@joshuafolkken/kit 1.1050.0 → 1.1128.0

package/scripts/version/version-commands.ts

@@ -24,6 +24,8 @@ import { version_targets } from './version-targets'
 const FAILURE_EXIT_CODE = 1
 const ALREADY_UP_TO_DATE = 'Already up to date'
 const NO_QUARANTINE_MINUTES = 0
+// A global install that goes to the network — the same ten minutes `lane-install.ts` gives one.
+const UPGRADE_TIMEOUT_MS = 600_000
 
 // What the local minimum-release-age policy permits for one package. Resolved per package because
 // the newest installable release is a property of that package's own publish history. Returns a hold
@@ -195,8 +197,16 @@ function run_check(config: VersionCommandConfig): void {
 	)
 }
 
+// Through `sh -c` because an upgrade command is the user's own configured string — `pnpm add -g …`,
+// or a chain with `&&` — so it is inside the trust boundary and needs a shell to mean what it says.
+// The bound keeps a registry that never answers from holding `josh version` open forever; a timed-out
+// run has no exit code, so it falls through to the failure code like any other failed step.
 function run_upgrade_command(command: string): number {
-	const result = execaSync('sh', ['-c', command], { stdio: 'inherit', reject: false })
+	const result = execaSync('sh', ['-c', command], {
+		stdio: 'inherit',
+		reject: false,
+		timeout: UPGRADE_TIMEOUT_MS,
+	})
 
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }

package/scripts/version/version-remote.ts

@@ -1,7 +1,7 @@
-import { git_gh_exec } from '#scripts/git/git-gh-exec'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
 import { error_text } from '#scripts/lib/error-message'
+import { json_value } from '#scripts/lib/json-value'
 import { npm_registry } from './npm-registry'
-import { safe_json_parse } from './parse-json'
 import { release_age } from './release-age'
 
 // Enough history to reach past a quarantine window into the newest release that has aged out of it.
@@ -68,7 +68,7 @@ function read_github_release_times(versions_endpoint: string): Record<string, st
 	const endpoint = with_page_size(versions_endpoint, TIMES_PAGE_SIZE)
 	const stdout = git_gh_exec.read_gh_api_sync({ path: endpoint, jq_filter: TIMES_JQ })
 	if (stdout === undefined) return undefined
-	const parsed = release_age.release_times_schema.safeParse(safe_json_parse(stdout))
+	const parsed = release_age.release_times_schema.safeParse(json_value.parse_or_undefined(stdout))
 
 	return parsed.success ? parsed.data : undefined
 }

package/scripts/version/version-targets.ts

@@ -1,8 +1,8 @@
 import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
 import { file_reader } from '#scripts/lib/read-file'
 import { package_version_schema, pnpm_ls_global_schema } from '#scripts/lib/schemas'
 import { execaSync } from 'execa'
-import { safe_json_parse } from './parse-json'
 
 const NODE_MODULES = 'node_modules'
 const PACKAGE_JSON = 'package.json'
@@ -15,7 +15,7 @@ function build_pnpm_ls_arguments(package_name: string): Array<string> {
 // Read the globally installed version from `pnpm ls -g --json` output. Returns undefined when
 // the package is absent or the output cannot be parsed (e.g. pnpm missing, empty stdout).
 function parse_global_version(stdout: string, package_name: string): string | undefined {
-	const parsed = pnpm_ls_global_schema.safeParse(safe_json_parse(stdout))
+	const parsed = pnpm_ls_global_schema.safeParse(json_value.parse_or_undefined(stdout))
 	if (!parsed.success) return undefined
 
 	return parsed.data[0]?.dependencies?.[package_name]?.version
@@ -25,7 +25,7 @@ function parse_global_version(stdout: string, package_name: string): string | un
 // file is missing (raw is undefined) or malformed.
 function parse_project_version(raw: string | undefined): string | undefined {
 	if (raw === undefined) return undefined
-	const parsed = package_version_schema.safeParse(safe_json_parse(raw))
+	const parsed = package_version_schema.safeParse(json_value.parse_or_undefined(raw))
 
 	return parsed.success ? parsed.data.version : undefined
 }
@@ -61,7 +61,7 @@ function read_workspace_version(cwd: string): string | undefined {
 // `📦 project version: <v>` for the end of a workflow. Both are gone (joshuafolkken/kit#1486): a
 // child no longer bumps, so the local manifest names the *previous* release rather than what the run
 // ships, and every caller now prints the count of unreleased merges instead
-// (`scripts/git/git-followup-pending.ts`). Removed rather than left unused, so nothing reaches for
+// (`scripts/followup/git-followup-pending.ts`). Removed rather than left unused, so nothing reaches for
 // the misleading reading again.
 
