@joshuafolkken/kit 1.1166.0 → 1.1229.0

package/SECURITY.md

@@ -29,7 +29,7 @@ The `files` field of `package.json` decides what the published `@joshuafolkken/k
 - `.codex/` — the same hooks for Codex (`hooks.json`) and its project settings (`config.toml`).
 - `.github/` — GitHub Actions workflows (CI, tagging, pull request classification, Dependabot auto-merge, SonarQube and production), composite actions, `dependabot.yml`, the pull request template and the release-notes config. `josh sync` overwrites the distributed workflows; their action references are pinned to commit SHAs. kit's own `publish.yml` ships in the package but is never copied into a project.
 - `lefthook/` — Git hook presets: lint before commit, checks before push.
-- The `preinstall` script `josh init` adds to `package.json` runs `pnpm dlx @aikidosec/safe-chain setup-ci` on every install, then a `node -e` check that only prints a warning, and only outside CI. The `prepare` script it adds runs `lefthook install` when Lefthook is present, then, when tsx is present, kit's `fix-gh-packages` script: only when the project `.npmrc` routes a scope to GitHub Packages, it reads a GitHub token (`NODE_AUTH_TOKEN`, a token in the project `.npmrc`, or `gh auth token`), queries GitHub Packages and rewrites tarball URLs in `pnpm-lock.yaml`.
+- The `preinstall` script `josh init` adds to `package.json` is a `node -e` check that fetches nothing and only prints a warning — outside CI, when safe-chain is not scanning the install (see [Installing safe-chain](#installing-safe-chain)). The `prepare` script it adds runs `lefthook install` when Lefthook is present, then, when tsx is present, kit's `fix-gh-packages` script: only when the project `.npmrc` routes a scope to GitHub Packages, it reads a GitHub token (`NODE_AUTH_TOKEN`, a token in the project `.npmrc`, or `gh auth token`), queries GitHub Packages and rewrites tarball URLs in `pnpm-lock.yaml`.
 - `.pnpmfile.mjs` — a pnpm `beforePacking` hook that removes that safe-chain `preinstall` from the manifest `pnpm pack` and `pnpm publish` write, and changes nothing else. `josh init` and `josh sync` copy it only into a project whose `package.json` is not `private: true`, and never over a pnpmfile of the project's own.
 
 **Agent instructions and skills**
@@ -47,6 +47,20 @@ The `files` field of `package.json` decides what the published `@joshuafolkken/k
 - `.vscode/`, `.gitattributes`, `.ncurc.json`, `.prettierignore`, `pnpm-workspace.yaml` — editor, Git and package-manager settings.
 - `CODE_OF_CONDUCT.md`, `SECURITY.md` — community files.
 
+## Installing safe-chain
+
+[safe-chain](https://github.com/AikidoSec/safe-chain) scans a local `pnpm install` for malware once its shell integration is active. The `preinstall` script only warns when it is not; it never installs safe-chain itself. Install it from a release whose installer hash you have checked — the same release and SHA-256 kit's CI uses, pinned as `SAFE_CHAIN_INSTALLER_VERSION` and `SAFE_CHAIN_INSTALLER_SHA256` in [`.github/actions/setup-pnpm/action.yml`](https://github.com/joshuafolkken/kit/blob/main/.github/actions/setup-pnpm/action.yml):
+
+```sh
+version=<SAFE_CHAIN_INSTALLER_VERSION>
+sha256=<SAFE_CHAIN_INSTALLER_SHA256>
+curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$version/install-safe-chain.sh" -o install-safe-chain.sh
+echo "$sha256  install-safe-chain.sh" | shasum -a 256 -c -
+sh install-safe-chain.sh
+```
+
+Stop if `shasum` does not print `install-safe-chain.sh: OK`. Then restart your terminal; if the warning still appears, run `safe-chain setup` and restart it again.
+
 ## Secrets
 
 kit never stores a secret in a file it ships or commits. The ones it uses:

