projectstore-claude 0.29.2 → 0.29.4

package/node_modules/projectstore/scripts/portable-registration.mjs

@@ -6,11 +6,23 @@ import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
-import { whichOnPath } from "./lib.mjs";
+import { whichOnPath, cmpPrecedence } from "./lib.mjs";
 
-const readJson = (path) => { try { return JSON.parse(readFileSync(path, "utf8")); } catch { return null; } };
+const readJson = (path) => {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+};
 const samePath = (a, b) => {
-  const real = (p) => { try { return realpathSync(p); } catch { return resolve(p); } };
+  const real = (p) => {
+    try {
+      return realpathSync(p);
+    } catch {
+      return resolve(p);
+    }
+  };
   return Boolean(a && b) && real(a) === real(b);
 };
 
@@ -19,19 +31,31 @@ function parseValue(raw) {
   if (s === "true") return true;
   if (s === "false") return false;
   if (s.startsWith('"') && s.endsWith('"')) {
-    try { return JSON.parse(s); } catch { return s.slice(1, -1); }
+    try {
+      return JSON.parse(s);
+    } catch {
+      return s.slice(1, -1);
+    }
   }
   return s;
 }
 
 export function readTomlSections(path) {
   let text;
-  try { text = readFileSync(path, "utf8"); } catch { return new Map(); }
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return new Map();
+  }
   const sections = new Map();
   let current = null;
   for (const line of text.split(/\r?\n/)) {
     const header = line.match(/^\s*\[([^\]]+)]\s*(?:#.*)?$/);
-    if (header) { current = header[1]; if (!sections.has(current)) sections.set(current, {}); continue; }
+    if (header) {
+      current = header[1];
+      if (!sections.has(current)) sections.set(current, {});
+      continue;
+    }
     if (!current || /^\s*(?:#|$)/.test(line)) continue;
     const kv = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*(.*?)\s*(?:#.*)?$/);
     if (kv) sections.get(current)[kv[1]] = parseValue(kv[2]);
@@ -43,17 +67,23 @@ export function payloadFiles(root) {
   const out = [];
   const walk = (at, rel = "") => {
     let entries;
-    try { entries = readdirSync(at, { withFileTypes: true }); } catch { return; }
+    try {
+      entries = readdirSync(at, { withFileTypes: true });
+    } catch {
+      return;
+    }
     for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (e.name.startsWith(".DS_Store")) continue;
-      const abs = join(at, e.name), next = rel ? `${rel}/${e.name}` : e.name;
+      const abs = join(at, e.name),
+        next = rel ? `${rel}/${e.name}` : e.name;
       // npm creates command shims as symlinks here. The shell invokes the
       // bundled core by its real path, so these convenience links are neither
       // runtime input nor portable plugin payload.
       if (next === "node_modules/.bin" || next.startsWith("node_modules/.bin/")) continue;
       const st = lstatSync(abs);
       if (st.isSymbolicLink()) throw new Error(`plugin payload contains a symlink: ${next}`);
-      if (st.isDirectory()) walk(abs, next); else if (st.isFile()) out.push(next);
+      if (st.isDirectory()) walk(abs, next);
+      else if (st.isFile()) out.push(next);
     }
   };
   walk(root);
@@ -65,7 +95,11 @@ export function payloadDigest(root) {
   const h = createHash("sha256");
   for (const rel of files) {
     h.update(rel + "\n");
-    h.update(createHash("sha256").update(readFileSync(join(root, rel))).digest("hex") + "\n");
+    h.update(
+      createHash("sha256")
+        .update(readFileSync(join(root, rel)))
+        .digest("hex") + "\n",
+    );
   }
   return { count: files.length, sha256: h.digest("hex") };
 }
@@ -92,41 +126,86 @@ export function renderPortableCatalog(s) {
   return {
     name: s.marketplace_name,
     interface: { displayName: "ProjectStore (npm)" },
-    plugins: [{
-      name: s.plugin_name,
-      source: { source: "local", path: `./${s.plugin_subdir}` },
-      policy: { installation: "AVAILABLE", authentication: "ON_INSTALL" },
-      category: "Developer Tools",
-    }],
+    plugins: [
+      {
+        name: s.plugin_name,
+        source: { source: "local", path: `./${s.plugin_subdir}` },
+        policy: { installation: "AVAILABLE", authentication: "ON_INSTALL" },
+        category: "Developer Tools",
+      },
+    ],
   };
 }
 
