rvlib-shipkit 1.8.0 → 2.0.0

package/src/core/discover-checks.ts

@@ -16,7 +16,7 @@
 // are told apart by reading the source first (`isLegacyCheckSource`).
 //
 // Skipped dirs: node_modules, dist, tmp, references (templates for other
-// repos), and every dot-dir.
+// repos), every dot-dir, and the repo's vendored dirs (core/vendored.ts).
 import { RETIRED_CHECK_IDS } from './retired-checks.ts'
 import { readdirSync, readFileSync, realpathSync, statSync } from 'fs'
 import { basename, join, relative } from 'path'
@@ -24,6 +24,7 @@ import { check, type CheckDef, type CheckFrom } from '../check.ts'
 
 import { CHECK_SUFFIX as SUFFIX, fallbackNames, isLegacyCheckSource, SKIPPED_DIRS as IGNORED_DIRS, UNIT_SUFFIX, unitBase } from './check-file-names.ts'
 import { unitKind } from '../shipkit-files.ts'
+import { readVendored } from './vendored-read.ts'
 
 export { fallbackNames, isLegacyCheckSource } from './check-file-names.ts'
 
@@ -56,23 +57,27 @@ export type DiscoveredCheck = {
     from: CheckFrom
 }
 
-function walk(dir: string, out: string[], suffix = SUFFIX, dirs?: string[]): void {
+function walk(dir: string, out: string[], suffix = SUFFIX, dirs?: string[], prune?: ReadonlySet<string>): void {
     dirs?.push(dir)
     let entries
     try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
     for (const e of entries) {
         if (e.isDirectory()) {
-            if (!IGNORED_DIRS.has(e.name) && !e.name.startsWith('.')) walk(join(dir, e.name), out, suffix, dirs)
+            const sub = join(dir, e.name)
+            if (!IGNORED_DIRS.has(e.name) && !e.name.startsWith('.') && prune?.has(sub) !== true) walk(sub, out, suffix, dirs, prune)
         } else if (e.name.endsWith(suffix)) out.push(join(dir, e.name))
     }
 }
 
+/** the absolute vendored dirs of a repo, which no repo walk enters */
+const vendoredPrune = (root: string): ReadonlySet<string> => new Set(readVendored(root).map((d) => join(root, d)))
+
 /** every `*.shipkit.ts` file under a repo root, by the same walk. Sorted.
  *  `dirs` collects every dir the walk read: a file added to one moves its
  *  mtime, which is how a reader tells the list moved without walking again */
 export function repoUnitFiles(root: string, dirs?: string[]): string[] {
     const out: string[] = []
-    walk(root, out, UNIT_SUFFIX, dirs)
+    walk(root, out, UNIT_SUFFIX, dirs, vendoredPrune(root))
     return out.sort()
 }
 
@@ -97,7 +102,7 @@ export async function importFresh(path: string): Promise<unknown> {
  *  Sorted. */
 export function repoCheckFiles(root: string): string[] {
     const out: string[] = []
-    walk(root, out)
+    walk(root, out, SUFFIX, undefined, vendoredPrune(root))
     return out.sort()
 }
 
@@ -158,50 +163,94 @@ function unloadable(path: string, message: string): CheckDef {
     }
 }
 
