inup 1.6.0 → 1.6.3

package/README.md

@@ -51,6 +51,8 @@ inup [options]
 --package-manager <name>      Force package manager (npm, yarn, pnpm, bun)
 --json                        Print a machine-readable JSON report and exit (read-only)
 -c, --check                   Exit non-zero if updates exist, without writing (for CI)
+--apply                       Non-interactively write upgrades + install (for CI/automation)
+--target <level>              With --apply: how far to bump — minor (default) | patch | latest
 --debug                       Write verbose debug logs
 ```
 
@@ -61,11 +63,19 @@ pipeline waiting on the interactive UI. Both `--json` and `--check` are **read-o
 they never edit `package.json` or install.
 
 ```bash
-inup --check            # exit 1 if anything is outdated → fails the build
-inup --json | jq        # structured drift report for dashboards/bots
-inup | cat              # plain line-based report when piped to a log
+inup --check                 # exit 1 if anything is outdated → fails the build
+inup --json | jq             # structured drift report for dashboards/bots
+inup | cat                   # plain line-based report when piped to a log
+inup --apply                 # write safe in-range bumps + install (non-interactive)
+inup --apply --target latest # include major bumps; --json to also emit the report
 ```
 
+Unlike `--json` and `--check`, **`--apply` writes**: it bumps `package.json` and runs your package
+manager's install to update the lockfile. By default (`--target minor`) it only applies **in-range**
+updates and leaves majors for you to review; `--target latest` includes majors. It honors `.inuprc`
+(`ignore`, `exclude`, `scanDirs`) exactly as the report does — a package the config excludes is
+never written. With `--apply --json`, the install output goes to stderr so stdout stays pure JSON.
+
 Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
 (declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
 from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
@@ -81,6 +91,73 @@ agents can pin to a known shape.
 Output hygiene: with `--json`, stdout carries **only** the JSON document; all progress and warnings go
 to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
 
+## GitHub Action — one rolling upgrade PR
+
+Run inup on a schedule and get **one rolling pull request** with safe upgrades applied. Re-runs update
+the same PR instead of opening new ones.
+
+Add this workflow to **your** repo:
+
+```yaml
+# .github/workflows/inup.yml
+name: inup
+on:
+  schedule:
+    - cron: '0 6 * * *' # daily at 06:00 UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: donfear/inup@v1
+        with:
+          target: minor # minor (default) | patch | latest
+```
+
+That's it. Also enable Settings → Actions → General → **Workflow permissions** →
+**"Allow GitHub Actions to create and approve pull requests"** so the action can open the PR.
+
+### Commit as you, not the bot
+
+By default the upgrade commit is authored by `github-actions[bot]`. To attribute it to **you**, store
+your name/email as repo secrets (Settings → Secrets and variables → Actions) and pass `committer`/`author`:
+
+```yaml
+      - uses: donfear/inup@v1
+        with:
+          committer: ${{ secrets.GH_USERNAME }} <${{ secrets.GH_EMAIL }}>
+          author: ${{ secrets.GH_USERNAME }} <${{ secrets.GH_EMAIL }}>
+```
+
+### All inputs
+
+| Input | Default | Description |
+|---|---|---|
+| `target` | `minor` | How far to bump: `minor` (in-range), `patch`, or `latest` (includes majors). |
+| `directory` | `.` | Directory to run in. |
+| `package-manager` | _(auto)_ | Force `npm`/`yarn`/`pnpm`/`bun`; empty auto-detects from the lockfile. |
+| `node-version` | `22` | Node.js version for the run (minimum `22.19`). |
+| `inup-version` | `latest` | inup version to run (pin for reproducible runs). |
+| `pr-branch` | `inup/dependency-upgrades` | Branch for the rolling PR. |
+| `pr-title` | `chore(deps): dependency upgrades` | PR title. |
+| `commit-message` | `chore(deps): upgrade dependencies via inup` | Commit message. |
+| `base` | _(default branch)_ | Base branch the PR targets. |
+| `labels` | `dependencies` | Labels to apply to the PR. |
+| `token` | `${{ github.token }}` | Token to push + open the PR. Pass a PAT to also trigger CI on the PR. |
+| `committer` | `github-actions[bot]` | Commit committer, as `Name <email>`. |
+| `author` | _(triggering user)_ | Commit author, as `Name <email>`. |
+
+Outputs: `outdated`, `vulnerable`, `pull-request-number`.
