@joshuafolkken/kit 1.1050.0 → 1.1128.0

package/scripts/init/claude-plugin-config.ts

@@ -13,9 +13,10 @@ const PLUGIN_ID = 'kit@kit'
 const MARKETPLACE_PATH = './node_modules/@joshuafolkken/kit'
 const CLAUDE_SETTINGS_DESTINATION = path.join('.claude', 'settings.json')
 
-// `enabledPlugins` declares the plugin; `extraKnownMarketplaces` says where to find it. The CLI does
-// not auto-install from these alone — a consumer runs `claude plugin install kit@kit` once — so the
-// declaration is what makes that one command resolve without further arguments.
+// `enabledPlugins` declares the plugin; `extraKnownMarketplaces` says where to find it. Nothing needs
+// installing: in a trusted workspace Claude Code registers the marketplace from this declaration and
+// loads the skills — an interactive session from its first session, a headless one (`claude -p`) from
+// its second (joshuafolkken/kit#2990).
 const PLUGIN_SETTINGS: Record<string, unknown> = {
 	extraKnownMarketplaces: {
 		[MARKETPLACE_NAME]: { source: { source: 'directory', path: MARKETPLACE_PATH } },
@@ -39,11 +40,9 @@ function apply_plugin_config_for_destination(destination_path: string, content:
 }
 
 const claude_plugin_config = {
-	MARKETPLACE_NAME,
 	PLUGIN_ID,
 	MARKETPLACE_PATH,
 	CLAUDE_SETTINGS_DESTINATION,
-	PLUGIN_SETTINGS,
 	inject_plugin_config,
 	apply_plugin_config_for_destination,
 }

package/scripts/init/hook-command-rewrite.ts

@@ -1,4 +1,3 @@
-import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
 import { claude_plugin_config } from './claude-plugin-config'
 import { hook_launch } from './hook-launch'
 
@@ -27,8 +26,11 @@ const MISSING_INSTALL_NOTICE = 'kit hooks inactive: run pnpm install, then rerea
 const MISSING_INSTALL_GUARD = `if [ ! -f ${CONSUMER_PACKAGE_MANIFEST} ]; then echo '${MISSING_INSTALL_NOTICE}' >&2; exit 0; fi; `
 const CODEX_ADAPTER_BUNDLE = `node ${CONSUMER_HOOK_BUNDLE_DIR}codex-hook-adapter.js`
 const CODEX_HOOKS_DESTINATION = '.codex/hooks.json'
-const GIT_UNSET_OPTIONS = GIT_LOCATION_VARIABLES.map((name) => `-u ${name}`).join(' ')
-const PROJECT_ROOT_PREFIX = String.raw`if project_root=\"$(env ${GIT_UNSET_OPTIONS} git rev-parse --show-toplevel 2>/dev/null)\"; then unset ${GIT_LOCATION_VARIABLES.join(' ')}; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && `
+// The values below are matched inside raw JSON text, so the root prefix is taken in its escaped form.
+const PROJECT_ROOT_PREFIX = JSON.stringify(hook_launch.PROJECT_ROOT_PREFIX).slice(1, -1)
+// The installed package ships its bundles built, so they cannot be stale against a source the consumer
+// never has: the ready gate kit's own commands pass (joshuafolkken/kit#2984) becomes a presence check.
+const CONSUMER_READY_GATE = `[ -d ${CONSUMER_HOOK_BUNDLE_DIR} ]`
 // Capture the value of every `"command"` field, escapes and all, so the rewrites below touch command
 // values alone — never an echo reminder's prose or a `"description"` that merely mentions the string.
 const COMMAND_FIELD = /("command":\s*")((?:[^"\\]|\\.)*)(")/gu
@@ -49,6 +51,8 @@ function rebase_bundle_directory(value: string): string {
 // holds no `pnpm josh `), so the whole rewrite is safe to run more than once.
 function rewrite_command_value(value: string): string {
 	const rewritten = rebase_bundle_directory(value)
+		.split(hook_launch.BUNDLE_READY_GATE)
+		.join(CONSUMER_READY_GATE)
 		.split(PNPM_JOSH_PREFIX)
 		.join(BUNDLE_INVOCATION)
 		.split(CODEX_ADAPTER_SOURCE)
@@ -60,12 +64,18 @@ function rewrite_command_value(value: string): string {
 	return `${MISSING_INSTALL_GUARD}${rewritten}`
 }
 
