rvlib-shipkit 1.8.0 → 1.9.0

package/src/core/run-ci.ts

@@ -10,6 +10,7 @@ import { loadRepoConfig, type RepoConfig } from '../repo-config.ts'
 import { reportToMotherhome } from './motherhome.ts'
 import { passScope, runCheckPass, type CheckOpts } from './run-check.ts'
 import { poolLines } from './slots.ts'
+import { fixPassRuns } from './fix-scope.ts'
 import { runFixPass } from './run-fixers.ts'
 import { formatLine } from './wire.ts'
 import { outcomeCounts } from './outcome-words.ts'
@@ -29,8 +30,9 @@ export type CiOpts = {
     onlyIds?: string[]
     /** refresh STATUS.md after the run (default true — O4: every repo gets it) */
     status?: boolean
-    /** repair the mechanical slots before gating. default on locally, verify
-     *  mode under CI. core/run-fixers.ts owns the scope. */
+    /** repair the mechanical slots before gating, verify mode under CI.
+     *  Unset: on for a whole gate, off for a narrowed one (core/fix-scope.ts).
+     *  core/run-fixers.ts owns the scope. */
     fix?: boolean
     /** also apply the repairs of the checks declaring `fix: 'ci'` during the
      *  fix pass */
@@ -138,15 +140,14 @@ export async function runCi(root: string, o: CiOpts = {}): Promise<number> {
     let c = o.config ?? (await loadRepoConfig(root))
     // mechanical failures are not information, so they never cost a round trip
     let fixFailed = false
-    // a NARROWED run repairs only the mechanical slots. The structural rule
-    // fixers rewrite package.json and repo config, and arming rewrites hooks/:
-    // that is the right price for the full gate and the wrong one for
-    // `bun run test`, which routes here and must answer the one question its
-    // name promises without leaving files in the agent's diff that it never
-    // wrote. Under CI it is worse than surprising: a formatting rewrite comes
-    // back as a test failure.
+    // a NARROWED run repairs nothing unless --fix asks, and even then only the
+    // mechanical slots. `bun run test` routes here and must answer the one
+    // question its name promises without leaving files in the agent's diff
+    // that it never wrote: in a shared tree the formatter rewrites every other
+    // agent's files too. The structural rule fixers rewrite package.json and
+    // repo config, and arming rewrites hooks/: the full gate's price alone
     const narrowed = (o.onlyIds ?? []).length > 0
-    if (o.fix !== false) {
+    if (fixPassRuns(o)) {
         const pass = await runFixPass(root, c, { rules: !narrowed && o.fixRules !== false, armHooks: !narrowed && o.armHooks === true, print: sink, detail })
         fixFailed = pass.failed
         // a fixer that rewrote the config or moved a check file leaves the
@@ -158,7 +159,7 @@ export async function runCi(root: string, o: CiOpts = {}): Promise<number> {
                 return 1
             }
         }
-    } else detail('skip: fix pass (--no-fix)')
+    } else detail(o.fix === false ? 'skip: fix pass (--no-fix)' : 'skip: fix pass (a --only run leaves the tree alone, --fix repairs first)')
     const tier: TestTier = o.tests ?? envTier()
     // announced BEFORE the run (under --verbose, and in every release log),
     // so a log that died mid-way still says which tier it was asking for

package/src/core/slots.ts

@@ -4,6 +4,11 @@
 // mutate lease's non blocking form (locked-write.ts tryLease): a slot whose
 // holder died is free at once, and a live holder heartbeats it.
 //
+// A slot is a check, and a check is often a whole multi core tool (bun test
+// workers, oxlint threads, tsc), so slots alone never bound the CPU. Past the
+// cores the pool admits fewer slots in proportion to the 1 minute load, never
+// fewer than one (admittedSlots). A slot already held is never taken back.
+//
 // The one constraint a reader breaks first: a process started BY a check
 // (SHIPKIT_SLOT_HELD=1 in its environment) takes no slot. It already runs on
 // its parent's, and a parent waiting on a child that waits for a slot the
@@ -12,6 +17,8 @@ import { mkdirSync, readdirSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
 import { leaseHolder, tryLease } from './locked-write.ts'
+import { machineLoad } from './budget.ts'
+import type { MachineLoad } from '../suite/judge-suites.ts'
 import { PARALLEL_ENV, parallelCap, parallelCapInfo } from './parallel.ts'
 
 /** where the slots live, for a test that must not touch the machine's pool */
@@ -19,7 +26,9 @@ export const SLOTS_DIR_ENV = 'SHIPKIT_SLOTS_DIR'
 /** set for every process a check spawns: it runs on its parent's slot */
 export const SLOT_HELD_ENV = 'SHIPKIT_SLOT_HELD'
 
