@williamthorsen/nmr 0.51.0 → 0.53.0

package/dist/esm/commands/actionlint.js

@@ -0,0 +1,31 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { describeSignalExitCode } from "../child-process.js";
+import { ensureTool } from "./workflow-tools.js";
+const WORKFLOWS_DIR = path.join('.github', 'workflows');
+export async function runActionlint(monorepoRoot, args, options = {}) {
+    if (!fs.existsSync(path.join(monorepoRoot, WORKFLOWS_DIR))) {
+        console.info(`No workflows to lint: ${WORKFLOWS_DIR}/ does not exist.`);
+        return 0;
+    }
+    const cacheRoot = options.cacheRoot ?? path.join(monorepoRoot, 'node_modules', '.cache', 'nmr-tools');
+    const ensure = options.ensure ?? ((tool, root) => ensureTool(tool, { cacheRoot: root }));
+    const actionlintPath = await ensure('actionlint', cacheRoot);
+    const shellcheckPath = await ensure('shellcheck', cacheRoot);
+    const outcome = (options.spawn ?? spawnInherited)(actionlintPath, buildActionlintArgs(shellcheckPath, args), monorepoRoot);
+    if (outcome.error !== undefined) {
+        throw new Error(`Cannot run actionlint: ${outcome.error.message}`, { cause: outcome.error });
+    }
+    if (outcome.signal !== null) {
+        return describeSignalExitCode(outcome.signal);
+    }
+    return outcome.status ?? 1;
+}
+export function buildActionlintArgs(shellcheckPath, args) {
+    return [`-shellcheck=${shellcheckPath}`, '-pyflakes=', ...args];
+}
+function spawnInherited(file, args, cwd) {
+    const result = spawnSync(file, args, { cwd, stdio: 'inherit' });
+    return { error: result.error, signal: result.signal, status: result.status };
+}

package/dist/esm/commands/build-output.d.ts

@@ -44,6 +44,11 @@ export declare function hasExpectedBuildOutput(packageDir: string, outdir: strin
  * current one.
  */
 export declare function readBuildDigest(packageDir: string): Promise<string | undefined>;
+/**
+ * Returns how long the emit took, in milliseconds, for the build that recorded `digest`, or `undefined` when no
+ * duration was recorded for that digest.
+ */
+export declare function readEmitDuration(packageDir: string, digest: string): Promise<number | undefined>;
 /**
  * Resolves the absolute path of a package's build-cache file, one entry in the shared store. The package
  * directory is the entry's scope, so the store keys the file to it and packages sharing a hoisted
@@ -54,6 +59,12 @@ export declare function readBuildDigest(packageDir: string): Promise<string | un
  * to the digest. Changing any of them leaves every entry on disk unreachable.
  */
 export declare function resolveBuildCachePath(packageDir: string): string;
+/**
+ * Resolves the absolute path of the entry that records how long a package's last emit took. It is a separate file in
+ * the build-cache entry's scope, so that a value varying from run to run never enters the digest that
+ * `readBuildDigest` returns.
+ */
+export declare function resolveEmitDurationPath(packageDir: string): string;
 /**
  * Resolves the two scratch directories through which a build publishes: `staging`, which the emit is written to,
  * and `previous`, which the outgoing output is renamed aside to. Both are siblings of the emit directory, so a
@@ -80,3 +91,5 @@ export declare function resolveScratchDirs(emitDir: string): ScratchDirs;
  * the pre-rebuild binary keeps the old fingerprint and rebuilds on the next run.
  */
 export declare function resolveToolchainFingerprint(packageDir: string, selfDir?: string): Promise<string>;
+/** Records how long the emit took for the build whose digest is `digest`. */
+export declare function writeEmitDuration(packageDir: string, digest: string, emitMs: number): Promise<void>;

