rvlib-shipkit 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 1.0.1
+
+- **A layout move lands once, and its commit says what it moved.** A tracked root `STATUS.md` that named an old folder was dropped and then written back by the text sweep in the same pass, so the move commit kept it, and the next run landed a second commit, titled as a move, that moved nothing and reported `moved  under .shipkit/`. A legacy generated file is now only dropped, never swept. The commit title is built from what the pass did (`chore(machine): move asks/ and .rv-identity/ under .shipkit/, and drop the root STATUS.md, which shipkit writes under .shipkit/`), so a pass that moves no folder never carries the move title, and the fix pass and SK004 print the same words (`layoutSummary` in `core/migrate-layout.ts`, which replaces `MIGRATION_MESSAGE`).
+
+- **An update never guesses the package manager.** `detectPackageManager` returns the manager the tracked lock files name, or a refusal (`{ refused }`, `isRefusal`) when they name none or two: no lock at all used to mean bun, and two managers' locks used to mean bun with a warning, so an npm repo could be updated with bun, which moves package.json and leaves `package-lock.json` on the old version. SK005 and the self-update WARN with the refusal and run nothing. `shipkit fleet --update` refuses a repo it cannot tell, and a non bun repo whose installed shipkit is older than 1.0.0, whose own update ran bun whatever the lock said; it prints the command in the repo's manager instead (`updateRefusal`, `PM_AWARE_SINCE` in `fleet/scan-fleet.ts`). The `warn` field of `PackageManager` is gone.
+
+- **The layout move rewrites the paths `repo.config.ts` holds.** Every quoted value that names a moved folder as a path (`hooks.leakAllow` paths, `hooks.blockedPaths`, `gitignore` lines, a prose include, any other string starting with `asks/`, `tmp/`, `hooks/` or a `.rv-<x>/` folder) now names its new place, in the same machine commit. The ignore block is rendered from those rewritten values, and the rule fixers that run after the move in the same fix pass read the rewritten config (`runFix` takes `config`, and the fix pass reports the config as reshaped). Before, `leakAllow: [{ paths: ['asks/'] }]` kept naming a folder that was gone, and a repo line in `gitignore` came back under its old name, which took a second move commit to clear. `sweepConfigSource` and `rebaseConfigPaths` are exported from `core/migrate-layout.ts`, and `renderGitignore` receives the moved config as a third argument.
+
+- **The seeded `sk-` key shape starts where a token starts.** `re:sk-[A-Za-z0-9_-]{20,}` matched inside a word ending in `sk`, so an ask file named `ask-the-town-hall-...` was refused as an API key. The starter row is now `re:(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{20,}` (`SK_KEY_ROW`), and a keyword file that still carries the old seeded row is read with the fixed shape under its old id, so a waiver written against its fingerprint keeps working.
+
+- **Every file a check file or `repo.config.ts` reaches compiles under a strict, node only consumer tsconfig.** The package ships its source, so a consumer's compiler judges it. Unused imports in `core/run-ci.ts`, `repo-config.ts`, `core/floor-resolve.ts`, `collections/checks.ts`, `wiki/scan-md.ts` and `assets/gen/derived.ts` failed a consumer with `noUnusedLocals` or `noUnusedParameters`, and `smoke/run-smoke.ts` named the dom `document`, which fails a consumer whose `lib` has no dom. `tsconfig.consumer.json` compiles `check.ts`, `repo-config.ts` and the barrel with those flags, `lib: ["ESNext"]` and bun types only, and `tests/consumer-typecheck.test.ts` (full tier) runs it, with samples that prove each flag bites.
+
 ## 1.0.0
 
 - **The PreToolUse guard refuses a piped gate.** `shipkit ci …|`, `bun <dir>/cli.ts ci …|`, `bunx shipkit ci …|`, `bun run test …|` and `bun run ci …|` exit 2 with the reason and the fix, whatever the deny list says: a pipeline exits with its last command's code, so a red gate reads green. A `>` redirect, `bun run test:raw <file> | tail` and a pipeline under `set -o pipefail` pass. `pipedGateIn`, `pipedGateRefusal` and `shellParts` (each segment with the operator that ends it) are exported from `core/one-way-in-policy.ts`, and a redirection's `&` (`2>&1`, `&>log`) no longer splits a segment.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "1.0.0",
+    "version": "1.0.1",
     "funding": "https://github.com/sponsors/rvion",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",

package/src/assets/gen/derived.ts

@@ -47,7 +47,7 @@ export async function recordParents(destDir: string, seed: number, parents: Reco
 /** A derived asset is STALE when its PICKED roll's recorded parent picks
  *  differ from the parents' CURRENT picks (or were never recorded). An
  *  unpicked asset is never stale — it's just unpicked. */
-export async function isStale(kit: KitConfig, workspace: string, f: FoundAsset): Promise<boolean> {
+export async function isStale(_kit: KitConfig, workspace: string, f: FoundAsset): Promise<boolean> {
     const parentIds = parentIdsOf(f)
     if (parentIds.length === 0) return false
     const dir = assetDir(workspace, f.asset.id)

package/src/checks/SK004-gitignore-policy.check.ts

@@ -20,7 +20,7 @@ import { GENERATED_IGNORE_LINES, GENERATED_TRACKED_PATHS, untrackGenerated } fro
 import { check, type CheckCtx, type FixResult } from '../check.ts'
 import { gitBin } from '../core/git-bin.ts'
 import { LAYOUT, SHIPKIT_DIR, TRACKED_DIRS } from '../core/layout.ts'
-import { LEGACY_CONTRACT_PREFIX, LEGACY_IGNORED, LEGACY_TMP, LEGACY_VENUES, legacyLayoutLeft, migrateLayout } from '../core/migrate-layout.ts'
+import { LEGACY_CONTRACT_PREFIX, LEGACY_IGNORED, LEGACY_TMP, LEGACY_VENUES, layoutSummary, legacyLayoutLeft, migrateLayout } from '../core/migrate-layout.ts'
 