-export type SlotPool = { dir: string; size: number }
+/** `load`: the reading that scales what the pool admits. Omitted: the whole
+ *  size, whatever the machine runs (a test's own pool) */
+export type SlotPool = { dir: string; size: number; load?: () => MachineLoad }
 
 export type SlotHolder = { slot: number; pid: number; repo: string; check: string; since: number }
 
@@ -37,9 +46,18 @@ export const autoGatePool = (): SlotPool => ({ dir: `${poolDir()}-auto-gate`, si
 
 /** this process's pool, or null when it runs inside a check that holds one */
 export function machinePool(): SlotPool | null {
-    return process.env[SLOT_HELD_ENV] === '1' ? null : { dir: poolDir(), size: parallelCap() }
+    return process.env[SLOT_HELD_ENV] === '1' ? null : { dir: poolDir(), size: parallelCap(), load: machineLoad }
 }
 
+/** how many of `size` slots a machine at this load admits: all of them up to
+ *  a load of one per core, then size × cores / load, never below one. At 20
+ *  on 8 cores a pool of 8 admits 3, at 81 it admits 1 */
+export const admittedSlots = (size: number, m: MachineLoad): number =>
+    Math.max(1, Math.min(size, Math.floor((size * m.cores) / Math.max(m.cores, m.load1))))
+
+const admitWords = (size: number, admitted: number, m: MachineLoad): string =>
+    `the pool admits ${admitted} of its ${size} slots at load ${m.load1.toFixed(1)} on ${m.cores} cores`
+
 /** who holds which slot right now, dead holders left out. Every slot file in
  *  the dir is read, so a slot taken under a larger size still shows. */
 export function poolOccupancy(pool: SlotPool = { dir: poolDir(), size: parallelCap() }): { size: number; dir: string; held: SlotHolder[] } {
@@ -64,25 +82,37 @@ export function poolLines(): string[] {
         ...(info.problem == null ? [] : [`WARN ${info.problem}`]),
         pool == null
             ? `ok: parallel: inside a check that holds a machine slot, so this run takes none (up to ${info.cap} at once in this process)`
-            : `ok: parallel: one machine pool of ${info.cap} slot(s) shared by every shipkit process, ${poolOccupancy(pool).held.length} held now (${why})`,
+            : `ok: parallel: one machine pool of ${info.cap} slot(s) shared by every shipkit process, ${poolOccupancy(pool).held.length} held now (${why})${loadNote(pool)}`,
     ]
 }
 
+const loadNote = (pool: SlotPool): string => {
+    const m = pool.load?.()
+    if (m == null) return ''
+    const admitted = admittedSlots(pool.size, m)
+    return admitted < pool.size ? `; ${admitWords(pool.size, admitted, m)}` : ''
+}
+
 /** wait for a free slot and hold it until release(). null = abort said stop. */
 export async function takeSlot(
     pool: SlotPool,
     who: { repo: string; check: string },
-    o: { abort?: () => boolean; pollMs?: number; onWait?: (held: SlotHolder[]) => void } = {},
+    o: { abort?: () => boolean; pollMs?: number; onWait?: (held: SlotHolder[], why: string) => void } = {},
 ): Promise<{ slot: number; release: () => void } | null> {
     mkdirSync(pool.dir, { recursive: true })
     let heard = false
     for (;;) {
-        for (let slot = 0; slot < pool.size; slot++) {
+        const m = pool.load?.() ?? null
+        const admitted = m == null ? pool.size : admittedSlots(pool.size, m)
+        for (let slot = 0; slot < admitted; slot++) {
             const lease = tryLease(join(pool.dir, `slot-${slot}`), who.check, { repo: who.repo, check: who.check })
             if (lease != null) return { slot, release: lease.release }
         }
         if (o.abort?.() === true) return null
-        if (!heard) { heard = true; o.onWait?.(poolOccupancy(pool).held) }
+        if (!heard) {
+            heard = true
+            o.onWait?.(poolOccupancy(pool).held, m != null && admitted < pool.size ? admitWords(pool.size, admitted, m) : `all ${pool.size} slots are held`)
+        }
         await Bun.sleep(o.pollMs ?? SLOT_POLL_MS)
     }
 }

package/src/home/gui-app/ShipkitGui.swift

@@ -130,6 +130,7 @@ final class Delegate: NSObject, NSApplicationDelegate, WKNavigationDelegate, WKU
 
     func applicationDidFinishLaunching(_ note: Notification) {
         if CommandLine.arguments.contains("--self-test-find") { return selfTestFind() }
+        if CommandLine.arguments.contains("--self-test-panels") { return selfTestPanels() }
         buildMenu()
         // esc closes the find bar of the key window, and reaches the page otherwise
         NSEvent.addLocalMonitorForEvents(matching: .keyDown) { e in
@@ -267,6 +268,61 @@ final class Delegate: NSObject, NSApplicationDelegate, WKNavigationDelegate, WKU
         web.loadHTMLString("<p>one needle, two needle</p>", baseURL: nil)
     }
 
