@stll/oxlint-config 1.0.1 → 1.1.0

package/dist/toolchain-guard.mjs

@@ -1,15 +1,16 @@
-import { _ as nodeSelectorMatches, a as isPythonDependencyManifest, c as pythonDependencyManifestKind, d as isComposeDefinitionPath, f as isKubernetesDefinitionPath, h as generateCloudSetup, i as isMiseConfigPath, l as toolchainInputKind, m as cloudSetupPath, n as isDependabotGithubActionsPath, o as isShellScript, p as workspaceContains, r as isDockerDefinitionPath, s as javascriptDependencyLockfiles, t as githubAutomationFileKind, u as containerDocumentImages, v as nodeSupportRangeMatches, y as parseCloudSetup } from "./toolchain-inputs.mjs";
+import { C as parseCloudSetup, S as nodeSupportRangeMatches, a as isPythonDependencyManifest, c as pythonDependencyManifestKind, d as isComposeDefinitionPath, f as isKubernetesDefinitionPath, g as hasCloudSessionStartHook, h as cloudSessionStartFix, i as isMiseConfigPath, l as toolchainInputKind, m as cloudClaudeSettingsPath, n as isDependabotGithubActionsPath, o as isShellScript, p as workspaceContains, r as isDockerDefinitionPath, s as javascriptDependencyLockfiles, t as githubAutomationFileKind, u as containerDocumentImages, v as cloudSetupPath, x as nodeSelectorMatches, y as generateCloudSetup } from "./toolchain-inputs.mjs";
+import { t as readGitTrackedOutput } from "./git-tracked-output.mjs";
 import { _ as parseConsumerFixtures, d as consumerPackageClosure, g as discoverConsumerPackages, i as assertConsumerFixtureKind, n as assertConsumerNodeSupport, o as assertConsumerFixtureSelection } from "./toolchain-schema.mjs";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { minVersion, satisfies, valid, validRange } from "semver";
+import { parse as parse$1 } from "smol-toml";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
 import picomatch from "picomatch";
-import { parse as parse$2 } from "smol-toml";
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.0.1";
+const consumerRunnerVersion = "1.1.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -191,7 +192,8 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 				const fixtureManifest = path.posix.join(declaration.fixturePath, "consumer-compat.json");
 				const fixtureSource = files[fixtureManifest];
 				if (fixtureSource === void 0) throw new Error(`consumerChecks fixture configuration must be tracked: ${fixtureManifest}`);
-				const fixtures = parseConsumerFixtures(JSON.parse(fixtureSource));
+				const fixtureConfiguration = JSON.parse(fixtureSource);
+				const fixtures = parseConsumerFixtures(fixtureConfiguration);
 				assertConsumerFixtureSelection({
 					selected: declaration.packages,
 					fixtures
@@ -321,7 +323,7 @@ const workspaceRoots = (files, ecosystem) => {
 			}
 		}
 		try {
-			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse$2(files[file] ?? "");
+			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse$1(files[file] ?? "");
 			if (!record$6(parsed)) continue;
 			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
 			const value = workspaceTable(parsed, ecosystem);
@@ -377,8 +379,8 @@ const workspaceRoots = (files, ecosystem) => {
 			if (includes.some((pattern) => picomatch.isMatch(relative, pattern)) && !excludes.some((pattern) => picomatch.isMatch(relative, pattern.slice(1)))) memberDirectories.add(directory);
 		}
 		for (const directory of memberDirectories) try {
-			const parsed = parse$2(files[path.posix.join(directory, "Cargo.toml")] ?? "");
-			const workspace = parse$2(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
+			const parsed = parse$1(files[path.posix.join(directory, "Cargo.toml")] ?? "");
+			const workspace = parse$1(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
 			const inherited = record$6(workspace) ? workspace["dependencies"] : void 0;
 			const dependencyOwners = [parsed];
 			const targets = parsed["target"];
@@ -435,7 +437,7 @@ const pythonEcosystem = (file, files) => {
 	if (files[path.posix.join(root, "uv.lock")] !== void 0 || files[path.posix.join(root, "uv.toml")] !== void 0) return "uv";
 	const pyproject = files[path.posix.join(root, "pyproject.toml")];
