@joshuafolkken/kit 1.929.0 → 1.953.0

package/scripts/run/run-tidy-lanes.ts

@@ -0,0 +1,110 @@
+import { git_spawn } from '#scripts/git/git-spawn'
+import { git_stash } from '#scripts/git/git-stash'
+import { lane_close } from '#scripts/lane/lane-close'
+import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
+import { run_hold } from './run-hold'
+import { run_tidy, type Outcome, type Verdict } from './run-tidy'
+
+// The lane half of `josh run:tidy` (joshuafolkken/kit#2701): each lane whose issue merged, read for
+// what would make closing it lose work, then closed with its run record released. A lane whose work
+// tree is already gone is `lane:prune`'s, so it is left to that command.
+
+const CLOSED_KIND = 'closed'
+const INCOMPLETE_REASON = 'the close left files behind'
+const NOT_MERGED_REASON = 'not merged'
+
+type IsMerged = (issue: string) => Promise<boolean>
+
+// Any commit on the lane's branch that no remote-tracking ref reaches — `HEAD --not --remotes` — is
+// work only this tree holds. A branch merged upstream is reached through the default branch even after
+// its own remote branch was deleted, so a merged lane answers zero. A failed read keeps the lane.
+async function has_unpushed(directory: string): Promise<boolean> {
+	try {
+		const count = await git_spawn.read([
+			'-C',
+			directory,
+			'rev-list',
+			'--count',
+			'HEAD',
+			'--not',
+			'--remotes',
+		])
+
+		return count !== '0'
+	} catch {
+		return true
+	}
+}
+
+async function hold_path_of(directory: string): Promise<string> {
+	const git_directory = await git_spawn.read(['-C', directory, 'rev-parse', '--absolute-git-dir'])
+
+	return run_hold.hold_path(git_directory)
+}
+
+// A live record belongs to a run still inside that tree — one finishing its post-merge steps — so the
+// lane waits for the next sweep; an unreadable record is kept for the same reason.
+function is_running(hold_path: string): boolean {
+	const read = run_hold.read_hold(hold_path)
+
+	return read.kind === 'held' || read.kind === 'unreadable'
+}
+
+// Asked only of a lane already read as merged, so the rule's "not merged" answer cannot come back.
+async function lane_verdict(lane: LaneInfo, hold_path: string): Promise<Verdict> {
+	const verdict = run_tidy.lane_verdict({
+		issue: lane.issue,
+		is_merged: true,
+		has_changes: await git_stash.has_changes(lane.directory),
+		has_unpushed: await has_unpushed(lane.directory),
+		is_running: is_running(hold_path),
+	})
+
+	return verdict ?? run_tidy.keep(NOT_MERGED_REASON)
+}
+
+async function close(issue: string, hold_path: string): Promise<Verdict> {
+	const outcome = await lane_close.close_lane(issue)
+
+	if (outcome.kind !== CLOSED_KIND) return run_tidy.keep(INCOMPLETE_REASON)
+
+	run_hold.release_hold(hold_path)
+
+	return run_tidy.CLEAN
+}
+
+async function settle(lane: LaneInfo): Promise<Verdict> {
+	try {
+		const hold_path = await hold_path_of(lane.directory)
+		const verdict = await lane_verdict(lane, hold_path)
+
+		return verdict.kind === 'clean' ? await close(lane.issue, hold_path) : verdict
+	} catch (error) {
+		return run_tidy.keep(String(error))
+	}
+}
+
+async function tidy_lane(lane: LaneInfo, is_merged: IsMerged): Promise<Outcome | undefined> {
+	if (lane.is_stranded || !(await is_merged(lane.issue))) return undefined
+
+	return { target: `lane #${lane.issue}`, verdict: await settle(lane) }
+}
+
+// One lane at a time: a close removes a work tree and prunes the worktree list the next read uses.
+async function tidy_lanes(is_merged: IsMerged): Promise<Array<Outcome>> {
+	const outcomes: Array<Outcome> = []
+	const lanes = await lane_registry.list_lanes()
+
+	for (const lane of lanes) {
+		const outcome = await tidy_lane(lane, is_merged)
+
+		if (outcome !== undefined) outcomes.push(outcome)
+	}
+
+	return outcomes
+}
+
+const run_tidy_lanes = { has_unpushed, tidy_lanes }
+
+export type { IsMerged }
+export { run_tidy_lanes }

