rvlib-shipkit 1.9.0 → 2.0.1

package/CHANGELOG.md

@@ -1,3 +1,38 @@
+## 2.0.1
+
+- **`sk fleet --update --major` crosses the major again.** Each repo's guarded run now stays in its own process (`SHIPKIT_NO_HOME`), because a check the home answered never saw `SHIPKIT_ALLOW_MAJOR` and refused the breaking jump, naming the very command that was running.
+
+## 2.0.0
+
+- **A clean commit prints one line**, `ok: N commit gate(s) clean`. A gate that fails still prints whole, and a WARN or a waived hit inside a passing gate still prints.
+- **A green `sk ci` prints one line, the verdict.** Each check's `ok:` and `skip:` line and the `ran:` reasons go behind `--verbose`, and STATUS.md still holds them. A WARN, a FAIL with its fix, what the fix pass rewrote and a wait for a machine slot always print. A gate of 65 checks went from 86 lines to 2.
+- **A check's default time budget is 1 s in process and 5 s for a build step, a `cmd` check or a world probe** (it was 2 s and 10 s). A check that passes over it still only warns. The per suite test budget is unchanged.
+- **The suite runner never discovers a test file under a dot dir, as bun does not.** So a repro archived under `.shipkit/repros/` costs no run, `tests.select` included. `.shipkit/repros/` is a tracked folder of the SK004 block.
+- **`sk commands --compact`** renders one line per command, for a page every session loads.
+- **No VS Code task starts the shipkit hub any more.** The hub runs in the home, so `sk start` and `sk init` write no `.vscode/tasks.json`, and the scaffold template is gone. SK017 now runs in the gate (a WARN, never a block) and its repair is in the fix pass of every `sk ci`: it removes a hub task (`bun run hub`, or a `🚀  shipkit` label) and the hub's `dependsOn` entries, a wrapper left starting nothing, and the old scaffold comment about the hub. A wrapper left starting ONE task folds into it, which then opens with the folder. A file left with no task is deleted. The `👁  TSC` rule is unchanged, and a package published to npm is still never rewritten. Run by hand: `sk check --fix SK017`.
+- **`vendored: ['<dir>', …]` in repo.config.ts keeps third party code out of every tool that treats the tree as the repo's own source.** A vendored library (a git subtree, a copied package) stays byte identical to upstream. The import fixer and imports:check never crawl it and never adopt its package.json as one of the repo's packages, which rewrote every relative import of a vendored workspace into a package name form. Cycles and the source graph skip it, the on save `imports <file>` leaves a vendored file alone, `bun lint` gets `--ignore-pattern=<dir>/**`, `c.list` leaves it out of every check's listing (unless the glob names a path inside it), check discovery and the md scan never enter it, and `shipkit mv` never rewrites a reference inside it. A fixer the toolkit cannot scope (a package.json `imports:fix` script) still runs, and whatever it wrote under a vendored dir is put back byte for byte, an uncommitted edit of the repo's own included, with a WARN naming it. Cache keys, watchers and the leak guard still read vendored files. The value is a literal array of strings, because the tools that never load the config read it as text, and the config load refuses a value the text cannot show. A repo running an older copy (its hooks, its own scripts) refuses the key as unknown until it upgrades.
+- **A directive id ends on a letter or digit.** `sk-disable-line RV027: why` reads as the id `RV027` with no reason, so it warns, where it used to name an id `RV027:` that matched nothing.
+- **A failed linter or tsc names its errors on the gate.** A build step that prints no wire FAIL line now shows its parsed errors under the headline, up to 20, as `file:line:col: rule message`, where it used to show only its closing recap and a log path.
+- **A finding carries its site, and the file it sits in can waive it.** `c.fail(msg, { fix, at: { file, line, col } })` and `c.warn` take the site beside the fix pointer, and a plain string is still the pointer, so no check file changes. A check that passes `{ fix, at }` needs this release: an older copy prints the object as its pointer. The site rides on the wire line through the cache replay into the problems pane, which no longer has to find `path:line` in the text, and a message that does not name its file gets the site in front. A directive in the file's own comment waives a site, and only with a reason: `sk-disable-next-line <ID>[, <ID>…] -- <reason>`, `sk-disable-line`, `sk-disable-file`. A waived site is neither a FAIL nor a WARN: the check prints `skip: [<ID>] 2 sites waived in their files`, and `--verbose` and STATUS.md list each one. A directive with no reason waives nothing and WARNs, and so does one that waives nothing in a file the check read. The waiving file is read through `c`, so it joins the answer's key, and a check keyed on `files` stores no answer that a directive outside its inputs decided. An in process `run` body applies them, a `cmd` check does not.
+- **SK027 reports where it found each problem.** A dangling ref carries the line it sits on and an orphan its file, so the problems pane opens the page and an orphan kept on purpose can waive itself with `sk-disable-file SK027 -- <reason>`.
+- **`sk start` on a repo with history seeds the house files when it writes the house include lines.** The `agent/` wiki the second include routes at, the `.shipkit/reflections/` seed and the two `.claude/` policy files land create-only (`adoptHouse`), so every file the repo already has wins and nothing is committed over its history. A start with no house still writes none of them.
+- **`off: { <id>: '<why>' }` is the one switch, for a check, a floor slot and a commit gate alike.** The commit gates take ids: `tree-shrink`, `leak-guard`, `blocked-paths`, `root-identity`, `commit-message` and `commit-language`. `commit-message` off takes `commit-language` with it. An `off` id the gate cannot find still fails, a misspelled gate id included.