+/** a built-in that does not load, as a repo that only CONSUMES the toolkit
+ *  sees it: one warning, never a red gate, since only the toolkit's own repo
+ *  can fix the file, and its gate stays red on it */
+function brokenBuiltin(path: string, message: string): CheckDef {
+    return {
+        ...unloadable(path, message),
+        blocking: false,
+        run: (c) => c.warn(`${basename(path)} does not load, so this gate skips it: ${message.replace(`${path}: `, '')}`, 'the toolkit repo owns the file, and its own gate fails on it'),
+    }
+}
+
+const BUILTIN_OWNER = 'build/shipkit/built-in-checks.md'
+
 /** every check this repo can run: its own files, plus the toolkit's. Throws
  *  on a registration nobody can act on (a duplicate id, a repo check squatting
  *  the reserved prefix, a built-in with no owner page), so a broken
- *  declaration dies at load rather than half way through a gate. */
-export async function discoverChecks(root: string): Promise<DiscoveredCheck[]> {
+ *  declaration dies at load rather than half way through a gate. A broken
+ *  built-in is that only in the toolkit's own repo: elsewhere it warns. */
+export type DiscoverOpts = {
+    /** a file not to import at all: the pre-commit gate skips the files its
+     *  declarations table already knows run no onPreCommit body */
+    skip?: (path: string) => boolean
+    /** every import, timed: `def` is null for a unit file of another kind,
+     *  and `loaded` is false for a file that did not load */
+    imported?: (path: string, ms: number, def: CheckDef | null, loaded: boolean) => void
+    /** the toolkit's checks dir, a parameter for tests only */
+    builtinDir?: string
+}
+
+export async function discoverChecks(root: string, o: DiscoverOpts = {}): Promise<DiscoveredCheck[]> {
+    const builtinDir = o.builtinDir ?? BUILTIN_CHECK_DIR
     const builtins: string[] = []
-    walk(BUILTIN_CHECK_DIR, builtins)
+    walk(builtinDir, builtins)
     const found: string[] = []
-    walk(root, found)
+    walk(root, found, SUFFIX, undefined, vendoredPrune(root))
     const units = repoUnitFiles(root)
     // the repo that HOSTS the toolkit walks over `src/checks/` too, and a file
     // discovered twice is a duplicate id rather than a second check. Real paths,
     // because a consumer reaches the same files through a linked node_modules
     const real = (f: string): string => { try { return realpathSync(f) } catch { return f } }
     const shipped = new Set(builtins.map(real))
+    // its own source, never an install of it
+    const inRoot = relative(real(root), real(builtinDir))
+    const hostsToolkit = !inRoot.startsWith('..') && !inRoot.split(/[\\/]/).includes('node_modules')
     const all = found.filter((f) => !shipped.has(real(f))).sort()
     builtins.sort()
     const names = fallbackNames(root, all)
     // a legacy script is left to its own reader, and never imported here
-    const own = all.filter((f) => !isLegacyCheckFile(f))
+    const own = all.filter((f) => o.skip?.(f) === true || !isLegacyCheckFile(f))
     const base = (f: string): string => basename(f).slice(0, -SUFFIX.length)
 
     const out: DiscoveredCheck[] = []
     const ids = new Set<string>()
     for (const f of [...builtins, ...own, ...units]) {
         const isBuiltin = builtins.includes(f)
+        if (o.skip?.(f) === true) continue
         let def: CheckDef | null
+        let loadError: string | null = null
+        const t = performance.now()
         try {
             def = await load(f)
+            o.imported?.(f, performance.now() - t, def, true)
         } catch (e) {
+            o.imported?.(f, performance.now() - t, null, false)
             // a file that does not load is ONE red row, never a dead inventory:
             // every other check still runs, and this one says why in every run
-            def = unloadable(f, (e as Error).message)
+            loadError = (e as Error).message
+            def = unloadable(f, loadError)
         }
         if (def == null) continue
         const rel = isBuiltin ? null : relative(root, f).replace(/\\/g, '/')
         const fallback = isBuiltin
             ? (BUILTIN_ID_RE.exec(base(f))?.[1] ?? base(f))
             : f.endsWith(UNIT_SUFFIX) ? unitBase(f) : names.get(f)!
-        const id = def.id ?? fallback
+        let id = def.id ?? fallback
         if (isBuiltin) {
-            if (id !== fallback) throw new Error(`${f}: declares id '${id}' but its file name says '${fallback}' — a built-in id is its file name`)
-            if ((def.owner ?? '') === '') throw new Error(`${f}: a built-in check names the page that OWNS the invariant`)
-            if (RETIRED_CHECK_IDS[id] != null) throw new Error(`${f}: id '${id}' is retired (${RETIRED_CHECK_IDS[id]}), and an id is never reused`)
+            const refused = loadError != null ? null
+                : id !== fallback ? `${f}: declares id '${id}' but its file name says '${fallback}' — a built-in id is its file name`
+                : (def.owner ?? '') === '' ? `${f}: a built-in check names the page that OWNS the invariant`
+                : RETIRED_CHECK_IDS[id] != null ? `${f}: id '${id}' is retired (${RETIRED_CHECK_IDS[id]}), and an id is never reused`
+                : null
+            // the toolkit's own repo dies on a refused built-in, a consumer
+            // only warns: it cannot fix the file, and must not lose its gate
+            if (refused != null && hostsToolkit) throw new Error(refused)
+            if (refused != null || loadError != null) {
+                def = hostsToolkit ? { ...def, owner: BUILTIN_OWNER } : { ...brokenBuiltin(f, refused ?? loadError!), owner: BUILTIN_OWNER }
+                id = fallback
+            }
         } else if (id.startsWith('SK')) {
             throw new Error(`${rel}: id '${id}' uses the reserved SK prefix — a repo check picks its own (e.g. RV${id.slice(-3)}) or plain words`)
         }

