@joshuafolkken/kit 1.1166.0 → 1.1229.0

package/scripts/git/git-prompt.ts

@@ -62,9 +62,7 @@ function create_prompt(): Interface | undefined {
 }
 
 function handle_prompt_fallback<T>(fallback_value?: T): T {
-	if (fallback_value !== undefined) {
-		return fallback_value
-	}
+	if (fallback_value !== undefined) return fallback_value
 
 	throw new Error('TTY not available')
 }
@@ -72,9 +70,7 @@ function handle_prompt_fallback<T>(fallback_value?: T): T {
 async function with_prompt<T>(callback: PromptCallback<T>, fallback_value?: T): Promise<T> {
 	const prompt = create_prompt()
 
-	if (prompt === undefined) {
-		return handle_prompt_fallback(fallback_value)
-	}
+	if (prompt === undefined) return handle_prompt_fallback(fallback_value)
 
 	try {
 		// eslint-disable-next-line promise/prefer-await-to-callbacks

package/scripts/git/{schemas.ts → git-schemas.ts}

@@ -140,6 +140,8 @@ const open_issue_schema = z.object({
 	labels: z.array(issue_label_schema).optional(),
 	createdAt: z.string(),
 	blockedBy: blocked_by_schema,
+	// Present only on the pickup listing, which reads it for the restructures each issue declares.
+	body: z.string().optional(),
 })
 
 type RollupItemData = z.infer<typeof rollup_item_schema>

package/scripts/git/git-spawn-sync.ts

@@ -1,4 +1,5 @@
 import { read_spawn_stderr, read_spawn_stdout } from '#scripts/lib/spawn-exit'
+import { GIT_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import { git_utilities } from './constants'
 
@@ -7,7 +8,6 @@ import { git_utilities } from './constants'
 // non-zero exit is returned as a result, and every call is bounded: a git that never answers is an
 // unknown the caller already handles, never a hang.
 
-const GIT_TIMEOUT_MS = 10_000
 const SUCCESS_EXIT_CODE = 0
 // git translates its messages, so a caller matching stderr would fail under any non-English locale.
 const C_LOCALE: Record<string, string> = { LC_ALL: 'C', LANGUAGE: 'C' }
@@ -16,6 +16,8 @@ interface GitSyncOptions {
 	cwd?: string
 	timeout?: number
 	env?: Record<string, string | undefined>
+	// A step a person watches (`josh start`) shows git's own progress and hook output as it runs.
+	stdio?: 'inherit'
 }
 
 interface GitSyncResult {

package/scripts/git/git-spawn.ts

@@ -20,7 +20,7 @@ import { git_ssh_keepalive } from './git-ssh-keepalive'
 // spawns git itself. The timeout it carries is shared here by `read_remote` / `with_output_remote`. Those two files are the spawn sites of the ordinary command
 // modules — the claim stops there. A synchronous caller goes through `git-spawn-sync.ts`, the same
 // binary resolution with a result instead of an exception (joshuafolkken/kit#3065). Other parts of
-// this package spawn git for their own purposes (`scripts/run/run-progress-clock.ts`,
+// this package spawn git for their own purposes (`scripts/run/progress/run-progress-clock.ts`,
 // `scripts/git/git-fixture-workspace.ts`), and an audit of how the git binary is resolved has to read
 // those too.
 

package/scripts/git/git-staging.ts

@@ -1,7 +1,7 @@
 import {
+	LEDGER_DIRECTORIES,
 	LEGACY_OBSERVATION_LEDGER_PATHS,
 	observation_ledger,
-	OBSERVATION_LEDGER_DIRECTORY,
 } from '#scripts/observations/observation-ledger'
 import { observation_ledger_prepare } from '#scripts/observations/observation-ledger-prepare'
 import { git_command } from './git-command'
@@ -29,9 +29,7 @@ async function confirm_package_json_staged(should_force = false): Promise<boolea
 async function confirm_package_json_version(should_force = false): Promise<void> {
 	const is_version_updated = await git_status.check_package_json_version()
 