+// kit's own commands already start from the root (`hook-launch.ts`), and so does an already-rewritten
+// value. The prefix is taken off before the rewrite and put back after it, so the install guard sits
+// behind the `cd` it depends on and a second pass never doubles the prefix.
+function without_root_prefix(value: string): string {
+	return value.startsWith(PROJECT_ROOT_PREFIX) ? value.slice(PROJECT_ROOT_PREFIX.length) : value
+}
+
 function rewrite_hook_commands(content: string, is_codex = false): string {
 	return content.replaceAll(COMMAND_FIELD, (_match, open: string, value: string, close: string) => {
-		const rewritten = rewrite_command_value(value)
+		const rewritten = rewrite_command_value(without_root_prefix(value))
 		const should_select_root = is_codex || rewritten.includes(claude_plugin_config.MARKETPLACE_PATH)
-		const prefix =
-			should_select_root && !rewritten.startsWith(PROJECT_ROOT_PREFIX) ? PROJECT_ROOT_PREFIX : ''
+		const prefix = should_select_root ? PROJECT_ROOT_PREFIX : ''
 
 		return `${open}${prefix}${rewritten}${close}`
 	})
@@ -89,8 +99,6 @@ function apply_hook_command_rewrite_for_destination(
 
 const hook_command_rewrite = {
 	apply_hook_command_rewrite_for_destination,
-	BUNDLE_INVOCATION,
-	PNPM_JOSH_PREFIX,
 	rewrite_hook_commands,
 }
 

package/scripts/init/hook-launch.ts

@@ -1,31 +1,57 @@
+import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
+
 // The shell command a Claude Code hook is launched with, so it starts without a `pnpm` wrapper — and,
 // for a consumer, without the `dist/josh.js` dispatcher re-spawning `tsx` for the hook's `.ts`
 // (joshuafolkken/kit#2023). Each hook is pre-built to its own `dist/hooks/<name>.js`
 // (`scripts/build/build-hooks.ts`) and launched directly with `node`.
 //
-// **The fallback is a real branch, not a courtesy.** A fresh clone has no `dist/hooks/` until
-// `pnpm build` runs, so the command prefers the bundle and drops to `pnpm josh <command>` (the live
-// `tsx` source) when the bundle is absent, rather than passing silently. **An `if`/`else`, never
-// `&&`/`||`**: a guard's refusal is a non-zero exit, and a `node … || pnpm josh …` chain would read
-// that refusal as a missing bundle and run the hook twice. `[ -f ]` decides on the file alone and
-// leaves the chosen branch's exit code untouched.
-
-// Relative to the working directory a hook runs in — kit's own root, where the built `dist/hooks/`
-// sits. The consumer rewrite (`hook-command-rewrite.ts`) rebases this onto the installed package.
+// **The command starts from the project root, never from wherever the session happens to be**
+// (joshuafolkken/kit#2984). Every path after the prefix is relative, so a hook fired from a
+// subdirectory would otherwise miss its bundle. The root is git's, with the location variables a git
+// hook exports cleared first — the same resolution the consumer rewrite (`hook-command-rewrite.ts`)
+// applies, so both sides stay one mechanism for Claude Code and Codex alike.
+//
+// **The bundle runs only once the ready gate passes** (`scripts/hooks/hook-bundle-ready.ts`): it
+// rebuilds `dist/hooks/` when the source beside it has changed, so an edited guard is never shadowed by
+// its old bundle. The gate failing — a checkout that cannot build — drops to the fallback, the live
+// source. **An `if`/`else`, never `&&`/`||`**: a guard's refusal is a non-zero exit, and a
+// `node … || pnpm josh …` chain would read that refusal as a missing bundle and run the hook twice.
+
 const HOOK_DIST_DIR = 'dist/hooks'
+const UNSET_OPTIONS = GIT_LOCATION_VARIABLES.map((name) => `-u ${name}`).join(' ')
+const PROJECT_ROOT_PREFIX = `if project_root="$(env ${UNSET_OPTIONS} git rev-parse --show-toplevel 2>/dev/null)"; then unset ${GIT_LOCATION_VARIABLES.join(' ')}; else project_root="$(git rev-parse --show-toplevel)" || exit 1; fi; cd "$project_root" && `
+// Plain `node` runs the gate's TypeScript directly; the flag keeps Node 22's type-stripping notice off
+// every hook's stderr.
+const BUNDLE_READY_GATE =
+	'node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts'
 
