@joshuafolkken/kit 1.1229.0 → 1.1370.0

package/scripts/init/hook-launch.ts

@@ -1,18 +1,18 @@
 import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
 
 // The shell command a Claude Code hook is launched with, so it starts without a `pnpm` wrapper — and,
-// for a consumer, without the `dist/josh.js` dispatcher re-spawning `tsx` for the hook's `.ts`
-// (joshuafolkken/kit#2023). Each hook is pre-built to its own `dist/hooks/<name>.js`
+// for a consumer, without the `dist/josh.js` dispatcher re-spawning `tsx` for the hook's `.ts`.
+// Each hook is pre-built to its own `dist/hooks/<name>.js`
 // (`scripts/build/build-hooks.ts`) and launched directly with `node`.
 //
-// **The command starts from the project root, never from wherever the session happens to be**
-// (joshuafolkken/kit#2984). Every path after the prefix is relative, so a hook fired from a
+// **The command starts from the project root, never from wherever the session happens to be**.
+// Every path after the prefix is relative, so a hook fired from a
 // subdirectory would otherwise miss its script. The root is git's, resolved with the location
 // variables a git hook exports cleared first, and resolved with them only when that fails — git
 // metadata outside the work tree. The consumer rewrite (`hook-command-rewrite.ts`) keeps this prefix,
 // so both sides stay one mechanism for Claude Code and Codex alike.
 //
-// **Everything after the root is one script** (`scripts/hooks/run-hook.sh`, joshuafolkken/kit#3184):
+// **Everything after the root is one script** (`scripts/hooks/run-hook.sh`):
 // clearing the location variables for the hook itself, the bundle-ready gate and the live-source
 // fallback live there once, so each hook command names only its hook.
 

package/scripts/init/init-actions.ts

@@ -7,6 +7,7 @@ import { init_logic } from './init-logic'
 import { package_path, PROJECT_ROOT } from './init-paths'
 import type { ProjectShape } from './project-profile'
 import { session_language_environment } from './session-language-environment'
+import { vscode_tasks } from './vscode-tasks'
 
 const PRETTIER_CONFIG_JS = 'prettier.config.js'
 const BASIC_PRETTIER_CONFIG = 'prettier.config.mjs'
@@ -38,6 +39,17 @@ function build_action(destination: string, create: () => string, merge: MergeFun
 	return { dest: destination, create, merge }
 }
 
+function build_vscode_tasks_action(): FileAction {
+	const tasks_path = path.join('.vscode', vscode_tasks.VSCODE_TASKS_FILENAME)
+	const kit_tasks = vscode_tasks.read_kit_tasks(read_package_file(tasks_path))
+
+	return build_action(
+		tasks_path,
+		() => read_package_file(tasks_path),
+		(existing) => vscode_tasks.merge_tasks(existing, kit_tasks),
+	)
+}
+
 function build_vscode_actions(): ReadonlyArray<FileAction> {
 	const extensions_path = path.join('.vscode', init_logic.VSCODE_EXTENSIONS_FILENAME)
 	const settings_path = path.join('.vscode', init_logic.get_vscode_settings_filename())
@@ -61,6 +73,7 @@ function build_vscode_actions(): ReadonlyArray<FileAction> {
 				init_logic.strip_kit_only_vscode_settings_content(read_package_file(settings_path)),
 			merge: (existing) => init_logic.merge_json_object(existing, settings_data),
 		},
+		build_vscode_tasks_action(),
 	]
 }
 

package/scripts/init/init-ai-copy.ts

@@ -33,7 +33,7 @@ const BASIC_AI_FILES = [
 	SECURITY_MD,
 	WORKSPACE_YAML,
 ]
-// A basic project gets its own template for these, not kit's development copy (joshuafolkken/kit#2693).
+// A basic project gets its own template for these, not kit's development copy.
 const BASIC_SOURCES: Readonly<Record<string, string>> = {
 	[PRETTIER_IGNORE]: 'templates/prettierignore.basic',
 	[WORKSPACE_YAML]: 'templates/pnpm-workspace.basic.yaml',
@@ -68,8 +68,8 @@ function copy_ai_file(source_path: string, destination_path: string): void {
 // destination may hold a workflow the consumer wrote themselves, and a header claiming this package
 // owns it would hold every bump to it back on a false premise. But an unstamped workflow is not
 // merely out of date either — the consumer's auto-merge workflow reads the stamp, so until `sync`
-// writes one, a bump to a workflow this package does overwrite merges and the next sync reverts it
-// (joshuafolkken/kit#844). A warning is the honest middle: `sync` resolves it either way, and this
+// writes one, a bump to a workflow this package does overwrite merges and the next sync reverts it.
+// A warning is the honest middle: `sync` resolves it either way, and this
 // names the consequence rather than leaving it to be discovered from a revert.
 //
 // The destination is checked before the file is opened, and a read failure is stepped over, so
@@ -103,9 +103,9 @@ function did_skip_copy_if_absent(
 }
 