package/scripts/run/run-tidy-stashes.ts

@@ -0,0 +1,160 @@
+import { readFile } from 'node:fs/promises'
+import { git_stash, type StashEntry } from '#scripts/git/git-stash'
+import { stash_orphans } from '#scripts/git/stash-orphans'
+import { stash_sweep_lock } from '#scripts/git/stash-sweep-lock'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { observation_ledger } from '#scripts/observations/observation-ledger'
+import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
+import { run_tidy, type Outcome, type Verdict } from './run-tidy'
+import type { IsMerged } from './run-tidy-lanes'
+
+// The stash half of `josh run:tidy` (joshuafolkken/kit#2701): each entry whose named issues are all
+// merged is dropped, and one that touches the observation ledger has its lines carried into the ledger
+// first. The ledger is append-only and the digest counts repeats across it, so an entry's lines are
+// never discarded with the entry.
+
+// The same width `run-carry-stash.ts` reads issue states at.
+const READ_CONCURRENCY = 8
+const GONE_REASON = 'already dropped by another run'
+const BUSY_REASON = 'another run held the stash sweep lock'
+
+async function read_ledger(ledger_path: string): Promise<string> {
+	try {
+		return await readFile(ledger_path, 'utf8')
+	} catch {
+		return ''
+	}
+}
+
+// An entry cut before joshuafolkken/kit#2724 holds its lines at the ledger's old path, so the lines of
+// every ledger path it touches are carried to the current ledger.
+async function added_ledger_lines(
+	hash: string,
+	ledger_paths: ReadonlyArray<string>,
+): Promise<Array<string>> {
+	const added: Array<string> = []
+
+	for (const ledger_path of ledger_paths) {
+		const lines = await git_stash.added_lines(hash, ledger_path)
+
+		added.push(...lines)
+	}
+
+	return added
+}
+
+// How many ledger lines went into the primary checkout's ledger before the drop.
+async function carry_ledger(hash: string): Promise<number> {
+	const changed = await git_stash.changed_paths(hash)
+	const ledger_paths = changed.filter((file_path) => observation_ledger.is_ledger_path(file_path))
+
+	if (ledger_paths.length === 0) return 0
+
+	const ledger_path = observation_ledger_home.ledger_path()
+	const added = await added_ledger_lines(hash, ledger_paths)
+	const carried = run_tidy.ledger_carry(added, await read_ledger(ledger_path))
+
+	await observation_ledger_home.append(ledger_path, carried)
+
+	return carried.length
+}
+
+function carried_note(count: number): string {
+	return count === 0 ? '' : ` (${String(count)} observation line(s) carried to the ledger)`
+}
+
+async function drop(entry: StashEntry): Promise<Outcome> {
+	const carried = await carry_ledger(entry.selector)
+	const target = `stash "${entry.subject}"${carried_note(carried)}`
+	const is_dropped = await git_stash.drop_by_hash(entry.selector)
+
+	return { target, verdict: is_dropped ? run_tidy.CLEAN : run_tidy.keep(GONE_REASON) }
+}
+
+async function merged_set(
+	issues: ReadonlyArray<string>,
+	is_merged: IsMerged,
+): Promise<Set<string>> {
+	const answers = await bounded_pool.bounded_map(
+		issues,
+		READ_CONCURRENCY,
+		async (issue) => await is_merged(issue),
+	)
+
+	return new Set(issues.filter((_issue, index) => answers[index] === true))
+}
+
+function entry_verdict(entry: StashEntry, merged: ReadonlySet<string>): Verdict | undefined {
+	const issues = stash_orphans.issues_named(entry.subject)
+
+	return run_tidy.stash_verdict({ subject: entry.subject, issues }, merged)
+}
+
+async function tidy_entry(
+	entry: StashEntry,
+	merged: ReadonlySet<string>,
+): Promise<Outcome | undefined> {
+	const verdict = entry_verdict(entry, merged)
+
+	if (verdict === undefined) return undefined
+
+	if (verdict.kind === 'keep') return { target: `stash "${entry.subject}"`, verdict }
+
+	try {
+		return await drop(entry)
+	} catch (error) {
+		return { target: `stash "${entry.subject}"`, verdict: run_tidy.keep(String(error)) }
+	}
+}
+
+async function tidy_entries(
+	entries: ReadonlyArray<StashEntry>,
+	merged: ReadonlySet<string>,
+): Promise<Array<Outcome>> {
+	const outcomes: Array<Outcome> = []
+
+	for (const entry of entries) {
+		const outcome = await tidy_entry(entry, merged)
+
+		if (outcome !== undefined) outcomes.push(outcome)
+	}
+
+	return outcomes
+}
+
+// The report a sweep that never got the lock gives: every entry it would have dropped is kept.
+function busy_outcome(entry: StashEntry, merged: ReadonlySet<string>): Outcome | undefined {
+	const verdict = entry_verdict(entry, merged)
+
+	if (verdict === undefined) return undefined
+
+	return {
+		target: `stash "${entry.subject}"`,
+		verdict: verdict.kind === 'keep' ? verdict : run_tidy.keep(BUSY_REASON),
+	}
+}
+
+function busy_outcomes(
+	entries: ReadonlyArray<StashEntry>,
+	merged: ReadonlySet<string>,
+): Array<Outcome> {
+	return entries
+		.map((entry) => busy_outcome(entry, merged))
+		.filter((outcome): outcome is Outcome => outcome !== undefined)
+}
+
+// Sequential drops under the repository-wide sweep lock: each resolves its position from its hash just
+// before it goes, which holds only while no other sweep is shifting the stack or appending the same
+// ledger lines. The GitHub reads stay outside the lock — they are the slow part and mutate nothing.
+async function tidy_stashes(is_merged: IsMerged): Promise<Array<Outcome>> {
+	const entries = await git_stash.list_by_hash()
+	const issues = [...new Set(entries.flatMap((entry) => stash_orphans.issues_named(entry.subject)))]
+	const merged = await merged_set(issues, is_merged)
+	const outcomes = await stash_sweep_lock.with_lock(async () => await tidy_entries(entries, merged))
+
+	return outcomes ?? busy_outcomes(entries, merged)
+}
+
+const run_tidy_stashes = { tidy_stashes }
+
+export { run_tidy_stashes }

