instar 0.28.75 → 0.28.76

package/scripts/add-migration-marker.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * add-migration-marker.js — stamp every pre-existing direct destructive
+ * git/fs callsite with `// safe-git-allow: incremental-migration` so the
+ * lint rule (`scripts/lint-no-direct-destructive.js`) accepts the existing
+ * codebase during the transitional period.
+ *
+ * Idempotent. Running it multiple times is safe — already-marked callsites
+ * are skipped. After PR #2 migrates every callsite through SafeGitExecutor /
+ * SafeFsExecutor, this script can be deleted along with the marker support
+ * in the lint rule.
+ *
+ * Mechanism:
+ *   1. Run the lint rule with markers temporarily disabled to collect every
+ *      pre-existing violation as (file, line) pairs.
+ *   2. For each unique line in each file, prepend a `// safe-git-allow:
+ *      incremental-migration` comment matching the indentation of the
+ *      flagged line. Skip if the marker already exists immediately above
+ *      or on the same line.
+ *   3. Write the file back.
+ *
+ * Usage:
+ *   node scripts/add-migration-marker.js
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const ROOT = path.resolve(__dirname, '..');
+
+const MARKER = '// safe-git-allow: incremental-migration';
+const MARKER_RE = /\/\/\s*safe-git-allow:\s*incremental-migration\b/;
+
+function collectViolations() {
+  // Run lint with the marker disabled by setting an env override the lint
+  // rule respects. Easier: pass --no-marker-suppression. The lint rule
+  // doesn't support that flag, so instead we set INSTAR_DISABLE_MIGRATION_MARKER=1
+  // and have the lint rule honor it.
+  const env = { ...process.env, INSTAR_DISABLE_MIGRATION_MARKER: '1' };
+  const result = spawnSync(process.execPath, [path.join(ROOT, 'scripts/lint-no-direct-destructive.js')], {
+    cwd: ROOT,
+    env,
+    encoding: 'utf8',
+  });
+  // Lint exits 1 on violations. We parse stderr regardless.
+  const stderr = result.stderr || '';
+
+  // Output format from lint:
+  //   <relpath>:<line>:<col>
+  //     <message>
+  const violations = [];
+  const lines = stderr.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^\s+([^:\s][^:]*):(\d+):(\d+)\s*$/);
+    if (m) {
+      violations.push({ file: m[1], line: parseInt(m[2], 10) });
+    }
+  }
+  return violations;
+}
+
+function applyMarkers(violations) {
+  // Group by file.
+  const byFile = new Map();
+  for (const v of violations) {
+    if (!byFile.has(v.file)) byFile.set(v.file, new Set());
+    byFile.get(v.file).add(v.line);
+  }
+
+  let marked = 0;
+  let skipped = 0;
+  for (const [relFile, lineSet] of byFile) {
+    const full = path.resolve(ROOT, relFile);
+    let text;
+    try {
+      text = fs.readFileSync(full, 'utf8');
+    } catch {
+      continue;
+    }
+    const orig = text.split('\n');
+
+    // Sort target lines DESCENDING so insertions don't shift later targets.
+    const targets = Array.from(lineSet).sort((a, b) => b - a);
+    const out = orig.slice();
+
+    for (const lineNum of targets) {
+      const idx = lineNum - 1; // 0-based
+      if (idx < 0 || idx >= out.length) continue;
+      const targetLine = out[idx];
+      // Skip if marker already on the target line or on the line above.
+      if (MARKER_RE.test(targetLine)) { skipped++; continue; }
+      if (idx - 1 >= 0 && MARKER_RE.test(out[idx - 1])) { skipped++; continue; }
+
+      // Match the indentation of the target line.
+      const indentMatch = targetLine.match(/^(\s*)/);
+      const indent = indentMatch ? indentMatch[1] : '';
+      out.splice(idx, 0, `${indent}${MARKER}`);
+      marked++;
+    }
+    fs.writeFileSync(full, out.join('\n'));
+  }
+  return { marked, skipped };
+}
+
+function main() {
+  const violations = collectViolations();
+  if (violations.length === 0) {
+    console.log('No violations detected — nothing to mark.');
+    return 0;
+  }
+  console.log(`Found ${violations.length} flagged callsites.`);
+  const { marked, skipped } = applyMarkers(violations);
+  console.log(`Stamped ${marked} new marker(s); ${skipped} already had a marker.`);
+  return 0;
+}
+
+process.exit(main());

package/scripts/analyze-release.js

@@ -44,15 +44,18 @@ function log(msg) {
 
 function getLastReleaseTag() {
   try {
+    // safe-git-allow: incremental-migration
     return execSync('git describe --tags --abbrev=0', { cwd: ROOT, encoding: 'utf-8' }).trim();
   } catch {
     // No tags at all — diff against the initial commit
+    // safe-git-allow: incremental-migration
     return execSync('git rev-list --max-parents=0 HEAD', { cwd: ROOT, encoding: 'utf-8' }).trim();
   }
 }
 
