@joshuafolkken/kit 1.1178.0 → 1.1229.0

package/scripts/git/git-pre-push-hook.ts

@@ -0,0 +1,139 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { git_spawn } from './git-spawn'
+
+// The pre-push hook, run ahead of the push instead of inside it (joshuafolkken/kit#3300).
+//
+// **The push budget is a transfer budget, and a hook is not a transfer.** `PUSH_TIMEOUT_MS` was read
+// off what moving objects costs here, but `git push` runs the pre-push hook first and the budget
+// counted it: a hook that ran the whole unit suite — any push the gate's record does not cover, such
+// as the observation ledger commit or a tree `ship` has just synced with main — took 130 to 196
+// seconds and was killed at 120 on a push that was healthy. Killing `git` did not kill the hook
+// either: lefthook and vitest outlived it, and the retry started a second suite in the same work tree,
+// where each `test-state-guard` read the other's temporary files as a mutation and both failed.
+//
+// So the hook runs here, once, with no budget, and `git_command.push` spawns the bounded transfer that
+// follows with `--no-verify`. The retry then repeats the transfer alone, and a hook that is still
+// running cannot exist for it to overlap.
+//
+// **What git hands the hook is reproduced rather than dropped.** `git hook run` executes whatever
+// hook is configured — lefthook's or anyone's — and the arguments and stdin are git's pre-push
+// contract: the remote's name and URL, and one `<local ref> <local oid> <remote ref> <remote oid>`
+// line per ref. A hook that reads them (`git lfs pre-push` uploads exactly the objects those lines
+// name) would otherwise act on nothing. Both pushes `git_command.push` makes send the current branch to
+// the same name on `origin`, so that is the one line written. Like git, an up-to-date branch runs no
+// hook: the remote-tracking ref already naming `HEAD` is git's "Everything up-to-date".
+
+const REMOTE = 'origin'
+const HOOK_NAME = 'pre-push'
+const PROBE_HOOK_NAME = 'kit-hook-run-probe'
+const ALLOW_UNKNOWN_HOOK_NAME_FLAG = '--allow-unknown-hook-name'
+const HOOK_RUN = 'run'
+const STDIN_FILE = 'refs'
+const TEMPORARY_PREFIX = 'kit-pre-push-'
+const ZERO_DIGIT = '0'
+
+interface PushReferences {
+	branch: string
+	local_oid: string
+	remote_oid: string | undefined
+}
+
+// `undefined` is a branch the remote has never seen, which git reports with an all-zero object id.
+async function read_remote_oid(branch: string): Promise<string | undefined> {
+	try {
+		return await git_spawn.read([
+			'rev-parse',
+			'--verify',
+			'--quiet',
+			`refs/remotes/${REMOTE}/${branch}`,
+		])
+	} catch {
+		return undefined
+	}
+}
+
+async function read_push_references(): Promise<PushReferences> {
+	const [branch, local_oid] = await Promise.all([
+		git_spawn.read(['rev-parse', '--abbrev-ref', 'HEAD']),
+		git_spawn.read(['rev-parse', 'HEAD']),
+	])
+
+	return { branch, local_oid, remote_oid: await read_remote_oid(branch) }
+}
+
+// The zero id takes the local id's length, so a SHA-256 repository gets 64 digits rather than 40.
+function to_stdin_line(references: PushReferences): string {
+	const reference = `refs/heads/${references.branch}`
+	const remote_oid = references.remote_oid ?? ZERO_DIGIT.repeat(references.local_oid.length)
+
+	return `${reference} ${references.local_oid} ${reference} ${remote_oid}\n`
+}
+
+function to_hook_run_arguments(stdin_path: string, hook_name: string): Array<string> {
+	return [HOOK_RUN, '--ignore-missing', `--to-stdin=${stdin_path}`, hook_name]
+}
+
+// **A git that cannot run the hook this way leaves it to the push** — `git hook run` is Git 2.36, and
+// `--to-stdin` later still; an older git exits 129 on either. It is asked with a hook name nothing
+// configures, which `--ignore-missing` turns into a clean exit on any git that understands the call,
+// so the answer never depends on what the real hook does. Git 2.54 refuses a name that is not a
+// native hook unless `--allow-unknown-hook-name` says otherwise, and a git before it refuses that flag,
+// so the probe is asked both ways.
+async function can_probe(probe_arguments: ReadonlyArray<string>): Promise<boolean> {
+	try {
+		await git_spawn.read(['hook', ...probe_arguments])
+
+		return true
+	} catch {
+		return false
+	}
+}
+
+async function can_run_hooks(stdin_path: string): Promise<boolean> {
+	const [, ...options] = to_hook_run_arguments(stdin_path, PROBE_HOOK_NAME)
+
+	if (await can_probe([HOOK_RUN, ALLOW_UNKNOWN_HOOK_NAME_FLAG, ...options])) return true
+
+	return await can_probe([HOOK_RUN, ...options])
+}
+
+async function run_with_stdin(stdin_line: string): Promise<boolean> {
+	const directory = await mkdtemp(path.join(tmpdir(), TEMPORARY_PREFIX))
+	const stdin_path = path.join(directory, STDIN_FILE)
+
+	try {
+		await writeFile(stdin_path, stdin_line)
+		if (!(await can_run_hooks(stdin_path))) return false
+		const url = await git_spawn.read(['remote', 'get-url', REMOTE])
+
+		await git_spawn.with_output('hook', [
+			...to_hook_run_arguments(stdin_path, HOOK_NAME),
+			'--',
+			REMOTE,
+			url,
+		])
+
+		return true
+	} finally {
+		await rm(directory, { force: true, recursive: true })
+	}
+}
+
+// `true` when the hook is settled here — run, or nothing to push — so the push skips it; `false` when
+// this git cannot run it, so the push runs it as it always did. A hook that fails throws
+// `git hook exited with code <n>`, and the push is never attempted.
+async function run(): Promise<boolean> {
+	const references = await read_push_references()
+
+	if (references.local_oid === references.remote_oid) return true
+
+	return await run_with_stdin(to_stdin_line(references))
+}
+
+const git_pre_push_hook = {
+	run,
+}
+
+export { git_pre_push_hook }