+- **The commit gates are rows of the inventory.** `sk checks`, `sk when` and the hub list each one with its hook in the commit column (`pre-commit`, `commit-msg` or `both`), its owner page and its `off` reason. They still run only from the git hooks, which load nothing new, and `sk ci --only <gate>` says where the gate runs instead of running it.
+- **`hooks.disable` and `defaults: { <slot>: false }` are retired, and still load.** Each reads as off with the reason `was hooks.disable: ['<id>'], no reason recorded` or `was defaults: { <slot>: false }, no reason recorded`, so every surface shows that nobody wrote one. SK029 fails while a config carries them, and the fix pass of `sk ci` ports them into `off`: the comment written right above the entry becomes its reason, and a shape it cannot read (a multi line `disable` array) is named for a person and left loading. `sk hooks list` prints an off gate as `(OFF: <reason>)` where it printed `(DISABLED by config)`.
+- **A floor slot turned off through `off` is off everywhere, as `defaults: { <slot>: false }` was.** It resolves to no task, SK001 no longer routes or asks for its script, SK013 no longer denies its raw tool, SK019 no longer reads its script, and its fixer slot stays off. Before, `off` stopped the slot from running but kept routing and denying it. A hub switch that turns a slot off now lifts its deny rule too, on the next fix pass.
+- **SK034 commit gates armed.** It FAILs a repo where git would not run the leak guard and the message gate: an unset `core.hooksPath`, or a foreign `pre-commit` or `commit-msg` that never calls shipkit, with the guarded line to chain. This was half of SK009, which only checked `commit-msg`, and it now covers the hook that carries the leak guard too.
+- **`sk ci --only <check> --fix` repairs only what the named checks own.** Their own ci repair, and the fixer slot that governs one of them (`imports:fix` for `imports:check`). Before, `--fix` ran every fixer slot over the whole tree.
+- **The STE prose rule is gone: SK014, `sk prose`, the hub's prose page and the `prose` config key.** No rule polices prose style any more. A `repo.config.ts` that still declares `prose` fails at load with "prose was removed with rule SK014: delete the key", and an `off` or `ruleExempt` entry that names SK014 or SK009 fails the same way, naming the retired rule.
+- **The AI attribution guard is gone: SK009 and the attribution half of the commit-msg hook.** The hook keeps the dash and French checks, and `hooks.disable: ['commit-message']` now lifts the whole message gate. The scaffold still writes the `.claude/settings.json` attribution silencer, which is harness config and reaches no agent's context.
+- **`bun lint` is the house linter.** With no `lint` script and a `[lint]` section in `bunfig.toml`, the lint slot runs `bun lint --format unix`, and the problems pane reads its findings. It needs bun 1.4.4 (canary today): an older bun gets a failing line that names `bun upgrade --canary`, never a `lint` script that calls itself.
+- **Nothing formats in the gate.** The fix pass has no formatter slot any more: a `fmt` or `format` script, and a `[fmt]` section in `bunfig.toml`, are never run by `sk ci`, locally or under CI, so verify mode no longer fails a commit on formatting. `bun fmt` stays a manual tool, styled by `[fmt]`. SK001 no longer asks for `[fmt]` or a `fmt` script, and the `pretty` alias WARN is gone with it.
+- **oxlint and oxfmt are retired.** SK001 WARNs, one line per tool, on a dependency (`oxlint-tsgolint` included) or a script body that names either, with the migration: port `.oxlintrc.json` into `[lint]` for `bun lint`, then delete the dependency, each script that is only the tool, and the tool's config file. A script that does more (a code generator that formats its output) is told to lose the step, never deleted. It never repairs this itself: a linter swap changes which rules gate the repo, and dropping a dependency moves `bun.lock`, which only an install rewrites.
+- **A leftover `lint` script can no longer take the built-in's place.** bun runs a package.json script of that name instead of `bun lint`, flags and all, so the built-in now runs through `src/core/bun-tool-cli.ts`, which sets `npm_lifecycle_event` and drops an inherited `npm_package_json`, the two signals bun reads, and SK001 WARNs on a `lint` or `fmt` script that shadows a declared section.
+- **A canary upgrade invalidates cached answers.** The toolchain identity hashes `Bun.revision` beside `Bun.version`, which every canary of one version shares.
+- **`lint` is no longer a routed script.** SK001 stops asking for `lint` to route through `sk ci --only lint`, its fixer stops writing `lint:raw`, and the one-way-in deny list drops `oxlint` and `eslint`. A `[lint]` section meets SK001's baseline as a script did. A repo that already routes `lint` keeps working.
+- **The scaffold writes `bunfig.toml` with `[fmt]` and `[lint]`, and no `lint` or `fmt` script.** The toolchain drops `oxlint` and `oxfmt`, and the editor settings drop `oxc.enable`.
+- **A test suite is judged on its own CPU in the parallel phase, never on the files that ran before it in its worker.** A suite over `tests.budgetMs` in wall time skipped its lone run only when its own CPU plus everything its worker burned before it stayed under the budget, and after a worker's first file that sum is always over. So on a loaded machine nearly every suspect ran alone, one after the other: in a large repo 27 lone runs took 53 s of a 97.6 s test check. A suspect whose own CPU in the parallel phase, children included, is inside the same allowance a lone run gets (`cpuAllowance`) is now cleared there. A module that several suites share is charged to the first suite of each worker that loads it. A suite whose own figure is past its allowance, whose wall can hide a wait, or that ends with a child still alive runs alone as before, and only a lone run can fail the task. Measured on that repo, 760 suites under eight CPU burners: 19 lone runs and 47.1 s at load 13.5, then 0 lone runs and 27.0 s at load 24.5. The preload's line is now `<file>\t<cpu ms>`.
+
 ## 1.9.0
 
