forgedock 1.26.0 → 1.28.0

package/scripts/fixtures/symbol-move/gen_big.py

@@ -0,0 +1,201 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# gen_big.py: deterministic fixture for scripts/symbol-move.test.sh (forge#4210). stdlib only, no randomness.
+# Usage: python3 gen_big.py <out_root>
+# Writes <out_root>/pkg/__init__.py, pkg/big.py (~3k lines) and tests/__init__.py, tests/test_big.py.
+# big.py groups (the test's plan): consts (LIMIT_*, _SEPARATOR), helpers (_scale_*, compute_*, join_parts),
+# aio (fetch_*), models (Item_*); VERSION, describe() and DEFAULT_TOTAL stay behind and use moved names.
+
+import os
+import sys
+
+N_FUNCS = 90
+N_ASYNC = 30
+N_CLASSES = 30
+
+
+def big():
+    out = ['"""Fixture module for the symbol-move codemod test."""', "",
+           "from __future__ import annotations", "",
+           "import functools", "import os", "", "", "# ---- constants ----", ""]
+    for i in range(N_FUNCS):
+        out.append("LIMIT_%02d = %d  # upper bound for compute_%02d" % (i, 10 + i, i))
+    out += ["", '_SEPARATOR = os.sep + "|"', "", ""]
+    out += ["# ---- helpers ----", ""]
+    for i in range(N_FUNCS):
+        out += [
+            "",
+            "def _scale_%02d(value: int) -> int:" % i,
+            "    # private helper: scales by the group factor",
+            "    factor = %d" % (i % 7 + 1),
+            "    if value < 0:",
+            "        return -value * factor",
+            "    return value * factor",
+            "",
+            "",
+            "def compute_%02d(value: int) -> int:" % i,
+            '    """Scale value and clamp it to LIMIT_%02d."""' % i,
+            "    scaled = _scale_%02d(value)" % i,
+            "    if scaled > LIMIT_%02d:" % i,
+            "        return LIMIT_%02d" % i,
+            "    total = 0",
+            "    for step in range(scaled):",
+            "        total += step % 3",
+            "    return scaled + total - total",
+            "",
+        ]
+    out += [
+        "",
+        "def join_parts(*parts: str) -> str:",
+        "    # joins with the module separator",
+        "    return _SEPARATOR.join(str(p) for p in parts)",
+        "",
+        "",
+        "# ---- async ----",
+        "",
+    ]
+    for i in range(N_ASYNC):
+        out += [
+            "",
+            "async def fetch_%02d(value: int) -> dict:" % i,
+            '    """Pretend to fetch: returns the computed value in a record."""',
+            "    result = compute_%02d(value)" % i,
+            '    record = {"id": %d, "value": result}' % i,
+            "    if result % 2:",
+            '        record["odd"] = True',
+            "    return record",
+            "",
+        ]
+    out += ["", "# ---- models ----", ""]
+    for i in range(N_CLASSES):
+        out += [
+            "",
+            "@functools.total_ordering",
+            "class Item_%02d:" % i,
+            '    """A comparable item backed by compute_%02d."""' % i,
+            "",
+            '    kind = "item-%02d"' % i,
+            "",
+            "    def __init__(self, raw: int) -> None:",
+            "        self.raw = raw",
+            "",
+            "    @property",
+            "    def value(self) -> int:",
+            "        return compute_%02d(self.raw)" % i,
+            "",
+            "    def label(self) -> str:",
+            '        return join_parts(self.kind, self.value, LIMIT_%02d)' % i,
+            "",
+            "    def __eq__(self, other: object) -> bool:",
+            "        if not isinstance(other, Item_%02d):" % i,
