@joshuafolkken/kit 1.921.0 → 1.947.0

package/scripts/run/run-tidy-lanes.ts

@@ -0,0 +1,110 @@
+import { git_spawn } from '#scripts/git/git-spawn'
+import { git_stash } from '#scripts/git/git-stash'
+import { lane_close } from '#scripts/lane/lane-close'
+import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
+import { run_hold } from './run-hold'
+import { run_tidy, type Outcome, type Verdict } from './run-tidy'
+
+// The lane half of `josh run:tidy` (joshuafolkken/kit#2701): each lane whose issue merged, read for
+// what would make closing it lose work, then closed with its run record released. A lane whose work
+// tree is already gone is `lane:prune`'s, so it is left to that command.
+
+const CLOSED_KIND = 'closed'
+const INCOMPLETE_REASON = 'the close left files behind'
+const NOT_MERGED_REASON = 'not merged'
+
+type IsMerged = (issue: string) => Promise<boolean>
+
+// Any commit on the lane's branch that no remote-tracking ref reaches — `HEAD --not --remotes` — is
+// work only this tree holds. A branch merged upstream is reached through the default branch even after
+// its own remote branch was deleted, so a merged lane answers zero. A failed read keeps the lane.
+async function has_unpushed(directory: string): Promise<boolean> {
+	try {
+		const count = await git_spawn.read([
+			'-C',
+			directory,
+			'rev-list',
+			'--count',
+			'HEAD',
+			'--not',
+			'--remotes',
+		])
+
+		return count !== '0'
+	} catch {
+		return true
+	}
+}
+
+async function hold_path_of(directory: string): Promise<string> {
+	const git_directory = await git_spawn.read(['-C', directory, 'rev-parse', '--absolute-git-dir'])
+
+	return run_hold.hold_path(git_directory)
+}
+
+// A live record belongs to a run still inside that tree — one finishing its post-merge steps — so the
+// lane waits for the next sweep; an unreadable record is kept for the same reason.
+function is_running(hold_path: string): boolean {
+	const read = run_hold.read_hold(hold_path)
+
+	return read.kind === 'held' || read.kind === 'unreadable'
+}
+
+// Asked only of a lane already read as merged, so the rule's "not merged" answer cannot come back.
+async function lane_verdict(lane: LaneInfo, hold_path: string): Promise<Verdict> {
+	const verdict = run_tidy.lane_verdict({
+		issue: lane.issue,
+		is_merged: true,
+		has_changes: await git_stash.has_changes(lane.directory),
+		has_unpushed: await has_unpushed(lane.directory),
+		is_running: is_running(hold_path),
+	})
+
+	return verdict ?? run_tidy.keep(NOT_MERGED_REASON)
+}
+
+async function close(issue: string, hold_path: string): Promise<Verdict> {
+	const outcome = await lane_close.close_lane(issue)
+
+	if (outcome.kind !== CLOSED_KIND) return run_tidy.keep(INCOMPLETE_REASON)
+
+	run_hold.release_hold(hold_path)
+
+	return run_tidy.CLEAN
+}
+
+async function settle(lane: LaneInfo): Promise<Verdict> {
+	try {
+		const hold_path = await hold_path_of(lane.directory)
+		const verdict = await lane_verdict(lane, hold_path)
+
+		return verdict.kind === 'clean' ? await close(lane.issue, hold_path) : verdict
+	} catch (error) {
+		return run_tidy.keep(String(error))
+	}
+}
+
+async function tidy_lane(lane: LaneInfo, is_merged: IsMerged): Promise<Outcome | undefined> {
+	if (lane.is_stranded || !(await is_merged(lane.issue))) return undefined
+
+	return { target: `lane #${lane.issue}`, verdict: await settle(lane) }
+}
+
+// One lane at a time: a close removes a work tree and prunes the worktree list the next read uses.
+async function tidy_lanes(is_merged: IsMerged): Promise<Array<Outcome>> {
+	const outcomes: Array<Outcome> = []
+	const lanes = await lane_registry.list_lanes()
+
+	for (const lane of lanes) {
+		const outcome = await tidy_lane(lane, is_merged)
+
+		if (outcome !== undefined) outcomes.push(outcome)
+	}
+
+	return outcomes
+}
+
+const run_tidy_lanes = { has_unpushed, tidy_lanes }
+
+export type { IsMerged }
+export { run_tidy_lanes }