 function getCommitsSinceTag(tag) {
   try {
+    // safe-git-allow: incremental-migration
     const raw = execSync(`git log ${tag}..HEAD --oneline --no-merges`, { cwd: ROOT, encoding: 'utf-8' });
     return raw.trim().split('\n').filter(Boolean).map(line => {
       const [hash, ...rest] = line.split(' ');
@@ -65,6 +68,7 @@ function getCommitsSinceTag(tag) {
 
 function getDiffStat(tag) {
   try {
+    // safe-git-allow: incremental-migration
     return execSync(`git diff ${tag}..HEAD --stat`, { cwd: ROOT, encoding: 'utf-8' }).trim();
   } catch {
     return '';
@@ -73,6 +77,7 @@ function getDiffStat(tag) {
 
 function getChangedFiles(tag) {
   try {
+    // safe-git-allow: incremental-migration
     const raw = execSync(`git diff ${tag}..HEAD --name-status`, { cwd: ROOT, encoding: 'utf-8' });
     return raw.trim().split('\n').filter(Boolean).map(line => {
       const [status, ...pathParts] = line.split('\t');
@@ -85,6 +90,7 @@ function getChangedFiles(tag) {
 
 function getFileDiff(tag, file) {
   try {
+    // safe-git-allow: incremental-migration
     return execSync(`git diff ${tag}..HEAD -- "${file}"`, { cwd: ROOT, encoding: 'utf-8' });
   } catch {
     return '';

package/scripts/check-contract-evidence.js

@@ -36,12 +36,14 @@ const ADAPTER_PATHS = [
 let adapterChanges = [];
 try {
   // Find files changed since the last npm version tag
+  // safe-git-allow: incremental-migration
   const lastTag = execSync('git describe --tags --abbrev=0 2>/dev/null || echo ""', {
     encoding: 'utf-8',
     cwd: ROOT,
   }).trim();
 
   const diffBase = lastTag || 'HEAD~10';
+  // safe-git-allow: incremental-migration
   const changedFiles = execSync(`git diff --name-only ${diffBase}...HEAD 2>/dev/null || echo ""`, {
     encoding: 'utf-8',
     cwd: ROOT,

package/scripts/destructive-command-shim.js

@@ -102,6 +102,7 @@ function dryRunGitClean(cwd, args) {
   // Use -n to count what would be removed
   const dryArgs = ['-C', cwd, 'clean', '-n', ...args.filter(a => a !== '-f')];
   try {
+    // safe-git-allow: incremental-migration
     const out = execFileSync('git', dryArgs, { encoding: 'utf-8', timeout: 5000 });
     return out.split('\n').filter(Boolean).length;
   } catch { return Number.POSITIVE_INFINITY; }

package/scripts/fix-better-sqlite3.cjs

@@ -167,6 +167,7 @@ function tryPrebuild(pkgDir, betterSqliteVersion) {
     console.log(`[fix-better-sqlite3] Downloading ${url}`);
     execSync(`curl -L -f -o "${tmpFile}" "${url}"`, { stdio: 'pipe', timeout: 30000 });
 
+    // safe-git-allow: incremental-migration
     if (fs.existsSync(buildDir)) fs.rmSync(buildDir, { recursive: true });
     execSync(`tar xzf "${tmpFile}" -C "${pkgDir}"`, { stdio: 'pipe' });
     return true;
@@ -174,6 +175,7 @@ function tryPrebuild(pkgDir, betterSqliteVersion) {
     console.warn(`[fix-better-sqlite3] prebuild download/extract failed: ${err.message}`);
     return false;
   } finally {
+    // safe-git-allow: incremental-migration
     try { fs.unlinkSync(tmpFile); } catch {}
   }
 }

package/scripts/generate-builtin-manifest.cjs

@@ -18,6 +18,7 @@ const ROOT = path.resolve(__dirname, '..');
 
 // Guard: warn if working tree is dirty (manifest won't match committed source in CI)
 try {
+  // safe-git-allow: incremental-migration
   const status = execSync('git status --porcelain -- src/', { cwd: ROOT, encoding: 'utf-8' }).trim();
   if (status) {
     console.warn('\n⚠️  WARNING: Working tree has uncommitted changes in src/.');

package/scripts/instar-dev-precommit.js

@@ -47,6 +47,7 @@ if (fs.existsSync(path.join(ROOT, '.git', 'MERGE_HEAD'))) {
 
 let stagedOutput;
 try {
+  // safe-git-allow: incremental-migration
   stagedOutput = execSync('git diff --cached --name-only --diff-filter=ACMR', {
     cwd: ROOT,
     encoding: 'utf8',
@@ -93,6 +94,7 @@ if (inScopeFiles.length === 0) {
 
 let addedOutput = '';
 try {
+  // safe-git-allow: incremental-migration
   addedOutput = execSync('git diff --cached --name-only --diff-filter=A', {
     cwd: ROOT,
     encoding: 'utf8',