@joshuafolkken/kit 1.1387.0 → 1.1435.0

package/scripts/sync/claude-settings-merge.ts

@@ -0,0 +1,144 @@
+import { json_format } from '#scripts/config-merge/json-format'
+import { hook_command_rewrite } from '#scripts/init/hook-command-rewrite'
+
+// `josh sync` used to replace a project's `.claude/settings.json` with the distributed file, which
+// deleted every hook and permission the project had added — and `.claude/settings.local.json` is
+// personal, so a team had nowhere to keep a shared one. The merge replaces what kit ships and keeps
+// the rest:
+//
+//  - hooks: a handler whose command has one of kit's shapes is kit's — the current ones are replaced
+//    and a retired one is dropped; every other handler is the project's and stays.
+//  - permissions: kit's `allow` / `deny` entries are always present, so a removed `deny` comes back;
+//    the project's own entries follow them, less the ones kit has withdrawn.
+//  - any other key: kit's value where kit ships one, the project's where it does not. Objects merge
+//    entry by entry, so a project's own `env` variable or plugin survives beside kit's.
+//
+// kit's keys and entries come first and in kit's order, which is what makes a file with nothing of the
+// project's own come out byte-identical to the distributed one, and a second merge change nothing.
+
+type JsonObject = Record<string, unknown>
+type EntryMerge = (key: string, kit: unknown, own: unknown) => unknown
+
+const HOOKS_KEY = 'hooks'
+const PERMISSIONS_KEY = 'permissions'
+// An entry kit stops shipping would otherwise stay in every merged file as if the project had added
+// it, so a permission kit withdraws could never be withdrawn. Withdrawing one means removing it from
+// kit's settings file and naming it here.
+const WITHDRAWN_KIT_PERMISSIONS: ReadonlySet<unknown> = new Set([
+	'Bash(git commit -a*)',
+	'Bash(git commit --all*)',
+])
+
+function is_json_object(value: unknown): value is JsonObject {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function as_array(value: unknown): Array<unknown> {
+	return Array.isArray(value) ? value : []
+}
+
+function merge_objects(kit: JsonObject, own: JsonObject, merge_entry: EntryMerge): JsonObject {
+	const merged: JsonObject = { ...kit, ...own }
+
+	for (const [key, value] of Object.entries(kit)) merged[key] = merge_entry(key, value, own[key])
+
+	return merged
+}
+
+function merge_kit_value(kit: unknown, own: unknown): unknown {
+	if (!is_json_object(kit) || !is_json_object(own)) return kit
+
+	return merge_objects(kit, own, (_key, kit_entry, own_entry) =>
+		merge_kit_value(kit_entry, own_entry),
+	)
+}
+
+function merge_permission(kit: unknown, own: unknown): unknown {
+	if (!Array.isArray(kit) || !Array.isArray(own)) return merge_kit_value(kit, own)
+
+	return [...new Set([...as_array(kit), ...as_array(own)])]
+}
+
+function without_withdrawn(value: unknown): unknown {
+	if (!Array.isArray(value)) return value
+
+	return value.filter((entry) => !WITHDRAWN_KIT_PERMISSIONS.has(entry))
+}
+
+// The withdrawn entries are taken out of every list first, so one goes even when kit no longer ships
+// the list it sat in.
+function merge_permissions(kit: unknown, own: unknown): unknown {
+	if (!is_json_object(kit) || !is_json_object(own)) return kit
+	const kept = Object.entries(own).map(([key, value]) => [key, without_withdrawn(value)] as const)
+
+	return merge_objects(kit, Object.fromEntries(kept), (_key, kit_entry, own_entry) =>
+		merge_permission(kit_entry, own_entry),
+	)
+}
+
+function is_kit_handler(handler: unknown): boolean {
+	if (!is_json_object(handler)) return false
+	const { command } = handler
+
+	return typeof command === 'string' && hook_command_rewrite.is_kit_hook_command(command)
+}
+
+// A matcher group left with no handler of the project's own was kit's alone, and goes with them.
+function without_kit_handlers(group: unknown): unknown {
+	if (!is_json_object(group)) return group
+	const handlers = as_array(group[HOOKS_KEY]).filter((handler) => !is_kit_handler(handler))
+
+	return handlers.length === 0 ? undefined : { ...group, [HOOKS_KEY]: handlers }
+}
+
+function own_groups(groups: unknown): Array<unknown> {
+	return as_array(groups)
+		.map((group) => without_kit_handlers(group))
+		.filter((group) => group !== undefined)
+}
+
+function own_hook_events(own: JsonObject): JsonObject {
+	const events = Object.entries(own).map(([event, groups]) => [event, own_groups(groups)] as const)
+
+	return Object.fromEntries(events.filter(([, groups]) => groups.length > 0))
+}
+
+function merge_hooks(kit: unknown, own: unknown): unknown {
+	if (!is_json_object(kit) || !is_json_object(own)) return kit
+
+	return merge_objects(kit, own_hook_events(own), (_event, kit_groups, groups) => [
+		...as_array(kit_groups),
+		...as_array(groups),
+	])
+}
+
+function merge_top_level(key: string, kit: unknown, own: unknown): unknown {
+	if (key === HOOKS_KEY) return merge_hooks(kit, own)
+	if (key === PERMISSIONS_KEY) return merge_permissions(kit, own)
+
+	return merge_kit_value(kit, own)
+}
+
+function parse_object(content: string): JsonObject | undefined {
+	try {
+		const parsed: unknown = JSON.parse(content)
+
+		return is_json_object(parsed) ? parsed : undefined
+	} catch {
+		return undefined
+	}
+}
+
+// A file that does not parse as a JSON object has nothing the merge can keep, so it is replaced with
+// the distributed one, as every file was before the merge existed.
+function merge_claude_settings(existing: string, distributed: string): string {
+	const own = parse_object(existing)
+	const kit = parse_object(distributed)
+	if (own === undefined || kit === undefined) return distributed
+
+	return json_format.format_json(merge_objects(kit, own, merge_top_level))
+}
+
+const claude_settings_merge = { merge_claude_settings, WITHDRAWN_KIT_PERMISSIONS }
+
+export { claude_settings_merge }