 	if (pyproject !== void 0) try {
-		const tool = parse$2(pyproject)["tool"];
+		const tool = parse$1(pyproject)["tool"];
 		if (record$6(tool) && record$6(tool["uv"])) return "uv";
 	} catch {}
 	return "pip";
@@ -1104,14 +1106,15 @@ const shellCommandSegments = (command, grouping = "boundaries") => {
 	for (const source of sources) {
 		const firstSegment = segments.length;
 		segments.push([]);
-		for (const { kind, value: word } of shellArgumentTokens(shellTokens(source))) if (kind === "boundary") if ([
-			"(",
-			")",
-			"{",
-			"}"
-		].includes(word) && grouping === "tokens") segments.at(-1)?.push(word);
-		else segments.push([]);
-		else segments.at(-1)?.push(word);
+		for (const { kind, value: word } of shellArgumentTokens(shellTokens(source))) if (kind === "boundary") {
+			if ([
+				"(",
+				")",
+				"{",
+				"}"
+			].includes(word) && grouping === "tokens") segments.at(-1)?.push(word);
+			else segments.push([]);
+		} else segments.at(-1)?.push(word);
 		for (const words of segments.slice(firstSegment)) {
 			const body = shellCommandBody(words);
 			if (body === void 0) continue;
@@ -1605,7 +1608,8 @@ const checkPackageFiles = ({ files, policy }) => {
 						if (resolved === specifier) return false;
 						if (qualifier === void 0 || validRange(qualifier) === null) return true;
 						if (typeof specifier !== "string") return false;
-						const release = valid(specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier);
+						const versionSpecifier = specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier;
+						const release = valid(versionSpecifier);
 						return release !== null && satisfies(release, qualifier);
 					}) && typeof resolved === "string" && tsSpecifiers.get(name)?.has(resolved)) add({
 						file,
@@ -2107,7 +2111,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	};
 	const toml = (rule) => {
 		try {
-			return parse$2(text);
+			return parse$1(text);
 		} catch {
 			add({
 				rule,
@@ -2189,7 +2193,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (candidate === file) return parsed;
 			if (!trackedFiles.has(candidate)) return void 0;
 			try {
-				return parse$2(readFile(candidate) ?? "");
+				return parse$1(readFile(candidate) ?? "");
 			} catch {
 				return;
 			}
@@ -2200,28 +2204,30 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (record$1(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
 			const pkg = parsed["package"];
 			const version = record$1(pkg) ? pkg["rust-version"] : void 0;
-			if (version !== void 0) if (!record$1(version)) rustFloor(version);
-			else {
-				let inherited;
-				if (version["workspace"] === true && record$1(pkg)) {
-					const explicit = pkg["workspace"];
-					let directory = path.posix.dirname(file);
-					const explicitPath = typeof explicit === "string" && !explicit.includes("\\") && !explicit.includes(":") && !explicit.includes("${{") && !path.posix.isAbsolute(explicit) ? path.posix.normalize(path.posix.join(directory, explicit)) : void 0;
-					if (explicit === void 0 || explicitPath !== void 0 && explicitPath !== ".." && !explicitPath.startsWith("../")) {
-						if (explicitPath !== void 0) directory = explicitPath;
-						while (true) {
-							const table = readManifest(path.posix.join(directory, "Cargo.toml"))?.["workspace"];
-							if (record$1(table)) {
-								const fields = table["package"];
-								inherited = record$1(fields) ? fields["rust-version"] : void 0;
-								break;
+			if (version !== void 0) {
+				if (!record$1(version)) rustFloor(version);
+				else {
+					let inherited;
+					if (version["workspace"] === true && record$1(pkg)) {
+						const explicit = pkg["workspace"];
+						let directory = path.posix.dirname(file);
+						const explicitPath = typeof explicit === "string" && !explicit.includes("\\") && !explicit.includes(":") && !explicit.includes("${{") && !path.posix.isAbsolute(explicit) ? path.posix.normalize(path.posix.join(directory, explicit)) : void 0;
+						if (explicit === void 0 || explicitPath !== void 0 && explicitPath !== ".." && !explicitPath.startsWith("../")) {
