@joshuafolkken/kit 1.1178.0 → 1.1240.0

package/scripts/git/git-prompt.ts

@@ -62,9 +62,7 @@ function create_prompt(): Interface | undefined {
 }
 
 function handle_prompt_fallback<T>(fallback_value?: T): T {
-	if (fallback_value !== undefined) {
-		return fallback_value
-	}
+	if (fallback_value !== undefined) return fallback_value
 
 	throw new Error('TTY not available')
 }
@@ -72,9 +70,7 @@ function handle_prompt_fallback<T>(fallback_value?: T): T {
 async function with_prompt<T>(callback: PromptCallback<T>, fallback_value?: T): Promise<T> {
 	const prompt = create_prompt()
 
-	if (prompt === undefined) {
-		return handle_prompt_fallback(fallback_value)
-	}
+	if (prompt === undefined) return handle_prompt_fallback(fallback_value)
 
 	try {
 		// eslint-disable-next-line promise/prefer-await-to-callbacks

package/scripts/git/git-spawn-sync.ts

@@ -1,4 +1,5 @@
 import { read_spawn_stderr, read_spawn_stdout } from '#scripts/lib/spawn-exit'
+import { GIT_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import { git_utilities } from './constants'
 
@@ -7,7 +8,6 @@ import { git_utilities } from './constants'
 // non-zero exit is returned as a result, and every call is bounded: a git that never answers is an
 // unknown the caller already handles, never a hang.
 
-const GIT_TIMEOUT_MS = 10_000
 const SUCCESS_EXIT_CODE = 0
 // git translates its messages, so a caller matching stderr would fail under any non-English locale.
 const C_LOCALE: Record<string, string> = { LC_ALL: 'C', LANGUAGE: 'C' }
@@ -16,6 +16,8 @@ interface GitSyncOptions {
 	cwd?: string
 	timeout?: number
 	env?: Record<string, string | undefined>
+	// A step a person watches (`josh start`) shows git's own progress and hook output as it runs.
+	stdio?: 'inherit'
 }
 
 interface GitSyncResult {

package/scripts/git/git-spawn.ts

@@ -20,7 +20,7 @@ import { git_ssh_keepalive } from './git-ssh-keepalive'
 // spawns git itself. The timeout it carries is shared here by `read_remote` / `with_output_remote`. Those two files are the spawn sites of the ordinary command
 // modules — the claim stops there. A synchronous caller goes through `git-spawn-sync.ts`, the same
 // binary resolution with a result instead of an exception (joshuafolkken/kit#3065). Other parts of
-// this package spawn git for their own purposes (`scripts/run/run-progress-clock.ts`,
+// this package spawn git for their own purposes (`scripts/run/progress/run-progress-clock.ts`,
 // `scripts/git/git-fixture-workspace.ts`), and an audit of how the git binary is resolved has to read
 // those too.
 

package/scripts/git/git-staging.ts

@@ -1,7 +1,7 @@
 import {
+	LEDGER_DIRECTORIES,
 	LEGACY_OBSERVATION_LEDGER_PATHS,
 	observation_ledger,
-	OBSERVATION_LEDGER_DIRECTORY,
 } from '#scripts/observations/observation-ledger'
 import { observation_ledger_prepare } from '#scripts/observations/observation-ledger-prepare'
 import { git_command } from './git-command'
@@ -29,9 +29,7 @@ async function confirm_package_json_staged(should_force = false): Promise<boolea
 async function confirm_package_json_version(should_force = false): Promise<void> {
 	const is_version_updated = await git_status.check_package_json_version()
 
-	if (is_version_updated) {
-		return
-	}
+	if (is_version_updated) return
 
 	if (should_force) {
 		console.info('💡 Skipping package.json version check (force).')
@@ -83,7 +81,7 @@ async function stage_untracked_files(files: ReadonlyArray<string>): Promise<void
 // own lines** (joshuafolkken/kit#2919): its writers append to its own tree's issue file, so this is
 // the step that takes them to the default branch.
 const LEDGER_PATHSPECS: ReadonlyArray<string> = [
-	OBSERVATION_LEDGER_DIRECTORY,
+	...LEDGER_DIRECTORIES,
 	...LEGACY_OBSERVATION_LEDGER_PATHS,
 ]
 
