@joshuafolkken/kit 1.1373.0 → 1.1379.0

package/dist/josh.js

@@ -46,6 +46,35 @@ var git_utilities = {
   get_git_command_for_spawn
 };
 
+// scripts/git/git-location-environment.ts
+var GIT_LOCATION_VARIABLES = [
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_DIR",
+  "GIT_INDEX_FILE",
+  "GIT_NAMESPACE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_WORK_TREE"
+];
+function location_free_environment() {
+  return Object.fromEntries(GIT_LOCATION_VARIABLES.map((name) => [name, void 0]));
+}
+function forget(name) {
+  Reflect.deleteProperty(process.env, name);
+}
+function restore_one(name, value) {
+  if (value === void 0) forget(name);
+  else process.env[name] = value;
+}
+function clear_git_location_variables() {
+  const previous = GIT_LOCATION_VARIABLES.map((name) => [name, process.env[name]]);
+  for (const [name] of previous) forget(name);
+  return () => {
+    for (const [name, value] of previous) restore_one(name, value);
+  };
+}
+var git_location_environment = { clear_git_location_variables, location_free_environment };
+
 // scripts/git/git-spawn-sync.ts
 var SUCCESS_EXIT_CODE = 0;
 var C_LOCALE = { LC_ALL: "C", LANGUAGE: "C" };
@@ -67,7 +96,10 @@ function read(args, options = {}) {
   return result.exit_code === SUCCESS_EXIT_CODE ? result.stdout.trim() : void 0;
 }
 function origin_url(cwd) {
-  return read(["config", "--get", "remote.origin.url"], { cwd });
+  return read(["config", "--get", "remote.origin.url"], {
+    cwd,
+    env: git_location_environment.location_free_environment()
+  });
 }
 function toplevel(timeout = GIT_TIMEOUT_MS) {
   return run(["rev-parse", "--show-toplevel"], { env: C_LOCALE, timeout });
@@ -2448,7 +2480,10 @@ var MAINTENANCE_COMMANDS = {
     script: "scripts/version/latest-update.ts",
     description: "Update all dependencies to latest",
     category: "Maintenance",
-    reference: ["", "developer", ["files", "network"]]
+    reference: ["", "developer", ["files", "network"]],
+    // `JOSH_PLAYWRIGHT_BROWSERS` widens the browsers a Playwright bump installs, and a project
+    // keeps that setting in its `.env`.
+    tsx_arguments: OPTIONAL_ENV_FILE_FLAGS
   }
 };
 
@@ -2536,7 +2571,7 @@ var PROJECT_COMMANDS = {
   },
   adopt: {
     script: "scripts/adopt/adopt.ts",
-    description: "Upgrade every installed @joshuafolkken toolkit here and open the pull request",
+    description: "Upgrade the @joshuafolkken toolkits and other dependencies here, open the PR",
     category: "Project",
     reference: ["[--dry-run]", "developer", ["files", "git", "network", "processes"]]
   }
@@ -2562,7 +2597,7 @@ var VERSIONING_COMMANDS = {
   // before chaining here, exactly as it already does for `latest:update`.
   ranges: {
     script: "scripts/version/publishable-range-check.ts",
-    description: "Check that every published dependency range still resolves for a consumer",
+    description: "Check that every published dependency range still resolves for a consumer and no peer range falls below an installed toolkit",
     category: "Versioning",
     reference: ["", "developer", ["network"]]
   },

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1373.0",
+  "version": "1.1379.0",
   "name": "@joshuafolkken/kit",
   "description": "Development toolkit for AI-assisted projects: formatting, AI assistant rules and a Git/GitHub Issue workflow for any repository, plus lint, type check, tests and hooks for Node projects",
   "keywords": [
@@ -264,10 +264,10 @@
     "eslint_d": "^15.0.3",
     "globals": "^17.13.0",
     "lefthook": "^2.2.1",
-    "prettier": "^3.9.9",
+    "prettier": "^3.9.10",
     "prettier-plugin-svelte": "^4.1.1",
     "prettier-plugin-tailwindcss": "^0.8.1",
-    "rollup": "^4.64.4",
+    "rollup": "^4.64.5",
     "rollup-plugin-dts": "^6.5.1",
     "secretlint": "^13.0.7",
     "typescript": "^6.0.3",
@@ -289,7 +289,7 @@
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "12.11.2+sha512.25a51652a196785af5f28bda6dfe8dc582ebefa4ac1d180221ce1390231c5fb76637822ea4b6e4633ce74acdcb0a77f725af11bad38177fdeddaee818a955cb9",
+      "version": "12.12.0+sha512.2ee06ac86db554cf384421461220f0e336a487bfd41b2acd04e17a86b1487832fe45e8d1743f7fc52acc77de12d2356b536fedf8229fc483239e40b13d474449",
       "onFail": "download"
     }
   },

