rvlib-shipkit 1.8.0 → 2.0.0

package/CHANGELOG.md

@@ -1,3 +1,69 @@
+## 2.0.0
+
+- **A clean commit prints one line**, `ok: N commit gate(s) clean`. A gate that fails still prints whole, and a WARN or a waived hit inside a passing gate still prints.
+- **A green `sk ci` prints one line, the verdict.** Each check's `ok:` and `skip:` line and the `ran:` reasons go behind `--verbose`, and STATUS.md still holds them. A WARN, a FAIL with its fix, what the fix pass rewrote and a wait for a machine slot always print. A gate of 65 checks went from 86 lines to 2.
+- **A check's default time budget is 1 s in process and 5 s for a build step, a `cmd` check or a world probe** (it was 2 s and 10 s). A check that passes over it still only warns. The per suite test budget is unchanged.
+- **The suite runner never discovers a test file under a dot dir, as bun does not.** So a repro archived under `.shipkit/repros/` costs no run, `tests.select` included. `.shipkit/repros/` is a tracked folder of the SK004 block.
+- **`sk commands --compact`** renders one line per command, for a page every session loads.
+- **No VS Code task starts the shipkit hub any more.** The hub runs in the home, so `sk start` and `sk init` write no `.vscode/tasks.json`, and the scaffold template is gone. SK017 now runs in the gate (a WARN, never a block) and its repair is in the fix pass of every `sk ci`: it removes a hub task (`bun run hub`, or a `🚀  shipkit` label) and the hub's `dependsOn` entries, a wrapper left starting nothing, and the old scaffold comment about the hub. A wrapper left starting ONE task folds into it, which then opens with the folder. A file left with no task is deleted. The `👁  TSC` rule is unchanged, and a package published to npm is still never rewritten. Run by hand: `sk check --fix SK017`.
+- **`vendored: ['<dir>', …]` in repo.config.ts keeps third party code out of every tool that treats the tree as the repo's own source.** A vendored library (a git subtree, a copied package) stays byte identical to upstream. The import fixer and imports:check never crawl it and never adopt its package.json as one of the repo's packages, which rewrote every relative import of a vendored workspace into a package name form. Cycles and the source graph skip it, the on save `imports <file>` leaves a vendored file alone, `bun lint` gets `--ignore-pattern=<dir>/**`, `c.list` leaves it out of every check's listing (unless the glob names a path inside it), check discovery and the md scan never enter it, and `shipkit mv` never rewrites a reference inside it. A fixer the toolkit cannot scope (a package.json `imports:fix` script) still runs, and whatever it wrote under a vendored dir is put back byte for byte, an uncommitted edit of the repo's own included, with a WARN naming it. Cache keys, watchers and the leak guard still read vendored files. The value is a literal array of strings, because the tools that never load the config read it as text, and the config load refuses a value the text cannot show. A repo running an older copy (its hooks, its own scripts) refuses the key as unknown until it upgrades.
+- **A directive id ends on a letter or digit.** `sk-disable-line RV027: why` reads as the id `RV027` with no reason, so it warns, where it used to name an id `RV027:` that matched nothing.
+- **A failed linter or tsc names its errors on the gate.** A build step that prints no wire FAIL line now shows its parsed errors under the headline, up to 20, as `file:line:col: rule message`, where it used to show only its closing recap and a log path.
+- **A finding carries its site, and the file it sits in can waive it.** `c.fail(msg, { fix, at: { file, line, col } })` and `c.warn` take the site beside the fix pointer, and a plain string is still the pointer, so no check file changes. A check that passes `{ fix, at }` needs this release: an older copy prints the object as its pointer. The site rides on the wire line through the cache replay into the problems pane, which no longer has to find `path:line` in the text, and a message that does not name its file gets the site in front. A directive in the file's own comment waives a site, and only with a reason: `sk-disable-next-line <ID>[, <ID>…] -- <reason>`, `sk-disable-line`, `sk-disable-file`. A waived site is neither a FAIL nor a WARN: the check prints `skip: [<ID>] 2 sites waived in their files`, and `--verbose` and STATUS.md list each one. A directive with no reason waives nothing and WARNs, and so does one that waives nothing in a file the check read. The waiving file is read through `c`, so it joins the answer's key, and a check keyed on `files` stores no answer that a directive outside its inputs decided. An in process `run` body applies them, a `cmd` check does not.
+- **SK027 reports where it found each problem.** A dangling ref carries the line it sits on and an orphan its file, so the problems pane opens the page and an orphan kept on purpose can waive itself with `sk-disable-file SK027 -- <reason>`.
+- **`sk start` on a repo with history seeds the house files when it writes the house include lines.** The `agent/` wiki the second include routes at, the `.shipkit/reflections/` seed and the two `.claude/` policy files land create-only (`adoptHouse`), so every file the repo already has wins and nothing is committed over its history. A start with no house still writes none of them.
+- **`off: { <id>: '<why>' }` is the one switch, for a check, a floor slot and a commit gate alike.** The commit gates take ids: `tree-shrink`, `leak-guard`, `blocked-paths`, `root-identity`, `commit-message` and `commit-language`. `commit-message` off takes `commit-language` with it. An `off` id the gate cannot find still fails, a misspelled gate id included.
+- **The commit gates are rows of the inventory.** `sk checks`, `sk when` and the hub list each one with its hook in the commit column (`pre-commit`, `commit-msg` or `both`), its owner page and its `off` reason. They still run only from the git hooks, which load nothing new, and `sk ci --only <gate>` says where the gate runs instead of running it.
+- **`hooks.disable` and `defaults: { <slot>: false }` are retired, and still load.** Each reads as off with the reason `was hooks.disable: ['<id>'], no reason recorded` or `was defaults: { <slot>: false }, no reason recorded`, so every surface shows that nobody wrote one. SK029 fails while a config carries them, and the fix pass of `sk ci` ports them into `off`: the comment written right above the entry becomes its reason, and a shape it cannot read (a multi line `disable` array) is named for a person and left loading. `sk hooks list` prints an off gate as `(OFF: <reason>)` where it printed `(DISABLED by config)`.