-function pluginTable(id) { return `plugins.${JSON.stringify(id)}`; }
-function marketplaceTable(name) { return `marketplaces.${name}`; }
+function pluginTable(id) {
+  return `plugins.${JSON.stringify(id)}`;
+}
+function marketplaceTable(name) {
+  return `marketplaces.${name}`;
+}
 
 function pluginIds(sections) {
   const ids = [];
   for (const key of sections.keys()) {
     const m = key.match(/^plugins\.(.+)$/);
     if (!m) continue;
-    try { ids.push(m[1].startsWith('"') ? JSON.parse(m[1]) : m[1]); } catch {}
+    try {
+      ids.push(m[1].startsWith('"') ? JSON.parse(m[1]) : m[1]);
+    } catch {}
   }
   return ids;
 }
 
+// The manifests a portable plugin root may carry, in the order they are read:
+// an Agent Plugins plugin.json at the root, then the legacy one Codex
+// validates — from 0.28.2 the shell's one manifest, since Codex picks a root
+// one first and loads no hooks from it (openai/codex#37027). The one place
+// either is spelled; the shell fetch's verification names them by kind.
+const PAYLOAD_MANIFESTS = { root: ["plugin.json"], legacy: [".codex-plugin", "plugin.json"] };
+export function payloadManifestPaths(root) {
+  return Object.values(PAYLOAD_MANIFESTS).map((parts) => join(root, ...parts));
+}
+export function payloadManifestPath(root, kind) {
+  return join(root, ...PAYLOAD_MANIFESTS[kind]);
+}
+// Is `root` a portable plugin root: does it carry either manifest?
+export function isPortablePluginRoot(root) {
+  return Boolean(root) && payloadManifestPaths(root).some((p) => existsSync(p));
+}
+// The first manifest that parses, or null — or, with `kind`, that one only.
+export function payloadManifest(root, { kind = null } = {}) {
+  for (const p of kind ? [payloadManifestPath(root, kind)] : payloadManifestPaths(root)) {
+    const m = readJson(p);
+    if (m) return m;
+  }
+  return null;
+}
+
 function cacheEntries(paths, s) {
   const base = join(paths.cacheDir, s.marketplace_name, s.plugin_name);
   let names;
-  try { names = readdirSync(base); } catch { return []; }
-  return names.map((name) => {
-    const path = join(base, name);
-    const manifest = readJson(join(path, "plugin.json")) || readJson(join(path, ".codex-plugin", "plugin.json"));
-    let at = 0; try { at = statSync(path).mtimeMs; } catch {}
-    if (!manifest || typeof manifest.version !== "string") return null;
-    let digest = null;
-    try { digest = payloadDigest(path); } catch {}
-    return { path, version: manifest.version, at, digest };
-  }).filter(Boolean).sort((a, b) => b.at - a.at || b.version.localeCompare(a.version));
+  try {
+    names = readdirSync(base);
+  } catch {
+    return [];
+  }
+  return names
+    .map((name) => {
+      const path = join(base, name);
+      const manifest = payloadManifest(path);
+      let at = 0;
+      try {
+        at = statSync(path).mtimeMs;
+      } catch {}
+      if (!manifest || typeof manifest.version !== "string") return null;
+      let digest = null;
+      try {
+        digest = payloadDigest(path);
+      } catch {}
+      return { path, version: manifest.version, at, digest };
+    })
+    .filter(Boolean)
+    .sort((a, b) => b.at - a.at || b.version.localeCompare(a.version));
 }
 
 // Where the payload to register lives. A surface conditioned on a distribution
@@ -139,18 +218,46 @@ function cacheEntries(paths, s) {
 // the harness's directory (S2 of the 2026-10-03 review in "The Codex shell's
 // plugin root: .codex-plugin, the rendered surfaces, and the first Codex
 // install").
-export function portablePayloadRoot(s, { root, env = process.env } = {}) {
+//
+// `fetched` is the root a core run fetched for this harness (the shell fetch
+// of install and upgrade). The variable wins: a set one is used as is, a root
+// or not, and the fetched root is consulted only when it is unset — a shell
+// that names its own root is never second-guessed by a fetch.
+export function portablePayloadRoot(s, { root, env = process.env, fetched = null } = {}) {
   const named = env.PROJECTSTORE_DISTRIBUTION_ROOT || null;
   if (s.condition !== "distribution_root") return named || root;
-  if (!named) return null;
-  return existsSync(join(named, "plugin.json")) || existsSync(join(named, ".codex-plugin", "plugin.json")) ? named : null;
+  const candidate = named || fetched || null;
+  return candidate && isPortablePluginRoot(candidate) ? candidate : null;
 }
 