package/scripts/sync/sync-ai-files.ts

@@ -8,6 +8,7 @@ import type { ProjectShape } from '#scripts/init/project-profile'
 import { security_policy } from '#scripts/init/security-policy'
 import { file_reader } from '#scripts/lib/read-file'
 import { pack_hook } from '#scripts/safe-chain/pack-hook'
+import { claude_settings_merge } from './claude-settings-merge'
 import { copy_directory_failure, directory_copy_blocker } from './directory-copy-guard'
 import { file_content } from './file-content'
 import { REMOVED_SKILL_MANIFEST } from './removed-skill-manifest'
@@ -45,9 +46,32 @@ function should_skip_hook_file(filename: string): boolean {
 	return true
 }
 
-function sync_file(source: string, filename: string): void {
+// The project's own hooks, permissions and keys survive: only kit's entries are replaced
+// (`claude-settings-merge.ts`). `--force` is the replacement sync used to make, as it is for
+// `pnpm-workspace.yaml`.
+function sync_claude_settings(
+	source_path: string,
+	destination_path: string,
+	is_force: boolean,
+): boolean {
+	const distributed = transform_copied_content(destination_path, readFileSync(source_path, 'utf8'))
+	const existing = is_force ? undefined : file_reader.read_optional(destination_path)
+	const content =
+		existing === undefined
+			? distributed
+			: claude_settings_merge.merge_claude_settings(existing, distributed)
+
+	return file_content.write_text_if_changed(destination_path, content)
+}
+
+function sync_file(source: string, filename: string, is_force: boolean): void {
 	if (should_skip_hook_file(filename)) return
-	const did_change = sync_ai_file(path.join(PACKAGE_DIR, source), path.join(PROJECT_ROOT, filename))
+	const source_path = path.join(PACKAGE_DIR, source)
+	const destination_path = path.join(PROJECT_ROOT, filename)
+	const did_change =
+		filename === CLAUDE_SETTINGS_FILE
+			? sync_claude_settings(source_path, destination_path, is_force)
+			: sync_ai_file(source_path, destination_path)
 
 	console.info(`  ✔ ${did_change ? 'synced   ' : 'unchanged'} ${filename}`)
 }
@@ -96,7 +120,7 @@ function sync_ai_copy_file(filename: string, is_force: boolean, shape?: ProjectS
 		return
 	}
 