package/src/core/fix-scope.ts

@@ -0,0 +1,5 @@
+// does a gate run its repair pass (core/run-fixers.ts). A leaf, so the hub's
+// run lanes read the same answer the gate acts on without loading the gate.
+
+/** `fix` named wins. Unnamed: a whole gate repairs, a narrowed run does not */
+export const fixPassRuns = (o: { fix?: boolean; onlyIds?: readonly string[] }): boolean => o.fix ?? (o.onlyIds ?? []).length === 0

package/src/core/floor-resolve.ts

@@ -20,10 +20,14 @@ import type { CheckCtx } from './check-ctx.ts'
 import { checkUnitReader, type UnitReader } from '../release/unit-resolve.ts'
 import { parseJsonc } from '../ts/jsonc.ts'
 import { resolveTypecheckProjects } from '../ts/tsconfig-resolve.ts'
+import { gateBuildInfoArgs } from '../ts/typecheck-cache.ts'
 import { parseBunTestScript, suiteFlags } from '../suite/judge-suites.ts'
 import { declaredTestUnits, siblingUnits, testCheckId, unitIgnores, unitTestBody, unitTsconfig, type TestUnitDecl } from '../suite/test-units.ts'
 import { describeFirst, type TaskDef } from '../check.ts'
 import type { RepoConfig } from '../repo-config.ts'
+import { repoOff } from './when.ts'
+import { bunfigDeclares, bunLintCmd } from './bun-builtins.ts'
+import { normalizeVendored } from './vendored.ts'
 
 /** how the floor reads the repo, by repo-relative path, plus the one lookup
  *  outside it: a binary on PATH */
@@ -64,10 +68,10 @@ export const unitTestDescription = (u: { id: string; rel: string }): string =>
 export const unitTypecheckDescription = (u: { id: string; rel: string }): string =>
     describeFirst(`tsc finds no type error under ${u.rel}`, `tsc finds no type error in unit ${u.id}`)
 
-export type FloorSource = 'package.json script' | 'repo.config override' | 'built-in (shipkit)' | 'built-in (tsc)' | 'unit'
+export type FloorSource = 'package.json script' | 'repo.config override' | 'built-in (shipkit)' | 'built-in (tsc)' | 'built-in (bun)' | 'unit'
 export type FloorResolution = {
     tasks: TaskDef[]
-    /** slots disabled by `defaults: { x: false }` — always printed */
+    /** slots the repo turned off (core/when.ts repoOff), always printed */
     disabled: string[]
     /** slots nothing could fill — always printed, never silent */
     unfilled: { id: string; reason: string }[]
@@ -160,9 +164,14 @@ function tsconfigChain(rel: string, io: FloorReader): string[] {
 }
 
