync/sync'
@@ -203,6 +204,7 @@ function main(): void {
 	merge_project_package_json()
 
 	run_ai_file_actions()
+	project_config.sync_project_config(PROJECT_ROOT)
 	console.info('\n✅ Done.\n')
 }
 

package/scripts/safe-chain/project-config.ts

@@ -0,0 +1,104 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { yaml_document } from '#scripts/yaml/yaml-document'
+import { dump } from 'js-yaml'
+import { z } from 'zod'
+
+const WORKSPACE_FILE = 'pnpm-workspace.yaml'
+const PROJECT_CONFIG_FILE = '.aikido'
+const EXCLUSIONS_FIELD = 'minimumPackageAgeExclusions'
+const workspace_schema = z.object({ minimumReleaseAgeExclude: z.array(z.string()).optional() })
+
+function read_mapping(value: unknown, label: string): Record<string, unknown> {
+	if (value === undefined) return {}
+	if (yaml_document.is_mapping_document(value)) return value
+	throw new Error(`${label} must be a YAML mapping`)
+}
+
+function is_block_line(line: string): boolean {
+	return line.trim() === '' || line.startsWith(' ') || line.startsWith('\t')
+}
+
+function trim_block_end(lines: ReadonlyArray<string>, start: number, end: number): number {
+	let trimmed = end
+	while (trimmed > start + 1 && lines[trimmed - 1]?.trim() === '') trimmed -= 1
+
+	return trimmed
+}
+
+function find_block_end(lines: ReadonlyArray<string>, start: number): number {
+	const remaining = lines.slice(start + 1)
+	const relative = remaining.findIndex((line, index) => {
+		if (is_block_line(line)) return false
+		if (!line.startsWith('#')) return true
+		const next = remaining
+			.slice(index + 1)
+			.find((candidate) => candidate.trim() !== '' && !candidate.startsWith('#'))
+
+		return next === undefined || !is_block_line(next)
+	})
+	const end = relative === -1 ? lines.length : start + 1 + relative
+
+	return trim_block_end(lines, start, end)
+}
+
+function append_block(existing: string, block: string): string {
+	if (existing.length === 0) return block
+	const prefix = existing.endsWith('\n') ? existing : `${existing}\n`
+
+	return `${prefix}\n${block}`
+}
+
+function preserve_anchor(block: string, key_line: string): string {
+	const anchor = /(?:^|\s)(&[^\s#]+)/u.exec(key_line)?.[1]
+	if (!anchor) return block
+	const header = 'safe-chain:'
+
+	return `${header} ${anchor}${block.slice(header.length)}`
+}
+
+function replace_safe_chain_block(existing: string, safe_chain: Record<string, unknown>): string {
+	const block = dump({ 'safe-chain': safe_chain }, { lineWidth: -1 })
+	const lines = existing.split('\n')
+	const start = lines.findIndex((line) =>
+		/^(?:safe-chain|'safe-chain'|"safe-chain")\s*:/u.test(line),
+	)
+	if (start === -1) return append_block(existing, block)
+	const replacement = preserve_anchor(block, lines[start] ?? '')
+	const end = find_block_end(lines, start)
+	const prefix = lines.slice(0, start).join('\n')
+	const suffix = lines.slice(end).join('\n')
+
+	return `${prefix}${prefix ? '\n' : ''}${replacement}${suffix}`
+}
+
+function merge_project_config(existing: string, workspace: string): string {
+	const source = workspace_schema.parse(yaml_document.parse_yaml(workspace))
+	const exclusions = source.minimumReleaseAgeExclude ?? []
+	const aikido = yaml_document.parse_yaml(existing)
+	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
+	const npm = read_mapping(safe_chain['npm'], 'safe-chain.npm')
+	if (JSON.stringify(npm[EXCLUSIONS_FIELD]) === JSON.stringify(exclusions)) return existing
+	if (exclusions.length === 0 && existing.length === 0) return existing
+
+	const merged = { ...safe_chain, npm: { ...npm, [EXCLUSIONS_FIELD]: exclusions } }
+
+	return replace_safe_chain_block(existing, merged)
+}
+
+function sync_project_config(root: string): boolean {
+	const workspace_path = path.join(root, WORKSPACE_FILE)
+	if (!existsSync(workspace_path)) return false
+	const config_path = path.join(root, PROJECT_CONFIG_FILE)
+	const existing = existsSync(config_path) ? readFileSync(config_path, 'utf8') : ''
+	const workspace = readFileSync(workspace_path, 'utf8')
+	const merged = merge_project_config(existing, workspace)
+	if (merged === existing) return false
+	writeFileSync(config_path, merged)
+
+	return true
+}
+
+const project_config = { merge_project_config, sync_project_config }
+
+export { project_config }

package/scripts/sync/sync.ts

@@ -8,6 +8,7 @@ import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
 import { plugin_install_hint_module } from '#scripts/init/plugin-install-hint'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { sonar_file } from '#scripts/security/sonar-file'
 import { did_refuse_self_run } from '#scripts/self-sync-guard/self-sync-refusal'
@@ -367,6 +368,7 @@ function report_repository_settings(name_with_owner: string | undefined): void {
 
 function sync_project_artifacts(is_force: boolean): void {
 	sync_ai_copy_all(is_force)
+	project_config.sync_project_config(PROJECT_ROOT)
 	sync_prettier_config(path.join(PROJECT_ROOT, 'prettier.config.js'))
 	sync_playwright_config(path.join(PROJECT_ROOT, 'playwright.config.ts'))
 	sync_deploy_vps(path.join(PROJECT_ROOT, '.github/workflows/deploy-vps.yml'))

package/scripts/version/publishable-range.ts

@@ -9,9 +9,9 @@ import semver from 'semver'
 // The check asks the registry through that same filtered view instead of modelling the policy:
 // `pnpm view <name>@<range> version` prints no version and exits non-zero
 // (ERR_PNPM_PACKAGE_NOT_FOUND) exactly when nothing visible satisfies the range. Modelling would
-// mean guessing safe-chain's threshold, and `minimumReleaseAgeExclude` cannot stand in for it —
-// that list governs pnpm's own `minimum-release-age`, and safe-chain has no knowledge of it, which
-// is precisely what made the original failure surprising.
+// mean guessing safe-chain's threshold. `josh init` / `josh sync` now mirror
+// `minimumReleaseAgeExclude` into Safe Chain's .aikido project config (kit #2618), but older
+// installed shims ignore it and published ranges must still be checked against their filtered view.
 
 interface PublishedRange {
 	name: string

package/scripts/version/version-commands.ts

@@ -204,10 +204,19 @@ function run_upgrade_command(command: string): number {
 // succeed) so a failure on either target is surfaced without aborting the remaining upgrades.
 function run_all_upgrade_commands(commands: ReadonlyArray<string>): number {
 	let exit_code = 0
+	const failed_commands: Array<string> = []
 
 	for (const command of commands) {
 		const code = run_upgrade_command(command)
-		if (code !== 0) exit_code = code
+		if (code === 0) continue
+		exit_code = code
+		failed_commands.push(command)
+	}
+
+	if (failed_commands.length > 0) {
+		console.error(
+			`Upgrade incomplete; successful steps remain applied. Failed: ${failed_commands.join(', ')}`,
+		)
 	}
 
 	return exit_code

package/templates/workflows/ci.yml

@@ -178,7 +178,7 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:
@@ -400,7 +400,7 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env: