@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/scripts/hooks/stop-guard.ts

@@ -1,49 +1,77 @@
 #!/usr/bin/env tsx
-import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
 import { agent_headless } from '#scripts/agent/agent-headless'
 import { backlog_ready } from '#scripts/backlog/backlog-ready'
 import { backlog_stalled_detect } from '#scripts/backlog/backlog-stalled-detect'
 import { repo_party } from '#scripts/discovery/repo-party'
+import { stop_actions } from '#scripts/hooks/stop-actions'
 import { hook_decision } from '#scripts/josh/hook-decision'
 import { session_language } from '#scripts/josh/session-language'
 import { lane_child_marker } from '#scripts/lane/lane-child-marker'
 import { lane_handoff } from '#scripts/lane/lane-handoff'
+import { stdout_on_stderr } from '#scripts/lib/stdout-on-stderr'
 import { filing_cap } from '#scripts/rules/filing-cap'
 import { lane_background } from '#scripts/rules/lane-background'
 import { lane_park } from '#scripts/rules/lane-park'
 import { last_prompt } from '#scripts/rules/last-prompt'
+import { pre_gate_cut } from '#scripts/rules/pre-gate-cut'
+import { stop_decision } from '#scripts/rules/stop-decision'
 import { stop_rules, type StopContext, type StopOutcome } from '#scripts/rules/stop-rules'
+import { tail_commands } from '#scripts/rules/tail-commands'
 import { run_carry } from '#scripts/run/carry/run-carry'
 import { run_cut } from '#scripts/run/cut/run-cut'
-import { run_hold } from '#scripts/run/hold/run-hold'
+import { run_cut_report } from '#scripts/run/cut/run-cut-report'
+import { run_hold, type RunHold } from '#scripts/run/hold/run-hold'
+import { run_hold_session } from '#scripts/run/hold/run-hold-session'
 import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
 import { run_headless } from '#scripts/run/run-headless'
 import { run_stranded_detect } from '#scripts/run/run-stranded-detect'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { time_hook_transcript } from '#scripts/time-runtime/time-hook-transcript'
 
-// The `Stop` hook entry: one process that delivers the three stop-time rules.
+// The `Stop` hook entry: one process that delivers the stop-time rules, running the fixed ones itself
+// (`stop-actions.ts`).
 // It is the stop-time counterpart of `pretool-guard.ts` — a second entry on the same `hook_decision`
 // foundation, not a second copy of it.
 //
 // **Every failure allows the stop.** A missing transcript, an unreadable hold record, a git status
 // that will not read — each ends as "no block", for the same reason the PreToolUse guard fails open:
-// a hook that failed closed would wedge a run over its own plumbing. The block rules are self-
-// resolving (send the notify, release the hold) and `stop_hook_active` is the backstop, so failing
+// a hook that failed closed would wedge a run over its own plumbing. The hook runs the fixed
+// operations itself (send the notify, release the hold) and `stop_hook_active` is the backstop, so failing
 // open here costs at most a missed nudge, never a stuck run.
 
-// The hold record for this working tree is still in place, and whether it is a `prrun` stop's.
-// `unreadable` reads as absent: the safe direction for a stop guard is not to
-// block, and an unreadable record is not proof a run is holding.
-async function hold_facts(): Promise<Pick<StopContext, 'hold_present' | 'prrun_stopped'>> {
+// The hold record for this working tree. `unreadable` reads as absent: the safe direction for a stop
+// guard is not to act, and an unreadable record is not proof a run is holding.
+async function held_record(): Promise<RunHold | undefined> {
 	const directory = await run_hold.worktree_directory()
-	const hold =
-		directory === undefined
-			? undefined
-			: run_halfrun_resume.hold_of(run_hold.read_hold(run_hold.hold_path(directory)))
+	if (directory === undefined) return undefined
 