package/scripts/run/run-tidy-stashes.ts

@@ -0,0 +1,160 @@
+import { readFile } from 'node:fs/promises'
+import { git_stash, type StashEntry } from '#scripts/git/git-stash'
+import { stash_orphans } from '#scripts/git/stash-orphans'
+import { stash_sweep_lock } from '#scripts/git/stash-sweep-lock'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { observation_ledger } from '#scripts/observations/observation-ledger'
+import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
+import { run_tidy, type Outcome, type Verdict } from './run-tidy'
+import type { IsMerged } from './run-tidy-lanes'
+
+// The stash half of `josh run:tidy` (joshuafolkken/kit#2701): each entry whose named issues are all
+// merged is dropped, and one that touches the observation ledger has its lines carried into the ledger
+// first. The ledger is append-only and the digest counts repeats across it, so an entry's lines are
+// never discarded with the entry.
+
+// The same width `run-carry-stash.ts` reads issue states at.
+const READ_CONCURRENCY = 8
+const GONE_REASON = 'already dropped by another run'
+const BUSY_REASON = 'another run held the stash sweep lock'
+
+async function read_ledger(ledger_path: string): Promise<string> {
+	try {
+		return await readFile(ledger_path, 'utf8')
+	} catch {
+		return ''
+	}
+}
+
+// An entry cut before joshuafolkken/kit#2724 holds its lines at the ledger's old path, so the lines of
+// every ledger path it touches are carried to the current ledger.
+async function added_ledger_lines(
+	hash: string,
+	ledger_paths: ReadonlyArray<string>,
+): Promise<Array<string>> {
+	const added: Array<string> = []
+
+	for (const ledger_path of ledger_paths) {
+		const lines = await git_stash.added_lines(hash, ledger_path)
+
+		added.push(...lines)
+	}
+
+	return added
+}
+
+// How many ledger lines went into the primary checkout's ledger before the drop.
+async function carry_ledger(hash: string): Promise<number> {
+	const changed = await git_stash.changed_paths(hash)
+	const ledger_paths = changed.filter((file_path) => observation_ledger.is_ledger_path(file_path))
+
+	if (ledger_paths.length === 0) return 0
+
+	const ledger_path = observation_ledger_home.ledger_path()
+	const added = await added_ledger_lines(hash, ledger_paths)
+	const carried = run_tidy.ledger_carry(added, await read_ledger(ledger_path))
+
+	await observation_ledger_home.append(ledger_path, carried)
+
+	return carried.length
+}
+
+function carried_note(count: number): string {
+	return count === 0 ? '' : ` (${String(count)} observation line(s) carried to the ledger)`
+}
+
+async function drop(entry: StashEntry): Promise<Outcome> {
+	const carried = await carry_ledger(entry.selector)
+	const target = `stash "${entry.subject}"${carried_note(carried)}`
+	const is_dropped = await git_stash.drop_by_hash(entry.selector)
+
+	return { target, verdict: is_dropped ? run_tidy.CLEAN : run_tidy.keep(GONE_REASON) }
+}
+
+async function merged_set(
+	issues: ReadonlyArray<string>,
+	is_merged: IsMerged,
+): Promise<Set<string>> {
+	const answers = await bounded_pool.bounded_map(
+		issues,
+		READ_CONCURRENCY,
+		async (issue) => await is_merged(issue),
+	)
+
+	return new Set(issues.filter((_issue, index) => answers[index] === true))
+}
+
+function entry_verdict(entry: StashEntry, merged: ReadonlySet<string>): Verdict | undefined {
+	const issues = stash_orphans.issues_named(entry.subject)
+
+	return run_tidy.stash_verdict({ subject: entry.subject, issues }, merged)
+}
+
+async function tidy_entry(
+	entry: StashEntry,
+	merged: ReadonlySet<string>,
+): Promise<Outcome | undefined> {
+	const verdict = entry_verdict(entry, merged)
+
+	if (verdict === undefined) return undefined
+
+	if (verdict.kind === 'keep') return { target: `stash "${entry.subject}"`, verdict }
+
+	try {
+		return await drop(entry)
+	} catch (error) {
+		return { target: `stash "${entry.subject}"`, verdict: run_tidy.keep(String(error)) }
+	}
+}
+
+async function tidy_entries(
+	entries: ReadonlyArray<StashEntry>,
+	merged: ReadonlySet<string>,
+): Promise<Array<Outcome>> {
+	const outcomes: Array<Outcome> = []
+
+	for (const entry of entries) {
+		const outcome = await tidy_entry(entry, merged)
+
+		if (outcome !== undefined) outcomes.push(outcome)
+	}
+
+	return outcomes
+}
+
+// The report a sweep that never got the lock gives: every entry it would have dropped is kept.
+function busy_outcome(entry: StashEntry, merged: ReadonlySet<string>): Outcome | undefined {
+	const verdict = entry_verdict(entry, merged)
+
+	if (verdict === undefined) return undefined
+
+	return {
+		target: `stash "${entry.subject}"`,
+		verdict: verdict.kind === 'keep' ? verdict : run_tidy.keep(BUSY_REASON),
+	}
+}
+
+function busy_outcomes(
+	entries: ReadonlyArray<StashEntry>,
+	merged: ReadonlySet<string>,
+): Array<Outcome> {
+	return entries
+		.map((entry) => busy_outcome(entry, merged))
+		.filter((outcome): outcome is Outcome => outcome !== undefined)
+}
+
+// Sequential drops under the repository-wide sweep lock: each resolves its position from its hash just
+// before it goes, which holds only while no other sweep is shifting the stack or appending the same
+// ledger lines. The GitHub reads stay outside the lock — they are the slow part and mutate nothing.
+async function tidy_stashes(is_merged: IsMerged): Promise<Array<Outcome>> {
+	const entries = await git_stash.list_by_hash()
+	const issues = [...new Set(entries.flatMap((entry) => stash_orphans.issues_named(entry.subject)))]
+	const merged = await merged_set(issues, is_merged)
+	const outcomes = await stash_sweep_lock.with_lock(async () => await tidy_entries(entries, merged))
+
+	return outcomes ?? busy_outcomes(entries, merged)
+}
+
+const run_tidy_stashes = { tidy_stashes }
+
+export { run_tidy_stashes }