-	sync_file(source, filename)
+	sync_file(source, filename, is_force)
 }
 
 // The reason this directory was not synced, or nothing when it was. Both halves answer the same
@@ -203,6 +227,7 @@ const sync_ai_files = {
 	sync_ai_file,
 	sync_workspace_yaml,
 	sync_claude_md,
+	ensured_claude_md,
 	sync_directory,
 	sync_ai_copy_all,
 }

package/scripts/sync/sync.ts

@@ -192,6 +192,19 @@ function sync_secretlint_development_deps(destination_path: string): void {
 	)
 }
 
+// A tool `josh init` started adding after a consumer was initialized never reached it: `lefthook.yml`
+// was synced, the lefthook that runs it was not. Only the tools the consumer resolves itself are
+// added, and only where the manifest declares them nowhere; an existing range is left as it is.
+function sync_consumer_resolved_development_deps(destination_path: string): void {
+	const has_git = project_profile.has_git(path.dirname(destination_path))
+
+	sync_package_json_with(
+		destination_path,
+		(existing) => init_logic.merge_consumer_resolved_development_deps(existing, has_git),
+		'  ✔ synced    toolchain devDependencies (run `pnpm install`)',
+	)
+}
+
 // `lefthook install` fails silently when `core.hooksPath` is set, leaving a consumer with no hooks
 // and no message. `josh init` rewrites the clause it wrote so the failure
 // is reported; this covers everyone already initialized, who never re-runs `josh init`.
@@ -219,6 +232,7 @@ function sync_package_json_migrations(destination_path: string): void {
 	sync_package_manager_version(destination_path)
 	sync_package_manager_on_fail(destination_path)
 	sync_secretlint_development_deps(destination_path)
+	sync_consumer_resolved_development_deps(destination_path)
 	sync_prepare_lefthook_warning(destination_path)
 	sync_safe_chain_preinstall(destination_path)
 }
@@ -300,6 +314,7 @@ const sync = {
 	sync_package_manager_version,
 	sync_package_manager_on_fail,
 	sync_secretlint_development_deps,
+	sync_consumer_resolved_development_deps,
 	sync_prepare_lefthook_warning,
 	sync_safe_chain_preinstall,
 	sync_package_json_migrations,

package/scripts/test/project-test-script.ts

@@ -0,0 +1,73 @@
+import { project_checks } from '#scripts/gate/project-checks'
+import { json_value } from '#scripts/lib/json-value'
+import { execa } from 'execa'
+
+// **The unit check of a basic project that carries no vitest is the test script the project itself
+// declares** — `scripts.test` in its `package.json`. A basic project is one of any language and any
+// runner (`node --test`, jest, mocha, a wrapper around another language's), and its own script is the one statement of
+// how its tests run that holds for all of them.
+//
+// Rejected: detecting `node --test` files and starting that runner here. Every further runner would
+// need its own detection and its own invocation, and the project has already written both down.
+const PNPM = 'pnpm'
+const SCRIPT_NAME = 'test'
+const FAIL_EXIT_CODE = 1
+
+// What `npm init` and `pnpm init` write when no test command is given. It exits 1 by design, so
+// running it would fail every freshly-initialized project for having declared nothing.
+const INIT_PLACEHOLDER = 'echo "Error: no test specified" && exit 1'
+
+// Set on the script this module spawns. A `scripts.test` that calls back into josh (`josh test:unit`,
+// `josh gate`) reaches this check again with it set, and running the script from there would recurse
+// without end.
+const REENTRY_KEY = 'JOSH_PROJECT_TEST_SCRIPT'
+const REENTRY_VALUE = '1'
+
+type ProjectScriptState = 'declared' | 'absent' | 'reentrant'
+
+const EMPTY_COMMANDS = new Set(['', INIT_PLACEHOLDER])
+
+function field_of(value: unknown, key: string): unknown {
+	return json_value.is_record(value) ? value[key] : undefined
+}
+
+function declared_script(project_directory: string): string | undefined {
+	const manifest: unknown = project_checks.read_manifest(project_directory)
+	const script = field_of(field_of(manifest, 'scripts'), SCRIPT_NAME)
+	if (typeof script !== 'string') return undefined
+
+	const command = script.trim()
+
+	return EMPTY_COMMANDS.has(command) ? undefined : command
+}
+
+function state(
+	project_directory: string,
+	environment: NodeJS.ProcessEnv = process.env,
+): ProjectScriptState {
+	if (declared_script(project_directory) === undefined) return 'absent'
+
+	return environment[REENTRY_KEY] === REENTRY_VALUE ? 'reentrant' : 'declared'
+}
+
+// The notice is printed before the spawn, so a reader of the gate's output sees which command stood in
+// for vitest rather than a bare runner log under the `test:unit` label.
+async function run(project_directory: string, command_label: string): Promise<number> {
+	console.info(
+		`josh ${command_label}: vitest is not installed — running the project's own test script (${PNPM} run ${SCRIPT_NAME}).`,
+	)
+
+	const result = await execa(PNPM, ['run', SCRIPT_NAME], {
+		cwd: project_checks.project_root(project_directory),
+		env: { [REENTRY_KEY]: REENTRY_VALUE },
+		stdio: 'inherit',
+		reject: false,
+	})
+
+	return result.exitCode ?? FAIL_EXIT_CODE
+}
+
+const project_test_script = { INIT_PLACEHOLDER, REENTRY_KEY, declared_script, state, run }
+
+export type { ProjectScriptState }
+export { project_test_script }