+            "            return NotImplemented",
+            "        return self.value == other.value",
+            "",
+            "    def __lt__(self, other: Item_%02d) -> bool:" % i,
+            "        return self.value < other.value",
+            "",
+            "    def __hash__(self) -> int:",
+            "        return hash((self.kind, self.value))",
+            "",
+        ]
+    out += [
+        "",
+        "# ---- kept in place ----",
+        "",
+        'VERSION = "1.0"',
+        "",
+        "",
+        "def describe() -> str:",
+        "    return join_parts(VERSION, compute_00(1), Item_01(2).label())",
+        "",
+        "",
+        "DEFAULT_TOTAL = LIMIT_03 * 2",
+    ]
+    return "\n".join(out) + "\n"
+
+
+TESTS = '''import asyncio
+import os
+import unittest
+
+from pkg.big import (
+    DEFAULT_TOTAL,
+    LIMIT_05,
+    VERSION,
+    Item_03,
+    _scale_02,
+    _SEPARATOR,
+    compute_04,
+    compute_89,
+    describe,
+    fetch_08,
+    join_parts,
+)
+import pkg.big as big
+
+
+class BigTest(unittest.TestCase):
+    def test_constant(self):
+        self.assertEqual(LIMIT_05, 15)
+
+    def test_private_helper(self):
+        self.assertEqual(_scale_02(-2), 6)
+
+    def test_compute_clamps(self):
+        self.assertEqual(compute_04(100), 14)
+
+    def test_compute_last(self):
+        self.assertEqual(compute_89(1), 6)
+
+    def test_join(self):
+        self.assertEqual(join_parts("a", 1), "a" + os.sep + "|1")
+        self.assertEqual(_SEPARATOR, os.sep + "|")
+
+    def test_async(self):
+        self.assertEqual(asyncio.run(fetch_08(1)), {"id": 8, "value": 2})
+
+    def test_item_order(self):
+        self.assertLess(Item_03(1), Item_03(2))
+        self.assertEqual(Item_03(1), Item_03(1))
+        self.assertGreaterEqual(Item_03(3), Item_03(2))
+
+    def test_item_label(self):
+        self.assertEqual(Item_03(1).label(), join_parts("item-03", 4, 13))
+
+    def test_kept_names(self):
+        self.assertEqual(VERSION, "1.0")
+        self.assertEqual(DEFAULT_TOTAL, 26)
+        self.assertTrue(describe().startswith("1.0"))
+
+    def test_module_attributes(self):
+        self.assertIs(big.os, os)
+        self.assertEqual(big.Item_29(1).value, 2)
+
+    @unittest.skip("documents a skipped case for the count check")
+    def test_skipped(self):
+        pass
+
+
+if __name__ == "__main__":
+    unittest.main()
+'''
+
+
+def main(argv):
+    if len(argv) != 1:
+        sys.stderr.write("usage: gen_big.py <out_root>\n")
+        return 2
+    root = argv[0]
+    for d in ("pkg", "tests"):
+        os.makedirs(os.path.join(root, d), exist_ok=True)
+    files = {"pkg/__init__.py": "", "pkg/big.py": big(), "tests/__init__.py": "", "tests/test_big.py": TESTS}
+    for rel, text in files.items():
+        with open(os.path.join(root, rel), "w", encoding="utf-8", newline="\n") as fh:
+            fh.write(text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/scripts/fixtures/symbol-move-ts/gen_big.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+//
+// gen_big.mjs <repo dir>: writes the TypeScript refactor:split fixture used by scripts/symbol-move-ts.test.sh
+// (forge#4212): src/big.ts (~700 lines: exported consts, non-exported helpers each used only by its exported
+// function, interfaces, classes, async functions, kept code that uses moved names, a relative import), src/util.ts
+// and a node:test suite in test/big.test.ts (one skipped test). Specifiers carry the .ts extension so Node runs
+// the sources with type stripping.