package/scripts/git/git-prompt.ts

@@ -62,9 +62,7 @@ function create_prompt(): Interface | undefined {
 }
 
 function handle_prompt_fallback<T>(fallback_value?: T): T {
-	if (fallback_value !== undefined) {
-		return fallback_value
-	}
+	if (fallback_value !== undefined) return fallback_value
 
 	throw new Error('TTY not available')
 }
@@ -72,9 +70,7 @@ function handle_prompt_fallback<T>(fallback_value?: T): T {
 async function with_prompt<T>(callback: PromptCallback<T>, fallback_value?: T): Promise<T> {
 	const prompt = create_prompt()
 
-	if (prompt === undefined) {
-		return handle_prompt_fallback(fallback_value)
-	}
+	if (prompt === undefined) return handle_prompt_fallback(fallback_value)
 
 	try {
 		// eslint-disable-next-line promise/prefer-await-to-callbacks

package/scripts/git/git-spawn-sync.ts

@@ -1,4 +1,5 @@
 import { read_spawn_stderr, read_spawn_stdout } from '#scripts/lib/spawn-exit'
+import { GIT_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import { git_utilities } from './constants'
 
@@ -7,7 +8,6 @@ import { git_utilities } from './constants'
 // non-zero exit is returned as a result, and every call is bounded: a git that never answers is an
 // unknown the caller already handles, never a hang.
 
