jackherd 1.9.0 → 1.11.0

package/src/watch/watcher-lock.ts

@@ -1,7 +1,15 @@
 import { createHash } from 'node:crypto'
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { basename, join } from 'node:path'
+import { rmSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import { writePrivateFile } from '../../kit/hooks/hooks/shared/private-directory'
+import {
+  ensurePrivateLevels,
+  type LocationSystem,
+  readPrivateText,
+  runtimeBaseOf,
+  systemLocation,
+  userDirectoryOf,
+} from '../shared/private-location'
 import { CLI_NAME, PACKAGE_NAME } from '../version/release'
 
 /** Looks up the command line of a process; null when there is no such process. */
@@ -17,8 +25,6 @@ const RUNTIME = 'bun'
 const DIRECTORY_PREFIX = 'jackherd-watch'
 const KEY_HASH_LENGTH = 12
 const NOT_A_SEGMENT = /[^A-Za-z0-9._-]+/g
-const PRIVATE_DIRECTORY = 0o700
-const PRIVATE_FILE = 0o600
 const STOP_WAIT_MS = 5_000
 const STOP_POLL_MS = 50
 
@@ -73,14 +79,6 @@ export const repositoryKey = (root: string): string => {
   return `${name}-${hash}`
 }
 
-const readText = (file: string): string | null => {
-  try {
-    return readFileSync(file, 'utf8')
-  } catch {
-    return null
-  }
-}
-
 const commandLineOf: CommandLineOf = (pid) => {
   const result = Bun.spawnSync(['ps', '-o', 'command=', '-p', String(pid)], { stdout: 'pipe', stderr: 'ignore' })
   return result.exitCode === 0 ? result.stdout.toString().trim() || null : null
@@ -96,36 +94,34 @@ const isAlive = (pid: number): boolean => {
 }
 
 /** Where `ensureWatcherDirectory` puts the watcher's files, without creating anything: for readers such as the herd. */
-export const watcherDirectoryOf = (root: string): string =>
-  join(tmpdir(), `${DIRECTORY_PREFIX}-${process.getuid?.() ?? 'user'}`, repositoryKey(root))
+export const watcherDirectoryOf = (root: string, system: LocationSystem = systemLocation()): string =>
+  join(userDirectoryOf(runtimeBaseOf(system), DIRECTORY_PREFIX, system.uid), repositoryKey(root))
 
 /**
  * The directory for the lock and state of the watcher of the repository at `root`, one per user and repository,
- * readable by that user only: with `TMPDIR` unset, `tmpdir()` is the shared `/tmp`, where another account could
- * plant the files. A watcher in another repository has its own lock and does not supersede this one.
+ * readable by that user only: without a private runtime directory the base is the temporary directory, which may be
+ * the shared `/tmp`, where another account could plant the files, so both levels are verified (`ensurePrivateLevels`)
+ * and this throws for a level that is a link or someone else's. A watcher in another repository has its own lock and
+ * does not supersede this one.
  */
-export const ensureWatcherDirectory = (root: string): string => {
-  const directory = watcherDirectoryOf(root)
-  mkdirSync(directory, { recursive: true, mode: PRIVATE_DIRECTORY })
-  return directory
+export const ensureWatcherDirectory = (root: string, system: LocationSystem = systemLocation()): string => {
+  const directory = watcherDirectoryOf(root, system)
+  return ensurePrivateLevels(dirname(directory), directory)
 }
 
 /** Whether the lock names a live process that is a watcher, so its saved state is being kept up to date. */
 export const isWatcherRunning = (lockFile: string, lookUp: CommandLineOf = commandLineOf): boolean => {
-  const pid = lockedPid(readText(lockFile))
+  const pid = lockedPid(readPrivateText(lockFile))
   return pid !== null && isAlive(pid) && isWatcherCommand(lookUp(pid) ?? '')
 }
 