package/dist/esm/commands/build-output.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, realpathSync } from 'node:fs';
 import path from 'node:path';
-import { findPackageRoot, readCacheEntry, resolveCacheEntryPath } from '@williamthorsen/nmr-core';
+import { findPackageRoot, readCacheEntry, readGuardedCacheEntry, resolveCacheEntryPath, writeGuardedCacheEntry, } from '@williamthorsen/nmr-core';
 import { glob } from 'glob';
 import { readPackageJson } from "../helpers/package-json.js";
 export const DEFAULT_ENTRY_GLOBS = ['src/**/*.{ts,tsx}'];
@@ -27,6 +27,10 @@ export function hasExpectedBuildOutput(packageDir, outdir, entryPoints) {
 export async function readBuildDigest(packageDir) {
     return readCacheEntry(resolveBuildCachePath(packageDir));
 }
+export async function readEmitDuration(packageDir, digest) {
+    const entry = await readGuardedCacheEntry(resolveEmitDurationPath(packageDir), digest, isEmitDurationEntry);
+    return entry?.emitMs;
+}
 export function resolveBuildCachePath(packageDir) {
     const absolutePackageDir = path.resolve(packageDir);
     return resolveCacheEntryPath({
@@ -36,6 +40,15 @@ export function resolveBuildCachePath(packageDir) {
         extension: '.hash',
     });
 }
+export function resolveEmitDurationPath(packageDir) {
+    const absolutePackageDir = path.resolve(packageDir);
+    return resolveCacheEntryPath({
+        tool: BUILD_CACHE_TOOL,
+        scopeDir: absolutePackageDir,
+        slug: path.basename(absolutePackageDir),
+        extension: '.duration.json',
+    });
+}
 export function resolveScratchDirs(emitDir) {
     const parent = path.dirname(emitDir);
     const name = path.basename(emitDir);
@@ -53,6 +66,22 @@ export async function resolveToolchainFingerprint(packageDir, selfDir = SELF_DIR
     }
     return readPackageJson(selfDir).version ?? '';
 }
+export async function writeEmitDuration(packageDir, digest, emitMs) {
+    const entry = { emitMs };
+    try {
+        await writeGuardedCacheEntry(resolveEmitDurationPath(packageDir), digest, entry);
+    }
+    catch {
+    }
+}
+function isEmitDurationEntry(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'emitMs' in value &&
+        typeof value.emitMs === 'number' &&
+        Number.isFinite(value.emitMs) &&
+        value.emitMs >= 0);
+}
 function isSameDir(left, right) {
     return resolveRealPath(left) === resolveRealPath(right);
 }

package/dist/esm/commands/build.js

@@ -2,11 +2,13 @@ import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { readFile, rename, rm } from 'node:fs/promises';
 import path from 'node:path';
-import { formatGlyphLine, readCacheEntry, STATUS_GLYPHS, writeCacheEntry, } from '@williamthorsen/nmr-core';
+import { formatGlyphLine, readCacheEntry, startTimer, STATUS_GLYPHS, writeCacheEntry, } from '@williamthorsen/nmr-core';
 import { glob } from 'glob';
 import { NMR_GLYPHS } from "../glyphs.js";
 import { resolveConfigPath } from "../helpers/config-path.js";
-import { DEFAULT_ENTRY_GLOBS, DEFAULT_IGNORE_PATTERNS, DEFAULT_OUTDIR, hasExpectedBuildOutput, resolveBuildCachePath, resolveScratchDirs, resolveToolchainFingerprint, } from "./build-output.js";
+import { formatSaving } from "../helpers/duration.js";
+import { writeStatedOutcome } from "../stated-outcome.js";
+import { DEFAULT_ENTRY_GLOBS, DEFAULT_IGNORE_PATTERNS, DEFAULT_OUTDIR, hasExpectedBuildOutput, readEmitDuration, resolveBuildCachePath, resolveScratchDirs, resolveToolchainFingerprint, writeEmitDuration, } from "./build-output.js";
 import { assertSupportedTypeScript, formatDiagnostics, getCompiler, loadCompiler } from "./compiler.js";
 import { isWithin, rewriteSpecifiers } from "./rewrite-specifiers.js";
 import { resolveTsconfigChain } from "./tsconfig-chain.js";
@@ -37,8 +39,11 @@ export async function buildPackage(packageDir, options) {
         await discardScratchDirs(resolveScratchDirs(emitDir));
         return;
     }
+    const readEmitMs = startTimer();
     const emittedFileCount = await emitPackage(packageDir, entryPoints, outdir);
+    const emitMs = readEmitMs();
     await writeCacheEntry(cachePath, currentHash);
+    await writeEmitDuration(packageDir, currentHash, emitMs);
     console.info(formatGlyphLine(NMR_GLYPHS, options.style, 'package', `${path.basename(packageDir)}: ${describeEmit(emittedFileCount, outdir)}`));
 }
 export async function computeBuildHash(packageDir, files, emitConfig, toolchain) {
@@ -184,7 +189,11 @@ async function detectBuildChanges(packageDir, files, emitConfig, toolchain, cach
     const currentHash = await computeBuildHash(packageDir, files, emitConfig, toolchain);
     if (previousHash === currentHash) {
         if (isOutputPresent) {
-            console.info(`${STATUS_GLYPHS[style].skipped.text} ${packageName}: No changes detected. Skipping build.`);
+            const savedMs = await readEmitDuration(packageDir, currentHash);
+            await writeStatedOutcome(process.env, { kind: 'build-unchanged', ...(savedMs !== undefined && { savedMs }) });
+            const saving = formatSaving(savedMs ?? 0);
+            const savingClause = saving === undefined ? '' : `, ${saving}`;
+            console.info(`${STATUS_GLYPHS[style].skipped.text} ${packageName}: No changes detected. Skipping build${savingClause}.`);
             return { changed: false, currentHash };
         }
         console.info(formatGlyphLine(NMR_GLYPHS, style, 'package', `${packageName}: Build output is missing. Rebuilding.`));

