@joshuafolkken/kit 1.1383.0 → 1.1435.0

package/scripts/init/init-basic.ts

@@ -3,6 +3,7 @@ import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 import { init_logic } from './init-logic'
 import type { ProjectShape } from './project-profile'
+import { workflow_mark } from './workflow-mark'
 
 const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
 const record_schema = z.record(z.string(), z.unknown())
@@ -16,13 +17,17 @@ function initial_manifest(): string {
 	return json_format.format_json({ private: true })
 }
 
-function with_recorded_profile(content: string, profile: ProjectShape['profile']): string {
+function with_recorded_profile(
+	content: string,
+	profile: ProjectShape['profile'],
+	has_workflow = false,
+): string {
 	const parsed: unknown = JSON.parse(content)
 	const manifest = record_schema.parse(parsed)
 	const existing = manifest['josh']
 	const josh = json_value.is_record(existing) ? existing : {}
 
-	manifest['josh'] = { ...josh, profile }
+	manifest['josh'] = { ...josh, profile, ...workflow_mark.recorded_fields(has_workflow) }
 
 	return json_format.format_json(manifest)
 }
@@ -32,7 +37,7 @@ function merge_basic_manifest(
 	shape: ProjectShape,
 	versions: BasicVersions,
 ): string {
-	const with_profile = with_recorded_profile(content, shape.profile)
+	const with_profile = with_recorded_profile(content, shape.profile, shape.has_workflow)
 	const with_script = init_logic.merge_package_scripts(with_profile, {
 		preinstall: init_logic.SAFE_CHAIN_CMD,
 		josh: 'josh',

package/scripts/init/init-logic-toolchain.ts

@@ -0,0 +1,76 @@
+import { parse_jsonc } from '#scripts/config-merge/parse-jsonc'
+import { json_value } from '#scripts/lib/json-value'
+import { init_logic_json_merge } from './init-logic-json-merge'
+import { kit_development_versions } from './kit-development-versions'
+
+// The tools a consumer has to resolve itself, as opposed to the ones only kit's own ESLint config
+// imports. Those are optional kit peers, which pnpm does not install unlisted, so a consumer still
+// needs them — `josh init` writes them, `josh sync` leaves them to it (#3711). A tool belongs here
+// when the consumer runs its bin from the project root (eslint, prettier, tsc, playwright, cspell,
+// lefthook), when a config the consumer owns imports it (`playwright.config.ts` → @playwright/test,
+// @types/node), or when it is named by a string Prettier resolves from the consumer (the preset's
+// plugins). `josh init` and `josh sync` both read this one list, so a tool added here reaches a fresh
+// project and an already-initialized one alike.
+const CONSUMER_RESOLVED_TOOLS = [
+	'eslint',
+	'prettier',
+	'typescript',
+	'@playwright/test',
+	'@ianvs/prettier-plugin-sort-imports',
+	'prettier-plugin-svelte',
+	'prettier-plugin-tailwindcss',
+	'cspell',
+	'@types/node',
+]
+// Only a project with Git gets `lefthook.yml`, so only that one needs the bin.
+const LEFTHOOK_DEVELOPMENT_DEPENDENCY = 'lefthook'
+const DECLARING_FIELDS = [
+	'dependencies',
+	'devDependencies',
+	'peerDependencies',
+	'optionalDependencies',
+]
+
+function consumer_resolved_names(has_git: boolean): ReadonlyArray<string> {
+	return has_git
+		? [...CONSUMER_RESOLVED_TOOLS, LEFTHOOK_DEVELOPMENT_DEPENDENCY]
+		: CONSUMER_RESOLVED_TOOLS
+}
+
+// What `josh init` adds: every kit peer — the ones only kit's own configs import included — and the
+// tools above. Versions mirror kit's own devDependencies, so the consumer runs the toolchain kit is
+// verified with.
+function get_toolchain_development_dependencies(has_git: boolean): Record<string, string> {
+	return kit_development_versions.versions_of([
+		...kit_development_versions.peer_names(),
+		...consumer_resolved_names(has_git),
+	])
+}
+
+function is_declared(manifest: Record<string, unknown>, name: string): boolean {
+	return DECLARING_FIELDS.some((field) => {
+		const dependencies = manifest[field]
+
+		return json_value.is_record(dependencies) && Object.hasOwn(dependencies, name)
+	})
+}
+
+// What `josh sync` adds to an already-initialized consumer: only the tools above, and only the ones
+// the manifest declares nowhere — a tool kept under `dependencies` is present, not missing.
+function merge_consumer_resolved_development_deps(content: string, has_git: boolean): string {
+	const manifest = parse_jsonc(content)
+	const missing = consumer_resolved_names(has_git).filter((name) => !is_declared(manifest, name))
+
+	return init_logic_json_merge.merge_development_dependencies(
+		content,
+		kit_development_versions.versions_of(missing),
+	)
+}
+
+const init_logic_toolchain = {
+	consumer_resolved_names,
+	get_toolchain_development_dependencies,
+	merge_consumer_resolved_development_deps,
+}
+
+export { init_logic_toolchain }