-const GIT_TIMEOUT_MS = 10_000
 const SUCCESS_EXIT_CODE = 0
 // git translates its messages, so a caller matching stderr would fail under any non-English locale.
 const C_LOCALE: Record<string, string> = { LC_ALL: 'C', LANGUAGE: 'C' }
@@ -16,6 +16,8 @@ interface GitSyncOptions {
 	cwd?: string
 	timeout?: number
 	env?: Record<string, string | undefined>
+	// A step a person watches (`josh start`) shows git's own progress and hook output as it runs.
+	stdio?: 'inherit'
 }
 
 interface GitSyncResult {

package/scripts/git/git-spawn.ts

@@ -20,7 +20,7 @@ import { git_ssh_keepalive } from './git-ssh-keepalive'
 // spawns git itself. The timeout it carries is shared here by `read_remote` / `with_output_remote`. Those two files are the spawn sites of the ordinary command
 // modules — the claim stops there. A synchronous caller goes through `git-spawn-sync.ts`, the same
 // binary resolution with a result instead of an exception (joshuafolkken/kit#3065). Other parts of
-// this package spawn git for their own purposes (`scripts/run/run-progress-clock.ts`,
+// this package spawn git for their own purposes (`scripts/run/progress/run-progress-clock.ts`,
 // `scripts/git/git-fixture-workspace.ts`), and an audit of how the git binary is resolved has to read
 // those too.
 

package/scripts/git/git-staging.ts

@@ -1,7 +1,7 @@
 import {
+	LEDGER_DIRECTORIES,
 	LEGACY_OBSERVATION_LEDGER_PATHS,
 	observation_ledger,
-	OBSERVATION_LEDGER_DIRECTORY,
 } from '#scripts/observations/observation-ledger'
 import { observation_ledger_prepare } from '#scripts/observations/observation-ledger-prepare'
 import { git_command } from './git-command'
@@ -29,9 +29,7 @@ async function confirm_package_json_staged(should_force = false): Promise<boolea
 async function confirm_package_json_version(should_force = false): Promise<void> {
 	const is_version_updated = await git_status.check_package_json_version()
 
-	if (is_version_updated) {
-		return
-	}
+	if (is_version_updated) return
 
 	if (should_force) {
 		console.info('💡 Skipping package.json version check (force).')
@@ -83,7 +81,7 @@ async function stage_untracked_files(files: ReadonlyArray<string>): Promise<void
 // own lines** (joshuafolkken/kit#2919): its writers append to its own tree's issue file, so this is
 // the step that takes them to the default branch.
 const LEDGER_PATHSPECS: ReadonlyArray<string> = [
-	OBSERVATION_LEDGER_DIRECTORY,
+	...LEDGER_DIRECTORIES,
 	...LEGACY_OBSERVATION_LEDGER_PATHS,
 ]
 
@@ -108,7 +106,7 @@ function is_stageable(file_path: string, excluded: ReadonlyArray<string>): boole
 // step dies on git's empty index with `Failed to commit changes` — a message naming nothing that
 // caused it. This line is what turns that into a diagnosis.
 //
-// **The paths are parsed rather than matched as substrings**: `docs/maintainers/observations-old/x.md`
+// **The paths are parsed rather than matched as substrings**: `.josh/observations-old/x.md`
 // contains the ledger's path, and a hint naming a file the exclusion never touched is a hint that
 // teaches the reader to ignore it.
 function report_excluded_paths(status_output: string, excluded: ReadonlyArray<string>): void {

package/scripts/git/git-status.ts

@@ -31,9 +31,7 @@ function has_unstaged_files(status_output: string): boolean {
 }
 
 function is_staged_file(line: string): boolean {
-	if (line.length < REQUIRED_STATUS_LENGTH || is_untracked_file(line)) {
-		return false
-	}
+	if (line.length < REQUIRED_STATUS_LENGTH || is_untracked_file(line)) return false
 
 	const [staged_status] = line
 
@@ -47,9 +45,7 @@ function has_unstaged_changes(line: string): boolean {
 function has_all_files_staged(status_output: string): boolean {
 	const lines = parse_status_lines(status_output)
 