-// Prefer `primary_path` (run as `node <path>`) when it exists, else run `fallback_command` verbatim.
-// Kept generic so a test can exercise the branch selection with stub commands rather than real hooks.
-function launch_command(primary_path: string, fallback_command: string): string {
-	return `if [ -f ${primary_path} ]; then node ${primary_path}; else ${fallback_command}; fi`
+// Run `primary_command` when `gate` exits 0, else `fallback_command` — both verbatim. Kept generic so
+// a test can exercise the branch selection with stub commands rather than real hooks.
+function launch_command(gate: string, primary_command: string, fallback_command: string): string {
+	return `if ${gate}; then ${primary_command}; else ${fallback_command}; fi`
+}
+
+// `invocation` is the hook's file under `dist/hooks` plus any arguments (e.g. `pretool-guard.js`);
+// `fallback_command` runs the same hook from source.
+function bundle_launch_command(invocation: string, fallback_command: string): string {
+	const primary = `node ${HOOK_DIST_DIR}/${invocation}`
+
+	return `${PROJECT_ROOT_PREFIX}${launch_command(BUNDLE_READY_GATE, primary, fallback_command)}`
 }
 
 // `bundle` is the hook's file under `dist/hooks` (e.g. `pretool-guard.js`); `command` is the josh
 // subcommand the fallback runs (e.g. `pretool:guard`).
 function hook_launch_command(bundle: string, command: string): string {
-	return launch_command(`${HOOK_DIST_DIR}/${bundle}`, `pnpm josh ${command}`)
+	return bundle_launch_command(bundle, `pnpm josh ${command}`)
 }
 
-const hook_launch = { HOOK_DIST_DIR, hook_launch_command, launch_command }
+const hook_launch = {
+	BUNDLE_READY_GATE,
+	bundle_launch_command,
+	HOOK_DIST_DIR,
+	hook_launch_command,
+	launch_command,
+	PROJECT_ROOT_PREFIX,
+}
 
 export { hook_launch }

package/scripts/init/init-basic.ts

@@ -1,4 +1,5 @@
 import { json_format } from '#scripts/config-merge/json-format'
+import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 import { init_logic } from './init-logic'
 import type { ProjectShape } from './project-profile'
@@ -6,10 +7,6 @@ import type { ProjectShape } from './project-profile'
 const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
 const record_schema = z.record(z.string(), z.unknown())
 
-function is_record(value: unknown): value is Record<string, unknown> {
-	return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
 interface BasicVersions {
 	kit: string
 	prettier: string
@@ -23,7 +20,7 @@ function with_recorded_profile(content: string, profile: ProjectShape['profile']
 	const parsed: unknown = JSON.parse(content)
 	const manifest = record_schema.parse(parsed)
 	const existing = manifest['josh']
-	const josh = is_record(existing) ? existing : {}
+	const josh = json_value.is_record(existing) ? existing : {}
 