package/scripts/adopt/adopt-logic.ts

@@ -8,7 +8,10 @@ import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
 // The decisions `josh adopt` makes before any step runs: whether this repository may adopt at all,
 // which repository the issue is opened in, and what the run is carrying.
 
-const ADOPT_ORIGIN = 'Opened by `josh adopt` in this repository.'
+// It names `josh latest` because the issue title names only the toolkits: without this sentence the
+// other dependency bumps in the pull request have nothing in the issue that accounts for them.
+const ADOPT_ORIGIN =
+	'Opened by `josh adopt` in this repository, which also ran `josh latest` — the other dependencies and the pnpm pin are updated alongside.'
 const INCOMPLETE_HEADLINE =
 	'Refusing to adopt: these declared toolkits would fall out of the plan, and the run would sync the rest without them.'
 const INCOMPLETE_EFFECT =

package/scripts/adopt/adopt.ts

@@ -13,9 +13,11 @@ import { adopt_toolkits } from './adopt-toolkits'
 //
 // It is `josh propagate` seen from the other end: propagation stands in the supplier and pushes one
 // released version out to every consumer, adoption stands in the consumer and pulls whatever is
-// newest in. The step sequence is literally the same one — `propagate_run.STEP_ORDER`, run through
-// `propagate_run.run_target` — so the working-tree pre-check, the ordering and the return to the
-// default branch cannot drift between the two.
+// newest in. The step sequence is the same one with `josh latest` added — `propagate_run
+// .ADOPT_STEP_ORDER`, derived from `STEP_ORDER` and run through `propagate_run.run_target` — so the
+// working-tree pre-check, the ordering and the return to the default branch cannot drift between the
+// two. `josh latest` is adoption's alone: catching a consumer up means its other dependencies and its
+// pnpm pin too, in the same pull request, where propagation carries one exact release and nothing else.
 //
 // It stops at the open pull request. Merging is what `pnpm josh followup` does, under an
 // authorization a CLI does not have.
@@ -62,7 +64,7 @@ function run_sequence(target: PropagateTarget, plan: ReleasePlan | undefined): n
 		plan === undefined ? propagate_steps.describe_step : propagate_steps.create_step_runner(plan)
 	const reason = plan === undefined ? DRY_RUN_REASON : propagate_run.PROPAGATED_REASON
 
-	return report(propagate_run.run_target(target, step, reason))
+	return report(propagate_run.run_target(target, step, reason, propagate_run.ADOPT_STEP_ORDER))
 }
 
 // A declared toolkit that cannot be carried stops the run, whichever of the two ways it fell out —
@@ -158,6 +160,7 @@ const adopt = {
 	KNOWN_FLAGS,
 	NOTHING_TO_ADOPT,
 	parse_options,
+	run_sequence,
 	run_here,
 	run,
 }

package/scripts/cost-runtime/context-cut-payback.ts

@@ -26,11 +26,16 @@ const POST_CUT_CONTEXT = 60_000
 const EXPECTED_REMAINING_REQUESTS = 10
 
 // The price of a dropped token relative to a rewritten one, from `cost-pricing.ts`. A cache read bills
-// `CACHE_READ_MULTIPLIER` of base input and a 5-minute cache write `CACHE_WRITE_5M_MULTIPLIER`, so a
-// preamble rewrite costs this many per-request cache reads. The base input rate is common to both and
-// cancels, which is why only the ratio appears.
+// `DEFAULT_CACHE_READ_MULTIPLIER` of base input and a 5-minute cache write `CACHE_WRITE_5M_MULTIPLIER`,
+// so a preamble rewrite costs this many per-request cache reads. The base input rate is common to both
+// and cancels, which is why only the ratio appears.
+//
+// **The standard cache-read rate, deliberately, not the running model's.** Opus 5.5 reads cache at
+// 0.05x and Fable 5.1 at 0.025x, which would move the threshold from 135,000 to 210,000 and 360,000 —
+// outside the 100k–200k band the cut was validated in. That changes when a cut fires, a decision that
+// needs a lane measurement of its own rather than arriving as a side effect of a corrected price list.
 function write_over_read(): number {
-	return cost_pricing.CACHE_WRITE_5M_MULTIPLIER / cost_pricing.CACHE_READ_MULTIPLIER
+	return cost_pricing.CACHE_WRITE_5M_MULTIPLIER / cost_pricing.DEFAULT_CACHE_READ_MULTIPLIER
 }
 