@@ -108,7 +106,7 @@ function is_stageable(file_path: string, excluded: ReadonlyArray<string>): boole
 // step dies on git's empty index with `Failed to commit changes` — a message naming nothing that
 // caused it. This line is what turns that into a diagnosis.
 //
-// **The paths are parsed rather than matched as substrings**: `docs/maintainers/observations-old/x.md`
+// **The paths are parsed rather than matched as substrings**: `.josh/observations-old/x.md`
 // contains the ledger's path, and a hint naming a file the exclusion never touched is a hint that
 // teaches the reader to ignore it.
 function report_excluded_paths(status_output: string, excluded: ReadonlyArray<string>): void {

package/scripts/git/git-status.ts

@@ -31,9 +31,7 @@ function has_unstaged_files(status_output: string): boolean {
 }
 
 function is_staged_file(line: string): boolean {
-	if (line.length < REQUIRED_STATUS_LENGTH || is_untracked_file(line)) {
-		return false
-	}
+	if (line.length < REQUIRED_STATUS_LENGTH || is_untracked_file(line)) return false
 
 	const [staged_status] = line
 
@@ -47,9 +45,7 @@ function has_unstaged_changes(line: string): boolean {
 function has_all_files_staged(status_output: string): boolean {
 	const lines = parse_status_lines(status_output)
 
-	if (lines.length === 0) {
-		return true
-	}
+	if (lines.length === 0) return true
 
 	return lines.every((line) => !has_unstaged_changes(line))
 }
@@ -62,9 +58,7 @@ function is_package_json_staged(status_output: string): boolean {
 	const lines = parse_status_lines(status_output)
 
 	return lines.some((line) => {
-		if (!is_staged_file(line)) {
-			return false
-		}
+		if (!is_staged_file(line)) return false
 
 		const filename = extract_filename(line)
 

package/scripts/hooks/codex-hook-adapter.ts

@@ -49,7 +49,7 @@ function paths_matching(command: string, pattern: RegExp): Array<string> {
 	return [...command.matchAll(pattern)].flatMap((match) => {
 		const file_path = match[1]?.trim()
 
-		return file_path === undefined || file_path === '' ? [] : [file_path]
+		return file_path === undefined || file_path === '' ? [] : file_path
 	})
 }
 

package/scripts/hooks/edited-cspell.ts

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs'
 import path from 'node:path'
+import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execa } from 'execa'
 
 // The spell half of the edit hook (joshuafolkken/kit#2296). joshuafolkken/kit#2275 gave the hook a way
@@ -47,9 +48,6 @@ const CSPELL_ARGS: ReadonlyArray<string> = [
 	'--no-summary',
 ]
 const PNPM = 'pnpm'
-// A spell check that hangs would hold the edit's turn open; the bound is generous because reaching it
-// means something is already wrong, exactly as the formatter spawns in `format-edited-file.ts`.
-const PROCESS_TIMEOUT_MS = 15_000
 
 const HEADER =
 	'The edit hook found words cspell does not know; fix them or add them to `cspell.config.yaml` now rather than at the gate:'
@@ -79,7 +77,7 @@ async function run_cspell(file_path: string, project_root: string): Promise<stri
 		cwd: project_root,
 		stdout: 'pipe',
 		stderr: 'ignore',
-		timeout: PROCESS_TIMEOUT_MS,
+		timeout: HOOK_PROCESS_TIMEOUT_MS,
 	})
 