 /** what this check reads, writes and asks git through */
 type Disk = Pick<CheckCtx, 'root' | 'read' | 'write' | 'exists' | 'exec'>
@@ -272,11 +272,11 @@ export const gitignorePolicy = check({
     },
     fix: async (c): Promise<FixResult> => {
         // the move first: it writes the new block itself, before any folder moves
-        const moved = process.env.SHIPKIT_FROZEN === '1' ? null : migrateLayout(c.root, { config: c.config, renderGitignore: (t, legacy) => renderPolicy(t, c.config, legacy) })
+        const moved = process.env.SHIPKIT_FROZEN === '1' ? null : migrateLayout(c.root, { config: c.config, renderGitignore: (t, legacy, cfg) => renderPolicy(t, cfg ?? c.config, legacy) })
         const layout = moved == null ? null
             : moved.deferred != null ? `layout move deferred: ${moved.deferred}`
-            : moved.moved.length === 0 && moved.removed.length === 0 ? null
-            : `moved ${moved.moved.map((m) => m.from).join(', ')} under ${SHIPKIT_DIR}/${moved.commit != null ? ` (committed as ${moved.commit})` : moved.uncommitted === true ? ', the commit did not land' : ''}`
+            : layoutSummary(moved) === '' ? null
+            : `layout: ${layoutSummary(moved)}${moved.commit != null ? ` (committed as ${moved.commit})` : moved.uncommitted === true ? ', the commit did not land' : ''}`
         const legacy = hasLegacy(c.root)
         const before = blockState(c, c.config, legacy)
         // terminate an unterminated file even when the block itself is current:

package/src/checks/SK005-rvlib-versions.check.ts

@@ -42,7 +42,7 @@ import { existsSync, readFileSync } from 'fs'
 import { join } from 'path'
 import type { CheckCtx } from '../core/check-ctx.ts'
 import { mutateLease, withMutateLease } from '../core/locked-write.ts'
-import { detectPackageManager } from '../core/package-manager.ts'
+import { detectPackageManager, isRefusal, LOCK_FILES } from '../core/package-manager.ts'
 import { check, type CheckEnv } from '../check.ts'
 
 type Pkg = { version?: string; dependencies?: Record<string, string>; devDependencies?: Record<string, string> }
@@ -85,7 +85,7 @@ export const rvlibVersions = check({
         const deps = Object.entries({ ...pkg.dependencies, ...pkg.devDependencies }).filter(([n]) => n.startsWith('rvlib-'))
         if (deps.length === 0) return c.ok('no rvlib-* deps')
         const pm = detectPackageManager(c.root)
-        const manifest = ['package.json', ...pm.locks]
+        const manifest = ['package.json', ...(isRefusal(pm) ? LOCK_FILES : pm.locks)]
 
         const stale: Array<{ name: string; installed: string; latest: string }> = []
         for (const [name, spec] of deps) {
@@ -95,7 +95,7 @@ export const rvlibVersions = check({
                 continue
             }
             const installed = installedVersion(c.root, name)
-            if (installed == null) { c.fail(`${name} declared (${spec}) but not installed — run: ${pm.install.join(' ')}`); continue }
+            if (installed == null) { c.fail(`${name} declared (${spec}) but not installed — ${isRefusal(pm) ? pm.refused : `run: ${pm.install.join(' ')}`}`); continue }
             let latest: string
             try { latest = await latestVersion(c, name) } catch (e) {
                 c.lines.push({ kind: 'skip', text: `${name} ${installed} — registry unreachable (${String(e).slice(0, 80)}), version drift unknown` })
@@ -113,8 +113,11 @@ export const rvlibVersions = check({
 
         const drift = stale.map((s) => `${s.name} ${s.installed} → ${s.latest}`).join(', ')
         const names = stale.map((s) => s.name)
+        if (isRefusal(pm)) {
+            c.warn(`newer rvlib live: ${drift}, not updating: ${pm.refused}`)
+            return
+        }
         const cmd = pm.update(names)
-        if (pm.warn != null) c.warn(pm.warn)
         if (process.env['SHIPKIT_FROZEN'] === '1') {
             c.warn(`newer rvlib live: ${drift} (frozen — apply with: ${cmd.join(' ')})`)
             return

package/src/cli/cmd_Fleet.ts

@@ -5,14 +5,17 @@
 import { Command, Option } from 'clipanion'
 import { existsSync } from 'fs'
 import { join } from 'path'
-import { npmLatest, resolveLatest, scanFleet, type FleetRepo } from '../fleet/scan-fleet.ts'
+import { npmLatest, resolveLatest, scanFleet, updateRefusal, type FleetRepo } from '../fleet/scan-fleet.ts'
 import { spawnWithTimeout } from '../core/spawn-timeout.ts'
-import { detectPackageManager } from '../core/package-manager.ts'
+import { detectPackageManager, isRefusal } from '../core/package-manager.ts'
 