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+const root = process.argv[2];
+if (!root) { process.stderr.write("usage: gen_big.mjs <dir>\n"); process.exit(2); }
+const N = 20;
+const pad = (i) => String(i).padStart(2, "0");
+const out = [];
+out.push("// SPDX-License-Identifier: MIT", "// big.ts: a hotspot module for the split fixture.", "",
+  'import { clamp, type Unit } from "./util.ts";', "");
+for (let i = 0; i < N; i++) out.push(`export const LIMIT_${pad(i)} = ${100 + i};`);
+out.push("");
+for (let i = 0; i < N; i++) {
+  out.push(`// scale step ${i}`, `function _scale_${pad(i)}(x: number): number {`, `  const factor = ${i + 1};`, "  return x * factor;", "}", "");
+  out.push(`/** compute ${i}: scaled and clamped. */`, `export function compute_${pad(i)}(x: number): number {`, `  const scaled = _scale_${pad(i)}(x);`,
+    `  return clamp(scaled, 0, LIMIT_${pad(i)});`, "}", "");
+}
+for (let i = 0; i < N; i++) {
+  out.push(`export interface Item_${pad(i)} {`, "  id: number;", "  unit: Unit;", "}", "");
+  out.push(`export class Store_${pad(i)} {`, `  items: Item_${pad(i)}[] = [];`, `  add(item: Item_${pad(i)}): number {`, "    this.items.push(item);",
+    `    return compute_${pad(i)}(item.id);`, "  }", "", "  size(): number {", "    return this.items.length;", "  }", "}", "");
+}
+for (let i = 0; i < N; i++) {
+  out.push(`export async function fetch_${pad(i)}(x: number): Promise<number> {`, "  await Promise.resolve();", `  return compute_${pad(i)}(x) + 1;`, "}", "");
+}
+out.push("// kept code that uses moved names", "export function summary(): number {", "  return compute_00(1) + LIMIT_01 + new Store_02().size();", "}", "",
+  "function _shared(x: number): number {", "  return x + 1;", "}", "", "export function kept_total(x: number): number {", "  return _shared(x) * 2;", "}", "",
+  "export function ping(n: number): number {", "  return n <= 0 ? 0 : pong(n - 1);", "}", "", "export function pong(n: number): number {", "  return n <= 0 ? 1 : ping(n - 1);", "}");
+
+const test = [
+  'import { test } from "node:test";', 'import assert from "node:assert/strict";',
+  'import { compute_03, LIMIT_05, Store_04, fetch_06, summary, kept_total, ping } from "../src/big.ts";', "",
+  'test("compute clamps", () => { assert.equal(compute_03(1000), 103); assert.equal(compute_03(2), 8); });',
+  'test("limits", () => { assert.equal(LIMIT_05, 105); });',
+  'test("store", () => { const s = new Store_04(); assert.equal(s.add({ id: 2, unit: "m" }), 10); assert.equal(s.size(), 1); });',
+  'test("fetch", async () => { assert.equal(await fetch_06(1), 8); });',
+  'test("kept", () => { assert.equal(summary(), 1 + 101 + 0); assert.equal(kept_total(1), 4); assert.equal(ping(3), 1); });',
+  'test("later", { skip: "not yet" }, () => {});', "",
+];
+
+mkdirSync(path.join(root, "src"), { recursive: true });
+mkdirSync(path.join(root, "test"), { recursive: true });
+writeFileSync(path.join(root, "src/big.ts"), out.join("\n") + "\n");
+writeFileSync(path.join(root, "src/util.ts"),
+  'export type Unit = "m" | "s";\n\nexport function clamp(x: number, lo: number, hi: number): number {\n  return Math.min(hi, Math.max(lo, x));\n}\n');
+writeFileSync(path.join(root, "test/big.test.ts"), test.join("\n"));
+writeFileSync(path.join(root, "package.json"), '{ "name": "split-fixture", "private": true, "type": "module" }\n');

package/scripts/forge-root.test.sh

@@ -341,7 +341,7 @@ hr_check_stub review-pr "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT derive-finding-mi
 hr_check_stub review-pr "$HR_CLASSIFY" PRIORITY_SCRIPT severity-to-priority.sh
 hr_check_stub review-prepare "$HR_PREPARE" CODE_INDEX_SCRIPT code-index.sh
 hr_check_stub review-pr "$HR_CLASSIFY" DEDUP_SCRIPT issue-dedup.sh
-hr_check_block issue "$ROOT/commands/issue.md" DEDUP_SCRIPT issue-dedup.sh
+hr_check_stub issue "$ROOT/commands/issue.md" ISSUE_CREATE_SCRIPT issue-create.sh
 stub_block "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT > "$T/hr_dm.sh"
 stub_block "$HR_CLASSIFY" PRIORITY_SCRIPT > "$T/hr_pr.sh"
 # no bare cwd-relative helper call in either review spec

package/scripts/hotspots.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# hotspots.sh — deterministic size and churn facts for named files (forge#4195). No LLM, no network: git + wc + jq,
+# yq (optional) only to read forge.yaml. Run from the repo root.
+#
+# Usage: hotspots.sh [--base <ref>] [--] <path>...
+# Config: forge.yaml maintenance.hotspot {enabled, file_lines, growth_lines, exclude_globs}; defaults true/2000/150/[]
+#   (also when forge.yaml or yq is missing).