-	if (lines.length === 0) {
-		return true
-	}
+	if (lines.length === 0) return true
 
 	return lines.every((line) => !has_unstaged_changes(line))
 }
@@ -62,9 +58,7 @@ function is_package_json_staged(status_output: string): boolean {
 	const lines = parse_status_lines(status_output)
 
 	return lines.some((line) => {
-		if (!is_staged_file(line)) {
-			return false
-		}
+		if (!is_staged_file(line)) return false
 
 		const filename = extract_filename(line)
 

package/scripts/hooks/codex-hook-adapter.ts

@@ -49,7 +49,7 @@ function paths_matching(command: string, pattern: RegExp): Array<string> {
 	return [...command.matchAll(pattern)].flatMap((match) => {
 		const file_path = match[1]?.trim()
 
-		return file_path === undefined || file_path === '' ? [] : [file_path]
+		return file_path === undefined || file_path === '' ? [] : file_path
 	})
 }
 

package/scripts/hooks/edited-cspell.ts

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs'
 import path from 'node:path'
+import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execa } from 'execa'
 
 // The spell half of the edit hook (joshuafolkken/kit#2296). joshuafolkken/kit#2275 gave the hook a way
@@ -47,9 +48,6 @@ const CSPELL_ARGS: ReadonlyArray<string> = [
 	'--no-summary',
 ]
 const PNPM = 'pnpm'
-// A spell check that hangs would hold the edit's turn open; the bound is generous because reaching it
-// means something is already wrong, exactly as the formatter spawns in `format-edited-file.ts`.
-const PROCESS_TIMEOUT_MS = 15_000
 
 const HEADER =
 	'The edit hook found words cspell does not know; fix them or add them to `cspell.config.yaml` now rather than at the gate:'
@@ -79,7 +77,7 @@ async function run_cspell(file_path: string, project_root: string): Promise<stri
 		cwd: project_root,
 		stdout: 'pipe',
 		stderr: 'ignore',
-		timeout: PROCESS_TIMEOUT_MS,
+		timeout: HOOK_PROCESS_TIMEOUT_MS,
 	})
 
 	return result.stdout

package/scripts/hooks/format-edited-file.ts

@@ -4,6 +4,7 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { resolve_local_bin, resolve_package_bin } from '#scripts/build/local-bin'
 import { ESLINT_EDIT_CACHE_FLAGS } from '#scripts/josh/josh-command-types'
+import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { execa } from 'execa'
 import { z } from 'zod'
@@ -87,15 +88,6 @@ const DAEMON_RESTART = 'restart'
 // `eslint.config.*` entry, and the rule modules under `eslint/` that it imports.
 const ESLINT_CONFIG_DIR = 'eslint'
 const ESLINT_CONFIG_ENTRY = /^eslint\.config\.[cm]?[jt]s$/u
-// A formatter that hangs would hold the edit's turn open, so each spawn is bounded. The bound has
-// to be read against the *worst-case run* rather than one spawn: an edit to a config input plans
-// eslint, prettier and `eslint_d restart`, and the first and last each have a second route behind
-// the daemon — five spawns. The hook entry in `.claude/settings.json` declares 90 seconds, so the
-// per-spawn bound must leave five of them under it, or the harness kill lands first and lands at a
-// moment this file did not choose — possibly inside `prettier --write`, which rewrites in place and
-// can leave the file truncated. 15s × 5 = 75s. It is still two orders of magnitude beyond the 0.84s
-// a warm run takes, so reaching it means something is already wrong.
-const PROCESS_TIMEOUT_MS = 15_000
 