 	return result.stdout

package/scripts/hooks/format-edited-file.ts

@@ -4,6 +4,7 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { resolve_local_bin, resolve_package_bin } from '#scripts/build/local-bin'
 import { ESLINT_EDIT_CACHE_FLAGS } from '#scripts/josh/josh-command-types'
+import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { execa } from 'execa'
 import { z } from 'zod'
@@ -87,15 +88,6 @@ const DAEMON_RESTART = 'restart'
 // `eslint.config.*` entry, and the rule modules under `eslint/` that it imports.
 const ESLINT_CONFIG_DIR = 'eslint'
 const ESLINT_CONFIG_ENTRY = /^eslint\.config\.[cm]?[jt]s$/u
-// A formatter that hangs would hold the edit's turn open, so each spawn is bounded. The bound has
-// to be read against the *worst-case run* rather than one spawn: an edit to a config input plans
-// eslint, prettier and `eslint_d restart`, and the first and last each have a second route behind
-// the daemon — five spawns. The hook entry in `.claude/settings.json` declares 90 seconds, so the
-// per-spawn bound must leave five of them under it, or the harness kill lands first and lands at a
-// moment this file did not choose — possibly inside `prettier --write`, which rewrites in place and
-// can leave the file truncated. 15s × 5 = 75s. It is still two orders of magnitude beyond the 0.84s
-// a warm run takes, so reaching it means something is already wrong.
-const PROCESS_TIMEOUT_MS = 15_000
 
 // The problems eslint could not auto-fix are handed to the model verbatim from eslint's own stdout —
 // its default formatter already prints the file, the `line:col`, and the rule name the issue asks
@@ -315,7 +307,7 @@ async function spawn_invocation(
 		env: { ESLINT_D_MISS: 'fail' },
 		stdout: 'pipe',
 		stderr: 'ignore',
-		timeout: PROCESS_TIMEOUT_MS,
+		timeout: HOOK_PROCESS_TIMEOUT_MS,
 	})
 
 	return { exit_code: result.exitCode ?? 1, stdout: result.stdout }
@@ -469,7 +461,7 @@ function report_no_payload(): void {
 // have (joshuafolkken/kit#2314). The rewrite, lint and spell blocks are composed together first, then
 // joined to the density line — one envelope, since a `PostToolUse` hook's stdout carries only one
 // (joshuafolkken/kit#2296). A hook killed at its 15s timeout is the one case this loses the density
-// line to — a run already gone pathologically wrong, per PROCESS_TIMEOUT_MS.
+// line to — a run already gone pathologically wrong, per HOOK_PROCESS_TIMEOUT_MS.
 async function run_hook(payload: string): Promise<void> {
 	const notice = time_density_hook.density_notice(payload)
 	const file_path = parse_edited_path(payload)
@@ -500,6 +492,5 @@ export {
 	select_invocation,
 	ESLINT_DAEMON,
 	MAX_DIAGNOSTIC_CHARS,
-	PROCESS_TIMEOUT_MS,
 }
 export type { CommandRunner, FormatCommand }

package/scripts/hooks/pre-push-unit.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
-import { gate_skip } from '#scripts/gate/gate-skip'
+import { gate_skip, type GateReuse } from '#scripts/gate/gate-skip'
 import { gate_tree, type GateTree } from '#scripts/gate/gate-tree'
 import { hook_gate_reuse } from '#scripts/gate/hook-gate-reuse'
-import type { FileMapStamp } from '#scripts/josh/file-map-stamp'
 import { test_unit_guard } from '#scripts/test/test-unit-guard'
 
 // The pre-push hook's unit run, which no longer re-runs a suite a green gate already covers
@@ -42,6 +41,15 @@ const FORCE_ENV = 'JOSH_PRE_PUSH_FORCE'
 // `gate-tree.ts` rather than read a second way here — plus the one this hook adds.
 interface PushTree extends GateTree {
 	is_clean: boolean
+	// What a dirty tree reports as the reason the record was not reused (joshuafolkken/kit#3307) — the
+	// paths name a lock file a hook's own `pnpm install` rewrote, the case that went unexplained.
+	carry_miss: string
+}
+
+function carry_miss(lines: ReadonlyArray<string> | undefined): string {
+	if (lines === undefined) return 'git status could not be read'
+
+	return `the working tree differs from HEAD (${lines.join('; ')})`
 }
 
 // `git status --porcelain` prints one line per difference from HEAD, untracked files included — so an
@@ -57,7 +65,11 @@ async function read_push_tree(): Promise<PushTree> {
 		hook_gate_reuse.read_status_lines(),
 	])
 