package/scripts/run/run-tidy.ts

@@ -0,0 +1,101 @@
+import { observation_ledger_line } from '#scripts/observations/observation-ledger-line'
+
+// The decisions behind `josh run:tidy` (joshuafolkken/kit#2701), kept apart from the git and GitHub
+// reads so each can be pinned without either. A run start sweeps what merged work left behind — the
+// lanes holding a seat after their branch merged, and the stashes of issues that are all merged — and
+// every rule here is written so that doubt keeps the thing: a lane with any uncommitted change or any
+// commit no remote has, and a stash naming any issue that is not merged or naming none at all, stay.
+
+const LINE_SEPARATOR = '\n'
+const CLEANED_HEADER = 'run:tidy — cleaned:'
+const KEPT_HEADER = 'run:tidy — kept:'
+const CHANGES_REASON = 'uncommitted changes'
+const UNPUSHED_REASON = 'commits no remote has'
+const RUNNING_REASON = 'held by a live run'
+
+interface LaneFacts {
+	issue: string
+	is_merged: boolean
+	has_changes: boolean
+	has_unpushed: boolean
+	is_running: boolean
+}
+
+interface StashFacts {
+	subject: string
+	issues: ReadonlyArray<string>
+}
+
+type Verdict = { kind: 'clean' } | { kind: 'keep'; reason: string }
+
+interface Outcome {
+	target: string
+	verdict: Verdict
+}
+
+const CLEAN: Verdict = { kind: 'clean' }
+
+function keep(reason: string): Verdict {
+	return { kind: 'keep', reason }
+}
+
+// A lane whose issue is still open is some run's, so it is left out of the report entirely rather than
+// listed as kept — the report names what merged work left behind, not every lane.
+function lane_verdict(facts: LaneFacts): Verdict | undefined {
+	if (!facts.is_merged) return undefined
+
+	if (facts.has_changes) return keep(CHANGES_REASON)
+
+	if (facts.has_unpushed) return keep(UNPUSHED_REASON)
+
+	return facts.is_running ? keep(RUNNING_REASON) : CLEAN
+}
+
+function unmerged_reason(unmerged: ReadonlyArray<string>): string {
+	const named = unmerged.map((issue) => `#${issue}`).join(', ')
+
+	return `${named} not merged`
+}
+
+// Like a lane, a stash naming no merged issue is left out of the report: one naming no issue at all,
+// or only open ones, is not merged work's residue, and listing it at every run start would bury the
+// entries that are.
+function stash_verdict(facts: StashFacts, merged: ReadonlySet<string>): Verdict | undefined {
+	const unmerged = facts.issues.filter((issue) => !merged.has(issue))
+
+	if (unmerged.length === facts.issues.length) return undefined
+
+	return unmerged.length === 0 ? CLEAN : keep(unmerged_reason(unmerged))
+}
+
+// The ledger lines a stash would carry away with it, less those the ledger already holds — the same
+// line appended twice would read as a recurrence to the observation digest, which counts repeats.
+function ledger_carry(added: ReadonlyArray<string>, ledger: string): Array<string> {
+	const entries = added.filter((line) => observation_ledger_line.is_ledger_entry_line(line))
+
+	return observation_ledger_line.missing_lines([...new Set(entries)], ledger)
+}
+
+function format_outcome(outcome: Outcome): string {
+	const suffix = outcome.verdict.kind === 'keep' ? ` — ${outcome.verdict.reason}` : ''
+
+	return `  ${outcome.target}${suffix}`
+}
+
+function section(header: string, outcomes: ReadonlyArray<Outcome>): Array<string> {
+	return outcomes.length === 0 ? [] : [header, ...outcomes.map((item) => format_outcome(item))]
+}
+
+// `undefined` when the sweep found nothing merged, so an ordinary run start prints nothing.
+function format_report(outcomes: ReadonlyArray<Outcome>): string | undefined {
+	const cleaned = outcomes.filter((outcome) => outcome.verdict.kind === 'clean')
+	const kept = outcomes.filter((outcome) => outcome.verdict.kind === 'keep')
+	const lines = [...section(CLEANED_HEADER, cleaned), ...section(KEPT_HEADER, kept)]
+
+	return lines.length === 0 ? undefined : lines.join(LINE_SEPARATOR)
+}
+
+const run_tidy = { CLEAN, format_report, keep, lane_verdict, ledger_carry, stash_verdict }
+
+export type { LaneFacts, Outcome, StashFacts, Verdict }
+export { run_tidy }