+							if (explicitPath !== void 0) directory = explicitPath;
+							while (true) {
+								const table = readManifest(path.posix.join(directory, "Cargo.toml"))?.["workspace"];
+								if (record$1(table)) {
+									const fields = table["package"];
+									inherited = record$1(fields) ? fields["rust-version"] : void 0;
+									break;
+								}
+								if (explicit !== void 0 || directory === ".") break;
+								directory = path.posix.dirname(directory);
 							}
-							if (explicit !== void 0 || directory === ".") break;
-							directory = path.posix.dirname(directory);
 						}
 					}
+					rustFloor(inherited);
 				}
-				rustFloor(inherited);
 			}
 		}
 	}
@@ -2842,9 +2848,10 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		for (let index = start + 3; index < value.length; index++) {
 			const character = value.at(index);
 			if (quote !== void 0) {
-				if (character === quote) if (quote === "'" && value.at(index + 1) === "'") index++;
-				else quote = void 0;
-				else if (quote === "\"" && character === "\\") index++;
+				if (character === quote) {
+					if (quote === "'" && value.at(index + 1) === "'") index++;
+					else quote = void 0;
+				} else if (quote === "\"" && character === "\\") index++;
 				continue;
 			}
 			if (character === "'" || character === "\"") quote = character;
@@ -3246,15 +3253,7 @@ const parseToolchainConfiguration = (input) => {
 /** Read one tracked configuration snapshot for guards and policy generation. */
 const readToolchainInputs = (root) => {
 	const diagnostics = [];
-	const tracked = execFileSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--stage"
-	], {
-		cwd: root,
-		encoding: "utf8"
-	}).split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
+	const tracked = readGitTrackedOutput(root, "staged").split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
 	const files = {};
 	const trackedFiles = new Set(tracked);
 	const resolvedRoot = realpathSync(root);
@@ -3346,26 +3345,36 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		line: 1,
 		message: "cloud setup script requires an explicit cloud declaration in stll-toolchain.json"
 	});
-	if (cloud !== void 0) try {
-		const nodeVersion = files[".node-version"];
-		if (nodeVersion === void 0) throw new Error("cloud setup requires a tracked root .node-version with an exact stable release");
-		if (script !== generateCloudSetup({
-			policy,
-			cloud,
-			nodeVersion: nodeVersion.trim()
-		})) diagnostics.push({
+	if (cloud !== void 0) {
+		if (!hasCloudSessionStartHook(files[".claude/settings.json"])) diagnostics.push({
 			rule: "cloud-setup-drift",
-			path: cloudSetupPath,
+			path: cloudClaudeSettingsPath,
 			line: 1,
-			message: "cloud setup script is missing or differs from shared policy; run stll-cloud-setup"
-		});
-	} catch (error) {
-		diagnostics.push({
-			rule: "cloud-setup-drift",
-			path: cloudSetupPath,
-			line: 1,
-			message: error instanceof Error ? error.message : String(error)
+			message: `tracked Claude cloud SessionStart hook is missing, disabled or differs from shared policy; run stll-cloud-setup; if automatic merge is unsafe, ${cloudSessionStartFix}`
 		});
+		try {
+			const nodeVersion = files[".node-version"];
+			if (nodeVersion === void 0) throw new Error("cloud setup requires a tracked root .node-version with an exact stable release");
+			if (script !== generateCloudSetup({
+				policy,
+				cloud,
+				nodeVersion: nodeVersion.trim(),
+				files,
+				rustExceptions: configuration.rustExceptions
+			})) diagnostics.push({
+				rule: "cloud-setup-drift",
+				path: cloudSetupPath,
+				line: 1,
+				message: "cloud setup script is missing or differs from shared policy; run stll-cloud-setup"
+			});
+		} catch (error) {
+			diagnostics.push({
+				rule: "cloud-setup-drift",
+				path: cloudSetupPath,
+				line: 1,
+				message: error instanceof Error ? error.message : String(error)
+			});
+		}
 	}
 	const exercisedFloors = /* @__PURE__ */ new Set();
 	const mismatchedFloors = /* @__PURE__ */ new Set();