 	manifest['josh'] = { ...josh, profile }
 

package/scripts/init/init-file-action.ts

@@ -0,0 +1,54 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import type { FileAction } from './init-actions'
+
+const SAMPLE_INDENT_WIDTH = 4
+const SAMPLE_INDENT = ' '.repeat(SAMPLE_INDENT_WIDTH)
+
+function write_new_file(action: FileAction, destination_path: string): void {
+	mkdirSync(path.dirname(destination_path), { recursive: true })
+	writeFileSync(destination_path, action.create())
+	console.info(`  ✔ created   ${action.dest}`)
+}
+
+function show_sample(action: FileAction): void {
+	console.info(`  ⚠ exists    ${action.dest} — add manually:`)
+	console.info('')
+	console.info(action.create().replaceAll(/^/gmu, () => SAMPLE_INDENT))
+}
+
+// A file that already holds the sample needs nothing added, so only one that differs gets it shown —
+// for a create-only file (no merge) as for a merge that only migrates a kit-written line (#3069).
+function report_unchanged(action: FileAction, existing: string): void {
+	const is_sample_missing = existing !== action.create()
+	const should_show_sample =
+		action.merge === undefined || action.should_show_sample_when_unchanged === true
+
+	if (is_sample_missing && should_show_sample) show_sample(action)
+	else console.info(`  ✔ unchanged ${action.dest}`)
+}
+
+function merge_existing_file(action: FileAction, destination_path: string): void {
+	const existing = readFileSync(destination_path, 'utf8')
+	const merged = action.merge === undefined ? existing : action.merge(existing)
+
+	if (merged === existing) {
+		report_unchanged(action, existing)
+
+		return
+	}
+
+	writeFileSync(destination_path, merged)
+	console.info(`  ✔ updated   ${action.dest}`)
+}
+
+function execute_file_action(action: FileAction, project_root: string): void {
+	const destination_path = path.join(project_root, action.dest)
+
+	if (existsSync(destination_path)) merge_existing_file(action, destination_path)
+	else write_new_file(action, destination_path)
+}
+
+const init_file_action = { execute_file_action }
+
+export { init_file_action }

package/scripts/init/init-logic-migrate.ts

@@ -4,6 +4,27 @@ const PREINSTALL_KEY = 'preinstall'
 const JF_PREFIX = 'jf-'
 const JOSH_PREFIX = 'josh '
 
+// The plain values kit wrote before its scripts became josh subcommands (#80). `check` is left out:
+// its value is the one `sv create` writes itself, so it cannot be told apart from the project's own.
+const PRE_JOSH_SCRIPT_VALUES: ReadonlyMap<string, string> = new Map([
+	['lint', 'pnpm lint:prettier && pnpm lint:eslint'],
+	['lint:prettier', 'prettier --check .'],
+	['lint:eslint', 'eslint . --cache --cache-strategy content'],
+	['format', 'pnpm format:prettier && pnpm format:eslint'],
+	['format:prettier', 'prettier --write .'],
+	['format:eslint', 'eslint . --fix --cache --cache-strategy content'],
+	['cspell', 'cspell lint --no-must-find-files --no-progress "**/*.{ts,js,md,yaml,yml,json}"'],
+	['cspell:dot', 'pnpm cspell . --dot'],
+	['test:unit', 'vitest run'],
+	['lefthook:install', 'lefthook install'],
+	['lefthook:uninstall', 'lefthook uninstall'],
+	['lefthook:commit', 'lefthook run pre-commit'],
+	['lefthook:push', 'lefthook run pre-push'],
+	['main:sync', 'git checkout main && git pull'],
+	['main:merge', 'git pull origin main'],
+	['check:ci', 'svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --threshold error'],
+])
+
 const RETIRED_MANAGED_SCRIPTS = new Set<string>([
 	'git',
 	'git:followup',
@@ -18,30 +39,15 @@ const RETIRED_MANAGED_SCRIPTS = new Set<string>([
 	'version:patch',
 	'version:current',
 	'overrides:check',
-	'lint',
-	'lint:prettier',
-	'lint:eslint',
-	'format',
-	'format:prettier',
-	'format:eslint',
-	'cspell',
-	'cspell:dot',
-	'test:unit',
 	'test:e2e',
 	'test',
-	'lefthook:install',
-	'lefthook:uninstall',
-	'lefthook:commit',
-	'lefthook:push',
-	'main:sync',
-	'main:merge',
 	'latest',
 	'latest:corepack',
 	'latest:update',
 	'check',
-	'check:ci',
 	'check:svelte',
 	'check:svelte:ci',
+	...PRE_JOSH_SCRIPT_VALUES.keys(),
 ])
 
 function migrate_jf_value(value: string): string {
@@ -62,9 +68,21 @@ function apply_jf_migrations(scripts: Record<string, string>): Record<string, st
 	)
 }
 
