rvlib-shipkit 1.0.0 → 1.1.0

package/src/core/run-fixers.ts

@@ -12,13 +12,13 @@ import { existsSync, readFileSync } from 'fs'
 import { join } from 'path'
 import { fileURLToPath } from 'url'
 import { armHooks } from '../hooks/run-hooks.ts'
-import type { RepoConfig } from '../repo-config.ts'
+import { loadRepoConfig, type RepoConfig } from '../repo-config.ts'
 import { runFix } from './run-fix.ts'
 import { routesToShipkit } from './canonical-scripts.ts'
 import { discoverLegacyChecks } from './discover-legacy-checks.ts'
 import { repoCheckFiles } from './discover-checks.ts'
 import { mutateLease, withMutateLease } from './locked-write.ts'
-import { migrateLayout } from './migrate-layout.ts'
+import { layoutSummary, migrateLayout } from './migrate-layout.ts'
 import { renderPolicy } from '../checks/SK004-gitignore-policy.check.ts'
 import { spawnWithTimeout } from './spawn-timeout.ts'
 import { gitBin } from './git-bin.ts'
@@ -180,20 +180,29 @@ export async function runFixPass(root: string, config: RepoConfig, o: FixPassOpt
     return { ran: false, touched: [], failed: false, reshaped: false }
 }
 
-async function fixPassBody(root: string, config: RepoConfig, o: FixPassOpts, verify: boolean): Promise<FixPassResult> {
+async function fixPassBody(root: string, loaded: RepoConfig, o: FixPassOpts, verify: boolean): Promise<FixPassResult> {
+    let config = loaded
+    const shapeBefore = shapeStamp(root)
     // the old root layout moves under .shipkit/ before anything else reads a
     // path: a move is not a decision, so it lands as one machine commit and
     // only what a machine cannot decide reaches a human. Runs before the tree
     // snapshot, and before hooks arm, because the hooks folder may be what moves
     if (!verify) {
-        const m = migrateLayout(root, { config, renderGitignore: (t, legacy) => renderPolicy(t, config, legacy) })
-        if (m.moved.length > 0 || m.removed.length > 0) {
-            const what = m.moved.filter((x) => x.kind !== 'cache').map((x) => `${x.from}/`).join(' ')
+        const m = migrateLayout(root, { config, renderGitignore: (t, legacy, cfg) => renderPolicy(t, cfg ?? config, legacy) })
+        // the move rewrote repo.config.ts, so the config loaded before it names
+        // folders that are gone, and every fixer below must read the new one
+        if (m.swept.includes('repo.config.ts')) {
+            try { config = await loadRepoConfig(root, { fresh: true }) } catch (e) {
+                o.print(`WARN repo.config.ts does not load after the move rewrote it: ${String((e as Error)?.message ?? e).slice(0, 160)}`)
+            }
+        }
+        const what = layoutSummary(m)
+        if (what !== '') {
             if (m.uncommitted === true) {
-                o.print(`WARN moved ${what} under .shipkit/, and the commit did not land`)
+                o.print(`WARN layout: ${what}. The commit did not land`)
                 const p = m.pending ?? []
-                o.print(`      fix: commit exactly these paths, never a bare commit: git commit -m 'chore: move the shipkit folders under .shipkit/' -- ${p.slice(0, 12).join(' ')}${p.length > 12 ? ` (+${p.length - 12} more, listed by git status)` : ''}`)
-            } else if (what !== '') o.print(`ok: moved ${what} under .shipkit/${m.commit != null ? `, committed as ${m.commit}` : ''}`)
+                o.print(`      fix: commit exactly these paths, never a bare commit: git commit -m 'chore: ${what}' -- ${p.slice(0, 12).join(' ')}${p.length > 12 ? ` (+${p.length - 12} more, listed by git status)` : ''}`)
+            } else o.print(`ok: layout: ${what}${m.commit != null ? `, committed as ${m.commit}` : ''}`)
         }
         if (m.deferred != null) {
             o.print(`WARN the move under .shipkit/ is deferred: ${m.deferred}`)
@@ -218,7 +227,6 @@ async function fixPassBody(root: string, config: RepoConfig, o: FixPassOpts, ver
     for (const u of unfilled) o.print(`skip: ${u.id} (${u.reason})`)
     for (const d of disabled) o.print(`skip: ${d.id} (${d.reason})`)
     const before = treeState(root)
-    const shapeBefore = shapeStamp(root)
 