+- **A floor slot turned off through `off` is off everywhere, as `defaults: { <slot>: false }` was.** It resolves to no task, SK001 no longer routes or asks for its script, SK013 no longer denies its raw tool, SK019 no longer reads its script, and its fixer slot stays off. Before, `off` stopped the slot from running but kept routing and denying it. A hub switch that turns a slot off now lifts its deny rule too, on the next fix pass.
+- **SK034 commit gates armed.** It FAILs a repo where git would not run the leak guard and the message gate: an unset `core.hooksPath`, or a foreign `pre-commit` or `commit-msg` that never calls shipkit, with the guarded line to chain. This was half of SK009, which only checked `commit-msg`, and it now covers the hook that carries the leak guard too.
+- **`sk ci --only <check> --fix` repairs only what the named checks own.** Their own ci repair, and the fixer slot that governs one of them (`imports:fix` for `imports:check`). Before, `--fix` ran every fixer slot over the whole tree.
+- **The STE prose rule is gone: SK014, `sk prose`, the hub's prose page and the `prose` config key.** No rule polices prose style any more. A `repo.config.ts` that still declares `prose` fails at load with "prose was removed with rule SK014: delete the key", and an `off` or `ruleExempt` entry that names SK014 or SK009 fails the same way, naming the retired rule.
+- **The AI attribution guard is gone: SK009 and the attribution half of the commit-msg hook.** The hook keeps the dash and French checks, and `hooks.disable: ['commit-message']` now lifts the whole message gate. The scaffold still writes the `.claude/settings.json` attribution silencer, which is harness config and reaches no agent's context.
+- **`bun lint` is the house linter.** With no `lint` script and a `[lint]` section in `bunfig.toml`, the lint slot runs `bun lint --format unix`, and the problems pane reads its findings. It needs bun 1.4.4 (canary today): an older bun gets a failing line that names `bun upgrade --canary`, never a `lint` script that calls itself.
+- **Nothing formats in the gate.** The fix pass has no formatter slot any more: a `fmt` or `format` script, and a `[fmt]` section in `bunfig.toml`, are never run by `sk ci`, locally or under CI, so verify mode no longer fails a commit on formatting. `bun fmt` stays a manual tool, styled by `[fmt]`. SK001 no longer asks for `[fmt]` or a `fmt` script, and the `pretty` alias WARN is gone with it.
+- **oxlint and oxfmt are retired.** SK001 WARNs, one line per tool, on a dependency (`oxlint-tsgolint` included) or a script body that names either, with the migration: port `.oxlintrc.json` into `[lint]` for `bun lint`, then delete the dependency, each script that is only the tool, and the tool's config file. A script that does more (a code generator that formats its output) is told to lose the step, never deleted. It never repairs this itself: a linter swap changes which rules gate the repo, and dropping a dependency moves `bun.lock`, which only an install rewrites.
+- **A leftover `lint` script can no longer take the built-in's place.** bun runs a package.json script of that name instead of `bun lint`, flags and all, so the built-in now runs through `src/core/bun-tool-cli.ts`, which sets `npm_lifecycle_event` and drops an inherited `npm_package_json`, the two signals bun reads, and SK001 WARNs on a `lint` or `fmt` script that shadows a declared section.
+- **A canary upgrade invalidates cached answers.** The toolchain identity hashes `Bun.revision` beside `Bun.version`, which every canary of one version shares.
+- **`lint` is no longer a routed script.** SK001 stops asking for `lint` to route through `sk ci --only lint`, its fixer stops writing `lint:raw`, and the one-way-in deny list drops `oxlint` and `eslint`. A `[lint]` section meets SK001's baseline as a script did. A repo that already routes `lint` keeps working.
+- **The scaffold writes `bunfig.toml` with `[fmt]` and `[lint]`, and no `lint` or `fmt` script.** The toolchain drops `oxlint` and `oxfmt`, and the editor settings drop `oxc.enable`.
+- **A test suite is judged on its own CPU in the parallel phase, never on the files that ran before it in its worker.** A suite over `tests.budgetMs` in wall time skipped its lone run only when its own CPU plus everything its worker burned before it stayed under the budget, and after a worker's first file that sum is always over. So on a loaded machine nearly every suspect ran alone, one after the other: in a large repo 27 lone runs took 53 s of a 97.6 s test check. A suspect whose own CPU in the parallel phase, children included, is inside the same allowance a lone run gets (`cpuAllowance`) is now cleared there. A module that several suites share is charged to the first suite of each worker that loads it. A suite whose own figure is past its allowance, whose wall can hide a wait, or that ends with a child still alive runs alone as before, and only a lone run can fail the task. Measured on that repo, 760 suites under eight CPU burners: 19 lone runs and 47.1 s at load 13.5, then 0 lone runs and 27.0 s at load 24.5. The preload's line is now `<file>\t<cpu ms>`.
+
+## 1.9.0
+
+- **A commit in a linked worktree passes the pre-commit hook.** git sets GIT_DIR for a hook there, and the installed copy then asked git where the house sits and got the worktree back, so it never handed off to the house source. Then it ran itself and failed every built-in check with ENOENT on a `?v=` stamped path. A directory with its own `.git` is now asked with the locating variables stripped, and an installed copy that runs itself (CI, `SHIPKIT_NO_HOME`) loads its own check files.
+- **A broken built-in check no longer aborts every repo's gate.** In a repo that only consumes the toolkit, a built-in that does not load or is refused is one non-blocking WARN that names the file. The repo that hosts the toolkit source still fails on it. Before, it threw a misleading "names the page that OWNS the invariant" error before any check ran.
+- **`sk gp open <id>` probes before it trusts "up".** A process that died since pm last looked now starts before its window opens, instead of a window on a dead port.
+- **A linked worktree of a house repo is no longer a house repo of its own.** The home, the global context and pm skip a sibling whose `.git` is a file, so its global processes no longer collide with the main checkout's ids and ports.
+- **`sk ci --only <check>` leaves the tree alone.** A narrowed run no longer runs the fix pass unless `--fix` is named, so `bun run test`, `lint` and `typecheck`, which route through `--only`, never reformat a shared tree. Before, the formatter ran on every narrowed run and rewrote 478 files of one checkout, other agents' uncommitted work included. A whole gate still repairs first, and `--no-fix` still turns it off.