 const version_targets = {

package/templates/CLAUDE.basic.md

@@ -1,8 +1,8 @@
 # Project instructions
 
-- 既存のファイルと利用者の設定を尊重し、変更する前に内容を確認する。
-- 変更には検証を付け、実行した結果を報告する。
-- HTML、CSS、JavaScript のファイルがある場合は Prettier で整形する。
-- 画面に見える変更をした場合はブラウザーで表示と操作を確認する。
-- JavaScript または TypeScript の動作を変更した場合は、その動作を確認する自動テストを追加する。
-- Git や GitHub を使う場合だけ、それぞれのワークフローを利用する。
+- Respect existing files and the user's settings, and read a file's contents before changing it.
+- Verify every change, and report the results you actually observed.
+- Format HTML, CSS and JavaScript files with Prettier when the project has any.
+- After a change that is visible on screen, check its display and interaction in a browser.
+- After changing JavaScript or TypeScript behavior, add an automated test that checks that behavior.
+- Use the Git or GitHub workflow only when you use Git or GitHub.

package/templates/sonar-project.properties

@@ -24,7 +24,11 @@ sonar.exclusions=.claude/**,scripts/**
 # tooling. A `*-file` flag takes a path the developer typed on their own command
 # line — the same trust level as the command itself — so there is no untrusted
 # input boundary for the taint analysis to protect, exactly as with S4036.
-sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8
+#
+# Suppress "await inside a loop" (S9382) everywhere. ESLint's `no-await-in-loop` reports the same
+# pattern in the local gate, and each intentional sequential await carries its reason on an
+# `eslint-disable-next-line` comment — which SonarJS does not read — so ESLint is the single gate.
+sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8,e9,e10,e11,e12,e13,e14
 sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S4036
 sonar.issue.ignore.multicriteria.e1.resourceKey=scripts/**/*
 sonar.issue.ignore.multicriteria.e2.ruleKey=typescript:S4036
@@ -41,6 +45,29 @@ sonar.issue.ignore.multicriteria.e7.ruleKey=jssecurity:S8707
 sonar.issue.ignore.multicriteria.e7.resourceKey=scripts/**/*
 sonar.issue.ignore.multicriteria.e8.ruleKey=jssecurity:S8707
 sonar.issue.ignore.multicriteria.e8.resourceKey=scripts-ai/**/*
+# Suppress "async function without await" (S7503) everywhere. The shared ESLint
+# config enforces `@typescript-eslint/promise-function-async`, so a function that
+# returns a Promise must be `async` even when it has nothing to await; that is why
+# it turns `require-await` off, and S7503 is the same rule under another name —
+# the two cannot both hold.
+sonar.issue.ignore.multicriteria.e9.ruleKey=typescript:S7503
+sonar.issue.ignore.multicriteria.e9.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e10.ruleKey=javascript:S7503
+sonar.issue.ignore.multicriteria.e10.resourceKey=**/*
+# Suppress "prefer Number static properties" (S7773) everywhere. It asks for
+# `Number.NaN`, while the unicorn recommended preset the shared ESLint config
+# enforces asks for the opposite (`prefer-global-number-constants`: `NaN` over
+# `Number.NaN`) — the two cannot both hold. The rest of what S7773 covers
+# (`Number.parseInt`, `Number.isNaN`, …) is already enforced by
+# `unicorn/prefer-number-properties`.
+sonar.issue.ignore.multicriteria.e11.ruleKey=typescript:S7773
+sonar.issue.ignore.multicriteria.e11.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e12.ruleKey=javascript:S7773
+sonar.issue.ignore.multicriteria.e12.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e13.ruleKey=typescript:S9382
+sonar.issue.ignore.multicriteria.e13.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e14.ruleKey=javascript:S9382
+sonar.issue.ignore.multicriteria.e14.resourceKey=**/*
 