+
+> `@v1` floats to the latest `1.x` release; pin to `@v1.6.2` or a SHA for reproducible runs. inup
+> honors your `.inuprc` (`ignore`, `exclude`, `scanDirs`).
+
 ## Keyboard Shortcuts
 
 <!-- KEYS:START -->
@@ -112,7 +189,7 @@ to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
 
 ## Privacy
 
-No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. When needed for exact-version manifests, inup may fetch a pinned `package.json` from jsDelivr.
+No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. Changelog and release notes are fetched from GitHub.
 
 ## License
 

package/dist/cli.js

@@ -15,6 +15,10 @@ const config_1 = require("./config");
 const utils_1 = require("./utils");
 const git_1 = require("./utils/git");
 const ui_1 = require("./ui");
+// Load developer-only toggles from <inup-repo>/.env.local before anything reads
+// env. Best-effort, gitignored, never overrides real env. Lets perf/debug be
+// "set once" across every project without shell config.
+(0, utils_1.loadInupLocalEnv)();
 const program = new commander_1.Command();
 async function runCli(options) {
     // Resolve colored-output intent before anything renders.
@@ -24,8 +28,14 @@ async function runCli(options) {
         (0, utils_1.enableDebugLogging)();
     }
     // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
-    // interactive mode; everything else routes through the read-only headless report path.
-    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check;
+    // interactive mode; everything else routes through the headless path (read-only, unless --apply).
+    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check && !options.apply;
+    // Validate --target early so a typo fails fast instead of silently defaulting.
+    if (options.target && !['minor', 'patch', 'latest'].includes(options.target)) {
+        console.error(chalk_1.default.red(`Invalid target: ${options.target}`));
+        console.error(chalk_1.default.yellow('Valid options: minor, patch, latest'));
+        process.exit(1);
+    }
     // The dirty-tree prompt would hang without a TTY; headless is read-only anyway, so skip it.
     if (interactive) {
         const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
@@ -88,11 +98,19 @@ async function runCli(options) {
         showOptionalDependencyVulnerabilities: projectConfig.showOptionalDependencyVulnerabilities ?? false,
         debug: options.debug || process.env.INUP_DEBUG === '1',
         saveExact: options.saveExact ?? false,
+        // Adaptive concurrency defaults ON; it's an internal/dev toggle with no public
+        // flag. Set INUP_ADAPTIVE=0 to disable (e.g. for A/B perf comparisons).
+        adaptive: process.env.INUP_ADAPTIVE !== '0',
     };
     // Non-interactive (piped / CI / --json / --check) routes to the read-only headless feature;
     // only the interactive path builds the full TUI runner.
     if (!interactive) {
-        await new headless_1.HeadlessRunner(runnerOptions).run({ json: options.json, check: options.check });
+        await new headless_1.HeadlessRunner(runnerOptions).run({
+            json: options.json,
+            check: options.check,
+            apply: options.apply,
+            target: options.target || 'minor',
+        });
         return;
     }
     await new index_1.UpgradeRunner(runnerOptions).run();
@@ -133,6 +151,8 @@ program
     .option('--save-exact', 'write exact versions instead of preserving the range prefix (^/~)')
     .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
     .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
+    .option('--apply', 'non-interactively write upgrades to package.json and run install (honors .inuprc ignore/exclude)')
+    .option('--target <level>', 'with --apply: how far to bump — minor | patch | latest (default: minor, in-range only)', 'minor')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/config/constants.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
+exports.POOL_CONNECTIONS = exports.REQUEST_TIMEOUT = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
 var package_meta_1 = require("./package-meta");
 Object.defineProperty(exports, "PACKAGE_NAME", { enumerable: true, get: function () { return package_meta_1.PACKAGE_NAME; } });
 Object.defineProperty(exports, "PACKAGE_VERSION", { enumerable: true, get: function () { return package_meta_1.PACKAGE_VERSION; } });
 exports.NPM_REGISTRY_URL = 'https://registry.npmjs.org';
-exports.MAX_CONCURRENT_REQUESTS = 150;
-exports.CACHE_TTL = 5 * 60 * 1000; // 5 minutes in milliseconds
 exports.REQUEST_TIMEOUT = 60000; // 60 seconds in milliseconds
+// Upper bound for both the undici Pool's connection count and the adaptive
+// concurrency controller's ceiling, kept as one const so they never drift apart.