+
+- **The machine pool admits fewer checks on a loaded machine.** A slot is a check, and a check is often a whole multi core tool, so eight slots on eight cores could put several times the cores to work. Past a 1 minute load of one per core the pool now admits slots in proportion to the load, never fewer than one: at load 20 on 8 cores it admits 3 of 8. A slot already held is never taken back. A waiting check prints the load and what the pool admits.
+
+- **The plan holds save runs while someone gates the repo.** A check a save moved now also waits 10 minutes after the latest run a terminal, an agent or a click started in its repo. On one repo with several agents, most of the plan's test runs had started within those 10 minutes and measured a tree the agents were gating themselves. The run is held, not dropped, so the tree still gets one verdict once they stop. `sk planned` shows the hold as a `deferred:` line.
+- **A suite over the CPU budget in its lone run runs alone once more, and the smaller figure stands.** On a busy Apple silicon machine the scheduler can spill a lone run onto the efficiency cores, where the same work burns up to 4x the CPU time, so a suite inside its budget failed one run in three and passed a minute later. A spill only raises CPU time, so the second run can clear a false red and never hide a real one. A wait or a suite with no CPU figure keeps its one run, and a green gate pays nothing.
+
+- **The gate's test line says the command the suite runner ran.** A plain `bun test` body does not run as written under `sk ci`: the runner adds `--parallel=<n>` and `--no-isolate`. The line now reads `ok: test 412 tests (ran 1.5s) as \`bun test --parallel=7 --no-isolate\` (added --parallel=7 --no-isolate)`, so a reader of package.json knows that `bun run test` outside the gate runs another way. Per file ignores stay out of it.
+
+- **A test phase killed at its ceiling names the suite that hung, and both things that hang a worker.** bun lists the suites still running when a phase is killed, and the parallel phase now reads that list, so the line says `with tests/x.test.ts still running`. It names a synchronous loop and `expect(p).resolves` or `.rejects` on a promise that never settles: bun's per test timeout stops neither, while a plain `await` of such a promise fails at the per test timeout. And a red suite is no longer judged on time: its time is its failure's, so a test that timed out no longer runs again alone and no longer adds a budget FAIL.
+- **The gate typecheck keeps its own incremental cache, and a release can publish with bun.** The built-in typecheck passes `--incremental --tsBuildInfoFile <project dir>/node_modules/.cache/shipkit/<config>.tsbuildinfo` for every project, so a `tsc --watch` task or a raw script on the same tsconfig no longer writes the cache the gate reads. A config without `incremental` gets it too: rvlib-shipkit's own typecheck went from 0.81 s to 0.35 s warm. `release.publisher: 'bun'` makes `sk release` and `sk bump` run `bun publish --access public`, with the token from `release.npmTokenCommand` in `NPM_CONFIG_TOKEN`, for a repo that tests its tarball with `bun pm pack`. The default stays npm, and an unknown publisher fails `defineRepo`.
+
+- **`alert`, `confirm` and `prompt` work in the shipkit app and in every process app.** The app window answered each one at once with no panel: `confirm` returned false and `prompt` null, so a page button behind one did nothing. Each now shows as a sheet on its window. The prompt's text field holds the default text, selected. Return is OK and Esc is Cancel. An app picks it up the next time `sk gui` or `sk gp open <id> --app` opens it, because a changed source rebuilds the app and quits the running copy.
+- **The pre-commit hook refuses a commit that drops most of the tree.** A commit that keeps under half of HEAD's files fails `tree-shrink`, which is what a commit from a private `GIT_INDEX_FILE` never filled with `git read-tree HEAD` does. `SHIPKIT_ALLOW_MASS_DELETE=1` lifts it for one deliberate mass delete, and `hooks.disable: ['tree-shrink']` for good.
+- **The pre-commit hook imports only the check files that run at commit.** A table under the git dir remembers, per file stamp, whether a check file declares `onPreCommit`, so a check file that never runs at commit costs the commit nothing while it stands still. A repo check file whose import takes over 30ms is named with a WARN on the commit that pays for it. The git steps share one staged listing, and the commit checks share one pass that records no config reads. Warm, on a consumer shaped fixture: 189ms before, 110ms after.
+- **SK013 also writes `Bash(git stash*)` into every repo's deny list, and the guard refuses a stash in the forms the deny row cannot see**: after git's own options (`git -C dir stash`), inside `bash -c` or `eval`. `git stash list` and `git stash show` pass the guard.
+
+- **The `prompt` and `seed` vars contract binds only the workflows a kit kind drives.** Loading the workflows folder no longer refuses a module that lacks them, so a workflow the repo drives with its own tools (portraits, voice, music) names its vars freely. The check runs when the atelier resolves the workflow for a kind, and the error names that kind.
+
+- **`sk assets gen` works on a repo whose comfy-ts is newer than shipkit's.** The one comfy-ts instance of the process is now created through the copy the repo's workflow modules import, so a module gets the vars builder of its own version. Before, shipkit's older copy rooted it, and a module using a newer var kind failed every roll (`v.model is not a function`).
+
+- **The og card draws accented names.** The default card names a font family list (Helvetica, Arial, DejaVu Sans, Liberation Sans, Noto Sans, then sans-serif). The generic sans-serif alone resolved on macOS to a face with no Latin-1 accents, so a French name rendered with a missing glyph box.
+
+- **`sk smoke` serves canvas apps: a route takes `minChars`**, the visible text a settled route needs (default 40). A game that draws into one canvas declares `{ path: '/', waitFor: 'canvas', minChars: 0 }`, and a missing canvas still fails the route.
+
+- **`serve: { assets: false }` hides the asset kit from the hub page and from `sk needs`**, for a repo whose own tool mounts `studioRoutes` and owns the picking. Workflows and posts stay.
+
+- **`defineKit({ rollFormat: 'webp-lossless' })` stores new image rolls as lossless webp**, the same pixels at about 60 percent of the png bytes, encoded with sharp. Existing png rolls stay readable beside them.
+
 ## 1.8.0
 