 // The problems eslint could not auto-fix are handed to the model verbatim from eslint's own stdout —
 // its default formatter already prints the file, the `line:col`, and the rule name the issue asks
@@ -315,7 +307,7 @@ async function spawn_invocation(
 		env: { ESLINT_D_MISS: 'fail' },
 		stdout: 'pipe',
 		stderr: 'ignore',
-		timeout: PROCESS_TIMEOUT_MS,
+		timeout: HOOK_PROCESS_TIMEOUT_MS,
 	})
 
 	return { exit_code: result.exitCode ?? 1, stdout: result.stdout }
@@ -469,7 +461,7 @@ function report_no_payload(): void {
 // have (joshuafolkken/kit#2314). The rewrite, lint and spell blocks are composed together first, then
 // joined to the density line — one envelope, since a `PostToolUse` hook's stdout carries only one
 // (joshuafolkken/kit#2296). A hook killed at its 15s timeout is the one case this loses the density
-// line to — a run already gone pathologically wrong, per PROCESS_TIMEOUT_MS.
+// line to — a run already gone pathologically wrong, per HOOK_PROCESS_TIMEOUT_MS.
 async function run_hook(payload: string): Promise<void> {
 	const notice = time_density_hook.density_notice(payload)
 	const file_path = parse_edited_path(payload)
@@ -500,6 +492,5 @@ export {
 	select_invocation,
 	ESLINT_DAEMON,
 	MAX_DIAGNOSTIC_CHARS,
-	PROCESS_TIMEOUT_MS,
 }
 export type { CommandRunner, FormatCommand }

package/scripts/hooks/pre-push-unit.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
-import { gate_skip } from '#scripts/gate/gate-skip'
+import { gate_skip, type GateReuse } from '#scripts/gate/gate-skip'
 import { gate_tree, type GateTree } from '#scripts/gate/gate-tree'
 import { hook_gate_reuse } from '#scripts/gate/hook-gate-reuse'
-import type { FileMapStamp } from '#scripts/josh/file-map-stamp'
 import { test_unit_guard } from '#scripts/test/test-unit-guard'
 
 // The pre-push hook's unit run, which no longer re-runs a suite a green gate already covers
@@ -42,6 +41,15 @@ const FORCE_ENV = 'JOSH_PRE_PUSH_FORCE'
 // `gate-tree.ts` rather than read a second way here — plus the one this hook adds.
 interface PushTree extends GateTree {
 	is_clean: boolean
+	// What a dirty tree reports as the reason the record was not reused (joshuafolkken/kit#3307) — the
+	// paths name a lock file a hook's own `pnpm install` rewrote, the case that went unexplained.
+	carry_miss: string
+}
+
+function carry_miss(lines: ReadonlyArray<string> | undefined): string {
+	if (lines === undefined) return 'git status could not be read'
+
+	return `the working tree differs from HEAD (${lines.join('; ')})`
 }
 
 // `git status --porcelain` prints one line per difference from HEAD, untracked files included — so an
@@ -57,7 +65,11 @@ async function read_push_tree(): Promise<PushTree> {
 		hook_gate_reuse.read_status_lines(),
 	])
 
-	return { ...tree, is_clean: hook_gate_reuse.is_worktree_clean(lines) }
+	return {
+		...tree,
+		is_clean: hook_gate_reuse.is_worktree_clean(lines),
+		carry_miss: carry_miss(lines),
+	}
 }
 
