vouchington-tooling 0.13.3 → 0.14.0

package/ast-grep/rules/no-three-sequential-awaits-tsx.yml

@@ -12,6 +12,10 @@ ignores:
   - 'web/test-helpers/**'
 rule:
   all:
+    - not:
+        any:
+          - matches: async-disposable-acquisition
+          - matches: async-disposable-commit
     - not:
         follows:
           stopBy: neighbor
@@ -72,6 +76,10 @@ rule:
                     pattern: $W = await Promise.all($$$)
                 - not:
                     pattern: $W = await Promise.allSettled($$$)
+          not:
+            any:
+              - matches: async-disposable-acquisition
+              - matches: async-disposable-commit
     - any:
         - all:
             - pattern:
@@ -189,8 +197,16 @@ rule:
                       pattern: $Y = await Promise.all($$$)
                   - not:
                       pattern: $Y = await Promise.allSettled($$$)
+          - not:
+              any:
+                - matches: async-disposable-acquisition
+                - matches: async-disposable-commit
           - precedes:
               stopBy: neighbor
+              not:
+                any:
+                  - matches: async-disposable-acquisition
+                  - matches: async-disposable-commit
               any:
                 - all:
                     - pattern:
@@ -261,6 +277,69 @@ constraints:
   P:
     not:
       regex: '^Promise\.all(Settled)?\b'
+utils:
+  async-disposable-acquisition:
+    all:
+      - pattern:
+          context: |
+            async function run() {
+              await using $RESOURCE = await $ACQUIRE
+            }
+          selector: expression_statement
+      - precedes:
+          # Pair only with the nearest lifecycle endpoint to the right.
+          # Overlapping-resource policy belongs to a separate lifecycle rule.
+          stopBy:
+            any:
+              - pattern:
+                  context: |
+                    async function run() {
+                      await using $_ = await $_
+                    }
+                  selector: expression_statement
+              - pattern:
+                  context: |
+                    async function run() {
+                      await $_.commit($$$)
+                    }
+                  selector: expression_statement
+          pattern:
+            context: |
+              async function run() {
+                await $RESOURCE.commit($$$)
+              }
+            selector: expression_statement
+  async-disposable-commit:
+    all:
+      - pattern:
+          context: |
+            async function run() {
+              await $RESOURCE.commit($$$)
+            }
+          selector: expression_statement
+      - follows:
+          # Pair only with the nearest lifecycle endpoint to the left.
+          # Overlapping-resource policy belongs to a separate lifecycle rule.
+          stopBy:
+            any:
+              - pattern:
+                  context: |
+                    async function run() {
+                      await using $_ = await $_
+                    }
+                  selector: expression_statement
+              - pattern:
+                  context: |
+                    async function run() {
+                      await $_.commit($$$)
+                    }
+                  selector: expression_statement
+          pattern:
+            context: |
+              async function run() {
+                await using $RESOURCE = await $ACQUIRE
+              }
+            selector: expression_statement
 examples:
   - code: |
       async function run() {
@@ -286,3 +365,102 @@ examples:
       }
     isValid: true
     file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyChange(transaction)
+        await transaction.commit()
+        return <div />
+      }
+    isValid: true
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using transaction = await beginBoundedTransaction({ timeoutMs: 1000 })
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await transaction.commit()
+        return <div />
+      }
+    isValid: true
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await applyThirdChange(transaction)
+        await transaction.commit()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await unrelatedFirst()
+        await unrelatedSecond()
+        await unrelatedThird()
+        await using transaction = await beginTransaction()
+        await applyChange(transaction)
+        await transaction.commit()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await other.commit()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyChange(transaction)
+        await transaction.commit()
+        await afterFirst()
+        await afterSecond()
+        await afterThird()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using outer = await acquire()
+        {
+          await using inner = await acquire()
+          await innerFirst(inner)
+          await innerSecond(inner)
+          await innerThird(inner)
+          await inner.commit()
+        }
+        await outer.commit()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await transaction.rollback()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'
+  - code: |
+      async function run() {
+        await using resource = await acquire()
+        await useFirst(resource)
+        await useSecond(resource)
+        await resource.dispose()
+        return <div />
+      }
+    isValid: false
+    file: 'web/app/example.tsx'

