rvlib-shipkit 1.1.1 → 1.3.0

package/src/core/check-runner.ts

@@ -39,7 +39,7 @@ import { parallelCap } from './parallel.ts'
 import { machinePool, SLOT_HELD_ENV, takeSlot, type SlotPool } from './slots.ts'
 import { budgetLine, machineLoad } from './budget.ts'
 import { killTree, spawnWithTimeout } from './spawn-timeout.ts'
-import { formatLine, parseWireOutput, type Line } from './wire.ts'
+import { FOREVER_MS, formatLine, parseWireOutput, type Line } from './wire.ts'
 import { offLine, type WhenDecl } from './when.ts'
 import { runCheckBody, type CheckDef, type CheckEnv } from '../check.ts'
 import { Ledger, stampCached } from '../ledger/ledger.ts'
@@ -47,7 +47,7 @@ import { attachedStamp } from './outcome-words.ts'
 import type { RunLog, RunStatus } from '../ledger/run-log.ts'
 import { liveStateOf } from '../ledger/live-runs.ts'
 import { CHECK_ID_ENV } from '../ledger/suite-log.ts'
-import { rememberWorld, replayWorld, type WorldCache } from '../ledger/world-cache.ts'
+import { rememberWorld, replayWorld, worldKeyOf, type WorldCache } from '../ledger/world-cache.ts'
 import { extractProblems } from '../problems/extract.ts'
 import { feedsProblemsPane, type Population, type Problem } from '../problems/problem-line.ts'
 
@@ -191,6 +191,9 @@ export type RunChecksOpts = {
      *  gate the whole repo, since the check's own gate already ran. */
     exclude?: string[]
     print?: (line: string) => void
+    /** where the green summary goes when the caller prints its own verdict
+     *  (`shipkit ci` does). Default: print */
+    detail?: (line: string) => void
     color?: boolean
     onCheck?: (e: CheckEvent) => void
 }
@@ -227,11 +230,21 @@ function closure(checks: RunnableCheck[], ids: string[]): Set<string> {
     return keep
 }
 