 // The current per-request context at which a cut breaks even over exactly `remaining` requests. The

package/scripts/cost-runtime/cost-pricing.ts

@@ -1,68 +1,114 @@
 import { cost_usage, type UsageTotals } from './cost-usage'
 
-// The current Claude price list, and the three multipliers that make a token's price depend on how
-// it was sent.
+// The current Claude price list, and the multipliers that make a token's price depend on how it was
+// sent.
 //
-// A run's cost is not "tokens x one rate". A cache read costs a tenth of base input, a 5-minute
-// cache write 1.25x, a 1-hour cache write 2x, and output 5x. On a measured request with
-// `cache_read_input_tokens` 97,190 against `input_tokens` 2, an estimate that ignored the
-// multipliers would be wrong by more than an order of magnitude in either direction depending on
+// A run's cost is not "tokens x one rate". A cache read costs a fraction of base input that depends
+// on the model, a 5-minute cache write 1.25x, a 1-hour cache write 2x, and output 5x. On a measured
+// request with `cache_read_input_tokens` 97,190 against `input_tokens` 2, an estimate that ignored
+// the multipliers would be wrong by more than an order of magnitude in either direction depending on
 // which single rate it picked.
 
 const CACHE_WRITE_5M_MULTIPLIER = 1.25
 const CACHE_WRITE_1H_MULTIPLIER = 2
-const CACHE_READ_MULTIPLIER = 0.1
+// The standard cache-read rate, a tenth of base input — what a model bills unless its row says
+// otherwise. Named the default because it is not every model's rate: pricing a model reads the row's
+// multiplier through `estimate_cost`, never this constant.
+const DEFAULT_CACHE_READ_MULTIPLIER = 0.1
+// The discounted cache-read rates of the 5.5 generation (platform.claude.com "Model pricing", read
+// 2026-10-12): Opus 5.5 and Sonnet 5.5 bill a cache read at 0.05x base input, Fable 5.1 and Mythos
+// 5.1 at 0.025x.
+const HALVED_CACHE_READ_MULTIPLIER = 0.05
+const QUARTERED_CACHE_READ_MULTIPLIER = 0.025
 const TOKENS_PER_MILLION = 1_000_000
 
 interface ModelPrice {
 	// USD per million tokens.
 	input: number
 	output: number
+	// The cache-read rate as a multiple of `input`. Absent on a model billed at the standard
+	// `DEFAULT_CACHE_READ_MULTIPLIER`, so a row states a multiplier only where it differs.
+	cache_read_multiplier?: number
 }
 
+// A model priced by prompt length carries a second row under its id plus this suffix — the rates a
+// request over `LONG_PROMPT_THRESHOLD` pays. The suffixed name is not an id the API reports; it is
+// what `cost_by_model` bills such a request under, so the higher-priced requests show as their own
+// row and resolve to their own price like any other.
+const LONG_PROMPT_SUFFIX = ':long-prompt'
+const LONG_PROMPT_THRESHOLD = 100_000
+
 // Base input/output rates per million tokens. Cache rates are derived from `input` by the
 // multipliers above rather than listed, because they are defined as multiples of it — writing them
 // out would let the two drift.
 /* eslint-disable @typescript-eslint/naming-convention */
 const MODEL_PRICES: Record<string, ModelPrice> = {
+	'claude-fable-5-1': {
+		input: 10,
+		output: 50,
+		cache_read_multiplier: QUARTERED_CACHE_READ_MULTIPLIER,
+	},
+	'claude-mythos-5-1': {
+		input: 10,
+		output: 50,
+		cache_read_multiplier: QUARTERED_CACHE_READ_MULTIPLIER,
+	},
 	'claude-fable-5': { input: 10, output: 50 },
 	'claude-mythos-5': { input: 10, output: 50 },
+	'claude-opus-5-5': { input: 4, output: 20, cache_read_multiplier: HALVED_CACHE_READ_MULTIPLIER },
 	'claude-opus-5': { input: 5, output: 25 },
 	'claude-opus-4-8': { input: 5, output: 25 },
 	'claude-opus-4-7': { input: 5, output: 25 },
 	'claude-opus-4-6': { input: 5, output: 25 },
+	'claude-sonnet-5-5': {
+		input: 2,
+		output: 10,
+		cache_read_multiplier: HALVED_CACHE_READ_MULTIPLIER,
+	},
 	'claude-sonnet-5': { input: 2, output: 10 },
 	'claude-sonnet-4-6': { input: 3, output: 15 },
+	'claude-haiku-5-5': { input: 0.1, output: 0.5 },
+	[`claude-haiku-5-5${LONG_PROMPT_SUFFIX}`]: { input: 0.5, output: 2.5 },
 	'claude-haiku-4-5': { input: 1, output: 5 },
 }
 /* eslint-enable @typescript-eslint/naming-convention */
 