+    /** hears every js panel once it shows: the self test answers it */
+    var onPanel: ((NSAlert) -> Void)?
+
+    // `--self-test-panels`: a page in an offscreen window calls prompt, confirm
+    // and alert, answered OK after typing over the prompt's text, then again,
+    // answered with esc. What the page got printed, exit 0 only when every
+    // answer reached it. Return is checked as OK being the sheet's default
+    // button: a synthetic return reaches it only in a key window, and the test
+    // must not take the focus
+    func selfTestPanels() {
+        let web = WKWebView(frame: .zero, configuration: WKWebViewConfiguration())
+        web.navigationDelegate = self
+        web.uiDelegate = self
+        let win = NSWindow(contentRect: NSRect(x: -4000, y: -4000, width: 600, height: 400), styleMask: [.titled], backing: .buffered, defer: false)
+        win.contentView = Pane(web: web)
+        win.orderFrontRegardless()
+        windows.append(win)
+        var accept = true
+        var panels = 0
+        var returnIsOK = true
+        var escHeard = true
+        onPanel = { alert in
+            panels += 1
+            DispatchQueue.main.async {
+                if alert.window.defaultButtonCell !== alert.buttons[0].cell { returnIsOK = false }
+                if accept {
+                    // typing replaces the default text only when it is selected in an active editor
+                    if let field = alert.accessoryView as? NSTextField { (field.currentEditor() as? NSTextView)?.insertText("typed", replacementRange: NSRange(location: NSNotFound, length: 0)) }
+                    return alert.buttons[0].performClick(nil)
+                }
+                if alert.buttons.count == 1 { return alert.buttons[0].performClick(nil) }
+                let esc = NSEvent.keyEvent(with: .keyDown, location: .zero, modifierFlags: [], timestamp: 0, windowNumber: alert.window.windowNumber, context: nil, characters: "\u{1b}", charactersIgnoringModifiers: "\u{1b}", isARepeat: false, keyCode: 53)
+                if let esc, alert.window.performKeyEquivalent(with: esc) { return }
+                escHeard = false
+                alert.buttons[1].performClick(nil)
+            }
+        }
+        let js = "JSON.stringify([prompt('name', 'x'), confirm('ok?'), (alert('hi'), 'alerted')])"
+        onLoad = { _ in
+            web.evaluateJavaScript(js) { a, _ in
+                accept = false
+                web.evaluateJavaScript(js) { b, _ in
+                    let ok = (a as? String) ?? "none", cancel = (b as? String) ?? "none"
+                    print("panels=\(panels)")
+                    print("return-is-ok=\(returnIsOK)")
+                    print("esc-heard=\(escHeard)")
+                    print("ok=\(ok)")
+                    print("cancel=\(cancel)")
+                    exit(panels == 6 && returnIsOK && escHeard && ok == "[\"typed\",true,\"alerted\"]" && cancel == "[null,false,\"alerted\"]" ? 0 : 1)
+                }
+            }
+        }
+        web.loadHTMLString("<p>panels</p>", baseURL: nil)
+    }
+
     func windowWillClose(_ note: Notification) {
         windows.removeAll { $0 === note.object as? NSWindow }
     }
@@ -293,6 +349,46 @@ final class Delegate: NSObject, NSApplicationDelegate, WKNavigationDelegate, WKU
         return nil
     }
 
+    // alert, confirm and prompt: without these WebKit answers each one at once
+    // (no panel, confirm false, prompt null), so a page's dialogs do nothing.
+    // WebKit throws when a handler is dropped or called twice: `panel` calls
+    // `done` exactly once on every path
+
+    /** one js panel: a sheet on the page's window, a modal where there is
+     *  none. Return is OK, esc is Cancel; `done` hears whether OK was pressed */
+    func panel(_ web: WKWebView, _ message: String, cancel: Bool, field: NSTextField? = nil, done: @escaping (Bool) -> Void) {
+        let alert = NSAlert()
+        alert.messageText = message
+        alert.addButton(withTitle: "OK").keyEquivalent = "\r"
+        if cancel { alert.addButton(withTitle: "Cancel").keyEquivalent = "\u{1b}" }
+        if let field {
+            alert.accessoryView = field
+            alert.window.initialFirstResponder = field
+        }
+        guard let win = web.window else {
+            onPanel?(alert)
+            return done(alert.runModal() == .alertFirstButtonReturn)
+        }
+        alert.beginSheetModal(for: win) { r in done(r == .alertFirstButtonReturn) }
+        // first responder selects the whole default text, so typing replaces it
+        if let field { alert.window.makeFirstResponder(field) }
+        onPanel?(alert)
+    }
+
+    func webView(_ web: WKWebView, runJavaScriptAlertPanelWithMessage message: String, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping () -> Void) {
+        panel(web, message, cancel: false) { _ in completionHandler() }
+    }
+
+    func webView(_ web: WKWebView, runJavaScriptConfirmPanelWithMessage message: String, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping (Bool) -> Void) {
+        panel(web, message, cancel: true) { ok in completionHandler(ok) }
+    }
+
+    func webView(_ web: WKWebView, runJavaScriptTextInputPanelWithPrompt prompt: String, defaultText: String?, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping (String?) -> Void) {
+        let field = NSTextField(string: defaultText ?? "")
+        field.frame = NSRect(x: 0, y: 0, width: 300, height: 24)
+        panel(web, prompt, cancel: true, field: field) { ok in completionHandler(ok ? field.stringValue : nil) }
+    }
+
     func item(_ menu: NSMenu, _ title: String, _ action: Selector, _ key: String, _ mods: NSEvent.ModifierFlags = [.command], tag: Int = 0) {
         let i = menu.addItem(withTitle: title, action: action, keyEquivalent: key)
         i.keyEquivalentModifierMask = mods