 - **A commit in a linked worktree passes the pre-commit hook.** git sets GIT_DIR for a hook there, and the installed copy then asked git where the house sits and got the worktree back, so it never handed off to the house source. Then it ran itself and failed every built-in check with ENOENT on a `?v=` stamped path. A directory with its own `.git` is now asked with the locating variables stripped, and an installed copy that runs itself (CI, `SHIPKIT_NO_HOME`) loads its own check files.
@@ -17,6 +52,9 @@
 - **The gate typecheck keeps its own incremental cache, and a release can publish with bun.** The built-in typecheck passes `--incremental --tsBuildInfoFile <project dir>/node_modules/.cache/shipkit/<config>.tsbuildinfo` for every project, so a `tsc --watch` task or a raw script on the same tsconfig no longer writes the cache the gate reads. A config without `incremental` gets it too: rvlib-shipkit's own typecheck went from 0.81 s to 0.35 s warm. `release.publisher: 'bun'` makes `sk release` and `sk bump` run `bun publish --access public`, with the token from `release.npmTokenCommand` in `NPM_CONFIG_TOKEN`, for a repo that tests its tarball with `bun pm pack`. The default stays npm, and an unknown publisher fails `defineRepo`.
 
 - **`alert`, `confirm` and `prompt` work in the shipkit app and in every process app.** The app window answered each one at once with no panel: `confirm` returned false and `prompt` null, so a page button behind one did nothing. Each now shows as a sheet on its window. The prompt's text field holds the default text, selected. Return is OK and Esc is Cancel. An app picks it up the next time `sk gui` or `sk gp open <id> --app` opens it, because a changed source rebuilds the app and quits the running copy.
+- **The pre-commit hook refuses a commit that drops most of the tree.** A commit that keeps under half of HEAD's files fails `tree-shrink`, which is what a commit from a private `GIT_INDEX_FILE` never filled with `git read-tree HEAD` does. `SHIPKIT_ALLOW_MASS_DELETE=1` lifts it for one deliberate mass delete, and `hooks.disable: ['tree-shrink']` for good.
+- **The pre-commit hook imports only the check files that run at commit.** A table under the git dir remembers, per file stamp, whether a check file declares `onPreCommit`, so a check file that never runs at commit costs the commit nothing while it stands still. A repo check file whose import takes over 30ms is named with a WARN on the commit that pays for it. The git steps share one staged listing, and the commit checks share one pass that records no config reads. Warm, on a consumer shaped fixture: 189ms before, 110ms after.
+- **SK013 also writes `Bash(git stash*)` into every repo's deny list, and the guard refuses a stash in the forms the deny row cannot see**: after git's own options (`git -C dir stash`), inside `bash -c` or `eval`. `git stash list` and `git stash show` pass the guard.
 
 - **The `prompt` and `seed` vars contract binds only the workflows a kit kind drives.** Loading the workflows folder no longer refuses a module that lacks them, so a workflow the repo drives with its own tools (portraits, voice, music) names its vars freely. The check runs when the atelier resolves the workflow for a kind, and the error names that kind.
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "1.9.0",
+    "version": "2.0.1",
     "funding": "https://github.com/sponsors/rvion",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",

package/src/check.ts

@@ -45,7 +45,7 @@ export type CheckDef = {
      *  Default: the id. */
     title?: string
     /** what MUST BE TRUE, in the present tense: ONE line, at most 90
-     *  characters, as in `package.json routes lint, typecheck and test
+     *  characters, as in `package.json routes typecheck and test
      *  through the gate`. Never what red means, red is its negation. It
      *  renders at the top of the check page and as the tree row's tooltip.
      *  A title names the check, this states the invariant it holds. */
@@ -119,7 +119,7 @@ export type CheckDef = {
     /** what a healthy run takes, in ms, distinct from the ceiling: a run that
      *  passes over it prints a WARN and reads yellow, and never blocks.
      *  Judged on the wall time of a run that measured, at the quick tier.
-     *  Default 2000 for an in process body, 10000 for a build step, a `cmd`
+     *  Default 1000 for an in process body, 5000 for a build step, a `cmd`
      *  or a world probe (cache `ttl`, `fact` or `never`, core/budget.ts).
      *  The repo's `budgets` wins over it. */
     budgetMs?: number
@@ -329,6 +329,7 @@ export async function runCheckBody(
         c.lines = tagCheckLines(u, c.lines)
         return
     }
+    c.checkId = u.id
     try {
         await u.run?.(c)
     } catch (e) {
@@ -340,6 +341,8 @@ export async function runCheckBody(
     // and it must not enter the body's read set
     if ((c.failed || c.warned) && !c.lines.some((l) => l.kind === 'fix-fail' || l.kind === 'fix-warn'))
         c.lines.push({ kind: c.failed ? 'fix-fail' : 'fix-warn', text: c.ownerPointer(u.owner) })
+    // after the pointer, so it binds to the body's own lines
+    c.settleWaivers()
     c.lines = tagCheckLines(u, c.lines)
 }
 

package/src/checks/SK001-package-json-shape.check.ts

@@ -6,7 +6,7 @@
 // whatever the floor resolution read.
 //
 // It also enforces the package.json half of ONE WAY IN (build/shipkit/one-way-in.md):
-// `test`, `lint` and `typecheck` ROUTE to `shipkit ci --only <id>` and the
+// `test` and `typecheck` ROUTE to `shipkit ci --only <id>` and the
 // tool body they used to hold sits at `<id>:raw`. That is what makes a cache
 // worth having: `bun run test` is the reflex, and the reflex has to land in
 // shipkit rather than beside it.
@@ -14,10 +14,13 @@ import { canonicalBodies, conditionalBodies, inferBin, ROUTED_SCRIPTS, rawName,
 import type { CheckCtx } from '../core/check-ctx.ts'
 import { checkFloorReader, resolveFloor } from '../core/floor-resolve.ts'
 import { rootPublishesNpm } from '../core/repo-facts.ts'
+import { bunfigDeclares } from '../core/bun-builtins.ts'
+import { repoOff } from '../core/when.ts'
 import type { RepoConfig } from '../repo-config.ts'
 import { check, type FixResult } from '../check.ts'
 
-type Pkg = { name?: string; private?: boolean; license?: string; scripts?: Record<string, string> }
+type Deps = Record<string, string>
+type Pkg = { name?: string; private?: boolean; license?: string; scripts?: Record<string, string>; dependencies?: Deps; devDependencies?: Deps; optionalDependencies?: Deps }
 
 const OWNER = 'meta/rv-conventions/package-json.md'
 
@@ -26,11 +29,18 @@ const OWNER = 'meta/rv-conventions/package-json.md'
 // folder must not be told to rename)
 const ALIASES: Record<string, { canonical: string; bodyMatch: RegExp }> = {
     'serve': { canonical: 'hub', bodyMatch: /(?:^|\s)(?:shipkit|\S*shipkit\S*\/cli\.ts) serve\b/ },
-    'pretty': { canonical: 'fmt', bodyMatch: /./ },
     'check-types': { canonical: 'typecheck', bodyMatch: /./ },
 }
 
-const BASELINE = ['test', 'lint', 'fmt'] as const
+const BASELINE = ['test', 'lint'] as const
+
+// tools bun's built-ins replaced. Never repaired here: a linter swap changes
+// which rules gate the repo, and dropping a dependency moves bun.lock, which
+// only an install rewrites
+const RETIRED: Array<{ tool: string; deps: string[]; config: string; how: string }> = [
+    { tool: 'oxlint', deps: ['oxlint', 'oxlint-tsgolint'], config: '.oxlintrc.json', how: 'port its rules into [lint] in bunfig.toml (`bun lint` is the house linter), then' },
+    { tool: 'oxfmt', deps: ['oxfmt'], config: '.oxfmtrc.json', how: 'nothing formats in the gate (`bun fmt` styled by [fmt] is manual), so' },
+]
 