package/scripts/init/init-logic.ts

@@ -7,6 +7,7 @@ import { init_logic_json_merge } from './init-logic-json-merge'
 import { init_logic_secretlint } from './init-logic-secretlint'
 import { init_logic_sonar } from './init-logic-sonar'
 import { init_logic_templates } from './init-logic-templates'
+import { init_logic_toolchain } from './init-logic-toolchain'
 import { init_logic_workspace } from './init-logic-workspace'
 import { init_logic_yaml_merge } from './init-logic-yaml-merge'
 
@@ -417,6 +418,7 @@ const init_logic = {
 	...init_logic_sonar,
 	...init_logic_json_merge,
 	...init_logic_secretlint,
+	...init_logic_toolchain,
 	...init_logic_yaml_merge,
 	...init_logic_deploy_vps,
 	...distributed_paths,

package/scripts/init/init.ts

@@ -23,7 +23,6 @@ import { init_file_action } from './init-file-action'
 import { init_install } from './init-install'
 import { init_logic } from './init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from './init-paths'
-import { kit_development_versions } from './kit-development-versions'
 import { kit_setup_state } from './kit-setup-state'
 import { package_manager_pin } from './package-manager-pin'
 import { project_profile, type ProjectProfile, type ProjectShape } from './project-profile'
@@ -71,27 +70,8 @@ function get_kit_self_dependency(): Record<string, string> {
 	return { [KIT_PACKAGE_NAME]: version }
 }
 
-// Each config `init` generates runs a CLI or imports types the consumer has to resolve itself:
-// `cspell.config.yaml` → cspell, `playwright.config.ts` → @types/node, `lefthook.yml` → lefthook.
-// Prettier, its preset plugins and @playwright/test come in as peers. Without them the first
-// `josh gate` after `pnpm install` fails.
-const TOOL_DEVELOPMENT_DEPENDENCIES = ['cspell', '@types/node']
-const LEFTHOOK_DEVELOPMENT_DEPENDENCY = 'lefthook'
-
-function tool_dependency_names(has_git: boolean): ReadonlyArray<string> {
-	return has_git
-		? [...TOOL_DEVELOPMENT_DEPENDENCIES, LEFTHOOK_DEVELOPMENT_DEPENDENCY]
-		: TOOL_DEVELOPMENT_DEPENDENCIES
-}
-
-// Versions mirror kit's own devDependencies, so the consumer runs the toolchain kit is verified with.
-function get_toolchain_development_dependencies(has_git: boolean): Record<string, string> {
-	return kit_development_versions.versions_of([
-		...kit_development_versions.peer_names(),
-		...tool_dependency_names(has_git),
-	])
-}
-
+// Each config `init` generates runs a CLI or imports types the consumer has to resolve itself, so
+// the toolchain is added here: without it the first `josh gate` after `pnpm install` fails.
 function apply_dependency_merges(content: string, has_git = true): string {
 	const migrated = init_logic.strip_managed_postinstall(content)
 	const suggested = init_logic.get_suggested_scripts_for_content(migrated)
@@ -103,7 +83,7 @@ function apply_dependency_merges(content: string, has_git = true): string {
 	)
 	const with_toolchain = init_logic.merge_development_dependencies(
 		merged,
-		get_toolchain_development_dependencies(has_git),
+		init_logic.get_toolchain_development_dependencies(has_git),
 	)
 	const with_secretlint = init_logic.merge_secretlint_development_deps(with_toolchain)
 
@@ -147,6 +127,7 @@ function merged_manifest(existing: string, shape: ProjectShape): string {
 	return init_basic.with_recorded_profile(
 		apply_package_json_merges(existing, shape.has_git),
 		shape.profile,
+		shape.has_workflow,
 	)
 }
 