package/dist/CLAUDE.md

@@ -1,6 +1,6 @@
 # Claude Code Instructions
 
-> **This file is the entry point for every agent rule.** `AGENTS.md` and `GEMINI.md` are pointers to it. A rule's trigger is written **once**, here; its procedure and numbers **once**, at its pointer (the single source). History and rationale: `https://github.com/joshuafolkken/kit/blob/main/docs/maintainers/claude-md-history.md`.
+> The entry point for every agent rule — `AGENTS.md`, `GEMINI.md` and `.cursorrules` point here; each rule has a single source (`node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/residency.md`).
 
 ## Project
 
@@ -10,29 +10,29 @@ Stack: TypeScript · pnpm · SvelteKit · Vitest · Playwright · TailwindCSS ·
 
 - **Answer opinion-seeking questions from a neutral standpoint.** A leading question is not a cue to agree — recommend the option you genuinely judge best.
 - **Fix root causes, not symptoms.** Where the proper fix is out of scope, surface the root cause instead of papering over it.
-- **Cross-package problems → file the upstream Issue, then stop.** A defect in another package (a dependency, or `josh` / kit tooling) is never worked around locally — **weakening a verification gate is a workaround too**. File it (first-party Tier A, third-party Tier C) and stop. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/upstream-interrupt.md`.
+- **Cross-package problems → file the upstream Issue, then stop.** A defect in another package (a dependency, or `josh` / kit tooling) is never worked around locally — **weakening a verification gate is a workaround too**. File it (first-party Tier A, third-party Tier C) and stop. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/upstream-interrupt.md`. Your own repository's run tooling is not another package: `upstream-interrupt.md` → "実行中のリポジトリ自身のラン機構の不具合".
 - **Third-party repositories are Tier C.** Decide the party with `pnpm josh repo:party`; every write to a tracker we do not own needs explicit current-turn instruction. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/upstream-interrupt.md`.
-- **No clones — single-source, even across package boundaries.** Duplicate non-trivial logic only after presenting the alternative and getting explicit approval. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "クローン禁止".
-- **Design for elegance and simplicity first.** Before adding a hook, guard, rule or abstraction, ask whether fixing the cause makes it unnecessary. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "設計はエレガント".
-- **Distinguish consultation from execution.** A question or goal statement asks for analysis only — act on an explicit imperative or a workflow keyword. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "相談と実行".
-- **Route distributed-doc / config changes upstream to kit.** In a consumer repo never edit kit-distributed docs/config (`josh sync` overwrites them); in kit you are the source. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "配布ドキュメント".
-- **Latest-first, fix forward — pin back only as a last resort.** `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "最新優先".
+- **No clones — single-source, even across package boundaries.** Duplicate non-trivial logic only after presenting the alternative and getting explicit approval. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "no-clones".
+- **Design for elegance and simplicity first.** Before adding a hook, guard, rule or abstraction, ask whether fixing the cause makes it unnecessary. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "elegant-design".
+- **Distinguish consultation from execution.** A question or goal statement asks for analysis only — act on an explicit imperative or a workflow keyword. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "consult-vs-execute".
+- **Route distributed-doc / config changes upstream to kit.** In a consumer repo never edit kit-distributed docs/config (`josh sync` overwrites them); in kit you are the source. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "upstream-to-kit".
+- **Latest-first, fix forward — pin back only as a last resort.** `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "latest-first".
 - **Output language follows `JOSH_SESSION_LANG`** (default `ja`) for session output and artifact prose; English for Issue/PR titles, code comments, test titles, commit messages and script strings. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/overview.md`.
 - **Cite an Issue with a number-link and a short title in the session language.** `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/issue-citation.md`.
-- **Durable rules belong in prompts/docs, not local MEMORY.** `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "恒久ルール".
+- **Durable rules belong in prompts/docs, not local MEMORY.** `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/principles.md` → "durable-rules".
 - **Never carry a file's new text inside a shell command.** Use the Edit tool, not a heredoc. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/file-edits.md`.
 - **Never put a body in shell double quotes** — a backtick or `$` there is _executed_; pass the body by path. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/shell-body.md`.
 - **Put every call that does not depend on another's result in the same turn.** **The criterion is whether this call's input needs another call's result, not what kind of call it is** — edits are covered exactly as reads are. `pnpm josh batch:guard` enforces it; `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/rule-delivery.md`.
 