 // `--force` is the gate's own flag, reused rather than respelled: it and `JOSH_PRE_PUSH_FORCE` are
@@ -74,14 +86,15 @@ function forwarded_arguments(extra_arguments: ReadonlyArray<string>): ReadonlyAr
 // **Any argument at all refuses the reuse**, not only `--force`. Everything else is forwarded to
 // vitest, and a caller who narrowed the run to one spec asked for that run rather than for a
 // recorded result about a whole tree. The hook's own line passes none, so this costs it nothing.
-function reusable_green_push(
+function push_reuse(
 	tree: PushTree,
 	extra_arguments: ReadonlyArray<string>,
 	source?: string,
-): FileMapStamp | undefined {
-	return hook_gate_reuse.reusable_green_hook({
+): GateReuse {
+	return hook_gate_reuse.hook_reuse({
 		tree,
 		is_tree_carried: tree.is_clean,
+		carry_miss: tree.carry_miss,
 		extra_arguments,
 		force_env: FORCE_ENV,
 		source,
@@ -107,20 +120,29 @@ function format_skip(taken_at: string): string {
 // other commands already have. **A project that has vitest and no test file at all fails the push
 // instead** (joshuafolkken/kit#1224): the guard treats that half as a broken state rather than a
 // young project, and the hook returns what the guard returns.
+// **A fall back to the whole suite says why, in one line** (joshuafolkken/kit#3307): under a crowded
+// machine the suite costs minutes, and a silent miss left a moved merge base, a dirty tree and a
+// mismatched record indistinguishable from one another.
+function format_miss(reason: string): string {
+	return `↻ running the whole unit suite — the green gate record does not cover this push: ${reason}.`
+}
+
 async function run_pre_push_unit(
 	extra_arguments: ReadonlyArray<string> = [],
 	source?: string,
 ): Promise<number> {
-	const reusable = reusable_green_push(await read_push_tree(), extra_arguments, source)
+	const reuse = push_reuse(await read_push_tree(), extra_arguments, source)
+
+	if ('miss' in reuse) {
+		process.stdout.write(`${format_miss(reuse.miss)}\n`)
 
-	if (reusable === undefined) {
 		return await test_unit_guard.run_guarded_unit(
 			process.cwd(),
 			forwarded_arguments(extra_arguments),
 		)
 	}
 
-	process.stdout.write(`${format_skip(reusable.taken_at)}\n`)
+	process.stdout.write(`${format_skip(reuse.stamp.taken_at)}\n`)
 
 	return 0
 }

package/scripts/hooks/reserved-run.ts

@@ -54,8 +54,8 @@ function parse_arguments(argv: ReadonlyArray<string>): ReservedCommand | undefin
 // command becomes an exit code the caller returns rather than a throw — the reservation is released by
 // `with_core_reservation`'s `finally` on either path.
 async function run_command(command: ReadonlyArray<string>): Promise<number> {
-	const [file, ...args] = command
-	const result = await execa(file ?? '', args, { stdio: 'inherit', reject: false })
+	const [file = '', ...args] = command
+	const result = await execa(file, args, { stdio: 'inherit', reject: false })
 
 	return result.exitCode ?? FAIL_EXIT_CODE
 }

package/scripts/hooks/run-hook.sh

@@ -12,9 +12,10 @@
 #   runs through josh, whose command is the name with its first `-` turned into `:`
 #   (`pretool-guard` → `pretool:guard`).
 # - In kit's own checkout the gate is `hook-bundle-ready.ts`, which rebuilds stale bundles
-#   (joshuafolkken/kit#2984). In an installed package it is a presence check: the published bundles
-#   cannot be stale against a source the consumer never edits, and Node strips no types under
-#   `node_modules`.
+#   (joshuafolkken/kit#2984) and then runs the bundle — or the josh fallback — itself, so a hook call
+#   starts node once (joshuafolkken/kit#3327). In an installed package it is a presence check: the
+#   published bundles cannot be stale against a source the consumer never edits, and Node strips no
+#   types under `node_modules`.
 # - An `if`/`else`, never `&&`/`||`: a guard's refusal is a non-zero exit, and a chain would read it as
 #   a missing bundle and run the hook twice.
 