+/** how many tests a suite ran, read from the headline it prints last
+ *  (`Ran 920 tests across 12 files.`), null when it printed none */
+export function testsRan(lastLine: string): number | null {
+    const m = /Ran (\d+) tests?/.exec(lastLine)
+    return m == null ? null : Number(m[1])
+}
+
 export type Selection = {
     /** what this run measures */
     selected: RunnableCheck[]
     /** turned off by name, with the reason: never run, always reported */
     off: RunnableCheck[]
+    /** off, and outside what `--only` asked about: reported where the caller
+     *  keeps what nobody acts on */
+    offElsewhere?: RunnableCheck[]
     /** not asked about by this run, and why */
     parked: { id: string; text: string }[]
     /** asked for, and it never said whether it blocks */
@@ -337,6 +350,8 @@ export function selectChecks(o: Pick<RunChecksOpts, 'checks' | 'audience' | 'ful
     if (o.onlyIds != null && o.onlyIds.length > 0) {
         const keep = closure(o.checks, onlyIds)
         selected = selected.filter((u) => keep.has(u.id))
+        // a narrowed run says nothing about the checks it never asked about
+        return { selected, off: off.filter((u) => keep.has(u.id)), offElsewhere: off.filter((u) => !keep.has(u.id)), parked, undeclared, errors }
     }
     return { selected, off, parked, undeclared, errors }
 }
@@ -346,35 +361,57 @@ export function selectChecks(o: Pick<RunChecksOpts, 'checks' | 'audience' | 'ful
  *  was still streaming into, so the surviving FAIL line pointed at a path
  *  that no longer existed. Now each run owns `run-<pid>-<started>/`.
  *
- *  Old run dirs are swept on the way in, and only ones nothing can be using:
- *  the pid must not be running AND the dir must be older than the grace
- *  window, so a recycled pid cannot cost a live run its logs. */
+ *  Old run dirs are swept on the way in (sweepRunDirs), and only ones nothing
+ *  can be using: the pid must not be running, so a live run keeps its logs. */
 function openRunDir(base: string): string {
     // the pid plus the millisecond separates two PROCESSES; the counter
     // separates two runs inside one (the TUI can start a second before the
     // clock ticks), so no run ever writes into another's dir
     const dir = join(base, `run-${process.pid}-${Date.now()}-${runSeq++}`)
     mkdirSync(dir, { recursive: true })
-    const cutoff = Date.now() - RUN_DIR_KEEP_MS
+    sweepRunDirs(base, Date.now(), { keep: basename(dir) })
+    return dir
+}
+
+/** how long a finished run's logs stay readable, and the pid-reuse guard */
+export const RUN_DIR_KEEP_MS = 6 * 60 * 60 * 1000
+/** the most finished runs whose logs stay, newest first */
+export const RUN_DIR_MAX = 40
+
+const RUN_ENTRY = /^(?:run|releases)-(\d+)-(\d+)(?:-\d+)?(?:\.json(?:\.lock)?)?$/
+
+const pidRuns = (pid: number): boolean => {
+    try { process.kill(pid, 0); return true } catch (e) { return (e as { code?: string }).code === 'EPERM' }
+}
+
+/** the run dirs under a log base, and the per run release survey files a
+ *  killed run leaves beside them: both carry the pid and the start time */
+export function runEntries(base: string): { name: string; pid: number; started: number }[] {
     try {
-        for (const name of readdirSync(base)) {
-            // run dirs AND the per-run release survey files, which a killed
-            // run leaves behind: both carry the pid and the start time, so one
-            // sweep covers both rather than one path leaking forever
-            const m = /^(?:run|releases)-(\d+)-(\d+)(?:-\d+)?(?:\.json(?:\.lock)?)?$/.exec(name)
-            if (m == null || name === basename(dir)) continue
-            if (Number(m[2]) > cutoff) continue
-            try { process.kill(Number(m[1]), 0); continue } catch (e) { if ((e as { code?: string }).code === 'EPERM') continue }
-            rmSync(join(base, name), { recursive: true, force: true })
-        }
+        return readdirSync(base).flatMap((name) => {
+            const m = RUN_ENTRY.exec(name)
+            return m == null ? [] : [{ name, pid: Number(m[1]), started: Number(m[2]) }]
+        })
     } catch {
-        // an unreadable log base is a housekeeping miss, never a gate failure
+        return []
     }
-    return dir
 }
 
-/** how long a finished run's logs stay readable, and the pid-reuse guard */
-const RUN_DIR_KEEP_MS = 6 * 60 * 60 * 1000
+/** the run logs' cap: every entry past the keep window (no run lasts that
+ *  long, so a live pid there is a long lived process's finished run, or a
+ *  reused pid), then the oldest past `max` whose pid no longer runs. `keep`
+ *  spares the caller's own dir */
+export function sweepRunDirs(base: string, now: number, o: { keep?: string; keepMs?: number; max?: number } = {}): void {
+    const all = runEntries(base).sort((a, b) => b.started - a.started)
+    const cutoff = now - (o.keepMs ?? RUN_DIR_KEEP_MS)
+    all.forEach((e, i) => {
+        if (e.name === o.keep) return
+        const old = e.started <= cutoff
+        if (!old && i < (o.max ?? RUN_DIR_MAX)) return
+        if (!old && pidRuns(e.pid)) return
+        try { rmSync(join(base, e.name), { recursive: true, force: true }) } catch { /* an unreadable log base is a housekeeping miss */ }
+    })
+}
 let runSeq = 0
 
 type Live = RunnableCheck & CheckResult & {
@@ -423,9 +460,9 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
 