package/ast-grep/rules/no-three-sequential-awaits.yml

@@ -33,6 +33,10 @@ ignores:
   - 'backend/scripts/explain-analyze/**'
 rule:
   all:
+    - not:
+        any:
+          - matches: async-disposable-acquisition
+          - matches: async-disposable-commit
     - not:
         follows:
           stopBy: neighbor
@@ -73,6 +77,10 @@ rule:
                     pattern: $W = await Promise.all($$$)
                 - not:
                     pattern: $W = await Promise.allSettled($$$)
+          not:
+            any:
+              - matches: async-disposable-acquisition
+              - matches: async-disposable-commit
     - any:
         - all:
             - pattern:
@@ -150,8 +158,16 @@ rule:
                       pattern: $Y = await Promise.all($$$)
                   - not:
                       pattern: $Y = await Promise.allSettled($$$)
+          - not:
+              any:
+                - matches: async-disposable-acquisition
+                - matches: async-disposable-commit
           - precedes:
               stopBy: neighbor
+              not:
+                any:
+                  - matches: async-disposable-acquisition
+                  - matches: async-disposable-commit
               any:
                 - all:
                     - pattern:
@@ -202,6 +218,69 @@ constraints:
   P:
     not:
       regex: '^Promise\.all(Settled)?\b'
+utils:
+  async-disposable-acquisition:
+    all:
+      - pattern:
+          context: |
+            async function run() {
+              await using $RESOURCE = await $ACQUIRE
+            }
+          selector: expression_statement
+      - precedes:
+          # Pair only with the nearest lifecycle endpoint to the right.
+          # Overlapping-resource policy belongs to a separate lifecycle rule.
+          stopBy:
+            any:
+              - pattern:
+                  context: |
+                    async function run() {
+                      await using $_ = await $_
+                    }
+                  selector: expression_statement
+              - pattern:
+                  context: |
+                    async function run() {
+                      await $_.commit($$$)
+                    }
+                  selector: expression_statement
+          pattern:
+            context: |
+              async function run() {
+                await $RESOURCE.commit($$$)
+              }
+            selector: expression_statement
+  async-disposable-commit:
+    all:
+      - pattern:
+          context: |
+            async function run() {
+              await $RESOURCE.commit($$$)
+            }
+          selector: expression_statement
+      - follows:
+          # Pair only with the nearest lifecycle endpoint to the left.
+          # Overlapping-resource policy belongs to a separate lifecycle rule.
+          stopBy:
+            any:
+              - pattern:
+                  context: |
+                    async function run() {
+                      await using $_ = await $_
+                    }
+                  selector: expression_statement
+              - pattern:
+                  context: |
+                    async function run() {
+                      await $_.commit($$$)
+                    }
+                  selector: expression_statement
+          pattern:
+            context: |
+              async function run() {
+                await using $RESOURCE = await $ACQUIRE
+              }
+            selector: expression_statement
 examples:
   - code: |
       async function run() {
@@ -240,3 +319,93 @@ examples:
       }
     isValid: true
     file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyChange(transaction)
+        await transaction.commit()
+      }
+    isValid: true
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using transaction = await beginBoundedTransaction({ timeoutMs: 1000 })
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await transaction.commit()
+      }
+    isValid: true
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await applyThirdChange(transaction)
+        await transaction.commit()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await unrelatedFirst()
+        await unrelatedSecond()
+        await unrelatedThird()
+        await using transaction = await beginTransaction()
+        await applyChange(transaction)
+        await transaction.commit()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await other.commit()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyChange(transaction)
+        await transaction.commit()
+        await afterFirst()
+        await afterSecond()
+        await afterThird()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using outer = await acquire()
+        {
+          await using inner = await acquire()
+          await innerFirst(inner)
+          await innerSecond(inner)
+          await innerThird(inner)
+          await inner.commit()
+        }
+        await outer.commit()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using transaction = await beginTransaction()
+        await applyFirstChange(transaction)
+        await applySecondChange(transaction)
+        await transaction.rollback()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'
+  - code: |
+      async function run() {
+        await using resource = await acquire()
+        await useFirst(resource)
+        await useSecond(resource)
+        await resource.dispose()
+      }
+    isValid: false
+    file: 'backend/services/example.mts'

package/dist/coverage-transport/outcome.d.mts

@@ -14,15 +14,16 @@ export type BlobPrimaryState = 'true' | 'false' | 'skipped';
 export declare function isBlobPrimaryState(value: string | undefined): value is BlobPrimaryState;
 /**
  * Sibling to `assertCoverageTransportOutcome` for the Vitest blob. `true`/`false` are the S3
- * upload step's `blob` output; `skipped` means that step never ran. GitHub fallback is always
- * attempted when enabled — workflows must not gate it on `blob != 'true'`.
+ * upload step's `blob` output; `skipped` means that step never ran. Workflows gate the GitHub
+ * fallback on `blob != 'true'`, so a persisted S3 primary with no GitHub artifact attempt is the
+ * expected steady state, not a degraded one.
  */
 export declare function assertCoverageTransportBlobOutcome(suite: string, primaryPersisted: BlobPrimaryState, artifactAttempt1: StepOutcome, artifactAttempt2: StepOutcome, emit?: (line: string) => void): boolean;
 export type AppendOutput = (path: string, data: string) => void;
 /**
- * Writes `blob=true|false` to `$GITHUB_OUTPUT` for outcome reporting. GitHub-fallback blob upload
- * must always be attempted when enabled; do not gate it on this signal. The upload subcommand's
- * exit code tracks the coverage pair, not the blob. A no-op outside CI (`githubOutputPath` unset).
+ * Writes `blob=true|false` to `$GITHUB_OUTPUT` for outcome reporting. Workflows gate the
+ * GitHub-fallback blob upload on this signal (`blob != 'true'`). The upload subcommand's exit
+ * code tracks the coverage pair, not the blob. A no-op outside CI (`githubOutputPath` unset).
  */
 export declare function writeUploadOutcomeOutput(outcome: {
     readonly blob: boolean;