+// With pipelining:1, effective in-flight requests are capped by the pool's
+// connection count, so the controller must never ramp past it.
+exports.POOL_CONNECTIONS = 24;
 //# sourceMappingURL=constants.js.map

package/dist/core/package-detector.js

@@ -55,12 +55,14 @@ class PackageDetector {
     maxDepth;
     batchSize = 10;
     maxConcurrency = 10;
+    adaptive;
     constructor(options) {
         this.cwd = options?.cwd || process.cwd();
         this.excludePatterns = options?.excludePatterns || [];
         this.scanDirs = options?.scanDirs || [];
         this.ignorePackages = options?.ignorePackages || [];
         this.maxDepth = options?.maxDepth ?? 10;
+        this.adaptive = options?.adaptive ?? true;
         this.packageJsonPath = (0, utils_1.findPackageJson)(this.cwd);
         if (this.packageJsonPath) {
             this.packageJson = (0, utils_1.readPackageJson)(this.packageJsonPath);
@@ -69,6 +71,19 @@ class PackageDetector {
     hasPackageJson() {
         return this.packageJsonPath !== null && this.packageJson !== null;
     }
+    /**
+     * The resolved fetch configuration for this run, for perf logging. Exposes the
+     * exact values handed to the registry fetcher so a logged run is reproducible.
+     */
+    getPerfConfig() {
+        return {
+            cwd: this.cwd,
+            adaptive: this.adaptive,
+            maxConcurrency: this.maxConcurrency,
+            batchSize: this.batchSize,
+            poolConnections: config_1.POOL_CONNECTIONS,
+        };
+    }
     async getOutdatedPackages() {
         const packages = [];
         await this.streamOutdatedPackages((event) => {
@@ -109,6 +124,11 @@ class PackageDetector {
             currentVersions: prepared.currentVersions,
             batchSize: this.batchSize,
             maxConcurrency: this.maxConcurrency,
+            adaptive: this.adaptive,
+            onControlTick: (tick) => performanceTracker.recordControlTick(tick),
+            onPackageTiming: (0, debug_1.isPerfLoggingEnabled)()
+                ? (name, latencyMs) => performanceTracker.recordPackageTiming({ name, latencyMs })
+                : undefined,
             onBatchReady: (batch) => {
                 const batchStart = lastBatchEndAt;
                 let batchFailedCount = 0;

package/dist/core/upgrade-runner.js

@@ -92,6 +92,14 @@ class UpgradeRunner {
                         progress.isLoading = event.payload.progress.isLoading;
                         performanceTracker.mark('firstBatch');
                         performanceTracker.mark('allLoaded');
+                        if ((0, debug_1.isPerfLoggingEnabled)()) {
+                            (0, debug_1.writePerfLog)({
+                                ...this.detector.getPerfConfig(),
+                                packageManager: this.packageManager.name,
+                                mode: 'interactive',
+                                env: (0, debug_1.perfEnv)(),
+                            }, performanceTracker.snapshot());
+                        }
                         refreshUI?.();
                     }
                 });

package/dist/core/upgrader.js

@@ -12,12 +12,17 @@ const child_process_1 = require("child_process");
 const utils_1 = require("../utils");
 class PackageUpgrader {
     packageManager;
-    constructor(packageManager) {
+    quiet;
+    /** When quiet, send our own progress to stderr so stdout stays reserved for the JSON document. */
+    log;
+    constructor(packageManager, options) {
         this.packageManager = packageManager;
+        this.quiet = options?.quiet ?? false;
+        this.log = this.quiet ? (msg) => console.error(msg) : (msg) => console.log(msg);
     }
     async upgradePackages(choices, _packageInfos) {
         if (choices.length === 0) {
-            console.log(chalk_1.default.yellow('No packages to upgrade.'));
+            this.log(chalk_1.default.yellow('No packages to upgrade.'));
             return;
         }
         // Group choices by package.json path and dependency type