package/scripts/run/run-tidy.ts

@@ -0,0 +1,101 @@
+import { observation_ledger_line } from '#scripts/observations/observation-ledger-line'
+
+// The decisions behind `josh run:tidy` (joshuafolkken/kit#2701), kept apart from the git and GitHub
+// reads so each can be pinned without either. A run start sweeps what merged work left behind — the
+// lanes holding a seat after their branch merged, and the stashes of issues that are all merged — and
+// every rule here is written so that doubt keeps the thing: a lane with any uncommitted change or any
+// commit no remote has, and a stash naming any issue that is not merged or naming none at all, stay.
+
+const LINE_SEPARATOR = '\n'
+const CLEANED_HEADER = 'run:tidy — cleaned:'
+const KEPT_HEADER = 'run:tidy — kept:'
+const CHANGES_REASON = 'uncommitted changes'
+const UNPUSHED_REASON = 'commits no remote has'
+const RUNNING_REASON = 'held by a live run'
+
+interface LaneFacts {
+	issue: string
+	is_merged: boolean
+	has_changes: boolean
+	has_unpushed: boolean
+	is_running: boolean
+}
+
+interface StashFacts {
+	subject: string
+	issues: ReadonlyArray<string>
+}
+
+type Verdict = { kind: 'clean' } | { kind: 'keep'; reason: string }
+
+interface Outcome {
+	target: string
+	verdict: Verdict
+}
+
+const CLEAN: Verdict = { kind: 'clean' }
+
+function keep(reason: string): Verdict {
+	return { kind: 'keep', reason }
+}
+
+// A lane whose issue is still open is some run's, so it is left out of the report entirely rather than
+// listed as kept — the report names what merged work left behind, not every lane.
+function lane_verdict(facts: LaneFacts): Verdict | undefined {
+	if (!facts.is_merged) return undefined
+
+	if (facts.has_changes) return keep(CHANGES_REASON)
+
+	if (facts.has_unpushed) return keep(UNPUSHED_REASON)
+
+	return facts.is_running ? keep(RUNNING_REASON) : CLEAN
+}
+
+function unmerged_reason(unmerged: ReadonlyArray<string>): string {
+	const named = unmerged.map((issue) => `#${issue}`).join(', ')
+
+	return `${named} not merged`
+}
+
+// Like a lane, a stash naming no merged issue is left out of the report: one naming no issue at all,
+// or only open ones, is not merged work's residue, and listing it at every run start would bury the
+// entries that are.
+function stash_verdict(facts: StashFacts, merged: ReadonlySet<string>): Verdict | undefined {
+	const unmerged = facts.issues.filter((issue) => !merged.has(issue))
+
+	if (unmerged.length === facts.issues.length) return undefined
+
+	return unmerged.length === 0 ? CLEAN : keep(unmerged_reason(unmerged))
+}
+
+// The ledger lines a stash would carry away with it, less those the ledger already holds — the same
+// line appended twice would read as a recurrence to the observation digest, which counts repeats.
+function ledger_carry(added: ReadonlyArray<string>, ledger: string): Array<string> {
+	const entries = added.filter((line) => observation_ledger_line.is_ledger_entry_line(line))
+
+	return observation_ledger_line.missing_lines([...new Set(entries)], ledger)
+}
+
+function format_outcome(outcome: Outcome): string {
+	const suffix = outcome.verdict.kind === 'keep' ? ` — ${outcome.verdict.reason}` : ''
+
+	return `  ${outcome.target}${suffix}`
+}
+
+function section(header: string, outcomes: ReadonlyArray<Outcome>): Array<string> {
+	return outcomes.length === 0 ? [] : [header, ...outcomes.map((item) => format_outcome(item))]
+}
+
+// `undefined` when the sweep found nothing merged, so an ordinary run start prints nothing.
+function format_report(outcomes: ReadonlyArray<Outcome>): string | undefined {
+	const cleaned = outcomes.filter((outcome) => outcome.verdict.kind === 'clean')
+	const kept = outcomes.filter((outcome) => outcome.verdict.kind === 'keep')
+	const lines = [...section(CLEANED_HEADER, cleaned), ...section(KEPT_HEADER, kept)]
+
+	return lines.length === 0 ? undefined : lines.join(LINE_SEPARATOR)
+}
+
+const run_tidy = { CLEAN, format_report, keep, lane_verdict, ledger_carry, stash_verdict }
+
+export type { LaneFacts, Outcome, StashFacts, Verdict }
+export { run_tidy }