 // no per-line fix pointers here — the rule framework appends ONE pointer
 // (docsBase + OWNER) to a failing/warning run, the same one-per-severity
@@ -94,7 +104,7 @@ export function evaluatePackageJson(t: CheckCtx): void {
     // route to, so it is not governed.
     const floor = resolveFloor(c, t.root, checkFloorReader(t))
     for (const id of ROUTED_SCRIPTS) {
-        if (routedExempt(c).has(id) || c.defaults?.[id] === false) continue
+        if (routedExempt(c).has(id) || repoOff(c, id) != null) continue
         const body = scripts[id]
         if (body == null) continue
         if (!routesToShipkit(body)) {
@@ -108,13 +118,38 @@ export function evaluatePackageJson(t: CheckCtx): void {
     // `test` is asked for only once the repo HAS tests: the fixer deliberately
     // refuses to scaffold it before that (a fixer never manufactures a
     // failure), so nagging for it would be a WARN no machine may clear. For
-    // the same reason `lint` and `fmt` wait for a source file to read
+    // the same reason `lint` waits for a source file to read. It is met by
+    // bun's built-in once bunfig.toml declares [lint]
     const tests = hasTestFiles(testFiles(t))
     const source = tests || hasSourceFiles(t)
-    const baseline = BASELINE.filter((n) => (n === 'test' ? tests : source))
-    const missingBaseline = baseline.filter((n) => !has(n))
+    const bunfig = t.read('bunfig.toml')
+    // a lint slot turned off has no built-in to declare
+    const baseline = BASELINE.filter((n) => (n === 'test' ? tests : source) && !(n === 'lint' && repoOff(c, 'lint') != null))
+    const missingBaseline = baseline.filter((n) => !has(n) && !(n !== 'test' && bunfigDeclares(bunfig, n)))
+    // a script named like the built-in runs in its place whenever someone
+    // types `bun lint` or `bun fmt`, so a declared section makes it dead weight
+    for (const n of ['lint', 'fmt'] as const)
+        if (scripts[n] != null && bunfigDeclares(bunfig, n))
+            t.warn(`package.json: script '${n}' shadows \`bun ${n}\`, which bunfig.toml turns on with [${n}] — delete it${scripts[rawName(n)] != null ? ` and '${rawName(n)}'` : ''}`)
     if (missingBaseline.length > 0)
-        t.warn(`package.json: missing baseline script(s): ${missingBaseline.join(', ')}`)
+        t.warn(`package.json: missing baseline: ${missingBaseline.map((n) => (n === 'test' ? `script 'test'` : `[${n}] in bunfig.toml (or a '${n}' script)`)).join(', ')}`)
+    for (const r of RETIRED) {
+        // the tool as a command word: `bunx oxlint@latest`, `"oxlint;"`, never `.oxlintrc` or `oxlint-smoke.ts`
+        const word = new RegExp(`(^|[^\\w.-])${r.tool}(?![\\w-])`)
+        const sole = new RegExp(`^\\s*(?:(?:bunx|npx|bun\\s+x)\\s+)?(?:\\S*/)?${r.tool}(?:@\\S+)?(?:\\s+[^;&|]*)?$`)
+        const deps = r.deps.filter((d) => [pkg.dependencies, pkg.devDependencies, pkg.optionalDependencies].some((m) => m?.[d] != null))
+        const using = Object.entries(scripts).filter(([, body]) => word.test(body))
+        const whole = using.filter(([, body]) => sole.test(body)).map(([name]) => `'${name}'`)
+        const steps = using.filter(([, body]) => !sole.test(body)).map(([name]) => `'${name}'`)
+        const del = [
+            ...deps.map((d) => `the ${d} dependency`),
+            ...(whole.length > 0 ? [`script ${whole.join(', ')}`] : []),
+            ...(t.exists(r.config) ? [r.config] : []),
+        ]
+        if (deps.length === 0 && using.length === 0) continue
+        const parts = [...(del.length > 0 ? [`delete ${del.join(', ')}`] : []), ...(steps.length > 0 ? [`take the ${r.tool} step out of script ${steps.join(', ')}, which does more`] : [])]
+        t.warn(`package.json: ${r.tool} is retired: ${r.how} ${parts.join(', and ')}`)
+    }
 
     if (!t.failed && !t.warned)
         t.ok(`package.json shape ok (private, no license, ${required.length} required script(s) present)`)
@@ -182,7 +217,7 @@ const SOURCE_GLOB = '**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'
 const EMPTY_MODULE = /^(?:\s|;|export\s*\{\s*\})*$/
 
 /** a code file with something in it, outside installs, build output, dot dirs
- *  and the repo config: what lint and fmt would read. Stops at the first */
+ *  and the repo config: what lint would read. Stops at the first */
 function hasSourceFiles(c: CheckCtx): boolean {
     for (const f of c.list(SOURCE_GLOB)) {
         const parts = f.split('/')
@@ -196,7 +231,7 @@ export const packageJsonShape = check({
     id: 'SK001',
     blocking: true,
     title: 'package.json',
-    description: 'package.json routes lint, typecheck and test through the gate',
+    description: 'package.json routes typecheck and test through the gate',
     owner: OWNER,
     runs: { onPreCommit: false, onCi: true, onFull: true, onRelease: true, onHealth: true, onSave: 'moved', onClock: false },
     cache: { by: 'reads' },
@@ -252,7 +287,7 @@ export const packageJsonShape = check({
         // call. Both keys keep their place in the file, so the diff a human
         // reads is the two lines that changed and not a reordered block
         for (const id of ROUTED_SCRIPTS) {
-            if (routedExempt(c.config).has(id) || c.config.defaults?.[id] === false) continue
+            if (routedExempt(c.config).has(id) || repoOff(c.config, id) != null) continue
             const body = pkg.scripts[id]
             if (body == null || routesToShipkit(body)) continue
             const raw = rawName(id)

