rvlib-shipkit 1.9.0 → 2.0.1

package/src/ledger/gate-checks.ts

@@ -26,6 +26,7 @@ import { CHECK_TIMEOUT_MS, type RunnableCheck, type CheckBody } from '../core/ch
 import { FOREVER, ttlMsOf } from '../core/wire.ts'
 import { budgetOf } from '../core/budget.ts'
 import { repoOff, withRepoOff, whenSummary, type WhenDecl } from '../core/when.ts'
+import { HOOK_BUDGET_MS, HOOK_GATES, HOOK_GATES_OWNER, hookGateOff, type HookName } from '../hooks/hook-gates.ts'
 import { cacheText, filesText, NOWHERE, sourced, type CacheDecl, type ResolvedRuns, type Runs } from '../core/runs.ts'
 import { isNamesInput, type CheckDecl } from './git-key.ts'
 import { populationOf } from '../problems/problem-line.ts'
@@ -131,6 +132,9 @@ export type CheckRow = {
      *  `repo` = this repo declared it (a package.json script behind a floor
      *  slot, a task, a rule, a check file, a check file). */
     from: CheckFrom
+    /** a COMMIT GATE: the git hook that runs it (hooks/hook-gates.ts). The
+     *  runner never does, so every runner context reads false */
+    hook?: HookName
 }
 
 /** the one axis every check answers: who wrote the declaration */
@@ -348,15 +352,16 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
         // time is not judged and its answer never stands in for a quick one
         out.push({ row, runnable: runnableOf(row, taskBody(t), { unbudgeted: full }) })
     }
-    // a slot `defaults: { <id>: false }` turned off never resolves to a task,
-    // so without this it had no row at all: no `runs in` value, no reason, and
-    // a count of off checks that read zero while a gate step sat dark. It has
-    // no command, which is why it declares `never` rather than joining the
-    // burn-down of checks nobody has keyed yet.
+    // a slot the repo turned off never resolves to a task, so without this it
+    // had no row at all: no `runs in` value, no reason, and a count of off
+    // checks that read zero while a gate step sat dark. It has no command,
+    // which is why it declares `never` rather than joining the burn-down of
+    // checks nobody has keyed yet.
     for (const id of floor.disabled) {
-        const runs = sourced(NOWHERE, 'none', 'repo.config.ts', null, `defaults.${id}: false`)
+        const off = repoOff(c, id) ?? { reason: 'turned off', source: 'off' as const }
+        const runs = sourced(NOWHERE, 'none', 'repo.config.ts', null, off.reason)
         const row: CheckRow = {
-            decl: { id, never: `turned off by defaults.${id}: false, so there is no command to key` },
+            decl: { id, never: `the slot is off, so there is no command to key` },
             title: id,
             description: slotDescription(id, declaredTestUnits(c.units).length > 0),
             gate: false,
@@ -369,8 +374,8 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
             optIn: false,
             fixable: false,
             runs,
-            cache: `never: turned off by defaults.${id}: false`,
-            when: whenSummary(runs, { reason: `defaults.${id}: false`, source: 'defaults' }, false),
+            cache: `never: the slot is off`,
+            when: whenSummary(runs, off, false),
             deps: null,
             // the repo wrote the line that turned it off
             from: 'repo',
@@ -518,6 +523,37 @@ export async function composeChecks(root: string, c: RepoConfig, o: ComposeOpts
         const body: CheckBody = { cmd: ['bun', d.path], ...(task?.env == null ? {} : { env: task.env }), ...(task?.cwd == null ? {} : { cwd: resolve(root, task.cwd) }) }
         out.push({ row, runnable: runnableOf(row, body, { pointer: `bun ${rel}` }) })
     }
+    // THE COMMIT GATES: the git hooks run them (hooks/run-hooks.ts), never the
+    // runner, so a row here only makes them enumerable and `off` able to name
+    // them. They run in no runner context, and a run by name says where they run
+    for (const g of HOOK_GATES) {
+        const na = c.nested === true ? 'n/a here: a nested folder, the parent work tree owns the commit gates'
+            : g.id === 'blocked-paths' && (c.hooks?.blockedPaths ?? []).length === 0 ? 'n/a here: no hooks.blockedPaths declared' : null
+        const off = hookGateOff(c, g.id)
+        const hookWords = g.hook === 'both' ? 'the pre-commit and commit-msg hooks' : `the ${g.hook} hook`
+        const runs = withRepoOff(sourced(NOWHERE, 'none', 'derived', `a commit gate: ${hookWords} run it on every commit`, na), off)
+        const row: CheckRow = {
+            decl: { id: g.id, never: `a commit gate runs on the index at commit, never cached` },
+            title: g.title,
+            description: g.description,
+            gate: false,
+            build: false,
+            blocking: true,
+            owner: HOOK_GATES_OWNER,
+            group: null,
+            timeoutMs: null,
+            budgetMs: HOOK_BUDGET_MS,
+            optIn: false,
+            fixable: false,
+            runs,
+            cache: `never: ${hookWords}`,
+            when: whenSummary(runs, off, false, { hook: true }),
+            deps: null,
+            from: 'shipkit',
+            hook: g.hook,
+        }
+        out.push({ row, runnable: runnableOf(row, { run: (ctx) => ctx.note(`${g.id} runs in ${hookWords}, never in a gate: \`shipkit hooks list\` shows it`) }) })
+    }
     return out
 }
 