 - **The quick tier can run only the suites a change reaches** (opt in: `tests: { select: true }`, or `SHIPKIT_TEST_SELECT=1` for one run). It keeps the snapshot of the last run and its red suites, and runs those plus every suite whose import closure, or whose recorded runtime reads, a change since then reaches. What it cannot see it runs: an unclaimed change under a code root, a spawn it does not know, a module that threw while loading, a run config file. The full tier still runs every suite.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "1.8.0",
+    "version": "2.0.0",
     "funding": "https://github.com/sponsors/rvion",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",

package/src/assets/gen/comfyts-gen.ts

@@ -40,6 +40,19 @@ const varsOf = (wf: DefinedWorkflow): Record<string, AnyVar> => wf.vars as Recor
 export const isRollImage = (img: Pick<MediaImage, 'ComfyNode'>): boolean =>
     !/preview/i.test(img.ComfyNode?.class_type ?? '')
 
+/** the ComfyTS class of the comfy-ts a bare import from `dir` reaches,
+ *  shipkit's own when the repo carries none */
+async function comfyTsOf(dir: string): Promise<typeof ComfyTS> {
+    let path: string
+    try {
+        path = Bun.resolveSync('comfy-ts', dir)
+    } catch {
+        return ComfyTS
+    }
+    const mod = (await import(path)) as { ComfyTS?: typeof ComfyTS }
+    return typeof mod.ComfyTS?.create === 'function' ? mod.ComfyTS : ComfyTS
+}
+
 /** dir = the flat folder holding the <id>.cflow.ts workflow modules.
  *  root pins `.comfy-ts/` (drafts, hosts cache) to the repo, cwd-independent. */
 export async function loadCflowWorkflows(root: string, dir: string): Promise<Map<string, LoadedWorkflow>> {
@@ -51,9 +64,12 @@ export async function loadCflowWorkflows(root: string, dir: string): Promise<Map
     // module then returns this same instance. comfy-ts keeps ONE instance per
     // process, and the daemon serves every repo from one process, so only the
     // first repo roots it. What it roots is the host caches, shared by every
-    // repo on the same host; each repo's drafts resolve from its own root
-    if ((globalThis as { comfyts?: unknown }).comfyts == null) ComfyTS.create({ rootPath: root })
+    // repo on the same host; each repo's drafts resolve from its own root.
+    // The instance is created through the copy the modules import, never
+    // shipkit's own: a host hands its vars builder to defineWorkflow, so an
+    // older copy gives a newer module a v without its newer var kinds
     if (!existsSync(dir)) fail(`${dir}/ missing — ship at least one <id>.cflow.ts comfy-ts workflow module (copy from the rv-comfy template)`)
+    if ((globalThis as { comfyts?: unknown }).comfyts == null) (await comfyTsOf(dir)).create({ rootPath: root })
     const out = new Map<string, LoadedWorkflow>()
     for (const f of readdirSync(dir).filter((x) => x.endsWith('.cflow.ts')).sort()) {
         const file = join(dir, f)
@@ -65,24 +81,25 @@ export async function loadCflowWorkflows(root: string, dir: string): Promise<Map
         // so letting them diverge would strand every per-asset draft
         if (wf.spec.id != null && wf.spec.id !== id) fail(`workflow file '${f}' declares id '${wf.spec.id}' — the file name IS the id, rename one`)
         wf.spec.id ??= id
-        const vars = varsOf(wf)
-        if (vars.prompt?.kind !== 'prompt' || vars.seed?.kind !== 'seed')
-            fail(`workflow '${id}' must declare vars.prompt (v.prompt) and vars.seed (v.seed) — shipkit drives both`)
         out.set(id, { id, root, file, wf })
     }
     if (out.size === 0) fail(`${dir}/ has no *.cflow.ts workflow modules — seed one from the rv-comfy template`)
     return out
 }
 
-/** Resolve a workflow: explicit id, else the sole loaded workflow. */
-export function workflowFor(workflows: Map<string, LoadedWorkflow>, ref: { workflow?: string; assetId?: string }): LoadedWorkflow {
-    if (ref.workflow != null) {
-        const lw = workflows.get(ref.workflow)
-        if (lw == null) fail(`asset '${ref.assetId ?? '?'}': unknown workflow '${ref.workflow}' (have: ${[...workflows.keys()].join(', ')})`)
-        return lw
-    }
-    if (workflows.size === 1) return [...workflows.values()][0]!
-    return fail(`asset '${ref.assetId ?? '?'}' names no workflow and ${workflows.size} are loaded (${[...workflows.keys()].join(', ')}) — set workflow on the kind`)
+/** Resolve the workflow a kit kind drives: explicit id, else the sole loaded
+ *  workflow. The atelier writes prompt and seed, so the contract binds here,
+ *  never at folder load: a workflow no kind drives names its vars freely. */
+export function workflowFor(workflows: Map<string, LoadedWorkflow>, ref: { workflow?: string; kind?: string; assetId?: string }): LoadedWorkflow {
+    const lw = ref.workflow != null
+        ? (workflows.get(ref.workflow) ?? fail(`asset '${ref.assetId ?? '?'}': unknown workflow '${ref.workflow}' (have: ${[...workflows.keys()].join(', ')})`))
+        : workflows.size === 1
+          ? [...workflows.values()][0]!
+          : fail(`asset '${ref.assetId ?? '?'}' names no workflow and ${workflows.size} are loaded (${[...workflows.keys()].join(', ')}) — set workflow on the kind`)
+    const vars = varsOf(lw.wf)
+    if (vars.prompt?.kind !== 'prompt' || vars.seed?.kind !== 'seed')
+        fail(`kind '${ref.kind ?? '?'}' drives workflow '${lw.id}', which must declare vars.prompt (v.prompt) and vars.seed (v.seed) — the atelier writes both`)
+    return lw
 }
 
 /** Apply a name→value record onto a workflow's vars: strings go through

package/src/assets/gen/generate-roll.ts

@@ -4,9 +4,9 @@
 // in both (before this, canvas draw lived only in the studio and the CLI
 // refused canvas kinds — A30). Comfy context is resolved LAZILY: canvas-only
 // kits never touch a comfy config or the box.
-import { mkdirSync } from 'fs'
+import { mkdirSync, unlinkSync } from 'fs'
 import { join } from 'path'
-import type { FoundAsset } from '../kit-config.ts'
+import type { FoundAsset, RollFormat } from '../kit-config.ts'
 import { generateComfyTs, loadCflowWorkflows, workflowFor, type ComfyTsRuntime, type OnProgress } from './comfyts-gen.ts'
 import { recordParents, type ParentContext } from './derived.ts'
 import { generateGemini } from './gemini-gen.ts'
@@ -16,11 +16,22 @@ export const CANVAS_SIZE = 1024
 