+# Output (stdout, one JSON object):
+#   {"enabled","file_lines","growth_lines","files":[{path,lines,commits_90d,hotspot,over,excluded,base_lines,growth}]}
+# lines = `wc -l` of the working-tree file (0 when missing); commits_90d = `git rev-list --count --since=90.days HEAD`;
+# hotspot = lines × commits_90d; over = lines > file_lines; excluded = linguist-generated / linguist-vendored set by
+# .gitattributes, or a match of an exclude_glob (shell pattern, `*` crosses `/`). Without --base no blob is read and
+# base_lines/growth are null; with --base they are the line count at git merge-base(<ref>, HEAD) (0 when absent there)
+# and lines - base_lines. enabled:false prints files:[] and does no per-file work.
+# Exit: 0 ok | 2 usage or bad ref. bash 3.2 portable.
+set -uo pipefail
+
+die() { echo "hotspots: $*" >&2; exit 2; }
+command -v jq >/dev/null 2>&1 || die "jq is required"
+BASE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --base) [ $# -ge 2 ] && [ -n "$2" ] || die "usage: hotspots.sh [--base <ref>] [--] <path>..."; BASE="$2"; shift 2 ;;
+    --) shift; break ;;
+    -*) die "unknown option: $1" ;;
+    *) break ;;
+  esac
+done
+
+# ---- config: maintenance.hotspot as JSON, {} when unreadable ----
+CFG='{}'
+if [ -f forge.yaml ] && command -v yq >/dev/null 2>&1; then
+  c=$(yq -o=json '.maintenance.hotspot // {}' forge.yaml 2>/dev/null) || c=""
+  printf '%s' "$c" | jq -e 'type == "object"' >/dev/null 2>&1 && CFG="$c"
+fi
+CFG=$(printf '%s' "$CFG" | jq -c '
+  def pos($d): if type == "number" and . > 0 then floor else $d end;
+  { enabled: (.enabled != false), file_lines: (.file_lines | pos(2000)), growth_lines: (.growth_lines | pos(150)),
+    exclude_globs: ([(.exclude_globs // [])[]? | strings]) }')
+ENABLED=$(printf '%s' "$CFG" | jq -r '.enabled')
+FILE_LINES=$(printf '%s' "$CFG" | jq -r '.file_lines')
+GROWTH_LINES=$(printf '%s' "$CFG" | jq -r '.growth_lines')
+head_json() { printf '%s' "$CFG" | jq -c --argjson files "$1" '{enabled, file_lines, growth_lines, files: $files}'; }
+[ "$ENABLED" = true ] || { head_json '[]'; exit 0; }
+
+MB=""
+if [ -n "$BASE" ]; then
+  git rev-parse --verify -q "$BASE^{commit}" >/dev/null || die "bad base ref: $BASE"
+  MB=$(git merge-base "$BASE" HEAD) || die "no merge base for $BASE and HEAD"
+fi
+HAS_HEAD=0; git rev-parse --verify -q "HEAD^{commit}" >/dev/null && HAS_HEAD=1
+GLOBS=$(printf '%s' "$CFG" | jq -r '.exclude_globs[]')
+
+T=$(mktemp -d "${TMPDIR:-/tmp}/hotspots.XXXXXX") || die "mktemp failed"
+trap 'rm -rf "$T"' EXIT
+: > "$T/rows"
+# one history walk per file, 8 at a time: wall time is the slowest batch, not the sum
+i=0
+for p in "$@"; do
+  i=$((i+1))
+  [ "$HAS_HEAD" = 1 ] && [ -n "${p#./}" ] && { git rev-list --count --since=90.days HEAD -- "${p#./}" > "$T/c.$i" 2>/dev/null & }
+  [ $((i % 8)) -eq 0 ] && wait
+done
+wait
+i=0
+for p in "$@"; do
+  i=$((i+1))
+  p=${p#./}
+  [ -n "$p" ] || continue
+  lines=0; [ -f "$p" ] && lines=$(wc -l < "$p" | tr -d ' ')
+  commits=$(cat "$T/c.$i" 2>/dev/null); case "$commits" in ''|*[!0-9]*) commits=0 ;; esac
+  excluded=false
+  if git check-attr linguist-generated linguist-vendored -- "$p" 2>/dev/null | grep -qE ': (set|true)$'; then excluded=true; fi
+  if [ "$excluded" = false ] && [ -n "$GLOBS" ]; then
+    while IFS= read -r g; do
+      [ -n "$g" ] || continue