     for (const s of slots) {
         const r = await spawnWithTimeout(s.cmd, { cwd: root, timeoutMs: FIXER_TIMEOUT_MS })
@@ -228,7 +236,7 @@ async function fixPassBody(root: string, config: RepoConfig, o: FixPassOpts, ver
             o.print(`WARN fix ${s.id} failed (exit ${r.code}) — ${r.out.trim().split('\n').at(-1)?.slice(0, 160) ?? ''}; the gate below still ran`)
     }
     // structural repo-config repair is never implicit, and never in verify mode
-    if (o.rules === true && !verify) await runFix(root, { quiet: true, print: o.print })
+    if (o.rules === true && !verify) await runFix(root, { quiet: true, print: o.print, config })
 
     const after = treeState(root)
     const reshaped = shapeStamp(root) !== shapeBefore

package/src/core/self-update.ts

@@ -10,12 +10,16 @@
 // re-exec guard set, dirty package.json/lockfile (a tool must not mix its
 // writes into human-staged work), registry unreachable (offline is not a
 // defect). every skip is silent except the actionable ones, which WARN.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
-import { dirname, join } from 'path'
+import { basename, dirname, join } from 'path'
 import { fileURLToPath } from 'url'
-import { detectPackageManager } from './package-manager.ts'
+import { detectPackageManager, isRefusal } from './package-manager.ts'
 import { gitBin } from './git-bin.ts'
+import { reexecSelf } from './reexec.ts'
+import { LIB_ROOT } from './lib-root.ts'
+import { FRESH_ENV } from '../ledger/store.ts'
+import { allowMajor, breakingAdvice, isBreaking } from './update-policy.ts'
 
 const PKG = 'rvlib-shipkit'
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000
@@ -34,6 +38,10 @@ export function planSelfUpdate(o: {
     ci: boolean
     frozen: boolean
     manifestDirty: boolean
+    /** `fleet --update --major` asked for this jump on purpose */
+    allowMajor: boolean
+    /** the repo dir name, for the advice a breaking jump prints */
+    repo: string
 }): SelfUpdatePlan {
     if (o.reexecGuard) return { action: 'skip', reason: 'already re-executed once' }
     if (o.ci) return { action: 'skip', reason: 'CI env' }
@@ -43,6 +51,7 @@ export function planSelfUpdate(o: {
     if (o.latest == null) return { action: 'skip', reason: 'registry unreachable' }
     if (o.installed === o.latest) return { action: 'skip', reason: 'current' }
     if (newerThan(o.installed, o.latest)) return { action: 'skip', reason: 'ahead of the registry' }
+    if (isBreaking(o.installed, o.latest) && !o.allowMajor) return { action: 'warn', reason: breakingAdvice(PKG, o.latest, o.repo) }
     if (o.manifestDirty) return { action: 'warn', reason: `rvlib-shipkit ${o.installed} is behind ${o.latest}, package.json or lockfile dirty, not touching — commit, then rerun` }
     return { action: 'update', installed: o.installed, latest: o.latest }
 }
@@ -58,23 +67,40 @@ const newerThan = (a: string, b: string): boolean => {
     return false
 }
 
-const cachePath = (): string => join(homedir(), '.cache', 'shipkit', 'self-update.json')
+/** overrides the per-machine cache file (tests) */
+export const SELF_UPDATE_CACHE_ENV = 'SHIPKIT_SELF_UPDATE_CACHE'
 
-/** npm latest with a per-machine 24h cache, null when unreachable */
-async function latestCached(): Promise<string | null> {
+const cachePath = (): string => {
+    const env = process.env[SELF_UPDATE_CACHE_ENV]
+    return env != null && env !== '' ? env : join(homedir(), '.cache', 'shipkit', 'self-update.json')
+}
+
+/** store a registry answer another path measured, so the next startup
+ *  decides on it instead of on an older cached one */
+export function rememberLatest(version: string): void {
     const p = cachePath()
-    try {
+    mkdirSync(dirname(p), { recursive: true })
+    writeFileSync(p, JSON.stringify({ at: Date.now(), version }))
+}
+
+const npmLatest = async (): Promise<string | null> => {
+    const res = await fetch(`https://registry.npmjs.org/${PKG}/latest`, { signal: AbortSignal.timeout(5000) })
+    if (!res.ok) return null
+    return ((await res.json()) as { version?: string }).version ?? null
+}
+
+/** npm latest with a per-machine 24h cache, null when unreachable. A fresh
+ *  run skips the cache: it decides the one update that restarts the run, and
+ *  a stale answer here leaves that update to SK005, mid run */
+export async function latestCached(o: { fresh: boolean; fetchLatest?: () => Promise<string | null> }): Promise<string | null> {
+    const p = cachePath()
+    if (!o.fresh) try {
         const c = JSON.parse(readFileSync(p, 'utf8')) as { at: number; version: string }
         if (Date.now() - c.at < CACHE_TTL_MS) return c.version
     } catch { /* no cache yet */ }
     try {
-        const res = await fetch(`https://registry.npmjs.org/${PKG}/latest`, { signal: AbortSignal.timeout(5000) })
-        if (!res.ok) return null
-        const v = ((await res.json()) as { version?: string }).version ?? null
-        if (v != null) {
-            mkdirSync(dirname(p), { recursive: true })
-            writeFileSync(p, JSON.stringify({ at: Date.now(), version: v }))
-        }
+        const v = await (o.fetchLatest ?? npmLatest)()
+        if (v != null) rememberLatest(v)
         return v
     } catch {
         return null
@@ -87,10 +113,22 @@ const manifestDirty = (root: string): boolean => {
     return p.stdout.toString().trim() !== ''
 }
 