package/dist/esm/commands/clean.d.ts

@@ -1,6 +1,6 @@
 import { type OutputStyle } from '@williamthorsen/nmr-core';
 /**
- * Removes a package's build output and the build-cache entry that describes it, so the package does not keep
+ * Removes a package's build output and the build-cache entries that describe it, so the package does not keep
  * any state that would make the next build skip. Removal is idempotent: An already-clean package is a silent
  * no-op.
  */

package/dist/esm/commands/clean.js

@@ -11,13 +11,14 @@ import { applyDevBin, buildWorkspaceRegistry, resolveScript } from "../resolver.
 import { runCommand } from "../runner.js";
 import { renderChain } from "../steps.js";
 import { findMonorepoRoot, getWorkspacePackageDirs } from "../workspace.js";
-import { resolveBuildCachePath } from "./build-output.js";
+import { resolveBuildCachePath, resolveEmitDurationPath } from "./build-output.js";
 const CLEAN_COMMAND = 'clean';
 const BUILT_IN_CLEAN = 'nmr-clean';
 const OUTPUT_ROOT = 'dist';
 export async function cleanPackage(packageDir, style) {
     await rm(path.resolve(packageDir, OUTPUT_ROOT), { recursive: true, force: true });
     await rm(resolveBuildCachePath(packageDir), { force: true });
+    await rm(resolveEmitDurationPath(packageDir), { force: true });
     console.info(formatGlyphLine(NMR_GLYPHS, style, 'clean', `${path.basename(packageDir)}: Removed build output and cache.`));
 }
 export async function runClean(cwd, style) {

package/dist/esm/commands/fmt.d.ts

@@ -6,7 +6,8 @@ export type FormatMode = 'check' | 'write';
  *
  * Trailing arguments are git pathspecs, not Prettier flags; an unrecognized option is rejected rather
  * than passed along, since git would read it as a pathspec matching nothing and the run would report
- * success over an empty selection.
+ * success over an empty selection. Every argument after `--` is a pathspec, even one that starts
+ * with `-`.
  */
 export declare function runFmt(argv: string[], cwd?: string): Promise<number>;
 /** @internal */