@@ -325,6 +306,7 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
 const init = {
 	copy_ai_file: init_ai_copy.copy_ai_file,
 	apply_package_json_merges,
+	merged_manifest,
 	install_lefthook,
 	resolve_kit_package_manager,
 }

package/scripts/init/project-profile.ts

@@ -4,6 +4,8 @@ import { repo_origin } from '#scripts/discovery/repo-origin'
 import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { json_value } from '#scripts/lib/json-value'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
+import { kit_written_paths } from './kit-written-paths'
+import { workflow_mark } from './workflow-mark'
 
 type ProjectProfile = 'basic' | 'full'
 
@@ -17,6 +19,8 @@ interface ProjectShape extends ProfileResult {
 	has_typescript: boolean
 	has_git: boolean
 	has_github: boolean
+	// Set up by `josh start` for the GitHub Issue workflow (`workflow-mark.ts`).
+	has_workflow: boolean
 }
 
 const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', '.svelte-kit'])
@@ -136,18 +140,27 @@ function scan_directory(directory: string, pending: Array<string>): Array<string
 			.map((entry) => path.join(directory, entry.name)),
 	)
 
-	return entries.filter((entry) => entry.isFile()).map((entry) => path.extname(entry.name))
+	return entries.filter((entry) => entry.isFile()).map((entry) => path.join(directory, entry.name))
+}
+
+// A file kit wrote says nothing about the project: counted, the `.pnpmfile.mjs` of the first
+// `josh init` would read as the user's Web file on the second and bring Prettier in
+// (joshuafolkken/kit#3713).
+function is_project_file(root: string, file: string): boolean {
+	const relative_path = path.relative(root, file).split(path.sep).join(path.posix.sep)
+
+	return !kit_written_paths.is_kit_written(relative_path)
 }
 
 function file_extensions(root: string): Array<string> {
 	const pending = [root]
-	const extensions: Array<string> = []
+	const files: Array<string> = []
 
 	for (const directory of pending) {
-		extensions.push(...scan_directory(directory, pending))
+		files.push(...scan_directory(directory, pending))
 	}
 
-	return extensions
+	return files.filter((file) => is_project_file(root, file)).map((file) => path.extname(file))
 }
 
 function scan_files(root: string): { has_web: boolean; has_typescript: boolean } {
@@ -164,17 +177,33 @@ function has_github_remote(root: string): boolean {
 	return url !== undefined && repo_origin.parse_origin_url(url) !== undefined
 }
 
+function has_git(root: string): boolean {
+	return existsSync(path.join(root, '.git'))
+}
+
+// The run is asked first, so a `josh start` whose setup has not written `package.json` yet reads it.
+function has_workflow(root: string): boolean {
+	return workflow_mark.is_requested() || workflow_mark.is_recorded(read_manifest(root))
+}
+
 function inspect_project(root: string, requested?: ProjectProfile): ProjectShape {
 	const profile = resolve_profile(root, requested)
 	const files = scan_files(root)
-	const has_git = existsSync(path.join(root, '.git'))
-
-	return { ...profile, ...files, has_git, has_github: has_git && has_github_remote(root) }
+	const is_git = has_git(root)
+
+	return {
+		...profile,
+		...files,
+		has_git: is_git,
+		has_github: is_git && has_github_remote(root),
+		has_workflow: has_workflow(root),
+	}
 }
 
 const project_profile = {
 	parse_profile,
 	resolve_profile,
+	has_git,
 	inspect_project,
 	requested_profile,
 	with_legacy_profile_names,

package/scripts/init/start-exec.ts

@@ -1,6 +1,6 @@
 import { git_gh_exec } from '#scripts/gh/git-gh-exec'
 import { git_location_environment } from '#scripts/git/git-location-environment'
-import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
+import { git_spawn_sync, type GitSyncOptions } from '#scripts/git/git-spawn-sync'
 import { COMMAND_TIMEOUT_MS, SUITE_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import type { Visibility } from './start-plan'
@@ -16,6 +16,8 @@ import type { Visibility } from './start-plan'
 // project's own commit and push hooks, which may run its whole suite, so it takes the suite budget:
 // long enough for that, short enough that a push that never answers ends the run.
 const SUCCESS_EXIT_CODE = 0
+const GIT_DIRECTORY = '.git'
+const IDENTITY_VARIABLES = ['GIT_AUTHOR_IDENT', 'GIT_COMMITTER_IDENT']
 
 function root_environment(): Record<string, string | undefined> {
 	return git_location_environment.location_free_environment()
@@ -29,6 +31,29 @@ function git_read(args: ReadonlyArray<string>, root: string): string | undefined
 	return git_spawn_sync.read(args, { cwd: root, env: root_environment() })
 }
 
