@stll/oxlint-config 1.6.2 → 1.8.0

package/dist/toolchain-inputs.mjs

@@ -1144,6 +1144,8 @@ NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
 BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
 export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
+DEPENDENCY_STATE_ROOT=/var/lib/stll-cloud
+DEPENDENCY_STAMP="$DEPENDENCY_STATE_ROOT/dependencies-$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1).sha256"
 @ENV_ASSIGNMENTS@
 [[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
@@ -1186,16 +1188,18 @@ verify_bun_routes() {
   [[ -n "$minimal_path" ]] || minimal_path=/usr/local/bin:/usr/bin:/bin
   root_mise="$(printenv STLL_CLOUD_TEST_ROOT_MISE || true)"
   [[ -n "$root_mise" ]] || root_mise=/root/.local/share/mise
-  bun_route 'the setup PATH' env PATH="$PATH" sh
-  bun_route 'sh -c' sh
+  # An absolute shell: a PATH entry such as a user-writable mise shims
+  # directory must never supply the program that root runs.
+  bun_route 'the setup PATH' env PATH="$PATH" /bin/sh
+  bun_route 'sh -c' /bin/sh
   bun_route 'bash -lc' "$login_shell" -l
-  bun_route 'the minimal system PATH' env -i PATH="$minimal_path" sh
+  bun_route 'the minimal system PATH' env -i PATH="$minimal_path" /bin/sh
   configured_mise="$(printenv MISE_DATA_DIR || true)"
   for mise_root in "$configured_mise" "$OUTPUT_HOME/.local/share/mise" "$root_mise"; do
     [[ -n "$mise_root" ]] || continue
     shims="$mise_root/shims"
     [[ -d "$shims" ]] || continue
-    bun_route "mise shims PATH $shims" env PATH="$shims:$PATH" sh
+    bun_route "mise shims PATH $shims" env PATH="$shims:$PATH" /bin/sh
   done
 }
 replace_image_buns() {
@@ -1222,7 +1226,8 @@ replace_image_buns() {
       [[ -d "$candidate" ]] && continue
       [[ "$(readlink -f -- "$candidate")" == "$(readlink -f -- "$BUN_DIR/bun")" ]] || ln -sfnT -- "$BUN_DIR/bun" "$candidate"
     done
-  done < <(printf '%s' "$PATH" | tr : '\n')
+  # The trailing newline lets read return the last PATH entry too.
+  done < <(printf '%s\n' "$PATH" | tr : '\n')
 }
 install_runtimes() (
   if [[ ! -s /etc/ssl/certs/ca-certificates.crt ]]; then
@@ -1262,7 +1267,6 @@ install_runtimes() (
   ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
   ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
   replace_image_buns
-  verify_bun_routes
 )
 
 dependency_install() {
@@ -1301,6 +1305,48 @@ process.stdout.write([...hosts].sort().join(","));
   network_run "$download_hosts" 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" BUN_CONFIG_HTTP_IDLE_TIMEOUT=20 "$BUN_DIR/bun" @INSTALL_ARGS@
 }
 
+dependency_hash() {
+  [[ -f bun.lock && ! -L bun.lock ]] || fail 'A regular root bun.lock is required'
+  sha256sum -- bun.lock | cut -d ' ' -f1
+}
+prepare_dependency_state() {
+  [[ ! -L "$DEPENDENCY_STATE_ROOT" ]] || fail 'Dependency state root must not be a symlink'
+  if [[ -e "$DEPENDENCY_STATE_ROOT" ]]; then
+    [[ -d "$DEPENDENCY_STATE_ROOT" && "$(stat -c '%u:%a' "$DEPENDENCY_STATE_ROOT")" == 0:755 ]] || fail 'Invalid dependency state root'
+  else
+    install -d -m 755 -o root -g root "$DEPENDENCY_STATE_ROOT"
+  fi
+  [[ ! -L "$DEPENDENCY_STAMP" ]] || fail 'Dependency stamp must not be a symlink'
+  if [[ -e "$DEPENDENCY_STAMP" ]]; then
+    [[ -f "$DEPENDENCY_STAMP" && "$(stat -c '%u:%a' "$DEPENDENCY_STAMP")" == 0:644 ]] || fail 'Invalid dependency stamp'
+  fi
+}
+write_dependency_stamp() {
+  local temporary
+  prepare_dependency_state
+  temporary="$(mktemp "$DEPENDENCY_STATE_ROOT/.dependencies.XXXXXX")"
+  chmod 644 "$temporary"
+  dependency_hash > "$temporary"
+  mv -f -- "$temporary" "$DEPENDENCY_STAMP"
+}
+install_dependencies() {
+  prepare_dependency_state
+  rm -f -- "$DEPENDENCY_STAMP"
+  dependency_install
+  write_dependency_stamp
+}
+sync_dependencies() {
+  local expected installed=''
+  prepare_dependency_state
+  expected="$(dependency_hash)"
+  if [[ -f "$DEPENDENCY_STAMP" ]]; then IFS= read -r installed < "$DEPENDENCY_STAMP" || true; fi
+  # The stamp describes an installation; without node_modules there is none.
+  [[ "$installed" == "$expected" && -d "$REPO_ROOT/node_modules" ]] && return
+  rm -f -- "$DEPENDENCY_STAMP"
+  dependency_install || fail 'bun.lock mismatch; dependency installation failed'
+  write_dependency_stamp
+}
+
 @SERVICE_INSTALL@
 @SERVICE_START@
 
