@joshuafolkken/kit 1.1240.0 → 1.1370.0

package/scripts/security/security-audit.ts

@@ -29,7 +29,7 @@ function scanner_version(binary_or_path: string): string | undefined {
 
 // Whether the binary at this name or path parses the whole lockfile, i.e. is at or above the pinned
 // floor. A version that cannot be read is not the floor met — an unspawnable or version-less binary
-// is treated as below it, never as a pass (joshuafolkken/kit#2200).
+// is treated as below it, never as a pass.
 function meets_floor(binary_or_path: string): boolean {
 	const version = scanner_version(binary_or_path)
 
@@ -68,9 +68,9 @@ function managed_scanner(project_root: string, platform: string): string | undef
 }
 
 // PATH first, but only when its scanner meets the floor: an older PATH build reads a fraction of the
-// lockfile and calls it clean (joshuafolkken/kit#2200), so a provisioned v2.6.0 is preferred over it
-// rather than the other way round (the preference of joshuafolkken/kit#1563 held only while every
-// build read the whole file). A below-floor PATH binary is the last resort, returned flagged so the
+// lockfile and calls it clean, so a provisioned v2.6.0 is preferred over it
+// rather than the other way round (preferring PATH outright holds only while every
+// build reads the whole file). A below-floor PATH binary is the last resort, returned flagged so the
 // audit can warn that its clean result proves nothing. `undefined` means no scanner at all.
 function resolve_scanner(project_root: string, platform: string): ScannerChoice | undefined {
 	const { BINARY_NAME } = security_audit_logic
@@ -92,7 +92,7 @@ function resolve_scanner(project_root: string, platform: string): ScannerChoice
 // next shell prompt as `11;rgb:0101/0404/0909;1R` after a push ran this audit from the pre-push hook.
 // A pipe means the scanner sees no terminal and asks nothing; the `inherit` half still prints its report.
 // The fix belongs here, at the one command that asks, rather than on `git push`: piping the push would
-// make its timeout wait on any process a hook left running (joshuafolkken/kit#2801).
+// make its timeout wait on any process a hook left running.
 const FORWARDED_OUTPUT = ['inherit', 'pipe'] as const
 
 function run_scanner(scanner_path: string): number {

package/scripts/security/security-updates-logic.ts

@@ -3,12 +3,11 @@ import { repo_setting, type RepoSettingStatus } from '#scripts/repo/repo-setting
 // GitHub's Dependabot security-updates setting, as reported by
 // `GET /repos/{owner}/{repo}/automated-security-fixes`.
 //
-// joshuafolkken/kit#803 set `open-pull-requests-limit: 0` on the npm entry of the distributed
+// `open-pull-requests-limit: 0` is set on the npm entry of the distributed
 // `.github/dependabot.yml`, which makes the security-advisory path the only remaining source of npm
 // Dependabot PRs. That path depends on this repository-level setting, which is opt-in and off by
 // default for private repositories — so a consumer that syncs the file without it gets zero npm
-// Dependabot PRs, advisories included. The failure is silent: no PR looks exactly like no advisory
-// (joshuafolkken/kit#805).
+// Dependabot PRs, advisories included. The failure is silent: no PR looks exactly like no advisory.
 //
 // `paused` is this setting's own third state, which is why the shared two-state classifier is only
 // half the answer here (see classify_security_updates).

package/scripts/security/security-updates.ts

@@ -4,8 +4,7 @@ import { security_updates_logic, type SecurityUpdatesStatus } from './security-u
 const SECURITY_FIXES_PATH = 'automated-security-fixes'
 
 // Read the repository's Dependabot security-updates setting. Never throws and never propagates a
-// non-zero exit: an unreadable answer is a reported status, not a command failure
-// (joshuafolkken/kit#805).
+// non-zero exit: an unreadable answer is a reported status, not a command failure.
 function read_security_updates(repo: string): SecurityUpdatesStatus {
 	const { exit_code, stdout } = repo_setting.query_repo_api(`repos/${repo}/${SECURITY_FIXES_PATH}`)
 
@@ -14,8 +13,7 @@ function read_security_updates(repo: string): SecurityUpdatesStatus {
 