 export type ComfyResolver = () => Promise<ComfyTsRuntime>
 
+/** re-encode freshly written png rolls in the kit's roll format, before any
+ *  sidecar names them. `exact` keeps the colour under transparent pixels */
+async function encodeRolls(saved: string[], format: RollFormat | undefined): Promise<void> {
+    if (format !== 'webp-lossless') return
+    const { default: sharp } = await import('sharp')
+    for (const png of saved.filter((p) => p.endsWith('.png'))) {
+        await sharp(png).webp({ lossless: true, exact: true }).toFile(png.replace(/\.png$/, '.webp'))
+        unlinkSync(png)
+    }
+}
+
 /** Draw/generate one roll for `found` into destDir as v<seed>.png (canvas) or
  *  v<seed>.<ext> (comfy). `resolveComfy` is only awaited for comfy backends. */
 export async function generateRoll(
     found: FoundAsset,
-    args: { prompt: string; seed: number; destDir: string; onProgress?: OnProgress; context?: ParentContext },
+    args: { prompt: string; seed: number; destDir: string; onProgress?: OnProgress; context?: ParentContext; rollFormat?: RollFormat },
     resolveComfy: ComfyResolver,
 ): Promise<void> {
     const gen = found.kind.generate
@@ -31,7 +42,7 @@ export async function generateRoll(
         // resolves them (queue/CLI) so a blocker names the parent, loud
         if ((found.asset.from?.length ?? 0) > 0 && args.context == null)
             throw new Error(`'${found.asset.id}' derives from ${found.asset.from!.join(', ')} — parent context missing (are the parents picked?)`)
-        await generateGemini({}, { prompt: args.prompt, model: gen.model, destDir: args.destDir, name: `v${args.seed}`, context: args.context?.images ?? [] })
+        await encodeRolls(await generateGemini({}, { prompt: args.prompt, model: gen.model, destDir: args.destDir, name: `v${args.seed}`, context: args.context?.images ?? [] }), args.rollFormat)
         if (args.context != null) await recordParents(args.destDir, args.seed, args.context.parents)
         return
     }
@@ -40,12 +51,14 @@ export async function generateRoll(
         const c = createCanvas(CANVAS_SIZE, CANVAS_SIZE)
         await gen.draw(c.getContext('2d'), { ...found.asset, prompt: args.prompt })
         mkdirSync(args.destDir, { recursive: true })
-        await Bun.write(join(args.destDir, `v${args.seed}.png`), c.toBuffer('image/png'))
+        const png = join(args.destDir, `v${args.seed}.png`)
+        await Bun.write(png, c.toBuffer('image/png'))
+        await encodeRolls([png], args.rollFormat)
         return
     }
     const rt = await resolveComfy()
-    const lw = workflowFor(rt.workflows, { workflow: gen.workflow, assetId: found.asset.id })
-    await generateComfyTs(rt, lw, { prompt: args.prompt, seed: args.seed, assetId: found.asset.id, draftId: found.kind.id, destDir: args.destDir, name: `v${args.seed}`, vars: gen.vars, onProgress: args.onProgress })
+    const lw = workflowFor(rt.workflows, { workflow: gen.workflow, kind: found.kind.id, assetId: found.asset.id })
+    await encodeRolls(await generateComfyTs(rt, lw, { prompt: args.prompt, seed: args.seed, assetId: found.asset.id, draftId: found.kind.id, destDir: args.destDir, name: `v${args.seed}`, vars: gen.vars, onProgress: args.onProgress }), args.rollFormat)
 }
 
 /** Memoized lazy comfy runtime for a resolved kit — loads the cflow modules on

package/src/assets/kit-config.ts

@@ -127,14 +127,23 @@ export type KitConfig = {
     /** workflows = dir of comfy-ts .cflow.ts modules (each module owns its
      *  host); heal = shell command shown in error hints, never executed */
     comfy?: { workflows: string; heal?: string }
+    /** absent: an image roll lands in the format its backend produced (png
+     *  from comfy and canvas). 'webp-lossless' re-encodes every new image
+     *  roll as lossless webp, the same pixels at about 60% of the bytes */
+    rollFormat?: RollFormat
     kinds: Kind[]
 }
 
+export const ROLL_FORMATS = ['webp-lossless'] as const
+export type RollFormat = (typeof ROLL_FORMATS)[number]
+
 export type ResolvedKit = KitConfig & { workspace: string }
 
 export function validateKit(k: KitConfig): string[] {
     const errs: string[] = []
     if (!Array.isArray(k.kinds) || k.kinds.length === 0) errs.push('kinds must be a non-empty array')
+    if (k.rollFormat != null && !(ROLL_FORMATS as readonly string[]).includes(k.rollFormat))
+        errs.push(`unknown rollFormat '${String(k.rollFormat)}' (${ROLL_FORMATS.join(' | ')}, or absent for the backend's own format)`)
     for (const key of Object.keys(k.comfy ?? {}))
         if (key !== 'workflows' && key !== 'heal')
             errs.push(`comfy config has unknown key '${key}'${key === 'host' ? " — host is gone, the workflow's _host.ts owns the box (comfy-ts migration)" : ''}`)

package/src/assets/kits/identity-kit.ts

@@ -51,10 +51,16 @@ export function identityKinds(brand: Brand): Kind[] {
     ]
 }
 
+// named faces first: the generic sans-serif can resolve to a face with no
+// Latin-1 accents (macOS). Each family below carries them, and an absent one
+// is skipped (macOS, Windows, then the common Linux faces)
+const OG_FAMILIES = 'Helvetica, Arial, "DejaVu Sans", "Liberation Sans", "Noto Sans", sans-serif'
+export const ogFont = (px: number, bold = false): string => `${bold ? 'bold ' : ''}${px}px ${OG_FAMILIES}`
+
 // shrink px until text fits maxW (og cards must never clip the tagline)
 const fitFont = (ctx: SKRSContext2D, text: string, px: number, maxW: number, bold = false): void => {
     for (; px > 12; px -= 2) {
-        ctx.font = `${bold ? 'bold ' : ''}${px}px sans-serif`
+        ctx.font = ogFont(px, bold)
         if (ctx.measureText(text).width <= maxW) return
     }
 }

