upstreamfix 0.1.2 → 0.1.3

package/dist/core/verify.js

@@ -3,9 +3,11 @@ import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile
 import os from 'node:os';
 import path from 'node:path';
 import { promisify } from 'node:util';
+import { StringDecoder } from 'node:string_decoder';
 import { applyPatch, parsePatch } from 'diff';
 import { registerTemporaryCleanup, terminateProcessGroup, trackProcessGroup } from './process-cleanup.js';
-const ignoredDirectories = new Set(['.git', 'node_modules', 'dist', 'coverage', '.next', '.nuxt', '.turbo', '.cache', '.codex', '.claude']);
+import { IGNORED_PROJECT_DIRECTORIES } from './project-discovery.js';
+import { parseManifest } from './manifest.js';
 const ignoredFiles = new Set(['.npmrc', '.yarnrc', '.yarnrc.yml', '.pnpmfile.cjs', '.pnpmfile.mjs', 'yarn.config.cjs']);
 const maxOutputLength = 4_000;
 const maxCopyBytes = 100 * 1024 * 1024;
@@ -19,11 +21,14 @@ export async function verifyProposedMigration(cwd, diffs, options = {}) {
     const temporaryRoot = await mkdtemp(path.join(os.tmpdir(), 'upstreamfix-verify-'));
     const projectCopy = path.join(temporaryRoot, 'project');
     const isolatedHome = path.join(temporaryRoot, 'home');
+    const persistentPnpmStore = options.pnpmCacheRoot ?? path.join(os.homedir(), '.cache', 'upstreamfix', 'pnpm-store');
     const checks = [];
     const unregisterCleanup = registerTemporaryCleanup(() => rm(temporaryRoot, { recursive: true, force: true }));
     try {
         await mkdir(projectCopy, { recursive: true });
         await mkdir(isolatedHome, { recursive: true });
+        // This cache is unique to the invocation and removed before returning. Project
+        // scripts never receive the user's npm cache path or credentials through env.
         await mkdir(path.join(isolatedHome, 'npm-cache'), { recursive: true });
         await Promise.all([
             writeFile(path.join(isolatedHome, 'npmrc.user'), '', 'utf8'),
@@ -42,6 +47,7 @@ export async function verifyProposedMigration(cwd, diffs, options = {}) {
         const env = sanitizedEnvironment(isolatedHome);
         const installChecks = [];
         const installDirs = new Set(packageDirs);
+        const installedRoots = new Set();
         const rootPackage = await readPackageJson(projectCopy).catch(() => undefined);
         if (rootPackage && (rootPackage.scripts?.typecheck || rootPackage.scripts?.test || rootPackage.workspaces) && hasDependencies(rootPackage)) {
             installDirs.add(projectCopy);
@@ -51,6 +57,24 @@ export async function verifyProposedMigration(cwd, diffs, options = {}) {
             if (!hasDependencies(pkg))
                 continue;
             const plan = await installCommand(projectCopy, directory, pkg);
+            if (installedRoots.has(plan.cwd))
+                continue;
+            installedRoots.add(plan.cwd);
+            if (plan.command === 'yarn' && plan.yarnMajor && plan.yarnMajor >= 2) {
+                const versionCheck = await runCheck('Check Yarn version', 'yarn', ['--version'], plan.cwd, env, timeoutMs, options.execute);
+                checks.push(versionCheck);
+                const actualMajor = Number(/^\s*(\d+)\./.exec(versionCheck.output)?.[1]);
+                if (versionCheck.status !== 'passed' || !(actualMajor >= 2) || (plan.yarnExact && actualMajor !== plan.yarnMajor)) {
+                    return { status: 'failed', checks, note: `Yarn ${plan.yarnMajor} is required by this project, but the temporary copy resolved ${versionCheck.output || 'an unknown version'}. Dependency installation was refused.` };
+                }
+            }
+            if (plan.command === 'pnpm') {
+                const cacheInfo = await lstat(persistentPnpmStore).catch(() => undefined);
+                if (cacheInfo?.isSymbolicLink() || (cacheInfo && !cacheInfo.isDirectory()))
+                    throw new Error('The private pnpm cache path is not a regular directory.');
+                await mkdir(persistentPnpmStore, { recursive: true, mode: 0o700 });
+                plan.args.push('--store-dir', persistentPnpmStore, '--prefer-offline');