package/src/ledger/ledger.ts

@@ -273,9 +273,14 @@ export class Ledger {
     /** buffer what a check just measured. Nothing reaches the store until
      *  commit() has re-hashed the inputs (rule 2). A READS check with no read
      *  set (it reached the world) is never stored (rule 7). */
-    record(id: string, outcome: CheckOutcome, reads?: ReadSet | null, notKept?: string | null): void {
+    record(id: string, outcome: CheckOutcome, reads?: ReadSet | null, notKept?: string | null, waiverFiles: readonly string[] = []): void {
         const k = this.key(id)
         if (k.key == null) return
+        // a READS answer carries every waiving file in its read set. A
+        // CONTENT key moves only with its inputs, so a directive outside
+        // them could be added or removed under a stored answer
+        const outside = k.population === 'content' ? waiverFiles.find((f) => !k.inputOids.some(([p]) => p === '.' || f === p || f.startsWith(`${p}/`))) : undefined
+        if (outside != null) { this.ranWhy.set(id, { group: 'not kept', why: `a site in ${outside}, which an in-file directive can waive, sits outside its declared inputs` }); return }
         if (k.population === 'reads') {
             if (reads == null) { this.ranWhy.set(id, { group: 'not kept', why: notKept ?? 'it read outside what the cache can see' }); return }
             this.buffered.set(id, { ...outcome, reads, components: k.components })

package/src/ledger/repo-view.ts

@@ -7,8 +7,14 @@
 // Built once per run and shared: `c.list` in every check and the ledger's
 // replay check read the same snapshot, so a check never lists one tree and is
 // validated against another inside one run.
+//
+// A listing leaves out the repo's vendored dirs (core/vendored.ts), unless
+// its glob names a path inside one: a check never mistakes third party code
+// for the repo's own, and the replay check lists through the same filter.
 import { relative } from 'path'
 import { gitBin } from '../core/git-bin.ts'
+import { listingWithoutVendored } from '../core/vendored.ts'
+import { readVendored } from '../core/vendored-read.ts'
 import { GitScanError, scanPaths, WHOLE_TREE, type ScanResult } from './git-scan.ts'
 
 export class RepoView {
@@ -21,26 +27,30 @@ export class RepoView {
         readonly fallback: string | null,
         /** the scan it was read off, handed to the next open as its prior */
         readonly scan: ScanResult | null = null,
+        /** the repo's vendored dirs, as its config text declared them at open */
+        readonly vendored: readonly string[] = [],
     ) {}
 
     /** `prior`: an earlier view of the same root in this run. The tree is
      *  still staged and hashed fresh, so the list is today's, and an unchanged
      *  tree reuses the prior's answer */
     static open(root: string, prior?: RepoView | null): RepoView {
+        const vendored = readVendored(root)
         try {
             const scan = scanPaths(root, [WHOLE_TREE], prior?.scan ?? undefined, { treeOnly: true })
             const tree = scan.oidByPath.get(WHOLE_TREE)
             if (tree == null) throw new GitScanError('git could not name the work tree')
-            return new RepoView(filesOf(root, tree), null, scan)
+            return new RepoView(filesOf(root, tree), null, scan, vendored)
         } catch (e) {
-            return new RepoView(walk(root), e instanceof Error ? e.message : String(e))
+            return new RepoView(walk(root), e instanceof Error ? e.message : String(e), null, vendored)
         }
     }
 