 const CONTEXT_MARKER = '['
+// A deployment's date suffix — `claude-haiku-4-5-20251001`. Eight digits and nothing else, so a
+// version segment (the last `-5` of `claude-opus-5-5`) is never read as one.
+const DATE_SUFFIX = /-\d{8}$/u
 
 // Claude Code appends a context-window marker to the model id it records — `claude-opus-5[1m]` —
 // and a deployment may carry a date suffix. Both name the same priced model, so the id is reduced
-// to its longest prefix that the table knows rather than reported as unknown.
+// to the table's id by removing exactly those two decorations.
+//
+// **Nothing else is removed.** The reduction was once "the longest prefix the table knows", which
+// priced `claude-opus-5-5` at `claude-opus-5`'s rates and `claude-fable-5-1` at `claude-fable-5`'s —
+// another model's price list, reported with no warning. A version the table does not carry is
+// unpriced, which `total_cost` names, rather than billed as the closest id it resembles.
 //
 // The `[1m]` marker is the 1M-context beta, and stripping it to the base rate is confirmed correct,
-// not an approximation. The published price list — platform.claude.com
-// "Long context pricing", read 2026-09 — states that Claude 4.6 and later models "include the full
-// 1M token context window at standard pricing (a 900k-token request is billed at the same per-token
-// rate as a 9k-token request)". Every id in `MODEL_PRICES` is 4.6-or-later, so no request has an
-// input-size surcharge band to account for, whatever its size. (Fast mode is a separate premium, but
-// it is signalled by `speed: "fast"` rather than by the context marker, so it is not this marker's
-// concern.) Were a future model to reintroduce a >200K band, the marker could no longer be stripped
-// blindly and this function would branch on the input size instead.
-function resolve_price(model: string): ModelPrice | undefined {
+// not an approximation. The published price list — platform.claude.com "Long context pricing", read
+// 2026-10-12 — states that Claude 4.6 and later models other than Haiku 5.5 "include the full 1M
+// token context window at standard pricing (a 900k-token request is billed at the same per-token
+// rate as a 9k-token request)". The one model with an input-size band is priced from the request's
+// own size by `billed_model`, not from the marker. (Fast mode is a separate premium, but it is
+// signalled by `speed: "fast"` rather than by the context marker, so it is not this marker's
+// concern.)
+function known_id(model: string): string | undefined {
 	const base = model.split(CONTEXT_MARKER)[0] ?? model
-	const direct = MODEL_PRICES[base]
 
-	if (direct !== undefined) return direct
+	return [base, base.replace(DATE_SUFFIX, '')].find((id) => Object.hasOwn(MODEL_PRICES, id))
+}
+
+function resolve_price(model: string): ModelPrice | undefined {
+	const id = known_id(model)
 
-	const [matched] = Object.keys(MODEL_PRICES)
-		.filter((id) => base.startsWith(id))
-		.toSorted((left, right) => right.length - left.length)
+	return id === undefined ? undefined : MODEL_PRICES[id]
+}
 
-	return matched === undefined ? undefined : MODEL_PRICES[matched]
+function cache_read_multiplier(price: ModelPrice): number {
+	return price.cache_read_multiplier ?? DEFAULT_CACHE_READ_MULTIPLIER
 }
 
 function estimate_cost(totals: UsageTotals, price: ModelPrice): number {
@@ -70,16 +116,16 @@ function estimate_cost(totals: UsageTotals, price: ModelPrice): number {
 		totals.input_tokens +
 		totals.cache_write_5m_tokens * CACHE_WRITE_5M_MULTIPLIER +
 		totals.cache_write_1h_tokens * CACHE_WRITE_1H_MULTIPLIER +
-		totals.cache_read_tokens * CACHE_READ_MULTIPLIER
+		totals.cache_read_tokens * cache_read_multiplier(price)
 
 	return (weighted_input * price.input + totals.output_tokens * price.output) / TOKENS_PER_MILLION
 }
 