-/** run before dispatching an interactive ci/check. On update: re-exec the
- *  SAME argv with a loop guard and exit with the child's code (never
- *  returns). Otherwise returns after at most one cached registry probe. */
-export async function maybeSelfUpdateAndRestart(root: string): Promise<void> {
+/** true when `root`'s installed rvlib-shipkit is the code of THIS process.
+ *  Updating that tree in process would leave the rest of the run importing
+ *  modules of two versions, so only the startup path below may update it */
+export function isRunningCopy(root: string): boolean {
+    try {
+        return realpathSync(join(root, 'node_modules', PKG)) === realpathSync(LIB_ROOT)
+    } catch {
+        return false
+    }
+}
+
+/** run before dispatching an interactive ci/check, so no check has loaded
+ *  yet. On update: re-exec the SAME argv with a loop guard and exit with the
+ *  child's code (never returns). Otherwise returns after at most one registry
+ *  probe, cached unless the run is fresh (`--fresh` or SHIPKIT_FRESH=1). */
+export async function maybeSelfUpdateAndRestart(root: string, o: { fresh?: boolean } = {}): Promise<void> {
     const here = fileURLToPath(import.meta.url)
     const base = {
         installed: installedVersion(root),
@@ -98,23 +136,22 @@ export async function maybeSelfUpdateAndRestart(root: string): Promise<void> {
         reexecGuard: process.env.SHIPKIT_SELF_UPDATED === '1',
         ci: process.env.CI != null && process.env.CI !== '',
         frozen: process.env.SHIPKIT_FROZEN === '1',
+        allowMajor: allowMajor(),
+        repo: basename(root),
     }
     // cheap gates first: no network unless an update is even possible
     if (base.reexecGuard || base.ci || base.frozen || !base.runningFromNodeModules || base.installed == null) return
-    const plan = planSelfUpdate({ ...base, latest: await latestCached(), manifestDirty: manifestDirty(root) })
+    const plan = planSelfUpdate({ ...base, latest: await latestCached({ fresh: o.fresh === true || process.env[FRESH_ENV] === '1' }), manifestDirty: manifestDirty(root) })
     if (plan.action === 'warn') { console.error(`WARN self-update: ${plan.reason}`); return }
     if (plan.action !== 'update') return
-    const cmd = detectPackageManager(root).update([PKG])
+    const pm = detectPackageManager(root)
+    if (isRefusal(pm)) { console.error(`WARN self-update: rvlib-shipkit ${plan.installed} is behind ${plan.latest}, not updating: ${pm.refused}`); return }
+    const cmd = pm.update([PKG])
     console.error(`ok: rvlib-shipkit ${plan.installed} → ${plan.latest}, self-updating (${cmd.join(' ')})`)
     const up = Bun.spawnSync(cmd, { cwd: root, stdout: 'inherit', stderr: 'inherit' })
     if (up.exitCode !== 0) { console.error(`WARN self-update failed (exit ${up.exitCode}), continuing on ${plan.installed}`) ; return }
     console.error(`ok: restarting on ${plan.latest} — commit package.json + lockfile with your work`)
-    const child = Bun.spawnSync([process.execPath, ...process.argv.slice(1)], {
-        cwd: process.cwd(),
-        stdout: 'inherit', stderr: 'inherit', stdin: 'inherit',
-        env: { ...process.env, SHIPKIT_SELF_UPDATED: '1' },
-    })
-    process.exit(child.exitCode ?? 1)
+    reexecSelf({ ...process.env, SHIPKIT_SELF_UPDATED: '1' })
 }
 