 // The merged file is written back, and reported as `updated`, only when the merge changed it — a
-// second `josh init` over an already-merged file reports `unchanged` (joshuafolkken/kit#2873).
+// second `josh init` over an already-merged file reports `unchanged`.
 // The workspace template with the project's own `.npmrc` values carried over: once the file holds a
-// key, the merge keeps it, so this is the one chance to move the value (joshuafolkken/kit#3267).
+// key, the merge keeps it, so this is the one chance to move the value.
 function read_workspace_template(source_path: string, destination_path: string): string {
 	const npmrc = file_reader.read_file_or_empty(path.join(path.dirname(destination_path), '.npmrc'))
 
@@ -242,10 +242,10 @@ function did_skip_ai_directory_copy(directory_name: string): boolean {
 
 // `josh init` writes the one-line CLAUDE.md import when the consumer has none, and — like every other
 // AI file — leaves an existing one untouched so a consumer's additions are never disturbed. `josh sync`
-// is what ensures the import line on an existing file (sync.ts). CLAUDE.md is no longer byte-copied
-// (joshuafolkken/kit#1878), so it is handled here rather than through AI_COPY_FILES.
+// is what ensures the import line on an existing file (sync.ts). CLAUDE.md is no longer byte-copied,
+// so it is handled here rather than through AI_COPY_FILES.
 //
-// The one edit made to an existing file is the rules import written before joshuafolkken/kit#2829,
+// The one edit made to an existing file is the rules import written under the static profile name,
 // moved onto the basic path — only that kit-written line, never the consumer's additions.
 // An unreadable file is left as it is and reported as skipped, as it was before the migration.
 function read_if_readable(destination_path: string): string | undefined {
@@ -271,8 +271,8 @@ function basic_claude_md(): string {
 }
 
 // A basic CLAUDE.md imports the basic rules alone: the full bootstrap and import are removed, a
-// pre-rename path is moved, and the basic header is restored when no basic import is left
-// (joshuafolkken/kit#2827). The project's own lines stay as they are.
+// pre-rename path is moved, and the basic header is restored when no basic import is left.
+// The project's own lines stay as they are.
 function ensure_basic_claude_md(existing: string | undefined): string {
 	if (existing === undefined) return basic_claude_md()
 	const kept = basic_path_migration.migrate_basic_paths(
@@ -303,7 +303,7 @@ function did_skip_claude_md_import(shape?: ProjectShape): boolean {
 }
 
 // Returns the repository name resolved for the Sonar config, so `josh init` can reuse it for the
-// security-updates report instead of spawning a second `gh repo view` (joshuafolkken/kit#805).
+// security-updates report instead of spawning a second `gh repo view`.
 // Resolving it here rather than in the caller keeps every AI-file write ahead of the network call.
 function should_copy_git_file(filename: string, shape?: ProjectShape): boolean {
 	if (shape?.has_git !== false) return true

package/scripts/init/init-bootstrap.ts

@@ -10,7 +10,7 @@ const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
 const NODE_MODULES = 'node_modules'
 const PACKAGE_JSON = 'package.json'
 // The basic template lists exactly the build scripts kit's own dependency tree carries, which is
-// what installing kit alone needs approved (joshuafolkken/kit#2785).
+// what installing kit alone needs approved.
 const KIT_BUILDS_TEMPLATE = 'templates/pnpm-workspace.basic.yaml'
 const HANDOFF_FAILURE = 'josh init from the project-installed kit failed — see the output above'
 // Set on the handed-off run, so a kit that still does not find itself installed in the project — pnpm
@@ -29,7 +29,7 @@ function real_directory(directory: string): string | undefined {
 
 // A `pnpm dlx` (or global) run executes whatever kit its cache held, which may be days behind the
 // registry — and `init` pins the kit it runs as, so a stale cache used to leave its version and its
-// templates in the project for good (joshuafolkken/kit#2794). Only the kit the project itself installs
+// templates in the project for good. Only the kit the project itself installs
 // does the setup. Compared by real path, so a global virtual store shared with the project still
 // reads as the project's own kit.
 function is_project_kit(package_directory: string, project_root: string): boolean {
@@ -75,7 +75,7 @@ function handoff_step(args: ReadonlyArray<string>): InstallStep {
 }
 
 // pnpm walks up to the nearest `package.json`, so without one here it installs kit into whatever
-// project an ancestor directory holds and rewrites that project's files (joshuafolkken/kit#2866).
+// project an ancestor directory holds and rewrites that project's files.
 function ensure_project_manifest(project_root: string): void {
 	const manifest_path = path.join(project_root, PACKAGE_JSON)
 

package/scripts/init/init-copy-content.ts

@@ -21,11 +21,11 @@ import { init_logic } from './init-logic'
  * managed-marker-logic.ts for why the stamp is on the file rather than in a list.
  *
  * The consumer's `.claude/settings.json` gets three further passes. The keys kit sets only for its
- * own sessions are removed (joshuafolkken/kit#3140, see claude-kit-only-settings.ts). The kit plugin's marketplace and
+ * own sessions are removed (see claude-kit-only-settings.ts). The kit plugin's marketplace and
  * `enabledPlugins` declaration is injected, because the skills that used to be copied now ship as the
- * `kit` plugin and load from that declaration (joshuafolkken/kit#1879). And its hook commands are
- * rewritten from `pnpm josh` to the published bundle invoked directly with node
- * (joshuafolkken/kit#1930), so a consumer's guarded call does not pay a `pnpm` launch it never needed.
+ * `kit` plugin and load from that declaration. And its hook commands are
+ * rewritten from `pnpm josh` to the published bundle invoked directly with node,
+ * so a consumer's guarded call does not pay a `pnpm` launch it never needed.
  * Keeping both on this one function is the same guarantee as the workflow passes — a copy path that
  * skipped the plugin block would ship a settings file that never enables the plugin, and one that
  * skipped the rewrite would leave every consumer hook slower than it has to be.