package/src/home/resources.ts

@@ -285,6 +285,9 @@ export class Resource {
      *  while it answers, else it starts and opens once it does */
     async open(how: OpenHow): Promise<void> {
         if (this.decl.url == null) throw new Error(`${this.decl.id} declares no url to open`)
+        // the status is the last tick's: a process that died since would get
+        // a window on a dead port and never start
+        await this.tick()
         if (this.status === 'up') {
             this.show(how, this.decl.url)
             return

package/src/plan/planner.ts

@@ -11,7 +11,8 @@
 //
 // what keeps it off the cpu: a save burst is asked about once the repo is
 // quiet (QUIET_MS, or MAX_WAIT_MS into a burst that never stops), a check a
-// save moved waits COST_FACTOR times its last measured run, and nothing it
+// save moved waits COST_FACTOR times its last measured run and GATED_HOLD_MS
+// after the latest gate someone else started in its repo, and nothing it
 // starts on its own starts while the load per core is above LOAD_MAX.
 import { availableParallelism, loadavg } from 'os'
 import { CATCH_UP_BEAT_MS, resumeCatchUp, type CatchUpStore } from './catch-up.ts'
@@ -39,6 +40,9 @@ export type PlanSource = {
     checks: () => Promise<PlanCheck[]>
     /** every check's last result on record */
     last: () => Record<string, LastResult>
+    /** when the latest run someone asked for started here (a terminal, an
+     *  agent, a click), never one the plan started; null when none did */
+    gatedAt?: () => number | null
     /** the checks a save moved: their answer would not replay */
     changed: () => Promise<string[]>
     /** run these checks now, in the background; resolves to the exit code */
@@ -88,6 +92,11 @@ export const MAX_WAIT_MS = 10 * 60_000
  *  measured run: a 30s suite at most every 10 minutes, a 200ms lint at once */
 export const COST_FACTOR = 20
 
+/** a save moved check waits this long after the latest run someone else
+ *  started in its repo (a terminal, an agent, a click): whoever gates that
+ *  tree is still at work, and its own gate measures what it changed */
+export const GATED_HOLD_MS = 10 * 60_000
+
 /** above this 1 minute load average per core, the plan starts nothing on its
  *  own: every core already has a process waiting for it */
 export const LOAD_MAX = 1
@@ -112,6 +121,7 @@ type Repo = {
     src: PlanSource
     checks: PlanCheck[]
     last: Record<string, LastResult>
+    gatedAt: number | null
     lastRead: number
     marks: Map<string, Mark>
     timer: unknown
@@ -169,7 +179,7 @@ export class Planner {
     async add(src: PlanSource): Promise<void> {
         const old = this.repos.get(src.repo)
         if (old?.timer != null) this.timers.clear(old.timer)
-        const r: Repo = { src, checks: [], last: {}, lastRead: -Infinity, marks: old?.marks ?? new Map(), timer: null, burstAt: null, settleAt: null, detecting: null, again: false, error: null }
+        const r: Repo = { src, checks: [], last: {}, gatedAt: null, lastRead: -Infinity, marks: old?.marks ?? new Map(), timer: null, burstAt: null, settleAt: null, detecting: null, again: false, error: null }
         this.repos.set(src.repo, r)
         await this.reload(src.repo)
         try {
@@ -223,6 +233,7 @@ export class Planner {
         r.lastRead = now
         try {
             r.last = r.src.last()
+            r.gatedAt = r.src.gatedAt?.() ?? null
         } catch (e) {
             this.fail(r.src.repo, e)
         }
@@ -315,7 +326,9 @@ export class Planner {
             // a check pays for its own runs: one save cannot run it again
             // before COST_FACTOR times its last measured run has passed
             const spaced = last?.cost != null ? last.cost.at + COST_FACTOR * last.cost.ms : -Infinity
-            const at = Math.max(m.changedAt, spaced)
+            // and it waits for whoever gates this tree by hand to stop
+            const gated = r.gatedAt != null ? r.gatedAt + GATED_HOLD_MS : -Infinity
+            const at = Math.max(m.changedAt, spaced, gated)
             return { ...base, state: at > now ? 'next' : 'due', reason: 'changed', dueAt: at }
         }
         const lastAt = Math.max(last?.at ?? -Infinity, m.attemptAt ?? -Infinity)
@@ -354,8 +367,12 @@ export class Planner {
     held(): string[] {
         const now = this.now()
         const out: string[] = []
-        for (const r of this.repos.values())
+        for (const r of this.repos.values()) {
             if (r.settleAt != null) out.push(`settling: ${r.src.repo}, ${Math.max(0, Math.ceil((r.settleAt - now) / 1_000))}s`)
+            const until = r.gatedAt == null ? null : r.gatedAt + GATED_HOLD_MS
+            if (until != null && until > now && [...r.marks.values()].some((m) => m.changedAt != null))
+                out.push(`deferred: ${r.src.repo}, a gate someone started there ${Math.floor((now - r.gatedAt!) / 60_000)}m ago, so what a save moved waits ${Math.ceil((until - now) / 60_000)}m`)
+        }
         if (this.holdReason != null) out.push(this.holdReason)
         return out
     }