 const installedVersion = (root: string): string | null => {

package/src/core/update-policy.ts

@@ -0,0 +1,25 @@
+// the ONE update policy every automatic update path asks: rule SK005, the
+// startup self-update and `shipkit fleet --update`. An automatic update never
+// crosses a breaking boundary. It reports the jump and names the one command
+// that takes it on purpose.
+
+/** set by `shipkit fleet --update --major` on the repo run it spawns */
+export const ALLOW_MAJOR_ENV = 'SHIPKIT_ALLOW_MAJOR'
+
+export const allowMajor = (): boolean => process.env[ALLOW_MAJOR_ENV] === '1'
+
+/** a jump across the boundary npm's caret draws: a changed major, or on a
+ *  `0.x` package a changed minor (`^0.2.0` means `<0.3.0`). A porting job
+ *  rather than a bump, so no automatic path takes it. */
+export function isBreaking(installed: string, latest: string): boolean {
+    const parts = (v: string) => v.split('-')[0]!.split('.').map((n) => Number(n) || 0)
+    const [aMajor = 0, aMinor = 0] = parts(installed)
+    const [bMajor = 0, bMinor = 0] = parts(latest)
+    if (aMajor !== bMajor) return true
+    return aMajor === 0 && aMinor !== bMinor
+}
+
+/** the WARN text for a jump no automatic path takes. `repo` is the directory
+ *  name, which is what `fleet --only` matches */
+export const breakingAdvice = (name: string, latest: string, repo: string): string =>
+    `${name} ${latest} available (breaking): run \`shipkit fleet --update --major --only ${repo}\``

package/src/fleet/scan-fleet.ts

@@ -8,10 +8,12 @@
 //
 // This module DISCOVERS and REPORTS. It never updates: rule SK005 owns the
 // update, with the lease, the dirty-tree guard and the frozen guard that took
-// three bugs to get right. `--update` runs each repo's own `shipkit check`,
-// so the fix travels through that one code path.
+// three bugs to get right. `--update` (update-fleet.ts) runs each repo's own
+// `shipkit check`, so the fix travels through that one code path.
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
 import { join } from 'path'
+import { detectPackageManager, isRefusal } from '../core/package-manager.ts'
+import { isBreaking } from '../core/update-policy.ts'
 
 export type Pkg = { name?: string; version?: string; dependencies?: Record<string, string>; devDependencies?: Record<string, string> }
 
@@ -25,18 +27,6 @@ export type FleetDep = {
     latest: string | null
 }
 
-/** a jump that changes the MAJOR, which is a porting job rather than a bump.
- *
- *  Deliberately NOT the semver rule. On a `0.x` package npm treats every
- *  minor as breaking, and by that rule every repo here is breaking, including
- *  the `0.24 → 0.35` shipkit jumps that rule SK005 already performs by itself
- *  every day. A flag that fires on everything is a flag nobody reads. What
- *  survives is the case a human has to own: `rvlib-pb-mobx 0.2.0 → 2.0.0`. */
-export function isBreaking(installed: string, latest: string): boolean {
-    const major = (v: string) => Number(v.split('-')[0]!.split('.')[0]) || 0
-    return major(installed) !== major(latest)
-}
-
 export type FleetRepo = {
     name: string
     dir: string
@@ -61,7 +51,7 @@ const readPkg = (dir: string): Pkg | null => {
     }
 }
 
-const installedVersion = (dir: string, name: string): string | null => readPkg(join(dir, 'node_modules', name))?.version ?? null
+export const installedVersion = (dir: string, name: string): string | null => readPkg(join(dir, 'node_modules', name))?.version ?? null
 
 /** semver-ish compare, enough to answer "is this one behind that one". A
  *  prerelease tag sorts before its release, which is the safe direction: it
@@ -140,3 +130,18 @@ export async function npmLatest(name: string): Promise<string | null> {
     if (!res.ok) return null
     return ((await res.json()) as Pkg).version ?? null
 }
+
+/** the first release whose SK005 updates through the manager the repo's lock
+ *  files name. An older one runs bun whatever the lock says */
+export const PM_AWARE_SINCE = '1.0.0'
+
+/** why `fleet --update` must not hand this repo its own update, or null.
+ *  The fleet runs the REPO's shipkit, so what matters is what THAT binary
+ *  does: one older than PM_AWARE_SINCE updates an npm repo with bun */
+export function updateRefusal(r: FleetRepo): string | null {
+    const pm = detectPackageManager(r.dir)
+    if (isRefusal(pm)) return `cannot tell which package manager installs it: ${pm.refused}`
+    const own = r.deps.find((d) => d.name === 'rvlib-shipkit')?.installed
+    if (pm.name === 'bun' || own == null || !isBehind(own, PM_AWARE_SINCE)) return null
+    return `its shipkit ${own} updates with bun whatever the lock says, and it installs with ${pm.name}. Run: cd ${r.dir} && ${pm.update(r.behind.map((d) => d.name)).join(' ')}`
+}