     // OFF, in ONE place: skipped by name, never run, never stored, and the
     // reason printed where the verdict would have been
-    for (const u of sel.off) {
+    for (const u of [...sel.off, ...(sel.offElsewhere ?? [])]) {
         const line: Line = { kind: 'skip', text: offLine(u.id, u.when) }
-        emit(line)
+        if (sel.off.includes(u)) emit(line); else (o.detail ?? print)(formatLine(line, color))
         report(u, { id: u.id, status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [line], problems: [], lastLine: line.text, note: 'off', logPath: null })
     }
     // `--only` that leaves nothing to run asked a question nobody answers, and
@@ -477,10 +514,15 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
      *  or that a different shipkit measured it. */
     const worldKey = (u: RunnableCheck): string => {
         let code = ''
-        try { code = o.ledger?.layer.keyFor(u.id).codeKey ?? '' } catch { code = '' }
-        // a check that writes answers a different question when frozen
-        const frozen = u.writes === true ? `\0frozen=${process.env['SHIPKIT_FROZEN'] === '1'}` : ''
-        return `tc=${o.ledger?.layer.toolchainId ?? ''}\0code=${code}\0${u.rotation ?? ''}${frozen}`
+        if (u.ttlMs < FOREVER_MS) try { code = o.ledger?.layer.keyFor(u.id).codeKey ?? '' } catch { code = '' }
+        return worldKeyOf({
+            ttlMs: u.ttlMs,
+            toolchain: u.ttlMs < FOREVER_MS ? o.ledger?.layer.toolchainId ?? '' : '',
+            code,
+            rotation: u.rotation ?? '',
+            // a check that writes answers a different question when frozen
+            frozen: u.writes === true ? process.env['SHIPKIT_FROZEN'] === '1' : null,
+        })
     }
 
     // a non-blocking failure becomes a WARNING here, at the source: printing
@@ -510,10 +552,18 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
         // baked into a remembered line comes back on a replay as if this run
         // had measured it (ledger/ledger.ts rule 5)
         const head = u.lines[0]
+        // a suite's count rides on its own line: `test 920 tests (1.4s)`
+        const ran = u.status === 'pass' || u.status === 'warn' ? testsRan(u.lastLine) : null
+        const counted = ran != null && head != null && head.kind === 'ok' && (head.text === u.id || head.text.startsWith(`${u.id} (`))
+        const id = counted ? `${u.id} ${ran} test${ran === 1 ? '' : 's'}` : u.id
         const shown = u.synthetic && !u.replayed && head != null
-            ? [{ ...head, text: `${u.id} (${(u.ms / 1000).toFixed(1)}s)${u.tail}` }, ...u.lines.slice(1)]
-            : u.lines
-        for (const l of shown) emit(l)
+            ? [{ ...head, text: `${id} (${(u.ms / 1000).toFixed(1)}s)${u.tail}` }, ...u.lines.slice(1)]
+            : counted ? [{ ...head, text: `${id}${head.text.slice(u.id.length)}` }, ...u.lines.slice(1)] : u.lines
+        // a caller printing its own verdict wants one line per green check and
+        // only the warnings of a warned one; a failure prints whole
+        const quiet = (l: Line, i: number): boolean =>
+            o.detail != null && (u.status === 'pass' ? i > 0 : u.status === 'warn' || u.advisory ? l.kind === 'ok' || l.kind === 'note' || l.kind === 'skip' : false)
+        for (const [i, l] of shown.entries()) if (quiet(l, i)) o.detail!(formatLine(l, color)); else emit(l)
         if (u.status === 'fail' && !u.advisory && u.logPath != null)
             emit({ kind: 'fix-fail', text: `full log: ${u.logPath}` })
         report(u, { id: u.id, status: u.status, advisory: u.advisory, replayed: u.replayed, ms: u.ms, exitCode: u.exitCode, lines: u.lines, problems: u.problems, lastLine: u.lastLine, note: u.note, logPath: u.logPath }, finishedAt, u.attached)
@@ -820,7 +870,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
     const warned = results.filter((r) => r.status === 'warn' || (r.status === 'fail' && r.advisory))
     const ran = results.filter((r) => r.status !== 'skip').length
     if (blocked.length === 0 && !interrupted && results.length > 0)
-        emit({ kind: 'ok', text: warned.length === 0 ? `all ${ran} check(s) green` : `all ${ran} check(s) passed, ${warned.length} with a warning: ${warned.map((r) => r.id).join(', ')}` })
+        (o.detail ?? print)(formatLine({ kind: 'ok', text: warned.length === 0 ? `all ${ran} check(s) green` : `all ${ran} check(s) passed, ${warned.length} with a warning: ${warned.map((r) => r.id).join(', ')}` }, color))
     return {
         ok: blocked.length === 0 && !interrupted,
         interrupted,