 // Report the repository's setting as a blank-line-separated block. A repository that cannot be
 // resolved (no `gh`, not a GitHub remote) reports `unreadable` rather than skipping the check
-// silently — the whole point of joshuafolkken/kit#805 is that an absent answer must not look like a
-// clean one.
+// silently — an absent answer must not look like a clean one.
 //
 // `repo` is always supplied by the caller — deliberately not a default parameter. A default fires
 // on an explicitly-passed `undefined`, so `josh sync` handing over a failed lookup would silently

package/scripts/self-sync-guard/index.ts

@@ -1,5 +1,5 @@
 // The public surface a downstream distribution package imports to refuse a sync aimed at its own
 // repository. Exported rather than left internal because app-kit and game-kit run the same kind of
-// copy and would otherwise each re-implement the detection (joshuafolkken/kit#868), which is the
+// copy and would otherwise each re-implement the detection, which is the
 // duplication `managed-marker` was extracted to avoid for the workflow stamp.
 export { self_sync_guard } from './self-sync-guard-logic'

package/scripts/self-sync-guard/self-sync-guard-logic.ts

@@ -6,8 +6,8 @@ import path from 'node:path'
 // truth is overwritten by the derived template, and the copy transforms fire against a project
 // where they are wrong (a `prompts/…` reference rewritten to `node_modules/@joshuafolkken/kit/…`
 // resolves nowhere, a workflow written from `templates/` loses the pins `.github/workflows` owns).
-// joshuafolkken/game-kit#447 is the incident; joshuafolkken/kit#868 reproduced the same damage in
-// kit — 14 files, including CLAUDE.md, tsconfig.json and both mapped workflows.
+// In kit the same damage reaches 14 files, including CLAUDE.md, tsconfig.json and both mapped
+// workflows.
 //
 // The check lives here rather than in each package's sync so the three distributors share one
 // implementation: a second copy would drift, and a distributor that spelled the signal differently

package/scripts/self-sync-guard/self-sync-refusal.ts

@@ -3,7 +3,7 @@ import { self_sync_guard } from './self-sync-guard-logic'
 // The half of the guard that `sync` and `init` share verbatim: print the refusal and leave a
 // non-zero exit code. It lives beside the detection rather than in either entry point because the
 // two commands do the same damage in the source repository — `init` a larger share of it, since it
-// rewrites `package.json` scripts and devDependencies as well (joshuafolkken/kit#879) — and a copy
+// rewrites `package.json` scripts and devDependencies as well — and a copy
 // in each `main()` would be the second implementation the shared module exists to prevent.
 //
 // Not re-exported from `index.ts`: the published `@joshuafolkken/kit/self-sync-guard` surface stays

package/scripts/sonar/sonar-hotspots-cli.ts

@@ -11,7 +11,7 @@ import {
 import { sonar_project } from './sonar-project'
 
 // `josh sonar:hotspots <PR>` — fetch the SonarCloud hotspots on a pull request and print the Step B
-// disposition of each (joshuafolkken/kit#2182).
+// disposition of each.
 //
 // The decision itself lives in `sonar-hotspots.ts`; this file is the I/O around it: read the project
 // key from `sonar-project.properties`, fetch the public search API, and answer the upstream-synced

package/scripts/sonar/sonar-hotspots.ts

@@ -1,5 +1,5 @@
 // The Step B disposition for each SonarCloud hotspot on a pull request, computed rather than read by
-// eye (joshuafolkken/kit#2182).
+// eye.
 //
 // `prompts/sonar-hotspot-handling.md` carried Step A and Step B as prose: the reader built the API
 // URL by hand and then walked a decision table whose one mechanical branch key — "is this path

package/scripts/sonar/sonar-new-code-cli.ts

@@ -13,7 +13,7 @@ import {
 import { sonar_project } from './sonar-project'
 
 // `josh sonar:new-code <PR>` — fail when a pull request adds any new SonarCloud issue or duplicated
-// block (joshuafolkken/kit#3045).
+// block.
 //
 // `sonar-qube.yml` runs it after the scan on every pull request, so the `SonarQube` check turns red on
 // a single finding instead of only when the Quality Gate's ratios tip over. The verdict lives in

package/scripts/sonar/sonar-new-code.ts

@@ -1,5 +1,5 @@
 // Whether a pull request adds any new SonarCloud finding — computed from the counts rather than from
-// the Quality Gate (joshuafolkken/kit#3045).
+// the Quality Gate.
 //
 // The built-in `Sonar way` gate judges a ratio and a rating, not a count: a few MINOR code smells keep
 // the maintainability rating at A, and a copied block in a large pull request stays under the 3%

package/scripts/sonar/sonar-project.ts

@@ -6,7 +6,7 @@ import { timed_fetch } from '#scripts/lib/timed-fetch'
 import type { z } from 'zod'
 