 // zero-config floor (O6): with no script, imports:check/cycles resolve to
-// shipkit's own rvlib-ts-tools dep, typecheck to the repo's tsc. Returns
-// the task, or the reason the slot stays empty.
-function builtinFloorTask(id: string, root: string, io: FloorReader): { task: TaskDef; source: FloorSource } | string {
+// shipkit's own rvlib-ts-tools dep, typecheck to the repo's tsc, lint to
+// `bun lint` once bunfig.toml declares [lint]. Returns the task, or the
+// reason the slot stays empty.
+function builtinFloorTask(id: string, root: string, io: FloorReader, vendored: readonly string[]): { task: TaskDef; source: FloorSource } | string {
+    if (id === 'lint') {
+        if (!bunfigDeclares(io.text('bunfig.toml'), 'lint')) return `no 'lint' script and no [lint] section in bunfig.toml`
+        return { task: { id, cmd: bunLintCmd(vendored) }, source: 'built-in (bun)' }
+    }
     if (id === 'imports:check' || id === 'cycles') {
         let cli: string
         // shipkit's OWN module, resolved from this file: no dependency to be
@@ -194,7 +203,7 @@ function builtinFloorTask(id: string, root: string, io: FloorReader): { task: Ta
             const projects = resolveTypecheckProjects(tsconfig, io, root)
             plain = projects.projects.length === 1 && projects.projects[0] === tsconfig && projects.missing.length === 0
         } catch { plain = false }
-        if (plain) return { task: { id, cmd: [tsc, '--noEmit'] }, source: 'built-in (tsc)' }
+        if (plain) return { task: { id, cmd: [tsc, '--noEmit', ...gateBuildInfoArgs(tsconfig)] }, source: 'built-in (tsc)' }
         const cli = fileURLToPath(import.meta.resolve('rvlib-shipkit/src/ts/typecheck-cli.ts'))
         return { task: { id, cmd: ['bun', cli, tsc, tsconfig] }, source: 'built-in (tsc)' }
     }
@@ -233,7 +242,8 @@ export function resolveFloor(c: RepoConfig, root: string, io: FloorReader): Floo
     const notes: string[] = []
     const subs = declaredTestUnits(c.units)
     for (const id of FLOOR_IDS) {
-        const override = c.defaults?.[id]
+        // a slot the repo turned off resolves to no task, whichever spelling said so
+        const override = repoOff(c, id) != null ? false : c.defaults?.[id]
         const description = slotDescription(id, subs.length > 0)
         const slot = slotBody(id, override, scripts)
         if (slot.kind === 'off') { disabled.push(id); continue }
@@ -249,7 +259,7 @@ export function resolveFloor(c: RepoConfig, root: string, io: FloorReader): Floo
             return override == null || override === false ? t : { ...t, ...override, id }
         }
         if (slot.kind === 'script') { tasks.push(decorate({ id, cmd: scriptCmd(c, id, slot.name, slot.body, notes, subs) })); sources[id] = 'package.json script'; continue }
-        const b = builtinFloorTask(id, root, io)
+        const b = builtinFloorTask(id, root, io, (c.vendored ?? []).map(normalizeVendored))
         // a routed script with nothing behind it measures NOTHING, and the
         // reason must say that rather than `no '<id>' script`, which is false
         if (typeof b === 'string') unfilled.push({ id, reason: slot.kind === 'routed-empty' ? `script '${id}' routes to shipkit and there is no '${rawName(id)}' body to run` : b })

package/src/core/git-root.ts

@@ -58,14 +58,23 @@ export function probeGitRoot(at: string): Probe {
     return p
 }
 
-/** the variables that let git find a repo with no `.git` in reach */
+/** the variables that let git find a repo with no `.git` in reach. They name
+ *  ONE repo for the whole process (git sets GIT_DIR for every hook in a linked
+ *  worktree), so they only answer for a directory with no `.git` of its own:
+ *  any other directory is asked with them stripped, or the hook's repo would
+ *  claim the house and every repo the process looks at */
 const LOCATING_ENV = ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR']
+const locatingEnvSet = (): boolean => LOCATING_ENV.some((k) => (process.env[k] ?? '') !== '')
+const discoveryEnv = (): Record<string, string | undefined> => {
+    const env = { ...process.env }
+    for (const k of LOCATING_ENV) delete env[k]
+    return env
+}
 
-/** git's discovery walks up looking for `.git`. With none at or above and no
- *  variable pointing elsewhere, its answer is already known, and a gate or a
- *  test suite that probes fresh temp dirs would spawn a process per dir for it */
+/** git's discovery walks up looking for `.git`. With none at or above, its
+ *  answer is already known, and a gate or a test suite that probes fresh temp
+ *  dirs would spawn a process per dir for it */
 function nothingInReach(dir: string): boolean {
-    if (LOCATING_ENV.some((k) => (process.env[k] ?? '') !== '')) return false
     let cur: string
     try {
         cur = realpathSync(dir)
@@ -81,12 +90,11 @@ function nothingInReach(dir: string): boolean {
 }
 