package/dist/coverage-transport/outcome.mjs

@@ -41,15 +41,13 @@ export function isBlobPrimaryState(value) {
 }
 /**
  * Sibling to `assertCoverageTransportOutcome` for the Vitest blob. `true`/`false` are the S3
- * upload step's `blob` output; `skipped` means that step never ran. GitHub fallback is always
- * attempted when enabled — workflows must not gate it on `blob != 'true'`.
+ * upload step's `blob` output; `skipped` means that step never ran. Workflows gate the GitHub
+ * fallback on `blob != 'true'`, so a persisted S3 primary with no GitHub artifact attempt is the
+ * expected steady state, not a degraded one.
  */
 export function assertCoverageTransportBlobOutcome(suite, primaryPersisted, artifactAttempt1, artifactAttempt2, emit = (line) => process.stderr.write(`${line}\n`)) {
     const artifactSucceeded = artifactAttempt1 === 'success' || artifactAttempt2 === 'success';
     if (primaryPersisted === 'true') {
-        if (!artifactSucceeded) {
-            emit(`::warning::Vitest blob persisted only to S3 for suite=${suite}; GitHub artifact fallback is degraded.`);
-        }
         return true;
     }
     if (artifactSucceeded) {
@@ -62,9 +60,9 @@ export function assertCoverageTransportBlobOutcome(suite, primaryPersisted, arti
     return false;
 }
 /**
- * Writes `blob=true|false` to `$GITHUB_OUTPUT` for outcome reporting. GitHub-fallback blob upload
- * must always be attempted when enabled; do not gate it on this signal. The upload subcommand's
- * exit code tracks the coverage pair, not the blob. A no-op outside CI (`githubOutputPath` unset).
+ * Writes `blob=true|false` to `$GITHUB_OUTPUT` for outcome reporting. Workflows gate the
+ * GitHub-fallback blob upload on this signal (`blob != 'true'`). The upload subcommand's exit
+ * code tracks the coverage pair, not the blob. A no-op outside CI (`githubOutputPath` unset).
  */
 export function writeUploadOutcomeOutput(outcome, githubOutputPath, appendOutput = appendFileSync) {
     if (githubOutputPath)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {

package/skills/agent-workflow/SKILL.md

@@ -22,9 +22,12 @@ branching, review, and release policy.
    checks with a concrete reason.
 6. Review the diff for accidental files, secrets, generated output, broken documentation links,
    and assumptions that belong in local instructions instead.
+7. When feedback arrives on an open change, give every surfaced item a disposition and drive it to
+   closure before hand-off; do not leave items unaddressed or silently absorb or defer them.
 
 For portable implementation and review checks, read [implementation](references/implementation.md),
-[review](references/review.md), and [evidence sweep](references/evidence-sweep.md). The older
+[review](references/review.md), [review response](references/review-response.md), and
+[evidence sweep](references/evidence-sweep.md). The older
 [implementation and review](references/implementation-and-review.md) remains a compact overview.
 Local instructions remain authoritative for commands, commits, review systems, and release policy.
 

package/skills/agent-workflow/references/review-response.md

@@ -0,0 +1,32 @@
+# Review response
+
+Applies when responding to feedback on an open change — a human reviewer, an automated reviewer, or
+a shepherding tool that surfaces both. This is the response side of [review](review.md); its closing
+line, to record unresolved risk as an explicit decision or follow-up and never as an unnoticed gap,
+is what the ladder below operationalizes.
+
+Give every surfaced item exactly one disposition before its resolution runs, recorded where the
+review conversation lives. Invalid — wrong, already satisfied by the current diff, or out of an
+already-settled scope — gets a reason and closes with no code change and no follow-up. Blocking —
+correctness, security, data safety, or a gap against a linked requirement — gets fixed, pushed, and
+confirmed on the change's head commit before closing; closing first can leave an unfixed commit
+behind a closed conversation. Non-blocking gets folded into an already-planned push when the fix is
+cheap and low-risk, and otherwise gets recorded as a follow-up only when leaving it undone would
+change behavior, structure, or risk: reuse or extend an existing follow-up before opening a new one,
+and group related items from the same round into one. A correct item that clears none of those bars
+— a style preference, a restatement, polish the change is fine without — is declined with a reason
+and no follow-up; that is the expected outcome for a minor suggestion, not a lapse. Escalate — work
+the change cannot absorb as feedback, such as a large architectural or ownership change — is
+recorded where decisions are tracked and reported for direction rather than implemented or silently
+downgraded to a follow-up.
+
+Read every outstanding item before editing and drain the round locally; the cost of iterating is the
+push, not the commit, because a push re-runs checks and re-triggers automated reviewers. Declining a
+round without pushing is what lets it converge instead of regenerating the same suggestions on every
+cycle. By hand-off, every item carries a disposition and reaches closure — an escalation through its
+decision record rather than an open conversation — except where the review surface itself withholds
+the capability to close an item; say so and leave it rather than forcing a resolution it never
+authorized.
+
+This skill supplies no review system, resolution mechanism, issue tracker, label, or severity
+vocabulary; a consumer wrapper owns those.