package/src/fleet/update-fleet.ts

@@ -0,0 +1,85 @@
+// `shipkit fleet --update`: hand each behind repo its own update. The update
+// is NOT performed here. Each repo runs its own binary, which is the only copy
+// whose SK005 matches the rules that repo is pinned to, and the only one
+// holding that repo's mutate lease.
+import { existsSync } from 'fs'
+import { join } from 'path'
+import { spawnWithTimeout } from '../core/spawn-timeout.ts'
+import { detectPackageManager, isRefusal } from '../core/package-manager.ts'
+import { ALLOW_MAJOR_ENV, breakingAdvice } from '../core/update-policy.ts'
+import { installedVersion, isBehind, updateRefusal, type FleetRepo } from './scan-fleet.ts'
+
+
+export const short = (name: string): string => name.replace(/^rvlib-/, '')
+
+// the hand-run fallback speaks the manager THAT repo installs with: telling
+// an npm consumer to run bun leaves its package-lock.json behind
+const manualUpdate = (r: FleetRepo): string => {
+    const pm = detectPackageManager(r.dir)
+    return isRefusal(pm) ? `<its package manager> update ${r.behind.map((d) => d.name).join(' ')} (${pm.refused})` : pm.update(r.behind.map((d) => d.name)).join(' ')
+}
+
+export type FleetUpdateOpts = {
+    /** cross a breaking boundary too (`--major`) */
+    major: boolean
+    print: (line: string) => void
+    /** per repo run (default 10 minutes: a fresh health pass probes the world) */
+    timeoutMs?: number
+}
+
+/** returns how many repos did not update. A repo whose gate refused (dirty
+ *  tree, frozen, a lease held elsewhere) is a REPORT, not a failure of the
+ *  command: SK005 defers on purpose */
+export async function updateFleet(behind: FleetRepo[], o: FleetUpdateOpts): Promise<number> {
+    const w = o.print
+    let failed = 0
+    for (const r of behind) {
+        // the same policy SK005 applies inside the repo: a breaking jump is reported,
+        // never taken, and a safe jump beside it still moves
+        const held = o.major ? [] : r.breaking
+        for (const d of held) w(`WARN ${r.name}: ${breakingAdvice(d.name, d.latest!, r.name)}`)
+        const wanted = r.behind.filter((d) => !held.includes(d))
+        if (wanted.length === 0) {
+            failed++
+            continue
+        }
+        const refused = updateRefusal(r)
+        if (refused != null) {
+            w(`WARN ${r.name}: not updating: ${refused}`)
+            failed++
+            continue
+        }
+        const cli = join(r.dir, 'node_modules', 'rvlib-shipkit', 'src', 'cli.ts')
+        if (!existsSync(cli)) {
+            w(`WARN ${r.name}: no shipkit installed, so it cannot update itself — run: cd ${r.dir} && ${manualUpdate(r)}`)
+            failed++
+            continue
+        }
+        // `--fresh` because SK005 caches a clean pass for 24h: a plain `check`
+        // replays the answer it gave before this release existed, and the run
+        // meant to update never asks the registry. `check --fix SK005` is no
+        // way around it: SK005 has no autofix, so the binary refuses the id.
+        // The re-exec guard is dropped so the repo's own startup self-update
+        // can still fire, and --major travels as the one env the policy reads.
+        const env: Record<string, string> = Object.fromEntries(Object.entries(process.env).filter((e): e is [string, string] => e[1] != null && e[0] !== 'SHIPKIT_SELF_UPDATED' && e[0] !== ALLOW_MAJOR_ENV))
+        if (o.major) env[ALLOW_MAJOR_ENV] = '1'
+        const res = await spawnWithTimeout(['bun', cli, 'check', '--fresh'], { cwd: r.dir, env, timeoutMs: o.timeoutMs ?? 600_000 })
+        // judge by what node_modules carries now, never by the exit code or a
+        // printed line: the code covers every rule in that repo, and the line
+        // format belongs to whatever version that repo runs
+        const stuck = wanted.filter((d) => {
+            const now = installedVersion(r.dir, d.name)
+            return now == null || isBehind(now, d.latest!)
+        })
+        if (stuck.length === 0) {
+            w(`ok: ${r.name} — ${wanted.map((d) => `${short(d.name)} ${d.installed} → ${installedVersion(r.dir, d.name)}`).join(', ')}`)
+            continue
+        }
+        failed++
+        const said = res.out.split('\n').find((l) => /\brvlib-/.test(l) && (l.startsWith('WARN') || l.startsWith('FAIL')))
+        w(`WARN ${r.name} did not move ${stuck.map((d) => short(d.name)).join(', ')} — ${said ?? `check exited ${res.code}${res.timedOut ? ', timed out' : ''} with no rvlib line`}`)
+        w(`      fix: cd ${r.dir} && ${manualUpdate(r)}`)
+    }
+    w(failed === 0 ? `ok: ${behind.length} repo(s) updated through their own gate` : `WARN ${failed}/${behind.length} repo(s) did not update — each line above says why`)
+    return failed
+}