package/scripts/test/skip-marker.ts

@@ -1,3 +1,16 @@
 const SKIP_MARKER = '— skipping'
 
-export { SKIP_MARKER }
+// **A check that ran and had nothing of the project's to look at says so with this, not with the skip
+// marker.** `josh exports:unused` in a consumer and `josh behavior` with no transcript are out of scope
+// by design rather than unverified, so they must not withhold the gate's green record the way a skip
+// does — but neither checked anything, and the gate's verdict has to be able to tell them from a check
+// that did. Shared for the reason the skip marker is: the notice and its reader cannot drift apart.
+const NOTHING_TO_CHECK_MARKER = 'nothing to check'
+
+// **A skip of a tool the project does not use carries this beside the skip marker.** A `basic`
+// project with no ESLint configuration skips eslint, and the notice stays a visible skip the verdict
+// counts — but nothing the project asked for went unverified, so it must not withhold the gate's
+// green record the way a unit suite that did not run does.
+const NOT_USED_MARKER = 'which this project does not use'
+
+export { NOT_USED_MARKER, NOTHING_TO_CHECK_MARKER, SKIP_MARKER }

package/scripts/test/test-related.ts

@@ -22,11 +22,12 @@ import { test_unit_guard } from './test-unit-guard'
 // project with no unit suite the record would say the tests were green over a run in which none
 // executed, and `josh review:brief` would stop refusing on the strength of it. **The guard's own
 // decision is asked again rather than re-derived here**, so the two can never disagree; it is asked
-// only when a record is otherwise due, since the question costs a project-wide glob.
+// only when a record is otherwise due, since the question costs a project-wide glob. A basic project's
+// own test script counts as a run: it executes the whole suite, which covers any narrowing.
 function conclusive_tree(before: GateTree | undefined): GateTree | undefined {
 	if (before === undefined) return undefined
 
-	return test_unit_guard.guard_action(process.cwd()) === 'run' ? before : undefined
+	return test_unit_guard.is_running(process.cwd()) ? before : undefined
 }
 
 async function run_related_tests(command_arguments: ReadonlyArray<string>): Promise<number> {

package/scripts/test/test-unit-guard.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { PROJECT_ENVIRONMENT_KEYS } from '#ports'
 import { project_checks } from '#scripts/gate/project-checks'
 import { execa } from 'execa'
+import { project_test_script, type ProjectScriptState } from './project-test-script'
 import { SKIP_MARKER } from './skip-marker'
 import { unit_worker_share } from './unit-worker-share'
 
@@ -35,29 +36,71 @@ const NODE_MODULES = 'node_modules'
 // oversight.** The argument above rests on the package's presence being a declaration, and
 // `@playwright/test` is not one: it is an optional peer dependency that vitest's browser mode also
 // needs, so a project can legitimately have it installed with no `*.e2e.{ts,js}` file at all.
+//
+// **A basic project without vitest is not thereby a project without tests.** It may be of any
+// language and any runner, and the `scripts.test` it declares is run in vitest's place
+// (`project-test-script.ts`); only a basic project that declares none skips. A full project keeps the
+// plain skip: its unit suite is vitest's, and `scripts.test` there is not this check's to run.
 const SKIP_ACTION = 'skip-missing-package'
 const SKIP_NO_TESTS_ACTION = 'skip-no-tests'
+const SKIP_NO_SCRIPT_ACTION = 'skip-no-test-script'
+const SKIP_REENTRANT_ACTION = 'skip-reentrant'
+const RUN_SCRIPT_ACTION = 'run-project-script'
 const FAIL_ACTION = 'fail-no-tests'
 