package/src/plan/repo-source.ts

@@ -82,12 +82,15 @@ export function readLastCosts(path: string): Record<string, { at: number; ms: nu
     return out
 }
 
-/** when the latest run on record started, whoever ran it, or null */
-export function lastStarted(path: string): number | null {
+/** when the latest run on record started, or null. `asked`: only a run
+ *  someone asked for (a terminal, an agent, a click), never one the plan
+ *  started on its own */
+export function lastStarted(path: string, o: { asked?: boolean } = {}): number | null {
     const opened = openDb(path, { create: false })
     if (opened == null) return null
     try {
-        const r = opened.db.query('select max(started) as at from invocations').get() as { at: number | null } | null
+        const sql = o.asked === true ? "select max(started) as at from invocations where by != 'schedule'" : 'select max(started) as at from invocations'
+        const r = opened.db.query(sql).get() as { at: number | null } | null
         return r?.at == null ? null : Number(r.at)
     } catch {
         return null
@@ -144,6 +147,7 @@ export function repoSource(d: RepoSourceDeps): PlanSource {
             for (const [id, cost] of Object.entries(costs)) if (all[id] != null) all[id] = { ...all[id]!, cost }
             return all
         },
+        gatedAt: () => (d.record === '' ? null : lastStarted(d.record, { asked: true })),
         changed: async () => {
             const decls = rows.map((r) => r.decl)
             if (decls.length === 0) return []

package/src/release/run-release.ts

@@ -12,7 +12,7 @@ import { runCi } from '../core/run-ci.ts'
 import { extractChangelogSection } from './changelog.ts'
 import { deriveRemote, dirtyPaths, git, remoteTagState, tagExistsLocally, type RemoteTagState } from './git-facts.ts'
 import { releaseScope } from './release-scope.ts'
-import { npmPublishArgv, unitBlockers } from './unit-gate.ts'
+import { publishCommand, unitBlockers, type Publisher } from './unit-gate.ts'
 import { formatUnitError, resolveUnits, unitById, unknownUnit, type ReleaseUnit } from './units.ts'
 import type { RepoConfig } from '../repo-config.ts'
 import { nestedIn, nestedRefusal } from '../core/nesting.ts'
@@ -37,6 +37,10 @@ export type ReleaseConfig = {
      *  Absent = rely on ambient npm auth. Never put a token in config.
      *  Repo-wide: one account publishes every unit. */
     npmTokenCommand?: string[]
+    /** the tool that packs and publishes every npm unit (default 'npm'). A
+     *  repo that tests its tarball with `bun pm pack` publishes with 'bun', so
+     *  the packer it tests is the packer that ships. */
+    publisher?: Publisher
     /** cut a GitHub release for the ROOT unit with `gh` (default true) */
     githubRelease?: boolean
     /** make a NON-blocking check failure block the release too. Blocking
@@ -301,18 +305,23 @@ export async function releaseUnit(root: string, config: RepoConfig, unit: Releas
         if (wantNpm && !alreadyPublished) {
             const env: Record<string, string> = { ...process.env as Record<string, string> }
             const argv = rc.npmTokenCommand
+            const publisher = rc.publisher ?? 'npm'
             let npmrc: string | null = null
+            let token: string | null = null
             if (argv != null && argv[0] != null) {
                 const t = Bun.spawnSync(argv)
-                const token = t.exitCode === 0 ? t.stdout.toString().trim() : ''
+                token = t.exitCode === 0 ? t.stdout.toString().trim() : ''
                 if (token === '') { print(`FAIL: release.npmTokenCommand produced no token (exit ${t.exitCode})`); return 1 }
-                // token via a throwaway userconfig, never argv, never a
-                // committed .npmrc, never a line in a log
-                npmrc = join(work, 'npmrc')
-                writeFileSync(npmrc, `//registry.npmjs.org/:_authToken=${token}\n`, { mode: 0o600 })
+                // token via a throwaway userconfig (npm) or the env (bun),
+                // never argv, never a committed .npmrc, never a line in a log
+                if (publisher === 'npm') {
+                    npmrc = join(work, 'npmrc')
+                    writeFileSync(npmrc, `//registry.npmjs.org/:_authToken=${token}\n`, { mode: 0o600 })
+                }
             }
-            const p = Bun.spawnSync(npmPublishArgv({ npmrc }), { cwd: unit.dir, env, stdout: 'inherit', stderr: 'inherit' })
-            if (p.exitCode !== 0) { print(`FAIL: npm publish failed for ${unit.id} (exit ${p.exitCode})`); return 1 }
+            const cmd = publishCommand({ publisher, npmrc, token })
+            const p = Bun.spawnSync(cmd.argv, { cwd: unit.dir, env: { ...env, ...cmd.env }, stdout: 'inherit', stderr: 'inherit' })
+            if (p.exitCode !== 0) { print(`FAIL: ${publisher} publish failed for ${unit.id} (exit ${p.exitCode})`); return 1 }
             print(`ok: published ${name}@${version}`)
         }
 