-	return { hold_present: hold !== undefined, prrun_stopped: hold?.prrun_stop_head !== undefined }
+	return run_halfrun_resume.hold_of(run_hold.read_hold(run_hold.hold_path(directory)))
+}
+
+// The pause was announced: by a `josh notify` on the tail, or by this hook's own send, recorded on the
+// hold since the pause began (joshuafolkken/kit#3961).
+function was_notified(hold: RunHold | undefined, tail: string): boolean {
+	if (lane_park.mentions_confirmation_notify(tail)) return true
+
+	return (
+		hold !== undefined && run_hold_session.is_notified_since(hold, last_prompt.pause_start(tail))
+	)
+}
+
+// The Issue the hold names, whether it is a `prrun` stop's and this session's own, and whether its
+// pause was already announced.
+async function hold_facts(
+	tail: string,
+): Promise<Pick<StopContext, 'hold_issue' | 'hold_owned' | 'notified' | 'prrun_stopped'>> {
+	const hold = await held_record()
+
+	return {
+		hold_issue: hold?.issue,
+		hold_owned: hold === undefined || run_hold_session.is_session_hold(hold),
+		notified: was_notified(hold, tail),
+		prrun_stopped: hold?.prrun_stop_head !== undefined,
+	}
 }
 
 // A `confirmation` notify sits on this run's transcript tail. The tail is derived exactly as the
@@ -60,7 +88,20 @@ function was_filed(tail: string): boolean {
 	return filing_cap.turn_filing_count(tail) > 0
 }
 
-// The session language the refusal is written for — `write_stop_decision` has already loaded the `.env`.
+// This turn ended at a cut — a record still `carried`, or this turn's `run:cut` relaunching a successor.
+// The second covers the successor's resume clearing the record before this stop (joshuafolkken/kit#3936);
+// the held cut outside a lane prints no marker, so its person is still notified.
+function is_cut_stop(tail: string): boolean {
+	if (run_cut.carried_cut_sync() !== undefined) return true
+
+	return tail_commands.answered(
+		filing_cap.current_turn(tail),
+		pre_gate_cut.takes_the_cut,
+		run_cut_report.RELAUNCHED_CUT_MARKER,
+	)
+}
+
+// The session language the refusal is written for — `respond_from_stdin` has already loaded the `.env`.
 function session_lang(): string {
 	return session_language.resolve_session_lang().lang
 }
@@ -85,13 +126,13 @@ async function build_context(
 	const tail = transcript_tail(transcript_path)
 
 	return {
-		...(await hold_facts()),
+		...(await hold_facts(tail)),
 		tree_clean: !(await run_hold.is_tree_dirty()),
-		notified: lane_park.mentions_confirmation_notify(tail),
 		message: payload_tail.message,
 		prompt: last_prompt.prompt_text(tail),
+		answers_question: stop_decision.is_question(last_prompt.turn_prompt(tail)),
 		stop_hook_active: payload_tail.stop_hook_active,
-		cut_pending: run_cut.carried_cut_sync() !== undefined,
+		cut_pending: is_cut_stop(tail),
 		filed: was_filed(tail),
 		session_owner: repo_party.current_owner(),
 		...(await session_role_facts()),
@@ -167,24 +208,28 @@ async function run_report_checks(): Promise<void> {
 	await run_stranded_detect.run_stranded_check()
 }
 
-// Nothing reaches stdout on an ordinary stop, so what the harness parses stays empty unless the stop
-// is being held — all three rules block, so a bare `#N` is reported the same way.
-async function write_stop_decision(raw_payload: string): Promise<void> {
-	hook_decision.load_environment_file()
+async function decided_envelope(raw_payload: string): Promise<string | undefined> {
 	await run_report_checks()
 
-	const { reason } = await outcome_of(raw_payload)
+	return await stop_actions.envelope_of(await outcome_of(raw_payload), session_lang())
+}
+
+// Nothing reaches stdout on an ordinary stop, so what the harness parses stays empty unless the stop is
+// held or the hook acted on it (`stop-actions.ts`). The report checks print too — a strand's skipped
+// notify line — and text ahead of the envelope makes the harness drop the refusal, as the #4091 child's
+// lane-background block was (joshuafolkken/kit#4101), so everything before the write goes to stderr.
+async function write_stop_decision(raw_payload: string): Promise<void> {
+	const envelope = await stdout_on_stderr.run(async () => await decided_envelope(raw_payload))
 
