@joshuafolkken/kit 1.1050.0 → 1.1094.0

package/.claude/skills/workflow-commands/issue-scout.md

@@ -41,4 +41,4 @@ pnpm josh issue:file "<title>" --body-file <complete-draft.md> --depth <n> --dis
 - **The split path files each child through the same command.** The epic is created with
   `pnpm josh epic` over children that were scanned.
 
-Full behavior: `docs/josh-commands.md` → "`josh issue:file`" and "`josh issue:scout`".
+Full behavior: `docs/josh-commands-automation.md` → "`josh issue:file`" and "`josh issue:scout`".

package/.claude/skills/workflow-commands/kickoff.md

@@ -1,13 +1,18 @@
 # `kickoff` — Planning phase only (plan → Issue → Telegram notify → stop)
 
-- `kickoff #<N>`: Read existing Issue #N **and every comment on it** — `pnpm josh issue:read <N>`; a
+- `kickoff #<N>`: **First `pnpm josh run:entry <N> --to kickoff`** (`SKILL.md` → §2k) — it claims
+  nothing and prints the stage line alone; `start: reached` means the Issue is already planned or further
+  up the ladder, so report the stage line and **stop**. Otherwise read existing Issue #N **and every comment on it** — `pnpm josh issue:read <N>`; a
   decision recorded after the body was written lives only in a comment, and the later text is the
   agreement in force (`SKILL.md` → §2g, which also carries the two answers that stop the run instead) →
   **normalize the title**: if the title is not in English or can be phrased more clearly, derive a
   better English title and run `gh api -X PATCH repos/{owner}/{repo}/issues/<N> -f title="<title>"` →
   analyze requirements → **scope assessment per `split-assessment.md`** → post the plan to the Issue (if
   body is blank, `gh api -X PATCH repos/{owner}/{repo}/issues/<N> -f body="<plan>"`; otherwise
-  `pnpm josh issue:comment <N> --body-file <path>`) → send Telegram notification → **stop**
+  `pnpm josh issue:comment <N> --body-file <path>`) → **apply the `run:planned` label** — the mark the next
+  command's `run:entry` reads to start at the implementation, provisioned by `josh sync` (`gh api
+  repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=run:planned' --silent`) → send Telegram
+  notification, its last line `Next: halfrun #<N> | prrun #<N> | fullrun #<N>` → **stop**
   (do not implement). **When the assessment finds two or more separately-mergeable deliverables**, take
   the split path instead of posting a plan: create the children as in `kickoff new`, then either
   **promote `#N`** with `pnpm josh epic --promote <N> <N1> <N2> ... [--ordered] [--rationale-file
@@ -37,7 +42,7 @@ than filing.
 **Read `split-assessment.md` → "The question" first.** It is the split decision every entry point
 applies, including this one — `kickoff #N` assesses scope exactly as `kickoff new` does. Its default is
 not to split: separability and a scope that clearly exceeds what one verification gate can confirm in
-one pass (the guide is about 10 changed files and about 400 changed lines) have to hold **together**.
+one pass (the size guide is stated there) have to hold **together**.
 The rest of `split-assessment.md` — what each entry does with the answer — is read on demand when a
 split is found.
 
@@ -80,4 +85,4 @@ split is found.
   creation call. (3) Send Telegram notification listing all created issues. (4) Present the command
   `backlogrun #<E> --only`. (5) **Stop** — do not implement.
 
-`pnpm josh issue:file` lints the body and applies the classification labels it declares, following `prompts/collaboration-workflow/issue-template.md` for classification (`docs/josh-commands.md` → `josh issue:file`).
+`pnpm josh issue:file` lints the body and applies the classification labels it declares, following `prompts/collaboration-workflow/issue-template.md` for classification (`docs/josh-commands-automation.md` → `josh issue:file`).

package/.claude/skills/workflow-commands/latest-gate.md

@@ -82,4 +82,4 @@ found once — fix it forward before parking the issue for it.
 