package/dist/esm/commands/fmt.js

@@ -13,7 +13,7 @@ import { resolveFormatTargets } from "./format-targets.js";
 const PRETTIER_PACKAGE = 'prettier';
 const DEFAULT_CONFIG_PATH = fileURLToPath(new URL(`../prettier-default.config${path.extname(fileURLToPath(import.meta.url))}`, import.meta.url));
 const ARGUMENT_BUDGET_BYTES = 100_000;
-const USAGE = 'Usage: nmr-fmt (--check | --write) [--no-cache] [pathspec...]';
+const USAGE = 'Usage: nmr-fmt (--check | --write) [--no-cache] [--] [pathspec...]';
 const MODE_ARGS = {
     check: ['--check'],
     write: ['--list-different', '--write'],
@@ -79,7 +79,11 @@ function parseFmtArgs(argv) {
     let mode;
     let shouldBypassCache = false;
     const pathspecs = [];
-    for (const arg of argv) {
+    for (const [index, arg] of argv.entries()) {
+        if (arg === '--') {
+            pathspecs.push(...argv.slice(index + 1));
+            break;
+        }
         if (arg === '--no-cache') {
             shouldBypassCache = true;
             continue;
@@ -147,6 +151,7 @@ export function runPrettier(options) {
             ? []
             : ['--cache', '--cache-strategy', 'content', '--cache-location', cacheLocation]),
         ...MODE_ARGS[mode],
+        '--',
     ];
     let firstFailureStatus = 0;
     for (const batch of batchWithinBudget(files, budgetBytes)) {

package/dist/esm/commands/run-vitest.js

@@ -7,6 +7,7 @@ import { reportError } from '@williamthorsen/nmr-core';
 import { findMonorepoRoot as findMonorepoRootOrNothing } from '@williamthorsen/nmr-core/workspace';
 import { describeSignalExitCode } from "../child-process.js";
 import { isObject } from "../helpers/type-guards.js";
+import { omitOutcomeFile } from "../stated-outcome.js";
 const VITEST_PACKAGE = 'vitest';
 const SUPPORTED_VITEST_RANGE = '>=4.0.0 <6';
 const CONFIG_EXTENSIONS = ['ts', 'mts', 'cts', 'js', 'mjs', 'cjs'];
@@ -18,6 +19,7 @@ export function runNmrVitest(argv, cwd = process.cwd()) {
     }
     const result = spawnSync(process.execPath, [cli.cliPath, ...chooseVitestConfigArgs(argv, cwd)], {
         cwd,
+        env: omitOutcomeFile(process.env),
         stdio: 'inherit',
     });
     if (result.error) {

package/dist/esm/commands/workflow-tools.d.ts

@@ -0,0 +1,39 @@
+/** A program that `nmr-actionlint` downloads rather than takes from `PATH`. */
+export type WorkflowTool = 'actionlint' | 'shellcheck';
+/** A supported pair of `process.platform` and `process.arch`, joined by a hyphen. */
+export type ToolPlatform = 'darwin-arm64' | 'darwin-x64' | 'linux-arm64' | 'linux-x64';
+/** One release of a tool: where each platform's archive is, its SHA-256, and the binary's path inside it. */
+export interface ToolPin {
+    archiveMember: string;
+    assets: Record<ToolPlatform, {
+        sha256: string;
+        url: string;
+    }>;
+    version: string;
+}
+export type ToolPins = Record<WorkflowTool, ToolPin>;
+/** The subset of `fetch` that the download uses. */
+export type FetchFunction = (url: string, init?: RequestInit) => Promise<Response>;
+export interface EnsureToolOptions {
+    /** Directory under which each tool version is cached in a directory of its own. */
+    cacheRoot: string;
+    arch?: string;
+    fetch?: FetchFunction;
+    pins?: ToolPins;
+    platform?: NodeJS.Platform;
+}
+/**
+ * The pinned releases. To move a pin, change its version and URLs and take each SHA-256 from the release's `digest`
+ * as `gh api repos/{owner}/{repo}/releases/tags/{tag}` reports it, confirming actionlint's against the release's
+ * `checksums.txt`. The pins move only with a release of nmr.
+ */
+export declare const TOOL_PINS: ToolPins;
+/**
+ * Returns the path of the tool's pinned binary, downloading, verifying, and caching it first on a cache miss.
+ *
+ * A failure at any step leaves the cache without the tool, and a concurrent run never sees a partial binary: The
+ * binary is assembled in a scratch directory beside its target and renamed into place only once verified.
+ */
+export declare function ensureTool(tool: WorkflowTool, options: EnsureToolOptions): Promise<string>;
+/** Maps Node's platform and architecture onto a supported pair, rejecting every other pair. */
+export declare function resolveToolPlatform(platform: NodeJS.Platform, arch: string): ToolPlatform;