-	if (reason === undefined) return
+	if (envelope === undefined) return
 
-	process.stdout.write(`${stop_rules.block_envelope(reason, session_lang())}\n`)
+	process.stdout.write(`${envelope}\n`)
 }
 
 const stop_guard = { outcome_of, stop_outcome_for_payload }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-	if (process.stdin.isTTY) hook_decision.report_no_payload('stop:guard')
-	else await write_stop_decision(await text(process.stdin))
+	await hook_decision.respond_from_stdin('stop:guard', write_stop_decision)
 }
 
 export { stop_guard, write_stop_decision }

package/scripts/init/hook-command-rewrite.ts

@@ -49,8 +49,19 @@ const PLAIN_KIT_COMMANDS: ReadonlySet<string> = new Set(
 		'session:lang',
 	].map((command) => `${PNPM_JOSH_PREFIX}${command}`),
 )
-// The values below are matched inside raw JSON text, so the root prefix is taken in its escaped form.
-const PROJECT_ROOT_PREFIX = JSON.stringify(hook_launch.PROJECT_ROOT_PREFIX).slice(1, -1)
+// The root prefix kit wrote until joshuafolkken/kit#4187 moved the git location variables into the
+// launcher. A consumer's file still carries it until its next sync, which replaces it with the current
+// one. History, never edited; removable from kit 2.0.0.
+const LOCATION_VARIABLES =
+	'GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE'
+const ROOT_LOOKUP = 'git rev-parse --show-toplevel'
+const LEGACY_ROOT_PREFIX = `if project_root="$(unset ${LOCATION_VARIABLES}; ${ROOT_LOOKUP} 2>/dev/null)"; then unset ${LOCATION_VARIABLES}; else project_root="$(${ROOT_LOOKUP})"; fi && cd "$project_root" && `
+// The values below are matched inside raw JSON text, so each root prefix is taken in its escaped form.
+const ROOT_PREFIXES: ReadonlyArray<string> = [
+	hook_launch.PROJECT_ROOT_PREFIX,
+	LEGACY_ROOT_PREFIX,
+].map((prefix) => JSON.stringify(prefix).slice(1, -1))
+const [PROJECT_ROOT_PREFIX = ''] = ROOT_PREFIXES
 // Capture the value of every `"command"` field, escapes and all, so the rewrites below touch command
 // values alone — never an echo reminder's prose or a `"description"` that merely mentions the string.
 const COMMAND_FIELD = /("command":\s*")((?:[^"\\]|\\.)*)(")/gu
@@ -76,10 +87,13 @@ function rewrite_command_value(value: string): string {
 }
 
 // kit's own commands already start from the root (`hook-launch.ts`), and so does an already-rewritten
-// value. The prefix is taken off before the rewrite and put back after it, so the install guard sits
-// behind the `cd` it depends on and a second pass never doubles the prefix.
+// value. The prefix — the current one or the one before it — is taken off before the rewrite and the
+// current one put back after it, so the install guard sits behind the `cd` it depends on and a second
+// pass never doubles the prefix.
 function without_root_prefix(value: string): string {
-	return value.startsWith(PROJECT_ROOT_PREFIX) ? value.slice(PROJECT_ROOT_PREFIX.length) : value
+	const prefix = ROOT_PREFIXES.find((candidate) => value.startsWith(candidate)) ?? ''
+
+	return value.slice(prefix.length)
 }
 
 function rewrite_hook_commands(content: string, is_codex = false): string {

package/scripts/init/hook-launch.ts

@@ -1,26 +1,29 @@
-import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
-
 // The shell command a Claude Code hook is launched with, so it starts without a `pnpm` wrapper — and,
 // for a consumer, without the `dist/josh.js` dispatcher re-spawning `tsx` for the hook's `.ts`.
 // Each hook is pre-built to its own `dist/hooks/<name>.js`
 // (`scripts/build/build-hooks.ts`) and launched directly with `node`.
 //
 // **The command starts from the project root, never from wherever the session happens to be**.
-// Every path after the prefix is relative, so a hook fired from a
-// subdirectory would otherwise miss its script. The root is git's, resolved with the location
-// variables a git hook exports cleared first, and resolved with them only when that fails — git
-// metadata outside the work tree. The consumer rewrite (`hook-command-rewrite.ts`) keeps this prefix,
-// so both sides stay one mechanism for Claude Code and Codex alike.
+// Every path after the prefix is relative, so a hook fired from a subdirectory would otherwise miss its
+// script. Claude Code names the root in `CLAUDE_PROJECT_DIR`, so its hooks start no `git` to find it;
+// Codex runs a hook in the session's directory and names no root, so there the root is git's — asked
+// first without the git location variables a git hook leaks, since a relative or bare `GIT_DIR` read
+// from a subdirectory names the wrong work tree, and with them only when the checkout does not resolve
+// without them (its metadata lives outside the work tree). A lookup that fails ends the command before
+// the launcher (joshuafolkken/kit#4187).
 //
-// **Everything after the root is one script** (`scripts/hooks/run-hook.sh`):
-// clearing the location variables for the hook itself, the bundle-ready gate and the live-source
-// fallback live there once, so each hook command names only its hook.
+// **Everything after the root is one script** (`scripts/hooks/run-hook.sh`): the git location
+// variables a git hook exports, the bundle-ready gate and the live-source fallback live there once, so
+// each hook command names only its hook. The consumer rewrite (`hook-command-rewrite.ts`) keeps this
+// prefix, so both sides stay one mechanism for Claude Code and Codex alike.
+
+import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
 