+            }
             const installLabel = path.relative(projectCopy, plan.cwd) || '.';
             const check = await runCheck(`Install dependencies (${installLabel})`, plan.command, plan.args, plan.cwd, env, timeoutMs, options.execute);
             installChecks.push(check);
@@ -103,26 +127,26 @@ export async function verifyProposedMigration(cwd, diffs, options = {}) {
         await rm(temporaryRoot, { recursive: true, force: true });
     }
 }
-async function copyProject(source, destination) {
+export async function copyProject(source, destination, operation = '--verify') {
     let listing;
     try {
         ({ stdout: listing } = await execFile('git', [
             '-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false', 'ls-files', '-co', '--exclude-standard', '-z',
         ], {
             cwd: source,
-            env: { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: os.tmpdir(), GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: os.devNull, GIT_TERMINAL_PROMPT: '0' },
+            env: { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: process.env.HOME ?? os.homedir(), GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' },
             timeout: 15_000,
             maxBuffer: 8 * 1024 * 1024,
         }));
     }
     catch {
-        throw new Error('--verify requires a Git working tree so ignored and untracked files can be excluded safely.');
+        throw new Error(`${operation} requires a Git working tree so ignored and untracked files can be excluded safely.`);
     }
     let totalBytes = 0;
     for (const relative of listing.split('\0').filter(Boolean)) {
         const portable = relative.replaceAll('\\', '/');
         const parts = portable.split('/');
-        if (parts.some((part) => ignoredDirectories.has(part))
+        if (parts.some((part) => IGNORED_PROJECT_DIRECTORIES.has(part))
             || ignoredFiles.has(parts.at(-1)) || isSensitivePath(portable))
             continue;
         const sourcePath = path.resolve(source, relative);
@@ -186,6 +210,17 @@ export async function applyProposedFiles(projectCopy, changes) {
         if (seen.has(key))
             throw new Error(`A proposed change contains a duplicate path: ${change.relativePath}`);
         seen.add(key);
+        let ancestor = root;
+        for (const component of relative.split(path.sep)) {
+            ancestor = path.join(ancestor, component);
+            const info = await lstat(ancestor).catch((error) => {
+                if (error.code === 'ENOENT')
+                    return undefined;
+                throw error;
+            });
+            if (info?.isSymbolicLink())
+                throw new Error(`A proposed change crosses a symbolic link: ${change.relativePath}`);
+        }
         const current = await readFile(absolute, 'utf8').catch(() => undefined);
         if (current !== change.before)
             throw new Error(`The temporary project does not match the migration input for ${change.relativePath}.`);
@@ -197,7 +232,9 @@ async function findRelevantPackageDirs(root, packageName) {
     const manifests = await findPackageFiles(root);
     const packageDirs = [];
     for (const manifestPath of manifests) {
-        const pkg = await readPackageJson(path.dirname(manifestPath));
+        const pkg = await readPackageJson(path.dirname(manifestPath)).catch(() => undefined);
+        if (!pkg)
+            continue;
         if (['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
             .some((section) => typeof pkg[section] === 'object'
             && pkg[section]?.[packageName])) {
@@ -227,7 +264,7 @@ async function findPackageFiles(root) {
                 continue;
             const absolute = path.join(directory, entry.name);
             if (entry.isDirectory()) {
-                if (!ignoredDirectories.has(entry.name))
+                if (!IGNORED_PROJECT_DIRECTORIES.has(entry.name))
                     await visit(absolute);
             }
             else if (entry.isFile() && entry.name === 'package.json')