package/scripts/safe-chain/ci-installer-pin.ts

@@ -0,0 +1,90 @@
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { execaSync } from 'execa'
+
+// The workflows that install safe-chain on the runner. Both carry the release and the installer's
+// SHA-256 as workflow-level env, so one pin per file moves every "Setup safe-chain" step at once
+// (joshuafolkken/kit#2711). A consumer has only the first, and `josh sync` rewrites it from the
+// template, so moving it anywhere but kit is harmless and short-lived.
+const WORKFLOW_PATHS = ['.github/workflows/ci.yml', 'templates/workflows/ci.yml']
+// `[ \t]` rather than `\s`: under the `m` flag `\s*` would run across line ends and swallow the
+// blank line that follows the env block.
+const VERSION_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_VERSION:[ \t]*)(?<value>\S+)[ \t]*$/mu
+const SHA256_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_SHA256:[ \t]*)(?<value>\S+)[ \t]*$/mu
+const VALUE_GROUP = 'value'
+const DOWNLOAD_TIMEOUT_MS = 30_000
+
+interface InstallerPin {
+	version: string
+	sha256: string
+}
+
+function installer_url(version: string): string {
+	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
+}
+
+function extract_pinned_version(content: string): string | undefined {
+	return VERSION_RE.exec(content)?.groups?.[VALUE_GROUP]
+}
+
+function rewrite_pin(content: string, pin: InstallerPin): string {
+	return content
+		.replace(VERSION_RE, (_match, key: string) => `${key}${pin.version}`)
+		.replace(SHA256_RE, (_match, key: string) => `${key}${pin.sha256}`)
+}
+
+function fetch_installer_sha256(version: string): string | undefined {
+	// `--proto =https` keeps the release redirect from being followed onto plain HTTP.
+	const result = execaSync('curl', ['--proto', '=https', '-fsSL', installer_url(version)], {
+		encoding: 'buffer',
+		// The hash is of the file as published; execa would otherwise drop its trailing newline.
+		stripFinalNewline: false,
+		reject: false,
+		timeout: DOWNLOAD_TIMEOUT_MS,
+	})
+	if (result.exitCode !== 0 || result.stdout.length === 0) return undefined
+
+	return createHash('sha256').update(result.stdout).digest('hex')
+}
+
+// The workflows whose pin lags `latest` — a missing file or one without the pin is not a target.
+function stale_workflows(latest: string, workflow_paths: ReadonlyArray<string>): Array<string> {
+	return workflow_paths.filter((workflow_path) => {
+		if (!existsSync(workflow_path)) return false
+		const current = extract_pinned_version(readFileSync(workflow_path, 'utf8'))
+
+		return current !== undefined && current !== latest
+	})
+}
+
+function write_pin(workflow_path: string, pin: InstallerPin): void {
+	console.info(`\n↑ Updating safe-chain installer in ${workflow_path} → ${pin.version}`)
+	writeFileSync(workflow_path, rewrite_pin(readFileSync(workflow_path, 'utf8'), pin), 'utf8')
+}
+
+function sync(latest: string, workflow_paths: ReadonlyArray<string> = WORKFLOW_PATHS): void {
+	const targets = stale_workflows(latest, workflow_paths)
+	if (targets.length === 0) return
+
+	const sha256 = fetch_installer_sha256(latest)
+
+	if (sha256 === undefined) {
+		console.warn(`\n⚠ Could not download the safe-chain ${latest} installer; CI pin left as is`)
+
+		return
+	}
+
+	for (const workflow_path of targets) write_pin(workflow_path, { version: latest, sha256 })
+}
+
+const ci_installer_pin = {
+	WORKFLOW_PATHS,
+	installer_url,
+	extract_pinned_version,
+	rewrite_pin,
+	fetch_installer_sha256,
+	sync,
+}
+
+export { ci_installer_pin }
+export type { InstallerPin }