package/src/release/unit-gate.ts

@@ -9,11 +9,18 @@ import { dirtyPaths } from './git-facts.ts'
 import type { ReleaseUnit } from './units.ts'
 import type { RepoConfig } from '../repo-config.ts'
 
-/** the publish argv. `--access public` is not a default: npm restricts a
- *  scoped package unless it is asked, and a restricted publish looks
- *  successful right up until a consumer cannot install it. */
-export function npmPublishArgv(o: { npmrc?: string | null } = {}): string[] {
-    return ['npm', 'publish', '--access', 'public', ...(o.npmrc != null ? ['--userconfig', o.npmrc] : [])]
+/** the tool that packs and publishes an npm unit (`release.publisher`) */
+export const PUBLISHERS = ['npm', 'bun'] as const
+export type Publisher = (typeof PUBLISHERS)[number]
+
+/** the publish argv and the env its token rides in. `--access public` is not
+ *  a default: npm restricts a scoped package unless it is asked, and a
+ *  restricted publish looks successful right up until a consumer cannot
+ *  install it. npm reads the token from a throwaway userconfig; `bun publish`
+ *  has no `--userconfig` and reads NPM_CONFIG_TOKEN instead. */
+export function publishCommand(o: { publisher?: Publisher; npmrc?: string | null; token?: string | null } = {}): { argv: string[]; env: Record<string, string> } {
+    if (o.publisher === 'bun') return { argv: ['bun', 'publish', '--access', 'public'], env: o.token != null ? { NPM_CONFIG_TOKEN: o.token } : {} }
+    return { argv: ['npm', 'publish', '--access', 'public', ...(o.npmrc != null ? ['--userconfig', o.npmrc] : [])], env: {} }
 }
 
 /** everything that must hold for this unit, checked before anything is

package/src/repo-config.ts

@@ -25,6 +25,7 @@ import type { Rule } from './check.ts'
 import { leakAllowProblems } from './hooks/leak-guard.ts'
 import type { HooksConfig } from './hooks/run-hooks.ts'
 import type { ReleaseConfig } from './release/run-release.ts'
+import { PUBLISHERS } from './release/unit-gate.ts'
 import { TEST_ONLY_UNIT_KEYS, UNIT_DECL_KEYS, type UnitDecl } from './release/unit-resolve.ts'
 import { TASK_DEF_KEYS, type TaskDef } from './check.ts'
 import { testsConfigProblems, type TestsConfig } from './suite/judge-suites.ts'
@@ -41,6 +42,10 @@ export type ServeConfig = {
      *  its own port — house range 5800+, default = the hub port plus 1000
      *  (build/comfyui.md owns that surface) */
     comfyPort?: number
+    /** false hides the asset kit from the hub page (no asset rows, an empty
+     *  studio) and from `shipkit needs`, for a repo whose own tool mounts
+     *  `studioRoutes` and owns the picking. Default true */
+    assets?: boolean
     /** custom wiki-graph provider for repos with their own link semantics.
      *  Default: a generic md scan of the repo root. */
     wikiGraph?: {
@@ -320,6 +325,8 @@ export function defineRepo(c: RepoConfig): RepoConfig {
     for (const k of Object.keys(c))
         if (!KNOWN_KEYS.has(k))
             throw new Error(`defineRepo: unknown key '${k}'${k === 'checks' ? ` — checks:[] was removed; drop a <name>.check.ts file instead ('shipkit check' auto-discovers it)` : k === 'home' ? ` — home.resources was removed; declare each one in a <name>.shipkit.ts file as \`export default globalProcess({...})\`` : ''}`)
+    if (c.release?.publisher != null && !(PUBLISHERS as readonly string[]).includes(c.release.publisher))
+        throw new Error(`defineRepo: release.publisher '${String(c.release.publisher)}' is not a publisher (${PUBLISHERS.join(', ')})`)
     // a typo'd unit key would silently drop a target and release the wrong shape
     for (const u of c.units ?? []) {
         if (typeof u.dir !== 'string' || u.dir === '') throw new Error(`defineRepo: every units[] entry needs a 'dir'`)