@@ -238,26 +275,14 @@ async function findPackageFiles(root) {
     return found;
 }
 async function readPackageJson(directory) {
-    return JSON.parse(await readFile(path.join(directory, 'package.json'), 'utf8'));
+    return parseManifest(await readFile(path.join(directory, 'package.json'), 'utf8'));
 }
 function hasDependencies(pkg) {
     return ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
         .some((section) => Object.keys(pkg[section] ?? {}).length > 0);
 }
 async function installCommand(root, directory, pkg) {
-    const lockRoot = await findLockfileRoot(root, directory);
-    const lockfile = await findLockfileName(lockRoot);
-    const rootPackage = await readPackageJson(lockRoot).catch(() => undefined);
-    const declared = pkg.packageManager ?? rootPackage?.packageManager;
-    let manager;
-    if (declared === undefined)
-        manager = lockfile === 'pnpm-lock.yaml' ? 'pnpm' : lockfile === 'yarn.lock' ? 'yarn' : 'npm';
-    else {
-        if (typeof declared !== 'string' || !/^(npm|pnpm|yarn)@\d+\.\d+\.\d+(?:\+sha\d+\.[0-9a-f]+)?$/.test(declared)) {
-            throw new Error(`Unsupported or unsafe packageManager field: ${String(declared)}. Use an exact npm, pnpm, or Yarn version.`);
-        }
-        manager = declared.slice(0, declared.indexOf('@'));
-    }
+    const { lockRoot, manager, declared } = await detectPackageManager(root, directory, pkg);
     if (manager === 'pnpm')
         return { command: 'pnpm', args: ['install', '--ignore-scripts', '--no-frozen-lockfile'], cwd: lockRoot };
     if (manager === 'yarn') {
@@ -265,8 +290,9 @@ async function installCommand(root, directory, pkg) {
         const yarnBerry = version >= 2 || (await readFile(path.join(lockRoot, 'yarn.lock'), 'utf8').catch(() => '')).includes('__metadata:');
         return {
             command: 'yarn',
-            args: ['install', '--non-interactive', ...(yarnBerry ? ['--mode=skip-builds'] : ['--ignore-scripts'])],
+            args: ['install', ...(yarnBerry ? ['--mode=skip-builds'] : ['--ignore-scripts'])],
             cwd: lockRoot,
+            ...(yarnBerry ? { yarnMajor: Math.max(version, 2), yarnExact: version >= 2 } : {}),
         };
     }
     return { command: 'npm', args: ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-offline'], cwd: lockRoot };
@@ -280,7 +306,7 @@ async function findLockfileRoot(root, directory) {
             break;
         current = path.dirname(current);
     }
-    return root;
+    return directory;
 }
 async function findLockfileName(directory) {
     for (const name of ['pnpm-lock.yaml', 'yarn.lock', 'package-lock.json', 'npm-shrinkwrap.json']) {
@@ -295,22 +321,34 @@ async function findLockfileName(directory) {
     return undefined;
 }
 async function scriptCommand(root, directory, pkg, script) {
-    const lockRoot = await findLockfileRoot(root, directory);
-    const lockfile = await findLockfileName(lockRoot);
-    const rootPackage = await readPackageJson(lockRoot).catch(() => undefined);
-    const manager = pkg.packageManager?.split('@')[0] ?? rootPackage?.packageManager?.split('@')[0]
-        ?? (lockfile === 'pnpm-lock.yaml' ? 'pnpm' : lockfile === 'yarn.lock' ? 'yarn' : 'npm');
+    const { manager } = await detectPackageManager(root, directory, pkg);
     if (manager === 'pnpm')
         return { command: 'pnpm', args: ['run', script] };
     if (manager === 'yarn')
         return { command: 'yarn', args: ['run', script] };
     return { command: 'npm', args: ['--ignore-scripts', 'run', script] };
 }
+async function detectPackageManager(root, directory, pkg) {
+    const lockRoot = await findLockfileRoot(root, directory);
+    const lockfile = await findLockfileName(lockRoot);
+    const rootPackage = await readPackageJson(lockRoot).catch(() => undefined);
+    const declared = pkg.packageManager ?? rootPackage?.packageManager;
+    if (declared !== undefined && (typeof declared !== 'string' || !/^(npm|pnpm|yarn)@\d+\.\d+\.\d+(?:\+sha\d+\.[0-9a-f]+)?$/.test(declared))) {