package/src/core/discover-checks.ts

@@ -17,11 +17,13 @@
 //
 // Skipped dirs: node_modules, dist, tmp, references (templates for other
 // repos), and every dot-dir.
+import { RETIRED_CHECK_IDS } from './retired-checks.ts'
 import { readdirSync, readFileSync, realpathSync, statSync } from 'fs'
 import { basename, join, relative } from 'path'
 import { check, type CheckDef, type CheckFrom } from '../check.ts'
 
-import { CHECK_SUFFIX as SUFFIX, fallbackNames, isLegacyCheckSource, SKIPPED_DIRS as IGNORED_DIRS } from './check-file-names.ts'
+import { CHECK_SUFFIX as SUFFIX, fallbackNames, isLegacyCheckSource, SKIPPED_DIRS as IGNORED_DIRS, UNIT_SUFFIX, unitBase } from './check-file-names.ts'
+import { unitKind } from '../shipkit-files.ts'
 
 export { fallbackNames, isLegacyCheckSource } from './check-file-names.ts'
 
@@ -54,16 +56,39 @@ export type DiscoveredCheck = {
     from: CheckFrom
 }
 
-function walk(dir: string, out: string[]): void {
+function walk(dir: string, out: string[], suffix = SUFFIX): void {
     let entries
     try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
     for (const e of entries) {
         if (e.isDirectory()) {
-            if (!IGNORED_DIRS.has(e.name) && !e.name.startsWith('.')) walk(join(dir, e.name), out)
-        } else if (e.name.endsWith(SUFFIX)) out.push(join(dir, e.name))
+            if (!IGNORED_DIRS.has(e.name) && !e.name.startsWith('.')) walk(join(dir, e.name), out, suffix)
+        } else if (e.name.endsWith(suffix)) out.push(join(dir, e.name))
     }
 }
 
+/** every `*.shipkit.ts` file under a repo root, by the same walk. Sorted */
+export function repoUnitFiles(root: string): string[] {
+    const out: string[] = []
+    walk(root, out, UNIT_SUFFIX)
+    return out.sort()
+}
+
+/** a file's default export, re-imported whenever the file on disk moves. An
+ *  ES module is cached by path for the life of the process, so a repo that
+ *  rewrites a file mid process would keep the old one without the stamp */
+export async function importFresh(path: string): Promise<unknown> {
+    let stamp = ''
+    // no dot in the stamp: a query ending `.1234` reads as the module's
+    // extension, and a load plugin then never sees the file
+    try { stamp = String(statSync(path).mtimeMs).replace('.', '_') } catch {}
+    // the REAL path: through a linked one, the resolver misses a file
+    // created after it first listed the directory, which is exactly the
+    // file a fix pass just wrote
+    let real = path
+    try { real = realpathSync(path) } catch {}
+    return ((await import(`${real}?v=${stamp}`)) as { default?: unknown }).default
+}
+
 /** every `*.check.ts` file under a repo root, check files and legacy
  *  scripts alike, by the same walk discovery takes, without importing one.
  *  Sorted. */
@@ -98,22 +123,14 @@ export function builtinCheckIds(): string[] {
 /** the module, re-imported whenever the file on disk moves. An ES module is
  *  cached by path for the life of the process, so a repo that rewrites a
  *  check file mid process would keep running the old body without this. */
-async function load(path: string): Promise<CheckDef> {
-    let stamp = ''
-    // no dot in the stamp: a query ending `.1234` reads as the module's
-    // extension, and a load plugin then never sees the file
-    try { stamp = String(statSync(path).mtimeMs).replace('.', '_') } catch {}
+async function load(path: string): Promise<CheckDef | null> {
     // the path rides on every message from here down, because `check()` knows
     // the object and not where it was written, and an agent reading a refused
     // declaration needs the file before it needs the rule
     try {
-        // the REAL path: through a linked one, the resolver misses a file
-        // created after it first listed the directory, which is exactly the
-        // file a fix pass just wrote
-        let real = path
-        try { real = realpathSync(path) } catch {}
-        const mod = (await import(`${real}?v=${stamp}`)) as { default?: unknown }
-        const d = mod.default
+        const d = await importFresh(path)
+        // a unit file of another kind is its reader's, never a check
+        if (path.endsWith(UNIT_SUFFIX) && unitKind(d) !== 'check') return null
         if (d == null || typeof d !== 'object' || (!('run' in d) && !('cmd' in d)))
             throw new Error(`a check file must \`export default check({...})\` with a \`run\` or a \`cmd\``)
         // re-validated here rather than trusted: a file can build the object
@@ -133,6 +150,7 @@ export async function discoverChecks(root: string): Promise<DiscoveredCheck[]> {
     walk(BUILTIN_CHECK_DIR, builtins)
     const found: string[] = []
     walk(root, found)
+    const units = repoUnitFiles(root)
     // the repo that HOSTS the toolkit walks over `src/checks/` too, and a file
     // discovered twice is a duplicate id rather than a second check. Real paths,
     // because a consumer reaches the same files through a linked node_modules
@@ -147,17 +165,19 @@ export async function discoverChecks(root: string): Promise<DiscoveredCheck[]> {
 