package/scripts/safe-chain/ci-installer-pin.ts

@@ -0,0 +1,90 @@
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { execaSync } from 'execa'
+
+// The workflows that install safe-chain on the runner. Both carry the release and the installer's
+// SHA-256 as workflow-level env, so one pin per file moves every "Setup safe-chain" step at once
+// (joshuafolkken/kit#2711). A consumer has only the first, and `josh sync` rewrites it from the
+// template, so moving it anywhere but kit is harmless and short-lived.
+const WORKFLOW_PATHS = ['.github/workflows/ci.yml', 'templates/workflows/ci.yml']
+// `[ \t]` rather than `\s`: under the `m` flag `\s*` would run across line ends and swallow the
+// blank line that follows the env block.
+const VERSION_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_VERSION:[ \t]*)(?<value>\S+)[ \t]*$/mu
+const SHA256_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_SHA256:[ \t]*)(?<value>\S+)[ \t]*$/mu
+const VALUE_GROUP = 'value'
+const DOWNLOAD_TIMEOUT_MS = 30_000
+
+interface InstallerPin {
+	version: string
+	sha256: string
+}
+
+function installer_url(version: string): string {
+	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
+}
+
+function extract_pinned_version(content: string): string | undefined {
+	return VERSION_RE.exec(content)?.groups?.[VALUE_GROUP]
+}
+
+function rewrite_pin(content: string, pin: InstallerPin): string {
+	return content
+		.replace(VERSION_RE, (_match, key: string) => `${key}${pin.version}`)
+		.replace(SHA256_RE, (_match, key: string) => `${key}${pin.sha256}`)
+}
+
+function fetch_installer_sha256(version: string): string | undefined {
+	// `--proto =https` keeps the release redirect from being followed onto plain HTTP.
+	const result = execaSync('curl', ['--proto', '=https', '-fsSL', installer_url(version)], {
+		encoding: 'buffer',
+		// The hash is of the file as published; execa would otherwise drop its trailing newline.
+		stripFinalNewline: false,
+		reject: false,
+		timeout: DOWNLOAD_TIMEOUT_MS,
+	})
+	if (result.exitCode !== 0 || result.stdout.length === 0) return undefined
+
+	return createHash('sha256').update(result.stdout).digest('hex')
+}
+
+// The workflows whose pin lags `latest` — a missing file or one without the pin is not a target.
+function stale_workflows(latest: string, workflow_paths: ReadonlyArray<string>): Array<string> {
+	return workflow_paths.filter((workflow_path) => {
+		if (!existsSync(workflow_path)) return false
+		const current = extract_pinned_version(readFileSync(workflow_path, 'utf8'))
+
+		return current !== undefined && current !== latest
+	})
+}
+
+function write_pin(workflow_path: string, pin: InstallerPin): void {
+	console.info(`\n↑ Updating safe-chain installer in ${workflow_path} → ${pin.version}`)
+	writeFileSync(workflow_path, rewrite_pin(readFileSync(workflow_path, 'utf8'), pin), 'utf8')