+        throw new Error(`Unsupported or unsafe packageManager field: ${String(declared)}. Use an exact npm, pnpm, or Yarn version.`);
+    }
+    const manager = declared === undefined
+        ? lockfile === 'pnpm-lock.yaml' ? 'pnpm' : lockfile === 'yarn.lock' ? 'yarn' : 'npm'
+        : declared.slice(0, declared.indexOf('@'));
+    return { lockRoot, manager, ...(typeof declared === 'string' ? { declared } : {}) };
+}
 async function runCheck(name, command, args, cwd, env, timeoutMs, execute) {
     const start = Date.now();
     const commandText = [command, ...args].join(' ');
     try {
         const result = execute ? await execute(command, args, cwd, env, timeoutMs) : undefined;
+        if (execute && result === undefined && name.startsWith('Install dependencies')) {
+            throw new Error('The supplied executor did not provide an installation result; refusing to run a real package install.');
+        }
         const output = result ?? await executeWithProcessGroup(command, args, cwd, env, timeoutMs);
         return { name, command: commandText, status: 'passed', durationMs: Date.now() - start, output: truncate(`${output.stdout ?? ''}${output.stderr ?? ''}`) };
     }
@@ -321,7 +359,7 @@ async function runCheck(name, command, args, cwd, env, timeoutMs, execute) {
         return { name, command: commandText, status: 'failed', durationMs: Date.now() - start, output: truncate(`${timedOut ? 'Timed out. ' : ''}${output}`) };
     }
 }
-async function executeWithProcessGroup(command, args, cwd, env, timeoutMs) {
+export async function executeWithProcessGroup(command, args, cwd, env, timeoutMs) {
     return new Promise((resolve, reject) => {
         const child = spawn(command, args, {
             cwd,
@@ -333,69 +371,52 @@ async function executeWithProcessGroup(command, args, cwd, env, timeoutMs) {
         const unregisterGroup = child.pid ? trackProcessGroup(child.pid) : () => undefined;
         let stdout = '';
         let stderr = '';
-        let timedOut = false;
+        const stdoutDecoder = new StringDecoder('utf8');
+        const stderrDecoder = new StringDecoder('utf8');
         let settled = false;
-        let killTimer;
         const timeout = setTimeout(() => {
-            timedOut = true;
-            signalProcessGroup(child, 'SIGTERM');
-            killTimer = setTimeout(() => signalProcessGroup(child, 'SIGKILL'), 750);
+            void finish(new Error(`Command exceeded its ${timeoutMs} ms timeout.`), true);
         }, timeoutMs);
         const append = (current, chunk) => {
-            const remaining = 2 * 1024 * 1024 - Buffer.byteLength(current);
-            return remaining <= 0 ? current : current + chunk.toString('utf8').slice(0, remaining);
+            const marker = '\n… [middle of command output omitted] …\n';
+            const limit = 2 * 1024 * 1024;
+            const next = current + chunk;
+            if (next.length <= limit)
+                return next;
+            const middle = current.indexOf(marker);
+            const head = middle >= 0 ? current.slice(0, middle) : next.slice(0, limit / 2);
+            return head + marker + next.slice(-limit / 2);
         };
-        child.stdout?.on('data', (chunk) => { stdout = append(stdout, chunk); });
-        child.stderr?.on('data', (chunk) => { stderr = append(stderr, chunk); });
-        const finish = (error) => {
+        child.stdout?.on('data', (chunk) => { stdout = append(stdout, stdoutDecoder.write(chunk)); });
+        child.stderr?.on('data', (chunk) => { stderr = append(stderr, stderrDecoder.write(chunk)); });
+        const finish = async (error, timedOut = false) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timeout);
-            if (killTimer)
-                clearTimeout(killTimer);
-            if (error)
-                reject(error);
-        };
-        child.once('error', async (error) => {
-            if (child.pid)
-                await terminateProcessGroup(child.pid, 0);
-            unregisterGroup();
-            const failure = Object.assign(error, { stdout, stderr, timedOut });
-            finish(failure);