 # Files to exclude from the duplicate check.
 # Snapshot files (.snap) contain machine-generated repetitive patterns and are not authored code.

package/templates/workflows/ci.yml

@@ -29,12 +29,11 @@ concurrency:
 # list (e.g. `chromium firefox webkit`) instead of editing this file, which josh sync overwrites.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
-  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
-  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
-  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
-  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+
+# Every job that needs pnpm prepares it through `.github/actions/setup-pnpm`, which `josh sync`
+# writes beside this file: the pnpm version resolution, the store cache, the hash-verified safe-chain
+# installer and the install. kit's own `ci.yml` calls the same action, so the path a consumer runs is
+# the path kit runs (joshuafolkken/kit#3095).
 
 jobs:
   playwright-image:
@@ -126,37 +125,11 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -188,17 +161,10 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # A `basic` project has no `prepare`, no build and no SvelteKit, so the ordered steps below
       # would fail on its first pull request (joshuafolkken/kit#2814). The profile is read from
@@ -399,37 +365,11 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -441,17 +381,10 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-build-cache-e2e-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # --ignore-scripts suppresses the install-time `prepare`, so generated framework
       # files never appear. Playwright >= 1.62 hard-throws when a tsconfig `extends`
@@ -679,6 +612,7 @@ jobs:
       needs.e2e-detect.result == 'success' &&
       (needs.e2e.result == 'success' || needs.e2e.result == 'skipped')
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       contents: write
     steps:

package/templates/workflows/dependabot-auto-merge.yml

@@ -27,6 +27,7 @@ jobs:
   # what stays restricted to Dependabot's own events, on the step below.
   auto-merge:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       # Whether the pull request touches a workflow some upstream package overwrites. Decided from
@@ -50,8 +51,10 @@ jobs:
       #
       # Everything comes from the API, so no checkout is needed. `--paginate` is what makes the file
       # list complete rather than the first page of a large diff, and the `select` narrows it to
-      # workflows inside `--jq` rather than through `grep`: the default shell is `bash -e` without
-      # `pipefail`, so a `gh` failure inside a pipeline would be masked by grep's status, and grep
+      # workflows — and the local composite actions under `.github/actions/`, which are stamped and
+      # overwritten the same way (joshuafolkken/kit#3013) — inside `--jq` rather than through `grep`:
+      # the default shell is `bash -e` without `pipefail`, so a `gh` failure inside a pipeline would
+      # be masked by grep's status, and grep
       # itself answers 1 for "no match" and 2 for "I could not look" — two readings this step must
       # not conflate, since one of them means "merge it" (joshuafolkken/kit#844). An assignment
       # carries the command's status, and `case` has no failure mode at all.
@@ -88,7 +91,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           changed="$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" --paginate \
-            --jq '.[] | select(.filename | startswith(".github/workflows/"))
+            --jq '.[] | select(.filename | startswith(".github/workflows/") or startswith(".github/actions/"))
                       | [.filename, .contents_url] | @tsv')"
 