 This file is the single source of the rule. `fullrun.md`, `halfrun.md`, `backlogrun.md` and `backlogrun.md`
 each name `pnpm josh latest:scope` at the point their procedure reaches it and route here for
-everything else; `docs/josh-commands.md` documents the command itself.
+everything else; `docs/josh-commands-automation.md` documents the command itself.

package/.claude/skills/workflow-commands/needs-human-review.md

@@ -57,7 +57,7 @@ run's *start*; this withholds its *end*. So a `needs-human-review` issue is stil
 the artifact a person is meant to look at would never be produced — and a child stopped by it **goes on
 holding its repository**, because the uncommitted work is still in the checkout; read as parked there,
 the next child would start `git switch main && git pull` on top of it. The code encodes both halves by
-leaving the label out of two sets: `scripts/git/issue-labels.ts` keeps it out of
+leaving the label out of two sets: `scripts/issue/issue-labels.ts` keeps it out of
 `NOT_DIRECTLY_RUNNABLE_LABELS` and `scripts/epic/epic-busy.ts` keeps it out of the parked set.
 
 Each entry point's own branch stays in its own file — `fullrun.md`, `halfrun.md`,

package/.claude/skills/workflow-commands/observation-filing.md

@@ -19,7 +19,7 @@ Tier C (`CLAUDE.md`). Name what was filed in the completion report. An observati
 on is dropped rather than filed.
 
 **The filing ceilings still apply.** Count this filing in the ten-Issue limit for the run. An
-observation is discretionary, so above 30 open Issues in the target repository, close one first or do
+observation is discretionary, so above the WIP cap in the target repository, close one first or do
 not file (`prompts/collaboration-workflow/wip-cap.md`). File it with `pnpm josh issue:file`
 (`issue-scout.md`), which lints the body against `prompts/collaboration-workflow/issue-template.md`,
 applies the classification labels it declares, runs the duplicate scan, and runs `epic:bundle` on the
@@ -42,7 +42,7 @@ The detail below is read at the filing decision, and the marker suite pins the r
 
 **The depth is recorded on the Issue as a label, and the label is applied when the Issue is filed**
 (joshuafolkken/kit#1729). `depth:0`, `depth:1` and `depth:2` are the three, defined once in
-`scripts/git/issue-labels.ts` and carrying no definition of their own — **the table above is the
+`scripts/issue/issue-labels.ts` and carrying no definition of their own — **the table above is the
 single source**, and a label description that paraphrased it would be a second copy of the rule.
 **Every filing route applies one**, this route and the other three of §2d's table alike: a `new`
 entry point, a `route:tier-a` prerequisite, a `route:interrupt`, a split child and a review round
@@ -56,7 +56,7 @@ gh api repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=depth:1'   # an Issue
 
 **Create the three once per repository**, before the first filing that applies one — REST auto-creates
 a missing label with a generated color and no description, and the three lines below are what give
-each a stable color a reader can scan a listing by. `DEPTH_LABELS` in `scripts/git/issue-labels.ts`
+each a stable color a reader can scan a listing by. `DEPTH_LABELS` in `scripts/issue/issue-labels.ts`
 is the single source of the colors and descriptions, and `scripts/rules/issue-depth-label.test.ts` keys
 these lines to it so the two cannot drift.
 

package/.claude/skills/workflow-commands/prerequisite.md

@@ -31,7 +31,7 @@ pnpm josh issue:file "<title>" --body-file <body-file> --depth <n> --route tier-
 
 The command lints the body against `prompts/collaboration-workflow/issue-template.md`, applies the
 classification labels it declares, and runs the duplicate scan and `epic:bundle` itself
-(`docs/josh-commands.md` → `josh issue:file`).
+(`docs/josh-commands-automation.md` → `josh issue:file`).
 