package/dist/esm/commands/workflow-tools.js

@@ -0,0 +1,140 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { UserError } from "../UserError.js";
+const SUPPORTED_PLATFORMS = ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64'];
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+const ACTIONLINT_RELEASE = 'https://github.com/rhysd/actionlint/releases/download/v1.7.12';
+const SHELLCHECK_RELEASE = 'https://github.com/koalaman/shellcheck/releases/download/v0.11.0';
+export const TOOL_PINS = {
+    actionlint: {
+        archiveMember: 'actionlint',
+        assets: {
+            'darwin-arm64': {
+                sha256: 'aba9ced2dee8d27fecca3dc7feb1a7f9a52caefa1eb46f3271ea66b6e0e6953f',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_darwin_arm64.tar.gz`,
+            },
+            'darwin-x64': {
+                sha256: '5b44c3bc2255115c9b69e30efc0fecdf498fdb63c5d58e17084fd5f16324c644',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_darwin_amd64.tar.gz`,
+            },
+            'linux-arm64': {
+                sha256: '325e971b6ba9bfa504672e29be93c24981eeb1c07576d730e9f7c8805afff0c6',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_linux_arm64.tar.gz`,
+            },
+            'linux-x64': {
+                sha256: '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_linux_amd64.tar.gz`,
+            },
+        },
+        version: '1.7.12',
+    },
+    shellcheck: {
+        archiveMember: 'shellcheck-v0.11.0/shellcheck',
+        assets: {
+            'darwin-arm64': {
+                sha256: '339b930feb1ea764467013cc1f72d09cd6b869ebf1013296ba9055ab2ffbd26f',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.darwin.aarch64.tar.gz`,
+            },
+            'darwin-x64': {
+                sha256: 'c2c15e08df0e8fbc374c335b230a7ee958c313fa5714817a59aa59f1aa594f51',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.darwin.x86_64.tar.gz`,
+            },
+            'linux-arm64': {
+                sha256: '68a8133197a50beb8803f8d42f9908d1af1c5540d4bb05fdfca8c1fa47decefc',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.linux.aarch64.tar.gz`,
+            },
+            'linux-x64': {
+                sha256: 'b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.linux.x86_64.tar.gz`,
+            },
+        },
+        version: '0.11.0',
+    },
+};
+export async function ensureTool(tool, options) {
+    const pin = (options.pins ?? TOOL_PINS)[tool];
+    const asset = pin.assets[resolveToolPlatform(options.platform ?? process.platform, options.arch ?? process.arch)];
+    const targetDir = path.join(options.cacheRoot, `${tool}-${pin.version}`);
+    const binaryPath = path.join(targetDir, tool);
+    if (fs.existsSync(binaryPath)) {
+        return binaryPath;
+    }
+    createCacheRoot(options.cacheRoot);
+    const scratchDir = `${targetDir}.tmp-${process.pid}`;
+    fs.rmSync(scratchDir, { force: true, recursive: true });
+    fs.mkdirSync(scratchDir);
+    try {
+        const archive = await download(asset.url, options.fetch ?? globalThis.fetch);
+        const actualSha256 = createHash('sha256').update(archive).digest('hex');
+        if (actualSha256 !== asset.sha256) {
+            throw new Error(`Checksum mismatch for ${asset.url}: expected sha256 ${asset.sha256}, got ${actualSha256}`);
+        }
+        const archivePath = path.join(scratchDir, 'archive.tar.gz');
+        fs.writeFileSync(archivePath, archive);
+        const extractDir = path.join(scratchDir, 'extract');
+        fs.mkdirSync(extractDir);
+        extractMember(archivePath, extractDir, pin.archiveMember);
+        const stageDir = path.join(scratchDir, 'stage');
+        fs.mkdirSync(stageDir);
+        const stagedBinary = path.join(stageDir, tool);
+        fs.renameSync(path.join(extractDir, pin.archiveMember), stagedBinary);
+        fs.chmodSync(stagedBinary, 0o755);
+        publishStage(stageDir, targetDir, binaryPath);
+    }
+    finally {
+        fs.rmSync(scratchDir, { force: true, recursive: true });
+    }
+    return binaryPath;
+}
+export function resolveToolPlatform(platform, arch) {
+    const key = `${platform}-${arch}`;
+    const supported = SUPPORTED_PLATFORMS.find((candidate) => candidate === key);
+    if (supported === undefined) {
+        throw new UserError(`Workflow linting does not support ${key}; the supported platforms are ${SUPPORTED_PLATFORMS.join(', ')}`);
+    }
+    return supported;
+}
+function createCacheRoot(cacheRoot) {
+    try {
+        fs.mkdirSync(cacheRoot, { recursive: true });
+    }
+    catch (error) {
+        throw new Error(`Cannot create the tool cache at ${cacheRoot}`, { cause: error });
+    }
+}
+async function download(url, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+    }
+    catch (error) {
+        throw new Error(`Cannot download ${url}: ${describeError(error)}`, { cause: error });
+    }
+    if (!response.ok) {
+        throw new Error(`Cannot download ${url}: HTTP ${response.status}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+function extractMember(archivePath, extractDir, member) {
+    const result = spawnSync('tar', ['-xzf', archivePath, '-C', extractDir, member], { encoding: 'utf8' });
+    if (result.error !== undefined) {
+        throw new Error(`Cannot run tar to extract ${member}: ${result.error.message}`, { cause: result.error });
+    }
+    if (result.status !== 0) {
+        throw new Error(`tar could not extract ${member} from ${archivePath}: ${result.stderr.trim()}`);
+    }
+}
+function publishStage(stageDir, targetDir, binaryPath) {
+    try {
+        fs.renameSync(stageDir, targetDir);
+    }
+    catch (error) {
+        if (!fs.existsSync(binaryPath)) {
+            throw error;
+        }
+    }
+}