 /** the common case answered from the disk: `.git` is a plain directory right
- *  at `dir`, which git describes as exactly that. Anything unusual (a locating
- *  variable, a gitfile or a symlinked `.git`, a shared common dir, a config
- *  that relocates the work tree, marks it bare or includes another file, a
- *  `.git` owned by someone else) is left to git */
+ *  at `dir`, which git describes as exactly that. Anything unusual (a gitfile
+ *  or a symlinked `.git`, a shared common dir, a config that relocates the
+ *  work tree, marks it bare or includes another file, a `.git` owned by
+ *  someone else) is left to git */
 function plainRoot(dir: string): GitRoot | null {
-    if (LOCATING_ENV.some((k) => (process.env[k] ?? '') !== '')) return null
     try {
         const top = realpathSync(dir)
         const gitDir = join(top, '.git')
@@ -102,8 +110,9 @@ function plainRoot(dir: string): GitRoot | null {
 }
 
 function ask(dir: string): Probe {
-    if (nothingInReach(dir)) return { root: null, error: 'fatal: not a git repository (or any of the parent directories): .git' }
-    const plain = plainRoot(dir)
+    const none = nothingInReach(dir)
+    if (none && !locatingEnvSet()) return { root: null, error: 'fatal: not a git repository (or any of the parent directories): .git' }
+    const plain = none ? null : plainRoot(dir)
     if (plain != null) return { root: plain, error: '' }
     let p: ReturnType<typeof Bun.spawnSync>
     try {
@@ -111,6 +120,7 @@ function ask(dir: string): Probe {
             cwd: dir,
             stdout: 'pipe',
             stderr: 'pipe',
+            env: none ? { ...process.env } : discoveryEnv(),
         })
     } catch (e) {
         return { root: null, error: e instanceof Error ? e.message : String(e) }

package/src/core/job-run.ts

@@ -4,14 +4,14 @@
 // the machine's one background turn here, so the turn outlives a daemon
 // reload the same as the run does.
 import { basename } from 'path'
-import { useOneLib } from './one-lib.ts'
+import { installOneLib } from './one-lib.ts'
 import { appendJobCheck, type JobKind, type JobOpts } from './jobs.ts'
 import { autoGatePool, takeSlot } from './slots.ts'
 import type { CheckEvent } from './check-runner.ts'
 
 export async function runJob(root: string, id: string, kind: JobKind, job: JobOpts, print: (l: string) => void): Promise<number> {
     // before the repo config loads: it imports this copy of the lib, never its own install
-    if (job.oneLib === true) useOneLib()
+    if (job.oneLib === true) installOneLib()
     const turn = job.turn === true ? await takeSlot(autoGatePool(), { repo: basename(root), check: 'auto gate' }, { pollMs: 250 }) : null
     try {
         const onCheck = (e: CheckEvent): void => appendJobCheck(root, id, e)

package/src/core/layout.ts

@@ -19,6 +19,9 @@ export const LAYOUT = {
     identity: sk('identity'),
     assets: sk('assets'),
     comfy: sk('comfy'),
+    // a bug's repro test once its fix lands: kept for the record, never run
+    // (bun test skips dot dirs), moved into the suite only when it earns its wait
+    repros: sk('repros'),
     // local: drafts, private notes, venue listings until they go live
     private: sk('private'),
     reflections: sk('reflections'),
@@ -41,7 +44,7 @@ export const LAYOUT = {
 } as const
 
 /** the children the SK004 block re-includes: everything else under `.shipkit/` stays local */
-export const TRACKED_DIRS = [LAYOUT.asks, LAYOUT.hooks, LAYOUT.identity, LAYOUT.assets, LAYOUT.comfy] as const
+export const TRACKED_DIRS = [LAYOUT.asks, LAYOUT.hooks, LAYOUT.identity, LAYOUT.assets, LAYOUT.comfy, LAYOUT.repros] as const
 
 /** the machine-global private folder, under $HOME: one keyword list and one
  *  allowlist per machine, never copied into a repo */