package/src/serve/hub-runtime.ts

@@ -158,9 +158,10 @@ export async function resolveHubDeps(root: string, boot: RepoConfig, io: ServeIo
         graphs.push({ id: 'agent', label: 'agent/', title: `${c.name} agent/`, load: () => scanMdGraph({ root: agentRoot, index: c.serve?.agentIndex }), lint: { root: agentRoot, index: c.serve?.agentIndex } })
     // ONE page for every repo: the studio ALWAYS
     // mounts — kit-less repos get an empty media section, never a second
-    // page. A broken kit degrades to the same empty kit, loudly.
+    // page. A broken kit degrades to the same empty kit, loudly, and a repo
+    // whose own tool owns the picking turns the kit off here
     let kit: ResolvedKit | null = null
-    if (existsSync(join(root, '.shipkit/assets/kit.ts'))) {
+    if (c.serve?.assets !== false && existsSync(join(root, '.shipkit/assets/kit.ts'))) {
         try {
             kit = await loadKit(root)
         } catch (e) {

package/src/serve/project-gutter.ts

@@ -9,7 +9,7 @@
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
 import { basename, dirname, join, resolve, sep } from 'path'
 import { fileURLToPath } from 'url'
-import { gitRoot } from '../core/git-root.ts'
+import { gitRoot, isLinkedWorktree } from '../core/git-root.ts'
 import { DB_FILE } from '../ledger/db.ts'
 import { defaultHubPort } from './hub-port.ts'
 import { LAYOUT } from '../core/layout.ts'
@@ -52,7 +52,9 @@ export const ICON_FILES = ['.shipkit/identity/icon.png', 'public/favicon.png', '
 
 export const ICON_TYPES: Record<string, string> = { png: 'image/png', svg: 'image/svg+xml', ico: 'image/x-icon' }
 
-/** every direct child of `parent` that includes `index`, sorted by name */
+/** every direct child of `parent` that includes `index`, sorted by name. A
+ *  linked worktree of one is that repo checked out again, never a repo of its
+ *  own: its processes would collide with the main checkout's ids and ports */
 export function wiredRepos(parent: string, index: string, home: string): WiredRepo[] {
     let names: string[]
     try {
@@ -65,6 +67,7 @@ export function wiredRepos(parent: string, index: string, home: string): WiredRe
         if (name.startsWith('.')) continue
         const path = join(parent, name)
         if (!includeTargets(path, home).includes(index)) continue
+        if (isLinkedWorktree(path)) continue
         out.push({ name, path, icon: ICON_FILES.find((f) => existsSync(join(path, f))) ?? null })
     }
     return out

package/src/serve/run-lanes.ts

@@ -7,7 +7,8 @@
 //   - a run that writes the tree (a repair pass) waits for every run ahead of
 //     it, and every later run waits for it
 //   - every other run starts at once: the machine slot pool each check body
-//     takes bounds the CPU, never this queue
+//     takes bounds the CPU, never this queue. It admits fewer slots on a
+//     loaded machine (core/slots.ts), so a run past it waits and says why
 //
 // the one constraint a reader breaks first: the stamp is taken when a run
 // STARTS, before its body reads anything, so a tree that moves during the run
@@ -15,6 +16,7 @@
 import { createHash } from 'crypto'
 import { statSync } from 'fs'
 import { join } from 'path'
+import { fixPassRuns } from '../core/fix-scope.ts'
 import { gitBin } from '../core/git-bin.ts'
 
 export type LaneAsk = {
@@ -106,8 +108,10 @@ export function runKey(kind: string, opts: Record<string, unknown>): string {
     return `${kind} ${JSON.stringify(sorted)}`
 }
 
-/** a run with its repair pass on: `fix` and `fixRules` default to on */
-export const writesTree = (opts: Record<string, unknown>): boolean => opts.fix !== false || opts.fixRules !== false
+/** a run whose repair pass runs (core/fix-scope.ts): the structural fixers
+ *  and the hooks only ever run inside it */
+export const writesTree = (opts: Record<string, unknown>): boolean =>
+    fixPassRuns({ fix: typeof opts.fix === 'boolean' ? opts.fix : undefined, onlyIds: Array.isArray(opts.onlyIds) ? (opts.onlyIds as string[]) : undefined })
 