 // The five dollar terms `estimate_cost` sums, kept apart so a report can say what a run's dollars
-// were spent on rather than only their total. Each is priced by the same
-// multipliers `estimate_cost` uses — the exported constants above — so the five always sum to
-// `estimate_cost(totals, price)`. It is a decomposition of the same arithmetic, not a second price
-// list, which is why the weights live in the constants both read rather than in either function.
+// were spent on rather than only their total. Each is priced by the same multipliers `estimate_cost`
+// uses — the write constants above and the price's own cache-read multiplier — so the five always
+// sum to `estimate_cost(totals, price)`. It is a decomposition of the same arithmetic, not a second
+// price list, which is why the weights live where both read them rather than in either function.
 interface CostComposition {
 	input_usd: number
 	cache_write_5m_usd: number
@@ -103,7 +149,7 @@ function estimate_composition(totals: UsageTotals, price: ModelPrice): CostCompo
 			totals.cache_write_1h_tokens * CACHE_WRITE_1H_MULTIPLIER,
 			price.input,
 		),
-		cache_read_usd: priced(totals.cache_read_tokens * CACHE_READ_MULTIPLIER, price.input),
+		cache_read_usd: priced(totals.cache_read_tokens * cache_read_multiplier(price), price.input),
 		output_usd: priced(totals.output_tokens, price.output),
 	}
 }
@@ -129,15 +175,29 @@ interface ModelUsage {
 	totals: UsageTotals
 }
 
+// The id a request is billed under: its own, unless the model is priced by prompt length and this
+// request is over the threshold, in which case the model's long-prompt row. The prompt length is
+// everything the request sent — cache reads and writes included — and each request is priced on its
+// own (platform.claude.com "Long context pricing", read 2026-10-12), which is why this reads one
+// request's totals and cannot be asked of a sum.
+function billed_model(usage: ModelUsage): string {
+	const long_id = `${known_id(usage.model) ?? usage.model}${LONG_PROMPT_SUFFIX}`
+	const is_long = cost_usage.billed_input(usage.totals) > LONG_PROMPT_THRESHOLD
+
+	return is_long && Object.hasOwn(MODEL_PRICES, long_id) ? long_id : usage.model
+}
+
 // Per-model, because a session routinely mixes tiers — a subagent on Haiku inside an Opus run — and
-// one blended rate would be wrong for both.
+// one blended rate would be wrong for both. Grouped by `billed_model`, so each record is one request:
+// a model priced by prompt length is split into the rows its requests were billed at.
 function cost_by_model(records: ReadonlyArray<ModelUsage>): Array<ModelCost> {
 	const grouped = new Map<string, UsageTotals>()
 
 	for (const record of records) {
-		const running = grouped.get(record.model) ?? cost_usage.EMPTY_TOTALS
+		const model = billed_model(record)
+		const running = grouped.get(model) ?? cost_usage.EMPTY_TOTALS
 
-		grouped.set(record.model, cost_usage.add_totals(running, record.totals))
+		grouped.set(model, cost_usage.add_totals(running, record.totals))
 	}
 
 	return [...grouped].map(([model, totals]) => to_model_cost(model, totals))
@@ -162,7 +222,8 @@ function cost_of(records: ReadonlyArray<ModelUsage>): number {
 const cost_pricing = {
 	CACHE_WRITE_5M_MULTIPLIER,
 	CACHE_WRITE_1H_MULTIPLIER,
-	CACHE_READ_MULTIPLIER,
+	DEFAULT_CACHE_READ_MULTIPLIER,
+	LONG_PROMPT_THRESHOLD,
 	resolve_price,
 	estimate_cost,
 	estimate_composition,