-    /** the files matching `glob`, sorted */
+    /** the files matching `glob`, sorted, the vendored ones left out unless
+     *  the glob names a path inside one */
     list(glob: string): string[] {
         const g = new Bun.Glob(glob)
-        return this.files.filter((f) => g.match(f))
+        return listingWithoutVendored(this.files.filter((f) => g.match(f)), glob, this.vendored)
     }
 }
 

package/src/ledger/toolchain-identity.ts

@@ -328,8 +328,10 @@ export function toolchainIdentity(repoRoot: string, cliEntry: string): Toolchain
     // stands.
     const lib = new LibSource(cliEntry)
     const r = createHash('sha256')
-    // the runtime. Free, and a bun upgrade genuinely changes behaviour
-    r.update(`bun=${Bun.version}\n`)
+    // the runtime. Free, and a bun upgrade genuinely changes behaviour. The
+    // revision too: every canary of one version reports the same version,
+    // and a canary upgrade can change what `bun lint` reports
+    r.update(`bun=${Bun.version}+${Bun.revision}\n`)
     for (const l of runnerLines(lib, cliEntry)) r.update(`${l}\n`)
     return { id: r.digest('hex').slice(0, 16), install: installOf(root, lib), lib }
 }

package/src/mv/mv-md.ts

@@ -8,6 +8,8 @@
 import { execSync } from 'child_process'
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'fs'
 import { basename, dirname, join, relative } from 'path'
+import { isVendored } from '../core/vendored.ts'
+import { vendoredAround } from '../core/vendored-read.ts'
 
 export type MvIo = { print: (l: string) => void; printErr: (l: string) => void }
 export type MvOpts = { write?: boolean; commit?: boolean }
@@ -130,8 +132,11 @@ export function movePage(root: string, oldRel: string, newRel: string, io: MvIo,
     const bound = (t: string): RegExp =>
         new RegExp('(?<![\\w-])' + t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + (/[/.]$/.test(t) || t.endsWith('.ts') ? '' : '(?![\\w-])'), 'g')
 
+    // third party code keeps its own references, byte for byte
+    const repo = vendoredAround(root)
+    const vendored = (repo?.dirs ?? []).map((d) => posix(relative(root, join(repo!.root, d))))
     const tracked = sh('git ls-files', root).split('\n').filter(Boolean)
-        .filter((f) => !/\.(png|jpe?g|gif|webp|ico|woff2?|ttf|zip|gz|lockb|lock)$/i.test(f))
+        .filter((f) => !/\.(png|jpe?g|gif|webp|ico|woff2?|ttf|zip|gz|lockb|lock)$/i.test(f) && !isVendored(f, vendored))
 
     // every path this move relocates, old → new. The sibling dir carries its
     // whole subtree, and the probe is renamed after the page, so its own entry

package/src/problems/extract.ts

@@ -1,6 +1,8 @@
 // file:line findings out of what a check printed, one function per format the
-// floor meets: tsc, oxlint (both its piped and its graphical output), eslint's
-// stylish output, a failing bun test, and a shipkit wire line naming a file.
+// floor meets: tsc, bun lint (the unix format the built-in lint slot asks
+// for), oxlint (both its piped and its graphical output, kept while a repo
+// still lints with it: SK001 warns on one, and it dies with the last), eslint's stylish
+// output, a failing bun test, and a shipkit wire line naming a file.
 // Every one feeds the one Problem shape (problem-line.ts).
 //
 // a finding the source cannot anchor in a file is dropped rather than pinned
@@ -62,6 +64,20 @@ export function fromTsc(text: string, ctx: ExtractCtx): Problem[] {
     return out
 }
 
+const BUN_LINT_UNIX = /^(.+?):(\d+):(\d+): (.*) \[(Error|Warning)\/([^\]]+)\]$/
+
+/** bun lint `--format unix`: `src/a.ts:1:7: msg [Warning/no-unused-vars]` */
+export function fromBunLint(text: string, ctx: ExtractCtx): Problem[] {
+    const out: Problem[] = []
+    for (const raw of stripAnsi(text).split('\n')) {
+        const m = BUN_LINT_UNIX.exec(raw)
+        if (m == null) continue
+        const file = repoFile(ctx, m[1]!, false)
+        if (file != null) out.push({ file, line: Number(m[2]), col: Number(m[3]), severity: m[5] === 'Error' ? 'error' : 'warning', check: ctx.check, message: `${m[6]} ${m[4]!.trim()}` })
+    }
+    return out
+}
+
 const OXLINT_PIPED = /^(.+?):(\d+):(\d+): (error|warning) (\S+?): (.*)$/
 const OXLINT_HEAD = /^\s*(x|!|×|⚠)\s+(.+)$/
 const OXLINT_AT = /^\s*(?:,-|╭─)\[(.+):(\d+):(\d+)\]\s*$/
@@ -148,14 +164,20 @@ export function fromBunTest(text: string, ctx: ExtractCtx): Problem[] {
 