-### Decision autonomy (minimize confirmation stops)
+### Decision autonomy
 
-Classify each decision point and act; stop **only** when it genuinely needs the user's judgment. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/operating-rules.md` → 「意思決定の自律ポリシー（確認停止を減らす）」.
+Classify each decision point and act; stop **only** where the user's judgment is genuinely needed. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/operating-rules.md` → "decision-autonomy".
 
 - **Tier A — reversible implementation / design choices** (library, naming, layout, tests, refactor shape; placing a filed Issue into an epic; self-correction). Pick the clearly-better option, proceed, log it.
 - **Tier B — genuine toss-up.** The only tier that stops — ask with the candidates and trade-offs.
 - **Tier C — irreversible / shared-state / out-of-scope actions** (merge, branch delete, force push, destructive ops, repo settings, out-of-scope work, `devEngines` / overrides edits): explicit user instruction only, never auto-decided. Deleting a git-tracked file is reversible, so it is not a destructive op — inspect the target first and surface any contradiction.
 
-Log auto-decisions: an Issue comment inside an Issue workflow, otherwise a one-line "Auto-decided: `<choice>` over `<alt>` because `<reason>`" in the reply.
+Log auto-decisions: an Issue comment in an Issue workflow, else a one-line "Auto-decided: `<choice>` over `<alt>` because `<reason>`" in the reply.
 
 ## Environment Variables
 
@@ -40,7 +40,7 @@ Log auto-decisions: an Issue comment inside an Issue workflow, otherwise a one-l
 
 ## Critical Conventions (non-standard — always apply)
 
-Most are lint-enforced; `function` syntax and the early-return one-liner are not. Craft guidance: `node_modules/@joshuafolkken/kit/prompts/coding-standards.md`.
+Most are lint-enforced. Craft guidance: `node_modules/@joshuafolkken/kit/prompts/coding-standards.md`.
 
 ### Naming
 
@@ -69,7 +69,7 @@ Svelte `PascalCase.svelte(.ts)` · TypeScript `kebab-case.ts` · tests `*.test.t
 
 - Effective overrides live in `pnpm-workspace.yaml`; check both files.
 - **NEVER** remove or modify entries in **either** location without explicit user approval.
-- **NEVER** modify the `devEngines` field in `package.json` without explicit user confirmation.
+- **NEVER** modify the `devEngines` field in `package.json` without explicit user confirmation — except the `josh latest` lockstep pnpm bump, kept per the `dependency-update` skill.
 - After any dependency-update command, load the `dependency-update` skill before reporting anything about the pins.
 
 ## Package-First Development
@@ -78,7 +78,7 @@ Before building a feature, check for a well-maintained package — measure with
 
 ## Code Change Rules
 
-0. **Work summary + test declaration** — before writing any implementation code, once per Issue (required in fullrun/halfrun/backlogrun; `kickoff` exempt), never wrapped in a code fence, never a confirmation stop. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/report-format.md`; `pnpm josh report:lint`.
+0. **Work summary + test declaration** — before writing any implementation code, once per Issue (required in fullrun/halfrun/prrun/backlogrun; `kickoff` exempt), never wrapped in a code fence, never a confirmation stop. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/report-format.md`; `pnpm josh report:lint`.
    - **Overview** — **Now / Change / Check**, one sentence each in the session language that a non-programmer can follow; name the concrete subject in each line — subject-less prose is not acceptable. Use no file paths, function or type names, or CLI option flags — only internal identifiers are banned.
    - **Details** — every change with its test: `<what changes> — Test: <Unit|E2E> — <file path> — <what it verifies>`. Completion reports lead with **Cause / Fix / Result**.
    - **Tests are required for ALL changes** — zero tests without explicit approval is a violation. Exceptions (non-runtime and basic-profile manual checks): `node_modules/@joshuafolkken/kit/prompts/testing-guide.md`. `pnpm josh test:declared` answers from the changed paths; a runtime change with no test is refused at `pnpm josh git -y` on `required`.
@@ -103,18 +103,18 @@ When `josh bump` changes the version, update `https://github.com/joshuafolkken/k
 ## Git Rules
 