+function is_kit_written(key: string, value: string): boolean {
+	if (value.startsWith(JOSH_PREFIX) || value.startsWith(JF_PREFIX)) return true
+
+	return PRE_JOSH_SCRIPT_VALUES.get(key) === value
+}
+
+// A retired name alone does not make a script kit's: `sv create` writes its own `check`, which must
+// survive `josh init` (joshuafolkken/kit#3069). Only a value kit itself wrote is retired.
+function is_retired_script(key: string, value: string): boolean {
+	return RETIRED_MANAGED_SCRIPTS.has(key) && is_kit_written(key, value)
+}
+
 function remove_retired_scripts(scripts: Record<string, string>): Record<string, string> {
 	return Object.fromEntries(
-		Object.entries(scripts).filter(([key]) => !RETIRED_MANAGED_SCRIPTS.has(key)),
+		Object.entries(scripts).filter(([key, value]) => !is_retired_script(key, value)),
 	)
 }
 

package/scripts/init/init-logic-secretlint.ts

@@ -5,7 +5,7 @@ const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
 
 // secretlint resolves both its CLI and every rule package from the project it runs in, not
 // transitively through the kit — the same constraint that forces the prettier plugins into
-// consumer devDependencies (see PRETTIER_PLUGIN_DEV_DEPS in init-logic.ts). Omitting either
+// consumer devDependencies (as kit peers, see init.ts). Omitting either
 // entry makes the pre-commit hook fail with "Cannot find module". Versions mirror the kit's
 // own devDependencies.
 const SECRETLINT_DEV_DEPS: Record<string, string> = {

package/scripts/init/init-logic.ts

@@ -92,6 +92,13 @@ const AI_COPY_FILES: ReadonlyArray<string> = [
 	'.github/workflows/production.yml',
 	'.github/workflows/sonar-qube.yml',
 	'.github/workflows/pr-classification.yml',
+	// Called by `ci.yml` and `pr-classification.yml` as `uses: ./.github/actions/setup-pnpm`; without
+	// it the consumer's jobs cannot resolve the action and their checks fail (joshuafolkken/kit#3013,
+	// joshuafolkken/kit#3095).
+	'.github/actions/setup-pnpm/action.yml',
+	// The one place the workflows' Node.js version is written, called by every distributed workflow
+	// that sets Node.js up (joshuafolkken/kit#3084).
+	'.github/actions/setup-node/action.yml',
 	'.github/pull_request_template.md',
 	'.github/release.yml',
 	'.github/dependabot.yml',
@@ -118,6 +125,9 @@ const AI_COPY_FILE_MAPPINGS: ReadonlyArray<FileCopyMapping> = [
 		src: 'templates/workflows/dependabot-auto-merge.yml',
 		dest: '.github/workflows/dependabot-auto-merge.yml',
 	},
+	// A template rather than a copy of kit's own file: kit releases from its publish.yml, so the file
+	// must not run in kit as well (joshuafolkken/kit#3007).
+	{ src: 'templates/workflows/github-release.yml', dest: '.github/workflows/github-release.yml' },
 ]
 
 // Empty since joshuafolkken/kit#1879: the five skill directories kit used to copy whole
@@ -213,20 +223,6 @@ const SUGGESTED_SCRIPTS_COMMON: Record<string, string> = {
 	josh: 'josh',
 }
 
-// prettier resolves its `plugins[]` from the consumer project, not transitively through the kit,
-// so every package that uses the kit prettier preset must declare these as devDependencies. The
-// preset references all three unconditionally (prettier/index.js → plugins), hence all three are
-// added regardless of project — omitting any breaks `prettier`/`josh lint` with a
-// "Cannot find package" error. Versions mirror the kit's own devDependencies.
-const SORT_IMPORTS_PLUGIN_KEY = '@ianvs/prettier-plugin-sort-imports'
-const PRETTIER_SVELTE_PLUGIN_KEY = 'prettier-plugin-svelte'
-const PRETTIER_TAILWIND_PLUGIN_KEY = 'prettier-plugin-tailwindcss'
-const PRETTIER_PLUGIN_DEV_DEPS: Record<string, string> = {
-	[SORT_IMPORTS_PLUGIN_KEY]: '^4.7.1',
-	[PRETTIER_SVELTE_PLUGIN_KEY]: '^4.1.1',
-	[PRETTIER_TAILWIND_PLUGIN_KEY]: '^0.8.0',
-}
-
 // format_json rather than JSON.stringify: it lays arrays out the way prettier does — inline while
 // they fit within printWidth, one element per line once they do not — so the file kit writes is
 // `prettier --check`-clean in the consumer whatever the entry count happens to be (#660).
@@ -426,10 +422,6 @@ function strip_managed_postinstall(content: string): string {
 	)
 }
 