-	if (is_version_updated) {
-		return
-	}
+	if (is_version_updated) return
 
 	if (should_force) {
 		console.info('💡 Skipping package.json version check (force).')
@@ -83,7 +81,7 @@ async function stage_untracked_files(files: ReadonlyArray<string>): Promise<void
 // own lines** (joshuafolkken/kit#2919): its writers append to its own tree's issue file, so this is
 // the step that takes them to the default branch.
 const LEDGER_PATHSPECS: ReadonlyArray<string> = [
-	OBSERVATION_LEDGER_DIRECTORY,
+	...LEDGER_DIRECTORIES,
 	...LEGACY_OBSERVATION_LEDGER_PATHS,
 ]
 
@@ -108,7 +106,7 @@ function is_stageable(file_path: string, excluded: ReadonlyArray<string>): boole
 // step dies on git's empty index with `Failed to commit changes` — a message naming nothing that
 // caused it. This line is what turns that into a diagnosis.
 //
-// **The paths are parsed rather than matched as substrings**: `docs/maintainers/observations-old/x.md`
+// **The paths are parsed rather than matched as substrings**: `.josh/observations-old/x.md`
 // contains the ledger's path, and a hint naming a file the exclusion never touched is a hint that
 // teaches the reader to ignore it.
 function report_excluded_paths(status_output: string, excluded: ReadonlyArray<string>): void {

package/scripts/git/git-status.ts

@@ -31,9 +31,7 @@ function has_unstaged_files(status_output: string): boolean {
 }
 
 function is_staged_file(line: string): boolean {
-	if (line.length < REQUIRED_STATUS_LENGTH || is_untracked_file(line)) {
-		return false
-	}
+	if (line.length < REQUIRED_STATUS_LENGTH || is_untracked_file(line)) return false
 
 	const [staged_status] = line
 
@@ -47,9 +45,7 @@ function has_unstaged_changes(line: string): boolean {
 function has_all_files_staged(status_output: string): boolean {
 	const lines = parse_status_lines(status_output)
 
-	if (lines.length === 0) {
-		return true
-	}
+	if (lines.length === 0) return true
 
 	return lines.every((line) => !has_unstaged_changes(line))
 }
@@ -62,9 +58,7 @@ function is_package_json_staged(status_output: string): boolean {
 	const lines = parse_status_lines(status_output)
 
 	return lines.some((line) => {
-		if (!is_staged_file(line)) {
-			return false
-		}
+		if (!is_staged_file(line)) return false
 
 		const filename = extract_filename(line)
 

package/scripts/git/main-merge.ts

@@ -44,44 +44,79 @@ function merge_message(default_branch: string, current_branch: string): string |
 	return `Merge ${default_branch} into ${current_branch} #${issue_number}`
 }
 
-// The refusal is read after the fetch, so the incoming paths are the ones the merge would bring in
-// (joshuafolkken/kit#2445).
-async function merge_refusal(default_branch: string): Promise<string | undefined> {
-	const status = await git_command.status()
-	const incoming = await main_merge_guard.incoming_paths(default_branch)
-
-	return main_merge_guard.refusal(status, incoming, default_branch)
+// What one merge of the default branch came to (joshuafolkken/kit#3221). `josh ship` merges it again
+// before the commit and on a conflicting pull request, and branches on the answer rather than on an
+// exit code: `current` brought nothing in, so the tree is unchanged; `merged` changed it; `refused`
+// is the guard's answer, nothing attempted; `conflict` names the paths git left unmerged, so a resumed
+// session goes straight to them instead of asking git again.
+type MergeOutcome =
+	| { kind: 'current'; branch: string }
+	| { kind: 'merged'; branch: string }
+	| { kind: 'refused'; message: string }
+	| { kind: 'conflict'; files: ReadonlyArray<string> }
+
+interface MergeTarget {
+	default_branch: string
+	current_branch: string
+	is_current: boolean
 }
 
-// A merge that stops on a conflict keeps git's report and adds how to finish it, so the next step is
-// the sanctioned commit rather than a request for `git add`.
-async function merge_with_hint(default_branch: string, message: string | undefined): Promise<void> {
+// A failure that left no unmerged path — a remote that cannot be reached, a hook that refused — is not
+// a conflict, so it is rethrown rather than reported as one with nothing to resolve.
+async function merge_into(target: MergeTarget): Promise<MergeOutcome> {
+	const { default_branch, current_branch } = target
+
 	try {
-		await git_command.merge_branch(default_branch, message)
+		await git_command.merge_branch(default_branch, merge_message(default_branch, current_branch))
 	} catch (error) {
-		console.error(main_merge_guard.CONFLICT_HINT)
-		throw error
+		const files = main_merge_guard.unmerged_paths(await git_command.status())
+
+		if (files.length === 0) throw error
+
+		return { kind: 'conflict', files }
 	}
+
+	return { kind: target.is_current ? 'current' : 'merged', branch: default_branch }
 }
 
