v1.49.0: More builtins, a stash tail-deletion fix

Three new builtin linters, tighter file matching for text-only hooks, and a three-way merge fix that stops fixer tail deletions from being dropped when a worktree edit overlaps their start.

Added

• rubocop_server builtin (@andyw8) #995. A sibling of Builtins.rubocop that passes --server to check, check_list_files, and fix, running RuboCop as a long-lived daemon for much faster repeat invocations.

  ["rubocop"] = Builtins.rubocop_server

• shellharden builtin (@hituzi-no-sippo) #996. Adds shellharden as a batched bash/sh linter. check runs shellharden --check (exit code 2 on suggested changes); fix runs shellharden --replace. Auto-suggested when *.sh or *.bash files are present.

• More ryl project indicators (@hituzi-no-sippo) #998. The ryl builtin now also discovers configs at .config/.ryl.toml, .config/ryl.toml, and pyproject.toml (when it contains a [tool.ryl] table), matching ryl's own upward search. The bundled ryl tool stub bumps to 0.20.0.

Changed

• Text-only builtins use types = List("text") (@hituzi-no-sippo) #997. Replaces glob = "**/*" with a text-type filter for builtins that only make sense on text files: byte_order_marker, check_executables_have_shebangs, check_merge_conflict, detect_private_key, dprint, fix_smart_quotes, mixed_line_ending, newlines, trailing_whitespace, and typos. check_added_large_files, check_case_conflict, and check_symlinks intentionally keep the everything-matcher since they're meaningful for binaries too.

• pklr bumped to 1.1.1 (@jdx) #1018, and Renovate no longer waits out the shared release-age delay for pklr updates (#1017), so fixes in the embedded pkl evaluator land in hk sooner.

• itertools updated to 0.15 (#1014).

Fixed

• Fixer tail deletions no longer get dropped when a worktree edit overlaps the start (@jdx) #990. In the three-way merge, a pure-deletion fixer hunk whose start was consumed by a worktree hunk was skipped entirely, causing trailing lines the fixer wanted to remove to reappear in the merged output. three_way_merge_hunks now trims such hunks to the current index and keeps the unconsumed tail. Includes a regression test for discussion #988. If you saw stash = "patch-file" restoring lines a fixer had deleted, this is the fix.

• betterleaks builtin test uses a still-detected fixture (@risu729) #1006. Since betterleaks 1.2.0, aws-access-token is a composite rule that requires a nearby secret key, so the old AWS-only fixture no longer failed the scanner. The test now uses a github-pat sample that still trips ≥1.2.0, and the bundled betterleaks stub moves to 1.5.0.

Documentation

• Link to all sponsors (@jdx) #991.
• Clarify contribution fit in the contributing guide (@jdx) #992.

New Contributors

• @risu729 made their first contribution in #1006
• @andyw8 made their first contribution in #995

Full Changelog: v1.48.0...v1.49.0

💚 Sponsor hk

hk is developed by @jdx at en.dev — a small independent studio behind developer tools like mise, aube, hk, and more. Work on hk is funded by sponsorships.

If hk has sped up your pre-commit loop or made linting feel less painful, please consider sponsoring at en.dev. Sponsorships are what keep hk moving and the project independent.