package/src/assets/run-assets.ts

@@ -50,7 +50,7 @@ async function rollOnce(root: string, io: AssetsIo, kit: ResolvedKit, resolveCom
     for (let i = 0; i < count; i++) {
         const seed = randomSeed()
         try {
-            await generateRoll(f!, { prompt, seed, destDir: dir, context }, resolveComfy)
+            await generateRoll(f!, { prompt, seed, destDir: dir, context, rollFormat: kit.rollFormat }, resolveComfy)
             io.print(`ok: ${assetId} v${seed}`)
         } catch (e) {
             failed++
@@ -196,7 +196,7 @@ export const runAssetsCheck = (root: string, io: AssetsIo): Promise<number> =>
                     const gen = kind.generate
                     if (gen.backend !== 'comfy') continue
                     try {
-                        const lw = workflowFor(wfs, { workflow: gen.workflow, assetId: kind.assets[0]?.id })
+                        const lw = workflowFor(wfs, { workflow: gen.workflow, kind: kind.id, assetId: kind.assets[0]?.id })
                         if (gen.vars != null) {
                             for (const [, d] of lw.wf.entries()) d.reset()
                             applyVarValues(lw.wf, gen.vars, `kind '${kind.id}'`)
@@ -215,7 +215,7 @@ export const runAssetsCheck = (root: string, io: AssetsIo): Promise<number> =>
                 for (const f of allAssets(kit).filter((x) => x.kind.generate.backend === 'comfy')) {
                     let lw: LoadedWorkflow
                     try {
-                        lw = workflowFor(wfs, { workflow: (f.kind.generate as ComfyGen).workflow, assetId: f.asset.id })
+                        lw = workflowFor(wfs, { workflow: (f.kind.generate as ComfyGen).workflow, kind: f.kind.id, assetId: f.asset.id })
                     } catch {
                         continue // an unresolvable workflow already FAILed on its kind above
                     }

package/src/assets/server/studio-server.ts

@@ -110,7 +110,7 @@ export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
         for (const f of allAssets(kit).filter((x) => x.kind.generate.backend === 'comfy')) {
             try {
                 const gen = f.kind.generate as { workflow?: string }
-                const lw = workflowFor(workflows, { workflow: gen.workflow, assetId: f.asset.id })
+                const lw = workflowFor(workflows, { workflow: gen.workflow, kind: f.kind.id, assetId: f.asset.id })
                 // the KIND's draft, shared by every asset of that kind
                 if (ensureAssetDraft(lw, f.kind.id, await promptOf(f))) console.log(`ok: draft '${f.kind.id}' seeded → .comfy-ts/drafts/${lw.id}/${f.kind.id}.json`)
             } catch (e) {
@@ -127,7 +127,7 @@ export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
         return { workflows, heal: kit.comfy.heal }
     }
     const generateOne = deps.generateOne ?? ((found, prompt, seed, destDir, onProgress, context?: ParentContext) =>
-        generateRoll(found, { prompt, seed, destDir, onProgress, context }, resolveComfy))
+        generateRoll(found, { prompt, seed, destDir, onProgress, context, rollFormat: kit.rollFormat }, resolveComfy))
 
     const queue = new StudioQueue(async (job, seed, onProgress) => {
         const found = findAsset(kit, job.assetId)
@@ -388,7 +388,7 @@ export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
             const rgen = running?.kind.generate
             if (workflows != null && rgen?.backend === 'comfy') {
                 try {
-                    await workflowFor(workflows, { workflow: rgen.workflow, assetId: running!.asset.id }).wf.host.interrupt()
+                    await workflowFor(workflows, { workflow: rgen.workflow, kind: running!.kind.id, assetId: running!.asset.id }).wf.host.interrupt()
                 } catch (e) {
                     queue.pushError(`interrupt: ${(e as Error).message} — current roll will finish, its job is still dropped`)
                 }

package/src/check.ts

@@ -45,7 +45,7 @@ export type CheckDef = {
      *  Default: the id. */
     title?: string
     /** what MUST BE TRUE, in the present tense: ONE line, at most 90
-     *  characters, as in `package.json routes lint, typecheck and test
+     *  characters, as in `package.json routes typecheck and test
      *  through the gate`. Never what red means, red is its negation. It
      *  renders at the top of the check page and as the tree row's tooltip.
      *  A title names the check, this states the invariant it holds. */
@@ -119,7 +119,7 @@ export type CheckDef = {
     /** what a healthy run takes, in ms, distinct from the ceiling: a run that
      *  passes over it prints a WARN and reads yellow, and never blocks.
      *  Judged on the wall time of a run that measured, at the quick tier.
-     *  Default 2000 for an in process body, 10000 for a build step, a `cmd`
+     *  Default 1000 for an in process body, 5000 for a build step, a `cmd`
      *  or a world probe (cache `ttl`, `fact` or `never`, core/budget.ts).
      *  The repo's `budgets` wins over it. */
     budgetMs?: number
@@ -329,6 +329,7 @@ export async function runCheckBody(
         c.lines = tagCheckLines(u, c.lines)
         return
     }
+    c.checkId = u.id
     try {
         await u.run?.(c)
     } catch (e) {
@@ -340,6 +341,8 @@ export async function runCheckBody(
     // and it must not enter the body's read set
     if ((c.failed || c.warned) && !c.lines.some((l) => l.kind === 'fix-fail' || l.kind === 'fix-warn'))
         c.lines.push({ kind: c.failed ? 'fix-fail' : 'fix-warn', text: c.ownerPointer(u.owner) })
+    // after the pointer, so it binds to the body's own lines
+    c.settleWaivers()
     c.lines = tagCheckLines(u, c.lines)
 }
 

package/src/checks/SK001-package-json-shape.check.ts

@@ -6,7 +6,7 @@
 // whatever the floor resolution read.
 //
 // It also enforces the package.json half of ONE WAY IN (build/shipkit/one-way-in.md):
-// `test`, `lint` and `typecheck` ROUTE to `shipkit ci --only <id>` and the
+// `test` and `typecheck` ROUTE to `shipkit ci --only <id>` and the
 // tool body they used to hold sits at `<id>:raw`. That is what makes a cache
 // worth having: `bun run test` is the reflex, and the reflex has to land in
 // shipkit rather than beside it.
@@ -14,10 +14,13 @@ import { canonicalBodies, conditionalBodies, inferBin, ROUTED_SCRIPTS, rawName,
 import type { CheckCtx } from '../core/check-ctx.ts'
 import { checkFloorReader, resolveFloor } from '../core/floor-resolve.ts'
 import { rootPublishesNpm } from '../core/repo-facts.ts'
+import { bunfigDeclares } from '../core/bun-builtins.ts'
+import { repoOff } from '../core/when.ts'
 import type { RepoConfig } from '../repo-config.ts'
 import { check, type FixResult } from '../check.ts'
 