@@ -26,12 +31,12 @@ class PackageUpgrader {
             if (choiceList.length === 0)
                 continue;
             const [packageJsonPath, type] = fileAndType.split('|');
-            console.log(`Processing ${type} in ${packageJsonPath}`);
+            this.log(`Processing ${type} in ${packageJsonPath}`);
             await this.upgradeChoiceGroup(choiceList, packageJsonPath, type);
         }
         // Count unique packages upgraded
         const uniquePackages = new Set(choices.map((c) => c.name));
-        console.log(chalk_1.default.green(`\n✅ Successfully upgraded ${uniquePackages.size} package(s)!`));
+        this.log(chalk_1.default.green(`\n✅ Successfully upgraded ${uniquePackages.size} package(s)!`));
         // Execute package manager install after all upgrades are complete
         await this.runInstall(choices);
     }
@@ -50,16 +55,23 @@ class PackageUpgrader {
             (0, utils_1.executeCommand)(`${this.packageManager.name} --version`, installDir);
         }
         catch (error) {
-            console.log(chalk_1.default.yellow(`\n⚠️  ${this.packageManager.displayName} is detected but not installed on your system.\n` +
+            this.log(chalk_1.default.yellow(`\n⚠️  ${this.packageManager.displayName} is detected but not installed on your system.\n` +
                 `Please run the install command manually:\n` +
                 `  cd ${installDir}\n` +
                 `  ${this.packageManager.installCommand}\n`));
             return; // Skip install, let user do it manually
         }
-        console.log(chalk_1.default.cyan(`\n📦 Running ${this.packageManager.installCommand}...\n`));
-        const result = (0, child_process_1.spawnSync)(this.packageManager.installCommand, {
+        // We just rewrote package.json, so the install must be allowed to regenerate the lockfile.
+        // pnpm/yarn default to frozen/immutable installs under CI; writeInstallCommand opts out.
+        const installCommand = this.packageManager.writeInstallCommand ?? this.packageManager.installCommand;
+        this.log(chalk_1.default.cyan(`\n📦 Running ${installCommand}...\n`));
+        // In quiet mode, send the install child's stdout to *our* stderr (fd 2). The child uses
+        // inherited fds, so its progress output bypasses any JS shim — redirecting at spawn time is
+        // the only reliable way to keep stdout reserved for the --json document. stderr stays inherited.
+        const stdio = this.quiet ? ['inherit', 2, 'inherit'] : 'inherit';
+        const result = (0, child_process_1.spawnSync)(installCommand, {
             cwd: installDir,
-            stdio: 'inherit',
+            stdio,
             shell: true,
         });
         if (result.error) {
@@ -67,9 +79,9 @@ class PackageUpgrader {
         }
         if (result.status !== 0) {
             if (result.signal) {
-                throw new Error(`${this.packageManager.installCommand} terminated by signal ${result.signal}`);
+                throw new Error(`${installCommand} terminated by signal ${result.signal}`);
             }
-            throw new Error(`${this.packageManager.installCommand} exited with code ${result.status}`);
+            throw new Error(`${installCommand} exited with code ${result.status}`);
         }
     }
     groupChoicesByFileAndType(choices) {
@@ -86,11 +98,14 @@ class PackageUpgrader {
     async upgradeChoiceGroup(choices, packageJsonPath, type) {
         // Validate that package.json exists
         if (!(0, fs_1.existsSync)(packageJsonPath)) {
-            console.warn(chalk_1.default.yellow(`⚠️  Skipping ${type} in ${packageJsonPath} - package.json file not found`));
+            this.log(chalk_1.default.yellow(`⚠️  Skipping ${type} in ${packageJsonPath} - package.json file not found`));
             return;
         }
         const packageDir = packageJsonPath.replace('/package.json', '');
-        const spinner = (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
+        // The spinner animates on stdout; skip it in quiet mode so the --json document stays clean.