 Every "file the prerequisite" below means that labelled filing, and it always happens **first**: the
 steps after it name a number that does not exist until it is. **Its duplicate scan is read exactly as

package/.claude/skills/workflow-commands/prrun.md

@@ -0,0 +1,36 @@
+# `prrun` — the manifest (plan → implement → PR → green → stop, a person merges)
+
+`prrun` sits between `halfrun` (stop before commit) and `fullrun` (auto-merge). It runs `fullrun`
+up to a green, mergeable pull request and **stops before the merge**, so a person merges by hand
+(joshuafolkken/kit#3023). **Read `fullrun.md` for every step** — the entry sequence, the step lists,
+the gate, the review and the stop branches are `fullrun`'s, unchanged. This file names only the
+difference, never a second copy of the procedure.
+
+## The difference — the entry
+
+`prrun #<N>` opens with `pnpm josh run:entry <N> --to prrun` where `fullrun` passes no `--to`
+(`SKILL.md` → §2k): a planned Issue starts at the implementation, a `halfrun` stop is adopted and
+resumes at the gate, and an Issue already stopped by a `prrun` is reached — report the stage line and
+stop. A merged Issue is reached too, but the `entry #<N>` line after the stage line answers it (§2k).
+
+## The difference — the end of the run
+
+Where `fullrun` runs `pnpm josh followup` and merges, `prrun` does three things and stops:
+
+1. **Watch the pull request to mergeable** — `pnpm josh followup "<title> #<N>" --no-merge`
+   (`followup.md` → "Run `pnpm josh followup`", read in the same turn): required CI green and the AI
+   review findings resolved. A failure stops the run exactly as it stops a `fullrun`.
+2. **Mark the stop — `pnpm josh run:hold <N> --prrun-stop`.** It records the commit the pull request is
+   on in this run's own hold, the record `fullrun #<N>` adopts (its prrun resume, `working-tree-hold.md`). **The hold and `in-progress` stay**: the run is not finished until the merge's tail runs.
+3. **Send a `confirmation` Telegram with the resume commands, then stop.** **`fullrun #<N>` first** —
+   its `run:entry` reads where the pull request stands and resumes from there; the direct command
+   follows for finishing without an agent:
+   `pnpm josh notify --task-type confirmation --issue-url "<issue-url>" --body=$'prrun ready to
+   merge: <pr-url>\nNext: fullrun #<N>\nAfter a manual merge, without an agent: pnpm josh followup
+   "<title> #<N>"'`. The stop report names the same two, in the same order.
+
+**Invoking `prrun` is _not_ authorization to merge** — never run `pnpm josh followup` without
+`--no-merge` in a `prrun`. After a person merges by hand, the same `pnpm josh followup "<title> #<N>"`
+runs only the post-merge tail (`followup.md`).
+
+`prrun new`: `fullrun new` up to the pull request, then the three steps above with the filed number.

package/.claude/skills/workflow-commands/retrospective.md

@@ -65,7 +65,7 @@ Issue, as after any filing.
 input, so the next run picks the improvements up without waiting for a person. **`backlogrun-steps.md` →
 "What one invocation approves" is that carve-out's single source**; it is written there, beside the
 brakes that bound it, rather than restated here. Every brake still counts a retrospective's filings: the
-ten-per-invocation ceiling, the WIP cap of 30, `--max`, the 150,000-token session budget and the 8-hour
+ten-per-invocation ceiling, the WIP cap, `--max`, the 150,000-token session budget and the 8-hour
 whole-run bound.
 
 **Close with `pnpm josh run:carry --retrospective --summary "<result>" --owner "$PPID"`.** It marks the

package/.claude/skills/workflow-commands/working-tree-hold.md

@@ -63,12 +63,13 @@ or release once the work is done; only an expired record over a clean tree is re
 **The batch entry points claim per child, not per batch.** `backlogrun` never
 call it themselves; each child runs the `fullrun` procedure, so it claims on entry and `pnpm josh
 followup` releases it at that child's merge. The command's behavior and the answer table are
-`docs/josh-commands.md` → "`josh run:hold` / `josh run:release`"; this file is the single source of
+`docs/josh-commands-automation.md` → "`josh run:hold` / `josh run:release`"; this file is the single source of
 the procedure.
 