-/** Writes a file only the user can read. */
-export const writePrivate = (file: string, content: string) => writeFileSync(file, content, { mode: PRIVATE_FILE })
-
 /**
  * Takes the lock for this process. A watcher that held it gets SIGTERM and is waited for, so the state
  * file it writes on the way out is complete before this one reads it.
  */
 export const takeOverLock = async (lockFile: string): Promise<TakeOver> => {
-  const previous = supersedeTarget(readText(lockFile), process.pid, commandLineOf)
-  writePrivate(lockFile, String(process.pid))
+  const previous = supersedeTarget(readPrivateText(lockFile), process.pid, commandLineOf)
+  writePrivateFile(lockFile, String(process.pid))
   if (previous === null || !isAlive(previous)) return { replaced: null, stillRunning: null }
   try {
     process.kill(previous, 'SIGTERM')
@@ -137,9 +133,9 @@ export const takeOverLock = async (lockFile: string): Promise<TakeOver> => {
   return isAlive(previous) ? { replaced: null, stillRunning: previous } : { replaced: previous, stillRunning: null }
 }
 
-export const stopNoticeOf = (lockFile: string): string => stopNotice(readText(lockFile), process.pid)
+export const stopNoticeOf = (lockFile: string): string => stopNotice(readPrivateText(lockFile), process.pid)
 
 /** Removes the lock only while it still names this process; a successor's lock stays. */
 export const releaseLock = (lockFile: string) => {
-  if (lockedPid(readText(lockFile)) === process.pid) rmSync(lockFile, { force: true })
+  if (lockedPid(readPrivateText(lockFile)) === process.pid) rmSync(lockFile, { force: true })
 }

package/kit/hooks/hooks/merge-guard/plan-approval-record.ts

@@ -1,23 +0,0 @@
-// PostToolUse hook for AskUserQuestion, shipped by jackherd. When the call asked about a plan (``Plan `<path>` ``) and
-// offered the label that approves it or the one that revokes it, it leaves a pointer to that dialog in the main
-// checkout's `.jackherd/approvals/plans/`, so the merge guard finds the answer again after the session ended. It writes
-// only the pointer; the merge guard reads the answer from the transcript itself. argv[2] and argv[3] are the two labels,
-// rendered into the hook entry by `sync`. It never blocks and prints nothing: a pointer it fails to write costs a question.
-// The other way round it costs a revocation: when no pointer is written for a "revoke" answer, the merge guard never
-// sees that answer, and an older approval keeps holding until the next plan question that is recorded.
-import { mainCheckoutOf } from '../shared/checkout'
-import { planPointersDirectory, pointerOf, writePointer } from './plan-pointers'
-
-const record = async (): Promise<void> => {
-  const pointer = pointerOf(JSON.parse(await Bun.stdin.text()), process.argv.slice(2, 4), Date.now())
-  if (pointer === undefined) return
-  const projectDirectory = process.env.CLAUDE_PROJECT_DIR ?? process.cwd()
-  writePointer(planPointersDirectory(mainCheckoutOf(projectDirectory)), pointer)
-}
-
-try {
-  await record()
-} catch {
-  // Nothing to do: without a pointer the merge asks.
-}
-process.exit(0)