+        const spinner = this.quiet
+            ? null
+            : (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
         try {
             // Read the current package.json — keep the raw text so we can round-trip its formatting
             const rawContent = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
@@ -128,15 +143,21 @@ class PackageUpgrader {
                     (0, fs_1.writeFileSync)(packageJsonPath, nextContent);
                 }
             }
-            spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
+            if (spinner)
+                spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
+            else
+                this.log(chalk_1.default.green(`✔ Upgraded ${choices.length} ${type} in ${packageDir}`));
             // Show which packages were upgraded
             choices.forEach((choice) => {
                 const upgradeTypeColor = choice.upgradeType === 'range' ? chalk_1.default.yellow : chalk_1.default.red;
-                console.log(`  ${chalk_1.default.green('✓')} ${chalk_1.default.cyan(choice.name)} → ${upgradeTypeColor(choice.targetVersion)}`);
+                this.log(`  ${chalk_1.default.green('✓')} ${chalk_1.default.cyan(choice.name)} → ${upgradeTypeColor(choice.targetVersion)}`);
             });
         }
         catch (error) {
-            spinner.error({ text: `Failed to upgrade ${type} in ${packageDir}` });
+            if (spinner)
+                spinner.error({ text: `Failed to upgrade ${type} in ${packageDir}` });
+            else
+                this.log(chalk_1.default.red(`✖ Failed to upgrade ${type} in ${packageDir}`));
             console.error(chalk_1.default.red(`Error: ${error}`));
             throw error;
         }

package/dist/features/debug/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types/debug.types"), exports);
 __exportStar(require("./services/performance-tracker"), exports);
+__exportStar(require("./services/perf-logger"), exports);
 __exportStar(require("./renderer/performance-modal"), exports);
 //# sourceMappingURL=index.js.map

package/dist/features/debug/renderer/performance-modal.js

@@ -21,7 +21,7 @@ function labelValue(label, value, labelWidth = 22) {
     return `${chalk_1.default.white(padded)} ${value}`;
 }
 function buildSections(snapshot) {
-    const { phases, counts, batches, failedPackages, packageManager, totalMs } = snapshot;
+    const { phases, counts, batches, controlTicks, failedPackages, packageManager, totalMs } = snapshot;
     const pinned = [
         {
             key: 'header',
@@ -67,6 +67,22 @@ function buildSections(snapshot) {
         bodyRows.push(chalk_1.default.gray('  (no batches recorded)'));
     }
     bodyRows.push('');
+    bodyRows.push(chalk_1.default.bold('Concurrency'));
+    if (controlTicks.length > 0) {
+        const limits = controlTicks.map((t) => t.limit);
+        const finalTick = controlTicks[controlTicks.length - 1];
+        const hardDowns = controlTicks.filter((t) => t.reason === 'hard-down').length;
+        bodyRows.push(labelValue('Start limit', formatCount(controlTicks[0].limit)));
+        bodyRows.push(labelValue('Peak limit', formatCount(Math.max(...limits))));
+        bodyRows.push(labelValue('Final limit', formatCount(finalTick.limit)));
+        bodyRows.push(labelValue('Final EWMA', formatMs(finalTick.ewmaMs)));
+        bodyRows.push(labelValue('Control ticks', formatCount(controlTicks.length)));
+        bodyRows.push(labelValue('Hard back-offs', formatCount(hardDowns)));
+    }
+    else {
+        bodyRows.push(chalk_1.default.gray('  (fixed — adaptive off or run too small)'));
+    }
+    bodyRows.push('');
     bodyRows.push(chalk_1.default.bold('Failures'));
     if (failedPackages.length > 0) {
         for (const name of failedPackages) {

package/dist/features/debug/services/perf-logger.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPerfLoggingEnabled = isPerfLoggingEnabled;
+exports.perfEnv = perfEnv;
+exports.getPerfDir = getPerfDir;
+exports.writePerfLog = writePerfLog;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const adaptive_controller_1 = require("../../../services/http/adaptive-controller");
+/**
+ * Performance debug logger.