package/scripts/init/init-logic-json-merge.ts

@@ -28,12 +28,11 @@ function read_extends_entries(content: string): ReadonlyArray<string> {
 
 // Ensure kit's tsconfig base preset is in `extends` — UNLESS an `@joshuafolkken/*` tsconfig preset
 // (kit's own base, or an app-kit / game-kit framework preset that already embeds kit base) is
-// present. Adding kit's base alongside such a preset is a redundant second extend. See
-// joshuafolkken/kit#660. The legacy `.jsonc` preset extension is migrated first: the presence check
-// below matches it too, so without the rewrite a consumer stuck on the old path would be reported
-// "already present" and never repaired. `base_directory` is the project root the `extends` paths
-// resolve against, which the migration needs to confirm the renamed preset is installed. See
-// joshuafolkken/kit#681.
+// present. Adding kit's base alongside such a preset is a redundant second extend. The legacy
+// `.jsonc` preset extension is migrated first: the presence check below matches it too, so without
+// the rewrite a consumer stuck on the old path would be reported "already present" and never
+// repaired. `base_directory` is the project root the `extends` paths resolve against, which the
+// migration needs to confirm the renamed preset is installed.
 function merge_tsconfig_extends(content: string, entry: string, base_directory: string): string {
 	const migrated = tsconfig_preset_migration.migrate_preset_paths(content, base_directory)
 	if (kit_base_preset.is_tsconfig_base_present(read_extends_entries(migrated))) return migrated
@@ -68,7 +67,7 @@ const COMPILER_OPTIONS_FIELD = 'compilerOptions'
 
 // Prune the redundant options one at a time, in place. Setting `compilerOptions` to the kept subset
 // would be one edit instead of several, but it replaces the whole block and takes any comment the
-// consumer wrote inside it along with the options being dropped (joshuafolkken/kit#798). Each
+// consumer wrote inside it along with the options being dropped. Each
 // removal re-reads the document, so the shifting offsets take care of themselves.
 function drop_redundant_options(content: string, redundant: ReadonlyArray<string>): string {
 	let current = content
@@ -146,7 +145,6 @@ function missing_entries<T>(
 // `import` and tsconfig `extends` lists. Arrays and scalars stay untouched: combining a list such as
 // `eslint.validate` would be a guess about intent, and overwriting it would drop the consumer's own
 // entries. Without this, one customized key froze out every later kit addition inside it, silently.
-// See joshuafolkken/kit#691.
 function merge_owned_entries(current: unknown, update: unknown): unknown {
 	const current_object = json_object_schema.safeParse(current)
 	const update_object = json_object_schema.safeParse(update)
@@ -218,7 +216,7 @@ function merge_package_scripts(content: string, scripts: Record<string, string>)
 }
 
 // Replace only a safe-chain `preinstall` an earlier kit wrote, for a consumer that never re-runs
-// `josh init`; every other key and script is kept (joshuafolkken/kit#3269).
+// `josh init`; every other key and script is kept.
 function upgrade_safe_chain_preinstall(content: string): string {
 	const parsed = parse_jsonc(content)
 	const raw = parsed['scripts']

package/scripts/init/init-logic-migrate.ts

@@ -75,7 +75,7 @@ function is_kit_written(key: string, value: string): boolean {
 }
 
 // A retired name alone does not make a script kit's: `sv create` writes its own `check`, which must
-// survive `josh init` (joshuafolkken/kit#3069). Only a value kit itself wrote is retired.
+// survive `josh init`. Only a value kit itself wrote is retired.
 function is_retired_script(key: string, value: string): boolean {
 	return RETIRED_MANAGED_SCRIPTS.has(key) && is_kit_written(key, value)
 }

package/scripts/init/init-logic-templates.ts

@@ -113,7 +113,7 @@ function merge_eslint_config(existing: string): string {
 }
 
 // The default is SvelteKit's stylesheet, and prettier-plugin-tailwindcss aborts every format when
-// the named file is missing — so it is written only for a project that has it (joshuafolkken/kit#2710).
+// the named file is missing — so it is written only for a project that has it.
 function detect_tailwind_stylesheet(project_root: string): string | undefined {
 	return existsSync(path.join(project_root, DEFAULT_TAILWIND_STYLESHEET))
 		? DEFAULT_TAILWIND_STYLESHEET

package/scripts/init/init-logic-workspace.ts

@@ -45,7 +45,7 @@ function remove_deprecated_yaml_keys(content: string): string {
 // pnpm 11+ writes this placeholder into `allowBuilds` for every build script it ignored, and fails
 // every later install until it is answered. `pnpm add -D @joshuafolkken/kit` before `josh init`
 // leaves one for esbuild, and the key-level merge below keeps an existing `allowBuilds` whole, so a
-// placeholder the template decides is answered here (joshuafolkken/kit#2693).
+// placeholder the template decides is answered here.
 const BUILD_PLACEHOLDER_PATTERN = /^([ \t]+)([^\s:#][^:#]*): set this to true or false$/gmu
 const TEMPLATE_BUILD_PATTERN = /^[ \t]+(?<key>[^\s:#][^:#]*):[ \t]*(?<value>true|false)\b/u
 