 const WIRE_REF = /((?:[\w@.~-]+\/)*[\w@.~-]+\.[A-Za-z0-9]+):(\d+)(?::(\d+))?/g
 
-/** a FAIL or WARN wire line naming `path:line` or `path:line:col`. The path
- *  must be a file this repo has: a url and a `host:port` look the same */
+/** a FAIL or WARN wire line: at the site the check reported when it gave one,
+ *  else at every `path:line` or `path:line:col` the text names. The path must
+ *  be a file this repo has: a url and a `host:port` look the same */
 export function fromWire(lines: Line[], ctx: ExtractCtx): Problem[] {
     const out: Problem[] = []
     for (const l of lines) {
         if (l.kind !== 'fail' && l.kind !== 'warn') continue
         const severity: Severity = l.kind === 'fail' ? 'error' : 'warning'
         const message = l.text.replace(/^\[[^\]]+\]\s*/, '').trim()
+        if (l.at != null) {
+            const file = repoFile(ctx, l.at.file, true)
+            if (file != null) out.push({ file, line: l.at.line ?? 1, col: l.at.col ?? 1, severity, check: ctx.check, message })
+            continue
+        }
         for (const m of l.text.matchAll(WIRE_REF)) {
             const before = l.text.slice(0, m.index)
             if (/[a-z]+:\/\/\S*$/i.test(before)) continue
@@ -173,7 +195,7 @@ export function extractProblems(src: { lines: Line[]; output?: string }, ctx: Ex
     const text = src.output ?? ''
     const all = [
         ...fromWire(src.lines, ctx),
-        ...(text === '' ? [] : [...fromTsc(text, ctx), ...fromOxlint(text, ctx), ...fromEslint(text, ctx), ...fromBunTest(text, ctx)]),
+        ...(text === '' ? [] : [...fromTsc(text, ctx), ...fromBunLint(text, ctx), ...fromOxlint(text, ctx), ...fromEslint(text, ctx), ...fromBunTest(text, ctx)]),
     ]
     const seen = new Set<string>()
     return all.filter((p) => {

package/src/problems/problem-line.ts

@@ -1,7 +1,6 @@
 // the ONE shape a problem takes on the hub terminal, and the vscode problem
-// matcher that reads it back. The printer and every tasks.json writer import
-// this file, so the line the hub prints and the regex the editor matches can
-// never drift apart.
+// matcher that reads it back, in one file so the two can never drift apart.
+// No house task carries the matcher any more (SK017 removes hub tasks).
 //
 // a run prints one FRAME: the begin line, one problem line per finding, the
 // end line. The matcher is a background one, so vscode clears the pane at the