package/src/checks/SK013-one-way-in-policy.check.ts

@@ -14,9 +14,10 @@
 // scaffold, so a policy written there would bind exactly one checkout.
 import { isAbsolute, join } from 'path'
 import { inferBin } from '../core/canonical-scripts.ts'
-import { denyRules, RAW_RUNNERS } from '../core/one-way-in-policy.ts'
+import { denyRules, GIT_STASH_RULE, RAW_RUNNERS } from '../core/one-way-in-policy.ts'
 import { rootPublishesNpm } from '../core/repo-facts.ts'
 import type { RepoConfig } from '../repo-config.ts'
+import { repoOff } from '../core/when.ts'
 import { check, type CheckCtx, type FixResult } from '../check.ts'
 
 const OWNER = 'build/shipkit/one-way-in.md'
@@ -31,7 +32,7 @@ type Settings = {
  *  either: ONE declaration governs the script name and the raw call together */
 export function exemptSlots(c: RepoConfig): Set<string> {
     const off = new Set(c.oneWayIn?.exempt ?? [])
-    for (const [slot, def] of Object.entries(c.defaults ?? {})) if (def === false) off.add(slot)
+    for (const id of [...Object.keys(c.defaults ?? {}), ...Object.keys(c.off ?? {}), ...Object.keys(c.when ?? {})]) if (repoOff(c, id) != null) off.add(id)
     return off
 }
 
@@ -132,14 +133,15 @@ export const oneWayInPolicy = check({
         if (rootPublishesNpm(c.config)) return c.ok(PUBLIC_SKIP)
         const d = c
         const want = denyRules(exemptSlots(c.config))
-        if (want.length === 0) return c.ok('every governed slot is exempt (repo.config oneWayIn/defaults) — nothing to deny')
         const s = readSettings(d)
         if (s == null) {
             c.fail(`${SETTINGS_PATH} ${d.exists(SETTINGS_PATH) ? 'is unparseable' : 'missing'} — nothing stops an agent typing \`bun test\`, and a package.json script cannot intercept a bun builtin`)
             return
         }
         const have = new Set(s.permissions?.deny ?? [])
-        const missing = want.filter((r) => !have.has(r))
+        const missing = want.filter((r) => !have.has(r) && r !== GIT_STASH_RULE)
+        if (!have.has(GIT_STASH_RULE))
+            c.fail(`${SETTINGS_PATH}: no "${GIT_STASH_RULE}" deny row, so an agent can stash every other agent's uncommitted work in a shared tree`)
         if (missing.length > 0)
             c.fail(`${SETTINGS_PATH}: ${missing.length} raw runner(s) still permitted (${missing.slice(0, 3).join(', ')}${missing.length > 3 ? ', …' : ''}) — those calls never reach shipkit, so nothing is cached and no run can be attached to`)
         const guard = guardHookCommand(s)
@@ -170,7 +172,7 @@ export const oneWayInPolicy = check({
         // replacement is named while the guard cannot run is the green that
         // measured nothing, one line under the WARN that says otherwise
         if (!c.failed)
-            c.ok(`${SETTINGS_PATH} closes ${want.length}/${RAW_RUNNERS.length} raw runner(s)${guardRuns ? ', with the replacement named' : ' (the guard that names the replacement is declared, not yet runnable)'}`)
+            c.ok(`${SETTINGS_PATH} closes ${want.length - 1}/${RAW_RUNNERS.length} raw runner(s) and refuses git stash${guardRuns ? ', with the replacement named' : ' (the guard that names the replacement is declared, not yet runnable)'}`)
     },
     // MERGES, never rewrites: this file also carries the attribution silencer,
     // a repo's own allow list and its own hooks, and clobbering those to fix a
@@ -179,7 +181,6 @@ export const oneWayInPolicy = check({
         if (rootPublishesNpm(c.config)) return { changed: false, summary: PUBLIC_SKIP }
         const d = c
         const want = denyRules(exemptSlots(c.config))
-        if (want.length === 0) return { changed: false, summary: 'every governed slot is exempt — nothing to write' }
         const existing = readSettings(d)
         if (existing == null && c.exists(SETTINGS_PATH)) return { changed: false, summary: `${SETTINGS_PATH} is unparseable — repair it by hand first, a merge would destroy it` }
         const s: Settings = existing ?? {}
@@ -188,7 +189,7 @@ export const oneWayInPolicy = check({
         const added = want.filter((r) => !deny.includes(r))
         if (added.length > 0) {
             s.permissions = { ...s.permissions, deny: [...deny, ...added] }
-            changes.push(`${added.length} raw runner(s) denied`)
+            changes.push(`${added.length} deny rule(s) added`)
         }
         const wantGuard = await guardCommandFor(d)
         if (!hasGuardHook(s)) {

package/src/checks/SK017-vscode-hub-task.check.ts

@@ -1,26 +1,24 @@
-// SK017 vscode hub task (build/vscode-tasks.md): the folder-open hub task
-// carries the problem matcher the hub prints for, it opens with the folder
-// itself when nothing else does, and no `👁  TSC` watcher runs beside a gate
-// that already runs `typecheck`.
+// SK017 vscode hub task (build/vscode-tasks.md): no folder-open task starts
+// the shipkit hub (it runs in the home, and VS Code needs no task for it), and
+// no `👁  TSC` watcher runs beside a gate that already runs `typecheck`.
 //
-// the file is hand-written jsonc, so the fixer edits spans: it removes the TSC
-// task, a wrapper that only starts the hub, and their dependsOn entries, and
-// writes the hub's matcher and folder-open run option. Every other byte stays
-// as its author left it.
+// the file is hand-written jsonc, so the fixer edits spans: it removes the hub
+// task, the TSC task, a wrapper left starting nothing, and their dependsOn
+// entries, and folds a wrapper left starting ONE task into it. Every other
+// byte stays, except a dependsOn array it edits, which is rewritten inline.
+// A file left holding nothing but an empty task list is deleted.
 import { basename } from 'path'
 import { check } from '../check.ts'
 import type { CheckCtx } from '../core/check-ctx.ts'
 import { checkFloorReader, resolveFloor } from '../core/floor-resolve.ts'
 import { rootPublishesNpm } from '../core/repo-facts.ts'
 import { repoOff } from '../core/when.ts'
-import { hubProblemMatcher } from '../problems/problem-line.ts'
-import { indentAt, parseSpans, plain, removalSpan, type Node } from '../scaffold/jsonc-spans.ts'
+import { indentAt, parseSpans, plain, removalSpans, type Node } from '../scaffold/jsonc-spans.ts'
 
 export const TSC_LABEL = '👁  TSC'
 const TASKS = '.vscode/tasks.json'
 
 type Obj = Extract<Node, { kind: 'object' }>
-type Arr = Extract<Node, { kind: 'array' }>
 
 const prop = (o: Obj, key: string): Node | undefined => o.props.find((p) => p.key === key)?.value
 