-type Pkg = { name?: string; private?: boolean; license?: string; scripts?: Record<string, string> }
+type Deps = Record<string, string>
+type Pkg = { name?: string; private?: boolean; license?: string; scripts?: Record<string, string>; dependencies?: Deps; devDependencies?: Deps; optionalDependencies?: Deps }
 
 const OWNER = 'meta/rv-conventions/package-json.md'
 
@@ -26,11 +29,18 @@ const OWNER = 'meta/rv-conventions/package-json.md'
 // folder must not be told to rename)
 const ALIASES: Record<string, { canonical: string; bodyMatch: RegExp }> = {
     'serve': { canonical: 'hub', bodyMatch: /(?:^|\s)(?:shipkit|\S*shipkit\S*\/cli\.ts) serve\b/ },
-    'pretty': { canonical: 'fmt', bodyMatch: /./ },
     'check-types': { canonical: 'typecheck', bodyMatch: /./ },
 }
 
-const BASELINE = ['test', 'lint', 'fmt'] as const
+const BASELINE = ['test', 'lint'] as const
+
+// tools bun's built-ins replaced. Never repaired here: a linter swap changes
+// which rules gate the repo, and dropping a dependency moves bun.lock, which
+// only an install rewrites
+const RETIRED: Array<{ tool: string; deps: string[]; config: string; how: string }> = [
+    { tool: 'oxlint', deps: ['oxlint', 'oxlint-tsgolint'], config: '.oxlintrc.json', how: 'port its rules into [lint] in bunfig.toml (`bun lint` is the house linter), then' },
+    { tool: 'oxfmt', deps: ['oxfmt'], config: '.oxfmtrc.json', how: 'nothing formats in the gate (`bun fmt` styled by [fmt] is manual), so' },
+]
 
 // no per-line fix pointers here — the rule framework appends ONE pointer
 // (docsBase + OWNER) to a failing/warning run, the same one-per-severity
@@ -94,7 +104,7 @@ export function evaluatePackageJson(t: CheckCtx): void {
     // route to, so it is not governed.
     const floor = resolveFloor(c, t.root, checkFloorReader(t))
     for (const id of ROUTED_SCRIPTS) {
-        if (routedExempt(c).has(id) || c.defaults?.[id] === false) continue
+        if (routedExempt(c).has(id) || repoOff(c, id) != null) continue
         const body = scripts[id]
         if (body == null) continue
         if (!routesToShipkit(body)) {
@@ -108,13 +118,38 @@ export function evaluatePackageJson(t: CheckCtx): void {
     // `test` is asked for only once the repo HAS tests: the fixer deliberately
     // refuses to scaffold it before that (a fixer never manufactures a
     // failure), so nagging for it would be a WARN no machine may clear. For
-    // the same reason `lint` and `fmt` wait for a source file to read
+    // the same reason `lint` waits for a source file to read. It is met by
+    // bun's built-in once bunfig.toml declares [lint]
     const tests = hasTestFiles(testFiles(t))
     const source = tests || hasSourceFiles(t)
-    const baseline = BASELINE.filter((n) => (n === 'test' ? tests : source))
-    const missingBaseline = baseline.filter((n) => !has(n))
+    const bunfig = t.read('bunfig.toml')
+    // a lint slot turned off has no built-in to declare
+    const baseline = BASELINE.filter((n) => (n === 'test' ? tests : source) && !(n === 'lint' && repoOff(c, 'lint') != null))
+    const missingBaseline = baseline.filter((n) => !has(n) && !(n !== 'test' && bunfigDeclares(bunfig, n)))
+    // a script named like the built-in runs in its place whenever someone
+    // types `bun lint` or `bun fmt`, so a declared section makes it dead weight
+    for (const n of ['lint', 'fmt'] as const)
+        if (scripts[n] != null && bunfigDeclares(bunfig, n))
+            t.warn(`package.json: script '${n}' shadows \`bun ${n}\`, which bunfig.toml turns on with [${n}] — delete it${scripts[rawName(n)] != null ? ` and '${rawName(n)}'` : ''}`)
     if (missingBaseline.length > 0)
-        t.warn(`package.json: missing baseline script(s): ${missingBaseline.join(', ')}`)
+        t.warn(`package.json: missing baseline: ${missingBaseline.map((n) => (n === 'test' ? `script 'test'` : `[${n}] in bunfig.toml (or a '${n}' script)`)).join(', ')}`)
+    for (const r of RETIRED) {
+        // the tool as a command word: `bunx oxlint@latest`, `"oxlint;"`, never `.oxlintrc` or `oxlint-smoke.ts`
+        const word = new RegExp(`(^|[^\\w.-])${r.tool}(?![\\w-])`)
+        const sole = new RegExp(`^\\s*(?:(?:bunx|npx|bun\\s+x)\\s+)?(?:\\S*/)?${r.tool}(?:@\\S+)?(?:\\s+[^;&|]*)?$`)
+        const deps = r.deps.filter((d) => [pkg.dependencies, pkg.devDependencies, pkg.optionalDependencies].some((m) => m?.[d] != null))
+        const using = Object.entries(scripts).filter(([, body]) => word.test(body))
+        const whole = using.filter(([, body]) => sole.test(body)).map(([name]) => `'${name}'`)
+        const steps = using.filter(([, body]) => !sole.test(body)).map(([name]) => `'${name}'`)
+        const del = [
+            ...deps.map((d) => `the ${d} dependency`),
+            ...(whole.length > 0 ? [`script ${whole.join(', ')}`] : []),
+            ...(t.exists(r.config) ? [r.config] : []),
+        ]
+        if (deps.length === 0 && using.length === 0) continue
+        const parts = [...(del.length > 0 ? [`delete ${del.join(', ')}`] : []), ...(steps.length > 0 ? [`take the ${r.tool} step out of script ${steps.join(', ')}, which does more`] : [])]
+        t.warn(`package.json: ${r.tool} is retired: ${r.how} ${parts.join(', and ')}`)
+    }
 
     if (!t.failed && !t.warned)
         t.ok(`package.json shape ok (private, no license, ${required.length} required script(s) present)`)
@@ -182,7 +217,7 @@ const SOURCE_GLOB = '**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'
 const EMPTY_MODULE = /^(?:\s|;|export\s*\{\s*\})*$/
 