-	return { ...tree, is_clean: hook_gate_reuse.is_worktree_clean(lines) }
+	return {
+		...tree,
+		is_clean: hook_gate_reuse.is_worktree_clean(lines),
+		carry_miss: carry_miss(lines),
+	}
 }
 
 // `--force` is the gate's own flag, reused rather than respelled: it and `JOSH_PRE_PUSH_FORCE` are
@@ -74,14 +86,15 @@ function forwarded_arguments(extra_arguments: ReadonlyArray<string>): ReadonlyAr
 // **Any argument at all refuses the reuse**, not only `--force`. Everything else is forwarded to
 // vitest, and a caller who narrowed the run to one spec asked for that run rather than for a
 // recorded result about a whole tree. The hook's own line passes none, so this costs it nothing.
-function reusable_green_push(
+function push_reuse(
 	tree: PushTree,
 	extra_arguments: ReadonlyArray<string>,
 	source?: string,
-): FileMapStamp | undefined {
-	return hook_gate_reuse.reusable_green_hook({
+): GateReuse {
+	return hook_gate_reuse.hook_reuse({
 		tree,
 		is_tree_carried: tree.is_clean,
+		carry_miss: tree.carry_miss,
 		extra_arguments,
 		force_env: FORCE_ENV,
 		source,
@@ -107,20 +120,29 @@ function format_skip(taken_at: string): string {
 // other commands already have. **A project that has vitest and no test file at all fails the push
 // instead** (joshuafolkken/kit#1224): the guard treats that half as a broken state rather than a
 // young project, and the hook returns what the guard returns.
+// **A fall back to the whole suite says why, in one line** (joshuafolkken/kit#3307): under a crowded
+// machine the suite costs minutes, and a silent miss left a moved merge base, a dirty tree and a
+// mismatched record indistinguishable from one another.
+function format_miss(reason: string): string {
+	return `↻ running the whole unit suite — the green gate record does not cover this push: ${reason}.`
+}
+
 async function run_pre_push_unit(
 	extra_arguments: ReadonlyArray<string> = [],
 	source?: string,
 ): Promise<number> {
-	const reusable = reusable_green_push(await read_push_tree(), extra_arguments, source)
+	const reuse = push_reuse(await read_push_tree(), extra_arguments, source)
+
+	if ('miss' in reuse) {
+		process.stdout.write(`${format_miss(reuse.miss)}\n`)
 
-	if (reusable === undefined) {
 		return await test_unit_guard.run_guarded_unit(
 			process.cwd(),
 			forwarded_arguments(extra_arguments),
 		)
 	}
 
-	process.stdout.write(`${format_skip(reusable.taken_at)}\n`)
+	process.stdout.write(`${format_skip(reuse.stamp.taken_at)}\n`)
 
 	return 0
 }

package/scripts/hooks/reserved-run.ts

@@ -54,8 +54,8 @@ function parse_arguments(argv: ReadonlyArray<string>): ReservedCommand | undefin
 // command becomes an exit code the caller returns rather than a throw — the reservation is released by
 // `with_core_reservation`'s `finally` on either path.
 async function run_command(command: ReadonlyArray<string>): Promise<number> {
-	const [file, ...args] = command
-	const result = await execa(file ?? '', args, { stdio: 'inherit', reject: false })
+	const [file = '', ...args] = command
+	const result = await execa(file, args, { stdio: 'inherit', reject: false })
 
 	return result.exitCode ?? FAIL_EXIT_CODE
 }

package/scripts/hooks/run-hook.sh

@@ -12,9 +12,10 @@
 #   runs through josh, whose command is the name with its first `-` turned into `:`
 #   (`pretool-guard` → `pretool:guard`).
 # - In kit's own checkout the gate is `hook-bundle-ready.ts`, which rebuilds stale bundles
-#   (joshuafolkken/kit#2984). In an installed package it is a presence check: the published bundles
-#   cannot be stale against a source the consumer never edits, and Node strips no types under
-#   `node_modules`.
+#   (joshuafolkken/kit#2984) and then runs the bundle — or the josh fallback — itself, so a hook call
+#   starts node once (joshuafolkken/kit#3327). In an installed package it is a presence check: the
+#   published bundles cannot be stale against a source the consumer never edits, and Node strips no
+#   types under `node_modules`.
 # - An `if`/`else`, never `&&`/`||`: a guard's refusal is a non-zero exit, and a chain would read it as
 #   a missing bundle and run the hook twice.
 