+}
+
+function sync(latest: string, workflow_paths: ReadonlyArray<string> = WORKFLOW_PATHS): void {
+	const targets = stale_workflows(latest, workflow_paths)
+	if (targets.length === 0) return
+
+	const sha256 = fetch_installer_sha256(latest)
+
+	if (sha256 === undefined) {
+		console.warn(`\n⚠ Could not download the safe-chain ${latest} installer; CI pin left as is`)
+
+		return
+	}
+
+	for (const workflow_path of targets) write_pin(workflow_path, { version: latest, sha256 })
+}
+
+const ci_installer_pin = {
+	WORKFLOW_PATHS,
+	installer_url,
+	extract_pinned_version,
+	rewrite_pin,
+	fetch_installer_sha256,
+	sync,
+}
+
+export { ci_installer_pin }
+export type { InstallerPin }

package/scripts/safe-chain/preinstall-command.ts

@@ -0,0 +1,39 @@
+// `setup-ci` only writes shims and adds them to PATH on a CI runner, so a local `pnpm install` is
+// scanned only when the developer has enabled safe-chain's own shell integration. That integration
+// runs pnpm behind safe-chain's registry proxy and hands `GLOBAL_AGENT_HTTP_PROXY` to it, which a bare
+// pnpm never sets — the one signal a lifecycle script can read (joshuafolkken/kit#2707).
+const SETUP_CI_CMD = 'pnpm dlx @aikidosec/safe-chain setup-ci'
+const LEGACY_PREINSTALL_RE = /^pnpm dlx @aikidosec\/safe-chain(?:@\S+)? setup-ci$/u
+const INTEGRATION_HINT =
+	'Warning: safe-chain is not scanning this install because its shell integration is not active.' +
+	' Install safe-chain (https://github.com/AikidoSec/safe-chain#installation) or run: safe-chain setup' +
+	' - then restart your terminal.'
+// `preinstall` runs before any dependency is installed, kit included, so the check is plain Node with
+// no imports. It never fails the install and stays silent on CI, where the runner is set up instead.
+// The source avoids double quotes, `$` and backticks so the shell passes it to Node verbatim.
+const LOCAL_INTEGRATION_CHECK_SOURCE = `if(!process.env.CI&&!process.env.GLOBAL_AGENT_HTTP_PROXY)console.warn('${INTEGRATION_HINT}')`
+const LOCAL_INTEGRATION_CHECK_CMD = `node -e "${LOCAL_INTEGRATION_CHECK_SOURCE}"`
+
+function with_local_check(setup_command: string): string {
+	return `${setup_command} && ${LOCAL_INTEGRATION_CHECK_CMD}`
+}
+
+// Upgrade a `preinstall` kit wrote before the check existed, pinned version included; any other
+// value is the consumer's own and is left exactly as it is.
+function migrate_preinstall(value: string): string {
+	if (!LEGACY_PREINSTALL_RE.test(value)) return value
+
+	return with_local_check(value)
+}
+
+const SAFE_CHAIN_CMD = with_local_check(SETUP_CI_CMD)
+
+const safe_chain_preinstall = {
+	SAFE_CHAIN_CMD,
+	LOCAL_INTEGRATION_CHECK_CMD,
+	LOCAL_INTEGRATION_CHECK_SOURCE,
+	INTEGRATION_HINT,
+	migrate_preinstall,
+}
+
+export { safe_chain_preinstall }