package/src/hooks/leak-guard.ts

@@ -80,6 +80,15 @@ export type ParsedPatterns = {
 
 const escapeRegex = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 
+/** a key shape is a token, so it starts where a token starts: `ask-the-...`
+ *  or `desk-lamp-...` is a word that ends in `sk`, never a key */
+export const SK_KEY_ROW = 're:(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{20,}'
+
+/** rows the hooks seeded before their shape was fixed, read as the fixed
+ *  shape. Their id stays the seeded row, so a waiver written against its
+ *  fingerprint keeps working */
+const SEEDED_ROW_FIXES: Record<string, string> = { 're:sk-[A-Za-z0-9_-]{20,}': SK_KEY_ROW }
+
 /** Parse the keyword file: blank lines and `#` comments dropped, `re:<pattern>`
  *  rows become case-insensitive regexes, `w:<word>` rows match on word
  *  boundaries, everything else a case-insensitive substring.
@@ -95,7 +104,7 @@ export function parsePatterns(text: string): ParsedPatterns {
         const row = raw.trim()
         if (row === '' || row.startsWith('#')) continue
         if (row.startsWith('re:')) {
-            try { regexes.push({ row, re: new RegExp(row.slice(3), 'i') }) }
+            try { regexes.push({ row, re: new RegExp((SEEDED_ROW_FIXES[row] ?? row).slice(3), 'i') }) }
             catch { /* a malformed row must not disable the whole guard */ }
         } else if (row.startsWith('w:')) {
             const word = row.slice(2).trim().toLowerCase()

package/src/hooks/run-hooks.ts

@@ -8,7 +8,7 @@ import { dirname, join } from 'path'
 import { fileURLToPath } from 'url'
 import { KEYWORD_FILE, LAYOUT } from '../core/layout.ts'
 import { commitMessageOffenses } from './commit-message.ts'
-import { globalAllowFile, globalKeywordFile, maskPattern, patternFingerprint, runLeakGuard, type LeakAllowEntry, type LeakHit, type LeakWaiver } from './leak-guard.ts'
+import { globalAllowFile, globalKeywordFile, maskPattern, patternFingerprint, runLeakGuard, SK_KEY_ROW, type LeakAllowEntry, type LeakHit, type LeakWaiver } from './leak-guard.ts'
 import { runRootIdentity } from './root-identity.ts'
 import { gitRoot } from '../core/git-root.ts'
 import { spawnWithTimeout } from '../core/spawn-timeout.ts'
@@ -143,14 +143,14 @@ export function installHooks(root: string, binInvocation: string, keywordFile?:
 // generic secret shapes only. private names live in the machine-global
 // ~/.shipkit/private/banned-keywords.txt, which the guard reads on every run
 // (never copied into a repo: a copy rots and a copy can leak)
-const KEYWORD_STARTER = `# banned-keywords — the leak guard greps every commit (added lines, paths,
+export const KEYWORD_STARTER = `# banned-keywords — the leak guard greps every commit (added lines, paths,
 # message) for these rows. one row = one case-insensitive substring, or
 # re:<regex>. add repo-specific names here; machine-wide private names go in
 # ~/.shipkit/private/banned-keywords.txt, read automatically alongside this file.
 # this file is gitignored on purpose: the list itself is private.
 re:-----BEGIN [A-Z ]*PRIVATE KEY-----
 re:AKIA[0-9A-Z]{16}
-re:sk-[A-Za-z0-9_-]{20,}
+${SK_KEY_ROW}
 re:ghp_[A-Za-z0-9]{36}
 re:xox[baprs]-[A-Za-z0-9-]{10,}
 `

