code-foundry 1.43.2 → 1.44.1

package/README.md

@@ -44,8 +44,9 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
   outcomes comparable across revisions and executors.
 - An opt-in product-quality runner for static sites, web apps, Workers, and
   published packages.
-- A small `.githooks/pre-commit` launcher with language-aware formatting and
-  linting.
+- A small `.githooks/pre-commit` launcher with a change-aware gate: it formats
+  and lints only staged files, type-checks only when typed sources are staged,
+  and leaves the build to CI.
 - An optional `.mise.toml`/`mise.lock`, repository profile configuration, and
   standard GitHub forms and policy files.
 - AGENTS instructions, CODEOWNERS, license/notice files, and reusable release

package/docs/CONFIGURATION.md

@@ -131,6 +131,7 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `coverage_minimum`                        | `0`–`100`                                            | Minimum percentage; defaults to `80`.                                                                                                                                                                                                                                                                                                                                                                                  |
 | `coverage_metrics`                        | `lines`, `functions`, `branches`, `statements`       | Metrics checked by the coverage gate.                                                                                                                                                                                                                                                                                                                                                                                  |
 | `coverage_report`                         | comma-separated repository paths                     | Istanbul JSON summary or LCOV evidence files.                                                                                                                                                                                                                                                                                                                                                                          |
+| `pre_commit_build`                        | `true`, `false`                                      | Run the project's build in the local pre-commit gate. Defaults to `false`; see [Pre-commit gate](#pre-commit-gate).                                                                                                                                                                                                                                                                                                    |
 | `filter_<task>`                           | comma-separated repository path globs                | Skip a lane when no changed path matches; see [Lane path filters](#lane-path-filters).                                                                                                                                                                                                                                                                                                                                 |
 | `rust_sccache`                            | `true`, `false`                                      | Install sccache and wrap rustc so compile artifacts survive manifest/lockfile churn.                                                                                                                                                                                                                                                                                                                                   |
 | `rust_nextest`                            | `true`, `false`                                      | Install cargo-nextest and prefer `cargo nextest run` over `cargo test` in Rust test lanes.                                                                                                                                                                                                                                                                                                                             |
@@ -169,6 +170,36 @@ to keep discovery optional. Product-quality profiles are repository-owned
 manifests invoked by existing build or E2E commands; they are not activated by a
 configuration key. See [Product quality profiles](product-quality.md).
 
+### Pre-commit gate
+
+`code-foundry sync` installs `.githooks/pre-commit`, which runs
+`code-foundry pre-commit` when the repository depends on `code-foundry`. The
+gate is change-aware and never runs work for code the commit cannot affect:
+
+- With nothing staged it exits immediately. `git diff --cached --check` still
+  blocks whitespace errors in every staged change.
+- Oxfmt and Oxlint check only the staged files they support, honoring their
+  own ignore patterns. Staging `.oxfmtrc.json`, `.oxlintrc.json`, or their
+  `*.config.*` equivalents widens that tool to the whole repository through the
+  repository's `format:check`/`lint` script. A repository without Oxfmt or
+  Oxlint keeps its own script, which runs only when a matching file is staged.
+- The project's `type-check`/`typecheck`/`type:check` script (or `tsc --noEmit`)
+  runs only when `.ts`, `.tsx`, `.mts`, `.cts`, or `tsconfig*.json` files are
+  staged, and for JavaScript sources when the repository type-checks them with
+  a root `jsconfig.json` or `checkJs`.
+- Ruff checks only staged Python files (`--force-exclude`), or the whole
+  repository when `pyproject.toml`, `ruff.toml`, or a requirements file is
+  staged. Staged Rust sources or `Cargo.toml` run `cargo fmt --check` and
+  Clippy.
+- The build does not run at commit time; CI and explicit commands own it. Set
+  `pre_commit_build: true` to run the `build` script (or `cargo build`) when
+  code is staged.
+
+Tools read working-tree contents, so a partially staged file is checked as it
+exists on disk. Task scripts that declare dependencies of their own, such as a
+Turborepo `typecheck` task with `dependsOn: ["^build"]`, still run them; drop
+that dependency to keep type checks build-free.
+
 ## Release and branch policy
 
 | Key                       | Values                                                                           | Purpose                                                                 |

package/docs/PERFORMANCE.md

@@ -6,27 +6,37 @@ budget is exceeded. Reports are generated-run evidence and are ignored by Git.
 