package/dist/esm/default-scripts.js

@@ -4,6 +4,7 @@ const TYPECHECK_STEP = { run: 'typecheck', shouldDeclineArguments: true };
 const ROOT_TYPECHECK_STEP = { run: 'root:typecheck', shouldDeclineArguments: true };
 const LINT_CHECK_STEP = { run: 'lint:check', shouldRunInBackground: true };
 const LINT_STRICT_STEP = { run: 'lint:strict', shouldRunInBackground: true };
+const LINT_WORKFLOWS_STEP = { run: 'lint:workflows', shouldDeclineArguments: true };
 export const workspaceScripts = {
     build: ['compile'],
     check: [LINT_CHECK_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
@@ -35,8 +36,8 @@ export function buildRootScripts(workspaceGlobs) {
         'audit:dev': 'pnpm exec v11y --dev',
         'audit:prod': 'pnpm exec v11y --prod',
         build: ['-R build'],
-        check: [LINT_CHECK_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
-        'check:strict': [LINT_STRICT_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
+        check: [LINT_CHECK_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
+        'check:strict': [LINT_STRICT_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
         ci: [{ run: 'build', shouldDeclineArguments: true }, 'check:strict'],
         clean: 'nmr-clean',
         fix: ['lint', 'fmt'],
@@ -46,9 +47,10 @@ export function buildRootScripts(workspaceGlobs) {
         lint: 'eslint --fix .',
         'lint:check': 'eslint .',
         'lint:strict': 'strict-lint',
+        'lint:workflows': 'nmr-actionlint',
         prepush: [{ run: 'audit', shouldDeclineArguments: true }, 'ci'],
         'report-overrides': 'nmr-report-overrides',
-        'root:check': [ROOT_TYPECHECK_STEP, 'fmt:check', 'root:lint:check', 'root:test'],
+        'root:check': [ROOT_TYPECHECK_STEP, 'fmt:check', 'root:lint:check', LINT_WORKFLOWS_STEP, 'root:test'],
         'root:lint': `eslint --fix ${ignorePatterns}.`,
         'root:lint:check': `eslint ${ignorePatterns}.`,
         'root:lint:strict': `strict-lint ${ignorePatterns}.`,