 // The SonarCloud project a `josh sonar:*` command reads, shared by every command that calls the
-// SonarCloud API (joshuafolkken/kit#3045): the host, the project key `sonar-project.properties`
+// SonarCloud API: the host, the project key `sonar-project.properties`
 // records — the file `josh init` / `josh sync` generate from the GitHub repository name — and the
 // `<PR>` positional each command takes.
 

package/scripts/split/split-assess-cli.ts

@@ -5,7 +5,7 @@ import { path_decision } from '#scripts/josh/path-decision'
 import { split_assess } from './split-assess'
 
 // `josh split:assess` — measure a branch's change size, tests excluded, and answer the size question
-// of the split assessment (joshuafolkken/kit#2218).
+// of the split assessment.
 //
 // A command rather than a paragraph for the reason every decision oracle is one: the "about 10 files /
 // 400 lines" guide is a number, but the size behind it was estimated by eye, so no data ever

package/scripts/split/split-assess.ts

@@ -1,6 +1,6 @@
 import { test_declared_logic } from '#scripts/test/test-declared-logic'
 
-// The size half of the split assessment, measured rather than estimated (joshuafolkken/kit#2218).
+// The size half of the split assessment, measured rather than estimated.
 //
 // `split-assessment.md` → "The question" asks two things, and only the second is mechanical: does the
 // change **clearly exceed** what one verification gate confirms in one pass, the guide being about 10
@@ -27,8 +27,8 @@ interface SizeMeasurement {
 	verdict: SplitVerdict
 }
 
-// The guide's single source: `split-assessment.md` states these once and a test pins the two equal
-// (joshuafolkken/kit#2996). Strictly greater than: "about 10 changed files" and a change
+// The guide's single source: `split-assessment.md` states these once and a test pins the two equal.
+// Strictly greater than: "about 10 changed files" and a change
 // that "lands at 11 files is not thereby a split" put the bar above the round number, not at it.
 const FILE_GUIDE = 10
 const LINE_GUIDE = 400

package/scripts/sync/directory-copy-guard.ts

@@ -7,7 +7,7 @@ import { file_content } from './file-content'
 // `josh init` and `josh sync` both copy a distributed directory with `cpSync`, and both have to
 // answer the same question first: is this copy one that `cpSync` will refuse? The answer lives here
 // rather than in each command, because the failure modes are the same and a second copy of the list
-// would drift (joshuafolkken/kit#853, which made the directory list non-empty for the first time).
+// would drift.
 //
 // Every check goes through `lstat`, never `existsSync` or `stat`:
 //   - `stat` follows a symlink, so a link pointing at a directory would read as a directory while
@@ -49,8 +49,7 @@ function directory_copy_blocker(source_path: string, destination_path: string):
 // `cpSync` copies bytes, so a distributed directory would otherwise carry the package's own
 // `prompts/…` references into a consumer, where that directory does not exist — the very rewrite
 // every file copy already runs through `transform_copied_content`. Running it over the copied tree
-// puts both copy paths on one transform, which is what lets a skill cite the prompt it extends
-// (joshuafolkken/kit#854).
+// puts both copy paths on one transform, which is what lets a skill cite the prompt it extends.
 //
 // Markdown only, and deliberately so: the rewrite is a text substitution, the workflow pin and
 // managed-marker passes inside `transform_copied_content` are gated on a `.github/workflows`

package/scripts/sync/managed-config-scope-cli.ts

@@ -3,8 +3,7 @@ import { fileURLToPath } from 'node:url'
 import { path_decision } from '#scripts/josh/path-decision'
 import { managed_config_scope } from './managed-config-scope'
 
-// `josh sync:scope` — say whether this change touches a file `josh sync` distributes
-// (joshuafolkken/kit#1578).
+// `josh sync:scope` — say whether this change touches a file `josh sync` distributes.
 //
 // A command rather than a paragraph, for the reason `josh review:level` is one: the confirmation
 // stop this feeds was written as an instruction to compare the diff against three arrays by eye, and

package/scripts/sync/managed-config-scope.ts

@@ -13,8 +13,8 @@ const AI_COPY_DIRECTORIES_LIST = 'AI_COPY_DIRECTORIES'
 // `init-logic.ts`: these destinations are written by `sync.ts` directly and appear on no list there.
 const SYNCED_PATHS_LIST = 'SYNCED_PATHS'
 