-type GuardAction = 'run' | typeof SKIP_ACTION | typeof SKIP_NO_TESTS_ACTION | typeof FAIL_ACTION
-
-// The word the gate looks for to know a passing step did not actually run. Exported and reused on
-// both sides rather than matched by eye: the gate does not print a passing check's body, so without
-// this a gate that skipped the whole unit suite would print the same lines as one that ran it.
-const SKIP_REASON = 'vitest is not installed'
-const SKIP_NO_TESTS_REASON = 'no unit test files were found in this basic project'
+type SkipAction =
+	| typeof SKIP_ACTION
+	| typeof SKIP_NO_TESTS_ACTION
+	| typeof SKIP_NO_SCRIPT_ACTION
+	| typeof SKIP_REENTRANT_ACTION
+type GuardAction = 'run' | typeof RUN_SCRIPT_ACTION | SkipAction | typeof FAIL_ACTION
+
+// What each skip did not run, said in full: a basic project that declares no test script was not
+// skipped for lacking vitest alone, and the unit tests it skipped were never vitest's. The
+// `SKIP_MARKER` between the two halves is the word the gate looks for to know a passing step did not
+// actually run; the gate does not print a passing check's body, so without it a gate that skipped the
+// whole unit suite would print the same lines as one that ran it.
+const VITEST_SUBJECT = 'vitest unit tests'
+const UNIT_SUBJECT = 'unit tests'
+const SKIP_NOTICES: Record<SkipAction, { reason: string; subject: string }> = {
+	[SKIP_ACTION]: { reason: 'vitest is not installed', subject: VITEST_SUBJECT },
+	[SKIP_NO_TESTS_ACTION]: {
+		reason: 'no unit test files were found in this basic project',
+		subject: VITEST_SUBJECT,
+	},
+	[SKIP_NO_SCRIPT_ACTION]: {
+		reason: 'vitest is not installed and package.json declares no test script',
+		subject: UNIT_SUBJECT,
+	},
+	[SKIP_REENTRANT_ACTION]: {
+		reason: "the project's test script called back into this check",
+		subject: UNIT_SUBJECT,
+	},
+}
 const FAIL_REASON =
 	'vitest is installed but no *.{test,spec}.{ts,js} test file was found — refusing to report a unit check that ran nothing'
 
+const BASIC_MISSING_PACKAGE_ACTIONS: Record<ProjectScriptState, GuardAction> = {
+	declared: RUN_SCRIPT_ACTION,
+	absent: SKIP_NO_SCRIPT_ACTION,
+	reentrant: SKIP_REENTRANT_ACTION,
+}
+
+function resolve_installed_action(has_tests: boolean, is_basic: boolean): GuardAction {
+	if (has_tests) return 'run'
+
+	return is_basic ? SKIP_NO_TESTS_ACTION : FAIL_ACTION
+}
+
 function resolve_guard_action(
 	is_installed: boolean,
 	has_tests: boolean,
 	is_basic = false,
+	script_state: ProjectScriptState = 'absent',
 ): GuardAction {
-	if (!is_installed) return SKIP_ACTION
-	if (has_tests) return 'run'
+	if (is_installed) return resolve_installed_action(has_tests, is_basic)
 
-	return is_basic ? SKIP_NO_TESTS_ACTION : FAIL_ACTION
+	return is_basic ? BASIC_MISSING_PACKAGE_ACTIONS[script_state] : SKIP_ACTION
 }
 
 function is_vitest_installed(project_directory: string): boolean {
@@ -84,15 +127,27 @@ function guard_action(project_directory: string): GuardAction {
 		is_vitest_installed(project_directory),
 		has_unit_tests(project_directory),
 		project_checks.is_basic(project_directory),
+		project_test_script.state(project_directory),
 	)
 }
 