 // The fetch is what makes `origin/<default>` current before the merge reads it. `git pull` did the
-// two together, which is the only thing it was doing here that is worth keeping.
-async function merge_default_branch(): Promise<number> {
+// two together, which is the only thing it was doing here that is worth keeping. The refusal is read
+// after the fetch, so the incoming paths are the ones the merge would bring in (joshuafolkken/kit#2445).
+async function merge(): Promise<MergeOutcome> {
 	const default_branch = await git_command.get_default_branch()
 	const current_branch = await git_command.branch()
 
 	await git_command.fetch_branch(default_branch)
 
-	const refusal = await merge_refusal(default_branch)
+	const status = await git_command.status()
+	const incoming = await main_merge_guard.incoming_paths(default_branch)
+	const message = main_merge_guard.refusal(status, incoming, default_branch)
+
+	if (message !== undefined) return { kind: 'refused', message }
+
+	return await merge_into({ default_branch, current_branch, is_current: incoming.length === 0 })
+}
+
+// A merge that stops on a conflict keeps git's report and adds how to finish it, so the next step is
+// the sanctioned commit rather than a request for `git add`.
+function failure_text(outcome: MergeOutcome): string | undefined {
+	if (outcome.kind === 'refused') return outcome.message
+	if (outcome.kind === 'conflict') return main_merge_guard.CONFLICT_HINT
+
+	return undefined
+}
+
+async function merge_default_branch(): Promise<number> {
+	const outcome = await merge()
+	const failure = failure_text(outcome)
 
-	if (refusal !== undefined) {
-		console.error(refusal)
+	if (failure !== undefined) {
+		console.error(failure)
 
 		return FAILURE_EXIT_CODE
 	}
 
-	await merge_with_hint(default_branch, merge_message(default_branch, current_branch))
-	console.info(default_branch)
+	if ('branch' in outcome) console.info(outcome.branch)
 
 	return SUCCESS_EXIT_CODE
 }
@@ -114,8 +149,9 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 	process.exitCode = await run(argv)
 }
 
-const main_merge = { run }
+const main_merge = { merge, run }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 
 export { main_merge }
+export type { MergeOutcome }

package/scripts/hooks/codex-hook-adapter.ts

@@ -49,7 +49,7 @@ function paths_matching(command: string, pattern: RegExp): Array<string> {
 	return [...command.matchAll(pattern)].flatMap((match) => {
 		const file_path = match[1]?.trim()
 
-		return file_path === undefined || file_path === '' ? [] : [file_path]
+		return file_path === undefined || file_path === '' ? [] : file_path
 	})
 }
 

package/scripts/hooks/edited-cspell.ts

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs'
 import path from 'node:path'
+import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execa } from 'execa'
 
 // The spell half of the edit hook (joshuafolkken/kit#2296). joshuafolkken/kit#2275 gave the hook a way
@@ -47,9 +48,6 @@ const CSPELL_ARGS: ReadonlyArray<string> = [
 	'--no-summary',
 ]
 const PNPM = 'pnpm'
-// A spell check that hangs would hold the edit's turn open; the bound is generous because reaching it
-// means something is already wrong, exactly as the formatter spawns in `format-edited-file.ts`.
-const PROCESS_TIMEOUT_MS = 15_000
 
 const HEADER =
 	'The edit hook found words cspell does not know; fix them or add them to `cspell.config.yaml` now rather than at the gate:'
@@ -79,7 +77,7 @@ async function run_cspell(file_path: string, project_root: string): Promise<stri
 		cwd: project_root,
 		stdout: 'pipe',
 		stderr: 'ignore',
-		timeout: PROCESS_TIMEOUT_MS,
+		timeout: HOOK_PROCESS_TIMEOUT_MS,
 	})
 