package/kit/hooks/hooks/merge-guard/plan-approval-sources.ts

@@ -1,196 +0,0 @@
-/**
- * Where plan approval reads its facts: git in the main checkout for the base branch, the worktrees and the boards, the
- * pointer directory and the transcripts for the answers. Every git call runs without a shell and with a timeout; any
- * failure answers nothing, so the guard asks.
- */
-import { existsSync } from 'node:fs'
-import { join, posix, relative, resolve } from 'node:path'
-import { lanePlansOf } from '../shared/board-lanes'
-import { laneOf } from '../shared/lane'
-import type { PlanApprovalSources } from './plan-approval'
-import { FULL_COMMIT } from '../shared/commit'
-import { isPlainPath } from './plain-path'
-import { planAnswers, planPointersDirectory } from './plan-pointers'
-import { checksPassed } from './pull-request'
-import { baseBranchOf } from '../shared/base-branch'
-import { type PlanApprovalSettings, PROJECT_CONFIG, planApprovalSettingsOf } from './plan-approval-settings'
-import { readConfigOrNull } from './settings'
-
-/** The base commit plan approval reads, just fetched, and the settings its project config holds. */
-export type PlanBase = { commit: string; settings: PlanApprovalSettings }
-
-export type PlanSourceContext = {
-  /** The main checkout, where the worktrees, the base branch and the pointers are. */
-  main: string
-  base: PlanBase
-  /** The transcript of the session that merges. */
-  transcript: string | undefined
-  /** The label that approves a plan. */
-  label: string
-  files: () => readonly string[] | undefined
-  /** The `gh pr view` answer for the pull request, which carries its checks. */
-  view: string
-}
-
-const GIT_TIMEOUT_MS = 3000
-const BASE_REMOTE = 'origin'
-const HEADER = /^[0-9a-f]+ blob (\d+)$/
-
-/**
- * The output of `git cat-file --batch`, one entry per requested path in order: the text of a blob, null for a path the
- * commit lacks or that is no blob. Undefined when the output does not hold one entry per path.
- */
-export const parseCatFileBatch = (output: Buffer, count: number): (string | null)[] | undefined => {
-  const texts: (string | null)[] = []
-  let at = 0
-  while (texts.length < count) {
-    const newline = output.indexOf('\n', at)
-    if (newline === -1) return undefined
-    const size = HEADER.exec(output.subarray(at, newline).toString('utf8'))?.[1]
-    if (size === undefined) {
-      texts.push(null)
-      at = newline + 1
-      continue
-    }
-    const end = newline + 1 + Number(size)
-    if (end > output.length) return undefined
-    texts.push(output.subarray(newline + 1, end).toString('utf8'))
-    at = end + 1
-  }
-  return texts
-}
-
-/** The lane whose worktree, directly below the worktree directory, has `branch` checked out. */
-export const laneInWorktreeList = (
-  worktreeList: string,
-  main: string,
-  worktreeDirectory: string,
-  branch: string,
-): string | undefined => {
-  const blocks = worktreeList.split('\n\n').map((block) => block.split('\n'))
-  const block = blocks.find((lines) => lines.includes(`branch refs/heads/${branch}`))
-  const path = block?.find((line) => line.startsWith('worktree '))?.slice('worktree '.length)
-  if (path === undefined) return undefined
-  const lane = laneOf({ cwd: path, main, worktreeDirectory })
-  return lane !== null && relative(resolve(main, worktreeDirectory), resolve(path)) === lane ? lane : undefined
-}
-
-/** Whether `name` is the directory of a lane's worktree below the worktree directory. */
-export const isLaneIn =
-  (main: string, worktreeDirectory: string) =>
-  (name: string): boolean => {
-    const worktree = join(resolve(main, worktreeDirectory), name)
-    return laneOf({ cwd: worktree, main, worktreeDirectory }) === name && existsSync(worktree)
-  }
-
-/** Only the base branch into its remote ref: no tags, no FETCH_HEAD written, no maintenance started. */
-export const baseFetchArguments = (baseBranch: string): string[] => [
-  'fetch',
-  '--quiet',
-  '--no-tags',
-  '--no-write-fetch-head',
-  '--no-auto-maintenance',
-  BASE_REMOTE,
-  `+refs/heads/${baseBranch}:refs/remotes/${BASE_REMOTE}/${baseBranch}`,
-]
-
-/** No prompt for a password or a host key: a fetch that would wait for one fails at once instead. */
-export const NON_INTERACTIVE = { GIT_TERMINAL_PROMPT: '0', GIT_SSH_COMMAND: 'ssh -o BatchMode=yes' }
-
-const git = (main: string, args: readonly string[], stdin?: string): Buffer | undefined => {
-  const result = Bun.spawnSync(['git', '-C', main, ...args], {
-    stdin: stdin === undefined ? 'ignore' : new TextEncoder().encode(stdin),
-    stdout: 'pipe',
-    stderr: 'ignore',
-    timeout: GIT_TIMEOUT_MS,
-    env: { ...process.env, ...NON_INTERACTIVE },
-  })
-  return result.exitCode === 0 ? result.stdout : undefined
-}
-
-const baseCommitOf = (main: string, baseBranch: string): string | undefined => {