+// Asked of git itself, so the answer is the one its commit would reach: config, the environment and
+// the identity git can detect all count (#3754).
+//
+// **Only an answer from git counts as a missing identity.** A git that could not be started or never
+// answered is a different failure, which the first step that runs git reports as what it is.
+function is_identity_refused(variable: string, options: GitSyncOptions): boolean {
+	const { exit_code } = git_spawn_sync.run(['var', variable], options)
+
+	return exit_code !== undefined && exit_code !== SUCCESS_EXIT_CODE
+}
+
+// A plan that creates the repository asks from where it will be: an identity given per directory
+// (`includeIf "gitdir:…"`) is matched against the git directory, which no `cwd` supplies before
+// `git init` has run. The path stays relative to `root` so git resolves it as its commit will — by
+// the path the user reached the directory through as well as the physical one, which is what a
+// `gitdir:` under a symlinked parent is written against.
+function lacks_git_identity(root: string, is_new_repository: boolean): boolean {
+	const location = is_new_repository ? { GIT_DIR: GIT_DIRECTORY } : {}
+	const options = { cwd: root, env: { ...root_environment(), ...location } }
+
+	return IDENTITY_VARIABLES.some((variable) => is_identity_refused(variable, options))
+}
+
 function git_run(args: ReadonlyArray<string>, root: string): void {
 	const options = { cwd: root, env: root_environment(), timeout: SUITE_TIMEOUT_MS }
 	const { exit_code } = git_spawn_sync.run(args, { ...options, stdio: 'inherit' })
@@ -86,6 +111,7 @@ const start_exec = {
 	git_succeeds,
 	git_read,
 	git_run,
+	lacks_git_identity,
 	is_gh_installed,
 	is_gh_signed_in,
 	create_github_repository,

package/scripts/init/start-plan.ts

@@ -9,6 +9,7 @@ interface StartOptions {
 	is_github: boolean
 	visibility: Visibility
 	init_command: string | undefined
+	push_preflight_command: string | undefined
 }
 
 type StartStep = 'git_init' | 'initialize' | 'commit' | 'repository' | 'labels' | 'setup_pr'
@@ -53,9 +54,13 @@ const STEP_LABELS: Readonly<Record<StartStep, string>> = {
 	setup_pr: 'Open an Issue and a pull request that add the kit setup to main',
 }
 
-// The GitHub write steps `--yes` alone never consents to.
+// The GitHub write steps `--yes` alone never consents to. Each one pushes — main, or the setup branch —
+// so they are also the steps a caller's push preflight guards (#3702).
 const GITHUB_WRITE_STEPS: ReadonlySet<StartStep> = new Set(['repository', 'setup_pr'])
 
+// The steps that create a commit, which git refuses without an author identity (#3754).
+const COMMIT_STEPS: ReadonlySet<StartStep> = new Set(['commit', 'setup_pr'])
+
 function refused(refusal: string): StepPlan {
 	return { steps: [], refusal }
 }
@@ -107,6 +112,14 @@ function plan_steps(state: GitState): StepPlan {
 	return { steps: FULL_STEPS, refusal: undefined }
 }
 
+function has_push(steps: ReadonlyArray<StartStep>): boolean {
+	return steps.some((step) => GITHUB_WRITE_STEPS.has(step))
+}
+
+function has_commit(steps: ReadonlyArray<StartStep>): boolean {
+	return steps.some((step) => COMMIT_STEPS.has(step))
+}
+
 function interaction_of(options: StartOptions, is_tty: boolean): Verdict<Interaction> {
 	if (options.is_yes) return { value: 'unattended', refusal: undefined }
 	if (is_tty) return { value: 'interactive', refusal: undefined }
@@ -126,9 +139,7 @@ function github_consent(
 	options: StartOptions,
 	interaction: Interaction,
 ): Verdict<Consent> {
-	const is_github_write = steps.some((step) => GITHUB_WRITE_STEPS.has(step))
-
-	if (!is_github_write || options.is_github) return { value: 'granted', refusal: undefined }
+	if (!has_push(steps) || options.is_github) return { value: 'granted', refusal: undefined }
 	if (interaction === 'interactive') return { value: 'ask', refusal: undefined }
 
 	return {
@@ -158,6 +169,17 @@ function progress_report(
 	return `josh start stopped at: ${labels[failed]}\nCompleted: ${done}\nCause: ${cause}`
 }
 