+      # shellcheck disable=SC2254
+      case "$p" in $g) excluded=true; break ;; esac
+    done <<EOF
+$GLOBS
+EOF
+  fi
+  base_lines=null; growth=null
+  if [ -n "$MB" ]; then
+    base_lines=0
+    git cat-file -e "$MB:$p" 2>/dev/null && base_lines=$(git show "$MB:$p" | wc -l | tr -d ' ')
+    growth=$((lines - base_lines))
+  fi
+  printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$p" "$lines" "$commits" "$excluded" "$base_lines" "$growth" >> "$T/rows"
+done
+
+FILES=$(jq -R -s -c --argjson fl "$FILE_LINES" '
+  [split("\n")[] | select(length > 0) | split("\t") |
+   { path: .[0], lines: (.[1] | tonumber), commits_90d: (.[2] | tonumber) } as $r |
+   $r + { hotspot: ($r.lines * $r.commits_90d), over: ($r.lines > $fl), excluded: (.[3] == "true"),
+          base_lines: (.[4] | fromjson), growth: (.[5] | fromjson) }]' < "$T/rows")
+head_json "$FILES"

package/scripts/hotspots.test.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# hotspots.test.sh — cases for scripts/hotspots.sh (forge#4195).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/hotspots.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/hotspots-test.XXXXXX")"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+eq() { if [ "$2" = "$3" ]; then ok; else bad "$1 (got: $2 want: $3)"; fi }
+q() { printf '%s' "$OUT" | jq -c "$1"; }
+HAVE_YQ=1; yq -o=json '.' - <<<'a: 1' 2>/dev/null | grep -q '"a"' || HAVE_YQ=0
+
+new_repo() {
+  rm -rf "$TMP/w"; mkdir -p "$TMP/w"; cd "$TMP/w" || exit 1
+  git init -q -b main; git config user.email t@example.com; git config user.name t; git config commit.gpgsign false
+}
+commit() { git add -A; git commit -qm "$1"; }
+lines() { i=0; : > "$1"; while [ $i -lt "$2" ]; do echo "l$i" >> "$1"; i=$((i+1)); done; }
+
+# ---- 1. exact lines, commits_90d, hotspot, over; old commits outside the window are not counted ----
+new_repo
+lines big.py 2100; GIT_COMMITTER_DATE="2000-01-01T00:00:00Z" GIT_AUTHOR_DATE="2000-01-01T00:00:00Z" commit old
+echo x >> big.py; commit c1
+echo y >> big.py; lines small.py 10; commit c2
+OUT="$(bash "$S" big.py ./small.py missing/gone.py)"; rc=$?
+eq "rc" "$rc" 0
+eq "defaults" "$(q '[.enabled,.file_lines,.growth_lines]')" '[true,2000,150]'
+eq "big facts" "$(q '.files[0]')" '{"path":"big.py","lines":2102,"commits_90d":2,"hotspot":4204,"over":true,"excluded":false,"base_lines":null,"growth":null}'
+eq "small facts (./ stripped)" "$(q '.files[1] | [.path,.lines,.commits_90d,.over]')" '["small.py",10,1,false]'
+eq "missing file" "$(q '.files[2] | [.path,.lines,.commits_90d,.over]')" '["missing/gone.py",0,0,false]'
+OUT="$(bash "$S")"; eq "no paths" "$(q '.files')" '[]'
+
+# ---- 2. --base growth: merge-base side, new file counts from 0 ----
+git checkout -q -b feat
+lines extra 200; cat extra >> big.py; lines fresh.py 30; commit grow
+OUT="$(bash "$S" --base main -- big.py fresh.py)"
+eq "growth" "$(q '.files[0] | [.base_lines,.growth,.lines]')" '[2102,200,2302]'
+eq "new file growth" "$(q '.files[1] | [.base_lines,.growth]')" '[0,30]'
+bash "$S" --base no-such-ref big.py >/dev/null 2>&1; eq "bad ref exit" "$?" 2
+bash "$S" --base >/dev/null 2>&1; eq "usage exit" "$?" 2
+bash "$S" --bogus x >/dev/null 2>&1; eq "unknown option exit" "$?" 2
+
+# ---- 3. exclusions: linguist-generated, linguist-vendored, forge.yaml globs ----
+mkdir -p gen vendor/lib dist