@@ -89,8 +89,8 @@ function build_entry_keys(block: string): Set<string> {
 
 // The key-level merge keeps an existing `allowBuilds` whole, and `pnpm add -D @joshuafolkken/kit`
 // before `josh init` always leaves one (esbuild's), so without this the template's other approvals
-// never landed and the first `pnpm install` failed on the next build script, e.g. unrs-resolver's
-// (joshuafolkken/kit#2710). Entries the project already answered keep their value.
+// never landed and the first `pnpm install` failed on the next build script, e.g. unrs-resolver's.
+// Entries the project already answered keep their value.
 // Only a block mapping can take appended entry lines; a flow map (`allowBuilds: { … }`) is left whole.
 const BLOCK_MAPPING_HEADER_PATTERN = /^allowBuilds:[ \t]*(?:#[^\n]*)?(?:\n|$)/u
 const LEADING_INDENT_PATTERN = /^[ \t]+/u
@@ -133,7 +133,7 @@ interface MovedNpmrcSetting {
 
 // `.npmrc` settings pnpm 12 reads only from `pnpm-workspace.yaml`, with the value shape each takes.
 // A project's own value (a longer age window, `engine-strict=false`) replaces the template's, so the
-// move neither loosens nor tightens what the project chose (joshuafolkken/kit#3267).
+// move neither loosens nor tightens what the project chose.
 const MOVED_NPMRC_SETTINGS: ReadonlyArray<MovedNpmrcSetting> = [
 	{ npmrc_key: 'minimum-release-age', workspace_key: 'minimumReleaseAge', value_pattern: /^\d+$/u },
 	{ npmrc_key: 'engine-strict', workspace_key: 'engineStrict', value_pattern: /^(?:true|false)$/u },

package/scripts/init/init-logic-yaml-merge.ts

@@ -23,7 +23,7 @@ function merge_yaml_list_entry(content: string, key: string, value: string): str
 // lefthook preset (kit's own, or an app-kit / game-kit framework preset that already extends kit
 // base) is present. Adding kit's `vanilla.yml` alongside such a preset would extend
 // `lefthook/base.yml` twice, which lefthook rejects with a hard "possible recursion in extends"
-// crash. See joshuafolkken/kit#660.
+// crash.
 function merge_lefthook_extends(content: string, value: string): string {
 	const entries = config_merge.read_yaml_list_field(content, LEFTHOOK_EXTENDS_FIELD)
 	if (kit_base_preset.is_lefthook_base_present(entries)) return content
@@ -35,7 +35,7 @@ function merge_lefthook_extends(content: string, value: string): string {
 // preset (kit's own base, or an app-kit / game-kit framework preset that already imports kit's
 // cspell base) is present. Adding kit's base alongside such a preset is a redundant double import.
 // kit owns this dedup because there is no downstream overlay in kit's `josh sync` path — every
-// consumer drives the sync through kit's CLI, so the check must live here. See joshuafolkken/kit#660.
+// consumer drives the sync through kit's CLI, so the check must live here.
 function merge_cspell_import(content: string, value: string): string {
 	const entries = config_merge.read_yaml_list_field(content, CSPELL_IMPORT_FIELD)
 	if (kit_base_preset.is_cspell_base_present(entries)) return content

package/scripts/init/init-logic.ts

@@ -11,12 +11,12 @@ import { init_logic_workspace } from './init-logic-workspace'
 import { init_logic_yaml_merge } from './init-logic-yaml-merge'
 
 const DEV_ENGINES_VALUE = {
-	packageManager: { name: 'pnpm', version: '>=12.1.0', onFail: 'error' },
+	packageManager: { name: 'pnpm', version: '>=12.1.0', onFail: 'download' },
 }
 
 // The settings lines earlier kit releases wrote into a project `.npmrc`. pnpm 12 reads only registry
 // and auth settings from `.npmrc`, so all four are inert there: the age window and engine check now
-// live in `pnpm-workspace.yaml`, and `confirmModulesPurge` no longer exists (joshuafolkken/kit#3267).
+// live in `pnpm-workspace.yaml`, and `confirmModulesPurge` no longer exists.
 const LEGACY_NPMRC_LINES: ReadonlySet<string> = new Set([
 	'engine-strict=true',
 	'minimum-release-age=1440',
@@ -43,7 +43,7 @@ const LEGACY_POSTINSTALL_KEY = 'postinstall'
 // both, so an install that left **zero** hooks in place still exited 0 and said nothing. The way it
 // happens in practice is `core.hooksPath` — lefthook refuses to install while any custom hooks path is
 // set — and the developer then commits and pushes for weeks with no pre-commit or pre-push check
-// running at all, believing they are (joshuafolkken/kit#1503).
+// running at all, believing they are.
 //
 // **The `|| true` stays**: a consumer's `pnpm install` must not die over a developer-only hook, which
 // is what it was added for. What changes is that the failure is named on standard error. The warning
@@ -72,7 +72,7 @@ const PREPARE_CMD = `(${GUARDED_LEFTHOOK_CMD} || true) && (${GUARDED_FIX_GH_PACK
 