@@ -36,6 +37,6 @@ case $0 in
 	if [ -d "$package_dir/dist/hooks" ]; then node "$bundle" "$@"; else node "$package_dir/dist/josh.js" "$josh_command" "$@"; fi
 	;;
 *)
-	if node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts"; then node "$bundle" "$@"; else pnpm josh "$josh_command" "$@"; fi
+	node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts" "$hook_name" "$josh_command" "$@"
 	;;
 esac

package/scripts/hooks/stop-guard.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env tsx
 import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
+import { agent_headless } from '#scripts/agent/agent-headless'
 import { backlog_ready } from '#scripts/backlog/backlog-ready'
 import { backlog_stalled_detect } from '#scripts/backlog/backlog-stalled-detect'
 import { repo_party } from '#scripts/discovery/repo-party'
@@ -13,11 +14,11 @@ import { lane_background } from '#scripts/rules/lane-background'
 import { lane_park } from '#scripts/rules/lane-park'
 import { last_prompt } from '#scripts/rules/last-prompt'
 import { stop_rules, type StopContext, type StopOutcome } from '#scripts/rules/stop-rules'
-import { run_carry } from '#scripts/run/run-carry'
-import { run_cut } from '#scripts/run/run-cut'
+import { run_carry } from '#scripts/run/carry/run-carry'
+import { run_cut } from '#scripts/run/cut/run-cut'
+import { run_hold } from '#scripts/run/hold/run-hold'
 import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
 import { run_headless } from '#scripts/run/run-headless'
-import { run_hold } from '#scripts/run/run-hold'
 import { run_stranded_detect } from '#scripts/run/run-stranded-detect'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { time_hook_transcript } from '#scripts/time-runtime/time-hook-transcript'
@@ -87,6 +88,7 @@ async function build_context(
 		agent_pending: lane_background.pending_agent_ids(tail).length > 0,
 		handed_off: lane_handoff.is_handed_off(process.cwd()),
 		session_lang: session_lang(),
+		headless_agent: agent_headless.is_headless(),
 	}
 }
 

package/scripts/init/init-actions.ts

@@ -217,11 +217,6 @@ function build_file_actions(shape?: ProjectShape): ReadonlyArray<FileAction> {
 
 	return [
 		...(shape?.has_git === false ? [] : [build_gitignore_action()]),
-		build_action(
-			'.npmrc',
-			() => init_logic.generate_npmrc(),
-			(existing) => init_logic.merge_npmrc(existing),
-		),
 		build_eslint_action(),
 		build_action(
 			PRETTIER_CONFIG_JS,

package/scripts/init/init-ai-copy.ts

@@ -104,8 +104,16 @@ function did_skip_copy_if_absent(
 
 // The merged file is written back, and reported as `updated`, only when the merge changed it — a
 // second `josh init` over an already-merged file reports `unchanged` (joshuafolkken/kit#2873).
+// The workspace template with the project's own `.npmrc` values carried over: once the file holds a
+// key, the merge keeps it, so this is the one chance to move the value (joshuafolkken/kit#3267).
+function read_workspace_template(source_path: string, destination_path: string): string {
+	const npmrc = file_reader.read_file_or_empty(path.join(path.dirname(destination_path), '.npmrc'))
+
+	return init_logic.carry_npmrc_settings(readFileSync(source_path, 'utf8'), npmrc)
+}
+
 function merge_existing_workspace_yaml(source_path: string, destination_path: string): void {
-	const template = readFileSync(source_path, 'utf8')
+	const template = read_workspace_template(source_path, destination_path)
 	const existing = readFileSync(destination_path, 'utf8')
 	const merged = init_logic.merge_workspace_yaml(existing, template)
 
@@ -126,7 +134,9 @@ function did_skip_workspace_yaml_copy(source_path: string, destination_path: str
 		return false
 	}
 