 /** a code file with something in it, outside installs, build output, dot dirs
- *  and the repo config: what lint and fmt would read. Stops at the first */
+ *  and the repo config: what lint would read. Stops at the first */
 function hasSourceFiles(c: CheckCtx): boolean {
     for (const f of c.list(SOURCE_GLOB)) {
         const parts = f.split('/')
@@ -196,7 +231,7 @@ export const packageJsonShape = check({
     id: 'SK001',
     blocking: true,
     title: 'package.json',
-    description: 'package.json routes lint, typecheck and test through the gate',
+    description: 'package.json routes typecheck and test through the gate',
     owner: OWNER,
     runs: { onPreCommit: false, onCi: true, onFull: true, onRelease: true, onHealth: true, onSave: 'moved', onClock: false },
     cache: { by: 'reads' },
@@ -252,7 +287,7 @@ export const packageJsonShape = check({
         // call. Both keys keep their place in the file, so the diff a human
         // reads is the two lines that changed and not a reordered block
         for (const id of ROUTED_SCRIPTS) {
-            if (routedExempt(c.config).has(id) || c.config.defaults?.[id] === false) continue
+            if (routedExempt(c.config).has(id) || repoOff(c.config, id) != null) continue
             const body = pkg.scripts[id]
             if (body == null || routesToShipkit(body)) continue
             const raw = rawName(id)

package/src/checks/SK013-one-way-in-policy.check.ts

@@ -14,9 +14,10 @@
 // scaffold, so a policy written there would bind exactly one checkout.
 import { isAbsolute, join } from 'path'
 import { inferBin } from '../core/canonical-scripts.ts'
-import { denyRules, RAW_RUNNERS } from '../core/one-way-in-policy.ts'
+import { denyRules, GIT_STASH_RULE, RAW_RUNNERS } from '../core/one-way-in-policy.ts'
 import { rootPublishesNpm } from '../core/repo-facts.ts'
 import type { RepoConfig } from '../repo-config.ts'
+import { repoOff } from '../core/when.ts'
 import { check, type CheckCtx, type FixResult } from '../check.ts'
 
 const OWNER = 'build/shipkit/one-way-in.md'
@@ -31,7 +32,7 @@ type Settings = {
  *  either: ONE declaration governs the script name and the raw call together */
 export function exemptSlots(c: RepoConfig): Set<string> {
     const off = new Set(c.oneWayIn?.exempt ?? [])
-    for (const [slot, def] of Object.entries(c.defaults ?? {})) if (def === false) off.add(slot)
+    for (const id of [...Object.keys(c.defaults ?? {}), ...Object.keys(c.off ?? {}), ...Object.keys(c.when ?? {})]) if (repoOff(c, id) != null) off.add(id)
     return off
 }
 
@@ -132,14 +133,15 @@ export const oneWayInPolicy = check({
         if (rootPublishesNpm(c.config)) return c.ok(PUBLIC_SKIP)
         const d = c
         const want = denyRules(exemptSlots(c.config))
-        if (want.length === 0) return c.ok('every governed slot is exempt (repo.config oneWayIn/defaults) — nothing to deny')
         const s = readSettings(d)
         if (s == null) {
             c.fail(`${SETTINGS_PATH} ${d.exists(SETTINGS_PATH) ? 'is unparseable' : 'missing'} — nothing stops an agent typing \`bun test\`, and a package.json script cannot intercept a bun builtin`)
             return
         }
         const have = new Set(s.permissions?.deny ?? [])
-        const missing = want.filter((r) => !have.has(r))
+        const missing = want.filter((r) => !have.has(r) && r !== GIT_STASH_RULE)
+        if (!have.has(GIT_STASH_RULE))
+            c.fail(`${SETTINGS_PATH}: no "${GIT_STASH_RULE}" deny row, so an agent can stash every other agent's uncommitted work in a shared tree`)
         if (missing.length > 0)
             c.fail(`${SETTINGS_PATH}: ${missing.length} raw runner(s) still permitted (${missing.slice(0, 3).join(', ')}${missing.length > 3 ? ', …' : ''}) — those calls never reach shipkit, so nothing is cached and no run can be attached to`)
         const guard = guardHookCommand(s)
@@ -170,7 +172,7 @@ export const oneWayInPolicy = check({
         // replacement is named while the guard cannot run is the green that
         // measured nothing, one line under the WARN that says otherwise
         if (!c.failed)
-            c.ok(`${SETTINGS_PATH} closes ${want.length}/${RAW_RUNNERS.length} raw runner(s)${guardRuns ? ', with the replacement named' : ' (the guard that names the replacement is declared, not yet runnable)'}`)
+            c.ok(`${SETTINGS_PATH} closes ${want.length - 1}/${RAW_RUNNERS.length} raw runner(s) and refuses git stash${guardRuns ? ', with the replacement named' : ' (the guard that names the replacement is declared, not yet runnable)'}`)
     },
     // MERGES, never rewrites: this file also carries the attribution silencer,
     // a repo's own allow list and its own hooks, and clobbering those to fix a
@@ -179,7 +181,6 @@ export const oneWayInPolicy = check({
         if (rootPublishesNpm(c.config)) return { changed: false, summary: PUBLIC_SKIP }
         const d = c
         const want = denyRules(exemptSlots(c.config))
-        if (want.length === 0) return { changed: false, summary: 'every governed slot is exempt — nothing to write' }
         const existing = readSettings(d)
         if (existing == null && c.exists(SETTINGS_PATH)) return { changed: false, summary: `${SETTINGS_PATH} is unparseable — repair it by hand first, a merge would destroy it` }
         const s: Settings = existing ?? {}
@@ -188,7 +189,7 @@ export const oneWayInPolicy = check({
         const added = want.filter((r) => !deny.includes(r))
         if (added.length > 0) {
             s.permissions = { ...s.permissions, deny: [...deny, ...added] }
-            changes.push(`${added.length} raw runner(s) denied`)
+            changes.push(`${added.length} deny rule(s) added`)
         }
         const wantGuard = await guardCommandFor(d)
         if (!hasGuardHook(s)) {