@@ -35,12 +33,17 @@ function isTscWatcher(t: Record<string, unknown>): boolean {
     return t['label'] === TSC_LABEL && TSC_BINS.has(basename(cmd)) && args.includes('--watch')
 }
 
-/** the hub task: `bun run hub`, or the house label */
+/** the hub task: `bun run hub` or `sk serve` (args or one shell string), or the house label */
 function isHub(t: Record<string, unknown>): boolean {
-    const args = Array.isArray(t['args']) ? t['args'] : []
-    return (t['command'] === 'bun' && args[0] === 'run' && args[1] === 'hub') || (typeof t['label'] === 'string' && /^🚀\s+shipkit\b/.test(t['label']))
+    const args = Array.isArray(t['args']) ? t['args'].map(String) : []
+    const line = [typeof t['command'] === 'string' ? t['command'] : '', ...args].join(' ')
+    return /(?:^|\s)(?:bun run hub|(?:sk|shipkit) serve)(?:\s|$)/.test(line) || (typeof t['label'] === 'string' && /^🚀\s+shipkit\b/.test(t['label']))
 }
 
+/** the comment the old scaffold wrote above its hub task, byte for byte, any
+ *  indent: it describes the hub task, so it goes with it */
+const SCAFFOLD_HEADER = /^[ \t]*\/\/ the hub is the one process every wired repo starts, so it opens with the\n[ \t]*\/\/ folder itself\. It runs every check after each save and its problem\n[ \t]*\/\/ matcher fills the problems pane, so there is no type checker task\. A\n[ \t]*\/\/ stack that earns more long-running watchers \(dev server, css\) adds a\n[ \t]*\/\/ master task with runOn folderOpen whose dependsOn lists them all, the hub\n[ \t]*\/\/ included, and moves runOn off the hub\.\n/m
+
 /** a task that only starts other tasks: no command of its own */
 const isWrapper = (t: Record<string, unknown>): boolean => t['command'] == null && t['type'] == null && t['dependsOn'] != null
 
@@ -50,112 +53,111 @@ export type RepairOpts = {
     typecheckOn: boolean
 }
 
-/** what this file needs, applied: the text to write, one line per change, and
- *  one line per thing it deliberately left. No change means the text comes
- *  back byte for byte */
-export function repairTasks(text: string, o: RepairOpts): { text: string; changes: string[]; kept: string[] } {
+/** what this file needs, applied: the text to write, one line per change,
+ *  one line per thing it deliberately left, and whether any task is left. No
+ *  change means the text comes back byte for byte */
+export function repairTasks(text: string, o: RepairOpts): { text: string; changes: string[]; kept: string[]; empty: boolean } {
     const root = parseSpans(text)
     if (root.kind !== 'object') throw new Error('tasks.json is not an object')
     const tasks = prop(root, 'tasks')
-    if (tasks == null || tasks.kind !== 'array') return { text, changes: [], kept: [] }
-    const edits: { start: number; end: number; body: string }[] = []
+    if (tasks == null || tasks.kind !== 'array') return { text, changes: [], kept: [], empty: false }
     const changes: string[] = []
     const kept: string[] = []
     const record = (t: Node): Record<string, unknown> => plain(text, t) as Record<string, unknown>
     const labelOf = (t: Node): string => String(record(t)['label'] ?? '?')
-    const items = tasks.items.filter((n): n is Obj => n.kind === 'object')
-    const hubs = items.filter((t) => isHub(record(t)))
-
-    const tscAt = tasks.items.flatMap((n, i) => (n.kind === 'object' && isTscWatcher(record(n)) ? [i] : []))
-    const dropTsc = tscAt.length > 0 && o.typecheckOn
-    if (tscAt.length > 0 && !o.typecheckOn) kept.push(`kept the '${TSC_LABEL}' task: this repo's gate has no enabled typecheck check, so it is the only type checker here`)
-    if (dropTsc) for (const i of tscAt) {
-        const [start, end] = removalSpan(text, tasks, i)
-        edits.push({ start, end, body: '' })
-        changes.push(`removed the '${TSC_LABEL}' task`)
+    const at = (pred: (t: Record<string, unknown>) => boolean): number[] => tasks.items.flatMap((n, i) => (n.kind === 'object' && pred(record(n)) ? [i] : []))
+
+    const remove = new Set<number>()
+    const gone = new Set<string>()
+    const drop = (i: number, why: string): void => {
+        remove.add(i)
+        gone.add(labelOf(tasks.items[i]!))
+        changes.push(why)
     }
+    for (const i of at(isHub)) drop(i, `removed the '${labelOf(tasks.items[i]!)}' hub task: the hub runs in the home, not in VS Code`)
+    const tscAt = at(isTscWatcher)
+    if (tscAt.length > 0 && !o.typecheckOn) kept.push(`kept the '${TSC_LABEL}' task: this repo's gate has no enabled typecheck check, so it is the only type checker here`)
+    if (o.typecheckOn) for (const i of tscAt) drop(i, `removed the '${TSC_LABEL}' task`)
 