+// What a run prints when the caller's push preflight fails: no step has run yet, so nothing changed.
+function preflight_report(command: string, cause: string): string {
+	return `josh start stopped before its first step: the push preflight (${command}) failed. Nothing was changed.\nCause: ${cause}`
+}
+
+// What a run prints when the scanner the pre-push audit needs could not be put in place: every push
+// the plan makes would be refused by that hook, so it stops while nothing has changed (#3755).
+function scanner_report(cause: string): string {
+	return `josh start stopped before its first step: osv-scanner, which the pre-push audit needs, is not installed and could not be fetched. Nothing was changed.\nCause: ${cause}\nInstall osv-scanner (https://google.github.io/osv-scanner/) or restore the network, then run josh start again.`
+}
+
 function plan_summary(
 	steps: ReadonlyArray<StartStep>,
 	labels: Readonly<Record<StartStep, string>> = STEP_LABELS,
@@ -169,9 +191,13 @@ function plan_summary(
 
 const start_plan = {
 	plan_steps,
+	has_push,
+	has_commit,
 	interaction_of,
 	github_consent,
 	progress_report,
+	preflight_report,
+	scanner_report,
 	plan_summary,
 	step_labels,
 	STEP_LABELS,

package/scripts/init/start-steps.ts

@@ -2,6 +2,8 @@ import path from 'node:path'
 import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { error_text } from '#scripts/lib/error-message'
 import { repository_labels } from '#scripts/repo/repository-labels'
+import { security_audit } from '#scripts/security/security-audit'
+import { security_audit_provision } from '#scripts/security/security-audit-provision'
 import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
 import { parseCommandString } from 'execa'
 import { main as init_main } from './init'
@@ -12,12 +14,14 @@ import type { ProjectProfile, ProjectShape } from './project-profile'
 import { start_exec } from './start-exec'
 import { start_plan, type GitState, type StartStep, type Visibility } from './start-plan'
 import { start_setup_pr } from './start-setup-pr'
+import { workflow_mark } from './workflow-mark'
 
 interface StepContext {
 	root: string
 	profile: ProjectProfile
 	visibility: Visibility
 	init_command: string | undefined
+	push_preflight_command: string | undefined
 }
 
 interface RunContext extends StepContext {
@@ -28,6 +32,12 @@ const GH_INSTALL_HINT =
 	'GitHub CLI (gh) is not installed. Install it from https://cli.github.com/, run gh auth login, then run josh start again. Nothing was changed.'
 const GH_AUTH_HINT =
 	'GitHub CLI is not signed in. Run gh auth login, then run josh start again. Nothing was changed.'
+const GIT_IDENTITY_HINT =
+	'Git has no author identity, which the commit josh start creates needs. Run git config --global user.name "Your Name" and git config --global user.email "you@example.com", then run josh start again. Nothing was changed.'
+// Printed before the scanner is looked for: a first run downloads tens of megabytes, and a terminal
+// that says nothing for minutes reads as a hang the user interrupts (#3755).
+const SCANNER_NOTICE =
+	'Checking for osv-scanner, which the pre-push audit needs. A first run downloads it, which can take a few minutes on a slow connection.'
 
 const { git_succeeds, git_read, run_local } = start_exec
 
@@ -62,6 +72,17 @@ function github_cli_refusal(root: string): string | undefined {
 	return undefined
 }
 
+// A machine Git was just installed on has no author identity, and the commit that needs one comes
+// after the repository and kit's files are written. It is asked for before the first write, and only
+// when the plan commits — a re-run with nothing left to commit is not stopped by it (#3754).
+function git_identity_refusal(steps: ReadonlyArray<StartStep>, root: string): string | undefined {
+	if (!start_plan.has_commit(steps)) return undefined
+
+	return start_exec.lacks_git_identity(root, steps.includes('git_init'))
+		? GIT_IDENTITY_HINT
+		: undefined
+}
+
 // `josh init` refuses to run inside the kit source repository by printing and setting the exit code
 // rather than throwing, so its step would pass and the later steps would commit and publish the
 // source repository. The same check is raised before the first write instead.
@@ -69,6 +90,13 @@ function self_run_refusal(root: string): string | undefined {
 	return self_sync_guard.self_sync_refusal(PACKAGE_DIR, root)
 }
 