-// The fifth source: the skill directories that ship as the `kit` plugin rather than as a copy
-// (joshuafolkken/kit#1879). They are no longer in `AI_COPY_DIRECTORIES`, but a change to one still
+// The fifth source: the skill directories that ship as the `kit` plugin rather than as a copy.
+// They are no longer in `AI_COPY_DIRECTORIES`, but a change to one still
 // reaches consumers through the package, so the gate keeps flagging it.
 const PLUGIN_SKILL_DIRECTORIES_LIST = 'PLUGIN_SKILL_DIRECTORIES'
 
@@ -57,7 +57,7 @@ function matches_plugin_skill(path: string): boolean {
 
 // The paths `josh sync` writes outside the three `AI_COPY_*` lists — `playwright.config.ts` and the
 // rest. Reading only those three made the gate **narrower than the instruction it replaced**, whose
-// own worked example was a file none of them holds (joshuafolkken/kit#1578).
+// own worked example was a file none of them holds.
 function matches_synced_path(path: string): boolean {
 	return synced_paths.get_synced_paths().includes(path)
 }
@@ -96,7 +96,7 @@ function has_managed_path(paths: ReadonlyArray<string>): boolean {
 
 // The path *and* the list that claimed it, because the two answer different questions: which file to
 // look at, and why it counts as distributed. `AI_COPY_DIRECTORIES` is the one a reader cannot derive
-// by eye — the path matched a directory entry it does not textually equal (joshuafolkken/kit#1578).
+// by eye — the path matched a directory entry it does not textually equal.
 function format_hit(hit: ManagedHit): string {
 	return `${hit.path} (${hit.list})`
 }

package/scripts/sync/plugin-skill-directories.ts

@@ -1,10 +1,10 @@
-// The skill directories kit ships as the `kit` Claude Code plugin (joshuafolkken/kit#1879). A
+// The skill directories kit ships as the `kit` Claude Code plugin. A
 // consumer receives them through the plugin rather than as a copy, so this is the single source two
 // places read: `skill-migration.ts` removes a consumer's stale copy of one, and
 // `managed-config-scope.ts` flags a change to one as reaching consumers. It is deliberately separate
 // from `init-logic.ts`'s `AI_COPY_DIRECTORIES` — which is now empty — because these directories are
 // distributed but no longer copied. `diag` is deliberately absent: it drives kit's own run
-// measurement, so it is excluded from the package and the plugin (joshuafolkken/kit#1997).
+// measurement, so it is excluded from the package and the plugin.
 const PLUGIN_SKILL_DIRECTORIES: ReadonlyArray<string> = [
 	'.claude/skills/workflow-commands',
 	'.claude/skills/epic-commands',

package/scripts/sync/reconcile-templates.ts

@@ -12,9 +12,13 @@
  * is reviewed and reconciled. Only the review is enforced for tripwire pairs.
  */
 import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { template_source_logic } from './template-source-logic'
 
+const ARGV_OFFSET = 2
+const OPTIONS = { check: { type: 'boolean', default: false } } as const
+const USAGE = cli_flags.usage_line(['--check'], 'reconcile-templates')
+
 function check_drift(): never {
 	const copy_drift = template_source_logic.find_copy_drift()
 	const tripwire_drift = template_source_logic.find_tripwire_drift(
@@ -38,16 +42,21 @@ function reconcile(): never {
 	process.exit(0)
 }
 
-function main(): void {
-	const { values } = parseArgs({
-		options: { check: { type: 'boolean', default: false } },
-		strict: true,
-	})
+// A line nobody can read is refused before either path runs: a misspelled `--check` that fell through
+// would regenerate the templates the caller only meant to verify.
+function refuse_usage(): never {
+	console.error(USAGE)
+	process.exit(1)
+}
+
+function main(argv: ReadonlyArray<string>): void {
+	const values = cli_flags.values_of(argv, OPTIONS)
 
+	if (values === undefined) refuse_usage()
 	if (values.check) check_drift()
 	reconcile()
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main()
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
 
-export { check_drift, reconcile }
+export { check_drift, reconcile, main }

package/scripts/sync/removed-skill-manifest.ts

@@ -6,9 +6,8 @@ import type { RemovedSkillManifest } from './skill-migration'
 // of each file's distributed (path-transformed) content, which is consumer-independent, so one hash
 // matches every consumer's untouched copy while an edited copy no longer matches and is kept.
 //
-// `diag` was dropped from distribution in joshuafolkken/kit#1997 because it drives kit's own run
-// measurement, and its source was deleted in joshuafolkken/kit#2015; this removes the copy a consumer
-// received before then (joshuafolkken/kit#1990). `removed-skill-manifest.test.ts` recomputes these
+// `diag` is no longer distributed because it drives kit's own run measurement, and its source is
+// gone; this removes the copy a consumer received while it still shipped. `removed-skill-manifest.test.ts` recomputes these
 // from the repo's own skill source and fails on drift where that source still ships; an entry whose
 // source has since been deleted has nothing left to recompute against, so its frozen hashes stand as
 // the permanent distributed record, guarded only by the test's well-formed-sha256 shape check.