     const out: DiscoveredCheck[] = []
     const ids = new Set<string>()
-    for (const f of [...builtins, ...own]) {
+    for (const f of [...builtins, ...own, ...units]) {
         const isBuiltin = builtins.includes(f)
         const def = await load(f)
+        if (def == null) continue
         const rel = isBuiltin ? null : relative(root, f).replace(/\\/g, '/')
         const fallback = isBuiltin
             ? (BUILTIN_ID_RE.exec(base(f))?.[1] ?? base(f))
-            : names.get(f)!
+            : f.endsWith(UNIT_SUFFIX) ? unitBase(f) : names.get(f)!
         const id = def.id ?? fallback
         if (isBuiltin) {
             if (id !== fallback) throw new Error(`${f}: declares id '${id}' but its file name says '${fallback}' — a built-in id is its file name`)
             if ((def.owner ?? '') === '') throw new Error(`${f}: a built-in check names the page that OWNS the invariant`)
+            if (RETIRED_CHECK_IDS[id] != null) throw new Error(`${f}: id '${id}' is retired (${RETIRED_CHECK_IDS[id]}), and an id is never reused`)
         } else if (id.startsWith('SK')) {
             throw new Error(`${rel}: id '${id}' uses the reserved SK prefix — a repo check picks its own (e.g. RV${id.slice(-3)}) or plain words`)
         }

package/src/core/file-stamp.ts

@@ -0,0 +1,20 @@
+// the content of a file no tree id reaches (outside the repo, gitignored, an
+// install), as one short hash for a check's `cacheKey`. `absent` when nothing
+// stands there, so a file appearing or vanishing moves the key too.
+import { createHash } from 'crypto'
+import { readFileSync } from 'fs'
+import { homedir } from 'os'
+import { isAbsolute, join } from 'path'
+
+export function fileStamp(abs: string): string {
+    try {
+        return createHash('sha256').update(readFileSync(abs)).digest('hex').slice(0, 16)
+    } catch {
+        return 'absent'
+    }
+}
+
+/** a path as a config declares it (`~/...`, absolute, or repo relative), absolute */
+export function configPath(root: string, p: string): string {
+    return p.startsWith('~/') ? join(homedir(), p.slice(2)) : isAbsolute(p) ? p : join(root, p)
+}