+// A caller's command line runs without a shell, split the way execa splits one.
+function run_command_line(command_line: string, extra: ReadonlyArray<string>, root: string): void {
+	const [command = '', ...args] = parseCommandString(command_line)
+
+	run_local(command, [...args, ...extra], root)
+}
+
 function create_git_repository(context: StepContext): void {
 	initial_commit.create_repository(context.root)
 }
@@ -77,16 +105,17 @@ function create_git_repository(context: StepContext): void {
 // A toolkit that layers its files over kit's (`josh-app init`) names its own setup instead, so every
 // other step and guard stays here rather than in a copy of this command (#2872). That command runs
 // without a shell, is given the same profile, and a non-zero exit stops the run before the commit.
+// Either one is told the project is set up for the GitHub Issue workflow (`workflow-mark.ts`).
 function initialize(context: StepContext): void {
+	workflow_mark.request()
+
 	if (context.init_command === undefined) {
 		init_main(['--profile', context.profile])
 
 		return
 	}
 
-	const [command = '', ...args] = parseCommandString(context.init_command)
-
-	run_local(command, [...args, '--profile', context.profile], context.root)
+	run_command_line(context.init_command, ['--profile', context.profile], context.root)
 }
 
 function commit_all(context: StepContext): void {
@@ -122,6 +151,47 @@ function baseline_of(
 	return start_setup_pr.changed_paths(context.root)
 }
 
+// A toolkit's own pre-push hook can need something kit knows nothing about (app-kit's needs a Docker
+// daemon), and a push it refuses lands after `gh repo create` has made the repository. So the caller
+// names a check that runs only when the plan pushes, before the first step: a run that does not push
+// is never stopped by it, and one it stops has written nothing (#3702).
+function run_push_preflight(steps: ReadonlyArray<StartStep>, context: StepContext): void {
+	const command_line = context.push_preflight_command
+
+	if (command_line === undefined || !start_plan.has_push(steps)) return
+
+	console.info(`\nPush preflight: ${command_line}`)
+
+	try {
+		run_command_line(command_line, [], context.root)
+	} catch (error) {
+		const cause = error_text.message_of(error)
+
+		throw new Error(start_plan.preflight_report(command_line, cause), { cause: error })
+	}
+}
+
+// The `full` profile installs kit's pre-push hook, whose audit refuses a push without osv-scanner. The
+// scanner is otherwise fetched at an agent's session start, which a first `josh start` from a terminal
+// has not had, so it is fetched here — forced, because a person asked for this run. A scanner that
+// still cannot be found stops the run before the first step rather than at the push (#3755).
+async function ensure_audit_scanner(
+	steps: ReadonlyArray<StartStep>,
+	context: StepContext,
+): Promise<void> {
+	if (context.profile !== 'full' || !start_plan.has_push(steps)) return
+
+	const { platform, arch } = process
+
+	console.info(`\n${SCANNER_NOTICE}`)
+	const outcome = await security_audit_provision.report(context.root, platform, arch, true)
+
+	console.info(outcome)
+	if (security_audit.resolve_scanner(context.root, platform) !== undefined) return
+
+	throw new Error(start_plan.scanner_report(outcome))
+}
+
 type StepAction = (context: RunContext) => void | Promise<void>
 
 const STEP_ACTIONS: Readonly<Record<StartStep, StepAction>> = {
@@ -150,6 +220,9 @@ async function run_step(
 
 async function run_steps(steps: ReadonlyArray<StartStep>, context: StepContext): Promise<void> {
 	const labels = start_plan.step_labels(context.init_command)
+
+	run_push_preflight(steps, context)
+	await ensure_audit_scanner(steps, context)
 	const run_context: RunContext = { ...context, baseline: baseline_of(steps, context) }
 
 	for (const [index, step] of steps.entries()) {
@@ -164,6 +237,7 @@ async function run_steps(steps: ReadonlyArray<StartStep>, context: StepContext):
 const start_steps = {
 	read_git_state,
 	github_cli_refusal,
+	git_identity_refusal,
 	self_run_refusal,
 	run_steps,
 }