package/scripts/safe-chain/preinstall-command.ts

@@ -0,0 +1,39 @@
+// `setup-ci` only writes shims and adds them to PATH on a CI runner, so a local `pnpm install` is
+// scanned only when the developer has enabled safe-chain's own shell integration. That integration
+// runs pnpm behind safe-chain's registry proxy and hands `GLOBAL_AGENT_HTTP_PROXY` to it, which a bare
+// pnpm never sets — the one signal a lifecycle script can read (joshuafolkken/kit#2707).
+const SETUP_CI_CMD = 'pnpm dlx @aikidosec/safe-chain setup-ci'
+const LEGACY_PREINSTALL_RE = /^pnpm dlx @aikidosec\/safe-chain(?:@\S+)? setup-ci$/u
+const INTEGRATION_HINT =
+	'Warning: safe-chain is not scanning this install because its shell integration is not active.' +
+	' Install safe-chain (https://github.com/AikidoSec/safe-chain#installation) or run: safe-chain setup' +
+	' - then restart your terminal.'
+// `preinstall` runs before any dependency is installed, kit included, so the check is plain Node with
+// no imports. It never fails the install and stays silent on CI, where the runner is set up instead.
+// The source avoids double quotes, `$` and backticks so the shell passes it to Node verbatim.
+const LOCAL_INTEGRATION_CHECK_SOURCE = `if(!process.env.CI&&!process.env.GLOBAL_AGENT_HTTP_PROXY)console.warn('${INTEGRATION_HINT}')`
+const LOCAL_INTEGRATION_CHECK_CMD = `node -e "${LOCAL_INTEGRATION_CHECK_SOURCE}"`
+
+function with_local_check(setup_command: string): string {
+	return `${setup_command} && ${LOCAL_INTEGRATION_CHECK_CMD}`
+}
+
+// Upgrade a `preinstall` kit wrote before the check existed, pinned version included; any other
+// value is the consumer's own and is left exactly as it is.
+function migrate_preinstall(value: string): string {
+	if (!LEGACY_PREINSTALL_RE.test(value)) return value
+
+	return with_local_check(value)
+}
+
+const SAFE_CHAIN_CMD = with_local_check(SETUP_CI_CMD)
+
+const safe_chain_preinstall = {
+	SAFE_CHAIN_CMD,
+	LOCAL_INTEGRATION_CHECK_CMD,
+	LOCAL_INTEGRATION_CHECK_SOURCE,
+	INTEGRATION_HINT,
+	migrate_preinstall,
+}
+
+export { safe_chain_preinstall }

package/scripts/sync/sync.ts

@@ -135,7 +135,10 @@ function did_migrate_prettierrc(destination_path: string): boolean {
 
 	const existing = readFileSync(legacy_path, 'utf8')
 