 	return result.stdout

package/scripts/hooks/format-edited-file.ts

@@ -4,6 +4,7 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { resolve_local_bin, resolve_package_bin } from '#scripts/build/local-bin'
 import { ESLINT_EDIT_CACHE_FLAGS } from '#scripts/josh/josh-command-types'
+import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { execa } from 'execa'
 import { z } from 'zod'
@@ -87,15 +88,6 @@ const DAEMON_RESTART = 'restart'
 // `eslint.config.*` entry, and the rule modules under `eslint/` that it imports.
 const ESLINT_CONFIG_DIR = 'eslint'
 const ESLINT_CONFIG_ENTRY = /^eslint\.config\.[cm]?[jt]s$/u
-// A formatter that hangs would hold the edit's turn open, so each spawn is bounded. The bound has
-// to be read against the *worst-case run* rather than one spawn: an edit to a config input plans
-// eslint, prettier and `eslint_d restart`, and the first and last each have a second route behind
-// the daemon — five spawns. The hook entry in `.claude/settings.json` declares 90 seconds, so the
-// per-spawn bound must leave five of them under it, or the harness kill lands first and lands at a
-// moment this file did not choose — possibly inside `prettier --write`, which rewrites in place and
-// can leave the file truncated. 15s × 5 = 75s. It is still two orders of magnitude beyond the 0.84s
-// a warm run takes, so reaching it means something is already wrong.
-const PROCESS_TIMEOUT_MS = 15_000
 
 // The problems eslint could not auto-fix are handed to the model verbatim from eslint's own stdout —
 // its default formatter already prints the file, the `line:col`, and the rule name the issue asks
@@ -315,7 +307,7 @@ async function spawn_invocation(
 		env: { ESLINT_D_MISS: 'fail' },
 		stdout: 'pipe',
 		stderr: 'ignore',
-		timeout: PROCESS_TIMEOUT_MS,
+		timeout: HOOK_PROCESS_TIMEOUT_MS,
 	})
 
 	return { exit_code: result.exitCode ?? 1, stdout: result.stdout }
@@ -469,7 +461,7 @@ function report_no_payload(): void {
 // have (joshuafolkken/kit#2314). The rewrite, lint and spell blocks are composed together first, then
 // joined to the density line — one envelope, since a `PostToolUse` hook's stdout carries only one
 // (joshuafolkken/kit#2296). A hook killed at its 15s timeout is the one case this loses the density
-// line to — a run already gone pathologically wrong, per PROCESS_TIMEOUT_MS.
+// line to — a run already gone pathologically wrong, per HOOK_PROCESS_TIMEOUT_MS.
 async function run_hook(payload: string): Promise<void> {
 	const notice = time_density_hook.density_notice(payload)
 	const file_path = parse_edited_path(payload)
@@ -500,6 +492,5 @@ export {
 	select_invocation,
 	ESLINT_DAEMON,
 	MAX_DIAGNOSTIC_CHARS,
-	PROCESS_TIMEOUT_MS,
 }
 export type { CommandRunner, FormatCommand }

package/scripts/hooks/pre-push-unit.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
-import { gate_skip } from '#scripts/gate/gate-skip'
+import { gate_skip, type GateReuse } from '#scripts/gate/gate-skip'
 import { gate_tree, type GateTree } from '#scripts/gate/gate-tree'
 import { hook_gate_reuse } from '#scripts/gate/hook-gate-reuse'
-import type { FileMapStamp } from '#scripts/josh/file-map-stamp'
 import { test_unit_guard } from '#scripts/test/test-unit-guard'
 
 // The pre-push hook's unit run, which no longer re-runs a suite a green gate already covers
@@ -42,6 +41,15 @@ const FORCE_ENV = 'JOSH_PRE_PUSH_FORCE'
 // `gate-tree.ts` rather than read a second way here — plus the one this hook adds.
 interface PushTree extends GateTree {
 	is_clean: boolean
+	// What a dirty tree reports as the reason the record was not reused (joshuafolkken/kit#3307) — the
+	// paths name a lock file a hook's own `pnpm install` rewrote, the case that went unexplained.
+	carry_miss: string
+}
+
+function carry_miss(lines: ReadonlyArray<string> | undefined): string {
+	if (lines === undefined) return 'git status could not be read'
+
+	return `the working tree differs from HEAD (${lines.join('; ')})`
 }
 