-function merge_prettier_plugin_development_deps(content: string): string {
-	return init_logic_json_merge.merge_development_dependencies(content, PRETTIER_PLUGIN_DEV_DEPS)
-}
-
 const init_logic = {
 	...init_logic_templates,
 	...init_logic_workspace,
@@ -447,7 +439,6 @@ const init_logic = {
 	generate_npmrc,
 	merge_npmrc,
 	merge_gitignore,
-	merge_prettier_plugin_development_deps,
 	get_tsconfig_extends_entry,
 	get_tsconfig_preset_filename,
 	get_lefthook_extends_value,

package/scripts/init/init.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env tsx
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { resolve_local_bin } from '#scripts/build/local-bin'
@@ -7,6 +7,7 @@ import { doctor_io } from '#scripts/doctor/doctor-io'
 import { error_text } from '#scripts/lib/error-message'
 import { package_version_schema, with_package_manager_schema } from '#scripts/lib/schemas'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { pack_hook } from '#scripts/safe-chain/pack-hook'
 import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { did_refuse_self_run } from '#scripts/self-sync-guard/self-sync-refusal'
@@ -14,83 +15,24 @@ import { sync } from '#scripts/sync/sync'
 import { package_manager_version } from '#scripts/version/package-manager-version'
 import { execaSync } from 'execa'
 import { z } from 'zod'
-import { init_actions, PRETTIER_CONFIG_JS, type FileAction } from './init-actions'
+import { init_actions, PRETTIER_CONFIG_JS } from './init-actions'
 import { init_ai_copy } from './init-ai-copy'
 import { init_basic } from './init-basic'
 import { init_bootstrap } from './init-bootstrap'
+import { init_file_action } from './init-file-action'
 import { init_install } from './init-install'
 import { init_logic } from './init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from './init-paths'
 import { kit_setup_state } from './kit-setup-state'
-import { plugin_install_hint_module } from './plugin-install-hint'
 import { project_profile, type ProjectProfile, type ProjectShape } from './project-profile'
 
 const PACKAGE_JSON = 'package.json'
 const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
 const LEFTHOOK_BIN = 'lefthook'
-const SAMPLE_INDENT_WIDTH = 4
 const ARGUMENT_START_INDEX = 2
-const SAMPLE_INDENT = ' '.repeat(SAMPLE_INDENT_WIDTH)
 const INSTALL_HINT = '→ run `pnpm install` to install what package.json lists'
 const INIT_USAGE = 'josh init [--profile basic|full] [--no-install]'
 
-function write_new_file(action: FileAction, destination_path: string): void {
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, action.create())
-	console.info(`  ✔ created   ${action.dest}`)
-}
-
-function show_sample(action: FileAction): void {
-	console.info(`  ⚠ exists    ${action.dest} — add manually:`)
-	console.info('')
-	console.info(action.create().replaceAll(/^/gmu, () => SAMPLE_INDENT))
-}
-
-// A file that already holds the sample needs nothing added, so only one that differs gets it shown.
-function report_unchanged(action: FileAction, existing: string): void {
-	const is_sample_missing = existing !== action.create()
-
-	if (is_sample_missing && action.should_show_sample_when_unchanged === true) show_sample(action)
-	else console.info(`  ✔ unchanged ${action.dest}`)
-}
-
-function merge_existing_file(
-	merge_function: (existing: string) => string,
-	destination_path: string,
-	action: FileAction,
-): void {
-	const existing = readFileSync(destination_path, 'utf8')
-	const merged = merge_function(existing)
-
-	if (merged === existing) {
-		report_unchanged(action, existing)
-
-		return
-	}
-
-	writeFileSync(destination_path, merged)
-	console.info(`  ✔ updated   ${action.dest}`)
-}
-
-function execute_file_action(action: FileAction): void {
-	const destination_path = path.join(PROJECT_ROOT, action.dest)
-	const is_existing = existsSync(destination_path)
-
-	if (!is_existing) {
-		write_new_file(action, destination_path)
-
-		return
-	}
-
-	if (action.merge === undefined) {
-		show_sample(action)
-
-		return
-	}
-
-	merge_existing_file(action.merge, destination_path, action)
-}
-
 const engine_pin_schema = z.looseObject({ name: z.string(), version: z.string() })
 