 const short = (name: string): string => name.replace(/^rvlib-/, '')
 // the hand-run fallback speaks the manager THAT repo installs with: telling
 // an npm consumer to run bun leaves its package-lock.json behind
-const manualUpdate = (r: FleetRepo): string => detectPackageManager(r.dir).update(r.behind.map((d) => d.name)).join(' ')
+const manualUpdate = (r: FleetRepo): string => {
+    const pm = detectPackageManager(r.dir)
+    return isRefusal(pm) ? `<its package manager> update ${r.behind.map((d) => d.name).join(' ')} (${pm.refused})` : pm.update(r.behind.map((d) => d.name)).join(' ')
+}
 
 export class FleetCommand extends Command {
     static override paths = [['fleet']]
@@ -92,6 +95,12 @@ export class FleetCommand extends Command {
                 failed++
                 continue
             }
+            const refused = updateRefusal(r)
+            if (refused != null) {
+                w(`WARN ${r.name}: not updating: ${refused}`)
+                failed++
+                continue
+            }
             const cli = join(r.dir, 'node_modules', 'rvlib-shipkit', 'src', 'cli.ts')
             if (!existsSync(cli)) {
                 w(`WARN ${r.name}: no shipkit installed, so it cannot update itself — run: cd ${r.dir} && ${manualUpdate(r)}`)

package/src/collections/checks.ts

@@ -142,7 +142,6 @@ function instanceOf(root: string, c: RepoConfig, row: CheckRow, stat: CheckStat
         keepsUntil: keepsUntil(row.decl.ttl, stat),
         recent: recent ?? [],
     }
-    const wire = last?.lines ?? []
     return {
         id: `check:${id}`,
         text: feedLine(row, facts),

package/src/core/floor-resolve.ts

@@ -99,7 +99,7 @@ const SUITE_CLI = fileURLToPath(import.meta.resolve('rvlib-shipkit/src/suite/sui
  *  bunfig, its preload and its `units[].tests` budget apply, after the checks
  *  its `deps` name. Its inputs are its dir and the dirs of the
  *  sibling units its package.json names, derived rather than declared */
-function unitTestTasks(c: RepoConfig, root: string, io: FloorReader, subs: TestUnitDecl[], siblings: Map<string, string[]>, notes: string[], unfilled: { id: string; reason: string }[]): TaskDef[] {
+function unitTestTasks(root: string, io: FloorReader, subs: TestUnitDecl[], siblings: Map<string, string[]>, notes: string[], unfilled: { id: string; reason: string }[]): TaskDef[] {
     const read = io.text
     const out: TaskDef[] = []
     for (const u of subs) {
@@ -258,7 +258,7 @@ export function resolveFloor(c: RepoConfig, root: string, io: FloorReader): Floo
         else { tasks.push(decorate(b.task)); sources[id] = b.source }
     }
     const siblings = siblingUnits(subs, io.text)
-    for (const t of unitTestTasks(c, root, io, subs, siblings, notes, unfilled)) { tasks.push(t); sources[t.id] = 'unit' }
+    for (const t of unitTestTasks(root, io, subs, siblings, notes, unfilled)) { tasks.push(t); sources[t.id] = 'unit' }
     for (const t of unitTypecheckTasks(root, io, subs, siblings, unfilled)) { tasks.push(t); sources[t.id] = 'unit' }
     return { tasks, disabled, unfilled, sources, notes }
 }

package/src/core/migrate-layout.ts

@@ -34,7 +34,20 @@ import { nestedIn } from './nesting.ts'
 /** the prefix every contract folder carried before `.shipkit/` */
 export const LEGACY_CONTRACT_PREFIX = '.rv-'
 
-export const MIGRATION_MESSAGE = 'chore(machine): move the shipkit folders under .shipkit/'
+const CONFIG_FILE = 'repo.config.ts'
+
+/** what one pass did, in words: the folders it moved and the root files it
+ *  dropped. Empty when it did neither, so no caller prints a sentence with a
+ *  hole where the list should be */
+export function layoutSummary(r: { moved: LayoutMove[]; removed: string[] }): string {
+    const list = (xs: string[]): string => (xs.length <= 1 ? xs.join('') : `${xs.slice(0, -1).join(', ')} and ${xs.at(-1)}`)
+    const folders = r.moved.filter((m) => m.kind !== 'cache').map((m) => `${m.from}/`)
+    const parts = [
+        ...(folders.length > 0 ? [`move ${list(folders)} under ${SHIPKIT_DIR}/`] : []),
+        ...(r.removed.length > 0 ? [`drop the root ${list(r.removed)}, which shipkit writes under ${SHIPKIT_DIR}/`] : []),
+    ]
+    return parts.join(', and ')
+}
 
 /** the contract names a typo is matched against */
 const KNOWN = ['identity', 'assets', 'comfy', 'private', 'reflections', 'social', 'journal', 'domain', 'itch', 'steam', 'discord'] as const
@@ -200,6 +213,39 @@ export function rebaseRelative(text: string, at: { from: string; to: string }, m
         .replace(/(\]\()(\.\.?\/[^)\s#]+)/g, (_m, lead: string, spec: string) => `${lead}${rebase(spec)}`)
 }
 
