@stll/oxlint-config 1.6.2 → 1.8.0

package/dist/toolchain-inputs.cjs

@@ -1147,6 +1147,8 @@ NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
 BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
 export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
+DEPENDENCY_STATE_ROOT=/var/lib/stll-cloud
+DEPENDENCY_STAMP="$DEPENDENCY_STATE_ROOT/dependencies-$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1).sha256"
 @ENV_ASSIGNMENTS@
 [[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
@@ -1189,16 +1191,18 @@ verify_bun_routes() {
   [[ -n "$minimal_path" ]] || minimal_path=/usr/local/bin:/usr/bin:/bin
   root_mise="$(printenv STLL_CLOUD_TEST_ROOT_MISE || true)"
   [[ -n "$root_mise" ]] || root_mise=/root/.local/share/mise
-  bun_route 'the setup PATH' env PATH="$PATH" sh
-  bun_route 'sh -c' sh
+  # An absolute shell: a PATH entry such as a user-writable mise shims
+  # directory must never supply the program that root runs.
+  bun_route 'the setup PATH' env PATH="$PATH" /bin/sh
+  bun_route 'sh -c' /bin/sh
   bun_route 'bash -lc' "$login_shell" -l
-  bun_route 'the minimal system PATH' env -i PATH="$minimal_path" sh
+  bun_route 'the minimal system PATH' env -i PATH="$minimal_path" /bin/sh
   configured_mise="$(printenv MISE_DATA_DIR || true)"
   for mise_root in "$configured_mise" "$OUTPUT_HOME/.local/share/mise" "$root_mise"; do
     [[ -n "$mise_root" ]] || continue
     shims="$mise_root/shims"
     [[ -d "$shims" ]] || continue
-    bun_route "mise shims PATH $shims" env PATH="$shims:$PATH" sh
+    bun_route "mise shims PATH $shims" env PATH="$shims:$PATH" /bin/sh
   done
 }
 replace_image_buns() {
@@ -1225,7 +1229,8 @@ replace_image_buns() {
       [[ -d "$candidate" ]] && continue
       [[ "$(readlink -f -- "$candidate")" == "$(readlink -f -- "$BUN_DIR/bun")" ]] || ln -sfnT -- "$BUN_DIR/bun" "$candidate"
     done
-  done < <(printf '%s' "$PATH" | tr : '\n')
+  # The trailing newline lets read return the last PATH entry too.
+  done < <(printf '%s\n' "$PATH" | tr : '\n')
 }
 install_runtimes() (
   if [[ ! -s /etc/ssl/certs/ca-certificates.crt ]]; then
@@ -1265,7 +1270,6 @@ install_runtimes() (
   ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
   ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
   replace_image_buns
-  verify_bun_routes
 )
 
 dependency_install() {
@@ -1304,6 +1308,48 @@ process.stdout.write([...hosts].sort().join(","));
   network_run "$download_hosts" 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" BUN_CONFIG_HTTP_IDLE_TIMEOUT=20 "$BUN_DIR/bun" @INSTALL_ARGS@
 }
 
+dependency_hash() {
+  [[ -f bun.lock && ! -L bun.lock ]] || fail 'A regular root bun.lock is required'
+  sha256sum -- bun.lock | cut -d ' ' -f1
+}
+prepare_dependency_state() {
+  [[ ! -L "$DEPENDENCY_STATE_ROOT" ]] || fail 'Dependency state root must not be a symlink'
+  if [[ -e "$DEPENDENCY_STATE_ROOT" ]]; then
+    [[ -d "$DEPENDENCY_STATE_ROOT" && "$(stat -c '%u:%a' "$DEPENDENCY_STATE_ROOT")" == 0:755 ]] || fail 'Invalid dependency state root'
+  else
+    install -d -m 755 -o root -g root "$DEPENDENCY_STATE_ROOT"
+  fi
+  [[ ! -L "$DEPENDENCY_STAMP" ]] || fail 'Dependency stamp must not be a symlink'
+  if [[ -e "$DEPENDENCY_STAMP" ]]; then
+    [[ -f "$DEPENDENCY_STAMP" && "$(stat -c '%u:%a' "$DEPENDENCY_STAMP")" == 0:644 ]] || fail 'Invalid dependency stamp'
+  fi
+}
+write_dependency_stamp() {
+  local temporary
+  prepare_dependency_state
+  temporary="$(mktemp "$DEPENDENCY_STATE_ROOT/.dependencies.XXXXXX")"
+  chmod 644 "$temporary"
+  dependency_hash > "$temporary"
+  mv -f -- "$temporary" "$DEPENDENCY_STAMP"
+}
+install_dependencies() {
+  prepare_dependency_state
+  rm -f -- "$DEPENDENCY_STAMP"
+  dependency_install
+  write_dependency_stamp
+}
+sync_dependencies() {
+  local expected installed=''
+  prepare_dependency_state
+  expected="$(dependency_hash)"
+  if [[ -f "$DEPENDENCY_STAMP" ]]; then IFS= read -r installed < "$DEPENDENCY_STAMP" || true; fi
+  # The stamp describes an installation; without node_modules there is none.
+  [[ "$installed" == "$expected" && -d "$REPO_ROOT/node_modules" ]] && return
+  rm -f -- "$DEPENDENCY_STAMP"
+  dependency_install || fail 'bun.lock mismatch; dependency installation failed'
+  write_dependency_stamp
+}
+
 @SERVICE_INSTALL@
 @SERVICE_START@
 