-  const commit = git(main, ['rev-parse', '--verify', '--quiet', `${BASE_REMOTE}/${baseBranch}^{commit}`])
-    ?.toString()
-    .trim()
-  return commit !== undefined && FULL_COMMIT.test(commit) ? commit : undefined
-}
-
-/** The texts of the paths at the commit, in one `git cat-file --batch`; null for each one it lacks or cannot read. */
-const readAtCommit = (main: string, commit: string, paths: readonly string[]): Map<string, string | null> => {
-  const asked = paths.filter(isPlainPath)
-  const output =
-    asked.length === 0
-      ? undefined
-      : git(main, ['cat-file', '--batch'], asked.map((path) => `${commit}:${path}\n`).join(''))
-  const texts = output === undefined ? undefined : parseCatFileBatch(output, asked.length)
-  return new Map(paths.map((path) => [path, texts?.[asked.indexOf(path)] ?? null]))
-}
-
-/** The board directories under the plan directory at the commit whose name matches the board pattern. */
-const boardDirectories = (main: string, commit: string, settings: PlanApprovalSettings): string[] => {
-  const listing = git(main, ['ls-tree', '-d', '--name-only', commit, '--', `${settings.planDirectory}/`])
-  const pattern = new Bun.Glob(settings.board.pattern)
-  return (listing?.toString() ?? '')
-    .split('\n')
-    .filter((path) => path !== '' && pattern.match(posix.basename(path)))
-}
-
-/** Brings `origin/<baseBranch>` up to date, so a stale ref cannot hold an approval GitHub's base no longer does. */
-const fetchBase = (main: string, baseBranch: string): boolean => git(main, baseFetchArguments(baseBranch)) !== undefined
-
-/** The newest first-parent commit of the base from before the time; undefined when there is none. */
-const commitBefore = (main: string, commit: string, time: number): string | undefined => {
-  const found = git(main, ['rev-list', '-1', '--first-parent', `--before=@${Math.floor(time / 1000)}`, commit])
-    ?.toString()
-    .trim()
-  return found !== undefined && FULL_COMMIT.test(found) ? found : undefined
-}
-
-/**
- * The plan as the base held it at the time of the answer; undefined when the base did not hold it then, or not
- * readably. A plan that was only in a pull request when the user approved it could have grown before it landed, and
- * the state the user saw is nowhere on the base, so the guard asks once more after it landed.
- */
-const planAtApproval = (main: string, commit: string, plan: string, answeredAt: number): string | undefined => {
-  const before = commitBefore(main, commit, answeredAt)
-  return (before === undefined ? undefined : readAtCommit(main, before, [plan]).get(plan)) ?? undefined
-}
-
-/**
- * The base plan approval reads: `origin/<baseBranch>` right after a fetch, and the settings of the project config at
- * that commit, never of the checkout. The base branch comes from the checkout's config (the base cannot name itself)
- * and must agree with the one the base's config names. Undefined, so the guard asks, when any step fails.
- */
-export const planBaseOf = (main: string): PlanBase | undefined => {
-  const baseBranch = baseBranchOf(readConfigOrNull([main]))
-  if (baseBranch === undefined || !fetchBase(main, baseBranch)) return undefined
-  const commit = baseCommitOf(main, baseBranch)
-  if (commit === undefined) return undefined
-  const settings = planApprovalSettingsOf(readAtCommit(main, commit, [PROJECT_CONFIG]).get(PROJECT_CONFIG) ?? null)
-  return settings !== null && settings.baseBranch === baseBranch ? { commit, settings } : undefined
-}
-
-export const planApprovalSources = ({ main, base, transcript, label, files, view }: PlanSourceContext): PlanApprovalSources => {
-  const { commit, settings } = base
-  return {
-    checksPassed: (requiredChecks) => checksPassed(view, requiredChecks),
-    containsBase: (headCommit) =>
-      FULL_COMMIT.test(headCommit) && git(main, ['merge-base', '--is-ancestor', commit, headCommit]) !== undefined,
-    files,
-    readAtBase: (paths) => readAtCommit(main, commit, paths),
-    laneOfBranch: (branch) => {
-      const list = git(main, ['worktree', 'list', '--porcelain'])?.toString()
-      return list === undefined ? undefined : laneInWorktreeList(list, main, settings.worktreeDirectory, branch)
-    },
-    lanePlans: (lane) => {
-      const boards = boardDirectories(main, commit, settings)
-      const texts = readAtCommit(main, commit, boards.map((directory) => `${directory}/${settings.board.file}`))
-      return boards.flatMap((directory) => {
-        const text = texts.get(`${directory}/${settings.board.file}`)
-        return (text ? lanePlansOf(text, directory, lane, settings.planLanguage) : undefined) ?? []
-      })
-    },
-    answers: (plan) => planAnswers({ directory: planPointersDirectory(main), currentTranscript: transcript, plan, label }),
-    readAtCommitBefore: (plan, answeredAt) => (isPlainPath(plan) ? planAtApproval(main, commit, plan, answeredAt) : undefined),
-  }
-}