-    // a folder-open wrapper whose only job is starting the hub is a second
-    // task on screen for nothing: the hub opens with the folder itself
-    const hub = hubs.length === 1 ? hubs[0]! : null
-    const hubLabel = hub == null ? null : labelOf(hub)
     const depsOf = (t: Node): string[] => {
         const d = record(t)['dependsOn']
-        const list = Array.isArray(d) ? d.map(String) : [String(d)]
-        return dropTsc ? list.filter((x) => x !== TSC_LABEL) : list
+        return d == null ? [] : Array.isArray(d) ? d.map(String) : [String(d)]
     }
-    const wrapperAt = hub == null ? -1 : tasks.items.findIndex((n) => n.kind === 'object' && isWrapper(record(n)) && depsOf(n).length === 1 && depsOf(n)[0] === hubLabel)
-    const wrapper = wrapperAt < 0 ? null : (tasks.items[wrapperAt] as Obj)
-    if (wrapper != null) {
-        const [start, end] = removalSpan(text, tasks, wrapperAt)
-        edits.push({ start, end, body: '' })
-        changes.push(`folded the '${labelOf(wrapper)}' wrapper into '${hubLabel}', which now opens with the folder`)
-        if (/\/\/.*(master task|subtask)/i.test(text)) changes.push('a comment still describes a master task with subtasks: rewrite it by hand')
-    }
-
-    // a wrapper that started only the TSC task starts nothing once it goes
-    const emptied = !dropTsc ? [] : tasks.items.flatMap((n, i) => (n !== wrapper && n.kind === 'object' && isWrapper(record(n)) && depsOf(n).length === 0 ? [i] : []))
-    for (const i of emptied) {
-        const [start, end] = removalSpan(text, tasks, i)
-        edits.push({ start, end, body: '' })
-        changes.push(`removed the '${labelOf(tasks.items[i]!)}' wrapper, which started nothing else`)
+    // a wrapper that started only what went starts nothing, and so on up
+    for (let moved = true; moved;) {
+        moved = false
+        tasks.items.forEach((n, i) => {
+            if (remove.has(i) || n.kind !== 'object' || !isWrapper(record(n))) return
+            const deps = depsOf(n)
+            if (deps.length > 0 && deps.every((x) => gone.has(x))) { drop(i, `removed the '${labelOf(n)}' wrapper, which started nothing else`); moved = true }
+        })
     }
 
-    if (dropTsc) {
-        for (const t of items) {
-            if (t === wrapper || emptied.some((i) => tasks.items[i] === t)) continue
-            const d = prop(t, 'dependsOn')
-            if (d?.kind === 'array') {
-                const idx = d.items.findIndex((x) => x.kind === 'scalar' && x.value === TSC_LABEL)
-                if (idx < 0) continue
-                const [start, end] = removalSpan(text, d as Arr, idx)
-                edits.push({ start, end, body: '' })
-                changes.push(`dropped '${TSC_LABEL}' from the dependsOn of '${labelOf(t)}'`)
-            } else if (d?.kind === 'scalar' && d.value === TSC_LABEL) {
-                edits.push({ start: d.start, end: d.end, body: '[]' })
-                changes.push(`dropped '${TSC_LABEL}' from a dependsOn`)
-            }
-        }
-    }
-
-    const want = hubProblemMatcher()
-    for (const h of hubs) {
-        const first = h.props[0]
-        const hubIndent = indentAt(text, h.start)
-        const propIndent = first != null ? indentAt(text, first.keyStart) : `${hubIndent}   `
-        const unit = propIndent.length > hubIndent.length ? propIndent.slice(hubIndent.length) : '   '
-        const render = (v: unknown): string => JSON.stringify(v, null, unit).split('\n').join(`\n${propIndent}`)
+    const edits: { start: number; end: number; body: string }[] = []
+    // a wrapper this pass cut down to ONE task is two tasks on screen for one
+    // process: it folds into that task, which takes the wrapper's own runOn
+    // and group, and every dependsOn naming the wrapper names the task instead
+    const alias = new Map<string, string>()
+    const folds = new Map<Obj, Obj[]>()
+    tasks.items.forEach((n, i) => {
+        if (remove.has(i) || n.kind !== 'object' || !isWrapper(record(n))) return
+        const deps = depsOf(n)
+        const left = deps.filter((x) => !gone.has(x))
+        if (left.length !== 1 || left.length === deps.length) return
+        const into = tasks.items.findIndex((t, j) => !remove.has(j) && t.kind === 'object' && labelOf(t) === left[0])
+        if (into < 0) return
+        remove.add(i)
+        alias.set(labelOf(n), left[0]!)
+        folds.set(tasks.items[into] as Obj, [...(folds.get(tasks.items[into] as Obj) ?? []), n])
+        const opens = (record(n)['runOptions'] as Record<string, unknown> | undefined)?.['runOn'] === 'folderOpen'
+        changes.push(`folded the '${labelOf(n)}' wrapper into '${left[0]}'${opens ? ', which now opens with the folder' : ''}`)
+    })
+    tasks.items.forEach((n, i) => {
+        if (remove.has(i) || n.kind !== 'object') return
+        const d = prop(n, 'dependsOn')
+        const deps = depsOf(n)
+        const next = [...new Set(deps.map((x) => alias.get(x) ?? x).filter((x) => !gone.has(x) && x !== labelOf(n)))]
+        if (d == null || JSON.stringify(next) === JSON.stringify(deps)) return
+        edits.push({ start: d.start, end: d.end, body: JSON.stringify(next).replace(/","/g, '", "') })
+        changes.push(`dropped ${deps.filter((x) => !next.includes(x)).map((x) => `'${x}'`).join(', ')} from the dependsOn of '${labelOf(n)}'`)
+    })
+    for (const [start, end] of removalSpans(text, tasks, remove)) edits.push({ start, end, body: '' })
+    // the default build group a removed hub held moves with the fold too
+    const hubGroup = at(isHub).map((i) => prop(tasks.items[i] as Obj, 'group')).find((g) => g != null && /"isDefault"\s*:\s*true/.test(text.slice(g.start, g.end)))
+    for (const [task, wrappers] of folds) {
+        const first = task.props[0]
+        const taskIndent = indentAt(text, task.start)
+        const propIndent = first != null ? indentAt(text, first.keyStart) : `${taskIndent}   `
         const added: string[] = []
-        const current = prop(h, 'problemMatcher')
-        if (current == null || JSON.stringify(plain(text, current)) !== JSON.stringify(want)) {
-            if (current != null) edits.push({ start: current.start, end: current.end, body: render(want) })
-            else added.push(`"problemMatcher": ${render(want)}`)
-            changes.push(`wrote the shipkit problem matcher on '${labelOf(h)}'`)
-        }
-        if (h === hub && wrapper != null) {
-            const ro = prop(h, 'runOptions')
+        const runOn = wrappers.map((w) => record(w)['runOptions'] as Record<string, unknown> | undefined).find((r) => r?.['runOn'] != null)?.['runOn']
+        if (runOn != null) {
+            const ro = prop(task, 'runOptions')
             const was = ro != null && ro.kind === 'object' ? record(ro) : {}
-            const inline = `{ ${Object.entries(Object.assign({ runOn: 'folderOpen', instanceLimit: 1 }, was, { runOn: 'folderOpen' })).map(([k, v]) => `${JSON.stringify(k)}: ${JSON.stringify(v)}`).join(', ')} }`
+            const inline = `{ ${Object.entries({ ...was, runOn, instanceLimit: was['instanceLimit'] ?? 1 }).map(([k, v]) => `${JSON.stringify(k)}: ${JSON.stringify(v)}`).join(', ')} }`
             if (ro != null) edits.push({ start: ro.start, end: ro.end, body: inline })
             else added.push(`"runOptions": ${inline}`)
-            const wg = prop(wrapper, 'group')
-            if (wg != null) {
-                const body = text.slice(wg.start, wg.end)
-                const g = prop(h, 'group')
-                if (g != null) edits.push({ start: g.start, end: g.end, body })
-                else added.push(`"group": ${body}`)
-            }
         }
-        if (added.length === 0) continue
-        const last = h.props.at(-1)
-        const joined = added.join(`,\n${propIndent}`)
-        if (last == null) edits.push({ start: h.start + 1, end: h.start + 1, body: `\n${propIndent}${joined}\n${hubIndent}` })
-        else edits.push({ start: last.value.end, end: last.value.end, body: `,\n${propIndent}${joined}` })
+        const wg = wrappers.map((w) => prop(w, 'group')).find((g) => g != null) ?? hubGroup
+        if (wg != null) {
+            const body = text.slice(wg.start, wg.end)
+            const g = prop(task, 'group')
+            if (g != null) edits.push({ start: g.start, end: g.end, body })
+            else added.push(`"group": ${body}`)
+        }
+        const last = task.props.at(-1)
+        if (added.length > 0 && last != null) edits.push({ start: last.value.end, end: last.value.end, body: `,\n${propIndent}${added.join(`,\n${propIndent}`)}` })
     }
 