+/** one repo.config.ts value that names a moved folder, as a path: the folder
+ *  then a slash, behind an optional `!`, `/` or `./`. A word, a bare folder
+ *  name and a longer name that merely starts the same stay as they are */
+function rebasePathValue(v: string, moves: LayoutMove[]): string {
+    const m = /^(!?(?:\/|\.\/)?)(.*)$/s.exec(v)!
+    const rest = m[2]!
+    const hit = moves.find((x) => rest.startsWith(`${x.from}/`))
+    return hit == null ? v : `${m[1]}${hit.to}${rest.slice(hit.from.length)}`
+}
+
+/** PURE: repo.config.ts source with every quoted path that names a moved
+ *  folder rewritten (`leakAllow` paths, `blockedPaths`, `gitignore` lines, a
+ *  prose include, any other value): each of them is a repo path by contract */
+export function sweepConfigSource(text: string, moves: LayoutMove[]): string {
+    if (moves.length === 0) return text
+    return text.replace(/(['"`])((?:\\.|(?!\1)[^\\\n])*)\1/g, (lit, q: string, body: string) => {
+        if (q === '`' && body.includes('${')) return lit
+        const next = rebasePathValue(body, moves)
+        return next === body ? lit : `${q}${next}${q}`
+    })
+}
+
+/** PURE: the loaded config with the same rewrite, so what this pass renders
+ *  from it (the ignore block) reads the values the file now holds. Only plain
+ *  objects and arrays are copied; functions and class instances are kept */
+export function rebaseConfigPaths<T>(v: T, moves: LayoutMove[]): T {
+    if (typeof v === 'string') return rebasePathValue(v, moves) as T
+    if (Array.isArray(v)) return v.map((x) => rebaseConfigPaths(x, moves)) as T
+    if (v != null && typeof v === 'object' && Object.getPrototypeOf(v) === Object.prototype)
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, rebaseConfigPaths(x, moves)])) as T
+    return v
+}
+
 /** PURE: the .gitignore after the move. Old names turn into new ones, except
  *  the folders still on disk (`keep`), whose lines keep guarding them. A
  *  negation of one FILE inside a folder (`!.shipkit/social/README.md`) is dead
@@ -400,8 +446,10 @@ function inProgress(root: string): string | null {
 export type MigrateOpts = {
     config?: RepoConfig
     /** re-render the SK004 block into this .gitignore text (SK004 owns the
-     *  block). `legacy`: an old folder is still on disk, so its name stays ignored */
-    renderGitignore?: (text: string, legacy: boolean) => string
+     *  block). `legacy`: an old folder is still on disk, so its name stays
+     *  ignored. `config`: the repo config with its paths already moved, which
+     *  is what the block must be rendered from */
+    renderGitignore?: (text: string, legacy: boolean, config?: RepoConfig) => string
 }
 
 /** tracked symlinks, with where each points */
@@ -442,8 +490,13 @@ export function migrateLayout(root: string, o: MigrateOpts = {}): LayoutResult {
     const targets = Object.fromEntries(plan.moves.filter((m) => m.kind === 'contract').map((m) => [m.from, m.to]))
     const sources = plan.moves.filter((m) => m.kind !== 'cache').map((m) => m.from)
     const tracked = inGit ? lsFiles(root, [...sources, ...legacyStatus]) : []
-    // a moved file is rebased whether or not it names an old folder
-    const swept = inGit ? [...new Set([...sweepTargets(root, contractNames), ...tracked.filter((t) => /\.(m?[jt]sx?|json|md)$/.test(t))])] : []
+    // a moved file is rebased whether or not it names an old folder, and
+    // repo.config.ts whenever one of its values names one
+    const configNames = inGit && lsFiles(root, [CONFIG_FILE]).length > 0 && sweepConfigSource(readFileSync(join(root, CONFIG_FILE), 'utf8'), plan.moves) !== readFileSync(join(root, CONFIG_FILE), 'utf8') ? [CONFIG_FILE] : []
+    // a legacy generated file is dropped, never rewritten: a rewrite would
+    // write it back after the drop, and the commit would keep it
+    const dropped = new Set<string>(legacyStatus)
+    const swept = inGit ? [...new Set([...sweepTargets(root, contractNames), ...tracked.filter((t) => /\.(m?[jt]sx?|json|md)$/.test(t)), ...configNames])].filter((f) => !dropped.has(f)) : []
     const links = inGit ? trackedLinks(root) : []
     // commit the ignore file when git tracks it, or when this pass creates it:
     // it is what keeps the moved private folders out. An existing untracked
@@ -464,7 +517,8 @@ export function migrateLayout(root: string, o: MigrateOpts = {}): LayoutResult {
         const text = readFileSync(join(root, rel), 'utf8')
         if (text.includes(SWEEP_SKIP)) continue
         const now = movedTo(moves, rel)
-        const next = sweepText(rebaseRelative(text, { from: rel, to: now }, moves), targets, { from: rel, to: now })
+        const paths = rel === CONFIG_FILE ? sweepConfigSource(text, moves) : text
+        const next = sweepText(rebaseRelative(paths, { from: rel, to: now }, moves), targets, { from: rel, to: now })
         if (next !== text) writes.push({ now, text: next })
     }
     const relinks: { now: string; target: string }[] = []
@@ -486,7 +540,8 @@ export function migrateLayout(root: string, o: MigrateOpts = {}): LayoutResult {
 