 const HOOK_DIST_DIR = 'dist/hooks'
 const RUN_HOOK_SCRIPT = 'scripts/hooks/run-hook.sh'
-const UNSET_OPTIONS = GIT_LOCATION_VARIABLES.map((name) => `-u ${name}`).join(' ')
 const ROOT_LOOKUP = 'git rev-parse --show-toplevel'
-const PROJECT_ROOT_PREFIX = `project_root="$(env ${UNSET_OPTIONS} ${ROOT_LOOKUP} 2>/dev/null || ${ROOT_LOOKUP})" && cd "$project_root" && `
+const CODEX_ROOT = `$( (unset ${GIT_LOCATION_VARIABLES.join(' ')}; ${ROOT_LOOKUP} 2>/dev/null) || ${ROOT_LOOKUP})`
+const PROJECT_ROOT_PREFIX = `project_root="\${CLAUDE_PROJECT_DIR:-${CODEX_ROOT}}" && cd "$project_root" && `
 
 // `name` is the hook's bundle under `dist/hooks` without `.js` (e.g. `pretool-guard`), followed by any
 // arguments it takes (e.g. `codex-hook-adapter pretool`).

package/scripts/init/init-actions.ts

@@ -2,7 +2,6 @@ import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import { json_format } from '#scripts/config-merge/json-format'
 import { string_array_schema, vscode_settings_schema } from '#scripts/lib/schemas'
-import { basic_path_migration } from './basic-path-migration'
 import { init_logic } from './init-logic'
 import { package_path, PROJECT_ROOT } from './init-paths'
 import type { ProjectShape } from './project-profile'
@@ -20,9 +19,6 @@ interface FileAction {
 	dest: string
 	create: () => string
 	merge?: (existing: string) => string
-	// A merge that only migrates a kit-written line, for a file kit otherwise leaves to the project:
-	// when it changes nothing, the file is reported with the sample to add, as one with no merge is.
-	should_show_sample_when_unchanged?: boolean
 }
 
 function read_package_file(relative_path: string): string {
@@ -215,8 +211,6 @@ function build_basic_actions(shape: ProjectShape): ReadonlyArray<FileAction> {
 			dest: BASIC_PRETTIER_CONFIG,
 			create: () =>
 				"import { config } from '@joshuafolkken/kit/prettier/basic'\n\nexport default config\n",
-			merge: (existing) => basic_path_migration.migrate_basic_paths(existing),
-			should_show_sample_when_unchanged: true,
 		})
 	}
 

package/scripts/init/init-ai-copy.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { is_workflow_destination } from '#scripts/claude/workflow-destination'
 import { gh_spawn } from '#scripts/gh/gh-spawn'
@@ -9,7 +9,7 @@ import {
 	copy_directory_failure,
 	directory_copy_blocker,
 } from '#scripts/sync/directory-copy-guard'
-import { basic_path_migration } from './basic-path-migration'
+import { file_content } from '#scripts/sync/file-content'
 import { distributed_paths } from './distributed-paths'
 import { transform_copied_content } from './init-copy-content'
 import { init_logic } from './init-logic'
@@ -76,8 +76,7 @@ function copied_content(source_path: string, destination_path: string): string {
 }
 
 function copy_ai_file(source_path: string, destination_path: string): void {
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, copied_content(source_path, destination_path))
+	file_content.write_contained(destination_path, copied_content(source_path, destination_path))
 }
 