package/src/core/legacy-shapes.ts

@@ -221,3 +221,43 @@ export function dropConfigKey(text: string, key: string): string | null {
     while (from > 0 && lines[from - 1]!.trim().startsWith('//') && !/^\/\/ (>>>|<<<) shipkit/.test(lines[from - 1]!.trim())) from--
     return [...lines.slice(0, from), ...lines.slice(end + 1)].join('\n')
 }
+
+const esc = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+/** the config text without one entry of a top level object key, as in
+ *  `disable` inside `hooks` or `lint: false` inside `defaults`, plus the words
+ *  of the comment written right above the entry, which are the closest thing
+ *  to a reason the entry ever had. `value` is the entry's value as a regex
+ *  source, so only the shape the caller expects is touched. The parent goes
+ *  too once nothing is left in it. Null when the parent or the entry is not
+ *  there exactly once, or sits in a shape this reader does not follow */
+export function dropConfigEntry(text: string, parent: string, entry: string, value: string): { text: string; comment: string | null } | null {
+    const lines = text.split('\n')
+    const at = lines.map((l, i) => (new RegExp(`^\\s*${esc(parent)}\\s*:`).test(l) ? i : -1)).filter((i) => i !== -1)
+    if (at.length !== 1) return null
+    const start = at[0]!
+    const end = statementEnd(lines, start)
+    const key = `(['"]?)${esc(entry)}\\1\\s*:\\s*(?:${value})`
+    if (start === end) {
+        // one line: `hooks: { blockedPaths: [...], disable: ['leak-guard'] },`
+        const line = lines[start]!
+        const hits = line.match(new RegExp(`(?<![\\w$])${key}`, 'g')) ?? []
+        if (hits.length !== 1) return null
+        let next = line.replace(new RegExp(`,\\s*${key}`), '')
+        if (next === line) next = line.replace(new RegExp(`(?<![\\w$])${key}\\s*,\\s*`), '')
+        if (next === line) next = line.replace(new RegExp(`(?<![\\w$])${key}`), '')
+        const out = [...lines.slice(0, start), next, ...lines.slice(start + 1)].join('\n')
+        return { text: /:\s*\{\s*\}\s*,?\s*(\/\/.*)?$/.test(next) ? (dropConfigKey(out, parent) ?? out) : out, comment: null }
+    }
+    const inner = lines.map((l, i) => (i > start && i <= end && new RegExp(`^\\s*${key}\\s*,?\\s*$`).test(l) ? i : -1)).filter((i) => i !== -1)
+    if (inner.length !== 1) return null
+    const i = inner[0]!
+    let from = i
+    while (from - 1 > start && lines[from - 1]!.trim().startsWith('//')) from--
+    const comment = lines.slice(from, i).map((l) => l.trim().replace(/^\/\/\s?/, '')).join(' ').trim()
+    const kept = [...lines.slice(0, from), ...lines.slice(i + 1)]
+    const body = kept.slice(start + 1, end - (i - from + 1))
+    const empty = body.every((l) => l.trim() === '' || l.trim().startsWith('//'))
+    const out = kept.join('\n')
+    return { text: empty ? (dropConfigKey(out, parent) ?? out) : out, comment: comment === '' ? null : comment }
+}

package/src/core/one-lib.ts

@@ -102,7 +102,7 @@ const LOADERS: Record<string, 'ts' | 'tsx' | 'js' | 'jsx'> = { '.ts': 'ts', '.ts
 let installed = false
 
 /** route every import of the package to this process's copy. Idempotent */
-export function useOneLib(root: string = LIB_ROOT): void {
+export function installOneLib(root: string = LIB_ROOT): void {
     if (installed) return
     installed = true
     const exports = readExports(root)
@@ -119,7 +119,9 @@ export function useOneLib(root: string = LIB_ROOT): void {
             build.onLoad({ filter: /\/(node_modules\/rvlib-shipkit|install\/cache\/rvlib-shipkit@[^/]*)\// }, (a) => {
                 const loader = LOADERS[extname(a.path)] ?? 'ts'
                 const sub = foreignLibPath(a.path, root)
-                if (sub == null) return { contents: readFileSync(a.path, 'utf8'), loader }
+                // the host copy itself lives under node_modules when it is an
+                // install: its path can carry importFresh's `?v=` stamp
+                if (sub == null) return { contents: readFileSync(a.path.replace(/\?.*$/, ''), 'utf8'), loader }
                 return reexport(join(root, sub))
             })
             for (const name of SHARED) {
@@ -131,7 +133,7 @@ export function useOneLib(root: string = LIB_ROOT): void {
                 const skip = [...new Set([host, real(host)])].map((h) => `(?!${esc(h)}/)`).join('')
                 build.onLoad({ filter: new RegExp(`^${skip}.*/node_modules/${esc(name)}/`) }, (a) => {
                     const sub = foreignSharedPath(a.path, name, host)
-                    if (sub == null) return { contents: readFileSync(a.path, 'utf8'), loader: LOADERS[extname(a.path)] ?? 'js' }
+                    if (sub == null) return { contents: readFileSync(a.path.replace(/\?.*$/, ''), 'utf8'), loader: LOADERS[extname(a.path)] ?? 'js' }
                     return reexport(sharedTarget(a.path, sub, name, host))
                 })
             }