+    const header = gone.size > 0 ? SCAFFOLD_HEADER.exec(text) : null
+    if (header != null) {
+        edits.push({ start: header.index, end: header.index + header[0].length, body: '' })
+        changes.push('removed the old scaffold comment that described the hub task')
+    }
     let out = text
     for (const e of edits.sort((a, b) => b.start - a.start)) out = out.slice(0, e.start) + e.body + out.slice(e.end)
-    return { text: out, changes, kept }
+    // empty only when nothing else lives in the file either (`inputs`, a key of its own)
+    const onlyTasks = root.props.every((x) => x.key === 'version' || x.key === 'tasks')
+    return { text: out, changes, kept, empty: onlyTasks && tasks.items.length > 0 && remove.size === tasks.items.length }
 }
 
 /** whether this repo's gate runs a typecheck: a floor slot or a task that
@@ -184,26 +186,26 @@ const PUBLIC_SKIP = `the root unit publishes to npm: ${TASKS} belongs to every c
 export const vscodeHubTask = check({
     id: 'SK017',
     // a stale editor file is behind, not broken: it warns, and the fix pass
-    // repairs it
+    // of every gate repairs it
     blocking: false,
     title: 'vscode hub task',
-    description: 'the vscode hub task carries the problem matcher and no extra tsc watcher runs',
+    description: 'no vscode task starts the shipkit hub, and no extra tsc watcher runs',
     owner: 'build/vscode-tasks.md',
-    runs: { onPreCommit: false, onCi: false, onFull: false, onRelease: false, onHealth: true, onSave: 'moved', onClock: false },
+    runs: { onPreCommit: false, onCi: true, onFull: true, onRelease: false, onHealth: true, onSave: 'moved', onClock: false },
     cache: { by: 'reads' },
-    fix: 'manual',
+    fix: 'ci',
     applies: 'always',
     run: (c) => {
         if (rootPublishesNpm(c.config)) return c.ok(PUBLIC_SKIP)
         const own = ownTasks(c)
-        if (own === 'none') return c.ok(`no ${TASKS}, so there is no hub task to wire`)
+        if (own === 'none') return c.ok(`no ${TASKS}, so no task starts the hub`)
         if (own === 'linked') return c.ok(`.vscode/ is a link to a shared dir, left alone`)
         let r: { changes: string[]; kept: string[] }
         try { r = repairTasks(own.text, { typecheckOn: typecheckOn(c) }) }
         catch (e) { return c.warn(`${TASKS} does not parse (${(e as Error).message}), so the hub task was not checked`) }
         for (const k of r.kept) c.note(`${TASKS}: ${k}`)
-        if (r.changes.length === 0) return c.ok(`${TASKS}: the hub task feeds the problems pane`)
-        for (const ch of r.changes) c.fail(`${TASKS}: ${ch.replace(/^removed/, 'should remove').replace(/^dropped/, 'should drop').replace(/^wrote/, 'should write').replace(/^folded/, 'should fold')}`)
+        if (r.changes.length === 0) return c.ok(`${TASKS}: no task starts the hub`)
+        for (const ch of r.changes) c.fail(`${TASKS}: ${ch.replace(/^removed/, 'should remove').replace(/^dropped/, 'should drop')}`)
     },
     repair: (c) => {
         if (rootPublishesNpm(c.config)) return { changed: false, summary: PUBLIC_SKIP }
@@ -211,8 +213,9 @@ export const vscodeHubTask = check({
         if (typeof own === 'string') return { changed: false, summary: `no ${TASKS} to repair` }
         const r = repairTasks(own.text, { typecheckOn: typecheckOn(c) })
         if (r.changes.length === 0) return { changed: false, summary: `${TASKS} already current` }
-        c.write(TASKS, r.text)
-        return { changed: true, summary: `${TASKS}: ${r.changes.join(', ')}` }
+        if (r.empty) c.remove(TASKS)
+        else c.write(TASKS, r.text)
+        return { changed: true, summary: `${TASKS}: ${r.changes.join(', ')}${r.empty ? ', and deleted the file, which held no other task' : ''}` }
     },
 })