-        });
-        child.once('close', async (code, signal) => {
+            if (!timedOut)
+                await new Promise((done) => setTimeout(done, 50));
+            stdout = append(stdout, stdoutDecoder.end());
+            stderr = append(stderr, stderrDecoder.end());
             if (child.pid)
-                await terminateProcessGroup(child.pid);
+                await terminateProcessGroup(child.pid, timedOut ? 100 : 0);
+            child.stdout?.destroy();
+            child.stderr?.destroy();
             unregisterGroup();
-            if (timedOut) {
-                finish(Object.assign(new Error(`Command exceeded its ${timeoutMs} ms timeout.`), { code: 'ETIMEDOUT', stdout, stderr, timedOut: true }));
-            }
-            else if (code === 0) {
-                finish();
+            if (error)
+                reject(Object.assign(error, { stdout, stderr, ...(timedOut ? { code: 'ETIMEDOUT', timedOut: true } : {}) }));
+            else
                 resolve({ stdout, stderr });
-            }
-            else {
-                finish(Object.assign(new Error(`Command exited with ${signal ? `signal ${signal}` : `code ${code}`}.`), { stdout, stderr }));
-            }
+        };
+        child.once('error', (error) => {
+            void finish(error);
+        });
+        child.once('exit', (code, signal) => {
+            void finish(code === 0 ? undefined : new Error(`Command exited with ${signal ? `signal ${signal}` : `code ${code}`}.`));
         });
     });
 }
-function signalProcessGroup(child, signal) {
-    if (!child.pid)
-        return;
-    try {
-        if (process.platform === 'win32')
-            child.kill(signal);
-        else
-            process.kill(-child.pid, signal);
-    }
-    catch (error) {
-        if (error.code !== 'ESRCH')
-            child.kill(signal);
-    }
-}
-function sanitizedEnvironment(home) {
+export function sanitizedEnvironment(home) {
     const allowed = new Set(['PATH', 'SYSTEMROOT', 'WINDIR', 'TMP', 'TEMP', 'TMPDIR', 'LANG', 'LC_ALL', 'TZ']);
     const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => allowed.has(key)));
     env.HOME = home;
@@ -403,13 +424,24 @@ function sanitizedEnvironment(home) {
     env.NPM_CONFIG_USERCONFIG = path.join(home, 'npmrc.user');
     env.NPM_CONFIG_GLOBALCONFIG = path.join(home, 'npmrc.global');
     env.NPM_CONFIG_CACHE = path.join(home, 'npm-cache');
+    env.NPM_CONFIG_IGNORE_SCRIPTS = 'true';
+    env.YARN_IGNORE_SCRIPTS = 'true';
+    env.YARN_NODE_LINKER = 'node-modules';
+    env.YARN_ENABLE_SCRIPTS = 'false';
     env.CI = '1';
     env.COREPACK_ENABLE_UNSAFE_CUSTOM_URLS = '0';
+    env.COREPACK_ENABLE_PROJECT_SPEC = '0';
+    env.COREPACK_ENABLE_AUTO_PIN = '0';
+    env.COREPACK_HOME = path.join(home, 'corepack');
     return env;
 }
 function truncate(output) {
     const trimmed = output.trim();
-    return trimmed.length <= maxOutputLength ? trimmed : `${trimmed.slice(0, maxOutputLength)} … [truncated]`;
+    if (trimmed.length <= maxOutputLength)
+        return trimmed;
+    const marker = '\n… [truncated middle; beginning and end retained] …\n';
+    const headLength = Math.floor((maxOutputLength - marker.length) / 2);
+    return trimmed.slice(0, headLength) + marker + trimmed.slice(-(maxOutputLength - marker.length - headLength));
 }
 async function fileExists(file) {
     try {

package/dist/core/watch.js

@@ -0,0 +1,81 @@
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+function exactVersion(value) {
+    return typeof value === 'string' && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
+}
+export async function readBoundedJson(url, maxBytes = 2 * 1024 * 1024, fetcher = fetch) {
+    const response = await fetcher(url, { signal: AbortSignal.timeout(10_000), redirect: 'error', headers: { accept: 'application/json' } });
+    if (!response.ok)
+        throw new Error(`Registry request failed (${response.status}) for ${url}`);
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of response.body ?? []) {
+        bytes += chunk.byteLength;
+        if (bytes > maxBytes)