package/scripts/document/document-byte-budget.ts

@@ -76,7 +76,7 @@ const DOCUMENT_BYTE_BUDGET: ReadonlyArray<DocumentBudget> = [
 	{ path: 'docs/josh-commands-automation.md', bytes: 53_248 },
 	{ path: 'docs/josh-commands-run.md', bytes: 65_536 },
 	{ path: 'docs/josh-commands-backlog.md', bytes: 57_344 },
-	{ path: 'docs/josh-commands.md', bytes: 45_056 },
+	{ path: 'docs/josh-commands.md', bytes: 49_152 },
 	{ path: 'docs/labels-and-run-states.md', bytes: 8192 },
 	{ path: 'prompts/coding-standards.md', bytes: 8192 },
 	{ path: 'prompts/collaboration-workflow.md', bytes: 8192 },

package/scripts/document/read-set-pricing.ts

@@ -9,11 +9,12 @@
 // was worth moving off the entry read.
 //
 // **The rate is not defined here.** The per-million-token input rate and the cache-read multiplier
-// come from `cost-pricing.ts` — the same constants `josh cost` and `josh time` price a run with — so
+// come from `cost-pricing.ts` — the same price table `josh cost` and `josh time` price a run with — so
 // there is no second price list to drift. This file is the model (a token rides every request as a
 // cache read) and the one assumption the model needs (how many requests a run makes); the arithmetic
 // is `cost_pricing.estimate_cost`'s.
 
+import { agent_role_profile } from '#scripts/agent/agent-role-profile'
 import { cost_pricing } from '#scripts/cost-runtime/cost-pricing'
 import { cost_usage } from '#scripts/cost-runtime/cost-usage'
 
@@ -23,10 +24,10 @@ import { cost_usage } from '#scripts/cost-runtime/cost-usage'
 // much per entry-read token, so the figure is "per run of this size", never an absolute.
 const ASSUMED_REQUESTS = 118
 
-// The model these runs execute on. Its base input rate and the cache-read multiplier are read from
-// the price table rather than written here, so the dollar figure tracks any price change with no edit
-// to this file.
-const REFERENCE_MODEL = 'claude-opus-4-8'
+// The model these runs execute on — the worker's default, read from the profile that launches a lane
+// rather than written here, so a model migration moves the dollar figure with no edit to this file.
+// Its base input rate and cache-read multiplier come from the price table in the same way.
+const REFERENCE_MODEL = agent_role_profile.DEFAULT_PROFILES.worker.model
 
 // A token read at the entry is written to cache once and then read back on every request. Modelled as
 // a pure cache read across the run — the one-time write is under 1% of the total and folding it in
@@ -45,6 +46,7 @@ function dollars_per_run(tokens: number): number {
 
 const read_set_pricing = {
 	ASSUMED_REQUESTS,
+	REFERENCE_MODEL,
 	dollars_per_run,
 }
 

package/scripts/git/git-spawn-sync.ts

@@ -2,6 +2,7 @@ import { read_spawn_stderr, read_spawn_stdout } from '#scripts/lib/spawn-exit'
 import { GIT_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import { git_utilities } from './constants'
+import { git_location_environment } from './git-location-environment'
 
 // The one place a synchronous git command is spawned from — the sync
 // counterpart of `git-spawn.ts`. Every caller here wants an answer rather than an exception, so a
@@ -51,8 +52,15 @@ function read(args: ReadonlyArray<string>, options: GitSyncOptions = {}): string
 }
 
 // The configured `origin` URL, or undefined when the repository has none.
+//
+// **The git location variables are cleared, so `cwd` is the repository that answers.** A hook exports
+// `GIT_DIR`, which beats `cwd` outright — a caller reached from inside `pre-push` would otherwise be
+// told the `origin` of the repository being pushed rather than of the directory it named.
 function origin_url(cwd: string): string | undefined {
-	return read(['config', '--get', 'remote.origin.url'], { cwd })
+	return read(['config', '--get', 'remote.origin.url'], {
+		cwd,
+		env: git_location_environment.location_free_environment(),
+	})
 }
 