     const gi = join(root, '.gitignore')
     const giOriginal = existsSync(gi) ? readFileSync(gi, 'utf8') : ''
-    const render = (text: string, legacy: boolean): string => (o.renderGitignore != null ? o.renderGitignore(text, legacy) : text)
+    const config = o.config == null ? undefined : rebaseConfigPaths(o.config, moves)
+    const render = (text: string, legacy: boolean): string => (o.renderGitignore != null ? o.renderGitignore(text, legacy, config) : text)
     const stillOld = (): string[] => dirsIn(root).filter((d) => d.startsWith(LEGACY_CONTRACT_PREFIX))
     try {
         // 1. both layouts ignored while any folder is in flight
@@ -550,7 +605,11 @@ export function migrateLayout(root: string, o: MigrateOpts = {}): LayoutResult {
     const giChanged = giNew || (giTracked && readFileSync(join(root, '.gitignore'), 'utf8') !== giOriginal)
     const touched = [...new Set([...tracked, ...added, ...sweptTracked, ...(giChanged ? ['.gitignore'] : [])])]
     if (touched.length === 0) return out
-    const landed = machineCommit({ anchor: root, message: MIGRATION_MESSAGE, paths: touched.map((p) => join(root, p)) })
+    // the title names what this commit carries; a pass that did neither has
+    // nothing tracked to land and returned above
+    const what = layoutSummary(out)
+    if (what === '') return out
+    const landed = machineCommit({ anchor: root, message: `chore(machine): ${what}`, paths: touched.map((p) => join(root, p)) })
     if (!landed) return { ...out, uncommitted: true, pending: touched }
     out.commit = git(root, ['rev-parse', '--short', 'HEAD']).out.trim()
     return out

package/src/core/package-manager.ts

@@ -7,9 +7,8 @@
 // TRACKED locks decide, because an untracked bun.lock is exactly what a wrong
 // update leaves behind, and reading it as the repo's choice would make that
 // first mistake permanent. Nothing tracked (a fresh tree, no git) falls back
-// to what sits on disk. Among several, the order below IS the preference, and
-// the loser is named so the drift is visible. No lock at all is bun, the
-// house default.
+// to what sits on disk. No lock at all, or locks of two managers, is a
+// REFUSAL that names what it saw: a guessed manager is the failure above.
 import { existsSync } from 'fs'
 import { join } from 'path'
 import { gitBin } from './git-bin.ts'
@@ -24,10 +23,11 @@ export type PackageManager = {
     install: string[]
     /** move these deps to their latest version, manifest AND lock in one call */
     update: (names: string[]) => string[]
-    /** set when several managers own a lock here, so the pick is a guess */
-    warn?: string
 }
 
+/** the manager, or why the lock files do not name exactly one */
+export type PackageManagerPick = PackageManager | { refused: string }
+
 const BUN_LOCKS = ['bun.lock', 'bun.lockb']
 export const LOCK_FILES = [...BUN_LOCKS, 'pnpm-lock.yaml', 'yarn.lock', 'package-lock.json']
 
@@ -70,17 +70,19 @@ export function trackedLocks(root: string): string[] {
 }
 
 /** the manager this repo installs with, read off its lock files */
-export function detectPackageManager(root: string, tracked: string[] = trackedLocks(root)): PackageManager {
+export function detectPackageManager(root: string, tracked: string[] = trackedLocks(root)): PackageManagerPick {
     const present = LOCK_FILES.filter((f) => existsSync(join(root, f)))
     const owned = present.filter((f) => tracked.includes(f))
     const locks = owned.length > 0 ? owned : present
-    const has = (f: string): boolean => locks.includes(f)
-    let pick = bun
-    if (BUN_LOCKS.some(has)) pick = bun
-    else if (has('pnpm-lock.yaml')) pick = pnpm
-    else if (has('yarn.lock')) pick = yarn(existsSync(join(root, '.yarnrc.yml')))
-    else if (has('package-lock.json')) pick = npm
-    const others = locks.filter((f) => !pick.locks.includes(f))
-    if (others.length === 0) return pick
-    return { ...pick, warn: `several lock files at the root (${locks.join(', ')}) — updating with ${pick.name}, so ${others.join(', ')} will drift; delete the one this repo does not install with` }
+    const managers = [
+        ...(locks.some((f) => BUN_LOCKS.includes(f)) ? [bun] : []),
+        ...(locks.includes('pnpm-lock.yaml') ? [pnpm] : []),
+        ...(locks.includes('yarn.lock') ? [yarn(existsSync(join(root, '.yarnrc.yml')))] : []),
+        ...(locks.includes('package-lock.json') ? [npm] : []),
+    ]
+    if (managers.length === 1) return managers[0]!
+    if (managers.length === 0) return { refused: `no lock file at the root (looked for ${LOCK_FILES.join(', ')}), so which package manager installs this repo is unknown: install once with the right one and commit its lock` }
+    return { refused: `lock files of ${managers.length} package managers ${owned.length > 0 ? 'are tracked' : 'sit at the root'} (${locks.join(', ')}), so which one installs this repo is unknown: delete the lock of the one it does not install with` }
 }
+
+export const isRefusal = (p: PackageManagerPick): p is { refused: string } => 'refused' in p