-	copy_ai_file(source_path, destination_path)
+	const template = read_workspace_template(source_path, destination_path)
+
+	writeFileSync(destination_path, transform_copied_content(destination_path, template))
 	console.info(`  ✔ created   ${WORKSPACE_YAML}`)
 
 	return false
@@ -385,6 +395,7 @@ const init_ai_copy = {
 	ai_file_source,
 	ai_file_mappings,
 	ensure_basic_claude_md,
+	read_workspace_template,
 }
 
 export { init_ai_copy, CLAUDE_MD_FILENAME }

package/scripts/init/init-logic-json-merge.ts

@@ -3,6 +3,7 @@ import { json_format } from '#scripts/config-merge/json-format'
 import { parse_jsonc } from '#scripts/config-merge/parse-jsonc'
 import { patch_json_key } from '#scripts/config-merge/patch-json-key'
 import { json_object_schema, string_array_schema, string_record_schema } from '#scripts/lib/schemas'
+import { safe_chain_preinstall } from '#scripts/safe-chain/preinstall-command'
 import { apply_jf_migrations, remove_retired_scripts } from './init-logic-migrate'
 import { PACKAGE_JSON_KEY_ORDER } from './init-logic-package-key-order'
 import { kit_base_preset } from './kit-base-preset'
@@ -216,6 +217,23 @@ function merge_package_scripts(content: string, scripts: Record<string, string>)
 	return serialize_package_json({ ...parsed, scripts: { ...prepend, ...migrated, ...append } })
 }
 
+// Replace only a safe-chain `preinstall` an earlier kit wrote, for a consumer that never re-runs
+// `josh init`; every other key and script is kept (joshuafolkken/kit#3269).
+function upgrade_safe_chain_preinstall(content: string): string {
+	const parsed = parse_jsonc(content)
+	const raw = parsed['scripts']
+	if (raw === undefined) return content
+
+	const scripts = string_record_schema.parse(raw)
+	const current = scripts['preinstall']
+	if (current === undefined) return content
+
+	const migrated = safe_chain_preinstall.migrate_preinstall(current)
+	if (migrated === current) return content
+
+	return serialize_package_json({ ...parsed, scripts: { ...scripts, preinstall: migrated } })
+}
+
 function merge_development_dependencies(
 	content: string,
 	additions: Record<string, string>,
@@ -327,6 +345,7 @@ const init_logic_json_merge = {
 	merge_json_array_field,
 	merge_json_object,
 	merge_package_scripts,
+	upgrade_safe_chain_preinstall,
 	merge_package_script_suffix,
 	replace_in_package_script,
 	remove_script_with_marker,

package/scripts/init/init-logic-secretlint.ts

@@ -1,4 +1,5 @@
 import { init_logic_json_merge } from './init-logic-json-merge'
+import { kit_development_versions } from './kit-development-versions'
 
 const SECRETLINT_CONFIG_FILENAME = '.secretlintrc.json'
 const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
@@ -6,12 +7,8 @@ const SECRETLINT_RULE_PRESET = '@secretlint/secretlint-rule-preset-recommend'
 // secretlint resolves both its CLI and every rule package from the project it runs in, not
 // transitively through the kit — the same constraint that forces the prettier plugins into
 // consumer devDependencies (as kit peers, see init.ts). Omitting either
-// entry makes the pre-commit hook fail with "Cannot find module". Versions mirror the kit's
-// own devDependencies.
-const SECRETLINT_DEV_DEPS: Record<string, string> = {
-	secretlint: '^13.0.2',
-	[SECRETLINT_RULE_PRESET]: '^13.0.2',
-}
+// entry makes the pre-commit hook fail with "Cannot find module". The versions are kit's own.
+const SECRETLINT_PACKAGES = ['secretlint', SECRETLINT_RULE_PRESET]
 
 function generate_secretlint_config(): string {
 	const config = { rules: [{ id: SECRETLINT_RULE_PRESET }] }
@@ -24,7 +21,10 @@ function get_secretlint_config_filename(): string {
 }
 
 function merge_secretlint_development_deps(content: string): string {
-	return init_logic_json_merge.merge_development_dependencies(content, SECRETLINT_DEV_DEPS)
+	return init_logic_json_merge.merge_development_dependencies(
+		content,
+		kit_development_versions.versions_of(SECRETLINT_PACKAGES),
+	)
 }
 
 const init_logic_secretlint = {

package/scripts/init/init-logic-workspace.ts

@@ -2,7 +2,7 @@ function extract_yaml_top_level_keys(content: string): Array<string> {
 	return content.split('\n').flatMap((line) => {
 		const key = /^([a-zA-Z][a-zA-Z0-9_-]*):/u.exec(line)?.[1]
 