package/scripts/sync/sync-ai-files.ts

@@ -30,7 +30,7 @@ function sync_ai_file(source_path: string, destination_path: string): boolean {
 
 // Both copied hook files must run against the consumer's installed bundle. When sync is run from a
 // newer source than that install, writing either file would leave hooks
-// that fail every prompt (joshuafolkken/kit#1930); skip it and print how to update instead.
+// that fail every prompt; skip it and print how to update instead.
 function should_skip_hook_file(filename: string): boolean {
 	if (filename !== CLAUDE_SETTINGS_FILE && filename !== CODEX_HOOKS_FILE) return false
 	const warning = sync_hook_safety.hook_write_warning(
@@ -60,7 +60,7 @@ function sync_file_mapping(source_path: string, destination_path: string): void
 
 	// Routed through sync_ai_file rather than cpSync: templates/workflows/ci.yml is a mapped
 	// file, so a byte copy would hand the consumer the template's own action pins. The pins
-	// have to be resolved from .github/workflows at write time (joshuafolkken/kit#747).
+	// have to be resolved from .github/workflows at write time.
 	const did_change = sync_ai_file(source_path, destination_path)
 
 	console.info(`  ✔ ${did_change ? 'synced   ' : 'unchanged'} ${path.basename(destination_path)}`)
@@ -121,8 +121,8 @@ function sync_directory(directory_name: string): void {
 }
 
 // A consumer's stale copy of a distributed skill is removed once it still matches the shipment and
-// kept with a warning once it does not (joshuafolkken/kit#1879). Plugin skills compare against the
-// package source; a retired skill compares against the frozen manifest (joshuafolkken/kit#1990). The
+// kept with a warning once it does not. Plugin skills compare against the
+// package source; a retired skill compares against the frozen manifest. The
 // note distinguishes the two, and `absent` — the consumer never had the copy — prints nothing.
 function report_migration_result(result: MigrationResult): void {
 	if (result.action === 'absent') return
@@ -151,7 +151,7 @@ function ensured_claude_md(existing: string | undefined, shape?: ProjectShape):
 		: init_logic.ensure_claude_md_import(existing)
 }
 
-// CLAUDE.md is not byte-copied (joshuafolkken/kit#1878): a consumer's file is one @import of kit's
+// CLAUDE.md is not byte-copied: a consumer's file is one @import of kit's
 // published rules plus the project's own additions below it. Ensure the import line is present
 // without ever disturbing those additions — so this ignores --force, which would otherwise mean
 // discarding a consumer's content.
@@ -171,7 +171,7 @@ function sync_claude_md(destination_path: string, shape?: ProjectShape): void {
 }
 
 // A basic shape syncs the file set `josh init` writes for that profile; no shape is the full set,
-// unfiltered, as sync has always written it (joshuafolkken/kit#2827).
+// unfiltered, as sync has always written it.
 function sync_ai_copy_all(is_force: boolean, shape?: ProjectShape): void {
 	console.info('AI files:')
 
@@ -191,7 +191,7 @@ function sync_ai_copy_all(is_force: boolean, shape?: ProjectShape): void {
 
 	migrate_removed_skills()
 	// Both profiles write the Safe Chain `preinstall`, so both get the hook that keeps it out of a
-	// published package (joshuafolkken/kit#3110).
+	// published package.
 	pack_hook.sync_pack_hook(PROJECT_ROOT, PACKAGE_DIR)
 }
 

package/scripts/sync/sync-configs.ts

@@ -1,7 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR } from '#scripts/init/init-paths'
+import { vscode_tasks } from '#scripts/init/vscode-tasks'
 import { string_array_schema, vscode_settings_schema } from '#scripts/lib/schemas'
 
 type MergeFunction = (existing: string) => string
@@ -30,10 +31,10 @@ function sync_with_merge(
 }
 