 - **No commits** unless explicitly requested. **No merges, branch deletions, force pushes or other shared-state mutations** unless requested in the current turn — except invoking `fullrun` or `backlogrun` authorizes the merge via `pnpm josh followup`; `prrun` does not. `.claude/settings.json` denies these, but the deny is narrower than the rule — never read "the tool let me" as permission.
-- **Never stage or mutate the git index on your own** — only on explicit instruction or via `pnpm josh git`. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/operating-rules.md` → "git index を勝手に変更しない".
+- **Never stage or mutate the git index on your own** — only on explicit instruction or via `pnpm josh git`. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/operating-rules.md` → "no-self-staging".
 - **Use `pnpm josh git`; open a PR with `pnpm josh pr`** — `pnpm josh rule:guard` refuses a direct `gh pr create`.
 - **Run `git status` (and `git stash list`) live** before acting on any tree assumption.
 
 ## Collaboration Workflow
 
-- The issue-driven flow: `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow.md`. **Before writing a rule as prose, place it by `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/residency.md`** — computable answers go to `pnpm josh oracle:list`, ordering to `pnpm josh run:step`.
-- **File through `pnpm josh issue:file` — it counts the target repository's open Issues, never a hand count; above the WIP cap, close one first.** Nothing honestly closable means do not file. A filing the run is blocked by is exempt, and so is an **interrupt** — three tests decide that, never judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository; both exemptions proceed, stating the overage. Meeting none of the three, a finding stays discretionary. `pnpm josh rule:guard` states it again at the call that files. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/wip-cap.md`.
+- The issue-driven flow: `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow.md`; where a new rule goes: `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/residency.md` (computable answers → `pnpm josh oracle:list`, ordering → `pnpm josh run:step`).
+- **File through `pnpm josh issue:file`, never a hand count; above the WIP cap, close one first.** Exempt: a filing the run is blocked by, and an **interrupt** — a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository; both proceed, stating the overage, and anything else stays discretionary. `pnpm josh rule:guard` states the rest at the call that files. `node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/wip-cap.md`.
 
 ### Shorthand Commands
 
-`kickoff`, `fullrun`, `prrun`, `halfrun`, `backlogrun` (with `#N` / `new`) are procedures in the `workflow-commands` skill — read it before any part of a command, including the first `gh` call. **What stays here is decided by one question: must the rule fire on a turn where no skill was loaded?** Explicit invocation, the mid-workflow stop notification, the `overrides` / `devEngines` prohibitions, the UI-verification gate and the three `epic:*` rules below all do.
+`kickoff`, `fullrun`, `prrun`, `halfrun`, `backlogrun` (with `#N` / `new`) are procedures in the `workflow-commands` skill — read it before any part of a command, including the first `gh` call.
 
 **`queue` and `epicrun` were removed** — point `queue` to `backlogrun #N1 #N2 …` and `epicrun` to `backlogrun #E --only`.
 
@@ -135,5 +135,3 @@ Before pausing **any** run for the user — a command's stop, an upstream-Issue
 ```bash
 pnpm josh notify --task-type confirmation --issue-url "<issue-url>" --body=$'<one-line reason>\n<what is needed from the user>'
 ```
-
-Keep `--body=...` one token when the body starts with `-`, otherwise `parseArgs` rejects it.