package/src/release/run-release.ts

@@ -117,7 +117,7 @@ export async function runReleaseGate(root: string, config: RepoConfig, print: (l
     return await runCi(root, {
         fix: o.fix ?? false,
         // a check's repair never runs on the release path (runs.onRelease):
-        // only the mechanical slots (the formatter) may, when bump asks
+        // only the mechanical slots (the import fixer) may, when bump asks
         fixRules: false,
         // the rows declaring onRelease, whatever the tier
         release: true,
@@ -243,13 +243,7 @@ export async function releaseUnit(root: string, config: RepoConfig, unit: Releas
     const remoteName0 = 'remote' in remote ? remote.remote : null
     const tagExists = (): boolean => tagExistsLocally(root, tag)
     const remoteState: RemoteTagState = remoteName0 == null ? { state: 'unreadable', error: 'no remote' } : remoteTagState(root, remoteName0, tag)
-    if (remoteName0 != null && remoteState.state === 'unreadable')
-        blockers.push(`cannot read tags on '${remoteName0}' (${remoteState.error}) — the push would be a guess`)
-    // a tag NAME the remote already carries at another commit is not a
-    // resumable release: this version would describe a tree that shipped as
-    // something else, and git refuses the push anyway
-    if (remoteState.state === 'different')
-        blockers.push(`tag ${tag} already on '${remoteName0 ?? ''}' at ${remoteState.remoteOid.slice(0, 8)}, ${remoteState.localOid == null ? 'and not here at all' : `not ${remoteState.localOid.slice(0, 8)} as here`} — that version number is burnt, bump a new one`)
+    blockers.push(...tagBlockers(remoteName0, remoteState, tag))
     const ghReleaseExists = (): boolean =>
         wantGh && Bun.which('gh') != null && Bun.spawnSync(['gh', 'release', 'view', tag], { cwd: root }).exitCode === 0
     const fullyShipped = tagExists() && remoteState.state === 'same' && (!wantGh || ghReleaseExists()) && (!wantNpm || alreadyPublished)
@@ -365,3 +359,14 @@ export async function releaseUnit(root: string, config: RepoConfig, unit: Releas
         rmSync(work, { recursive: true, force: true })
     }
 }
+
+/** what the remote's view of the tag forbids: a remote nobody can read makes
+ *  the push a guess, and a tag NAME it already carries at another commit is not
+ *  a resumable release (this version would describe a tree that shipped as
+ *  something else, and git refuses the push anyway) */
+export function tagBlockers(remote: string | null, state: RemoteTagState, tag: string): string[] {
+    if (remote != null && state.state === 'unreadable') return [`cannot read tags on '${remote}' (${state.error}) — the push would be a guess`]
+    if (state.state === 'different')
+        return [`tag ${tag} already on '${remote ?? ''}' at ${state.remoteOid.slice(0, 8)}, ${state.localOid == null ? 'and not here at all' : `not ${state.localOid.slice(0, 8)} as here`} — that version number is burnt, bump a new one`]
+    return []
+}