+            throw new Error(`Registry response exceeds ${maxBytes} bytes.`);
+        chunks.push(chunk);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+export async function npmLatestVersion(packageName, fetcher = fetch) {
+    const data = await readBoundedJson(`https://registry.npmjs.org/-/package/${encodeURIComponent(packageName)}/dist-tags`, undefined, fetcher);
+    if (!exactVersion(data.latest))
+        throw new Error(`Registry returned an invalid latest version for ${packageName}.`);
+    return data.latest;
+}
+export async function watchPackages(statePath, packages, lookup = npmLatestVersion) {
+    const previous = await readFile(statePath, 'utf8')
+        .then((contents) => JSON.parse(contents), (error) => {
+        if (error.code === 'ENOENT')
+            return { versions: {}, events: [] };
+        throw error;
+    });
+    if (!previous || !previous.versions || typeof previous.versions !== 'object' || Array.isArray(previous.versions) || !Array.isArray(previous.events)
+        || Object.values(previous.versions).some((version) => !exactVersion(version))
+        || previous.events.some((event) => !event || typeof event.package !== 'string' || !exactVersion(event.from) || !exactVersion(event.to))) {
+        throw new Error('Invalid watch state file.');
+    }
+    const versions = Object.assign(Object.create(null), previous.versions);
+    const events = [];
+    for (const packageName of [...new Set(packages)]) {
+        const latest = await lookup(packageName);
+        if (!exactVersion(latest))
+            throw new Error(`Invalid version for ${packageName}.`);
+        const old = Object.hasOwn(versions, packageName) ? versions[packageName] : undefined;
+        if (old && compareVersions(latest, old) > 0 && (Number(latest.split('.')[0]) > Number(old.split('.')[0])
+            || (Number(latest.split('.')[0]) === Number(old.split('.')[0]) && old.includes('-') && !latest.includes('-'))))
+            events.push({ package: packageName, from: old, to: latest });
+        if (!old || compareVersions(latest, old) > 0)
+            versions[packageName] = latest;
+    }
+    const next = { versions, events: [...previous.events, ...events].slice(-100) };
+    const absolute = path.resolve(statePath);
+    await mkdir(path.dirname(absolute), { recursive: true });
+    const temporary = `${absolute}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        await rename(temporary, absolute);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+    return { versions, events };
+}
+function compareVersions(left, right) {
+    const a = left.split(/[.-]/).slice(0, 3).map(Number);
+    const b = right.split(/[.-]/).slice(0, 3).map(Number);
+    for (let index = 0; index < 3; index++) {
+        if (a[index] !== b[index])
+            return a[index] - b[index];
+    }
+    const leftPrerelease = left.split('-', 2)[1];
+    const rightPrerelease = right.split('-', 2)[1];
+    if (leftPrerelease === undefined && rightPrerelease !== undefined)
+        return 1;
+    if (leftPrerelease !== undefined && rightPrerelease === undefined)
+        return -1;
+    if (leftPrerelease === undefined || rightPrerelease === undefined)
+        return 0;
+    return leftPrerelease.localeCompare(rightPrerelease, undefined, { numeric: true });
+}

package/dist/core/write-branch.js

@@ -1,11 +1,12 @@
 import { execFile as execFileCallback } from 'node:child_process';
-import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { mkdtemp, readFile, realpath, rm } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { runMigration } from './runner.js';
 import { applyProposedFiles, verifyProposedMigration } from './verify.js';
 import { registerTemporaryCleanup } from './process-cleanup.js';
+import { parseManifest } from './manifest.js';
 const execFile = promisify(execFileCallback);
 /**
  * Builds and verifies a migration in a detached worktree, then commits only the
@@ -13,7 +14,7 @@ const execFile = promisify(execFileCallback);
  * `WRITES_ENABLED` safety gate before calling this operation.