 /** HEAD, what git status lists, and the stat of each listed path, hashed:
  *  equal stamps mean no tracked or untracked file moved in between. Null

package/src/smoke/run-smoke.ts

@@ -27,6 +27,10 @@ export type SmokeRoute = {
      *  match's href after this route and judges the landed page as its own
      *  row. How a detail page with a real id gets visited without knowing one. */
     open?: string
+    /** the visible text a settled route needs before it counts as rendered,
+     *  default 40. A canvas app (a game) draws everything into one canvas and
+     *  shows no text: `{ path: '/', waitFor: 'canvas', minChars: 0 }`. */
+    minChars?: number
 }
 
 export type SmokeLogin = {
@@ -63,8 +67,9 @@ export type SmokeConfig = {
 const SMOKE_KEYS = new Set(['base', 'routes', 'login', 'paceMs', 'shots'])
 const LOGIN_KEYS = new Set(['path', 'email', 'emailSecret', 'passwordSecret', 'form'])
 const FORM_KEYS = new Set(['email', 'password', 'submit'])
-const ROUTE_KEYS = new Set(['path', 'waitFor', 'open'])
+const ROUTE_KEYS = new Set(['path', 'waitFor', 'open', 'minChars'])
 export const DEFAULT_LOGIN_PATH = '/login'
+export const DEFAULT_MIN_CHARS = 40
 
 export const DEFAULT_PACE_MS = 3000
 export const DEFAULT_SHOTS = `${LAYOUT.tmp}/smoke`
@@ -86,6 +91,8 @@ export function validateSmokeConfig(c: unknown): SmokeConfig {
                 const v = (r as Record<string, unknown>)[k]
                 if (v != null && (typeof v !== 'string' || v === '')) throw new Error(`defineRepo: smoke.routes['${path}'].${k} must be a non-empty selector`)
             }
+            const min = (r as Record<string, unknown>)['minChars']
+            if (min != null && (typeof min !== 'number' || !Number.isInteger(min) || min < 0)) throw new Error(`defineRepo: smoke.routes['${path}'].minChars must be a whole number of characters, 0 or more`)
         }
     }
     if (s['login'] != null) {
@@ -152,8 +159,8 @@ export type SmokeReport = {
  *  nothing threw, an empty `waitFor` on a listing is exactly how a broken
  *  migration looks, and a page that scrolls sideways is a layout defect only
  *  a real browser can see (happy-dom does no layout). */
-export function judgeRoute(r: { route: string; chars: number; matches: number; problems: number; waitFor?: string; overflowPx: number }): RouteReport {
-    const empty = r.chars < 40
+export function judgeRoute(r: { route: string; chars: number; matches: number; problems: number; waitFor?: string; minChars?: number; overflowPx: number }): RouteReport {
+    const empty = r.chars < (r.minChars ?? DEFAULT_MIN_CHARS)
     const noMatch = r.waitFor != null && r.matches === 0
     const sideways = r.overflowPx > 1
     const note = empty ? 'EMPTY PAGE' : noMatch ? `NO MATCH FOR ${r.waitFor}` : sideways ? `PAGE SCROLLS SIDEWAYS +${r.overflowPx}px` : r.problems > 0 ? `${r.problems} problem(s)` : ''
@@ -368,7 +375,7 @@ export async function runSmoke(root: string, config: SmokeConfig, opts: SmokeRun
         }
 
         /** visit one url, settle it, judge it, screenshot it */
-        const visit = async (label: string, url: string, waitFor?: string): Promise<RouteReport> => {
+        const visit = async (label: string, url: string, waitFor?: string, minChars?: number): Promise<RouteReport> => {
             // let the previous page's requests drain out of the concurrency
             // window BEFORE the label moves, or its late failures land on this row
             if (paceMs > 0) await page.waitForTimeout(paceMs)
@@ -387,11 +394,11 @@ export async function runSmoke(root: string, config: SmokeConfig, opts: SmokeRun
                 return Math.max(de.scrollWidth - de.clientWidth, doc.body.scrollWidth - doc.body.clientWidth)
             }).catch(() => 0)
             await page.screenshot({ path: join(shots, `${routeSlug(label)}.png`), fullPage: true })
-            return judgeRoute({ route: label, chars, matches, problems: problems.length - before, waitFor, overflowPx })
+            return judgeRoute({ route: label, chars, matches, problems: problems.length - before, waitFor, minChars, overflowPx })
         }
 
         for (const route of routes) {
-            reports.push(await visit(route.path, route.path, route.waitFor))
+            reports.push(await visit(route.path, route.path, route.waitFor, route.minChars))
             if (route.open == null) continue
             // a detail page with a real id: the first link the selector matches
             const href = await page.locator(route.open).first().getAttribute('href').catch(() => null)