 // `git status --porcelain` prints one line per difference from HEAD, untracked files included — so an
@@ -57,7 +65,11 @@ async function read_push_tree(): Promise<PushTree> {
 		hook_gate_reuse.read_status_lines(),
 	])
 
-	return { ...tree, is_clean: hook_gate_reuse.is_worktree_clean(lines) }
+	return {
+		...tree,
+		is_clean: hook_gate_reuse.is_worktree_clean(lines),
+		carry_miss: carry_miss(lines),
+	}
 }
 
 // `--force` is the gate's own flag, reused rather than respelled: it and `JOSH_PRE_PUSH_FORCE` are
@@ -74,14 +86,15 @@ function forwarded_arguments(extra_arguments: ReadonlyArray<string>): ReadonlyAr
 // **Any argument at all refuses the reuse**, not only `--force`. Everything else is forwarded to
 // vitest, and a caller who narrowed the run to one spec asked for that run rather than for a
 // recorded result about a whole tree. The hook's own line passes none, so this costs it nothing.
-function reusable_green_push(
+function push_reuse(
 	tree: PushTree,
 	extra_arguments: ReadonlyArray<string>,
 	source?: string,
-): FileMapStamp | undefined {
-	return hook_gate_reuse.reusable_green_hook({
+): GateReuse {
+	return hook_gate_reuse.hook_reuse({
 		tree,
 		is_tree_carried: tree.is_clean,
+		carry_miss: tree.carry_miss,
 		extra_arguments,
 		force_env: FORCE_ENV,
 		source,
@@ -107,20 +120,29 @@ function format_skip(taken_at: string): string {
 // other commands already have. **A project that has vitest and no test file at all fails the push
 // instead** (joshuafolkken/kit#1224): the guard treats that half as a broken state rather than a
 // young project, and the hook returns what the guard returns.
+// **A fall back to the whole suite says why, in one line** (joshuafolkken/kit#3307): under a crowded
+// machine the suite costs minutes, and a silent miss left a moved merge base, a dirty tree and a
+// mismatched record indistinguishable from one another.
+function format_miss(reason: string): string {
+	return `↻ running the whole unit suite — the green gate record does not cover this push: ${reason}.`
+}
+
 async function run_pre_push_unit(
 	extra_arguments: ReadonlyArray<string> = [],
 	source?: string,
 ): Promise<number> {
-	const reusable = reusable_green_push(await read_push_tree(), extra_arguments, source)
+	const reuse = push_reuse(await read_push_tree(), extra_arguments, source)
+
+	if ('miss' in reuse) {
+		process.stdout.write(`${format_miss(reuse.miss)}\n`)
 
-	if (reusable === undefined) {
 		return await test_unit_guard.run_guarded_unit(
 			process.cwd(),
 			forwarded_arguments(extra_arguments),
 		)
 	}
 
-	process.stdout.write(`${format_skip(reusable.taken_at)}\n`)
+	process.stdout.write(`${format_skip(reuse.stamp.taken_at)}\n`)
 
 	return 0
 }

package/scripts/hooks/reserved-run.ts

@@ -54,8 +54,8 @@ function parse_arguments(argv: ReadonlyArray<string>): ReservedCommand | undefin
 // command becomes an exit code the caller returns rather than a throw — the reservation is released by
 // `with_core_reservation`'s `finally` on either path.
 async function run_command(command: ReadonlyArray<string>): Promise<number> {
-	const [file, ...args] = command
-	const result = await execa(file ?? '', args, { stdio: 'inherit', reject: false })
+	const [file = '', ...args] = command
+	const result = await execa(file, args, { stdio: 'inherit', reject: false })
 
 	return result.exitCode ?? FAIL_EXIT_CODE
 }

package/scripts/hooks/run-hook.sh

@@ -12,9 +12,10 @@
 #   runs through josh, whose command is the name with its first `-` turned into `:`
 #   (`pretool-guard` → `pretool:guard`).
 # - In kit's own checkout the gate is `hook-bundle-ready.ts`, which rebuilds stale bundles
-#   (joshuafolkken/kit#2984). In an installed package it is a presence check: the published bundles
-#   cannot be stale against a source the consumer never edits, and Node strips no types under
-#   `node_modules`.
+#   (joshuafolkken/kit#2984) and then runs the bundle — or the josh fallback — itself, so a hook call
+#   starts node once (joshuafolkken/kit#3327). In an installed package it is a presence check: the
+#   published bundles cannot be stale against a source the consumer never edits, and Node strips no
+#   types under `node_modules`.
 # - An `if`/`else`, never `&&`/`||`: a guard's refusal is a non-zero exit, and a chain would read it as
 #   a missing bundle and run the hook twice.
 