package/src/core/one-way-in-policy.ts

@@ -14,7 +14,7 @@
 // The deny is the floor and the hook is the messenger. When the hook cannot
 // run, enforcement degrades to terse rather than to nothing.
 //
-// Subprocesses are NOT intercepted (verified): shipkit spawning oxlint or
+// Subprocesses are NOT intercepted (verified): shipkit spawning tsc or
 // `bun run test:raw` from inside a permitted `shipkit ci` is invisible to
 // these rules, which is exactly what makes the gate itself still work.
 
@@ -24,7 +24,7 @@ export type RawRunner = {
     /** the floor slot it answers, so ONE exemption governs the script name and
      *  the shell command together: a repo that keeps `test` raw is not then
      *  refused `bun test` */
-    slot: 'test' | 'lint' | 'typecheck'
+    slot: 'test' | 'typecheck'
     /** the shipkit command that answers the same question, cache and all */
     use: string
     /** the narrower way in, when there is one: iterating on a single repro
@@ -47,25 +47,118 @@ export const RAW_RUNNERS: readonly RawRunner[] = [
     { head: 'bunx tsc', slot: 'typecheck', use: 'shipkit ci --only typecheck' },
     { head: 'npx tsc', slot: 'typecheck', use: 'shipkit ci --only typecheck' },
     { head: 'tsc', slot: 'typecheck', use: 'shipkit ci --only typecheck' },
-    { head: 'bunx oxlint', slot: 'lint', use: 'shipkit ci --only lint' },
-    { head: 'npx oxlint', slot: 'lint', use: 'shipkit ci --only lint' },
-    { head: 'oxlint', slot: 'lint', use: 'shipkit ci --only lint' },
-    { head: 'npx eslint', slot: 'lint', use: 'shipkit ci --only lint' },
-    { head: 'eslint', slot: 'lint', use: 'shipkit ci --only lint' },
 ]
 
-// the FORMATTER is deliberately absent, and that is not an oversight. It
-// answers no cached question and produces no green anyone could mistake for a
-// verification, shipkit's own fix pass runs it BY SCRIPT (`bun run fmt`), and
-// denying the bare binary while that stays open would be theatre. `shipkit ci`
-// formats before it gates, which is the only reason the reflex matters at all.
+// the LINTER and the FORMATTER are deliberately absent. `bun lint` and
+// `bun fmt` are the house way in: bun's built-ins cover a whole repo in well
+// under a second, so a cache has nothing to save, and the formatter is a
+// manual tool the gate never runs.
 