           has_managed=false

package/templates/workflows/github-release.yml

@@ -0,0 +1,79 @@
+name: GitHub Release
+
+# Creates the GitHub Release, with notes generated from `.github/release.yml`, for each tag
+# `josh release` cuts (joshuafolkken/kit#3007). A repository with a Publish workflow gets its release
+# once that workflow has succeeded for the tag; one without it gets the release when auto-tag.yml
+# announces the tag. kit's own release is the `create-release` job of its publish.yml, which runs the
+# same `josh release:github`, so this file is distributed but never runs in kit.
+on:
+  workflow_run:
+    workflows: [Publish]
+    types: [completed]
+  repository_dispatch:
+    types: [new-tag-created]
+
+# Deliberately no `concurrency` block: a later tag waits inside `josh release:github` for the lower
+# tag's release, so serializing the runs would leave the later run holding the slot the lower one needs.
+
+jobs:
+  release:
+    # The Publish run is titled `Publish <tag>`; its head branch is not the tag when it was started by
+    # repository_dispatch, so the title is where the tag is read from.
+    if: >-
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' &&
+      startsWith(github.event.workflow_run.display_title, 'Publish v')) ||
+      github.event_name == 'repository_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 65
+    permissions:
+      actions: read
+      contents: write
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      # A repository with a Publish workflow is released from the workflow_run above, after its
+      # publication, so the tag announcement is left alone there and one tag never starts two releases.
+      - name: Select release tag
+        id: release
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_TITLE: ${{ github.event.workflow_run.display_title }}
+          RUN_WORKFLOW: ${{ github.event.workflow_run.workflow_id }}
+          DISPATCH_TAG: ${{ github.event.client_payload.tag }}
+        run: |
+          if [ "$EVENT_NAME" = workflow_run ]; then
+            echo "tag=${RUN_TITLE#Publish }" >> "$GITHUB_OUTPUT"
+            echo "workflow=$RUN_WORKFLOW" >> "$GITHUB_OUTPUT"
+          elif [ -f .github/workflows/publish.yml ]; then
+            echo "ℹ️ publish.yml releases this tag once it has published, skipping"
+          else
+            echo "tag=$DISPATCH_TAG" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Node.js
+        if: steps.release.outputs.tag != ''
+        uses: ./.github/actions/setup-node
+
+      - name: Configure GitHub Packages authentication for existing projects
+        if: steps.release.outputs.tag != ''
+        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
+
+      - name: Setup pnpm and install dependencies
+        if: steps.release.outputs.tag != ''
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
+          cache: 'false'
+
+      - name: Publish GitHub Release
+        if: steps.release.outputs.tag != ''
+        run: pnpm josh release:github
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          RELEASE_WORKFLOW: ${{ steps.release.outputs.workflow }}

package/tsconfig.sonar.json

@@ -1,29 +1,11 @@
 {
+	"extends": "@joshuafolkken/kit/tsconfig/base",
 	"compilerOptions": {
-		"target": "ES2020",
-		"module": "ES2020",
-		"lib": ["ES2020", "DOM", "DOM.Iterable"],
-		"moduleResolution": "node",
-		"allowImportingTsExtensions": false,
+		"target": "ES2022",
+		"lib": ["ES2023", "DOM", "DOM.Iterable"],
+		"types": ["node"],
 		"allowJs": true,
 		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
-		"sourceMap": true,
-		"strict": true,
-		"noUncheckedIndexedAccess": true,
-		"noImplicitOverride": true,
-		"noUnusedLocals": true,
-		"noUnusedParameters": true,
-		"exactOptionalPropertyTypes": true,
-		"noFallthroughCasesInSwitch": true,
-		"noImplicitReturns": true,
-		"noPropertyAccessFromIndexSignature": true,
-		"allowUnusedLabels": false,
-		"allowUnreachableCode": false,
-		"isolatedModules": true,
 		"paths": {
 			"$lib": ["./src/lib"],
 			"$lib/*": ["./src/lib/*"]

package/prompts/collaboration-workflow/cross-repo-epic.md

@@ -1,5 +0,0 @@
-## リポジトリをまたぐ EPIC
-
-**この規則の単一ソースは `.claude/skills/epic-commands/SKILL.md` → "Epics that span repositories" である。** 子の書き方、owner の制限、自動クローズ、公開の完了を待つ依存、配布物を持たない repo、実行のディスパッチ、`owner/repo#N` での参照はすべてそこにある。
-
-経緯（公開待ちが要る理由、joshuafolkken/kit#1129）は [`docs/maintainers/epic-commands-rationale.md`](../../docs/maintainers/epic-commands-rationale.md) にある。