@@ -1322,13 +1368,16 @@ if [[ "$MODE" == install ]]; then
   step services install_services
   step tools install_tools
   step shell install_shell_environment
-  step dependencies dependency_install
+  # Login routes read the installed profile, so they are checked after it.
+  step routes verify_bun_routes
+  step dependencies install_dependencies
 @PREPARE_STEP@
   exit 0
 fi
 @ENV_INITIALIZE@
 start_environment() {
   step runtime-check runtime_ready
+  step dependencies sync_dependencies
   step tool-check verify_tools
   step shell install_shell_environment
   step shell-check verify_shell_environment
@@ -1394,6 +1443,39 @@ emit_session_environment() {
 }
 `;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const renderWasmBindgenLockValidation = (version) => `[[ -f 'Cargo.lock' && ! -L 'Cargo.lock' ]] && awk -v expected=${shellQuote(version)} '${String.raw`
+function validate_package() {
+  if (in_package && name == "wasm-bindgen") {
+    count++
+    if (version != expected) mismatch = 1
+  }
+}
+/^\[\[package\]\][[:space:]]*$/ {
+  validate_package()
+  in_package = 1
+  name = ""
+  version = ""
+  next
+}
+/^\[/ {
+  validate_package()
+  in_package = 0
+  next
+}
+in_package && /^[[:space:]]*name[[:space:]]*=/ {
+  name = $0
+  sub(/^[^=]*=[[:space:]]*"/, "", name)
+  sub(/"[[:space:]]*$/, "", name)
+}
+in_package && /^[[:space:]]*version[[:space:]]*=/ {
+  version = $0
+  sub(/^[^=]*=[[:space:]]*"/, "", version)
+  sub(/"[[:space:]]*$/, "", version)
+}
+END {
+  validate_package()
+  exit !(count >= 1 && !mismatch)
+}`}' 'Cargo.lock' || fail 'Cargo.lock wasm-bindgen version changed; regenerate cloud-setup.sh'`;
 const renderPrepare = (prepare, files) => {
 	if (prepare === void 0) return "";
 	const manifest = files["package.json"];
@@ -1432,16 +1514,12 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			bunVersion: policy.bun,
 			rust: toolchains.rust
 		})],
-		["@INPUT_VALIDATION@", [
-			"rust-toolchain.toml",
-			"rust-toolchain",
-			...selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : ["Cargo.lock"]
-		].flatMap((file) => {
+		["@INPUT_VALIDATION@", ["rust-toolchain.toml", "rust-toolchain"].flatMap((file) => {
 			const content = files[file];
 			if (content === void 0) return [`[[ ! -e ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] || fail ${shellQuote(`${file} appeared; regenerate cloud-setup.sh`)}`];
 			const hash = (0, node_crypto.createHash)("sha256").update(content).digest("hex");
 			return [`[[ -f ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] && [[ "$(sha256sum -- ${shellQuote(file)} | cut -d ' ' -f1)" == ${shellQuote(hash)} ]] || fail ${shellQuote(`${file} changed; regenerate cloud-setup.sh`)}`];
-		}).join("\n")],
+		}).concat(selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : [renderWasmBindgenLockValidation(selected.tools["wasm-bindgen-cli"])]).join("\n")],
 		["@BUN@", policy.bun],
 		["@NODE@", exactNode],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
@@ -1492,7 +1570,7 @@ const releasedSessionStartHook = (script) => ({
 fi`
 	}]
 });
-const sessionStartHook = (script) => ({
+const releasedTemporaryFileHook = (script) => ({
 	matcher: "",
 	hooks: [{
 		type: "command",
@@ -1533,6 +1611,52 @@ $cloud_shell_exports"
 fi`
 	}]
 });
+const sessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    cloud_session_exports="$(${script} session)" || cloud_setup_incomplete 'startup failed; run install'
+  else
+    ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+    exit 0
+  fi
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      [ -f "$CLAUDE_ENV_FILE" ] && [ ! -L "$CLAUDE_ENV_FILE" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'
+    fi
+    cloud_env_snapshot="\${CLAUDE_ENV_FILE}.stll-cloud"
+    case "$cloud_env_snapshot" in