 const published_development_engines_schema = z.looseObject({
@@ -125,10 +67,10 @@ function get_kit_self_dependency(): Record<string, string> {
 }
 
 // Each config `init` generates runs a CLI or imports types the consumer has to resolve itself:
-// `prettier.config.js` → prettier, `cspell.config.yaml` → cspell, `playwright.config.ts` →
-// @types/node (with @playwright/test among the peers), `lefthook.yml` → lefthook. Without them the
-// first `josh gate` after `pnpm install` fails (joshuafolkken/kit#2710).
-const TOOL_DEVELOPMENT_DEPENDENCIES = ['prettier', 'cspell', '@types/node']
+// `cspell.config.yaml` → cspell, `playwright.config.ts` → @types/node, `lefthook.yml` → lefthook.
+// Prettier, its preset plugins and @playwright/test come in as peers. Without them the first
+// `josh gate` after `pnpm install` fails (joshuafolkken/kit#2710).
+const TOOL_DEVELOPMENT_DEPENDENCIES = ['cspell', '@types/node']
 const LEFTHOOK_DEVELOPMENT_DEPENDENCY = 'lefthook'
 
 function tool_dependency_names(has_git: boolean): ReadonlyArray<string> {
@@ -165,9 +107,8 @@ function apply_dependency_merges(content: string, has_git = true): string {
 			? suggested
 			: Object.fromEntries(Object.entries(suggested).filter(([key]) => key !== 'prepare')),
 	)
-	const with_prettier = init_logic.merge_prettier_plugin_development_deps(merged)
 	const with_toolchain = init_logic.merge_development_dependencies(
-		with_prettier,
+		merged,
 		get_toolchain_development_dependencies(has_git),
 	)
 	const with_secretlint = init_logic.merge_secretlint_development_deps(with_toolchain)
@@ -263,7 +204,7 @@ function run_config_file_actions(shape: ProjectShape): void {
 	}
 
 	for (const action of init_actions.build_file_actions(shape)) {
-		execute_file_action(action)
+		init_file_action.execute_file_action(action, PROJECT_ROOT)
 	}
 }
 
@@ -295,8 +236,6 @@ function run_ai_file_actions(shape: ProjectShape): void {
 	const name_with_owner = init_ai_copy.run_ai_copies(shape)
 
 	if (shape.has_github) report_repository_settings(name_with_owner)
-
-	if (shape.profile === 'full') plugin_install_hint_module.report_plugin_install_hint()
 }
 
 function initialize_project(shape: ProjectShape): void {
@@ -308,6 +247,7 @@ function initialize_project(shape: ProjectShape): void {
 	merge_project_package_json(shape)
 
 	run_ai_file_actions(shape)
+	pack_hook.sync_pack_hook(PROJECT_ROOT, PACKAGE_DIR)
 	if (shape.profile === 'full') project_config.sync_project_config(PROJECT_ROOT)
 }
 

package/scripts/init/kit-written-paths.ts

@@ -1,3 +1,4 @@
+import { PACK_HOOK_FILE } from '#scripts/safe-chain/pack-hook'
 import { PROJECT_CONFIG_FILE } from '#scripts/safe-chain/project-config'
 import { managed_config_scope } from '#scripts/sync/managed-config-scope'
 import { BASIC_PRETTIER_CONFIG } from './init-actions'
@@ -13,6 +14,7 @@ const SETUP_ONLY_PATHS: ReadonlySet<string> = new Set([
 	CLAUDE_MD_FILENAME,
 	BASIC_PRETTIER_CONFIG,
 	PROJECT_CONFIG_FILE,
+	PACK_HOOK_FILE,
 	MANIFEST_FILE,
 	LOCKFILE,
 ])

package/scripts/init/project-profile.ts

@@ -1,8 +1,9 @@
 import { existsSync, readdirSync, readFileSync, type Dirent } from 'node:fs'
 import path from 'node:path'
 import { repo_origin } from '#scripts/discovery/repo-origin'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
+import { json_value } from '#scripts/lib/json-value'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
-import { execaSync } from 'execa'
 
 type ProjectProfile = 'basic' | 'full'
 