package/kit/hooks/hooks/merge-guard/plan-approval.ts

@@ -1,168 +0,0 @@
-/**
- * Whether the user's approval of a plan lifts the question for the merge of a pull request: it merges into the base
- * branch, its checks passed, its head contains the base, the pull request comes from a lane whose rows link exactly
- * that plan, the plan still has an open phase, no file matches a path that always asks, none is a package.json and
- * none the CHANGELOG.md of a published package, the newest answer to a plan question naming it approved it, and the
- * plan gained no phase and no undecided task since that answer. Everything is read from the base branch and from
- * GitHub, never from the pull request's own files, and every doubt answers "no", so the guard asks as before. Only a
- * plain `gh pr merge <number>` gets this far.
- */
-import type { LanePlans } from '../shared/board-lanes'
-import { hasOpenPhase } from '../shared/plan-open-phases'
-import { isRecord } from '../shared/json'
-import type { MergeNote } from './decision'
-import { isPlainPath } from './plain-path'
-import { type NewTask, newPhasesSince, newTasksSince } from './plan-growth'
-
-/** The label the user picked in a plan question and when; read from the transcript, not from the pointer. */
-export type PlanAnswer = { answer: string; answeredAt: number }
-
-/** Where the facts come from; each is asked only once the steps before it said yes. */
-export type PlanApprovalSources = {
-  /** Whether GitHub can merge the head commit and its checks passed, the required ones among them. */
-  checksPassed: (requiredChecks: readonly string[] | undefined) => boolean
-  /** Whether the head commit contains the base commit plan approval reads. */
-  containsBase: (headCommit: string) => boolean
-  /** The files of the pull request as GitHub lists them, renames with their old name; undefined when not complete. */
-  files: () => readonly string[] | undefined
-  /** The texts of these paths at the base branch; null for a path it does not have. */
-  readAtBase: (paths: readonly string[]) => ReadonlyMap<string, string | null>
-  /** The lane whose worktree has the branch checked out. */
-  laneOfBranch: (branch: string) => string | undefined
-  /** The lane's rows in each board at the base branch that has any. */
-  lanePlans: (lane: string) => LanePlans[]
-  /** The answers to the plan questions naming this plan, each backed by its dialog in a transcript. */
-  answers: (plan: string) => PlanAnswer[]
-  /** The plan as the base held it at the time of the answer; undefined when it held none then or it is unreadable. */
-  readAtCommitBefore: (plan: string, answeredAt: number) => string | undefined
-}
-
-export type PlanApprovalQuery = {
-  /** The pull request as GitHub names it: its head branch and commit, and the branch it merges into. */
-  pullRequest: { branch: string; headCommit: string; baseBranch: string }
-  /** The exact option label that approves a plan. */
-  label: string
-  /** The time of the check, in milliseconds. */
-  now: number
-  /** The paths that always ask, the base branch, and the checks that must have passed (undefined: every one listed). */
-  settings: { exceptPaths: readonly string[]; baseBranch: string; requiredChecks: readonly string[] | undefined }
-}
-
-/** `true` lifts the question; `false` asks as before; a note asks and says why, for a plan that grew since its approval. */
-export type PlanVerdict = boolean | MergeNote
-
-const MANIFEST = 'package.json'
-/** How many new tasks a note names before it only counts the rest. */
-const NAMED_TASKS = 5
-const TASK_LENGTH = 80
-const CHANGELOG = 'changelog.md'
-
-const directoryOf = (file: string): string => file.slice(0, Math.max(file.lastIndexOf('/'), 0))
-
-/** In lower case, as a case-insensitive file system would write it. */
-const fileName = (file: string): string => file.slice(file.lastIndexOf('/') + 1).toLowerCase()
-
-const manifestOf = (directory: string): string => (directory === '' ? MANIFEST : `${directory}/${MANIFEST}`)
-
-/**
- * Compared in lower case: on a case-insensitive file system git writes `.Claude/x` into the existing `.claude/`, so a
- * pattern must not miss it. Folding only ever adds a question.
- */
-const matchesAny = (files: readonly string[], patterns: readonly string[]): boolean => {
-  const globs = patterns.map((pattern) => new Bun.Glob(pattern.toLowerCase()))
-  return files.some((file) => globs.some((glob) => glob.match(file.toLowerCase())))
-}
-
-/** The manifests of the packages whose CHANGELOG.md the pull request changes. */
-const changelogManifests = (files: readonly string[]): string[] => [
-  ...new Set(files.filter((file) => fileName(file) === CHANGELOG).map((file) => manifestOf(directoryOf(file)))),
-]
-
-/** A package is private only when its manifest at the base says `"private": true`; a missing or broken one is published. */