 // CLAUDE.md is deliberately absent: it is no longer byte-copied. A consumer's CLAUDE.md is a single
 // @import of kit's published, path-transformed rules (ensure_claude_md_import), so a package update
-// alone keeps it current (joshuafolkken/kit#1878). AGENTS.md / GEMINI.md / .cursorrules stay copies
+// alone keeps it current. AGENTS.md / GEMINI.md / .cursorrules stay copies
 // here — they are for other tools that do not read CLAUDE.md's import.
 const AI_COPY_FILES: ReadonlyArray<string> = [
 	'AGENTS.md',
@@ -92,11 +92,10 @@ const AI_COPY_FILES: ReadonlyArray<string> = [
 	'.github/workflows/sonar-qube.yml',
 	'.github/workflows/pr-classification.yml',
 	// Called by `ci.yml` and `pr-classification.yml` as `uses: ./.github/actions/setup-pnpm`; without
-	// it the consumer's jobs cannot resolve the action and their checks fail (joshuafolkken/kit#3013,
-	// joshuafolkken/kit#3095).
+	// it the consumer's jobs cannot resolve the action and their checks fail.
 	'.github/actions/setup-pnpm/action.yml',
 	// The one place the workflows' Node.js version is written, called by every distributed workflow
-	// that sets Node.js up (joshuafolkken/kit#3084).
+	// that sets Node.js up.
 	'.github/actions/setup-node/action.yml',
 	'.github/pull_request_template.md',
 	'.github/release.yml',
@@ -119,19 +118,18 @@ const AI_COPY_FILE_MAPPINGS: ReadonlyArray<FileCopyMapping> = [
 	{ src: 'templates/workflows/ci.yml', dest: '.github/workflows/ci.yml' },
 	// The counterpart to the distributed `.github/dependabot.yml`: without it a consumer receives
 	// the machinery that opens Dependabot pull requests and none of the machinery that closes them,
-	// so every github-actions bump sits green and unmerged (joshuafolkken/kit#834).
+	// so every github-actions bump sits green and unmerged.
 	{
 		src: 'templates/workflows/dependabot-auto-merge.yml',
 		dest: '.github/workflows/dependabot-auto-merge.yml',
 	},
 	// A template rather than a copy of kit's own file: kit releases from its publish.yml, so the file
-	// must not run in kit as well (joshuafolkken/kit#3007).
+	// must not run in kit as well.
 	{ src: 'templates/workflows/github-release.yml', dest: '.github/workflows/github-release.yml' },
 ]
 
-// Empty since joshuafolkken/kit#1879: the five skill directories kit used to copy whole
-// (`workflow-commands`, `epic-commands`, `dependency-update`, `verify-ui`, `diag`) now ship as the
-// `kit` Claude Code plugin and load from the package, so nothing is copied into a consumer's tree.
+// Empty: kit's skill directories ship as the `kit` Claude Code plugin and load from the package, so
+// nothing is copied into a consumer's tree.
 // The copy-and-transform machinery (directory-copy-guard.ts → transform_copied_tree) is kept intact
 // for any future distributed directory; the migration that removes a consumer's stale skill copies
 // lives in `scripts/sync/skill-migration.ts`.
@@ -143,7 +141,7 @@ const LEFTHOOK_EXTENDS = 'node_modules/@joshuafolkken/kit/lefthook/vanilla.yml'
 // `extends` entry that does not already end in it, then hard-throws when the resulting path is
 // missing — so a `.jsonc` preset resolves to `*.jsonc.json` and takes down the whole E2E suite
 // before a single test runs. A tsconfig is parsed as JSONC regardless of extension, so comments in
-// the preset still work. See joshuafolkken/kit#681.
+// the preset still work.
 const TSCONFIG_EXTENDS = './node_modules/@joshuafolkken/kit/tsconfig/base.json'
 