package/src/core/run-ci.ts

@@ -6,15 +6,14 @@
 // (write-status.ts — atomic + lock) unless status:false, and the fix pass plus
 // some checks WRITE, so a run is not read-only unless frozen is set and
 // --no-fix is passed.
-import { join } from 'path'
 import { loadRepoConfig, type RepoConfig } from '../repo-config.ts'
 import { reportToMotherhome } from './motherhome.ts'
 import { runCheckPass, type CheckOpts } from './run-check.ts'
 import { poolLines } from './slots.ts'
 import { runFixPass } from './run-fixers.ts'
-import { formatLine, type Line } from './wire.ts'
+import { formatLine } from './wire.ts'
 import { writeStatus } from './write-status.ts'
-import { allTasks, composeChecks, envTier, FULL_TESTS_ENV, gateInventory, type TestTier } from '../ledger/gate-checks.ts'
+import { allTasks, composeChecks, envTier, FULL_TESTS_ENV, type TestTier } from '../ledger/gate-checks.ts'
 import { CHECK_TABLE_FILE, writeCheckTable } from '../ledger/check-table.ts'
 import { Ledger } from '../ledger/ledger.ts'
 import { RunLog, type InvokedBy } from '../ledger/run-log.ts'

package/src/core/run-fix.ts

@@ -17,11 +17,14 @@ export type FixOpts = {
      *  not wire-shaped, which the frozen output contract forbids */
     quiet?: boolean
     print?: (line: string) => void
+    /** the config as it stands on disk now, when the caller holds one: a
+     *  second load of a rewritten repo.config.ts can hit the module cache */
+    config?: RepoConfig
 }
 
 export async function runFix(root: string, o: FixOpts = {}): Promise<number> {
     const print = o.print ?? ((l: string) => console.log(l))
-    const config = await loadRepoConfig(root)
+    const config = o.config ?? (await loadRepoConfig(root))
     const env: CheckEnv = { root, config }
     // a fresh context per body: a fixer may rewrite the config, and the body
     // after it must read the one on disk now

package/src/core/run-fixers.ts

@@ -12,13 +12,13 @@ import { existsSync, readFileSync } from 'fs'
 import { join } from 'path'
 import { fileURLToPath } from 'url'
 import { armHooks } from '../hooks/run-hooks.ts'
-import type { RepoConfig } from '../repo-config.ts'
+import { loadRepoConfig, type RepoConfig } from '../repo-config.ts'
 import { runFix } from './run-fix.ts'
 import { routesToShipkit } from './canonical-scripts.ts'
 import { discoverLegacyChecks } from './discover-legacy-checks.ts'
 import { repoCheckFiles } from './discover-checks.ts'
 import { mutateLease, withMutateLease } from './locked-write.ts'
-import { migrateLayout } from './migrate-layout.ts'
+import { layoutSummary, migrateLayout } from './migrate-layout.ts'
 import { renderPolicy } from '../checks/SK004-gitignore-policy.check.ts'
 import { spawnWithTimeout } from './spawn-timeout.ts'
 import { gitBin } from './git-bin.ts'
@@ -180,20 +180,29 @@ export async function runFixPass(root: string, config: RepoConfig, o: FixPassOpt
     return { ran: false, touched: [], failed: false, reshaped: false }
 }
 
-async function fixPassBody(root: string, config: RepoConfig, o: FixPassOpts, verify: boolean): Promise<FixPassResult> {
+async function fixPassBody(root: string, loaded: RepoConfig, o: FixPassOpts, verify: boolean): Promise<FixPassResult> {
+    let config = loaded
+    const shapeBefore = shapeStamp(root)
     // the old root layout moves under .shipkit/ before anything else reads a
     // path: a move is not a decision, so it lands as one machine commit and
     // only what a machine cannot decide reaches a human. Runs before the tree
     // snapshot, and before hooks arm, because the hooks folder may be what moves
     if (!verify) {
-        const m = migrateLayout(root, { config, renderGitignore: (t, legacy) => renderPolicy(t, config, legacy) })
-        if (m.moved.length > 0 || m.removed.length > 0) {
-            const what = m.moved.filter((x) => x.kind !== 'cache').map((x) => `${x.from}/`).join(' ')
+        const m = migrateLayout(root, { config, renderGitignore: (t, legacy, cfg) => renderPolicy(t, cfg ?? config, legacy) })
+        // the move rewrote repo.config.ts, so the config loaded before it names
+        // folders that are gone, and every fixer below must read the new one
+        if (m.swept.includes('repo.config.ts')) {
+            try { config = await loadRepoConfig(root, { fresh: true }) } catch (e) {
+                o.print(`WARN repo.config.ts does not load after the move rewrote it: ${String((e as Error)?.message ?? e).slice(0, 160)}`)
+            }
+        }
+        const what = layoutSummary(m)
+        if (what !== '') {
             if (m.uncommitted === true) {
-                o.print(`WARN moved ${what} under .shipkit/, and the commit did not land`)
+                o.print(`WARN layout: ${what}. The commit did not land`)
                 const p = m.pending ?? []
-                o.print(`      fix: commit exactly these paths, never a bare commit: git commit -m 'chore: move the shipkit folders under .shipkit/' -- ${p.slice(0, 12).join(' ')}${p.length > 12 ? ` (+${p.length - 12} more, listed by git status)` : ''}`)
-            } else if (what !== '') o.print(`ok: moved ${what} under .shipkit/${m.commit != null ? `, committed as ${m.commit}` : ''}`)
+                o.print(`      fix: commit exactly these paths, never a bare commit: git commit -m 'chore: ${what}' -- ${p.slice(0, 12).join(' ')}${p.length > 12 ? ` (+${p.length - 12} more, listed by git status)` : ''}`)
+            } else o.print(`ok: layout: ${what}${m.commit != null ? `, committed as ${m.commit}` : ''}`)
         }
         if (m.deferred != null) {
             o.print(`WARN the move under .shipkit/ is deferred: ${m.deferred}`)
@@ -218,7 +227,6 @@ async function fixPassBody(root: string, config: RepoConfig, o: FixPassOpts, ver
     for (const u of unfilled) o.print(`skip: ${u.id} (${u.reason})`)
     for (const d of disabled) o.print(`skip: ${d.id} (${d.reason})`)
     const before = treeState(root)
-    const shapeBefore = shapeStamp(root)
 