+      *"'"*) cloud_setup_incomplete 'session environment path must not contain a single quote; check its path and rerun start' ;;
+    esac
+    if [ -n "$cloud_session_exports" ]; then
+      cloud_session_exports="$cloud_session_exports
+$cloud_shell_exports"
+    else
+      cloud_session_exports="$cloud_shell_exports"
+    fi
+    cloud_env_temporary="$(umask 077; mktemp "\${cloud_env_snapshot}.XXXXXX")" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'
+    printf '%s\\n' "$cloud_session_exports" > "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }
+    mv -f -- "$cloud_env_temporary" "$cloud_env_snapshot" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }
+    cloud_env_source=". '$cloud_env_snapshot'"
+    if [ ! -f "$CLAUDE_ENV_FILE" ] || ! grep -Fqx -- "$cloud_env_source" "$CLAUDE_ENV_FILE"; then
+      printf '\\n%s\\n' "$cloud_env_source" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+    fi
+  fi
+fi`
+	}]
+});
 const currentMainSessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
@@ -1559,7 +1683,8 @@ const cloudSessionStartHook = sessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${clou
 const previousCloudSessionStartHooks = [
 	releasedSessionStartHook(`bash ${cloudSetupPath}`),
 	releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
-	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
+	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
+	releasedTemporaryFileHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
 ];
 const cloudAttribution = {
 	commit: "",
@@ -1837,14 +1962,19 @@ const isDockerDefinitionPath = (file) => {
 	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
 	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
 };
+const isFormatterConfigPath = (file) => {
+	const name = file.split("/").at(-1) ?? "";
+	return /^\.oxfmtrc(?:\.jsonc?)?$/.test(name) || /^oxfmt\.config\.[cm]?[jt]s$/.test(name) || /^\.prettierrc(?:\.[^/]+)?$/.test(name) || /^prettier\.config\.[cm]?[jt]s$/.test(name) || name === ".prettierignore" || /^biome\.jsonc?$/.test(name) || /^\.?dprint\.jsonc?$/.test(name);
+};
+const isLefthookConfigPath = (file) => /^\.?lefthook(?:-local)?\.ya?ml$/.test(file);
 /** Executable shell files may have no suffix; the interpreter is then their discriminator. */
 const isShellScript = (file, text = "") => !excludedInputPath(file) && (/\.(?:sh|bash|zsh)$/.test(file) || /^#![ \t]*(?:\/(?:[^ \t\r\n]+\/)*(?:bash|dash|ksh|zsh|sh)|\/usr\/bin\/env[ \t]+(?:-S[ \t]+)?(?:bash|dash|ksh|zsh|sh))(?=[ \t\r\n]|$)/.test(text));
 /** Lockfiles establish ecosystem presence without reading their dependency graphs. */
 const toolchainInputKind = (file, text = "") => {
-	if (file === "bunfig.toml" || file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
+	if (file === "bunfig.toml" || file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock" || file === ".changeset/config.json" || isLefthookConfigPath(file)) return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
-	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file) || isFormatterConfigPath(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
@@ -1926,12 +2056,24 @@ Object.defineProperty(exports, "isDockerDefinitionPath", {
 		return isDockerDefinitionPath;
 	}
 });
+Object.defineProperty(exports, "isFormatterConfigPath", {
+	enumerable: true,
+	get: function() {
+		return isFormatterConfigPath;
+	}
+});
 Object.defineProperty(exports, "isKubernetesDefinitionPath", {
 	enumerable: true,
 	get: function() {
 		return isKubernetesDefinitionPath;
 	}
 });
+Object.defineProperty(exports, "isLefthookConfigPath", {
+	enumerable: true,
+	get: function() {
+		return isLefthookConfigPath;
+	}
+});
 Object.defineProperty(exports, "isMiseConfigPath", {
 	enumerable: true,
 	get: function() {