 // The absolute repository (or worktree) root, asked under the C locale so a caller can tell "not a

package/scripts/init/init-ai-copy.ts

@@ -16,6 +16,7 @@ import { init_logic } from './init-logic'
 import { package_path, PROJECT_ROOT } from './init-paths'
 import { init_sonar } from './init-sonar'
 import type { ProjectShape } from './project-profile'
+import { security_policy } from './security-policy'
 
 const WORKSPACE_YAML = 'pnpm-workspace.yaml'
 const CLAUDE_MD_FILENAME = 'CLAUDE.md'
@@ -23,7 +24,7 @@ const BASIC_CLAUDE_IMPORT = '@node_modules/@joshuafolkken/kit/dist/CLAUDE.basic.
 const PRETTIER_IGNORE = '.prettierignore'
 const GIT_ATTRIBUTES = '.gitattributes'
 const CODE_OF_CONDUCT = 'CODE_OF_CONDUCT.md'
-const SECURITY_MD = 'SECURITY.md'
+const { SECURITY_MD } = security_policy
 const BASIC_AI_FILES = [
 	'AGENTS.md',
 	'GEMINI.md',
@@ -38,6 +39,10 @@ const BASIC_SOURCES: Readonly<Record<string, string>> = {
 	[PRETTIER_IGNORE]: 'templates/prettierignore.basic',
 	[WORKSPACE_YAML]: 'templates/pnpm-workspace.basic.yaml',
 }
+// Written from a template of the consumer's own on every profile, not from kit's same-named file.
+const CONSUMER_SOURCES: Readonly<Record<string, string>> = {
+	[SECURITY_MD]: security_policy.SECURITY_TEMPLATE,
+}
 const GITHUB_FILES = new Set([CODE_OF_CONDUCT, SECURITY_MD])
 const BASIC_POINTER_MAPPING = { src: 'templates/cursorrules.basic', dest: '.cursorrules' }
 const PULL_REQUEST_TEMPLATE = '.github/pull_request_template.md'
@@ -143,14 +148,16 @@ function did_skip_workspace_yaml_copy(source_path: string, destination_path: str
 }
 
 // The package file an AI file is copied from: a basic project gets its own template for a few of
-// them, every other file is copied from the path it is written to.
+// them, a few are a consumer template on every profile, and every other file is copied from the
+// path it is written to.
 function ai_file_source(filename: string, shape?: ProjectShape): string {
 	const basic_source = shape?.profile === 'basic' ? BASIC_SOURCES[filename] : undefined
 
-	return basic_source ?? filename
+	return basic_source ?? CONSUMER_SOURCES[filename] ?? filename
 }
 
 function did_skip_ai_file_copy(filename: string, shape?: ProjectShape): boolean {
+	if (security_policy.did_skip_unresolved(filename, PROJECT_ROOT)) return false
 	const source_path = package_path(ai_file_source(filename, shape))
 	const destination_path = path.join(PROJECT_ROOT, filename)
 

package/scripts/init/init-copy-content.ts

@@ -5,6 +5,7 @@ import { claude_kit_only_settings } from './claude-kit-only-settings'
 import { claude_plugin_config } from './claude-plugin-config'
 import { hook_command_rewrite } from './hook-command-rewrite'
 import { init_logic } from './init-logic'
+import { security_policy } from './security-policy'
 
 /**
  * The single transform applied to every file kit copies verbatim into a consumer
@@ -29,6 +30,10 @@ import { init_logic } from './init-logic'
  * Keeping both on this one function is the same guarantee as the workflow passes — a copy path that
  * skipped the plugin block would ship a settings file that never enables the plugin, and one that
  * skipped the rewrite would leave every consumer hook slower than it has to be.
+ *
+ * The consumer's `SECURITY.md` gets one further pass: the repository it lands in is filled into the
+ * template, so its advisory and release links name that repository and not kit (see
+ * security-policy.ts).
  */
 function transform_copied_content(destination_path: string, content: string): string {
 	const with_paths = init_logic.transform_distributed_paths(content)
@@ -47,10 +52,12 @@ function transform_copied_content(destination_path: string, content: string): st
 		with_kit_only_stripped,
 	)
 
-	return hook_command_rewrite.apply_hook_command_rewrite_for_destination(
+	const with_hooks = hook_command_rewrite.apply_hook_command_rewrite_for_destination(
 		destination_path,
 		with_plugin,
 	)
+
+	return security_policy.apply_repository_for_destination(destination_path, with_hooks)
 }
 