 ## Enforced budgets
 
-| Metric                              |   Budget | Why it is bounded                                    |
-| ----------------------------------- | -------: | ---------------------------------------------------- |
-| CLI help startup p95                |   250 ms | Detect eager imports and startup regressions         |
-| Runtime mode startup p95            |   250 ms | Detect baseline runtime initialization regressions   |
-| Focused runtime tests               |     10 s | Keep the representative runtime contract inexpensive |
-| Format, lint, type-check, and build |     15 s | Bound the local CI feedback loop                     |
-| Runtime dependencies                |        0 | Keep the installed CLI dependency-free               |
-| Development dependencies            |        4 | Prevent unreviewed toolchain growth                  |
-| Packed artifact                     |   260 kB | Bound registry transfer and install cost             |
-| Unpacked artifact                   | 1,000 kB | Bound installed footprint                            |
-| Packed files                        |      115 | Detect accidental release contents                   |
+| Metric                                |   Budget | Why it is bounded                                    |
+| ------------------------------------- | -------: | ---------------------------------------------------- |
+| CLI help startup p95                  |   250 ms | Detect eager imports and startup regressions         |
+| Runtime mode startup p95              |   750 ms | Detect baseline runtime initialization regressions   |
+| Focused runtime tests                 |     10 s | Keep the representative runtime contract inexpensive |
+| Format, lint, type-check, and build   |     15 s | Bound the local CI feedback loop                     |
+| Runtime dependencies                  |        0 | Keep the installed CLI dependency-free               |
+| Development dependencies              |        4 | Prevent unreviewed toolchain growth                  |
+| Packed artifact (without changelog)   |   296 kB | Bound registry transfer and install cost             |
+| Unpacked artifact (without changelog) | 1,136 kB | Bound installed footprint                            |
+| Packed files (without changelog)      |      120 | Detect accidental release contents                   |
 
 The source-of-truth budgets live in `scripts/performance-check.mjs`. When those
 limits change, update this table and include before/after measurements in the
-same change. The Cloudflare delivery and qualified-publication changes in this release
-moved the measured artifact from 990,481 to 994,555 unpacked bytes (257,384 to
-258,647 packed bytes, with 112 files in both measurements). Draft protection
-configuration, reusable-workflow inputs, documentation, and regression tests
-increased the measured artifact to 998,348 unpacked bytes (259,532 packed bytes,
-with 112 files). The unpacked budget is therefore 1,000 kB; the packed and
-file-count budgets remain unchanged.
+same change. Latency budgets are evaluated against the fastest of the timed
+samples so a single load spike on a shared runner cannot fail the gate.
+
+The artifact budgets measure the package **without `CHANGELOG.md`**. Release
+Please prepends every release to the repository changelog, so a budget that
+included it eroded on every release and repeatedly failed release pull requests.
+The check packs a staging copy without the changelog and reports the repository
+changelog size and its packaged (trimmed) size as informational metrics. At
+v1.44.0 the measured artifact was 280,902 packed bytes, 1,070,333 unpacked bytes,
+and 118 files, leaving roughly 5% packed and 6% unpacked headroom for source
+growth.
+
+The published package ships a changelog trimmed to the 20 most recent releases
+with a link to the full history on GitHub. `scripts/package-changelog.mjs`
+rewrites only the ephemeral checkout in the qualification pack job, immediately
+before the lifecycle-free `npm pack --ignore-scripts`; the repository keeps the
+complete `CHANGELOG.md` that Release Please maintains.
 