 ## The halfrun resume
 
-**`fullrun #<N>` after a `halfrun` stop resumes it instead of claiming** (joshuafolkken/kit#2796). The
+**`fullrun #<N>` or `prrun #<N>` after a `halfrun` stop resumes it instead of claiming**
+(joshuafolkken/kit#2796, #3042). The
 stop is **recorded, never inferred**: the `halfrun` ends with `pnpm josh run:hold <N> --halfrun-stop`,
 which marks its own record (re-keying a `halfrun new`'s unnumbered one to the filed issue) — a
 `halfrun` still implementing or a `backlogrun` child leaves the same hold over the same dirty tree, and
@@ -79,3 +80,22 @@ halfrun`. **Skip the title, the plan, the split assessment, `git switch main &&
 issue (`pnpm josh issue:read <N>`), then run the gate **in full** from the refactor (`chain-rule.md` →
 "Run the review-to-merge chain") — a fix made during the manual check has had no gate — and ship as
 any `fullrun` does.
+
+## The prrun resume
+
+**`fullrun #<N>` after a `prrun` stop resumes it the same way** (joshuafolkken/kit#3023). The `prrun`
+ends with `pnpm josh run:hold <N> --prrun-stop`, which writes the commit its pull request is on into its
+own record; only a record carrying that commit is adopted. `run:entry` asks the session budget, adopts
+the hold with the `fullrun` mark and prints one of three tokens — read, never inferred:
+
+- **`resume: prrun-merged`** — a person merged the pull request. Run `pnpm josh followup "<title>
+  #<N>"` alone: it detects the merge and runs only the post-merge tail.
+- **`resume: prrun-merge`** — the branch is still on the stop's commit, both here and on the pull
+  request, and the tree is clean, so what was verified is what would merge. Skip the gate and the
+  review; run `pnpm josh followup` to merge.
+- **`resume: prrun-gate`** — the branch moved (locally, or by a push made on GitHub), its pull request
+  could not be read, or the tree is dirty: a person changed something. Run the
+  gate **in full** and the review (`chain-rule.md` → "Run the review-to-merge chain"), then ship as any
+  `fullrun` does.
+
+All three skip the title, the plan, the split assessment and the implementation.

package/.codex/hooks.json

@@ -1,52 +1,48 @@
 {
 	"hooks": {
-		"PreToolUse": [
+		"SessionStart": [
 			{
-				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
+				"matcher": "",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/codex-hook-adapter.js ]; then node dist/hooks/codex-hook-adapter.js pretool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts pretool; fi",
-						"timeout": 20
+						"command": "pnpm josh audit:provision",
+						"timeout": 180
 					}
 				]
 			}
 		],
-		"PostToolUse": [
+		"UserPromptSubmit": [
 			{
-				"matcher": "Edit|Write|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/codex-hook-adapter.js ]; then node dist/hooks/codex-hook-adapter.js posttool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts posttool; fi",
-						"timeout": 90
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/session-lang.js; else pnpm josh session:lang; fi",
+						"timeout": 10
 					}
 				]
 			}
 		],
-		"SessionStart": [
+		"PreToolUse": [
 			{
-				"matcher": "",
+				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "pnpm josh audit:provision",
-						"timeout": 180
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/codex-hook-adapter.js pretool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts pretool; fi",
+						"timeout": 20
 					}
 				]
 			}
 		],
-		"UserPromptSubmit": [
+		"PostToolUse": [
 			{
+				"matcher": "Edit|Write|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "echo 'MANDATORY before writing any implementation code: present the two-layer work summary (Now / Change / Check, then every change with its test). Full rule: Code Change Rules Step 0 in CLAUDE.md.'"
-					},
-					{
-						"type": "command",
-						"command": "if [ -f dist/hooks/session-lang.js ]; then node dist/hooks/session-lang.js; else pnpm josh session:lang; fi",
-						"timeout": 10
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/codex-hook-adapter.js posttool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts posttool; fi",
+						"timeout": 90
 					}
 				]
 			}
@@ -57,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/stop-guard.js ]; then node dist/hooks/stop-guard.js; else pnpm josh stop:guard; fi",
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/stop-guard.js; else pnpm josh stop:guard; fi",
 						"timeout": 20
 					}
 				]