-export function analysePortableRegistration(projectDir, s, { root, payloadRoot: explicitPayloadRoot = null, home = homedir(), harness, env = process.env, ignoreJournal = false } = {}) {
+// Two modes. With a payload, every rung is decided, the published digest
+// against the recorded one included. With a `version` and no payload — plan's
+// dry run, both uninstalls, a run whose fetch was skipped, and the recheck of
+// an item planned that way — every rung that reads host facts is decided, and
+// the one comparison that needs the payload's bytes is not: its digest, so
+// `contentDiffers` and the same-version, different-content conflict. That is
+// the one rung a local-tarball install at an unchanged version trips, and it
+// is decided after a real fetch. `unavailable` for want of a payload fires
+// only when there is neither. Doctor passes neither and reads as before.
+export function analysePortableRegistration(
+  projectDir,
+  s,
+  {
+    root,
+    payloadRoot: explicitPayloadRoot = null,
+    version = null,
+    fetched = null,
+    home = homedir(),
+    harness,
+    env = process.env,
+    ignoreJournal = false,
+  } = {},
+) {
   const paths = portableRegistrationPaths(s, { home, projectDir, harness, env });
-  const payloadRoot = explicitPayloadRoot || portablePayloadRoot(s, { root, env });
-  const desiredManifest = payloadRoot ? (readJson(join(payloadRoot, "plugin.json")) || readJson(join(payloadRoot, ".codex-plugin", "plugin.json"))) : null;
-  const desiredVersion = desiredManifest?.version || null;
+  const payloadRoot = explicitPayloadRoot || portablePayloadRoot(s, { root, env, fetched });
+  const desiredManifest = payloadRoot ? payloadManifest(payloadRoot) : null;
+  const versionOnly = !payloadRoot && typeof version === "string" && version !== "";
+  const desiredVersion = desiredManifest?.version || (versionOnly ? version : null);
   const id = `${s.plugin_name}@${s.marketplace_name}`;
   const bin = whichOnPath(s.cli.bin, env);
   const ownership = readJson(paths.ownership)?.[s.provenance_key] || null;
@@ -165,39 +272,152 @@ export function analysePortableRegistration(projectDir, s, { root, payloadRoot:
   const others = [...new Set([...pluginIds(global), ...pluginIds(project)])]
     .filter((other) => other !== id && other.split("@")[0] === s.plugin_name)
     .map((other) => {
-      const g = global.get(pluginTable(other)) || null, p = project.get(pluginTable(other)) || null;
+      const g = global.get(pluginTable(other)) || null,
+        p = project.get(pluginTable(other)) || null;
       return { id: other, enabled: typeof p?.enabled === "boolean" ? p.enabled : g?.enabled === true };
     });
+  // A registration newer than what this run offers (the converge story's rule
+  // 6): set before the ladder, so a damaged one keeps it beside its real
+  // reason, and the cache is then read at the version the host registered —
+  // keyed on the desired version, a newer registration's integrity rungs
+  // checked the wrong cache directory.
+  const newer =
+    typeof ownership?.version === "string" &&
+    typeof desiredVersion === "string" &&
+    cmpPrecedence(ownership.version, desiredVersion) > 0;
   const caches = cacheEntries(paths, s);
-  const installed = caches.find((e) => e.version === desiredVersion) || caches[0] || null;
-  const out = { id, paths, path: paths.dir, payloadRoot, desiredVersion, bin, ownership, journal, catalog, market, globalPlugin, projectPlugin, enabled, others, caches, installed, installPath: installed?.path || null, installedVersion: installed?.version || null, state: "absent", reason: null, produced: Boolean(desiredManifest), contentDiffers: null };
+  const installed = caches.find((e) => e.version === (newer ? ownership.version : desiredVersion)) || caches[0] || null;
+  const out = {
+    id,
+    paths,
+    path: paths.dir,
+    payloadRoot,
+    desiredVersion,
+    versionOnly,
+    bin,
+    ownership,
+    journal,
+    catalog,
+    market,
+    globalPlugin,
+    projectPlugin,
+    enabled,
+    others,
+    caches,
+    installed,