@@ -36,6 +37,6 @@ case $0 in
 	if [ -d "$package_dir/dist/hooks" ]; then node "$bundle" "$@"; else node "$package_dir/dist/josh.js" "$josh_command" "$@"; fi
 	;;
 *)
-	if node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts"; then node "$bundle" "$@"; else pnpm josh "$josh_command" "$@"; fi
+	node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts" "$hook_name" "$josh_command" "$@"
 	;;
 esac

package/scripts/hooks/stop-guard.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env tsx
 import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
+import { agent_headless } from '#scripts/agent/agent-headless'
 import { backlog_ready } from '#scripts/backlog/backlog-ready'
 import { backlog_stalled_detect } from '#scripts/backlog/backlog-stalled-detect'
 import { repo_party } from '#scripts/discovery/repo-party'
@@ -13,11 +14,11 @@ import { lane_background } from '#scripts/rules/lane-background'
 import { lane_park } from '#scripts/rules/lane-park'
 import { last_prompt } from '#scripts/rules/last-prompt'
 import { stop_rules, type StopContext, type StopOutcome } from '#scripts/rules/stop-rules'
-import { run_carry } from '#scripts/run/run-carry'
-import { run_cut } from '#scripts/run/run-cut'
+import { run_carry } from '#scripts/run/carry/run-carry'
+import { run_cut } from '#scripts/run/cut/run-cut'
+import { run_hold } from '#scripts/run/hold/run-hold'
 import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
 import { run_headless } from '#scripts/run/run-headless'
-import { run_hold } from '#scripts/run/run-hold'
 import { run_stranded_detect } from '#scripts/run/run-stranded-detect'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { time_hook_transcript } from '#scripts/time-runtime/time-hook-transcript'
@@ -87,6 +88,7 @@ async function build_context(
 		agent_pending: lane_background.pending_agent_ids(tail).length > 0,
 		handed_off: lane_handoff.is_handed_off(process.cwd()),
 		session_lang: session_lang(),
+		headless_agent: agent_headless.is_headless(),
 	}
 }
 

package/scripts/init/init-actions.ts

@@ -217,11 +217,6 @@ function build_file_actions(shape?: ProjectShape): ReadonlyArray<FileAction> {
 
 	return [
 		...(shape?.has_git === false ? [] : [build_gitignore_action()]),
-		build_action(
-			'.npmrc',
-			() => init_logic.generate_npmrc(),
-			(existing) => init_logic.merge_npmrc(existing),
-		),
 		build_eslint_action(),
 		build_action(
 			PRETTIER_CONFIG_JS,

package/scripts/init/init-ai-copy.ts

@@ -104,8 +104,16 @@ function did_skip_copy_if_absent(
 
 // The merged file is written back, and reported as `updated`, only when the merge changed it — a
 // second `josh init` over an already-merged file reports `unchanged` (joshuafolkken/kit#2873).
+// The workspace template with the project's own `.npmrc` values carried over: once the file holds a
+// key, the merge keeps it, so this is the one chance to move the value (joshuafolkken/kit#3267).
+function read_workspace_template(source_path: string, destination_path: string): string {
+	const npmrc = file_reader.read_file_or_empty(path.join(path.dirname(destination_path), '.npmrc'))
+
+	return init_logic.carry_npmrc_settings(readFileSync(source_path, 'utf8'), npmrc)
+}
+
 function merge_existing_workspace_yaml(source_path: string, destination_path: string): void {
-	const template = readFileSync(source_path, 'utf8')
+	const template = read_workspace_template(source_path, destination_path)
 	const existing = readFileSync(destination_path, 'utf8')
 	const merged = init_logic.merge_workspace_yaml(existing, template)
 
@@ -126,7 +134,9 @@ function did_skip_workspace_yaml_copy(source_path: string, destination_path: str
 		return false
 	}
 