package/src/{checks/SK021-github-login.check.ts → core/gh-login.ts}

@@ -1,27 +1,30 @@
-// SK021: the gh login the toolkit itself runs on: `init` and `start` create
-// a PRIVATE repo with it, every push and release goes through it, SK007 reads
-// visibility with it. gh keeps that login outside any secrets manager, so this
-// probe is the only place a lost one shows. It is a `core` credential: red on
-// the secrets page and in `shipkit needs` (collections/providers.ts reads the
-// `cred <name> missing` line), while the check itself is about the world, so
-// it never blocks a gate and runs in the health pass only.
+// the gh login the toolkit itself runs on: `init` and `start` create a
+// PRIVATE repo with it, every push and release goes through it, SK007 reads
+// visibility with it. gh keeps that login outside any secrets manager, so the
+// house repo's one `github-login` check (a machine fact, asked once, never in
+// every repo) runs `probeGhLogin`. It is a `core` credential: red on the
+// secrets page and in `shipkit needs` (collections/providers.ts reads the
+// `cred <name> missing` line).
 //
 // A private repo needs the classic `repo` scope. The token itself is never
 // asked for: `gh auth status --json` carries no token field, and the text
 // answer masks it. github.com unreachable is `unreachable`, a WARN that
 // measured nothing, never a lost login.
 import { carveGhJson, firstGhLine } from '../git-bootstrap.ts'
-import { check } from '../check.ts'
+import type { CheckCtx } from './check-ctx.ts'
 
 const HOST = 'github.com'
 
-/** the secrets page row this check proves: a built-in `core` credential
- *  every repo has, shown once SK021 has run there */
+/** the id of the house check that runs `probeGhLogin` */
+export const GH_LOGIN_CHECK = 'github-login'
+
+/** the secrets page row the probe proves: a built-in `core` credential, shown
+ *  in the repo where the `github-login` check has run */
 export const GH_LOGIN_CRED = {
     name: 'gh/github/login',
     service: 'gh login',
     level: 'core' as const,
-    probedBy: 'SK021',
+    probedBy: GH_LOGIN_CHECK,
     mintUrl: 'https://cli.github.com/manual/gh_auth_login',
     /** what the row offers to copy when no failing line names a better fix */
     command: 'gh auth login',
@@ -76,48 +79,36 @@ export function readGhText(out: string): GhLogin {
     return { state: 'ok', login: login[1]!, scopes: scopesOf(scopes?.[1]) }
 }
 
-export const githubLogin = check({
-    id: 'SK021',
-    // about the world, never this repo: a lost login warns in a gate and is
-    // red on the secrets page and in needs, through the core credential row
-    blocking: false,
-    title: 'github login',
-    description: 'gh is logged in to github.com with the repo scope shipkit creates repos with',
-    owner: 'build/shipkit/built-in-checks.md',
-    when: 'health',
-    ttl: '1h',
-    run: async (c) => {
-        const cred = GH_LOGIN_CRED.name
-        // the switch that keeps every github step off (git-bootstrap.ts), which every test suite sets
-        if ((process.env['SHIPKIT_NO_GITHUB'] ?? '') !== '') return void c.lines.push({ kind: 'skip', text: 'gh login not probed, SHIPKIT_NO_GITHUB is set' })
-        const gh = c.tool('gh')
-        if (gh == null)
-            return c.fail(`cred ${cred} missing: gh is not installed, so shipkit cannot create a repo, push or release`, 'install gh (https://cli.github.com), then run `gh auth login`')
-
-        let r = await c.exec([gh, 'auth', 'status', '--hostname', HOST, '--active', '--json', 'hosts'], { cwd: c.root, timeoutMs: 20_000 })
-        let seen: GhLogin
-        if (r.code !== 0 && /unknown flag/i.test(r.out)) {
-            r = await c.exec([gh, 'auth', 'status', '--hostname', HOST], { cwd: c.root, timeoutMs: 20_000 })
-            seen = readGhText(r.out)
-        } else seen = r.timedOut ? { state: 'unreachable', why: 'gh auth status timed out' } : readGhJson(r.out)
+/** the probe: logged in to github.com, with the repo scope */
+export async function probeGhLogin(c: CheckCtx): Promise<void> {
+    const cred = GH_LOGIN_CRED.name
+    // the switch that keeps every github step off (git-bootstrap.ts), which every test suite sets
+    if ((process.env['SHIPKIT_NO_GITHUB'] ?? '') !== '') return void c.lines.push({ kind: 'skip', text: 'gh login not probed, SHIPKIT_NO_GITHUB is set' })
+    const gh = c.tool('gh')
+    if (gh == null)
+        return c.fail(`cred ${cred} missing: gh is not installed, so shipkit cannot create a repo, push or release`, 'install gh (https://cli.github.com), then run `gh auth login`')
 