 The performance workflow disables build-cache reads and writes for this task.
 Timing comparisons therefore do not depend on a warm protected-branch cache, and

package/docs/qualified-publication.md

@@ -51,7 +51,9 @@ identity checks.
 
 The producer must:
 
-- pack the candidate with lifecycle scripts disabled;
+- pack the candidate with lifecycle scripts disabled, after trimming the
+  checkout's `CHANGELOG.md` to recent releases with
+  `scripts/package-changelog.mjs`;
 - create or reuse a draft release for the exact package version;
 - attach the package archive before the release is published;
 - keep the tag at the qualified source commit;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.43.2",
+  "version": "1.44.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/lib/pre-commit.mjs

@@ -0,0 +1,114 @@
+// @ts-check
+
+/**
+ * Change-aware planning for the local commit gate.
+ *
+ * The gate runs once per commit and blocks every agent or developer sharing a
+ * checkout, so it only does work the staged change can affect: format and lint
+ * the staged files, type-check only when a typed source or compiler config is
+ * staged, and leave the build to CI unless a repository opts back in with
+ * `pre_commit_build: true`. Repository-wide runs happen only when a staged file
+ * changes the tool's own configuration, because that can affect every file.
+ */
+
+/** Files Oxfmt formats; anything else is left out of the staged file list. */
+const FORMATTABLE =
+  /\.(?:[cm]?[jt]sx?|json[c5]?|mdx?|ya?ml|toml|css|scss|less|html?|vue|svelte|astro|graphql|gql|hbs|handlebars)$/i
+/** Files Oxlint lints. */
+const LINTABLE = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/i
+/** Typed sources and compiler configuration: the type-check trigger. */
+const TYPED = /\.(?:ts|tsx|mts|cts)$|(?:^|\/)tsconfig[^/]*\.json$/i
+/** JavaScript sources, type-checked only when the repository opts in with a root jsconfig. */
+const JAVASCRIPT = /\.(?:js|jsx|mjs|cjs)$|(?:^|\/)jsconfig[^/]*\.json$/i
+const FORMAT_CONFIG = /^(?:\.oxfmtrc\.jsonc?|oxfmt\.config\.[^/]+|\.prettierignore)$/
+const LINT_CONFIG = /^(?:\.oxlintrc\.json|oxlint\.config\.[^/]+)$/
+const PYTHON = /\.pyi?$/i
+const PYTHON_CONFIG =
+  /^(?:pyproject\.toml|ruff\.toml|\.ruff\.toml)$|(?:^|\/)requirements[^/]*\.txt$/
+const RUST = /\.rs$|(?:^|\/)Cargo\.toml$/
+
+/**
+ * @typedef {object} PreCommitPlan
+ * @property {boolean} formatAll A formatter configuration file is staged.
+ * @property {string[]} formatFiles Staged files the formatter should check.
+ * @property {boolean} lintAll A linter configuration file is staged.
+ * @property {string[]} lintFiles Staged files the linter should check.
+ * @property {boolean} typeCheck Run the project's type-check command.
+ * @property {boolean} pythonAll A Python tool configuration file is staged.
+ * @property {string[]} pythonFiles Staged Python files.
+ * @property {boolean} rust Rust sources or manifests are staged.
+ * @property {boolean} build Run the project's build command.
+ */
+
+/**
+ * @param {string[]} staged Repository-relative paths of staged files that still exist.
+ * @param {{checkJs?: boolean, build?: boolean}} [options]
+ * @returns {PreCommitPlan}
+ */
+export function planPreCommit(staged, options = {}) {
+  const formatAll = staged.some((file) => FORMAT_CONFIG.test(file))
+  const lintAll = staged.some((file) => LINT_CONFIG.test(file))
+  const pythonAll = staged.some((file) => PYTHON_CONFIG.test(file))
+  const formatFiles = staged.filter((file) => FORMATTABLE.test(file))
+  const lintFiles = staged.filter((file) => LINTABLE.test(file))
+  const pythonFiles = staged.filter((file) => PYTHON.test(file))
+  const typeCheck = staged.some(
+    (file) => TYPED.test(file) || (options.checkJs === true && JAVASCRIPT.test(file))
+  )
+  const rust = staged.some((file) => RUST.test(file))
+  const code =
+    typeCheck ||
+    lintFiles.length > 0 ||
+    pythonFiles.length > 0 ||
+    rust ||
+    staged.some((file) => /(?:^|\/)package\.json$/.test(file))
+  return {
+    formatAll,
+    formatFiles,
+    lintAll,
+    lintFiles,
+    typeCheck,
+    pythonAll,
+    pythonFiles,
+    rust,
+    build: options.build === true && code,
+  }
+}
+
+/**
+ * Parse `git diff --cached --name-only -z` output.
+ * @param {string} output
+ * @returns {string[]}
+ */
+export function parseStagedFiles(output) {
+  return output.split('\0').filter(Boolean)
+}
+
+/**
+ * Resolve the `pre_commit_build` configuration value. Building at commit time
+ * is opt-in: it serializes parallel work on a shared checkout and CI rebuilds
+ * every change anyway.
+ * @param {string|undefined} value
+ * @returns {boolean}
+ */
+export function preCommitBuildEnabled(value) {
+  const resolved = value === undefined || value === '' ? 'false' : value
+  if (resolved !== 'true' && resolved !== 'false')
+    throw new Error(`Unsupported pre_commit_build: ${resolved}; use true or false.`)
+  return resolved === 'true'
+}
+
+/**
+ * Split a file list so one tool invocation never exceeds the platform's
+ * argument-length limit on very large commits.
+ * @param {string[]} files
+ * @param {number} [size]
+ * @returns {string[][]}
+ */
+export function chunkFiles(files, size = 200) {
+  /** @type {string[][]} */
+  const chunks = []
+  for (let index = 0; index < files.length; index += size)
+    chunks.push(files.slice(index, index + size))
+  return chunks
+}