 // Preset file basename within the package's tsconfig/ directory, used to read the base
@@ -159,7 +157,7 @@ const TSCONFIG_EXCLUDE_FIELD = 'exclude'
 // config for. The two directories must stay disjoint (Playwright refuses an html output folder nested
 // in the tests output folder, and vice versa), so both are excluded rather than consolidated. These
 // belong in the CONSUMER file: a consumer `exclude` overrides the extended preset's instead of merging
-// with it, so shipping them only in a preset would have no effect. See joshuafolkken/kit#712.
+// with it, so shipping them only in a preset would have no effect.
 const TSCONFIG_GENERATED_OUTPUT_EXCLUDE: ReadonlyArray<string> = [
 	'node_modules',
 	'build',
@@ -186,10 +184,10 @@ const TSCONFIG_GENERATED_OUTPUT_EXCLUDE: ReadonlyArray<string> = [
 // `node_modules` above already covers it.
 //
 // Limit: these are the DEFAULT paths. A project that moves the worker with `kit.files.serviceWorker`
-// in `svelte.config.js` gets globs that match nothing, and its real exclusion is still replaced — the
-// #796 failure, unfixed for that shape. Covering it means reading `svelte.config.js`, which is the
-// same project detection kit does not have; such a project should add its own path to `exclude`
-// (the merge appends, so a hand-added entry survives). See joshuafolkken/kit#796.
+// in `svelte.config.js` gets globs that match nothing, and its real exclusion is still replaced.
+// Covering it means reading `svelte.config.js`, which is the same project detection kit does not
+// have; such a project should add its own path to `exclude` (the merge appends, so a hand-added entry
+// survives).
 const TSCONFIG_SVELTEKIT_EXCLUDE: ReadonlyArray<string> = [
 	'src/service-worker.js',
 	'src/service-worker/**/*.js',
@@ -226,7 +224,7 @@ const SUGGESTED_SCRIPTS_COMMON: Record<string, string> = {
 // they fit within printWidth, one element per line once they do not — so the file kit writes is
 // `prettier --check`-clean in the consumer whatever the entry count happens to be (#660).
 // TypeScript 6 defaults `types` to `[]`, so a full project sees no `process` global — not even in the
-// generated `playwright.config.ts` — until the Node types are named (joshuafolkken/kit#2710).
+// generated `playwright.config.ts` — until the Node types are named.
 function generate_tsconfig(): string {
 	return json_format.format_json({
 		extends: TSCONFIG_EXTENDS,
@@ -378,9 +376,8 @@ function get_suggested_scripts_for_content(content: string): Record<string, stri
 
 // **The upgrade path for projects `josh init` has already run in.** Their `prepare` carries the
 // fix-gh-packages marker, and that marker is exactly what makes both merges here return early — so
-// the population joshuafolkken/kit#1503 is actually about, the consumers already installing with zero
-// hooks and no warning, would never receive the fix however often they re-ran `josh init`; only new
-// projects would. This rewrites the lefthook clause kit itself wrote and nothing else, because the
+// the consumers already installing with zero hooks and no warning would never receive the fix
+// however often they re-ran `josh init`; only new projects would. This rewrites the lefthook clause kit itself wrote and nothing else, because the
 // rest of that script is the consumer's. It is idempotent by construction: the new clause does not
 // contain the old one as a substring, since `{ ` sits between them.
 function upgrade_prepare_lefthook_warning(content: string): string {

package/scripts/init/init.ts

@@ -25,6 +25,7 @@ import { init_logic } from './init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from './init-paths'
 import { kit_development_versions } from './kit-development-versions'
 import { kit_setup_state } from './kit-setup-state'
+import { package_manager_pin } from './package-manager-pin'
 import { project_profile, type ProjectProfile, type ProjectShape } from './project-profile'
 
 const PACKAGE_JSON = 'package.json'
@@ -52,7 +53,10 @@ function resolve_kit_package_manager(manifest: unknown): string | undefined {
 }
 
 function get_kit_package_manager(): string | undefined {
-	return resolve_kit_package_manager(init_actions.read_package_json(PACKAGE_JSON))
+	return package_manager_pin.choose(
+		resolve_kit_package_manager(init_actions.read_package_json(PACKAGE_JSON)),
+		process.env['npm_config_user_agent'],
+	)
 }
 
 function get_kit_development_engines(): Record<string, unknown> {
@@ -70,7 +74,7 @@ function get_kit_self_dependency(): Record<string, string> {
 // Each config `init` generates runs a CLI or imports types the consumer has to resolve itself:
 // `cspell.config.yaml` → cspell, `playwright.config.ts` → @types/node, `lefthook.yml` → lefthook.
 // Prettier, its preset plugins and @playwright/test come in as peers. Without them the first
-// `josh gate` after `pnpm install` fails (joshuafolkken/kit#2710).
+// `josh gate` after `pnpm install` fails.
 const TOOL_DEVELOPMENT_DEPENDENCIES = ['cspell', '@types/node']
 const LEFTHOOK_DEVELOPMENT_DEPENDENCY = 'lefthook'
 
@@ -199,7 +203,7 @@ function run_config_file_actions(shape: ProjectShape): void {
 }
 
 // Gated, unlike `sync`: `init` skips a file the consumer already has, so neither the npm-disable
-// (joshuafolkken/kit#803) nor the auto-merge workflow (joshuafolkken/kit#834) may have landed, and a
+// nor the auto-merge workflow may have landed, and a
 // report's claim would then be false. `sync` overwrites both unconditionally, which is why it needs
 // no gate. The gates are the artifacts themselves, so a consumer's own pre-existing auto-merge
 // workflow still gets its prerequisite reported — it needs the same repository setting kit's does.
@@ -215,8 +219,8 @@ function report_repository_settings(name_with_owner: string | undefined): void {
 