+    installPath: installed?.path || null,
+    installedVersion: installed?.version || null,
+    state: "absent",
+    reason: null,
+    produced: Boolean(desiredManifest),
+    contentDiffers: null,
+    newer,
+  };
   const enabledOther = others.find((other) => other.enabled);
   const nothing = !existsSync(paths.dir) && !market && !globalPlugin && !installed && !enabledOther;
-  if (!desiredManifest) return { ...out, state: "unavailable", reason: payloadRoot ? `${payloadRoot} is not a portable plugin root` : `nothing to register from this run: ${harness?.display_name || "this harness"}'s plugin is registered from its distribution shell, not from the core` };
-  if (!bin && nothing) return { ...out, state: "unavailable", reason: `\`${s.cli.bin}\` is not on PATH — the registration needs the host CLI` };
+  if (!desiredManifest && !versionOnly)
+    return {
+      ...out,
+      state: "unavailable",
+      reason: payloadRoot
+        ? `${payloadRoot} is not a portable plugin root`
+        : `nothing to register from this run: ${harness?.display_name || "this harness"}'s plugin is registered from its distribution shell, not from the core`,
+    };
+  if (!bin && nothing)
+    return {
+      ...out,
+      state: "unavailable",
+      reason: `\`${s.cli.bin}\` is not on PATH — the registration needs the host CLI`,
+    };
   let desiredDigest = null;
-  try { desiredDigest = payloadDigest(payloadRoot); } catch (e) { return { ...out, state: "unavailable", reason: e.message }; }
+  if (!versionOnly) {
+    try {
+      desiredDigest = payloadDigest(payloadRoot);
+    } catch (e) {
+      return { ...out, state: "unavailable", reason: e.message };
+    }
+  }
   out.desiredDigest = desiredDigest;
-  if (enabledOther) return { ...out, state: "conflict", refusal: `${enabledOther.id} is already enabled; two ProjectStore plugins would load the same skills and hooks. Disable or remove that registration explicitly, then retry` };
+  if (enabledOther)
+    return {
+      ...out,
+      state: "conflict",
+      refusal: `${enabledOther.id} is already enabled; two ProjectStore plugins would load the same skills and hooks. Disable or remove that registration explicitly, then retry`,
+    };
   // A journal the rollback could not prove names the run that left it, when,
   // and its error, so the reader of the plan is not told recovery is assured
   // (issue #28). Every other phase reads as before.
-  if (journal && !ignoreJournal) return { ...out, state: "stale", reason: journal.phase === "recovery-required"
-    ? `a previous run${journal.failed_at ? ` (${journal.failed_at})` : ""} could not prove its restore: ${String(journal.error || "no error recorded").split("\n")[0]}; this run re-proves the previous state before applying this plan, and refuses if it cannot (${paths.journal})`
-    : "an interrupted registration has a recovery journal; the next confirmed run recovers it before applying this plan" };
-  if (existsSync(paths.dir) && !ownership) return { ...out, state: "foreign", refusal: `${paths.dir} exists without ${s.ownership_manifest}; a source this installer does not own holds the stable marketplace path` };
-  if (market?.source && !samePath(market.source, paths.dir)) return { ...out, state: "foreign", refusal: `${paths.globalConfig} points marketplace ${s.marketplace_name} at ${market.source}, not ${paths.dir}` };
+  if (journal && !ignoreJournal)
+    return {
+      ...out,
+      state: "stale",
+      reason:
+        journal.phase === "recovery-required"
+          ? `a previous run${journal.failed_at ? ` (${journal.failed_at})` : ""} could not prove its restore: ${String(journal.error || "no error recorded").split("\n")[0]}; this run re-proves the previous state before applying this plan, and refuses if it cannot (${paths.journal})`
+          : "an interrupted registration has a recovery journal; the next confirmed run recovers it before applying this plan",
+    };
+  if (existsSync(paths.dir) && !ownership)
+    return {
+      ...out,
+      state: "foreign",