package/src/runtime-core.mjs

@@ -20,6 +20,12 @@ import { docsOnlyPullRequest } from './lib/docs-only.mjs'
 import { readTaskFilters, resolveChangedPaths, taskAffected } from './lib/task-filters.mjs'
 import { classifyValidationMode, evaluateValidationGate } from './lib/validation-policy.mjs'
 import { readReleaseConfig, validateGeneratedReleaseDiff } from './lib/release-policy.mjs'
+import {
+  chunkFiles,
+  parseStagedFiles,
+  planPreCommit,
+  preCommitBuildEnabled,
+} from './lib/pre-commit.mjs'
 import { runNodePackagePerformance } from './lib/node-package-performance.mjs'
 import {
   EVAL_BUDGET_FILE_DEFAULT,
@@ -1167,35 +1173,89 @@ function printProfile(command) {
   writeOutput('npm_publish', config.npm_publish ?? 'false')
 }
 
+/** Whether JavaScript sources are type-checked (a root jsconfig or `checkJs`). */
+function checksJavascript() {
+  if (existsSync(resolve(root, 'jsconfig.json'))) return true
+  return /"checkJs"\s*:\s*true/.test(readFileSafe(resolve(root, 'tsconfig.json')) ?? '')
+}
+
+/** @param {string} tool @param {string[]} args @param {string[]} files */
+function runToolOnFiles(tool, args, files) {
+  for (const chunk of chunkFiles(files)) runTool(tool, [...args, ...chunk])
+}
+
 /**
  * The local commit gate.
  *
  * Exported so the generated `.githooks/pre-commit` can reach it: the hook is
- * what turns this into an actual gate, and it used to run the whitespace
- * check alone. The generated hook is the consumer-visible contract, so keep
- * the two in step.
+ * what turns this into an actual gate. The generated hook is the
+ * consumer-visible contract, so keep the two in step.
+ *
+ * The gate is change-aware: it formats and lints only staged files, runs the
+ * project's type-check command only when typed sources or compiler config are
+ * staged, and never builds unless `pre_commit_build: true` opts back in. The
+ * full suite still runs in CI. Tools see working-tree contents, so a partially
+ * staged file is checked as it exists on disk.
  */
 export function preCommit() {
-  const changed = capture('git', ['diff', '--cached', '--name-only'])
-  if (!changed) return
+  const staged = parseStagedFiles(
+    capture('git', ['diff', '--cached', '--name-only', '-z', '--diff-filter=ACMR'])
+  )
+  // Deletions still go through the whitespace guard; they need no tool run.
+  if (!staged.length && !capture('git', ['diff', '--cached', '--name-only'])) return
   const check = spawnSync('git', ['diff', '--cached', '--check'], { cwd: root, stdio: 'inherit' })
   if (check.status !== 0) process.exit(check.status ?? 1)
-  if (/\.(js|jsx|ts|tsx|json|md|mdx|yml|yaml)$/.test(changed)) {