-	writeFileSync(destination_path, init_logic.merge_prettier_config(existing))
+	writeFileSync(
+		destination_path,
+		init_logic.merge_prettier_config(existing, path.dirname(destination_path)),
+	)
 	rmSync(legacy_path)
 
 	return true
@@ -143,7 +146,7 @@ function did_migrate_prettierrc(destination_path: string): boolean {
 
 function write_merged_prettier_config(destination_path: string): void {
 	const existing = readFileSync(destination_path, 'utf8')
-	const merged = init_logic.merge_prettier_config(existing)
+	const merged = init_logic.merge_prettier_config(existing, path.dirname(destination_path))
 
 	if (merged === existing) {
 		console.info('  ✔ unchanged prettier.config.js')

package/scripts/test/pilot-files.ts

@@ -212,7 +212,6 @@ const PILOT_FILES: ReadonlyArray<string> = [
 	'scripts/init/init-logic-migrate.test.ts',
 	'scripts/init/init-logic-secretlint.test.ts',
 	'scripts/init/init-logic-sonar.test.ts',
-	'scripts/init/init-logic-templates.test.ts',
 	'scripts/init/init-logic-workspace.test.ts',
 	'scripts/init/init-logic.cspell.test.ts',
 	'scripts/init/init-logic.merge.test.ts',

package/scripts/version/preinstall-version-update.ts

@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync } from 'node:fs'
+import { ci_installer_pin } from '#scripts/safe-chain/ci-installer-pin'
 import { execaSync } from 'execa'
 
 const SAFE_CHAIN_PKG = '@aikidosec/safe-chain'
@@ -72,6 +73,7 @@ function sync(package_json_path: string): void {
 	}
 
 	write_if_updated(package_json_path, info.content, info.current_version, latest)
+	ci_installer_pin.sync(latest)
 }
 
 const preinstall_version_update = {

package/templates/pnpm-workspace.static.yaml

@@ -0,0 +1,4 @@
+# Written by `josh init` for a static project (joshuafolkken/kit#2693). kit's CLI runs on tsx, which
+# depends on esbuild, and pnpm fails an install whose dependencies carry an unapproved build script.
+allowBuilds:
+  esbuild: true

package/templates/workflows/ci.yml

@@ -4,9 +4,13 @@ on:
   push:
     branches: [main]
 
+  # No `labeled` / `unlabeled`: a label added right after the pull request opens started a second
+  # run on the same commit, the concurrency block below cancelled one of the two, and a cancelled
+  # run left in the newer check suite blocked the merge (joshuafolkken/kit#2712). The one check that
+  # reads labels runs in `pr-classification.yml` instead.
   pull_request:
     branches: [main]
-    types: [opened, synchronize, reopened, labeled, unlabeled]
+    types: [opened, synchronize, reopened]
 
 # A push run is grouped by the commit it carries, so a later push to the default branch never
 # cancels an earlier one. Without the sha every such push shares one group — `github.ref` is
@@ -25,6 +29,12 @@ concurrency:
 # list (e.g. `chromium firefox webkit`) instead of editing this file, which josh sync overwrites.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
+  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
+  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
+  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
+  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
+  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
+  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
 
 jobs:
   playwright-image:
@@ -179,7 +189,11 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:
@@ -221,10 +235,6 @@ jobs:
       - name: Run unit tests
         run: pnpm josh test:unit
 
-      - name: Check release classification
-        if: github.event_name == 'pull_request'
-        run: pnpm josh pr:classification
-
       - name: Check bundle size
         run: pnpm size-limit
 
@@ -405,7 +415,11 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:

package/tsconfig/base.json

@@ -1,7 +1,10 @@
 {
 	"compilerOptions": {
 		"strict": true,
-		// tsx uses bundler-like resolution; "bundler" is the correct pairing for module:ESNext
+		// tsx uses bundler-like resolution; "bundler" is the correct pairing for module:ESNext.
+		// `module` is stated rather than inherited: TypeScript 5.x defaults it to a value "bundler"
+		// rejects (TS5095), so a consumer pinned below 6 failed its first check (#2725)
+		"module": "ESNext",
 		"moduleResolution": "bundler",
 		"esModuleInterop": true,
 		"forceConsistentCasingInFileNames": true,