+      refusal: `${paths.dir} exists without ${s.ownership_manifest}; a source this installer does not own holds the stable marketplace path`,
+    };
+  if (market?.source && !samePath(market.source, paths.dir))
+    return {
+      ...out,
+      state: "foreign",
+      refusal: `${paths.globalConfig} points marketplace ${s.marketplace_name} at ${market.source}, not ${paths.dir}`,
+    };
   if (nothing) return out;
   let sourceDigest = null;
-  try { if (existsSync(paths.payload)) sourceDigest = payloadDigest(paths.payload); } catch {}
+  try {
+    if (existsSync(paths.payload)) sourceDigest = payloadDigest(paths.payload);
+  } catch {}
   out.sourceDigest = sourceDigest;
-  out.contentDiffers = Boolean(ownership?.digest) && (ownership.digest.sha256 !== desiredDigest.sha256 || ownership.digest.count !== desiredDigest.count);
+  out.contentDiffers = versionOnly
+    ? null
+    : Boolean(ownership?.digest) &&
+      (ownership.digest.sha256 !== desiredDigest.sha256 || ownership.digest.count !== desiredDigest.count);
   if (!ownership || !catalog) return { ...out, state: "stale", reason: "the owned marketplace source is incomplete" };
-  if (ownership.version === desiredVersion && out.contentDiffers) return { ...out, state: "conflict", refusal: `release ${desiredVersion} already owns this marketplace with a different payload digest` };
-  if (!sourceDigest || sourceDigest.sha256 !== ownership.digest?.sha256 || sourceDigest.count !== ownership.digest?.count) return { ...out, state: "stale", reason: "the stable source does not match its recorded digest" };
+  if (!versionOnly && ownership.version === desiredVersion && out.contentDiffers)
+    return {
+      ...out,
+      state: "conflict",
+      refusal: `release ${desiredVersion} already owns this marketplace with a different payload digest`,
+    };
+  if (
+    !sourceDigest ||
+    sourceDigest.sha256 !== ownership.digest?.sha256 ||
+    sourceDigest.count !== ownership.digest?.count
+  )
+    return { ...out, state: "stale", reason: "the stable source does not match its recorded digest" };
   if (!market) return { ...out, state: "stale", reason: "the host does not know the marketplace" };
-  if (!installed || installed.version !== ownership.version) return { ...out, state: "stale", reason: "the host cache does not contain the registered payload version" };
-  if (!installed.digest || installed.digest.sha256 !== ownership.digest?.sha256 || installed.digest.count !== ownership.digest?.count) return { ...out, state: "stale", reason: "the materialised host cache does not match the registered payload digest" };
-  if (ownership.version !== desiredVersion) return { ...out, state: "stale", reason: `installed ${ownership.version}; package offers ${desiredVersion}` };
-  return { ...out, state: "current", reason: enabled ? null : "installed globally but disabled by effective configuration" };
+  if (!installed || installed.version !== ownership.version)
+    return { ...out, state: "stale", reason: "the host cache does not contain the registered payload version" };
+  if (
+    !installed.digest ||
+    installed.digest.sha256 !== ownership.digest?.sha256 ||
+    installed.digest.count !== ownership.digest?.count
+  )
+    return {
+      ...out,
+      state: "stale",
+      reason: "the materialised host cache does not match the registered payload digest",
+    };
+  // The newer rung, after the integrity rungs: a sound registration newer
+  // than this run is current and never staged over (rule 6). A damaged one
+  // stayed stale above, with its real reason; the planner skips it.
+  if (newer)
+    return {
+      ...out,
+      state: "current",
+      reason: `the registration is at ${ownership.version}, newer than this package (${desiredVersion}) — not downgraded`,
+    };
+  if (ownership.version !== desiredVersion)
+    return { ...out, state: "stale", reason: `installed ${ownership.version}; package offers ${desiredVersion}` };
+  return {
+    ...out,
+    state: "current",
+    reason: enabled ? null : "installed globally but disabled by effective configuration",
+  };
 }