  */
 export async function writeMigrationOnBranch(migration, options) {
-    const cwd = path.resolve(options.cwd);
+    const cwd = await realpath(path.resolve(options.cwd));
     const repositoryRoot = await git(cwd, ['rev-parse', '--show-toplevel']).then((value) => value.trim()).catch(() => {
         throw new Error('--write requires the project directory to be inside a Git repository.');
     });
@@ -42,13 +43,13 @@ export async function writeMigrationOnBranch(migration, options) {
             await git(repositoryRoot, ['worktree', 'remove', '--force', worktree]).catch(() => undefined);
         await rm(worktreeParent, { recursive: true, force: true });
         if (branchCreated && !committed)
-            await git(repositoryRoot, ['branch', '-D', branch]).catch(() => undefined);
+            await removeUncommittedBranch(repositoryRoot, branch, head);
     });
     try {
         await git(repositoryRoot, ['worktree', 'add', '--detach', worktree, head]);
         worktreeAdded = true;
         const projectCopy = projectRelative ? path.join(worktree, projectRelative) : worktree;
-        const outcome = await runMigration(migration, { cwd: projectCopy, dryRun: true, nodeRuntime: options.nodeRuntime });
+        const outcome = await runMigration(migration, { cwd: projectCopy, dryRun: true, nodeRuntime: options.nodeRuntime, allowYarnLockInstall: options.allowYarnLockInstall });
         if (outcome.manual.length > 0) {
             throw new Error(`Migration has ${outcome.manual.length} manual review item(s); no branch or commit was created.`);
         }
@@ -95,8 +96,8 @@ export async function writeMigrationOnBranch(migration, options) {
             }
         }
         await git(worktree, ['commit', '-m', `Apply ${migration.id} migration with UpstreamFix`]);
-        const commit = (await git(worktree, ['rev-parse', 'HEAD'])).trim();
         committed = true;
+        const commit = (await git(worktree, ['rev-parse', 'HEAD'])).trim();
         return {
             branch,
             commit,
@@ -112,9 +113,14 @@ export async function writeMigrationOnBranch(migration, options) {
         }
         await rm(worktreeParent, { recursive: true, force: true });
         if (branchCreated && !committed)
-            await git(repositoryRoot, ['branch', '-D', branch]).catch(() => undefined);
+            await removeUncommittedBranch(repositoryRoot, branch, head);
     }
 }
+async function removeUncommittedBranch(repositoryRoot, branch, originalHead) {
+    const current = await git(repositoryRoot, ['rev-parse', '--verify', branch]).then((value) => value.trim()).catch(() => undefined);
+    if (current === originalHead)
+        await git(repositoryRoot, ['branch', '-D', branch]).catch(() => undefined);
+}
 /** Do not commit vNext source code while its containing manifest still installs vOld. */
 async function assertChangedSourcesUseTargetSdk(projectRoot, migration, outcome) {
     const proposed = new Map(outcome.proposedFiles.map((file) => [path.resolve(projectRoot, file.relativePath), file.after]));
@@ -133,7 +139,7 @@ async function assertChangedSourcesUseTargetSdk(projectRoot, migration, outcome)
             const manifestFile = path.join(directory, 'package.json');
             const raw = proposed.get(manifestFile) ?? await readFile(manifestFile, 'utf8').catch(() => undefined);
             if (raw) {
-                const manifest = JSON.parse(raw);
+                const manifest = parseManifest(raw);
                 const ranges = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
                     .map((section) => manifest[section]?.[migration.packageName])
                     .filter((range) => typeof range === 'string');
@@ -161,15 +167,17 @@ async function assertChangedSourcesUseTargetSdk(projectRoot, migration, outcome)
 }
 async function git(cwd, args) {
     try {