@@ -36,6 +37,6 @@ case $0 in
 	if [ -d "$package_dir/dist/hooks" ]; then node "$bundle" "$@"; else node "$package_dir/dist/josh.js" "$josh_command" "$@"; fi
 	;;
 *)
-	if node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts"; then node "$bundle" "$@"; else pnpm josh "$josh_command" "$@"; fi
+	node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts" "$hook_name" "$josh_command" "$@"
 	;;
 esac

package/scripts/hooks/stop-guard.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env tsx
 import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
+import { agent_headless } from '#scripts/agent/agent-headless'
 import { backlog_ready } from '#scripts/backlog/backlog-ready'
 import { backlog_stalled_detect } from '#scripts/backlog/backlog-stalled-detect'
 import { repo_party } from '#scripts/discovery/repo-party'
@@ -13,11 +14,11 @@ import { lane_background } from '#scripts/rules/lane-background'
 import { lane_park } from '#scripts/rules/lane-park'
 import { last_prompt } from '#scripts/rules/last-prompt'
 import { stop_rules, type StopContext, type StopOutcome } from '#scripts/rules/stop-rules'
-import { run_carry } from '#scripts/run/run-carry'
-import { run_cut } from '#scripts/run/run-cut'
+import { run_carry } from '#scripts/run/carry/run-carry'
+import { run_cut } from '#scripts/run/cut/run-cut'
+import { run_hold } from '#scripts/run/hold/run-hold'
 import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
 import { run_headless } from '#scripts/run/run-headless'
-import { run_hold } from '#scripts/run/run-hold'
 import { run_stranded_detect } from '#scripts/run/run-stranded-detect'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { time_hook_transcript } from '#scripts/time-runtime/time-hook-transcript'
@@ -87,6 +88,7 @@ async function build_context(
 		agent_pending: lane_background.pending_agent_ids(tail).length > 0,
 		handed_off: lane_handoff.is_handed_off(process.cwd()),
 		session_lang: session_lang(),
+		headless_agent: agent_headless.is_headless(),
 	}
 }
 

package/scripts/init/init-actions.ts

@@ -217,11 +217,6 @@ function build_file_actions(shape?: ProjectShape): ReadonlyArray<FileAction> {
 
 	return [
 		...(shape?.has_git === false ? [] : [build_gitignore_action()]),
-		build_action(
-			'.npmrc',
-			() => init_logic.generate_npmrc(),
-			(existing) => init_logic.merge_npmrc(existing),
-		),
 		build_eslint_action(),
 		build_action(
 			PRETTIER_CONFIG_JS,

package/scripts/init/init-ai-copy.ts

@@ -104,8 +104,16 @@ function did_skip_copy_if_absent(
 
 // The merged file is written back, and reported as `updated`, only when the merge changed it — a
 // second `josh init` over an already-merged file reports `unchanged` (joshuafolkken/kit#2873).
+// The workspace template with the project's own `.npmrc` values carried over: once the file holds a
+// key, the merge keeps it, so this is the one chance to move the value (joshuafolkken/kit#3267).
+function read_workspace_template(source_path: string, destination_path: string): string {
+	const npmrc = file_reader.read_file_or_empty(path.join(path.dirname(destination_path), '.npmrc'))
+
+	return init_logic.carry_npmrc_settings(readFileSync(source_path, 'utf8'), npmrc)
+}
+
 function merge_existing_workspace_yaml(source_path: string, destination_path: string): void {
-	const template = readFileSync(source_path, 'utf8')
+	const template = read_workspace_template(source_path, destination_path)
 	const existing = readFileSync(destination_path, 'utf8')
 	const merged = init_logic.merge_workspace_yaml(existing, template)
 
@@ -126,7 +134,9 @@ function did_skip_workspace_yaml_copy(source_path: string, destination_path: str
 		return false
 	}
 