 // Removes only the exact settings lines earlier kit releases wrote, which pnpm 12 ignores in
-// `.npmrc` (joshuafolkken/kit#3267); every other line, a `_authToken` line included, is left alone.
+// `.npmrc`; every other line, a `_authToken` line included, is left alone.
 // Sync used to remove the env-var form, which broke every project that had opted its project
 // .npmrc in via `npmrcAuthFile` — there the line is the live credential, and the opt-in itself
-// can live in a deploy platform's dashboard where sync cannot see it (joshuafolkken/kit#759).
+// can live in a deploy platform's dashboard where sync cannot see it.
 function sync_npmrc(destination_path: string): void {
 	sync_with_merge(destination_path, '.npmrc', init_logic.merge_npmrc)
 }
@@ -142,6 +143,31 @@ function sync_vscode_settings_json(destination_path: string): void {
 	)
 }
 
+// Creates the file when absent, unlike the other `.vscode` syncs: the folder-open board task is the
+// whole point of distributing it, and a consumer
+// without a tasks.json has nothing of its own to protect. An existing file keeps every task whose
+// label kit does not ship.
+function sync_vscode_tasks_json(destination_path: string): void {
+	const kit_content = readFileSync(
+		path.join(PACKAGE_DIR, '.vscode', vscode_tasks.VSCODE_TASKS_FILENAME),
+		'utf8',
+	)
+
+	if (existsSync(destination_path)) {
+		const kit_tasks = vscode_tasks.read_kit_tasks(kit_content)
+
+		sync_with_merge(destination_path, '.vscode/tasks.json', (existing) =>
+			vscode_tasks.merge_tasks(existing, kit_tasks),
+		)
+
+		return
+	}
+
+	mkdirSync(path.dirname(destination_path), { recursive: true })
+	writeFileSync(destination_path, kit_content)
+	console.info('  ✔ created   .vscode/tasks.json')
+}
+
 const sync_configs = {
 	sync_npmrc,
 	sync_gitignore,
@@ -152,6 +178,7 @@ const sync_configs = {
 	sync_secretlint_config,
 	sync_vscode_extensions_json,
 	sync_vscode_settings_json,
+	sync_vscode_tasks_json,
 }
 
 export { sync_configs }

package/scripts/sync/sync-hook-safety.ts

@@ -6,11 +6,11 @@ import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
 import semver from 'semver'
 
 // `josh sync` writes the consumer's Claude and Codex hook files, whose hooks invoke bundles under
-// `node_modules/@joshuafolkken/kit/dist/` (joshuafolkken/kit#1930). When sync is run from a
+// `node_modules/@joshuafolkken/kit/dist/`. When sync is run from a
 // newer source than the consumer's installed package — an `npx @joshuafolkken/kit sync`, or a global
 // josh — the settings it writes reference commands (e.g. `pretool:guard`) the older installed bundle
 // does not have, and every prompt then fails a hook that exits `Unknown command`
-// (joshuafolkken/kit#1930's own observation, kit 1.214). This checks the version before writing and
+// (observed on kit 1.214). This checks the version before writing and
 // asks the consumer to update first rather than leaving broken hooks behind.
 //
 // Run through `pnpm josh sync` in the consumer the two versions are equal by construction — the same

package/scripts/sync/sync.ts

@@ -64,7 +64,7 @@ function sync_prettier_config(destination_path: string): void {
 	write_merged_prettier_config(destination_path)
 }
 
-// A basic project's prettier config written before joshuafolkken/kit#2829 still imports the static
+// A basic project's prettier config written under the static profile name still imports the static
 // preset path; it is moved onto the basic one with the rule `josh init` applies.
 function sync_basic_prettier_config(destination_path: string): void {
 	if (!existsSync(destination_path)) return
@@ -137,6 +137,7 @@ function sync_config_files(): void {
 	sync_configs.sync_secretlint_config(path.join(PROJECT_ROOT, '.secretlintrc.json'))
 	sync_configs.sync_vscode_extensions_json(path.join(PROJECT_ROOT, '.vscode/extensions.json'))
 	sync_configs.sync_vscode_settings_json(path.join(PROJECT_ROOT, '.vscode/settings.json'))
+	sync_configs.sync_vscode_tasks_json(path.join(PROJECT_ROOT, '.vscode/tasks.json'))
 }
 
 function sync_package_json_with(
@@ -170,6 +171,16 @@ function sync_package_manager_version(destination_path: string): void {
 	)
 }
 
+// A manifest an earlier `josh init` wrote rejects a standalone pnpm of another version outright;
+// `"download"` fetches the pin instead.
+function sync_package_manager_on_fail(destination_path: string): void {
+	sync_package_json_with(
+		destination_path,
+		(existing) => package_manager_version.upgrade_development_engines_on_fail(existing),
+		'  ✔ synced    devEngines.packageManager.onFail',
+	)
+}
+
 // The pre-commit secretlint rule resolves secretlint from the consumer project, so a project
 // that predates the rule needs the devDependencies added here (then `pnpm install`) before the
 // hook can run. `josh init` covers fresh projects; this covers everyone already initialized.
@@ -182,7 +193,7 @@ function sync_secretlint_development_deps(destination_path: string): void {
 }
 