package/src/repo-config.ts

@@ -5,21 +5,21 @@
 // (lint/typecheck/test/imports:check/cycles): a package.json script wins;
 // with no script, imports:check/cycles fill from shipkit's own
 // rvlib-ts-tools dep and typecheck from the repo's tsc (O6 zero-config);
-// a slot that can't fill emits a visible reason, disabling via
-// `defaults: { x: false }` prints a skipped-by-config line — never silence.
+// a slot that can't fill emits a visible reason, and one turned off with
+// `off: { x: '<why>' }` prints a skipped-by-config line, never silence.
 // The `contracts` task is always present when any contract applies.
-import { existsSync } from 'fs'
+import { existsSync, readFileSync } from 'fs'
 import { isAbsolute, join, normalize } from 'path'
 import { ROUTED_SCRIPTS } from './core/canonical-scripts.ts'
 import { FLOOR_IDS } from './core/floor.ts'
 export { resolveFloor, type FloorResolution, type FloorSource } from './core/floor.ts'
 import type { ContractManifest } from './contracts/contract-types.ts'
-import type { ProseConfig } from './prose/run-prose.ts'
-import { proseWordsProblems } from './prose/ste.ts'
 import { validateSmokeConfig, type SmokeConfig } from './smoke/run-smoke.ts'
 import { RULE_ID_RE, validateRules } from './rules/rule.ts'
 import { builtinCheckIds } from './core/discover-checks.ts'
+import { RETIRED_CHECK_IDS } from './core/retired-checks.ts'
 import { parseWhen } from './core/when.ts'
+import { normalizeVendored, vendoredOfText, vendoredProblem } from './core/vendored.ts'
 import { budgetValueProblem } from './core/budget.ts'
 import type { Rule } from './check.ts'
 import { leakAllowProblems } from './hooks/leak-guard.ts'
@@ -80,12 +80,13 @@ export type RepoConfig = {
     social?: string[]
     /** prefix for contract fix: pointers (docs checkout or URL) — written by init, never baked in */
     docsBase?: string
-    /** a floor slot: `false` disables it (always visible), a def with a
-     *  `cmd` or `logic` REPLACES it, and a def with neither DECORATES whatever
-     *  fills it. The decoration is how a repo declares what its own `test`
-     *  script reads (`{ test: { inputs: ['tests', 'src'] } }`) without
-     *  restating the command: the read set is repo knowledge, the command is
-     *  already in package.json, and restating it is a second source of truth. */
+    /** a floor slot: a def with a `cmd` or `logic` REPLACES it, and a def
+     *  with neither DECORATES whatever fills it. The decoration is how a repo
+     *  declares what its own `test` script reads (`{ test: { inputs:
+     *  ['tests', 'src'] } }`) without restating the command: the read set is
+     *  repo knowledge, the command is already in package.json, and restating
+     *  it is a second source of truth. A slot set to `false` is RETIRED, read
+     *  as `off` while SK029 ports it there: a slot turns off like any check */
     defaults?: Record<string, Partial<TaskDef> | false>
     /** DEPRECATED, read through 0.40 and rewritten by `shipkit check --fix
      *  SK016`: a build step is a `<name>.check.ts` file with `build: true` */
@@ -167,10 +168,10 @@ export type RepoConfig = {
      *  folder only: it never commits, untracks, tags or pushes on the parent's
      *  history. Rule SK015 fails when this and the disk disagree (core/nesting.ts) */
     nested?: boolean
-    /** THE CHECKS THIS REPO TURNS OFF, check id → why. The one thing a repo
-     *  says about a check it does not own: where a check runs is its own
-     *  declaration (build/shipkit/runs.md), and an off check runs in no
-     *  context. `defineRepo` throws on a blank reason and on a rule id no
+    /** THE CHECKS THIS REPO TURNS OFF, check id → why, for a whole check it
+     *  does not own (one false finding is waived at its site instead): where
+     *  a check runs is its own declaration (build/shipkit/runs.md), and an
+     *  off check runs in no context. `defineRepo` throws on a blank reason and on a rule id no
      *  check carries. The hub writes this map through the managed block in
      *  this file (core/when-block.ts). */
     off?: Record<string, string>
@@ -251,6 +252,18 @@ export type RepoConfig = {
      *  repo root is refused outright: a single line that excuses everything
      *  would turn a blocking rule into a false green. */
     notReleasable?: string[]
+    /** repo-relative dirs of THIRD PARTY code (a git subtree, a copied
+     *  library) that must stay byte identical to upstream. Every tool that
+     *  treats the tree as the repo's own source leaves them out: the import
+     *  fixer and its package discovery, imports:check, cycles, the fix pass
+     *  (a fixer that rewrites a file under one gets it put back, with a
+     *  WARN naming it), bun lint, the checks' file
+     *  listings, check discovery, the md scan and `shipkit mv`. Cache keys
+     *  and watchers still read them, because they are still inputs, and the
+     *  leak guard still scans what a commit stages there. Write it
+     *  as a literal array of strings: the tools that never load this file
+     *  read it as text. One entry is one dir, never a glob */
+    vendored?: string[]
     /** git-hook gates: built-in leak guard + commit-message predicate, plus the
      *  repo's own commands. `shipkit hooks list` enumerates them, so what blocks
      *  a commit is answerable without reading shell. hooks/run-hooks.ts */
@@ -263,12 +276,6 @@ export type RepoConfig = {
         /** what a `*.check.ts` with no `export const blocking` means here */
         blocking?: boolean
     }
-    /** house prose in STE (identity/writing-voice.md), gated by rule SK014.
-     *  `include` is what makes the rule run at all: a repo that declares no
-     *  scope is skipped rather than failed, because STE binds the prose an
-     *  agent WRITES and no repo can be opted in from the outside.
-     *  prose/run-prose.ts */
-    prose?: ProseConfig
     /** `shipkit smoke`: the deployed url, the routes a read only browser pass
      *  visits after a deploy, and how it logs in. The password is a secret
      *  NAME: the value never sits in config, argv or env. smoke/run-smoke.ts */
@@ -300,7 +307,7 @@ export type RepoConfig = {
     logDir?: string
 }
 