-        switch (seen.state) {
-            case 'none':
-                return c.fail(`cred ${cred} missing: gh is not logged in to ${HOST}, so shipkit cannot create a repo, push or release`, 'gh auth login')
-            case 'refused':
-                return c.fail(`cred ${cred} missing: the gh login from ${seen.source} was refused by ${HOST} (${seen.why.slice(0, 120)})`, 'gh auth login')
-            case 'unreachable':
-                return c.unreachable(`gh login unverified: ${HOST} unreachable (${seen.why.slice(0, 120)})`)
-            case 'unreadable':
-                return c.unreachable(`gh login unverified: gh answered something unreadable (${seen.why})`)
-            case 'ok':
-                if (seen.scopes == null)
-                    return c.warn(`gh is logged in to ${HOST} as ${seen.login}, but its token lists no oauth scopes (a fine grained or app token), so creating a private repo is unverified`, 'gh auth login')
-                if (!seen.scopes.includes('repo'))
-                    return c.fail(`cred ${cred} missing: the gh login ${seen.login} lacks the repo scope (it has ${seen.scopes.join(', ')}), so shipkit cannot create a private repo`, `gh auth refresh -h ${HOST} -s repo`)
-                return c.ok(`gh is logged in to ${HOST} as ${seen.login}, with the repo scope`)
-        }
-    },
-})
+    let r = await c.exec([gh, 'auth', 'status', '--hostname', HOST, '--active', '--json', 'hosts'], { cwd: c.root, timeoutMs: 20_000 })
+    let seen: GhLogin
+    if (r.code !== 0 && /unknown flag/i.test(r.out)) {
+        r = await c.exec([gh, 'auth', 'status', '--hostname', HOST], { cwd: c.root, timeoutMs: 20_000 })
+        seen = readGhText(r.out)
+    } else seen = r.timedOut ? { state: 'unreachable', why: 'gh auth status timed out' } : readGhJson(r.out)
 
-export default githubLogin
+    switch (seen.state) {
+        case 'none':
+            return c.fail(`cred ${cred} missing: gh is not logged in to ${HOST}, so shipkit cannot create a repo, push or release`, 'gh auth login')
+        case 'refused':
+            return c.fail(`cred ${cred} missing: the gh login from ${seen.source} was refused by ${HOST} (${seen.why.slice(0, 120)})`, 'gh auth login')
+        case 'unreachable':
+            return c.unreachable(`gh login unverified: ${HOST} unreachable (${seen.why.slice(0, 120)})`)
+        case 'unreadable':
+            return c.unreachable(`gh login unverified: gh answered something unreadable (${seen.why})`)
+        case 'ok':
+            if (seen.scopes == null)
+                return c.warn(`gh is logged in to ${HOST} as ${seen.login}, but its token lists no oauth scopes (a fine grained or app token), so creating a private repo is unverified`, 'gh auth login')
+            if (!seen.scopes.includes('repo'))
+                return c.fail(`cred ${cred} missing: the gh login ${seen.login} lacks the repo scope (it has ${seen.scopes.join(', ')}), so shipkit cannot create a private repo`, `gh auth refresh -h ${HOST} -s repo`)
+            return c.ok(`gh is logged in to ${HOST} as ${seen.login}, with the repo scope`)
+    }
+}