-		return key ? [key] : []
+		return key ?? []
 	})
 }
 
@@ -125,6 +125,45 @@ function add_missing_build_entries(existing: string, template: string): string {
 	return existing.replace(block, () => [block, ...missing].join('\n'))
 }
 
+interface MovedNpmrcSetting {
+	npmrc_key: string
+	workspace_key: string
+	value_pattern: RegExp
+}
+
+// `.npmrc` settings pnpm 12 reads only from `pnpm-workspace.yaml`, with the value shape each takes.
+// A project's own value (a longer age window, `engine-strict=false`) replaces the template's, so the
+// move neither loosens nor tightens what the project chose (joshuafolkken/kit#3267).
+const MOVED_NPMRC_SETTINGS: ReadonlyArray<MovedNpmrcSetting> = [
+	{ npmrc_key: 'minimum-release-age', workspace_key: 'minimumReleaseAge', value_pattern: /^\d+$/u },
+	{ npmrc_key: 'engine-strict', workspace_key: 'engineStrict', value_pattern: /^(?:true|false)$/u },
+]
+
+// The last assignment wins, as it does when npm reads the file.
+function npmrc_value(npmrc: string, key: string): string | undefined {
+	const pattern = new RegExp(String.raw`^[ \t]*${key}[ \t]*=[ \t]*(\S+)[ \t]*$`, 'gmu')
+
+	return [...npmrc.matchAll(pattern)].at(-1)?.[1]
+}
+
+function carry_npmrc_setting(template: string, npmrc: string, setting: MovedNpmrcSetting): string {
+	const value = npmrc_value(npmrc, setting.npmrc_key)
+	if (value === undefined || !setting.value_pattern.test(value)) return template
+	const line_pattern = new RegExp(`^${setting.workspace_key}:.*$`, 'mu')
+
+	return template.replace(line_pattern, () => `${setting.workspace_key}: ${value}`)
+}
+
+function carry_npmrc_settings(template: string, npmrc: string): string {
+	let result = template
+
+	for (const setting of MOVED_NPMRC_SETTINGS) {
+		result = carry_npmrc_setting(result, npmrc, setting)
+	}
+
+	return result
+}
+
 function merge_workspace_yaml(existing: string, template: string): string {
 	if (!existing.trim()) return template
 	const normalized = existing.endsWith('\n') ? existing : `${existing}\n`
@@ -138,6 +177,6 @@ function merge_workspace_yaml(existing: string, template: string): string {
 	return append_user_blocks(cleaned, new_keys, template)
 }
 
-const init_logic_workspace = { merge_workspace_yaml, template_build_values }
+const init_logic_workspace = { carry_npmrc_settings, merge_workspace_yaml, template_build_values }
 
 export { init_logic_workspace }

package/scripts/init/init-logic.ts

@@ -14,16 +14,15 @@ const DEV_ENGINES_VALUE = {
 	packageManager: { name: 'pnpm', version: '>=12.1.0', onFail: 'error' },
 }
 
-// New projects resolve kit from public npm. Existing registry and auth lines remain untouched
-// by merge_npmrc so consumers of other GitHub Packages can migrate separately.
-const NPMRC_LINES: ReadonlyArray<string> = [
+// The settings lines earlier kit releases wrote into a project `.npmrc`. pnpm 12 reads only registry
+// and auth settings from `.npmrc`, so all four are inert there: the age window and engine check now
+// live in `pnpm-workspace.yaml`, and `confirmModulesPurge` no longer exists (joshuafolkken/kit#3267).
+const LEGACY_NPMRC_LINES: ReadonlySet<string> = new Set([
 	'engine-strict=true',
 	'minimum-release-age=1440',
 	'confirmModulesPurge=false',
-	// Pin full GitHub Packages tarball URLs in the lockfile so pnpm >=11.5 frozen-lockfile
-	// installs hit the correct authenticated download path (avoids ERR_PNPM_FETCH_401 on CI).
 	'lockfile-include-tarball-url=true',
-]
+])
 
 const CSPELL_IMPORT = '@joshuafolkken/kit/cspell'
 