package/dist/esm/delegate-host.js

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import { Writable } from 'node:stream';
-import { reportError } from '@williamthorsen/nmr-core';
+import { reportError, startTimer } from '@williamthorsen/nmr-core';
 import { NO_CACHE_ENV_VAR, resolveRunId, writeDebugNote } from "./check-cache.js";
 import { buildChildEnv, buildRemoteEnv } from "./child-env.js";
 import { resolveDelegationTarget } from "./delegation-target.js";
@@ -111,7 +111,7 @@ async function delegate(options) {
     const { invocation, remoteEnv, target } = options;
     const { command, context, cwd, env, parsedArgs, stderr, stdout } = invocation;
     const listedHosts = target.hosts.join(', ');
-    const startedAtMs = Date.now();
+    const readElapsedMs = startTimer();
     const snapshot = createSnapshot(cwd, env);
     if (!snapshot.ok && snapshot.isUnsupported) {
         if (target.source === 'flag') {
@@ -144,7 +144,7 @@ async function delegate(options) {
             stdout: createTee(stdout, retained.stdout),
         })
         : { ok: false, message: 'could not snapshot the working tree', output: snapshot.reason, waitedMs: 0 };
-    const durationMs = Date.now() - startedAtMs - result.waitedMs;
+    const durationMs = readElapsedMs() - result.waitedMs;
     const ran = {
         kind: 'ran',
         durationMs,

package/dist/esm/glyphs.d.ts

@@ -5,5 +5,5 @@
  * `noop` is a neutral circle: Nothing ran because the repo asked for nothing to run, which is neither a
  * failure nor a block.
  */
-export declare const NMR_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"overrides" | "clean" | "catalog" | "noop" | "package" | "recording", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
+export declare const NMR_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"overrides" | "clean" | "host" | "catalog" | "noop" | "package" | "recording", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
 export type NmrGlyphName = keyof (typeof NMR_GLYPHS)['rich'];

package/dist/esm/glyphs.js

@@ -2,6 +2,7 @@ import { defineGlyphSet } from '@williamthorsen/nmr-core';
 export const NMR_GLYPHS = defineGlyphSet({
     catalog: { plain: '', rich: '\u{1F4DA}' },
     clean: { plain: '', rich: '\u{1F9F9}' },
+    host: { plain: '', rich: '\u{1F4E1}' },
     noop: { plain: 'NOOP', rich: '\u{26AA}' },
     overrides: { plain: '', rich: '\u{1F512}' },
     package: { plain: '', rich: '\u{1F4E6}' },

package/dist/esm/remote-host-session.js

@@ -14,6 +14,8 @@ export function runHostSession(params) {
     const COMMAND_NOT_FOUND_EXIT_CODE = 127;
     const DELEGATION_FAILURE_EXIT_CODE = 255;
     const STOP_GRACE_MS = 5_000;
+    const NODE_MODULES_DIR = path.join(params.rootDir, 'node_modules');
+    const BINS_RECORD_PATH = path.join(NODE_MODULES_DIR, '.nmr-delegate-bins');
     const token = crypto.randomUUID();
     let isHolding = false;
     let activeChild;
@@ -36,6 +38,10 @@ export function runHostSession(params) {
                 return;
             }
         }
+        const binsFingerprint = readBinsFingerprint();
+        if (binsFingerprint === undefined || readBinsRecord() !== binsFingerprint) {
+            removeWorkspaceState();
+        }
         const install = await runPhase('pnpm', ['install', '--frozen-lockfile'], params.rootDir, {
             ...process.env,
             CI: 'true',
@@ -46,6 +52,8 @@ export function runHostSession(params) {
             fail('install', install);
             return;
         }
+        if (binsFingerprint !== undefined)
+            writeBinsRecord(binsFingerprint);
         emit({ kind: 'run' });
         fs.mkdirSync(params.runDir, { recursive: true });
         fs.mkdirSync(params.passManifestDir, { recursive: true });
@@ -146,6 +154,42 @@ export function runHostSession(params) {
             return true;
         return state.holder !== undefined && isProcessGone(state.holder.pid);
     }
+    function readBinsFingerprint() {
+        let listing;
+        try {
+            listing = childProcess.execFileSync('git', ['ls-files', '-z', '--', '*package.json'], {
+                cwd: params.rootDir,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+        }
+        catch {
+            return undefined;
+        }
+        const lines = listing
+            .split('\0')
+            .filter((file) => path.basename(file) === 'package.json')
+            .toSorted()
+            .map((file) => {
+            try {
+                const manifest = JSON.parse(fs.readFileSync(path.join(params.rootDir, file), 'utf8'));
+                const fields = typeof manifest === 'object' && manifest !== null ? { ...manifest } : {};
+                return JSON.stringify([file, fields['name'], fields['bin']]);
+            }
+            catch {
+                return JSON.stringify([file]);
+            }
+        });
+        return crypto.createHash('sha256').update(lines.join('\n')).digest('hex');
+    }
+    function readBinsRecord() {
+        try {
+            return fs.readFileSync(BINS_RECORD_PATH, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    }
     function readErrorCode(error) {
         return typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
     }
@@ -218,6 +262,14 @@ export function runHostSession(params) {
             fs.rmSync(LOCK_PATH, { force: true });
         }
     }
+    function removeWorkspaceState() {
+        const names = fs.existsSync(NODE_MODULES_DIR) ? fs.readdirSync(NODE_MODULES_DIR) : [];
+        for (const name of names) {
+            if (name.startsWith('.pnpm-workspace-state') && name.endsWith('.json')) {
+                fs.rmSync(path.join(NODE_MODULES_DIR, name), { force: true });
+            }
+        }
+    }
     function runPhase(file, args, cwd, env) {
         const head = [];
         const tail = [];
@@ -274,4 +326,12 @@ export function runHostSession(params) {
         catch {
         }
     }
+    function writeBinsRecord(fingerprint) {
+        try {
+            fs.mkdirSync(NODE_MODULES_DIR, { recursive: true });
+            fs.writeFileSync(BINS_RECORD_PATH, fingerprint);
+        }
+        catch {
+        }
+    }
 }