package/.github/actions/setup-pnpm/action.yml

@@ -0,0 +1,93 @@
+name: Setup pnpm
+description: >
+  Resolve the project's pnpm version, set pnpm up, and — unless `install` is false — restore the
+  pnpm store, install safe-chain from its hash-verified release installer and install the
+  dependencies through it.
+
+# The one place kit's own workflows prepare pnpm (joshuafolkken/kit#2982). Every job that installed
+# dependencies used to carry these steps itself, and `publish.yml` — the workflow holding the npm
+# and GitHub Packages publish rights — had been left without safe-chain while `ci.yml` had it. A
+# job that calls this action cannot install without the scan.
+#
+# Distributed: `josh sync` writes this file into a consumer beside the workflows that call it
+# (`pr-classification.yml`), stamped as managed like they are (joshuafolkken/kit#3013).
+# `templates/workflows/ci.yml` still carries the same steps inline — it was written before this file
+# was distributed, and moving it onto the action is a change of its own. `workflow_pin_logic` reads
+# this file as a source of canonical action pins, so the template's refs still resolve from here.
+
+inputs:
+  install:
+    description: Install the dependencies. False sets pnpm up alone, for a job that only runs pnpm.
+    required: false
+    default: 'true'
+  cache:
+    description: >
+      Restore and save the pnpm store. A release job passes false, so nothing another run saved
+      reaches a job that holds publish credentials.
+    required: false
+    default: 'true'
+  runtime:
+    description: Passed to pnpm/setup's `runtime` input; empty leaves the runtime to setup-node.
+    required: false
+    default: ''
+  node-auth-token:
+    description: >
+      NODE_AUTH_TOKEN for the install, for a job whose `.npmrc` authenticates to GitHub Packages.
+      Empty keeps whatever the job already has.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pnpm version
+      id: pnpm-version
+      shell: bash
+      run: |
+        version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
+        test -n "$version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+    - name: Setup pnpm
+      uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      with:
+        version: ${{ steps.pnpm-version.outputs.version }}
+        runtime: ${{ inputs.runtime }}
+        install: false
+
+    - name: Resolve pnpm store path
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      shell: bash
+      run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
+
+    - name: Setup pnpm store cache
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ env.PNPM_STORE_PATH }}
+        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-
+
+    # The safe-chain release and the SHA-256 of that release's install-safe-chain.sh. The installer
+    # puts the safe-chain binary under ~/.safe-chain/bin and adds it to PATH beside the shims;
+    # `pnpm dlx … setup-ci` left only the shims, which then let every install through without a scan
+    # (joshuafolkken/kit#2711). `josh latest` moves both together.
+    - name: Setup safe-chain
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
+        SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+      run: |
+        installer="$RUNNER_TEMP/install-safe-chain.sh"
+        curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+        echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+        sh "$installer" --ci
+
+    - name: Install dependencies
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token || env.NODE_AUTH_TOKEN }}
+      run: pnpm install --frozen-lockfile --ignore-scripts

package/.github/dependabot.yml

@@ -1,7 +1,11 @@
 version: 2
 updates:
+  # The local composite actions pin actions of their own, and Dependabot reads only the directories
+  # it is given — `/` covers `.github/workflows` and no `.github/actions/*/action.yml`.
   - package-ecosystem: 'github-actions'
-    directory: '/'
+    directories:
+      - '/'
+      - '/.github/actions/*'
     schedule:
       interval: 'weekly'
   # Version updates are disabled: `josh latest` runs at the start of every fullrun / halfrun /

package/.github/workflows/ci.yml

@@ -27,13 +27,10 @@ concurrency:
 # set the JOSH_PLAYWRIGHT_BROWSERS repository variable to a space-separated list to widen it.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
-  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
-  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
-  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
-  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
 