@@ -254,10 +253,6 @@ function generate_cspell_config(): string {
 	return `version: "0.2"\nimport:\n  - "${CSPELL_IMPORT}"\nwords: []\nignorePaths: []\n`
 }
 
-function generate_npmrc(): string {
-	return `${NPMRC_LINES.join('\n')}\n`
-}
-
 // Append `missing` lines to `existing`, inserting a separating newline when the base is
 // non-empty and lacks a trailing one. Returns `existing` untouched when nothing is missing.
 function append_missing_lines(existing: string, missing: ReadonlyArray<string>): string {
@@ -267,18 +262,19 @@ function append_missing_lines(existing: string, missing: ReadonlyArray<string>):
 	return `${prefix}${missing.join('\n')}\n`
 }
 
-// Insert-only: every existing line survives verbatim, including a `_authToken` line the consumer
-// added themselves. Kit removed the env-var form until #759, on the premise that pnpm always
-// ignores it in a project .npmrc — true only while `npmrcAuthFile` is unset. A consumer that
-// declares the project file its trusted auth file (Cloudflare Workers Builds via
-// `PNPM_CONFIG_NPMRC_AUTH_FILE`, for instance) gets the credential expanded, and that setting can
-// live in a deploy platform's dashboard — so no reading of the repository tells an inert line
-// apart from a live one. Deleting it took down a working production deploy; leaving it costs at
-// most the warning pnpm already prints. See docs/authentication.md §4(d).
+// Removes only an exact kit-written legacy line; every other line survives verbatim, including a
+// `_authToken` line the consumer added themselves and a setting carrying a value of their own. Kit
+// removed the env-var auth form until #759, on the premise that pnpm always ignores it in a project
+// .npmrc — true only while `npmrcAuthFile` is unset. A consumer that declares the project file its
+// trusted auth file (Cloudflare Workers Builds via `PNPM_CONFIG_NPMRC_AUTH_FILE`, for instance) gets
+// the credential expanded, and that setting can live in a deploy platform's dashboard — so no
+// reading of the repository tells an inert auth line apart from a live one. Deleting it took down a
+// working production deploy. See docs/authentication.md §4(d).
 function merge_npmrc(content: string): string {
-	const missing = NPMRC_LINES.filter((line) => !content.includes(line))
+	const lines = content.split('\n')
+	const kept = lines.filter((line) => !LEGACY_NPMRC_LINES.has(line.trim()))
 
-	return append_missing_lines(content, missing)
+	return kept.length === lines.length ? content : kept.join('\n')
 }
 
 // A gitignore line worth appending during a union merge: real ignore patterns only.
@@ -349,10 +345,6 @@ function strip_kit_only_vscode_settings_content(raw: string): string {
 	return json_format.format_json(stripped)
 }
 
-function get_npmrc_lines(): ReadonlyArray<string> {
-	return NPMRC_LINES
-}
-
 function get_development_engines_value(): typeof DEV_ENGINES_VALUE {
 	return DEV_ENGINES_VALUE
 }
@@ -436,7 +428,6 @@ const init_logic = {
 	get_tsconfig_exclude_entries,
 	generate_lefthook_config,
 	generate_cspell_config,
-	generate_npmrc,
 	merge_npmrc,
 	merge_gitignore,
 	get_tsconfig_extends_entry,
@@ -450,7 +441,6 @@ const init_logic = {
 	SAFE_CHAIN_CMD,
 	GUARDED_LEFTHOOK_CMD,
 	upgrade_prepare_lefthook_warning,
-	get_npmrc_lines,
 	get_development_engines_value,
 	get_ai_copy_files,
 	get_ai_copy_file_mappings,