-const KNOWN_KEYS = new Set(['name', 'venues', 'social', 'docsBase', 'defaults', 'tasks', 'asks', 'creds', 'credsCommand', 'credsReadCommand', 'notifyCommand', 'contracts', 'gitignore', 'ignoredInputs', 'untrackGenerated', 'nested', 'off', 'when', 'budgets', 'ruleExempt', 'visibility', 'archived', 'reviewer', 'oneWayIn', 'rules', 'release', 'units', 'notReleasable', 'hooks', 'checkDefaults', 'tui', 'serve', 'identity', 'logDir', 'prose', 'smoke', 'tests'])
+const KNOWN_KEYS = new Set(['name', 'venues', 'social', 'docsBase', 'defaults', 'tasks', 'asks', 'creds', 'credsCommand', 'credsReadCommand', 'notifyCommand', 'contracts', 'gitignore', 'ignoredInputs', 'untrackGenerated', 'nested', 'off', 'when', 'budgets', 'ruleExempt', 'visibility', 'archived', 'reviewer', 'oneWayIn', 'rules', 'release', 'units', 'notReleasable', 'vendored', 'hooks', 'checkDefaults', 'tui', 'serve', 'identity', 'logDir', 'smoke', 'tests'])
 
 export function defineRepo(c: RepoConfig): RepoConfig {
     if (typeof c.name !== 'string' || c.name === '') throw new Error('defineRepo: name is required')
@@ -324,7 +331,7 @@ export function defineRepo(c: RepoConfig): RepoConfig {
     // gate is exactly the never-silence failure mode (A23)
     for (const k of Object.keys(c))
         if (!KNOWN_KEYS.has(k))
-            throw new Error(`defineRepo: unknown key '${k}'${k === 'checks' ? ` — checks:[] was removed; drop a <name>.check.ts file instead ('shipkit check' auto-discovers it)` : k === 'home' ? ` — home.resources was removed; declare each one in a <name>.shipkit.ts file as \`export default globalProcess({...})\`` : ''}`)
+            throw new Error(`defineRepo: unknown key '${k}'${k === 'checks' ? ` — checks:[] was removed; drop a <name>.check.ts file instead ('shipkit check' auto-discovers it)` : k === 'home' ? ` — home.resources was removed; declare each one in a <name>.shipkit.ts file as \`export default globalProcess({...})\`` : k === 'prose' ? ` — prose was removed with rule SK014: delete the key` : ''}`)
     if (c.release?.publisher != null && !(PUBLISHERS as readonly string[]).includes(c.release.publisher))
         throw new Error(`defineRepo: release.publisher '${String(c.release.publisher)}' is not a publisher (${PUBLISHERS.join(', ')})`)
     // a typo'd unit key would silently drop a target and release the wrong shape
@@ -348,6 +355,11 @@ export function defineRepo(c: RepoConfig): RepoConfig {
         if (isAbsolute(d) || rel === '.' || rel === '' || rel === '..' || rel.startsWith('../'))
             throw new Error(`defineRepo: notReleasable '${d}' is the repo root or outside it, and would excuse every package at once — name one package dir per entry`)
     }
+    if (c.vendored != null && !Array.isArray(c.vendored)) throw new Error(`defineRepo: vendored is a list of repo-relative dirs`)
+    for (const d of c.vendored ?? []) {
+        const bad = vendoredProblem(d)
+        if (bad != null) throw new Error(`defineRepo: vendored '${String(d)}' ${bad}`)
+    }
     for (const [k, slot] of Object.entries(c.defaults ?? {})) {
         if (!(FLOOR_IDS as readonly string[]).includes(k))
             throw new Error(`defineRepo: defaults.${k} is not a floor task (floor: ${FLOOR_IDS.join(', ')})`)
@@ -385,6 +397,7 @@ export function defineRepo(c: RepoConfig): RepoConfig {
     for (const [id, reason] of Object.entries(c.off ?? {})) {
         if (id.trim() === '') throw new Error(`defineRepo: off has an entry with no check id`)
         if (typeof reason !== 'string' || reason.trim() === '') throw new Error(`defineRepo: off.${id} needs a reason: a check nobody can explain is a silenced gate`)
+        if (RETIRED_CHECK_IDS[id] != null) throw new Error(`defineRepo: off.${id} names a retired rule (${RETIRED_CHECK_IDS[id]}): delete the entry`)
         if (RULE_ID_RE.test(id) && !builtinCheckIds().includes(id) && !(c.rules ?? []).some((r) => r.id === id))
             throw new Error(`defineRepo: off.${id} names no rule, the ids are in \`shipkit checks\``)
     }
@@ -403,15 +416,12 @@ export function defineRepo(c: RepoConfig): RepoConfig {
     }
     // an exemption silences a gate, so it names a rule that exists and says why
     for (const [id, reason] of Object.entries(c.ruleExempt ?? {})) {
+        if (RETIRED_CHECK_IDS[id] != null) throw new Error(`defineRepo: ruleExempt.${id} names a retired rule (${RETIRED_CHECK_IDS[id]}): delete the entry`)
         if (!builtinCheckIds().includes(id) && !(c.rules ?? []).some((r) => r.id === id))
             throw new Error(`defineRepo: ruleExempt.${id} names no rule, the ids are in \`shipkit checks\``)
         if (typeof reason !== 'string' || reason.trim() === '')
             throw new Error(`defineRepo: ruleExempt.${id} needs a reason, an exemption nobody can explain is a silenced gate`)
     }
-    // a word list entry silences or adds gate hits, so a malformed one dies
-    // here rather than matching nothing
-    const words = proseWordsProblems(c.prose?.words)
-    if (words.length > 0) throw new Error(`defineRepo: ${words[0]}`)
     // a smoke typo would land as a run that visits nothing and exits 0
     if (c.smoke != null) validateSmokeConfig(c.smoke)
     // a leak-guard waiver is the one config row that can make a gate quieter,
@@ -439,5 +449,12 @@ export async function loadRepoConfig(root: string, o: { fresh?: boolean } = {}):
     if (!existsSync(path)) throw new Error(`no repo.config.ts in ${root} — run: shipkit init`)
     const mod = (await import(o.fresh === true ? `${path}?v=${Date.now()}-${Math.random().toString(36).slice(2)}` : path)) as { default?: RepoConfig }
     if (mod.default == null) throw new Error(`${path}: must default-export defineRepo({...})`)
+    // the tools that never load the config read `vendored` off the text, so
+    // a value the text cannot show would omit one set of dirs here and
+    // another there
+    const loaded = (mod.default.vendored ?? []).map(normalizeVendored)
+    const read = vendoredOfText(readFileSync(path, 'utf8'))
+    if (loaded.join('\0') !== read.join('\0'))
+        throw new Error(`${path}: \`vendored\` must be a literal array of strings, the tools that never load the config read it as text (they read [${read.join(', ')}], the config says [${loaded.join(', ')}])`)
     return mod.default
 }