 // The same refusal `sync` makes, for a larger blast radius: `init` calls the `sync` writers directly
 // rather than through `sync`'s own `main()`, so the guard there never ran for it — and on top of the
-// 14 files #868 reproduced, `init` also rewrites `package.json` scripts and devDependencies
-// (joshuafolkken/kit#879). Checked before the first write, for the reason the sync guard is.
+// 14 files #868 reproduced, `init` also rewrites `package.json` scripts and devDependencies.
+// Checked before the first write, for the reason the sync guard is.
 function run_ai_file_actions(shape: ProjectShape): void {
 	console.info('\nAI files:')
 	// `init` writes the same npm-disabling `.github/dependabot.yml` that `sync` distributes, so a
@@ -242,7 +246,7 @@ function initialize_project(shape: ProjectShape): void {
 }
 
 // A tool `init` just listed is absent until the user installs it — and `josh lint` then fails on it
-// rather than skipping it (joshuafolkken/kit#2709). Saying so is what tells the user the next step.
+// rather than skipping it. Saying so is what tells the user the next step.
 function report_manual_install(shape: ProjectShape): void {
 	console.info(`\nDependencies:\n  ${INSTALL_HINT}`)
 	if (shape.has_git && shape.profile === 'full') install_lefthook()
@@ -262,7 +266,7 @@ function finish_dependencies(shape: ProjectShape, is_install: boolean): void {
 }
 
 // A kit run from outside the project — `pnpm dlx`, a global install — sets nothing up itself: it
-// installs the project's kit and hands the whole run to that one (joshuafolkken/kit#2794). Under
+// installs the project's kit and hands the whole run to that one. Under
 // `--no-install` nothing is installed, so the running kit does the setup as before.
 function did_hand_off(args: ReadonlyArray<string>): boolean {
 	if (init_bootstrap.is_project_kit(PACKAGE_DIR, PROJECT_ROOT)) return false
@@ -296,7 +300,7 @@ function main(args: ReadonlyArray<string> = []): boolean {
 }
 
 // Only the command a person typed points onward to `josh start`: `josh start` calls `main` itself and
-// is already the next step (joshuafolkken/kit#2816).
+// is already the next step.
 // A setup that failed after writing, such as a failed install, sets the exit code and points nowhere.
 function print_start_hint(): void {
 	if (process.exitCode !== undefined && process.exitCode !== 0) return

package/scripts/init/kit-base-preset.ts

@@ -25,7 +25,7 @@ const KIT_TSCONFIG_PRESET = /@joshuafolkken\/[^/]+\/tsconfig\//u
 // this segment-anchored fallback covers the prefix-less relative form. The `(?<![\w-])` /
 // `(?![\w-])` boundaries anchor `sveltekit` to a complete path segment — mirroring app-kit's
 // config-patch anchoring — so a `sveltekit-*` / `*-sveltekit` sibling and hyphenated `svelte-kit`
-// are left untouched. See joshuafolkken/kit#664.
+// are left untouched.
 const SVELTEKIT_PRESET = /(?<![\w-])sveltekit(?![\w-])/u
 
 function has_match(entries: ReadonlyArray<string>, pattern: RegExp): boolean {

package/scripts/init/kit-setup-state.ts

@@ -5,7 +5,7 @@ const START_HINT =
 	'To use the GitHub Issue workflow, run pnpm exec josh start next: it puts this setup on GitHub, through a pull request when main already has commits.'
 
 // Whether the commit checked out records kit in its manifest — the sign that kit's setup has already
-// reached the branch, so `josh start` has no setup pull request to open (joshuafolkken/kit#2816).
+// reached the branch, so `josh start` has no setup pull request to open.
 function is_kit_committed(root: string): boolean {
 	// `./` resolves the path from `root` rather than from the repository's top level.
 	const manifest = start_exec.git_read(['show', 'HEAD:./package.json'], root)

package/scripts/init/kit-written-paths.ts

@@ -20,8 +20,7 @@ const SETUP_ONLY_PATHS: ReadonlySet<string> = new Set([
 ])
 
 // Whether a changed path is one kit's setup wrote — what the setup pull request of `josh start`
-// carries, so a file the user keeps beside it (notes, an editor's own directory) never rides along
-// (joshuafolkken/kit#2816).
+// carries, so a file the user keeps beside it (notes, an editor's own directory) never rides along.
 function is_kit_written(file_path: string): boolean {
 	return SETUP_ONLY_PATHS.has(file_path) || managed_config_scope.has_managed_path([file_path])
 }