+        const settings = await readPreservedGitSettings(cwd);
         const { stdout } = await execFile('git', [
             '-c', `core.hooksPath=${os.devNull}`,
             '-c', 'core.fsmonitor=false',
             '-c', 'core.untrackedCache=false',
             '-c', 'protocol.file.allow=never',
+            '-c', `commit.gpgsign=${settings.get('commit.gpgsign') === 'true' ? 'true' : 'false'}`,
             ...args,
         ], {
             cwd,
-            env: await gitEnvironment(cwd),
+            env: await gitEnvironment(cwd, settings),
             timeout: 30_000,
             maxBuffer: 2 * 1024 * 1024,
             windowsHide: true,
@@ -189,8 +197,7 @@ const preservedGitConfigKeys = [
     'gpg.ssh.program',
     'user.signingkey',
 ];
-async function gitEnvironment(cwd) {
-    const settings = await readPreservedGitSettings(cwd);
+async function gitEnvironment(cwd, settings) {
     const env = {
         PATH: process.env.PATH ?? '/usr/bin:/bin',
         HOME: process.env.HOME ?? os.homedir(),
@@ -262,10 +269,7 @@ async function readGitConfig(cwd, env, keys, globalOnly = false) {
     return settings;
 }
 async function assertSafeLocalGitConfig(repositoryRoot) {
-    const { stdout } = await execFile('git', [
-        '-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false', '-c', 'protocol.file.allow=never',
-        'config', '--local', '--get-regexp', String.raw `^(core\.fsmonitor|filter\..*\.(clean|smudge|process|required)|diff\.external|diff\..*\.command)$`,
-    ], {
+    const options = {
         cwd: repositoryRoot,
         env: {
             PATH: process.env.PATH ?? '/usr/bin:/bin',
@@ -277,19 +281,33 @@ async function assertSafeLocalGitConfig(repositoryRoot) {
         timeout: 10_000,
         maxBuffer: 1024 * 1024,
         windowsHide: true,
-    }).catch((error) => {
-        if (String(error.code) !== '1')
-            throw error;
-        return { stdout: error.stdout ?? '' };
-    });
-    const dangerous = stdout.split(/\r?\n/).filter((line) => {
-        const [key, ...value] = line.trim().split(/\s+/);
-        if (!key)
-            return false;
-        if (key.toLowerCase() === 'core.fsmonitor')
-            return value.join(' ') !== '' && !/^false$/i.test(value.join(' '));
-        return value.join(' ').trim() !== '';
-    });
+    };
+    const output = await Promise.all(['--local', '--worktree'].map(async (scope) => {
+        const { stdout } = await execFile('git', [
+            '-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false', '-c', 'protocol.file.allow=never',
+            'config', scope, '--includes', '--show-origin', '--null', '--list',
+        ], options);
+        return stdout;
+    }));
+    const dangerous = [];
+    for (const listing of output) {
+        const fields = listing.split('\0');
+        for (let index = 0; index + 1 < fields.length; index += 2) {
+            const origin = fields[index] ?? '';
+            const record = fields[index + 1] ?? '';
+            const separator = record.indexOf('\n');
+            if (separator < 0)
+                continue;
+            const key = record.slice(0, separator).toLowerCase();
+            const value = record.slice(separator + 1).trim();
+            if (/^include(?:if\..*)?\.path$/.test(key))
+                dangerous.push(`${origin}: ${key}`);
+            else if (key === 'core.fsmonitor' && value && !/^false$/i.test(value))
+                dangerous.push(`${origin}: ${key}`);
+            else if (/^(?:filter\..*\.(?:clean|smudge|process|required)|diff\.external|diff\..*\.command|gpg\..*)$/.test(key) && value)
+                dangerous.push(`${origin}: ${key}`);
+        }
+    }
     if (dangerous.length > 0) {
         throw new Error('The repository has configured Git filters, diff commands, or fsmonitor hooks. Remove them before using --write.');
     }