-const isPrivate = (manifest: string | null | undefined): boolean => {
-  try {
-    const parsed: unknown = JSON.parse(manifest ?? '')
-    return isRecord(parsed) && parsed.private === true
-  } catch {
-    return false
-  }
-}
-
-/** The one plan the lane's open rows link across the boards; none or several gives none. */
-const onlyPlanOf = (rows: readonly LanePlans[]): string | undefined => {
-  const plans = new Set(rows.filter(({ closed }) => !closed).flatMap(({ plans }) => plans))
-  const [only] = plans
-  return plans.size === 1 ? only : undefined
-}
-
-/**
- * When the user approved the plan: the time of the newest answers not from the future, when every one of them is the
- * label. Two answers at the same time (two questions in one dialog) approve only together.
- */
-const approvedAt = (answers: readonly PlanAnswer[], label: string, now: number): number | undefined => {
-  const past = answers.filter(({ answeredAt }) => answeredAt <= now)
-  if (past.length === 0) return undefined
-  const newest = Math.max(...past.map(({ answeredAt }) => answeredAt))
-  const atNewest = past.filter(({ answeredAt }) => answeredAt === newest)
-  return atNewest.every(({ answer }) => answer === label) ? newest : undefined
-}
-
-const shortened = (task: string): string => (task.length > TASK_LENGTH ? `${task.slice(0, TASK_LENGTH - 1)}…` : task)
-
-const tasksNote = (tasks: readonly NewTask[]): string => {
-  const named = tasks.slice(0, NAMED_TASKS).map(({ phase, task }) => `P${phase} "${shortened(task)}"`)
-  const rest = tasks.length > NAMED_TASKS ? ` and ${tasks.length - NAMED_TASKS} more` : ''
-  return `${tasks.length} new tasks: ${named.join(', ')}${rest}`
-}
-
-/** Why the approval no longer covers the plan: the phases and the undecided tasks it gained; undefined when none. */
-const growthNote = (plan: string, approvedText: string, currentText: string): string | undefined => {
-  const phases = newPhasesSince(approvedText, currentText)
-  const tasks = newTasksSince(approvedText, currentText)
-  const parts = [
-    ...(phases.length > 0 ? [`new phases: ${phases.map((phase) => `"${phase}"`).join(', ')}`] : []),
-    ...(tasks.length > 0 ? [tasksNote(tasks)] : []),
-  ]
-  return parts.length === 0 ? undefined : `Plan \`${plan}\` gained since the user's approval ${parts.join('; ')}.`
-}
-
-/**
- * No file of the pull request matches a path that always asks or is a package.json (private or not: it can drop
- * `"private"` or add a dependency), and none is the changelog of a package the base does not call private.
- */
-const changesOnlyOrdinaryFiles = (files: readonly string[], exceptPaths: readonly string[], sources: PlanApprovalSources) => {
-  if (files.length === 0 || !files.every(isPlainPath) || matchesAny(files, exceptPaths)) return false
-  if (files.some((file) => fileName(file) === MANIFEST)) return false
-  const manifests = changelogManifests(files)
-  if (manifests.length === 0) return true
-  const texts = sources.readAtBase(manifests)
-  return manifests.every((manifest) => isPrivate(texts.get(manifest)))
-}
-
-/** The plan of the branch's lane and its text at the base, while that plan has an open phase there. */
-const openPlanOf = (branch: string, sources: PlanApprovalSources): { plan: string; text: string } | undefined => {
-  const lane = sources.laneOfBranch(branch)
-  const plan = lane === undefined ? undefined : onlyPlanOf(sources.lanePlans(lane))
-  if (plan === undefined) return undefined
-  const text = sources.readAtBase([plan]).get(plan)
-  return typeof text === 'string' && hasOpenPhase(text) ? { plan, text } : undefined
-}
-
-/** The pull request merges into the base, the head contains it, and its checks passed. */
-const isTestedAgainstBase = ({ pullRequest, settings }: PlanApprovalQuery, sources: PlanApprovalSources): boolean =>
-  pullRequest.baseBranch === settings.baseBranch &&
-  sources.checksPassed(settings.requiredChecks) &&
-  sources.containsBase(pullRequest.headCommit)
-
-export const isPlanApproved = (query: PlanApprovalQuery, sources: PlanApprovalSources): PlanVerdict => {
-  if (!isTestedAgainstBase(query, sources)) return false
-  const files = sources.files()
-  if (files === undefined || !changesOnlyOrdinaryFiles(files, query.settings.exceptPaths, sources)) return false
-  const open = openPlanOf(query.pullRequest.branch, sources)
-  const answeredAt = open === undefined ? undefined : approvedAt(sources.answers(open.plan), query.label, query.now)
-  if (open === undefined || answeredAt === undefined) return false
-  const approvedText = sources.readAtCommitBefore(open.plan, answeredAt)
-  if (approvedText === undefined) return false
-  const note = growthNote(open.plan, approvedText, open.text)
-  return note === undefined ? true : { note }
-}