package/prompts/collaboration-workflow/epic-audit.md

@@ -1,5 +0,0 @@
-## `josh epic:audit` — 子 Issue 群を横断して矛盾を検出する
-
-**この規則の単一ソースは `.claude/skills/epic-commands/SKILL.md` → "`josh epic:audit <E>` — contradictions across the children" である。** 検査表、警告とエラーの区別、片方が closed の組を警告に降格する規則、孤児検索の 2 つの結果、Tier A の修正、計画時の波及先の点検はすべてそこにある。
-
-経緯（joshuafolkken/kit#858 の監査で見つかった矛盾と波及漏れ、joshuafolkken/kit#1010）は [`docs/maintainers/epic-commands-rationale.md`](../../docs/maintainers/epic-commands-rationale.md) にある。

package/prompts/collaboration-workflow/epic-bundle.md

@@ -1,5 +0,0 @@
-## 後から関連が判明した Issue を epic に束ねる
-
-**この規則の単一ソースは `.claude/skills/epic-commands/SKILL.md` → "`josh epic:bundle <N>` — does this new issue belong with one already filed?" である。** 発火点、強い信号、候補探索の範囲、決定木、所属先の記録、順序の記録、起票前の `issue:scout` はすべてそこにある。レビュー上限で切り出す後追い Issue の起票と答えへの対応は `prompts/review.md` → "Three-way disposition after the cap" が単一ソースである。
-
-経緯（joshuafolkken/kit#943 / #946 / #947 の取りこぼし、CI 待ちに起票を置く根拠の計測）は [`docs/maintainers/epic-commands-rationale.md`](../../docs/maintainers/epic-commands-rationale.md) にある。

package/scripts/init/plugin-install-hint.ts

@@ -1,47 +0,0 @@
-import { readdirSync } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { claude_plugin_config } from './claude-plugin-config'
-
-// `josh init` / `josh sync` declare the kit plugin in the consumer's `.claude/settings.json`, but the
-// CLI does not install it from the declaration alone — a consumer runs `claude plugin install kit@kit`
-// once (joshuafolkken/kit#1930). Nothing said so at the end of init or sync, so a consumer whose
-// skills silently never loaded had no pointer to the one command that fixes it. This prints that
-// command on completion, unless the plugin already appears installed.
-
-const PLUGINS_SUBDIR = path.join('.claude', 'plugins')
-
-// Best effort: Claude Code records installed marketplaces under `~/.claude/plugins`. The kit
-// marketplace directory being present is the strongest signal available at the shell; the plugin's
-// enabled state is not readable here, so an uncertain read (no directory, no permission) counts as
-// "not installed". A hint shown once too often costs a line; one never shown costs a consumer its skills.
-function is_plugin_installed(home_directory: string = os.homedir()): boolean {
-	try {
-		return readdirSync(path.join(home_directory, PLUGINS_SUBDIR)).some(
-			(entry) =>
-				entry === claude_plugin_config.MARKETPLACE_NAME ||
-				entry.startsWith(`${claude_plugin_config.MARKETPLACE_NAME}@`),
-		)
-	} catch {
-		return false
-	}
-}
-
-function plugin_install_hint(is_installed: boolean): string | undefined {
-	if (is_installed) return undefined
-
-	return `  ℹ Skills load from the kit plugin. If they are missing, run: claude plugin install ${claude_plugin_config.PLUGIN_ID}`
-}
-
-function report_plugin_install_hint(home_directory?: string): void {
-	const hint = plugin_install_hint(is_plugin_installed(home_directory))
-	if (hint !== undefined) console.info(hint)
-}
-
-const plugin_install_hint_module = {
-	is_plugin_installed,
-	plugin_install_hint,
-	report_plugin_install_hint,
-}
-
-export { plugin_install_hint_module }

package/scripts/version/parse-json.ts

@@ -1,13 +0,0 @@
-// Parse JSON without throwing: returns the parsed value, or undefined when the input is not valid
-// JSON. Single source for the version commands that read package.json / CLI output and hand the
-// result to a schema's `safeParse` (running-binary, version-targets, effective-upstream), so the
-// permissive-parse behavior is defined once rather than re-cloned per reader.
-function safe_json_parse(raw: string): unknown {
-	try {
-		return JSON.parse(raw)
-	} catch {
-		return undefined
-	}
-}
-
-export { safe_json_parse }