+lines gen/api.py 2500; lines vendor/lib/x.js 2500; lines dist/bundle.js 2500
+printf 'gen/** linguist-generated\nvendor/** linguist-vendored=true\n' > .gitattributes
+commit gen
+OUT="$(bash "$S" gen/api.py vendor/lib/x.js dist/bundle.js big.py)"
+eq "attr exclusions" "$(q '[.files[] | .excluded]')" '[true,true,false,false]'
+if [ "$HAVE_YQ" = 1 ]; then
+  printf 'maintenance:\n  hotspot:\n    file_lines: 100\n    growth_lines: 5\n    exclude_globs: ["dist/*", "*.lock"]\n' > forge.yaml
+  OUT="$(bash "$S" dist/bundle.js small.py big.py)"
+  eq "config thresholds" "$(q '[.file_lines,.growth_lines]')" '[100,5]'
+  eq "glob exclusion" "$(q '[.files[] | .excluded]')" '[true,false,false]'
+  eq "over uses configured file_lines" "$(q '[.files[] | .over]')" '[true,false,true]'
+  printf 'maintenance:\n  hotspot:\n    enabled: false\n' > forge.yaml
+  OUT="$(bash "$S" big.py)"
+  eq "opt-out" "$(q '[.enabled,.files]')" '[false,[]]'
+  printf 'maintenance:\n  hotspot:\n    file_lines: nope\n' > forge.yaml
+  OUT="$(bash "$S" big.py)"; eq "bad value falls back" "$(q '.file_lines')" 2000
+  rm -f forge.yaml
+else
+  echo "SKIP: forge.yaml cases need mikefarah yq v4"
+fi
+# yq missing: defaults, still exit 0
+mkdir -p "$TMP/noyq"; printf '#!/bin/sh\nexit 1\n' > "$TMP/noyq/yq"; chmod +x "$TMP/noyq/yq"
+printf 'maintenance:\n  hotspot:\n    file_lines: 100\n' > forge.yaml
+OUT="$(PATH="$TMP/noyq:$PATH" bash "$S" big.py)"; eq "yq unusable: defaults" "$(q '.file_lines')" 2000
+rm -f forge.yaml
+
+# ---- 4. 30k-commit repo: exact counts under 1 s, no blob reads, no network ----
+rm -rf "$TMP/big"; git init -q -b main "$TMP/big"; cd "$TMP/big" || exit 1
+now=$(date +%s)
+awk -v now="$now" 'BEGIN { for (i = 1; i <= 30000; i++) {
+  ts = (i > 27000) ? now - (30000 - i) * 60 : now - 200 * 86400 - (27000 - i) * 600
+  print "commit refs/heads/main"; print "mark :" i; print "committer t <t@e> " ts " +0000"; print "data 1"; print "x"
+  if (i > 1) print "from :" (i - 1)
+  f = (i % 10 == 0) ? "hot.py" : "other" (i % 50) ".txt"; c = "line " i
+  print "M 644 inline " f; print "data " length(c) + 1; print c; print "" } }' | git fast-import --quiet
+git checkout -q main
+mkdir -p "$TMP/bin"
+for t in gh curl wget npm npx pnpm yarn nc ssh; do printf '#!/bin/sh\necho "%s" >> "%s/net.log"\nexit 1\n' "$t" "$TMP" > "$TMP/bin/$t"; chmod +x "$TMP/bin/$t"; done
+best=""
+for _ in 1 2 3; do
+  start=$(date +%s%N 2>/dev/null)
+  OUT="$(PATH="$TMP/bin:$PATH" GIT_TRACE2_EVENT="$TMP/trace.json" bash "$S" hot.py other1.txt other2.txt other3.txt)"
+  end=$(date +%s%N 2>/dev/null)
+  case "$start$end" in *N*|"") best=0; break ;; esac
+  ms=$(( (end - start) / 1000000 )); if [ -z "$best" ] || [ "$ms" -lt "$best" ]; then best=$ms; fi
+done
+eq "30k exact commits" "$(q '[.files[] | .commits_90d]')" '[300,60,60,60]'
+eq "30k exact lines" "$(q '[.files[] | .lines]')" '[1,1,1,1]'
+if [ "$best" -lt 1000 ]; then ok; else bad "30k-commit run took ${best} ms (limit 1000)"; fi
+grep -q '"rev-list"' "$TMP/trace.json" && ok || bad "git trace not captured"
+if grep -qE '"(cat-file|show)"' "$TMP/trace.json"; then bad "blob read without --base"; else ok; fi
+if [ -e "$TMP/net.log" ]; then bad "network tool invoked: $(tr '\n' ' ' < "$TMP/net.log")"; else ok; fi
+
+echo "hotspots.test.sh: $PASS passed, $FAILN failed"
+[ "$FAILN" -eq 0 ]