@@ -73,32 +74,26 @@ function read_manifest(root: string): Record<string, unknown> | undefined {
 	if (!existsSync(filename)) return undefined
 	const parsed: unknown = JSON.parse(readFileSync(filename, 'utf8'))
 
-	if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-		throw new Error('package.json must contain an object')
-	}
-
-	return parsed as Record<string, unknown>
-}
+	if (!json_value.is_record(parsed)) throw new Error('package.json must contain an object')
 
-function is_record(value: unknown): value is Record<string, unknown> {
-	return typeof value === 'object' && value !== null && !Array.isArray(value)
+	return parsed
 }
 
 function recorded_profile(manifest: Record<string, unknown>): ProjectProfile | undefined {
 	const { josh } = manifest
 
-	return is_record(josh) ? parse_profile(josh['profile']) : undefined
+	return json_value.is_record(josh) ? parse_profile(josh['profile']) : undefined
 }
 
 function has_build_script(value: unknown): boolean {
-	return is_record(value) && ('build' in value || 'dev' in value)
+	return json_value.is_record(value) && ('build' in value || 'dev' in value)
 }
 
 // kit itself is not evidence of a Node toolchain: `pnpm add -D @joshuafolkken/kit` before
 // `josh init` is the documented order, and it must still leave an `index.html` site on the basic
 // profile (joshuafolkken/kit#2693).
 function has_project_dependencies(value: unknown): boolean {
-	if (!is_record(value)) return false
+	if (!json_value.is_record(value)) return false
 
 	return Object.keys(value).some((name) => name !== KIT_PACKAGE_NAME)
 }
@@ -164,12 +159,9 @@ function scan_files(root: string): { has_web: boolean; has_typescript: boolean }
 }
 
 function has_github_remote(root: string): boolean {
-	const result = execaSync('git', ['config', '--get', 'remote.origin.url'], {
-		cwd: root,
-		reject: false,
-	})
+	const url = git_spawn_sync.origin_url(root)
 
-	return result.exitCode === 0 && repo_origin.parse_origin_url(result.stdout) !== undefined
+	return url !== undefined && repo_origin.parse_origin_url(url) !== undefined
 }
 
 function inspect_project(root: string, requested?: ProjectProfile): ProjectShape {

package/scripts/init/start-exec.ts

@@ -1,4 +1,4 @@
-import { git_gh_exec } from '#scripts/git/git-gh-exec'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
 import { execaSync } from 'execa'
 
 // The three spawn shapes every `josh start` step uses, shared by `start-steps.ts`, the setup pull

package/scripts/init/start-setup-pr.ts

@@ -1,10 +1,10 @@
-import { git_gh_api_path } from '#scripts/git/git-gh-api-path'
-import { git_gh_exec } from '#scripts/git/git-gh-exec'
-import { git_gh_issue_write } from '#scripts/git/git-gh-issue-write'
+import { git_gh_api_path } from '#scripts/gh/git-gh-api-path'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
+import { git_gh_issue_write } from '#scripts/gh/git-gh-issue-write'
+import { git_pr } from '#scripts/gh/git-pr'
+import { github_issue_url } from '#scripts/gh/github-issue-url'
 import { git_issue, type IssueInfo } from '#scripts/git/git-issue'
-import { git_pr } from '#scripts/git/git-pr'
-import { github_issue_url } from '#scripts/git/github-issue-url'
-import { IGNORE_FOR_RELEASE_LABEL } from '#scripts/git/issue-labels'
+import { IGNORE_FOR_RELEASE_LABEL } from '#scripts/issue/issue-labels'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
 import { kit_written_paths } from './kit-written-paths'
 import { start_exec } from './start-exec'