@@ -1319,13 +1365,16 @@ if [[ "$MODE" == install ]]; then
   step services install_services
   step tools install_tools
   step shell install_shell_environment
-  step dependencies dependency_install
+  # Login routes read the installed profile, so they are checked after it.
+  step routes verify_bun_routes
+  step dependencies install_dependencies
 @PREPARE_STEP@
   exit 0
 fi
 @ENV_INITIALIZE@
 start_environment() {
   step runtime-check runtime_ready
+  step dependencies sync_dependencies
   step tool-check verify_tools
   step shell install_shell_environment
   step shell-check verify_shell_environment
@@ -1391,6 +1440,39 @@ emit_session_environment() {
 }
 `;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const renderWasmBindgenLockValidation = (version) => `[[ -f 'Cargo.lock' && ! -L 'Cargo.lock' ]] && awk -v expected=${shellQuote(version)} '${String.raw`
+function validate_package() {
+  if (in_package && name == "wasm-bindgen") {
+    count++
+    if (version != expected) mismatch = 1
+  }
+}
+/^\[\[package\]\][[:space:]]*$/ {
+  validate_package()
+  in_package = 1
+  name = ""
+  version = ""
+  next
+}
+/^\[/ {
+  validate_package()
+  in_package = 0
+  next
+}
+in_package && /^[[:space:]]*name[[:space:]]*=/ {
+  name = $0
+  sub(/^[^=]*=[[:space:]]*"/, "", name)
+  sub(/"[[:space:]]*$/, "", name)
+}
+in_package && /^[[:space:]]*version[[:space:]]*=/ {
+  version = $0
+  sub(/^[^=]*=[[:space:]]*"/, "", version)
+  sub(/"[[:space:]]*$/, "", version)
+}
+END {
+  validate_package()
+  exit !(count >= 1 && !mismatch)
+}`}' 'Cargo.lock' || fail 'Cargo.lock wasm-bindgen version changed; regenerate cloud-setup.sh'`;
 const renderPrepare = (prepare, files) => {
 	if (prepare === void 0) return "";
 	const manifest = files["package.json"];
@@ -1429,16 +1511,12 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			bunVersion: policy.bun,
 			rust: toolchains.rust
 		})],
-		["@INPUT_VALIDATION@", [
-			"rust-toolchain.toml",
-			"rust-toolchain",
-			...selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : ["Cargo.lock"]
-		].flatMap((file) => {
+		["@INPUT_VALIDATION@", ["rust-toolchain.toml", "rust-toolchain"].flatMap((file) => {
 			const content = files[file];
 			if (content === void 0) return [`[[ ! -e ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] || fail ${shellQuote(`${file} appeared; regenerate cloud-setup.sh`)}`];
 			const hash = createHash("sha256").update(content).digest("hex");
 			return [`[[ -f ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] && [[ "$(sha256sum -- ${shellQuote(file)} | cut -d ' ' -f1)" == ${shellQuote(hash)} ]] || fail ${shellQuote(`${file} changed; regenerate cloud-setup.sh`)}`];
-		}).join("\n")],
+		}).concat(selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : [renderWasmBindgenLockValidation(selected.tools["wasm-bindgen-cli"])]).join("\n")],
 		["@BUN@", policy.bun],
 		["@NODE@", exactNode],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
@@ -1489,7 +1567,7 @@ const releasedSessionStartHook = (script) => ({
 fi`
 	}]
 });
-const sessionStartHook = (script) => ({
+const releasedTemporaryFileHook = (script) => ({
 	matcher: "",
 	hooks: [{
 		type: "command",
@@ -1530,6 +1608,52 @@ $cloud_shell_exports"
 fi`
 	}]
 });
+const sessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    cloud_session_exports="$(${script} session)" || cloud_setup_incomplete 'startup failed; run install'
+  else
+    ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+    exit 0
+  fi
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      [ -f "$CLAUDE_ENV_FILE" ] && [ ! -L "$CLAUDE_ENV_FILE" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'
+    fi
+    cloud_env_snapshot="\${CLAUDE_ENV_FILE}.stll-cloud"
+    case "$cloud_env_snapshot" in
+      *"'"*) cloud_setup_incomplete 'session environment path must not contain a single quote; check its path and rerun start' ;;
+    esac
+    if [ -n "$cloud_session_exports" ]; then
+      cloud_session_exports="$cloud_session_exports
+$cloud_shell_exports"
+    else
+      cloud_session_exports="$cloud_shell_exports"
+    fi
+    cloud_env_temporary="$(umask 077; mktemp "\${cloud_env_snapshot}.XXXXXX")" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'