 // `lefthook install` fails silently when `core.hooksPath` is set, leaving a consumer with no hooks
-// and no message (joshuafolkken/kit#1503). `josh init` rewrites the clause it wrote so the failure
+// and no message. `josh init` rewrites the clause it wrote so the failure
 // is reported; this covers everyone already initialized, who never re-runs `josh init`.
 function sync_prepare_lefthook_warning(destination_path: string): void {
 	sync_package_json_with(
@@ -192,7 +203,7 @@ function sync_prepare_lefthook_warning(destination_path: string): void {
 	)
 }
 
-// The `preinstall` earlier kits wrote fetched safe-chain on every install (joshuafolkken/kit#3269);
+// The `preinstall` earlier kits wrote fetched safe-chain on every install;
 // `josh init` replaces it, and this covers everyone already initialized.
 function sync_safe_chain_preinstall(destination_path: string): void {
 	sync_package_json_with(
@@ -206,6 +217,7 @@ function sync_safe_chain_preinstall(destination_path: string): void {
 // group so the next one is added here rather than at the call site.
 function sync_package_json_migrations(destination_path: string): void {
 	sync_package_manager_version(destination_path)
+	sync_package_manager_on_fail(destination_path)
 	sync_secretlint_development_deps(destination_path)
 	sync_prepare_lefthook_warning(destination_path)
 	sync_safe_chain_preinstall(destination_path)
@@ -213,16 +225,16 @@ function sync_package_json_migrations(destination_path: string): void {
 
 // Two distributed artifacts each depend on a repository setting kit cannot write, and both reports
 // are tied to the moment the artifact reaches the consumer. `.github/dependabot.yml` disables npm
-// version updates (joshuafolkken/kit#803), so a synced consumer only receives npm Dependabot pull
-// requests through the security-advisory path (joshuafolkken/kit#805);
+// version updates, so a synced consumer only receives npm Dependabot pull
+// requests through the security-advisory path;
 // `.github/workflows/dependabot-auto-merge.yml` runs `gh pr merge --auto`, which fails outright
-// unless the repository allows auto-merge (joshuafolkken/kit#834). Neither ever fails the sync: both
+// unless the repository allows auto-merge. Neither ever fails the sync: both
 // are GitHub-side state, not synced artifacts. Unconditional, unlike `init`, because `sync`
 // overwrites both files on every run.
 //
 // The labels are the same kind of GitHub-side prerequisite, and one kit *can* write: the synced
 // `pr-classification.yml` requires one of the release classification labels, so the missing ones are
-// created here rather than reported (joshuafolkken/kit#2797).
+// created here rather than reported.
 function report_repository_settings(name_with_owner: string | undefined): void {
 	security_updates.report_security_updates_section(name_with_owner)
 	auto_merge_setting.report_auto_merge_section(name_with_owner)
@@ -242,7 +254,7 @@ function sync_project_artifacts(is_force: boolean): void {
 	sync_sonar_with_template(name_with_owner, is_force)
 	sync_config_files()
 	// After `sync_ai_copy_all`, which may add the `pnpm-workspace.yaml` window `.aikido`'s age is
-	// derived from (joshuafolkken/kit#2743, #3267).
+	// derived from.
 	project_config.sync_project_config(PROJECT_ROOT)
 	sync_package_json_migrations(path.join(PROJECT_ROOT, PACKAGE_JSON))
 	report_repository_settings(name_with_owner)
@@ -250,7 +262,7 @@ function sync_project_artifacts(is_force: boolean): void {
 
 // A basic project gets what `josh init` gives that profile and nothing more: its AI file set and the
 // move of its prettier preset path. The full toolchain's configs, Sonar, package.json migrations and
-// repository settings are never written into it (joshuafolkken/kit#2827).
+// repository settings are never written into it.
 function sync_basic_artifacts(is_force: boolean): void {
 	console.info('profile: basic (package.json josh.profile)\n')
 	sync_ai_files.sync_ai_copy_all(is_force, project_profile.inspect_project(PROJECT_ROOT, 'basic'))
@@ -259,7 +271,7 @@ function sync_basic_artifacts(is_force: boolean): void {
 