package/scripts/init/start.ts

@@ -15,8 +15,9 @@ import { start_steps } from './start-steps'
 const ARGUMENT_START_INDEX = 2
 const READY_MESSAGE = 'GitHub workflow ready. Use kickoff new in your assistant to plan an Issue.'
 const START_USAGE =
-	'josh start [--profile basic|full] [--yes] [--github] [--public] [--init-command <command>]'
+	'josh start [--profile basic|full] [--yes] [--github] [--public] [--init-command <command>] [--push-preflight-command <command>]'
 const INIT_COMMAND_FLAG = '--init-command'
+const PUSH_PREFLIGHT_COMMAND_FLAG = '--push-preflight-command'
 const YES_FLAG = '--yes'
 const GITHUB_FLAG = '--github'
 const PUBLIC_FLAG = '--public'
@@ -28,34 +29,38 @@ interface Prepared {
 	choices: Choices
 }
 
-interface InitCommandSplit {
-	init_command: string | undefined
+interface CommandSplit {
+	command: string | undefined
 	rest: ReadonlyArray<string>
 }
 
 // A value that is blank or another flag means the command itself was left out, which would otherwise
-// swallow the next switch or hand the initialize step nothing to run.
+// swallow the next switch or hand its step nothing to run.
 function is_command_value(value: string | undefined): value is string {
 	return value !== undefined && value.trim() !== '' && !value.startsWith('-')
 }
 
 // The command arrives as the one argument after its flag and is removed together with it.
-function split_init_command(args: ReadonlyArray<string>): InitCommandSplit {
-	const index = args.indexOf(INIT_COMMAND_FLAG)
+function split_command(args: ReadonlyArray<string>, flag: string): CommandSplit {
+	const index = args.indexOf(flag)
 
-	if (index === -1) return { init_command: undefined, rest: args }
+	if (index === -1) return { command: undefined, rest: args }
 
 	const value = args[index + 1]
 
 	if (!is_command_value(value)) throw new Error(`Usage: ${START_USAGE}`)
 
-	return { init_command: value, rest: args.filter((_, at) => at !== index && at !== index + 1) }
+	return { command: value, rest: args.filter((_, at) => at !== index && at !== index + 1) }
 }
 
-// The switches and the initialize command are peeled off first, so what remains is exactly the
+// The switches and the caller's commands are peeled off first, so what remains is exactly the
 // `--profile` pair `josh init` accepts — one parser for the profile in both commands.
 function parse_start_options(args: ReadonlyArray<string>): StartOptions {
-	const { init_command, rest } = split_init_command(args)
+	const init = split_command(args, INIT_COMMAND_FLAG)
+	const { command: push_preflight_command, rest } = split_command(
+		init.rest,
+		PUSH_PREFLIGHT_COMMAND_FLAG,
+	)
 	const profile_args = rest.filter((argument) => !SWITCHES.has(argument))
 
 	return {
@@ -63,7 +68,8 @@ function parse_start_options(args: ReadonlyArray<string>): StartOptions {
 		is_yes: rest.includes(YES_FLAG),
 		is_github: rest.includes(GITHUB_FLAG),
 		visibility: rest.includes(PUBLIC_FLAG) ? 'public' : 'private',
-		init_command,
+		init_command: init.command,
+		push_preflight_command,
 	}
 }
 
@@ -100,6 +106,7 @@ function prepare(args: ReadonlyArray<string>, is_tty: boolean, root: string): Pr
 	const consent: Consent = settle(start_plan.github_consent(plan.steps, options, interaction))
 
 	stop_on(start_steps.github_cli_refusal(root))
+	stop_on(start_steps.git_identity_refusal(plan.steps, root))
 
 	return {
 		steps: plan.steps,
@@ -112,12 +119,13 @@ async function main(args: ReadonlyArray<string>, is_tty: boolean): Promise<void>
 	const { steps, interaction, choices } = prepare(args, is_tty, process.cwd())
 
 	const { root, options } = choices
-	const { visibility, init_command } = options
+	const { visibility, init_command, push_preflight_command } = options
 
 	console.info(start_plan.plan_summary(steps, start_plan.step_labels(init_command)))
 	const profile = await resolve_profile(choices, interaction)
+	const context = { root, profile, visibility, init_command, push_preflight_command }
 
-	await start_steps.run_steps(steps, { root, profile, visibility, init_command })
+	await start_steps.run_steps(steps, context)
 	console.info(`\n${READY_MESSAGE}`)
 }