-	copy_ai_file(source_path, destination_path)
+	const template = read_workspace_template(source_path, destination_path)
+
+	writeFileSync(destination_path, transform_copied_content(destination_path, template))
 	console.info(`  ✔ created   ${WORKSPACE_YAML}`)
 
 	return false
@@ -385,6 +395,7 @@ const init_ai_copy = {
 	ai_file_source,
 	ai_file_mappings,
 	ensure_basic_claude_md,
+	read_workspace_template,
 }
 
 export { init_ai_copy, CLAUDE_MD_FILENAME }

package/scripts/init/init-logic-json-merge.ts

@@ -3,6 +3,7 @@ import { json_format } from '#scripts/config-merge/json-format'
 import { parse_jsonc } from '#scripts/config-merge/parse-jsonc'
 import { patch_json_key } from '#scripts/config-merge/patch-json-key'
 import { json_object_schema, string_array_schema, string_record_schema } from '#scripts/lib/schemas'
+import { safe_chain_preinstall } from '#scripts/safe-chain/preinstall-command'
 import { apply_jf_migrations, remove_retired_scripts } from './init-logic-migrate'
 import { PACKAGE_JSON_KEY_ORDER } from './init-logic-package-key-order'
 import { kit_base_preset } from './kit-base-preset'
@@ -216,6 +217,23 @@ function merge_package_scripts(content: string, scripts: Record<string, string>)
 	return serialize_package_json({ ...parsed, scripts: { ...prepend, ...migrated, ...append } })
 }
 
+// Replace only a safe-chain `preinstall` an earlier kit wrote, for a consumer that never re-runs
+// `josh init`; every other key and script is kept (joshuafolkken/kit#3269).
+function upgrade_safe_chain_preinstall(content: string): string {
+	const parsed = parse_jsonc(content)
+	const raw = parsed['scripts']
+	if (raw === undefined) return content
+
+	const scripts = string_record_schema.parse(raw)
+	const current = scripts['preinstall']
+	if (current === undefined) return content
+
+	const migrated = safe_chain_preinstall.migrate_preinstall(current)
+	if (migrated === current) return content
+
+	return serialize_package_json({ ...parsed, scripts: { ...scripts, preinstall: migrated } })
+}
+
 function merge_development_dependencies(
 	content: string,
 	additions: Record<string, string>,
@@ -327,6 +345,7 @@ const init_logic_json_merge = {
 	merge_json_array_field,
 	merge_json_object,
 	merge_package_scripts,
+	upgrade_safe_chain_preinstall,
 	merge_package_script_suffix,
 	replace_in_package_script,
 	remove_script_with_marker,

package/scripts/init/init-logic-secretlint.ts

@@ -1,4 +1,5 @@
 import { init_logic_json_merge } from './init-logic-json-merge'
+import { kit_development_versions } from './kit-development-versions'
 
 const SECRETLINT_CONFIG_FILENAME = '.secretlintrc.json'
 const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
@@ -6,12 +7,8 @@ const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
 // secretlint resolves both its CLI and every rule package from the project it runs in, not
 // transitively through the kit — the same constraint that forces the prettier plugins into
 // consumer devDependencies (as kit peers, see init.ts). Omitting either
-// entry makes the pre-commit hook fail with "Cannot find module". Versions mirror the kit's
-// own devDependencies.
-const SECRETLINT_DEV_DEPS: Record<string, string> = {
-	secretlint: '^13.0.2',
-	[SECRETLINT_RULE_PRESET]: '^13.0.2',
-}
+// entry makes the pre-commit hook fail with "Cannot find module". The versions are kit's own.
+const SECRETLINT_PACKAGES = ['secretlint', SECRETLINT_RULE_PRESET]
 
 function generate_secretlint_config(): string {
 	const config = { rules: [{ id: SECRETLINT_RULE_PRESET }] }
@@ -24,7 +21,10 @@ function get_secretlint_config_filename(): string {
 }
 
 function merge_secretlint_development_deps(content: string): string {
-	return init_logic_json_merge.merge_development_dependencies(content, SECRETLINT_DEV_DEPS)
+	return init_logic_json_merge.merge_development_dependencies(
+		content,
+		kit_development_versions.versions_of(SECRETLINT_PACKAGES),
+	)
 }
 
 const init_logic_secretlint = {