package/src/scaffold/files/bunfig.toml

@@ -0,0 +1,11 @@
+# `bun lint` is the house linter, and `sk ci` runs it once [lint] is declared.
+# [fmt] is the house style for a manual `bun fmt`: nothing formats in the gate.
+[fmt]
+semi = false
+singleQuote = true
+printWidth = 140
+tabWidth = 4
+# code only: prose keeps its own shape, and package.json belongs to its fixers
+ignorePatterns = ["*.md", "*.json", "*.jsonc", "*.yaml", "*.yml", "*.toml"]
+
+[lint]

package/src/scaffold/files/vscode-settings.json

@@ -33,8 +33,7 @@
    "js/ts.tsserver.automaticTypeAcquisition.enabled": false,
    "js/ts.tsserver.checkNpmIsInstalled": false,
 
-   // oxc lints in-editor; eslint off; formatter owns formatting, not tsserver
-   "oxc.enable": true,
+   // eslint off, and no formatter on save: formatting is a manual `bun fmt`
    "eslint.enable": false,
    "js/ts.format.enabled": false
 }

package/src/scaffold/jsonc-spans.ts

@@ -111,3 +111,19 @@ export function removalSpan(text: string, arr: Extract<Node, { kind: 'array' }>,
     }
     return [item.start, item.end]
 }
+
+/** the spans that take several items out of one array at once, disjoint so
+ *  they apply in any order. An item with a kept one after it goes with its own
+ *  comma, and the removed run after the last kept item goes as one span from
+ *  that item's end, so no comma is left dangling */
+export function removalSpans(text: string, arr: Extract<Node, { kind: 'array' }>, idxs: Iterable<number>): [number, number][] {
+    const gone = new Set(idxs)
+    if (gone.size === 0) return []
+    const kept = arr.items.flatMap((_, i) => (gone.has(i) ? [] : [i]))
+    const lastKept = kept.at(-1) ?? -1
+    const spans: [number, number][] = []
+    for (const i of [...gone].sort((a, b) => a - b)) if (i < lastKept) spans.push(removalSpan(text, arr, i))
+    const tail = [...gone].filter((i) => i > lastKept).sort((a, b) => a - b)
+    if (tail.length > 0) spans.push([lastKept < 0 ? arr.items[tail[0]!]!.start : arr.items[lastKept]!.end, arr.items[tail.at(-1)!]!.end])
+    return spans
+}