     for (const s of slots) {
         const r = await spawnWithTimeout(s.cmd, { cwd: root, timeoutMs: FIXER_TIMEOUT_MS })
@@ -228,7 +236,7 @@ async function fixPassBody(root: string, config: RepoConfig, o: FixPassOpts, ver
             o.print(`WARN fix ${s.id} failed (exit ${r.code}) — ${r.out.trim().split('\n').at(-1)?.slice(0, 160) ?? ''}; the gate below still ran`)
     }
     // structural repo-config repair is never implicit, and never in verify mode
-    if (o.rules === true && !verify) await runFix(root, { quiet: true, print: o.print })
+    if (o.rules === true && !verify) await runFix(root, { quiet: true, print: o.print, config })
 
     const after = treeState(root)
     const reshaped = shapeStamp(root) !== shapeBefore

package/src/core/self-update.ts

@@ -14,7 +14,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { dirname, join } from 'path'
 import { fileURLToPath } from 'url'
-import { detectPackageManager } from './package-manager.ts'
+import { detectPackageManager, isRefusal } from './package-manager.ts'
 import { gitBin } from './git-bin.ts'
 
 const PKG = 'rvlib-shipkit'
@@ -104,7 +104,9 @@ export async function maybeSelfUpdateAndRestart(root: string): Promise<void> {
     const plan = planSelfUpdate({ ...base, latest: await latestCached(), manifestDirty: manifestDirty(root) })
     if (plan.action === 'warn') { console.error(`WARN self-update: ${plan.reason}`); return }
     if (plan.action !== 'update') return
-    const cmd = detectPackageManager(root).update([PKG])
+    const pm = detectPackageManager(root)
+    if (isRefusal(pm)) { console.error(`WARN self-update: rvlib-shipkit ${plan.installed} is behind ${plan.latest}, not updating: ${pm.refused}`); return }
+    const cmd = pm.update([PKG])
     console.error(`ok: rvlib-shipkit ${plan.installed} → ${plan.latest}, self-updating (${cmd.join(' ')})`)
     const up = Bun.spawnSync(cmd, { cwd: root, stdout: 'inherit', stderr: 'inherit' })
     if (up.exitCode !== 0) { console.error(`WARN self-update failed (exit ${up.exitCode}), continuing on ${plan.installed}`) ; return }

package/src/fleet/scan-fleet.ts

@@ -12,6 +12,7 @@
 // so the fix travels through that one code path.
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
 import { join } from 'path'
+import { detectPackageManager, isRefusal } from '../core/package-manager.ts'
 
 export type Pkg = { name?: string; version?: string; dependencies?: Record<string, string>; devDependencies?: Record<string, string> }
 
@@ -140,3 +141,18 @@ export async function npmLatest(name: string): Promise<string | null> {
     if (!res.ok) return null
     return ((await res.json()) as Pkg).version ?? null
 }
+
+/** the first release whose SK005 updates through the manager the repo's lock
+ *  files name. An older one runs bun whatever the lock says */
+export const PM_AWARE_SINCE = '1.0.0'
+
+/** why `fleet --update` must not hand this repo its own update, or null.
+ *  The fleet runs the REPO's shipkit, so what matters is what THAT binary
+ *  does: one older than PM_AWARE_SINCE updates an npm repo with bun */
+export function updateRefusal(r: FleetRepo): string | null {
+    const pm = detectPackageManager(r.dir)
+    if (isRefusal(pm)) return `cannot tell which package manager installs it: ${pm.refused}`
+    const own = r.deps.find((d) => d.name === 'rvlib-shipkit')?.installed
+    if (pm.name === 'bun' || own == null || !isBehind(own, PM_AWARE_SINCE)) return null
+    return `its shipkit ${own} updates with bun whatever the lock says, and it installs with ${pm.name}. Run: cd ${r.dir} && ${pm.update(r.behind.map((d) => d.name)).join(' ')}`
+}

package/src/hooks/leak-guard.ts

@@ -80,6 +80,15 @@ export type ParsedPatterns = {
 
 const escapeRegex = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 
+/** a key shape is a token, so it starts where a token starts: `ask-the-...`
+ *  or `desk-lamp-...` is a word that ends in `sk`, never a key */
+export const SK_KEY_ROW = 're:(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{20,}'
+
+/** rows the hooks seeded before their shape was fixed, read as the fixed
+ *  shape. Their id stays the seeded row, so a waiver written against its
+ *  fingerprint keeps working */
+const SEEDED_ROW_FIXES: Record<string, string> = { 're:sk-[A-Za-z0-9_-]{20,}': SK_KEY_ROW }
+
 /** Parse the keyword file: blank lines and `#` comments dropped, `re:<pattern>`
  *  rows become case-insensitive regexes, `w:<word>` rows match on word
  *  boundaries, everything else a case-insensitive substring.
@@ -95,7 +104,7 @@ export function parsePatterns(text: string): ParsedPatterns {
         const row = raw.trim()
         if (row === '' || row.startsWith('#')) continue
         if (row.startsWith('re:')) {
-            try { regexes.push({ row, re: new RegExp(row.slice(3), 'i') }) }
+            try { regexes.push({ row, re: new RegExp((SEEDED_ROW_FIXES[row] ?? row).slice(3), 'i') }) }
             catch { /* a malformed row must not disable the whole guard */ }
         } else if (row.startsWith('w:')) {
             const word = row.slice(2).trim().toLowerCase()