 /** the `permissions.deny` entries, in the syntax Claude Code matches:
  *  `Bash(<head>*)` is a prefix match, and a compound command is checked one
  *  segment at a time, so `cd x && bun test` is caught too */
 export const denyRules = (exemptSlots: Iterable<string> = []): string[] => {
     const off = new Set(exemptSlots)
-    return RAW_RUNNERS.filter((r) => !off.has(r.slot)).map((r) => `Bash(${r.head}*)`)
+    return [...RAW_RUNNERS.filter((r) => !off.has(r.slot)).map((r) => `Bash(${r.head}*)`), GIT_STASH_RULE]
+}
+
+// `git stash` in a tree that other agents share takes every agent's
+// uncommitted work, not just the caller's (identity/how-we-commit.md: never
+// stash as a side effect). The deny row is the floor. Claude Code matches it
+// per subcommand of a compound and inside `$(...)`, and never inside
+// `bash -c '...'`, after git's own global options (`git -C dir stash`), or
+// through `eval`: the guard closes those (stashCallIn).
+export const GIT_STASH_HEAD = 'git stash'
+export const GIT_STASH_RULE = `Bash(${GIT_STASH_HEAD}*)`
+
+/** the stash subcommands that only read, which the guard lets through */
+const STASH_READS = new Set(['list', 'show'])
+
+/** git's global options that take their value as the NEXT word */
+const GIT_VALUE_OPTS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env', '--exec-path'])
+
+const unquote = (w: string): string => w.replace(/^(['"])(.*)\1$/, '$2')
+
+/** a segment's words, a quoted run kept as one word, subshell and group
+ *  brackets dropped */
+const quotedWords = (seg: string): string[] =>
+    (seg.match(/(?:'[^']*'|"(?:[^"\\]|\\.)*"|[^\s'"])+/g) ?? []).map((w) => w.replace(/^[({]+|[)}]+$/g, '')).filter((w) => w !== '')
+
+/** the bodies of `$(...)` and backtick substitutions outside single quotes,
+ *  where a shell runs them */
+function substitutions(seg: string): string[] {
+    const out: string[] = []
+    let single = false
+    for (let i = 0; i < seg.length; i++) {
+        const ch = seg[i]!
+        if (ch === "'") { single = !single; continue }
+        if (single) continue
+        if (ch === '`') {
+            const end = seg.indexOf('`', i + 1)
+            if (end < 0) break
+            out.push(seg.slice(i + 1, end))
+            i = end
+        } else if (ch === '$' && seg[i + 1] === '(') {
+            let depth = 0
+            let j = i + 1
+            for (; j < seg.length; j++) {
+                if (seg[j] === '(') depth++
+                else if (seg[j] === ')' && --depth === 0) break
+            }
+            out.push(seg.slice(i + 2, j))
+            i = j
+        }
+    }
+    return out
+}
+
+/** the script a segment hands to another shell: `bash -c '<script>'`,
+ *  `sh -c`, `zsh -c`, or `eval <words>` */
+function innerScript(words: string[], seg: string): string | null {
+    const program = words[0]?.split('/').pop() ?? ''
+    if (program === 'eval') {
+        const all = quotedWords(seg)
+        return all.slice(all.indexOf(words[0]!) + 1).map(unquote).join(' ')
+    }
+    if (!/^(?:ba|z|da|k)?sh$/.test(program)) return null
+    const m = /\s-[a-z]*c[a-z]*\s+(?:'([^']*)'|"((?:[^"\\]|\\.)*)"|(\S+))/.exec(seg)
+    return m == null ? null : (m[1] ?? m[2] ?? m[3] ?? null)
+}
+
+/** the segment of a command that runs a stash which is not a read, or null.
+ *  Like rawRunnerHit it reads only what a shell would RUN: a heredoc body and
+ *  a quoted argument are data, so a commit message that mentions the command
+ *  is never refused. */
+export function stashCallIn(command: string, depth = 0): string | null {
+    if (depth > 3) return null
+    for (const seg of shellSegments(command)) {
+        for (const inner of substitutions(seg)) {
+            const hit = stashCallIn(inner, depth + 1)
+            if (hit != null) return hit
+        }
+        const words = programWords(seg)
+        const script = innerScript(words, seg)
+        if (script != null) {
+            const hit = stashCallIn(script, depth + 1)
+            if (hit != null) return hit
+            continue
+        }
+        if ((words[0]?.split('/').pop() ?? '') !== 'git') continue
+        // re-split with quotes kept whole: `git -C "a dir" stash`
+        const all = quotedWords(seg)
+        const g = all.findIndex((w) => w.split('/').pop() === 'git')
+        const args = all.slice(g + 1)
+        let i = 0
+        while (i < args.length && args[i]!.startsWith('-')) i += GIT_VALUE_OPTS.has(args[i]!) ? 2 : 1
+        if (unquote(args[i] ?? '') !== 'stash') continue
+        if (!STASH_READS.has(unquote(args[i + 1] ?? ''))) return seg.trim()
+    }
+    return null
+}
+
+/** what a stash refusal says: why, what to do instead, how to lift it */
+export function stashRefusal(segment: string): string {
+    return `\`${segment.slice(0, 80)}\` stashes: in a tree that other agents share, a stash takes every agent's uncommitted work, not just yours. Set your own work aside with a commit by pathspec (git commit -m … -- <paths>), and read an existing stash by revision: \`git log -g --oneline refs/stash\`, \`git show stash@{0}:<file>\`. Lifting this: delete the "${GIT_STASH_RULE}" line from .claude/settings.json permissions.deny (identity/how-we-commit.md).`
 }
 
 /** what a refusal says. Never just the ban: a refusal with no replacement