 // Checked before anything is written, never per file: the damage is the whole run, and a partial
 // sync that stopped halfway would leave the source repository in a state neither `git checkout` nor
-// a re-run describes (joshuafolkken/kit#868).
+// a re-run describes.
 //
 // Only a recorded basic profile switches the file set; an unrecorded one stays full, as every
 // project initialized before the profile was recorded was set up.
@@ -286,6 +298,7 @@ const sync = {
 	sync_playwright_config,
 	sync_deploy_vps,
 	sync_package_manager_version,
+	sync_package_manager_on_fail,
 	sync_secretlint_development_deps,
 	sync_prepare_lefthook_warning,
 	sync_safe_chain_preinstall,

package/scripts/sync/synced-paths.ts

@@ -1,7 +1,7 @@
 import { init_logic } from '#scripts/init/init-logic'
 
 // **`josh sync` distributes more than the three `AI_COPY_*` lists**, and a gate that reads only
-// those is narrower than the instruction it replaced (joshuafolkken/kit#1578). The prose that
+// those is narrower than the instruction it replaced. The prose that
 // instruction lived in named `playwright.config.ts` as its own worked example — a file no `AI_COPY_*`
 // list holds — so a matcher built from those lists alone would have answered "not distributed" for
 // the very file the rule was written about.
@@ -29,6 +29,7 @@ const SYNCED_CONFIG_PATHS: ReadonlyArray<string> = [
 	'.secretlintrc.json',
 	'.vscode/extensions.json',
 	'.vscode/settings.json',
+	'.vscode/tasks.json',
 ]
 
 // **`package.json` is deliberately absent.** `sync` does not overwrite it — it realigns one field,

package/scripts/sync/workflow-pin-logic.ts

@@ -147,7 +147,7 @@ function list_workflow_sources(relative_directory: string): Array<WorkflowSource
 }
 
 // The local composite actions are runtime sources too: `.github/actions/setup-pnpm` is the only
-// place kit's own workflows still pin pnpm/setup (joshuafolkken/kit#2982).
+// place kit's own workflows still pin pnpm/setup.
 function list_composite_action_sources(): Array<WorkflowSource> {
 	return composite_actions
 		.list(package_path)

package/scripts/test/test-declared-changed.ts

@@ -4,7 +4,7 @@ import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { test_declared_logic, type Verdict } from './test-declared-logic'
 
 // The working-tree change set and the verdict over it, read **synchronously** for the `PreToolUse`
-// trigger in `delivered-rules.ts` (joshuafolkken/kit#2118).
+// trigger in `delivered-rules.ts`.
 //
 // **Synchronous on purpose, and separate from `git-command.ts` for the same reason `run-cut.ts` keeps
 // a `carried_cut_sync`.** A guard answers a hook synchronously — an `await` or a network call is out —
@@ -45,7 +45,7 @@ function read_changed_paths_sync(): Array<string> {
 }
 
 // The working-tree read behind `current_verdict`, injectable so the delivery path can be exercised
-// without a checkout (joshuafolkken/kit#2169). Held on a `const` object rather than a reassigned
+// without a checkout. Held on a `const` object rather than a reassigned
 // variable — production leaves `paths` unset and the real reader runs; a test fixes it for the span of
 // one call through `with_paths`, and it is cleared afterwards.
 const injected: { paths?: ReadonlyArray<string> } = {}
@@ -64,7 +64,7 @@ function current_verdict(paths: ReadonlyArray<string> = source_paths()): Verdict
 
 // Put the injection back to what it was before a `with_paths` span — cleared to the live reader when
 // nothing was in force, else the outer span's set. Restoring rather than always clearing lets a nested
-// span prove the clear happened without reading the live tree (joshuafolkken/kit#2169).
+// span prove the clear happened without reading the live tree.
 function restore_injection(previous: ReadonlyArray<string> | undefined): void {
 	if (previous === undefined) {
 		delete injected.paths
@@ -75,7 +75,7 @@ function restore_injection(previous: ReadonlyArray<string> | undefined): void {
 	injected.paths = previous
 }
 
-// The seam the `rule_delivery` call path needs (joshuafolkken/kit#2169). `is_untested_commit` reads the
+// The seam the `rule_delivery` call path needs. `is_untested_commit` reads the
 // tree at trigger time rather than from an argument, so a unit test driving `rule_delivery` cannot reach
 // `current_verdict`'s `paths` port from the outside. Running `body` inside `with_paths` fixes the read
 // to `paths` for its duration and restores it afterwards — the `PreToolUse` production path, which never