package/src/hooks/run-hooks.ts

@@ -8,7 +8,7 @@ import { dirname, join } from 'path'
 import { fileURLToPath } from 'url'
 import { KEYWORD_FILE, LAYOUT } from '../core/layout.ts'
 import { commitMessageOffenses } from './commit-message.ts'
-import { globalAllowFile, globalKeywordFile, maskPattern, patternFingerprint, runLeakGuard, type LeakAllowEntry, type LeakHit, type LeakWaiver } from './leak-guard.ts'
+import { globalAllowFile, globalKeywordFile, maskPattern, patternFingerprint, runLeakGuard, SK_KEY_ROW, type LeakAllowEntry, type LeakHit, type LeakWaiver } from './leak-guard.ts'
 import { runRootIdentity } from './root-identity.ts'
 import { gitRoot } from '../core/git-root.ts'
 import { spawnWithTimeout } from '../core/spawn-timeout.ts'
@@ -143,14 +143,14 @@ export function installHooks(root: string, binInvocation: string, keywordFile?:
 // generic secret shapes only. private names live in the machine-global
 // ~/.shipkit/private/banned-keywords.txt, which the guard reads on every run
 // (never copied into a repo: a copy rots and a copy can leak)
-const KEYWORD_STARTER = `# banned-keywords — the leak guard greps every commit (added lines, paths,
+export const KEYWORD_STARTER = `# banned-keywords — the leak guard greps every commit (added lines, paths,
 # message) for these rows. one row = one case-insensitive substring, or
 # re:<regex>. add repo-specific names here; machine-wide private names go in
 # ~/.shipkit/private/banned-keywords.txt, read automatically alongside this file.
 # this file is gitignored on purpose: the list itself is private.
 re:-----BEGIN [A-Z ]*PRIVATE KEY-----
 re:AKIA[0-9A-Z]{16}
-re:sk-[A-Za-z0-9_-]{20,}
+${SK_KEY_ROW}
 re:ghp_[A-Za-z0-9]{36}
 re:xox[baprs]-[A-Za-z0-9-]{10,}
 `

package/src/repo-config.ts

@@ -8,11 +8,10 @@
 // a slot that can't fill emits a visible reason, disabling via
 // `defaults: { x: false }` prints a skipped-by-config line — never silence.
 // The `contracts` task is always present when any contract applies.
-import { existsSync, readFileSync } from 'fs'
+import { existsSync } from 'fs'
 import { isAbsolute, join, normalize } from 'path'
-import { fileURLToPath } from 'url'
 import { ROUTED_SCRIPTS } from './core/canonical-scripts.ts'
-import { FLOOR_IDS, resolveFloor, type FloorResolution } from './core/floor.ts'
+import { FLOOR_IDS } from './core/floor.ts'
 export { resolveFloor, type FloorResolution, type FloorSource } from './core/floor.ts'
 import type { ContractManifest } from './contracts/contract-types.ts'
 import type { ProseConfig } from './prose/run-prose.ts'

package/src/smoke/run-smoke.ts

@@ -379,8 +379,12 @@ export async function runSmoke(root: string, config: SmokeConfig, opts: SmokeRun
             const chars = (await page.locator('body').innerText().catch(() => '')).trim().length
             const matches = waitFor == null ? 0 : await page.locator(waitFor).count().catch(() => 0)
             const overflowPx = await page.evaluate(() => {
-                const de = document.documentElement
-                return Math.max(de.scrollWidth - de.clientWidth, document.body.scrollWidth - document.body.clientWidth)
+                // runs in the browser, typed locally: a consumer compiling this
+                // file may have no dom lib
+                type Box = { scrollWidth: number; clientWidth: number }
+                const doc = (globalThis as unknown as { document: { documentElement: Box; body: Box } }).document
+                const de = doc.documentElement
+                return Math.max(de.scrollWidth - de.clientWidth, doc.body.scrollWidth - doc.body.clientWidth)
             }).catch(() => 0)
             await page.screenshot({ path: join(shots, `${routeSlug(label)}.png`), fullPage: true })
             return judgeRoute({ route: label, chars, matches, problems: problems.length - before, waitFor, overflowPx })

package/src/wiki/scan-md.ts

@@ -7,7 +7,7 @@
 // Depth = 0-1 BFS from the index (eager edge keeps depth, lazy adds 1);
 // unreachable files stay in the graph with no depth (lint-md.ts turns those,
 // plus dangling refs, into failures — the graph itself is a viewer).
-import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
+import { readdirSync, readFileSync, statSync } from 'fs'
 import { basename, dirname, join, relative, resolve } from 'path'
 import type { MdEdge, MdGraph, MdNode } from 'rvlib-shipkit/src/wiki/md-graph.ts'