+ *
+ * When INUP_PERF=1, every run writes ONE self-contained JSON file capturing the
+ * full configuration plus the performance snapshot (phases, batches, adaptive
+ * control ticks, counts). The files accumulate in a gitignored directory so a
+ * series of runs can be diffed to find the best-performing configuration.
+ *
+ * Output location:
+ *  - Default: `<cwd>/.inup-perf` (logs next to the project being scanned).
+ *  - INUP_PERF_DIR=<path>: a single centralized directory (e.g. the inup repo)
+ *    so runs from many different projects collect in one place for analysis.
+ *    The project name is encoded into each filename so they stay distinct.
+ *
+ * Each file is independent: it records every input that could affect timing, so
+ * a run can be understood (and reproduced) without external context.
+ */
+const PERF_DIR_NAME = '.inup-perf';
+/** Filesystem-safe slug of a project name for use in filenames. */
+function projectSlug(cwd) {
+    const name = (0, path_1.basename)((0, path_1.resolve)(cwd)) || 'root';
+    return name.replace(/[^a-zA-Z0-9._-]/g, '-').slice(0, 40);
+}
+function isPerfLoggingEnabled() {
+    return process.env.INUP_PERF === '1';
+}
+/** Capture the env toggles that influence a run, for reproducibility. */
+function perfEnv() {
+    return {
+        INUP_ADAPTIVE: process.env.INUP_ADAPTIVE,
+        INUP_PERF: process.env.INUP_PERF,
+        INUP_DEBUG: process.env.INUP_DEBUG,
+        CI: process.env.CI,
+        NODE_ENV: process.env.NODE_ENV,
+    };
+}
+/**
+ * Resolve (and lazily create) the perf-log directory.
+ *
+ * - INUP_PERF_DIR set → that directory verbatim (centralized collection point,
+ *   e.g. the inup repo's .inup-perf). Relative paths resolve from cwd.
+ * - otherwise → `<cwd>/.inup-perf` (logs sit next to the scanned project).
+ */
+function getPerfDir(cwd = process.cwd()) {
+    const override = process.env.INUP_PERF_DIR;
+    const dir = override
+        ? (0, path_1.isAbsolute)(override)
+            ? override
+            : (0, path_1.resolve)(cwd, override)
+        : (0, path_1.join)(cwd, PERF_DIR_NAME);
+    if (!(0, fs_1.existsSync)(dir)) {
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    return dir;
+}
+const pad = (n, width = 2) => String(n).padStart(width, '0');
+function fileStamp(d) {
+    return (`${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}` +
+        `-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}` +
+        `-${pad(d.getMilliseconds(), 3)}`);
+}
+/**
+ * Write one perf record to its own JSON file. Best-effort: never throws into the
+ * caller (a debugging aid must not break a real run). Returns the path written,
+ * or null if disabled or on failure.