-	copy_ai_file(source_path, destination_path)
+	const template = read_workspace_template(source_path, destination_path)
+
+	writeFileSync(destination_path, transform_copied_content(destination_path, template))
 	console.info(`  ✔ created   ${WORKSPACE_YAML}`)
 
 	return false
@@ -385,6 +395,7 @@ const init_ai_copy = {
 	ai_file_source,
 	ai_file_mappings,
 	ensure_basic_claude_md,
+	read_workspace_template,
 }
 
 export { init_ai_copy, CLAUDE_MD_FILENAME }

package/scripts/init/init-logic-json-merge.ts

@@ -3,6 +3,7 @@ import { json_format } from '#scripts/config-merge/json-format'
 import { parse_jsonc } from '#scripts/config-merge/parse-jsonc'
 import { patch_json_key } from '#scripts/config-merge/patch-json-key'
 import { json_object_schema, string_array_schema, string_record_schema } from '#scripts/lib/schemas'
+import { safe_chain_preinstall } from '#scripts/safe-chain/preinstall-command'
 import { apply_jf_migrations, remove_retired_scripts } from './init-logic-migrate'
 import { PACKAGE_JSON_KEY_ORDER } from './init-logic-package-key-order'
 import { kit_base_preset } from './kit-base-preset'
@@ -216,6 +217,23 @@ function merge_package_scripts(content: string, scripts: Record<string, string>)
 	return serialize_package_json({ ...parsed, scripts: { ...prepend, ...migrated, ...append } })
 }
 
+// Replace only a safe-chain `preinstall` an earlier kit wrote, for a consumer that never re-runs
+// `josh init`; every other key and script is kept (joshuafolkken/kit#3269).
+function upgrade_safe_chain_preinstall(content: string): string {
+	const parsed = parse_jsonc(content)
+	const raw = parsed['scripts']
+	if (raw === undefined) return content
+
+	const scripts = string_record_schema.parse(raw)
+	const current = scripts['preinstall']
+	if (current === undefined) return content
+
+	const migrated = safe_chain_preinstall.migrate_preinstall(current)
+	if (migrated === current) return content
+
+	return serialize_package_json({ ...parsed, scripts: { ...scripts, preinstall: migrated } })
+}
+
 function merge_development_dependencies(
 	content: string,
 	additions: Record<string, string>,
@@ -327,6 +345,7 @@ const init_logic_json_merge = {
 	merge_json_array_field,
 	merge_json_object,
 	merge_package_scripts,
+	upgrade_safe_chain_preinstall,
 	merge_package_script_suffix,
 	replace_in_package_script,
 	remove_script_with_marker,

package/scripts/init/init-logic-secretlint.ts

@@ -1,4 +1,5 @@
 import { init_logic_json_merge } from './init-logic-json-merge'
+import { kit_development_versions } from './kit-development-versions'
 
 const SECRETLINT_CONFIG_FILENAME = '.secretlintrc.json'
 const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
@@ -6,12 +7,8 @@ const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
 // secretlint resolves both its CLI and every rule package from the project it runs in, not
 // transitively through the kit — the same constraint that forces the prettier plugins into
 // consumer devDependencies (as kit peers, see init.ts). Omitting either
-// entry makes the pre-commit hook fail with "Cannot find module". Versions mirror the kit's
-// own devDependencies.
-const SECRETLINT_DEV_DEPS: Record<string, string> = {
-	secretlint: '^13.0.2',
-	[SECRETLINT_RULE_PRESET]: '^13.0.2',
-}
+// entry makes the pre-commit hook fail with "Cannot find module". The versions are kit's own.
+const SECRETLINT_PACKAGES = ['secretlint', SECRETLINT_RULE_PRESET]
 
 function generate_secretlint_config(): string {
 	const config = { rules: [{ id: SECRETLINT_RULE_PRESET }] }
@@ -24,7 +21,10 @@ function get_secretlint_config_filename(): string {
 }
 
 function merge_secretlint_development_deps(content: string): string {
-	return init_logic_json_merge.merge_development_dependencies(content, SECRETLINT_DEV_DEPS)
+	return init_logic_json_merge.merge_development_dependencies(
+		content,
+		kit_development_versions.versions_of(SECRETLINT_PACKAGES),
+	)
 }
 
 const init_logic_secretlint = {