package/scripts/safe-chain/project-config.ts

@@ -1,12 +1,16 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
+import { release_age } from '#scripts/version/release-age'
 import { yaml_document } from '#scripts/yaml/yaml-document'
 import { dump } from 'js-yaml'
 import { z } from 'zod'
 
 const WORKSPACE_FILE = 'pnpm-workspace.yaml'
 const PROJECT_CONFIG_FILE = '.aikido'
+const NPMRC_FILE = '.npmrc'
 const EXCLUSIONS_FIELD = 'minimumPackageAgeExclusions'
+const AGE_FIELD = 'minimumPackageAgeHours'
+const MINUTES_PER_HOUR = 60
 const workspace_schema = z.object({ minimumReleaseAgeExclude: z.array(z.string()).optional() })
 
 function read_mapping(value: unknown, label: string): Record<string, unknown> {
@@ -72,27 +76,68 @@ function replace_safe_chain_block(existing: string, safe_chain: Record<string, u
 	return `${prefix}${prefix ? '\n' : ''}${replacement}${suffix}`
 }
 
-function merge_project_config(existing: string, workspace: string): string {
-	const source = workspace_schema.parse(yaml_document.parse_yaml(workspace))
-	const exclusions = source.minimumReleaseAgeExclude ?? []
-	const aikido = yaml_document.parse_yaml(existing)
-	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
+// Safe Chain enforces its own minimum package age (48 hours by default), so CI refused lockfiles pnpm
+// had resolved under `.npmrc`'s shorter window (kit #2743). `.npmrc` is the source: its minutes are
+// floored to whole hours so Safe Chain is never stricter than pnpm, and an undeclared window writes
+// nothing; an explicit `0` opt-out is written as 0 so an earlier synchronized age cannot outlive it.
+function package_age_hours(npmrc: string): number | undefined {
+	const minutes = release_age.parse_declared_minimum_release_age(npmrc)
+	if (minutes === undefined) return undefined
+
+	return Math.floor(minutes / MINUTES_PER_HOUR)
+}
+
+function merge_age(safe_chain: Record<string, unknown>, npmrc: string): Record<string, unknown> {
+	const hours = package_age_hours(npmrc)
+	if (hours === undefined) return safe_chain
+
+	return { ...safe_chain, [AGE_FIELD]: hours }
+}
+
+function merge_exclusions(
+	safe_chain: Record<string, unknown>,
+	exclusions: ReadonlyArray<string>,
+): Record<string, unknown> {
 	const npm = read_mapping(safe_chain['npm'], 'safe-chain.npm')
-	if (JSON.stringify(npm[EXCLUSIONS_FIELD]) === JSON.stringify(exclusions)) return existing
-	if (exclusions.length === 0 && existing.length === 0) return existing
 
-	const merged = { ...safe_chain, npm: { ...npm, [EXCLUSIONS_FIELD]: exclusions } }
+	return { ...safe_chain, npm: { ...npm, [EXCLUSIONS_FIELD]: exclusions } }
+}
+
+function has_nothing_to_write(
+	existing: string,
+	exclusions: ReadonlyArray<string>,
+	npmrc: string,
+): boolean {
+	return existing.length === 0 && exclusions.length === 0 && package_age_hours(npmrc) === undefined
+}
+
+function read_exclusions(workspace: string): ReadonlyArray<string> {
+	return workspace_schema.parse(yaml_document.parse_yaml(workspace)).minimumReleaseAgeExclude ?? []
+}
+
+function merge_project_config(existing: string, workspace: string, npmrc = ''): string {
+	const exclusions = read_exclusions(workspace)
+	const aikido = yaml_document.parse_yaml(existing)
+	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
+	const merged = merge_age(merge_exclusions(safe_chain, exclusions), npmrc)
+	if (JSON.stringify(merged) === JSON.stringify(safe_chain)) return existing
+	if (has_nothing_to_write(existing, exclusions, npmrc)) return existing
 