+# Every job that needs pnpm prepares it through `.github/actions/setup-pnpm`, which carries the
+# pnpm version resolution, the store cache, the safe-chain installer pin and the install
+# (joshuafolkken/kit#2982).
 jobs:
   node-26-pnpm:
     name: Node 26 pnpm
@@ -43,17 +40,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: ./.github/actions/setup-pnpm
         with:
-          version: ${{ steps.pnpm-version.outputs.version }}
           runtime: node@26
-          install: false
+          install: 'false'
       - run: node --version && pnpm --version
 
   playwright-image:
@@ -223,7 +213,7 @@ jobs:
   static-checks:
     name: Static Checks
     needs: reuse-pr-checks
-    if: ${{ always() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -239,30 +229,6 @@ jobs:
           node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -317,17 +283,10 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # One step rather than five, and concurrent rather than serial (joshuafolkken/kit#1216).
       # `josh gate` is the command a developer runs before committing; it fans out to the same
@@ -366,13 +325,10 @@ jobs:
       - name: Run verification gate
         run: pnpm josh gate --verbose --no-unit
 
-  # The other half of the gate, on a runner of its own. It carries the same setup steps as
-  # `static-checks` rather than sharing them: a GitHub job is its own machine, so every job that
-  # needs Node sets Node up, and this workflow already writes that preamble once per job. The
-  # single-source alternative — a local composite action under `.github/actions/` — is ruled out by
-  # `scripts/ci/ci-yml-action-parity.test.ts`, which pins the set of action names in this file to the
-  # set in `templates/workflows/ci.yml`; a local action cannot appear in a distributed template,
-  # because the template travels to consumers without it.
+  # The other half of the gate, on a runner of its own. A GitHub job is its own machine, so this job
+  # sets Node up again; the pnpm preamble is the shared `.github/actions/setup-pnpm` action
+  # (joshuafolkken/kit#2982), whose own action pins `scripts/ci/ci-yml-action-parity.test.ts` counts
+  # as this file's when it compares them with `templates/workflows/ci.yml`.
   #
   # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `gate-plan.ts` leaves
   # any machine below its measured 11 cores uncapped, so vitest sizes its own pool from the runner
@@ -380,7 +336,7 @@ jobs:
   unit:
     name: Unit Tests
     needs: reuse-pr-checks
-    if: ${{ always() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -396,41 +352,10 @@ jobs:
           node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
         with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # **Through `josh test:unit`, never `vitest run` directly, and that is what makes a job split
       # safe rather than a hole.** The guard decides between a skip and a failure, and
@@ -457,6 +382,10 @@ jobs:
   # through with an E2E suite that never ran (see the `Detect E2E` job below, and
   # https://github.com/joshuafolkken/kit/issues/991). A skipped aggregator would have reproduced that
   # defect on the unit suite. Running always and failing explicitly is the only shape that cannot.
+  # That is also why this job alone keeps `always()` while the two halves use `!cancelled()`
+  # (joshuafolkken/kit#2980): a cancelled run must stop the minutes-long halves, but a skipped
+  # `Checks` on a cancelled head-SHA run would read as passing, so this seconds-long job still runs
+  # and fails on the halves' `cancelled` results.
   #
   # The results are read from the environment rather than interpolated into the script. `needs.*.result`
   # is a GitHub-controlled enum and not attacker-controlled, but a `${{ }}` expression spliced into a
@@ -601,30 +530,6 @@ jobs:
           node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -636,17 +541,10 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-build-cache-e2e-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Only needed on the fallback path: the container image already ships browsers
       # matching its own Playwright version. Invoked through the local bin rather than