+function is_skip_action(action: GuardAction): action is SkipAction {
+	return Object.hasOwn(SKIP_NOTICES, action)
+}
+
 // **A skip is the project having no unit suite, so no unit check can ever vouch for its tree.** The
 // failing branch is not one: it is a broken suite, and it is left to fail where it is reported.
 function is_skipping(project_directory: string): boolean {
+	return is_skip_action(guard_action(project_directory))
+}
+
+// **Whether a green exit vouches for the tree** — vitest ran, or the project's own script did. The
+// scoped record is written on this answer, so a project `is_skipping` requires a record from is
+// always one that can write it.
+function is_running(project_directory: string): boolean {
 	const action = guard_action(project_directory)
 
-	return action === SKIP_ACTION || action === SKIP_NO_TESTS_ACTION
+	return action === 'run' || action === RUN_SCRIPT_ACTION
 }
 
 // A lane's port allocation belongs to its development and preview servers, not to unit fixtures.
@@ -146,16 +201,16 @@ const UNIT_COMMAND_LABEL = 'test:unit'
 // they mean different things: one says the project has no unit suite yet, the other says it has one
 // that could not be found. Only the first keeps `SKIP_MARKER`, so the
 // gate's "passed without running" handling still means exactly what it did.
-function report_no_run(action: Exclude<GuardAction, 'run'>, command_label: string): number {
+function report_no_run(action: SkipAction | typeof FAIL_ACTION, command_label: string): number {
 	if (action === FAIL_ACTION) {
 		console.error(`josh ${command_label}: ${FAIL_REASON}.`)
 
 		return FAIL_EXIT_CODE
 	}
 
-	const reason = action === SKIP_NO_TESTS_ACTION ? SKIP_NO_TESTS_REASON : SKIP_REASON
+	const { reason, subject } = SKIP_NOTICES[action]
 
-	console.info(`josh ${command_label}: ${reason} ${SKIP_MARKER} vitest unit tests.`)
+	console.info(`josh ${command_label}: ${reason} ${SKIP_MARKER} ${subject}.`)
 
 	return 0
 }
@@ -163,6 +218,10 @@ function report_no_run(action: Exclude<GuardAction, 'run'>, command_label: strin
 // `announcement` is printed only on the branch that actually spawns vitest. A caller that wrote it
 // itself would claim a run before this guard had decided there would be one — the same "a passing
 // step did not actually run" ambiguity `SKIP_MARKER` exists for, reintroduced one layer up.
+//
+// **The project's own script takes neither the vitest arguments nor the announcement.** Both describe
+// a vitest run — a filter, a narrowing to related files — and the script runs as the project declared
+// it, whole; it prints its own notice saying so.
 async function run_guarded_vitest(
 	project_directory: string,
 	vitest_arguments: ReadonlyArray<string>,
@@ -171,6 +230,10 @@ async function run_guarded_vitest(
 ): Promise<number> {
 	const action = guard_action(project_directory)
 
+	if (action === RUN_SCRIPT_ACTION) {
+		return await project_test_script.run(project_directory, command_label)
+	}
+
 	if (action !== 'run') return report_no_run(action, command_label)
 	if (announcement !== undefined) process.stdout.write(`${announcement}\n`)
 
@@ -195,6 +258,7 @@ const test_unit_guard = {
 	SKIP_MARKER,
 	guard_action,
 	is_skipping,
+	is_running,
 	resolve_guard_action,
 	is_vitest_installed,
 	has_unit_tests,

package/scripts/time-runtime/time-reported-failure.ts

@@ -112,8 +112,16 @@ function is_failed_verdict(line: string): boolean {
 	return josh_verdict.read_verdict(line) === josh_verdict.FAILED_VERDICT
 }
 
-function is_passed_verdict(line: string): boolean {
-	return josh_verdict.read_verdict(line) === josh_verdict.PASSED_VERDICT
+// **A gate that ran no check closes its region exactly as a passed one does.** Its `not verified`
+// verdict is still the gate's own statement that no check failed, so a failure mark a skip notice
+// forwarded in front of it is no more the gate's than one in front of `passed`.
+const GREEN_VERDICTS: ReadonlySet<string | undefined> = new Set([
+	josh_verdict.PASSED_VERDICT,
+	josh_verdict.UNVERIFIED_VERDICT,
+])
+
+function is_green_verdict(line: string): boolean {
+	return GREEN_VERDICTS.has(josh_verdict.read_verdict(line))
 }
 