package/src/ledger/gate-checks.ts

@@ -22,6 +22,7 @@ import { discoverChecks } from '../core/discover-checks.ts'
 import { checkCacheExtra, describeFirst, type TaskDef, type CheckFrom } from '../check.ts'
 import { CHECK_TIMEOUT_MS, type RunnableCheck, type CheckBody } from '../core/check-runner.ts'
 import { parseDuration } from '../core/wire.ts'
+import { budgetOf } from '../core/budget.ts'
 import { whenOfLegacyCheck, whenOfDisabledSlot, whenOfRule, whenOfTask, whenOfCheck, type WhenDecl } from '../core/when.ts'
 import type { CheckDecl } from './git-key.ts'
 import { populationOf } from '../problems/problem-line.ts'
@@ -34,9 +35,9 @@ import { declaredTestUnits, inputsOutsideUnits, isTestFile } from '../suite/test
 /** why an undeclared `run` check cannot be keyed on its reads, or null when it
  *  can. A built-in is walked inside the toolkit, a repo check inside the repo
  *  with the toolkit left out (the toolchain id covers it) */
-function rawAccessOf(root: string, u: DiscoveredCheck, configs: Map<string, RvtConfig>): string | null {
+function rawAccessOf(root: string, u: DiscoveredCheck, configs: Map<string, RvtConfig>, texts: Map<string, string>): string | null {
     try {
-        const r = u.rel == null ? rawAccessInClosure(LIB_ROOT, u.path, { configs }) : rawAccessInClosure(root, u.path, { skip: LIB_ROOT, configs })
+        const r = u.rel == null ? rawAccessInClosure(LIB_ROOT, u.path, { configs, texts }) : rawAccessInClosure(root, u.path, { skip: LIB_ROOT, configs, texts })
         return r == null ? null : rawAccessLine(r)
     } catch (e) {
         return `the modules ${u.rel ?? u.path} imports could not be listed (${String(e).slice(0, 120)}): declare inputs or never`
@@ -103,6 +104,9 @@ export type CheckRow = {
     /** the wall clock ceiling it DECLARED, null when it named none and takes
      *  the default for its kind of body */
     timeoutMs: number | null
+    /** what a healthy run takes, RESOLVED: the repo's `budgets`, else what
+     *  the check declared, else the default for its kind (core/budget.ts) */
+    budgetMs: number
     /** excluded from a default run unless named with `--with` */
     optIn: boolean
     /** an idempotent repair exists: `shipkit check --fix <id>` applies it,
@@ -150,7 +154,7 @@ const ttlMsOf = (ttl: string | undefined): number => (ttl == null || ttl === ''
 
 /** the runnable half of a row: everything the runner needs, and nothing it
  *  has to look up again */
-function runnableOf(row: CheckRow, body: CheckBody, o: { fix?: unknown; pointer?: string | null } = {}): RunnableCheck {
+function runnableOf(row: CheckRow, body: CheckBody, o: { fix?: unknown; pointer?: string | null; unbudgeted?: boolean } = {}): RunnableCheck {
     return {
         id: row.decl.id,
         title: row.title,
@@ -161,6 +165,7 @@ function runnableOf(row: CheckRow, body: CheckBody, o: { fix?: unknown; pointer?
         deps: row.deps ?? [],
         group: row.group,
         timeoutMs: row.timeoutMs ?? (row.build ? BUILD_TIMEOUT_MS : CHECK_TIMEOUT_MS),
+        ...(o.unbudgeted === true ? {} : { budgetMs: row.budgetMs }),
         ttlMs: ttlMsOf(row.decl.ttl),
         rotation: row.decl.extra,
         writes: row.decl.writes === true,
@@ -251,6 +256,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             owner: t.cmd == null ? null : t.cmd.join(' '),
             group: t.group ?? null,
             timeoutMs: t.timeoutMs ?? null,
+            budgetMs: budgetOf(t.id, undefined, { build: true, cmd: t.cmd != null, world: t.ttl != null }, c.budgets),
             optIn: t.optIn === true,
             // a build step runs a TOOL, and repairing what a tool reports is
             // that tool's own job (a formatter, a codemod), never the gate's
@@ -259,7 +265,10 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             deps: t.deps ?? null,
             from: taskFrom(t.id),
         }
-        out.push({ row, runnable: runnableOf(row, taskBody(t)) })
+        // at the full tier a build step runs every slow suite on purpose, and
+        // its env (and so its cache key) differs from the quick run, so its
+        // time is not judged and its answer never stands in for a quick one
+        out.push({ row, runnable: runnableOf(row, taskBody(t), { unbudgeted: full }) })
     }
     // a slot `defaults: { <id>: false }` turned off never resolves to a task,
     // so without this it had no row at all: no `runs in` value, no reason, and
@@ -277,6 +286,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             owner: null,
             group: null,
             timeoutMs: null,
+            budgetMs: budgetOf(id, undefined, { build: true, cmd: false, world: false }, c.budgets),
             optIn: false,
             fixable: false,
             when: whenOfDisabledSlot(id),
@@ -290,6 +300,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
     }
     // every `*.check.ts` this repo and the toolkit declare
     const configs = new Map<string, RvtConfig>()
+    const texts = new Map<string, string>()
     for (const u of checks) {
         const w = whenOfCheck(c, u)
         // an in process body declaring nothing is keyed on what it reads
@@ -299,7 +310,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
         const undeclared = u.def.run != null && u.def.inputs == null && u.def.ttl == null && u.def.never == null
         // conservative: any module its body can reach that touches the disk or
         // a process around `c` keeps it off its reads (core/raw-access.ts)
-        const raw = undeclared ? rawAccessOf(root, u, configs) : null
+        const raw = undeclared ? rawAccessOf(root, u, configs, texts) : null
         const reads = undeclared && raw == null
         const extra = checkCacheExtra({ id: u.id, cacheKey: u.def.cacheKey }, env, w)
         const row: CheckRow = {
@@ -323,6 +334,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             owner: u.owner,
             group: u.def.group ?? null,
             timeoutMs: u.def.timeoutMs ?? null,
+            budgetMs: budgetOf(u.id, u.def.budgetMs, { build: u.def.build === true, cmd: u.def.cmd != null, world: u.def.ttl != null }, c.budgets),
             optIn: false,
             fixable: u.def.fix != null,
             when: w,
@@ -358,6 +370,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             owner: r.owner,
             group: null,
             timeoutMs: null,
+            budgetMs: budgetOf(r.id, undefined, { build: false, cmd: false, world: r.ttl != null }, c.budgets),
             optIn: false,
             fixable: r.fix != null,
             when: whenOfRule(c, r.id),
@@ -401,6 +414,7 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             owner: rel,
             group: task?.group ?? null,
             timeoutMs: task?.timeoutMs ?? null,
+            budgetMs: budgetOf(d.name, undefined, { build: false, cmd: true, world: d.ttl != null }, c.budgets),
             optIn: false,
             // the reader is a source scanner, so it cannot carry a function
             fixable: false,