package/dist/esm/remote-run.js

@@ -3,7 +3,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
-import { STATUS_GLYPHS } from '@williamthorsen/nmr-core';
+import { startTimer, STATUS_GLYPHS } from '@williamthorsen/nmr-core';
 import { PASS_MANIFEST_DIR_ENV_VAR, writeDebugNote } from "./check-cache.js";
 import { createBoundedBuffer } from "./helpers/createBoundedBuffer.js";
 import { quoteForShell } from "./helpers/quoteForShell.js";
@@ -74,18 +74,18 @@ export async function runRemotely(options) {
     const marker = `__NMR_DELEGATE_${nonce}__`;
     const statusFile = `.git/nmr-run-status-${nonce}`;
     const passes = [];
-    let waitStartedAtMs;
+    let readWaitedMs;
     let waitedMs = 0;
     let failure;
     const demultiplexer = createSessionDemultiplexer({
         marker,
         onRecord(record) {
             if (record.kind === 'waiting') {
-                waitStartedAtMs ??= Date.now();
+                readWaitedMs ??= startTimer();
                 stderr.write(`${formatDelegationWaitingLine(record.holder, host)}\n`);
             }
-            else if (record.kind === 'locked' && waitStartedAtMs !== undefined) {
-                waitedMs = Date.now() - waitStartedAtMs;
+            else if (record.kind === 'locked' && readWaitedMs !== undefined) {
+                waitedMs = readWaitedMs();
             }
             else if (record.kind === 'failed') {
                 failure = record;

package/dist/esm/remote-snapshot.js

@@ -2,7 +2,7 @@ import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { GIT_OUTPUT_LIMIT } from '@williamthorsen/nmr-core';
+import { GIT_OUTPUT_LIMIT_BYTES } from '@williamthorsen/nmr-core';
 export function createSnapshot(cwd, env) {
     const toplevelResult = runGit(['rev-parse', '--show-toplevel'], cwd, env);
     if (!toplevelResult.ok) {
@@ -69,7 +69,7 @@ function copyIndex(source, destination) {
     fs.utimesSync(destination, atime, mtime);
 }
 function runGit(args, cwd, env) {
-    const result = spawnSync('git', args, { cwd, encoding: 'utf8', env, maxBuffer: GIT_OUTPUT_LIMIT });
+    const result = spawnSync('git', args, { cwd, encoding: 'utf8', env, maxBuffer: GIT_OUTPUT_LIMIT_BYTES });
     if (result.error !== undefined) {
         return { ok: false, error: result.error.message };
     }