package/kit/hooks/hooks/merge-guard/plan-growth.ts

@@ -1,40 +0,0 @@
-/**
- * What a plan gained since the user approved it: phases, and tasks in the phases they already saw. Both compare the
- * text of the approved plan with the plan at the base, whatever the boxes say, so ticking a task is no growth.
- */
-import { phaseBlocksOf, taskOf } from '../shared/plan-open-phases'
-
-/** A task of a phase that was there at the approval, which the approved plan did not hold. */
-export type NewTask = { phase: string; task: string }
-
-/** A task the user decided, marked `(User <date> …)` with `DD.MM.` or `YYYY-MM-DD`; the user already saw it. */
-const USER_DECIDED = /\(User (?:\d{1,2}\.\d{1,2}\.|\d{4}-\d{2}-\d{2})/
-
-const tasksOf = (lines: readonly string[]): string[] =>
-  lines.flatMap((line) => {
-    const task = taskOf(line)
-    return task === null ? [] : [task.text]
-  })
-
-/** The headings of the current plan's phases the approved plan does not have, by their text: a rename is new. */
-export const newPhasesSince = (approvedText: string, currentText: string): string[] => {
-  const approved = new Set(phaseBlocksOf(approvedText).map(({ heading }) => heading))
-  return phaseBlocksOf(currentText)
-    .map(({ heading }) => heading)
-    .filter((heading) => !approved.has(heading))
-}
-
-/**
- * The tasks of the current plan that the same phase of the approved plan did not hold, by their text (a rewording is
- * new), leaving out tasks the user decided and every task of a phase that is new itself.
- */
-export const newTasksSince = (approvedText: string, currentText: string): NewTask[] => {
-  const approved = new Map(phaseBlocksOf(approvedText).map(({ id, lines }) => [id, new Set(tasksOf(lines))]))
-  return phaseBlocksOf(currentText).flatMap(({ id, lines }) => {
-    const known = approved.get(id)
-    if (known === undefined) return []
-    return tasksOf(lines)
-      .filter((task) => !known.has(task) && !USER_DECIDED.test(task))
-      .map((task) => ({ phase: id, task }))
-  })
-}