package/scripts/init/package-manager-pin.ts

@@ -0,0 +1,35 @@
+import { package_manager_version } from '#scripts/version/package-manager-version'
+import semver from 'semver'
+
+// pnpm sets `npm_config_user_agent` to `pnpm/<version> npm/? node/<version> <platform> <arch>` for
+// every script and `pnpm exec` it runs, so the pnpm that invoked `josh init` is readable from it.
+const PNPM_USER_AGENT_REGEX = /^pnpm\/(\S+)/u
+
+function running_pnpm_version(user_agent = ''): string | undefined {
+	const version = PNPM_USER_AGENT_REGEX.exec(user_agent)?.[1]
+
+	return version === undefined ? undefined : (semver.valid(version) ?? undefined)
+}
+
+function is_older_than(kit_pin: string, version: string): boolean {
+	const kit_version = semver.valid(package_manager_version.extract_pnpm_pin(kit_pin) ?? '')
+
+	return kit_version !== null && semver.lt(kit_version, version)
+}
+
+// Never pin a project below the pnpm installing it: the lockfile that pnpm just wrote can name a
+// version an older pnpm fails to resolve, so `pnpm install` under kit's older pin breaks the
+// first `josh init`. The kit pin keeps its integrity suffix when it wins.
+function choose(kit_pin: string | undefined, user_agent: string | undefined): string | undefined {
+	const running = running_pnpm_version(user_agent)
+	if (kit_pin === undefined || running === undefined) return kit_pin
+
+	return is_older_than(kit_pin, running) ? `pnpm@${running}` : kit_pin
+}
+
+const package_manager_pin = {
+	running_pnpm_version,
+	choose,
+}
+
+export { package_manager_pin }

package/scripts/init/project-profile-cli.ts

@@ -3,7 +3,7 @@ import { fileURLToPath } from 'node:url'
 import { project_profile } from './project-profile'
 
 const ARGUMENT_START_INDEX = 2
-// A `ci.yml` synced before joshuafolkken/kit#2829 matches `*'profile: static ('*` on this output to
+// A `ci.yml` synced before the profile rename matches `*'profile: static ('*` on this output to
 // hand a basic project to `josh gate`. A consumer can upgrade kit without re-syncing that workflow,
 // so a basic project keeps printing the old phrase on a line of its own until every workflow reads
 // the new name.

package/scripts/init/project-profile.ts

@@ -23,7 +23,7 @@ const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', '.
 const WEB_EXTENSIONS = new Set(['.html', '.css', '.js', '.jsx', '.mjs', '.cjs'])
 const TYPESCRIPT_EXTENSIONS = new Set(['.ts', '.tsx'])
 const PROFILE_ARG_LENGTH = 2
-// The names before joshuafolkken/kit#2829. A project that recorded one, or a script that passes one
+// The names before the profile rename. A project that recorded one, or a script that passes one
 // to `--profile`, keeps working: each reads as the profile it was renamed to.
 const PROFILE_NAMES: Readonly<Record<string, ProjectProfile>> = {
 	basic: 'basic',
@@ -39,7 +39,7 @@ function parse_profile(value: unknown): ProjectProfile | undefined {
 }
 
 // The pre-rename name of each profile, which every kit with `--profile` accepts — the new one only
-// from joshuafolkken/kit#2829 on.
+// from the rename on.
 const LEGACY_NAMES: Readonly<Record<ProjectProfile, string>> = { basic: 'static', full: 'node' }
 
 // A `josh init` handed to the project's kit may run an older kit than the one handing off: the
@@ -91,7 +91,7 @@ function has_build_script(value: unknown): boolean {
 
 // kit itself is not evidence of a Node toolchain: `pnpm add -D @joshuafolkken/kit` before
 // `josh init` is the documented order, and it must still leave an `index.html` site on the basic
-// profile (joshuafolkken/kit#2693).
+// profile.
 function has_project_dependencies(value: unknown): boolean {
 	if (!json_value.is_record(value)) return false
 

package/scripts/init/session-language-environment.ts

@@ -1,5 +1,5 @@
 // `josh init` seeds `JOSH_SESSION_LANG` in `.env` from the OS locale, so a newly adopting user starts
-// in their own language (joshuafolkken/kit#2818). A project already using kit keeps its language: the
+// in their own language. A project already using kit keeps its language: the
 // session language takes effect only through the `session:lang` hook, so a project whose
 // `.claude/settings.json` already wires it is left alone, and an existing `.env` value — the `export`
 // form included — is never touched. The unset default stays `ja`.

package/scripts/init/start-exec.ts

@@ -9,10 +9,9 @@ import type { Visibility } from './start-plan'
 // step and the `josh init` hint so none of them keeps a copy of its own.
 //
 // The git shapes below act on `root`, so `cwd` has to mean it: an inherited `GIT_DIR` and friends beat `cwd`
-// and would carry a `git init` or commit into whichever repository a calling hook was firing in
-// (joshuafolkken/kit#3151).
+// and would carry a `git init` or commit into whichever repository a calling hook was firing in.
 //
-// **Every git and gh call here is bounded** (joshuafolkken/kit#3262). A read asks the local
+// **Every git and gh call here is bounded**. A read asks the local
 // repository and takes git's own budget. A write — and `gh repo create --push` — can fire the
 // project's own commit and push hooks, which may run its whole suite, so it takes the suite budget:
 // long enough for that, short enough that a push that never answers ends the run.
@@ -42,7 +41,7 @@ function git_run(args: ReadonlyArray<string>, root: string): void {
 }
 
 // Every gh spawn here dials GitHub directly, past a scanner's loopback proxy, the same as every
-// other `gh` spawn under scripts/ (joshuafolkken/kit#2436). Each argument list is written inline so
+// other `gh` spawn under scripts/. Each argument list is written inline so
 // `gh-subcommand-guard.ts` reads its subcommand rather than `<dynamic>`.
 interface GhProbeOptions {
 	cwd: string