 	return replace_safe_chain_block(existing, merged)
 }
 
+function read_optional(file_path: string): string {
+	return existsSync(file_path) ? readFileSync(file_path, 'utf8') : ''
+}
+
 function sync_project_config(root: string): boolean {
 	const workspace_path = path.join(root, WORKSPACE_FILE)
 	if (!existsSync(workspace_path)) return false
 	const config_path = path.join(root, PROJECT_CONFIG_FILE)
-	const existing = existsSync(config_path) ? readFileSync(config_path, 'utf8') : ''
+	const existing = read_optional(config_path)
 	const workspace = readFileSync(workspace_path, 'utf8')
-	const merged = merge_project_config(existing, workspace)
+	const npmrc = read_optional(path.join(root, NPMRC_FILE))
+	const merged = merge_project_config(existing, workspace, npmrc)
 	if (merged === existing) return false
 	writeFileSync(config_path, merged)
 

package/scripts/sync/sync.ts

@@ -135,7 +135,10 @@ function did_migrate_prettierrc(destination_path: string): boolean {
 
 	const existing = readFileSync(legacy_path, 'utf8')
 
-	writeFileSync(destination_path, init_logic.merge_prettier_config(existing))
+	writeFileSync(
+		destination_path,
+		init_logic.merge_prettier_config(existing, path.dirname(destination_path)),
+	)
 	rmSync(legacy_path)
 
 	return true
@@ -143,7 +146,7 @@ function did_migrate_prettierrc(destination_path: string): boolean {
 
 function write_merged_prettier_config(destination_path: string): void {
 	const existing = readFileSync(destination_path, 'utf8')
-	const merged = init_logic.merge_prettier_config(existing)
+	const merged = init_logic.merge_prettier_config(existing, path.dirname(destination_path))
 
 	if (merged === existing) {
 		console.info('  ✔ unchanged prettier.config.js')
@@ -368,7 +371,6 @@ function report_repository_settings(name_with_owner: string | undefined): void {
 
 function sync_project_artifacts(is_force: boolean): void {
 	sync_ai_copy_all(is_force)
-	project_config.sync_project_config(PROJECT_ROOT)
 	sync_prettier_config(path.join(PROJECT_ROOT, 'prettier.config.js'))
 	sync_playwright_config(path.join(PROJECT_ROOT, 'playwright.config.ts'))
 	sync_deploy_vps(path.join(PROJECT_ROOT, '.github/workflows/deploy-vps.yml'))
@@ -379,6 +381,9 @@ function sync_project_artifacts(is_force: boolean): void {
 
 	sync_sonar_with_template(name_with_owner, is_force)
 	sync_config_files()
+	// After `sync_config_files`, which may add the `.npmrc` window `.aikido`'s age is derived from
+	// (joshuafolkken/kit#2743).
+	project_config.sync_project_config(PROJECT_ROOT)
 	sync_package_json_migrations(path.join(PROJECT_ROOT, PACKAGE_JSON))
 	report_repository_settings(name_with_owner)
 }

package/scripts/test/pilot-files.ts

@@ -212,7 +212,6 @@ const PILOT_FILES: ReadonlyArray<string> = [
 	'scripts/init/init-logic-migrate.test.ts',
 	'scripts/init/init-logic-secretlint.test.ts',
 	'scripts/init/init-logic-sonar.test.ts',
-	'scripts/init/init-logic-templates.test.ts',
 	'scripts/init/init-logic-workspace.test.ts',
 	'scripts/init/init-logic.cspell.test.ts',
 	'scripts/init/init-logic.merge.test.ts',

package/scripts/version/preinstall-version-update.ts

@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync } from 'node:fs'
+import { ci_installer_pin } from '#scripts/safe-chain/ci-installer-pin'
 import { execaSync } from 'execa'
 
 const SAFE_CHAIN_PKG = '@aikidosec/safe-chain'
@@ -72,6 +73,7 @@ function sync(package_json_path: string): void {
 	}
 
 	write_if_updated(package_json_path, info.content, info.current_version, latest)
+	ci_installer_pin.sync(latest)
 }
 
 const preinstall_version_update = {