+ */
+function writePerfLog(config, snapshot) {
+    if (!isPerfLoggingEnabled())
+        return null;
+    try {
+        const now = new Date();
+        const record = {
+            schemaVersion: 1,
+            timestamp: now.toISOString(),
+            wallMs: snapshot.totalMs,
+            config,
+            tuning: adaptive_controller_1.DEFAULT_TUNING,
+            snapshot,
+        };
+        const dir = getPerfDir(config.cwd);
+        const modeTag = config.mode;
+        const adaptiveTag = config.adaptive ? 'adaptive' : 'fixed';
+        // Project name in the filename keeps multi-project runs distinct when many
+        // collect into one centralized INUP_PERF_DIR.
+        const fileName = `run-${fileStamp(now)}-${projectSlug(config.cwd)}-${adaptiveTag}-${modeTag}.json`;
+        const filePath = (0, path_1.join)(dir, fileName);
+        (0, fs_1.writeFileSync)(filePath, JSON.stringify(record, null, 2));
+        // Maintain a stable pointer to the most recent run for quick reads.
+        (0, fs_1.writeFileSync)((0, path_1.join)(dir, 'latest.json'), JSON.stringify(record, null, 2));
+        // And a cheap one-line-per-run index for fast scanning.
+        appendPerfIndex(dir, record);
+        if (process.env.INUP_DEBUG === '1') {
+            process.stderr.write(`[inup] perf log → ${filePath}\n`);
+        }
+        return filePath;
+    }
+    catch {
+        // Never let perf logging affect the run.
+        return null;
+    }
+}
+/** Append a single line to a NDJSON index for ultra-cheap scanning, best-effort. */
+function appendPerfIndex(dir, record) {
+    try {
+        const line = JSON.stringify({
+            timestamp: record.timestamp,
+            wallMs: record.wallMs,
+            adaptive: record.config.adaptive,
+            mode: record.config.mode,
+            uniquePackages: record.snapshot.counts.uniquePackages,
+            registryFetch: record.snapshot.phases.registryFetch,
+            controlTicks: record.snapshot.controlTicks.length,
+        }) + '\n';
+        (0, fs_1.appendFileSync)((0, path_1.join)(dir, 'index.ndjson'), line);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+//# sourceMappingURL=perf-logger.js.map

package/dist/features/debug/services/performance-tracker.js

@@ -6,6 +6,8 @@ class PerformanceTracker {
     phases = {};
     counts = {};
     batches = [];
+    controlTicks = [];
+    packageTimings = [];
     failedPackages = [];
     packageManager = null;
     start() {
@@ -13,6 +15,8 @@ class PerformanceTracker {
         this.phases = {};
         this.counts = {};
         this.batches = [];
+        this.controlTicks = [];
+        this.packageTimings = [];
         this.failedPackages = [];
         this.packageManager = null;
     }
@@ -30,6 +34,12 @@ class PerformanceTracker {
     recordBatch(batch) {
         this.batches.push(batch);
     }
+    recordControlTick(tick) {
+        this.controlTicks.push(tick);
+    }
+    recordPackageTiming(timing) {
+        this.packageTimings.push(timing);
+    }
     recordFailedPackage(name) {
         if (!this.failedPackages.includes(name)) {
             this.failedPackages.push(name);
@@ -39,15 +49,15 @@ class PerformanceTracker {
         this.packageManager = name;
     }
     snapshot() {
-        const totalMs = this.startedAt === null
-            ? null
-            : (this.phases.allLoaded ?? Date.now() - this.startedAt);
+        const totalMs = this.startedAt === null ? null : (this.phases.allLoaded ?? Date.now() - this.startedAt);
         return {
             startedAt: this.startedAt,
             phases: { ...this.phases },
             totalMs,
             counts: { ...this.counts },
             batches: [...this.batches],
+            controlTicks: [...this.controlTicks],
+            packageTimings: [...this.packageTimings],
             failedPackages: [...this.failedPackages],
             packageManager: this.packageManager,
         };
@@ -57,6 +67,8 @@ class PerformanceTracker {
         this.phases = {};
         this.counts = {};
         this.batches = [];
+        this.controlTicks = [];
+        this.packageTimings = [];
         this.failedPackages = [];
         this.packageManager = null;
     }