 // What one pass over the body has established. The two failure buckets are kept apart because a
@@ -165,7 +173,7 @@ function note_failure(scan: FailureScan): void {
 // anything about the region: it is the gate's report about one check, and the run it belongs to states
 // a failed verdict of its own.
 function scan_line(scan: FailureScan, line: string): void {
-	if (is_passed_verdict(line)) {
+	if (is_green_verdict(line)) {
 		close_region(scan)
 
 		return

package/scripts/uninstall/distributed-files.ts

@@ -0,0 +1,92 @@
+import path from 'node:path'
+import { init } from '#scripts/init/init'
+import { init_actions } from '#scripts/init/init-actions'
+import { CLAUDE_MD_FILENAME, init_ai_copy, WORKSPACE_YAML } from '#scripts/init/init-ai-copy'
+import { init_basic } from '#scripts/init/init-basic'
+import { package_path, PROJECT_ROOT } from '#scripts/init/init-paths'
+import type { ProjectProfile, ProjectShape } from '#scripts/init/project-profile'
+import { file_reader } from '#scripts/lib/read-file'
+import { PACK_HOOK_FILE } from '#scripts/safe-chain/pack-hook'
+import { sync_ai_files } from '#scripts/sync/sync-ai-files'
+import { IGNORE_FILE, type DistributedFile } from './uninstall-plan'
+
+// Every file the profile can write, whatever the project looks like today: a project that has since
+// lost its last web file still holds the Prettier config kit wrote while it had one. Asking for the
+// widest shape is safe because a file is only ever deleted while it equals what kit writes.
+function widest_shape(profile: ProjectProfile): ProjectShape {
+	return {
+		profile,
+		reason: 'josh uninstall',
+		has_web: true,
+		has_typescript: true,
+		has_git: true,
+		has_github: true,
+		has_workflow: true,
+	}
+}
+
+// Some content names the repository it lands in and cannot be produced where there is none. Such a
+// file has no known distribution content, so it is kept.
+function content_or_unknown(produce: () => string): string | undefined {
+	try {
+		return produce()
+	} catch {
+		return undefined
+	}
+}
+
+function config_files(shape: ProjectShape): Array<DistributedFile> {
+	return init_actions.build_file_actions(shape).map((action) => ({
+		dest: action.dest,
+		distributed: content_or_unknown(() => action.create()),
+	}))
+}
+
+function copied_file(filename: string, shape: ProjectShape): DistributedFile {
+	const source_path = package_path(init_ai_copy.ai_file_source(filename, shape))
+	const destination_path = path.join(PROJECT_ROOT, filename)
+	const read_content =
+		filename === WORKSPACE_YAML ? init_ai_copy.workspace_content : init_ai_copy.copied_content
+
+	return {
+		dest: filename,
+		distributed: content_or_unknown(() => read_content(source_path, destination_path)),
+	}
+}
+
+function mapped_file(source: string, destination: string): DistributedFile {
+	return {
+		dest: destination,
+		distributed: content_or_unknown(() =>
+			init_ai_copy.copied_content(package_path(source), path.join(PROJECT_ROOT, destination)),
+		),
+	}
+}
+
+function ai_files(shape: ProjectShape): Array<DistributedFile> {
+	return [
+		{ dest: CLAUDE_MD_FILENAME, distributed: sync_ai_files.ensured_claude_md(undefined, shape) },
+		...init_ai_copy.ai_files(shape).map((filename) => copied_file(filename, shape)),
+		...init_ai_copy.ai_file_mappings(shape).map(({ src, dest }) => mapped_file(src, dest)),
+		{ dest: PACK_HOOK_FILE, distributed: file_reader.read_optional(package_path(PACK_HOOK_FILE)) },
+	]
+}
+
+// The lists are `josh init`'s and `josh sync`'s own — the same builders, read for what they would
+// write and not run — so a file added to either is one this command already knows about. The ignore
+// file is left out: it is named for review and never compared, so it can never be removed.
+function list(profile: ProjectProfile): Array<DistributedFile> {
+	const shape = widest_shape(profile)
+
+	return [...config_files(shape), ...ai_files(shape)].filter((file) => file.dest !== IGNORE_FILE)
+}
+
+// What kit's merge writes into the manifest it starts a project without one from, which names every
+// entry it adds — `private` included, the one entry that start alone writes.
+function kit_manifest(profile: ProjectProfile): string {
+	return init.merged_manifest(init_basic.initial_manifest(), widest_shape(profile))
+}
+
+const distributed_files = { list, kit_manifest }
+
+export { distributed_files }