 export { transform_copied_content }

package/scripts/init/security-policy.ts

@@ -0,0 +1,79 @@
+import path from 'node:path'
+import { repo_origin } from '#scripts/discovery/repo-origin'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
+import { file_reader } from '#scripts/lib/read-file'
+
+// A consumer's `SECURITY.md` is its own policy, not kit's: the advisory and release links have to
+// name the repository the file lands in, and kit's account of its own published package is not a
+// fact about that repository. So the consumer copy is written from a template of its own, with the
+// repository filled in, and kit's root `SECURITY.md` stays kit's.
+const SECURITY_MD = 'SECURITY.md'
+const SECURITY_TEMPLATE = 'templates/SECURITY.md'
+const REPOSITORY_PLACEHOLDER = '{{REPOSITORY}}'
+const KIT_ADVISORY_URL = 'https://github.com/joshuafolkken/kit/security/advisories/new'
+const UNRESOLVED_REASON = '`origin` is not a GitHub repository `owner/repo` can be read from'
+const LINK_DELIMITER = /[\s()<>[\]]+/u
+
+// Read from the local `origin` rather than asked of GitHub: the basic profile decides whether to
+// write the file from the same remote, and a policy file must not depend on `gh` being signed in.
+function repository_at(root: string): string | undefined {
+	const url = git_spawn_sync.origin_url(root)
+	const identity = url === undefined ? undefined : repo_origin.parse_origin_url(url)
+
+	return identity === undefined ? undefined : `${identity.owner}/${identity.repo}`
+}
+
+function apply_repository(content: string, repository: string): string {
+	return content.replaceAll(REPOSITORY_PLACEHOLDER, () => repository)
+}
+
+// Throws rather than writing the placeholder through: both copy paths ask `did_skip_unresolved`
+// first, so reaching here without a repository is a caller that skipped the question.
+function apply_repository_for_destination(destination_path: string, content: string): string {
+	if (path.basename(destination_path) !== SECURITY_MD) return content
+	const repository = repository_at(path.dirname(destination_path))
+
+	if (repository === undefined) {
+		throw new Error(`${SECURITY_MD} needs a GitHub origin to name the repository it reports to`)
+	}
+
+	return apply_repository(content, repository)
+}
+
+// A full project synced before the template existed holds kit's own policy under this name, and the
+// skip leaves that file on disk — still sending its readers to kit's advisory form. The form is
+// matched as a whole link target, not as a substring: a longer address that merely starts with it
+// is another address.
+function does_report_to_kit(root: string): boolean {
+	const existing = file_reader.read_if_readable(path.join(root, SECURITY_MD)) ?? ''
+
+	return new Set(existing.split(LINK_DELIMITER)).has(KIT_ADVISORY_URL)
+}
+
+function unresolved_warning(root: string): string {
+	if (!does_report_to_kit(root)) return `  ⚠ skipped   ${SECURITY_MD} (${UNRESOLVED_REASON})`
+
+	return `  ⚠ stale     ${SECURITY_MD} still reports vulnerabilities to joshuafolkken/kit — replace it with your own policy or delete it (${UNRESOLVED_REASON})`
+}
+
+// Without a GitHub `origin` there is no repository for the advisory link to name, so the file is
+// left unwritten — the next `josh sync` after the remote is added writes it.
+function did_skip_unresolved(filename: string, root: string): boolean {
+	if (filename !== SECURITY_MD || repository_at(root) !== undefined) return false
+
+	console.warn(unresolved_warning(root))
+
+	return true
+}
+
+const security_policy = {
+	SECURITY_MD,
+	SECURITY_TEMPLATE,
+	REPOSITORY_PLACEHOLDER,
+	KIT_ADVISORY_URL,
+	repository_at,
+	apply_repository_for_destination,
+	did_skip_unresolved,
+}
+
+export { security_policy }

package/scripts/josh/josh-commands-maintenance.ts

@@ -80,6 +80,9 @@ const MAINTENANCE_COMMANDS: Record<string, CommandEntry> = {
 		description: 'Update all dependencies to latest',
 		category: 'Maintenance',
 		reference: ['', 'developer', ['files', 'network']],
+		// `JOSH_PLAYWRIGHT_BROWSERS` widens the browsers a Playwright bump installs, and a project
+		// keeps that setting in its `.env`.
+		tsx_arguments: OPTIONAL_ENV_FILE_FLAGS,
 	},
 }
 /* eslint-enable @typescript-eslint/naming-convention */

package/scripts/josh/josh-commands-project.ts

@@ -88,7 +88,7 @@ const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 	},
 	adopt: {
 		script: 'scripts/adopt/adopt.ts',
-		description: 'Upgrade every installed @joshuafolkken toolkit here and open the pull request',
+		description: 'Upgrade the @joshuafolkken toolkits and other dependencies here, open the PR',
 		category: 'Project',
 		reference: ['[--dry-run]', 'developer', ['files', 'git', 'network', 'processes']],
 	},