package/src/ledger/git-key.ts

@@ -173,6 +173,9 @@ export type KeyLayerOpts = {
     cliEntry: string
     /** module-graph config; loaded from the repo when omitted */
     cfg?: RvtConfig
+    /** the checks this run executes. Only they are scanned and hashed, and any
+     *  other id gets no key. Omitted = every check */
+    scope?: ReadonlySet<string>
 }
 
 /**
@@ -191,6 +194,7 @@ export class KeyLayer {
         private readonly codeOids: Map<string, string>,
         private readonly toolchain: { id: string; uncacheable: string[] },
         private readonly scanPathsUsed: string[],
+        private readonly scope: ReadonlySet<string> | null,
         /** wall time of the WHOLE layer: toolchain identity, the module-graph
          *  closures, the git scan and the closure hashing. Reported rather
          *  than the scan alone, because the scan alone is the flattering
@@ -237,7 +241,8 @@ export class KeyLayer {
         const closureByCheck = new Map<string, string[]>()
         // computed for EVERY check with code, not only the content ones: a
         // world check's TTL cache must break when the probe itself is rewritten
-        for (const d of decls) {
+        const scoped = o.scope == null ? decls : decls.filter((d) => o.scope!.has(d.id))
+        for (const d of scoped) {
             const entries = d.code ?? []
             if (entries.length > 0) closureByCheck.set(d.id, importClosure(cfg, entries))
         }
@@ -246,14 +251,13 @@ export class KeyLayer {
         // are mostly directories, mostly unchanged, and git's stat cache
         // answers them without reading a byte.
         const paths = new Set<string>()
-        for (const d of decls) {
+        for (const d of scoped) {
             if (classify(d).population !== 'content') continue
             for (const p of d.inputs ?? []) paths.add(p)
         }
 
         // the closure is INDIVIDUAL FILES belonging to no declared path, so it
-        // goes through one `hash-object --stdin-paths` instead of one `git
-        // add` spawn per file (measured: 15ms for the whole set)
+        // is hashed in process (hashFiles) instead of staged one `git add` each
         const closureFiles = new Set<string>()
         for (const files of closureByCheck.values()) for (const f of files) closureFiles.add(f)
 
@@ -268,7 +272,7 @@ export class KeyLayer {
             // downstream may key on it. Loud, and the whole run goes uncached.
             scanError = e instanceof GitScanError ? e.message : String(e)
         }
-        return new KeyLayer(root, decls, registration, scan, scanError, closureByCheck, codeOids, toolchain, [...paths].sort(), performance.now() - started)
+        return new KeyLayer(root, decls, registration, scan, scanError, closureByCheck, codeOids, toolchain, [...paths].sort(), o.scope ?? null, performance.now() - started)
     }
 
     /** the key for one check, or the reason there is none. */
@@ -284,6 +288,7 @@ export class KeyLayer {
             codeKey: own.length === 0 || !ownReadable ? null : createHash('sha256').update(codeLines.join('\n')).digest('hex').slice(0, 16),
         }
         if (c.error != null) return { ...base, reason: c.error }
+        if (this.scope != null && !this.scope.has(d.id)) return { ...base, reason: 'not one of the checks this run executes, so nothing was scanned for it' }
         if (c.population === 'world') return { ...base, reason: `world check — TTL ${d.ttl}, no content key` }
         if (c.population === 'none') return { ...base, reason: c.reason ?? 'undeclared' }
         if (this.scanError != null) return { ...base, reason: `git scan failed, nothing may be keyed: ${this.scanError}` }