+    printf '%s\\n' "$cloud_session_exports" > "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }
+    mv -f -- "$cloud_env_temporary" "$cloud_env_snapshot" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }
+    cloud_env_source=". '$cloud_env_snapshot'"
+    if [ ! -f "$CLAUDE_ENV_FILE" ] || ! grep -Fqx -- "$cloud_env_source" "$CLAUDE_ENV_FILE"; then
+      printf '\\n%s\\n' "$cloud_env_source" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+    fi
+  fi
+fi`
+	}]
+});
 const currentMainSessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
@@ -1556,7 +1680,8 @@ const cloudSessionStartHook = sessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${clou
 const previousCloudSessionStartHooks = [
 	releasedSessionStartHook(`bash ${cloudSetupPath}`),
 	releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
-	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
+	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
+	releasedTemporaryFileHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
 ];
 const cloudAttribution = {
 	commit: "",
@@ -1834,17 +1959,22 @@ const isDockerDefinitionPath = (file) => {
 	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
 	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
 };
+const isFormatterConfigPath = (file) => {
+	const name = file.split("/").at(-1) ?? "";
+	return /^\.oxfmtrc(?:\.jsonc?)?$/.test(name) || /^oxfmt\.config\.[cm]?[jt]s$/.test(name) || /^\.prettierrc(?:\.[^/]+)?$/.test(name) || /^prettier\.config\.[cm]?[jt]s$/.test(name) || name === ".prettierignore" || /^biome\.jsonc?$/.test(name) || /^\.?dprint\.jsonc?$/.test(name);
+};
+const isLefthookConfigPath = (file) => /^\.?lefthook(?:-local)?\.ya?ml$/.test(file);
 /** Executable shell files may have no suffix; the interpreter is then their discriminator. */
 const isShellScript = (file, text = "") => !excludedInputPath(file) && (/\.(?:sh|bash|zsh)$/.test(file) || /^#![ \t]*(?:\/(?:[^ \t\r\n]+\/)*(?:bash|dash|ksh|zsh|sh)|\/usr\/bin\/env[ \t]+(?:-S[ \t]+)?(?:bash|dash|ksh|zsh|sh))(?=[ \t\r\n]|$)/.test(text));
 /** Lockfiles establish ecosystem presence without reading their dependency graphs. */
 const toolchainInputKind = (file, text = "") => {
-	if (file === "bunfig.toml" || file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
+	if (file === "bunfig.toml" || file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock" || file === ".changeset/config.json" || isLefthookConfigPath(file)) return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
-	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file) || isFormatterConfigPath(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
-export { nodePolicyValid as C, parseCloudSetup as E, generateCloudSetup as S, nodeSupportRangeMatches as T, cloudSessionStartFix as _, isMiseConfigPath as a, mergeCloudClaudeSettings as b, javascriptDependencyLockfiles as c, containerDocumentImages as d, isComposeDefinitionPath as f, cloudClaudeSettingsPath as g, cloudAttributionFix as h, isDockerDefinitionPath as i, pythonDependencyManifestKind as l, workspaceContains as m, githubAutomationFileKind as n, isPythonDependencyManifest as o, isKubernetesDefinitionPath as p, isDependabotGithubActionsPath as r, isShellScript as s, dependabotManifestEcosystem as t, toolchainInputKind as u, hasCloudAttribution as v, nodeSelectorMatches as w, cloudSetupPath as x, hasCloudSessionStartHook as y };
+export { cloudSetupPath as C, nodeSupportRangeMatches as D, nodeSelectorMatches as E, parseCloudSetup as O, mergeCloudClaudeSettings as S, nodePolicyValid as T, cloudAttributionFix as _, isFormatterConfigPath as a, hasCloudAttribution as b, isPythonDependencyManifest as c, pythonDependencyManifestKind as d, toolchainInputKind as f, workspaceContains as g, isKubernetesDefinitionPath as h, isDockerDefinitionPath as i, isShellScript as l, isComposeDefinitionPath as m, githubAutomationFileKind as n, isLefthookConfigPath as o, containerDocumentImages as p, isDependabotGithubActionsPath as r, isMiseConfigPath as s, dependabotManifestEcosystem as t, javascriptDependencyLockfiles as u, cloudClaudeSettingsPath as v, generateCloudSetup as w, hasCloudSessionStartHook as x, cloudSessionStartFix as y };
 
 //# sourceMappingURL=toolchain-inputs.mjs.map