package/node_modules/projectstore/scripts/provenance.mjs

@@ -88,15 +88,18 @@ export const STALE_TEXT = Object.freeze({
 
 // Contract 5's resolution wording (Ivan Morozov's), in one place for the
 // verbs that refuse and the report that names.
-export const FOREIGN_TEXT = "a file we did not write sits at our path — rename it if it is yours, or delete it to let install take the name";
+export const FOREIGN_TEXT =
+  "a file we did not write sits at our path — rename it if it is yours, or delete it to let install take the name";
 
 const normalizeEol = (s) => s.replace(/\r\n/g, "\n");
 
 function unsupportedFormat(format) {
   return new Error(
     `format "${format}" cannot carry a provenance line — a JSON surface is a ` +
-    `SHARED surface (install spec contracts 2 and 6), owned per entry, not stamped; ` +
-    `known stampable formats: ${Object.keys(DELIMITERS).filter((k) => DELIMITERS[k]).join(", ")}`,
+      `SHARED surface (install spec contracts 2 and 6), owned per entry, not stamped; ` +
+      `known stampable formats: ${Object.keys(DELIMITERS)
+        .filter((k) => DELIMITERS[k])
+        .join(", ")}`,
   );
 }
 
@@ -149,7 +152,8 @@ export function provenanceLine({ src, srcHash, pkg, project, render }) {
   // whitespace would be emitted, fail to parse back, derive `foreign`, and
   // make our own file immune to uninstall — refuse it here instead.
   for (const [k, v] of Object.entries({ src, pkg })) {
-    if (/\s/.test(v)) throw new Error(`provenanceLine: field "${k}" may not contain whitespace (got ${JSON.stringify(v)})`);
+    if (/\s/.test(v))
+      throw new Error(`provenanceLine: field "${k}" may not contain whitespace (got ${JSON.stringify(v)})`);
   }
   if (!/^[0-9a-f]{12}$/.test(srcHash) || !/^[0-9a-f]{12}$/.test(render)) {
     throw new Error("provenanceLine: srcHash and render must be 12 lowercase hex characters");
@@ -198,7 +202,9 @@ function insertionOffset(body, format) {
     const m = /^---\n(?:[\s\S]*?\n)?---(?:\n|$)/.exec(body);
     if (m) return m[0].length;
     if (body.startsWith("---\n") || body === "---") {
-      throw new Error("insertStamp: markdown body opens a frontmatter block that never closes — refusing to stamp before it");
+      throw new Error(
+        "insertStamp: markdown body opens a frontmatter block that never closes — refusing to stamp before it",
+      );
     }
   }
   if (format === "mjs" && body.startsWith("#!")) {
@@ -219,7 +225,9 @@ export function insertStamp(body, { format, harness, source, generator = DEFAULT
   delimitersFor(format);
   const text = normalizeEol(String(body));
   if (bareTokenRe().test(text)) {
-    throw new Error(`insertStamp: the body already carries a bare ${PROVENANCE_TOKEN} line — it would survive into the installed file`);
+    throw new Error(
+      `insertStamp: the body already carries a bare ${PROVENANCE_TOKEN} line — it would survive into the installed file`,
+    );
   }
   const at = insertionOffset(text, format);
   const block = banner(format, { harness, source, generator, remedy }) + PROVENANCE_TOKEN + "\n";
@@ -250,7 +258,10 @@ export function substituteProvenance(tokenized, { format, src, srcHash, pkg, pro
 // read and be born "edited by hand" — a false accusation reinstalling cannot
 // clear. The cost: an edit confined to such a quoted line does not move
 // `render=`; strictly narrower harm than a permanent false positive.
-export function stamp(body, { format, src, srcHash, pkg, project, harness, generator = DEFAULT_GENERATOR, remedy = DEFAULT_REMEDY }) {
+export function stamp(
+  body,
+  { format, src, srcHash, pkg, project, harness, generator = DEFAULT_GENERATOR, remedy = DEFAULT_REMEDY },
+) {
   const tokenized = insertStamp(body, { format, harness, source: src, generator, remedy });
   const render = renderHash(neutralizeProject(tokenizeProvenance(tokenized) ?? tokenized, project));
   const text = substituteProvenance(tokenized, { format, src, srcHash, pkg, project, render });
@@ -336,7 +347,8 @@ export function deriveState({ file, sourceHash: srcNow, pkg, renderNowHash, proj
     provenance,
     writtenBy: provenance ? provenance.project : null,
     sameProject: Boolean(
-      provenance && typeof project === "string" &&
+      provenance &&
+      typeof project === "string" &&
       stripTrailingSlash(provenance.project) === stripTrailingSlash(project),
     ),
   });
@@ -348,8 +360,12 @@ export function deriveState({ file, sourceHash: srcNow, pkg, renderNowHash, proj
   const parsed = parseProvenance(file.text);
   if (!parsed) return result("foreign");
   const provenance = {
-    v: parsed.v, src: parsed.src, srcHash: parsed.srcHash,
-    pkg: parsed.pkg, project: parsed.project, render: parsed.render,
+    v: parsed.v,
+    src: parsed.src,
+    srcHash: parsed.srcHash,
+    pkg: parsed.pkg,
+    project: parsed.project,
+    render: parsed.render,
   };
 
   // A newer grammar than this parser knows. The spec does not say; reporting