-    ci('format')
-    ci('lint')
-    // Type errors are the fastest check that still needs a full toolchain, and
-    // the most common reason a green-looking commit fails CI later. Run it
-    // here while the dependency graph is warm.
-    ci('type_check')
+  if (!staged.length) return
+
+  const plan = planPreCommit(staged, {
+    checkJs: checksJavascript(),
+    build: preCommitBuildEnabled(config.pre_commit_build),
+  })
+  const js = (hasLanguage('typescript') || hasLanguage('javascript')) && hasRootJavascriptProject()
+
+  if (js && (plan.formatAll || plan.formatFiles.length)) {
+    if (plan.formatAll) {
+      if (!runScript(['format:check', 'format', 'fmt']) && hasOxfmtSetup())
+        runTool('oxfmt', ['--check', '.'])
+    } else if (hasOxfmtSetup()) {
+      runToolOnFiles('oxfmt', ['--check', '--no-error-on-unmatched-pattern'], plan.formatFiles)
+    } else if (plan.formatFiles.some((file) => /\.(?:[cm]?[jt]sx?|json|mdx?|ya?ml)$/.test(file))) {
+      // A repository-owned formatter cannot be scoped generically; its script
+      // still runs, but only when a file it plausibly owns is staged.
+      runScript(['format:check', 'format', 'fmt'])
+    }
+  }
+  if (js && (plan.lintAll || plan.lintFiles.length)) {
+    if (plan.lintAll) {
+      if (!runScript(['lint']) && hasOxlintSetup()) runTool('oxlint', ['--deny-warnings'])
+    } else if (hasOxlintSetup()) {
+      runToolOnFiles(
+        'oxlint',
+        ['--deny-warnings', '--no-error-on-unmatched-pattern'],
+        plan.lintFiles
+      )
+    } else {
+      runScript(['lint'])
+    }
+  }
+  if (js && plan.typeCheck) {
+    // Use the project's own command so project references, workspaces, and
+    // path aliases resolve exactly as they do in CI.
+    const scripted = runScript(['type-check', 'typecheck', 'type:check'])
+    if (!scripted && existsSync(resolve(root, 'tsconfig.json'))) runTool('tsc', ['--noEmit'])
   }
-  if (/\.rs$|(^|\/)Cargo\.toml$/.test(changed)) {
+  if (plan.rust) {
     run('cargo', ['fmt', '--check'])
     run('cargo', ['clippy', '--all-targets', '--', '-D', 'warnings'])
   }
-  if (/\.py$|(^|\/)(pyproject\.toml|requirements[^/]*\.txt)$/.test(changed)) {
+  if (plan.pythonAll) {
     runTool('ruff', ['format', '--check', '.'])
     runTool('ruff', ['check', '.'])
+  } else if (plan.pythonFiles.length) {
+    runToolOnFiles('ruff', ['format', '--check', '--force-exclude'], plan.pythonFiles)
+    runToolOnFiles('ruff', ['check', '--force-exclude'], plan.pythonFiles)
   }
+  if (plan.build) ci('build')
 }
 
 // Only dispatch when this module is the process entry point. The CLI imports