 // `init` declines to modify a file that already exists, and that includes not stamping it: the
@@ -139,7 +138,7 @@ function merge_existing_workspace_yaml(source_path: string, destination_path: st
 		return
 	}
 
-	writeFileSync(destination_path, merged)
+	file_content.write_contained(destination_path, merged)
 	console.info(`  ✔ updated   ${WORKSPACE_YAML}`)
 }
 
@@ -158,7 +157,7 @@ function did_skip_workspace_yaml_copy(source_path: string, destination_path: str
 		return false
 	}
 
-	writeFileSync(destination_path, workspace_content(source_path, destination_path))
+	file_content.write_contained(destination_path, workspace_content(source_path, destination_path))
 	console.info(`  ✔ created   ${WORKSPACE_YAML}`)
 
 	return false
@@ -268,40 +267,15 @@ function did_skip_ai_directory_copy(directory_name: string): boolean {
 // AI file — leaves an existing one untouched so a consumer's additions are never disturbed. `josh sync`
 // is what ensures the import line on an existing file (sync.ts). CLAUDE.md is no longer byte-copied,
 // so it is handled here rather than through AI_COPY_FILES.
-//
-// The one edit made to an existing file is the rules import written under the static profile name,
-// moved onto the basic path — only that kit-written line, never the consumer's additions.
-// An unreadable file is left as it is and reported as skipped, as it was before the migration.
-function read_if_readable(destination_path: string): string | undefined {
-	return file_reader.read_if_readable(destination_path)
-}
-
-function report_existing_claude_md(destination_path: string): void {
-	const existing = read_if_readable(destination_path) ?? ''
-	const migrated = basic_path_migration.migrate_basic_paths(existing)
-
-	if (migrated === existing) {
-		console.info(`  ⏭ skipped   ${CLAUDE_MD_FILENAME} (already exists)`)
-
-		return
-	}
-
-	writeFileSync(destination_path, migrated)
-	console.info(`  ✔ updated   ${CLAUDE_MD_FILENAME} (rules import moved to the basic path)`)
-}
-
 function basic_claude_md(): string {
 	return `> If kit is not installed, run \`pnpm install\` first.\n\n${BASIC_CLAUDE_IMPORT}\n`
 }
 
-// A basic CLAUDE.md imports the basic rules alone: the full bootstrap and import are removed, a
-// pre-rename path is moved, and the basic header is restored when no basic import is left.
-// The project's own lines stay as they are.
+// A basic CLAUDE.md imports the basic rules alone: the full bootstrap and import are removed, and the
+// basic header is restored when no basic import is left. The project's own lines stay as they are.
 function ensure_basic_claude_md(existing: string | undefined): string {
 	if (existing === undefined) return basic_claude_md()
-	const kept = basic_path_migration.migrate_basic_paths(
-		distributed_paths.remove_claude_md_import(existing),
-	)
+	const kept = distributed_paths.remove_claude_md_import(existing)
 
 	if (kept.includes(BASIC_CLAUDE_IMPORT)) return kept
 
@@ -312,7 +286,7 @@ function did_skip_claude_md_import(shape?: ProjectShape): boolean {
 	const destination_path = path.join(PROJECT_ROOT, CLAUDE_MD_FILENAME)
 
 	if (existsSync(destination_path)) {
-		report_existing_claude_md(destination_path)
+		console.info(`  ⏭ skipped   ${CLAUDE_MD_FILENAME} (already exists)`)
 
 		return true
 	}
@@ -320,7 +294,7 @@ function did_skip_claude_md_import(shape?: ProjectShape): boolean {
 	const content =
 		shape?.profile === 'basic' ? basic_claude_md() : init_logic.ensure_claude_md_import(undefined)
 
-	writeFileSync(destination_path, content)
+	file_content.write_contained(destination_path, content)
 	console.info(`  ✔ created   ${CLAUDE_MD_FILENAME}`)
 
 	return false

package/scripts/init/init-bootstrap.ts

@@ -1,5 +1,7 @@
-import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import path from 'node:path'
+import { package_manifest } from '#scripts/lib/package-manifest'
+import { file_content } from '#scripts/sync/file-content'
 import { z } from 'zod'
 import { init_basic } from './init-basic'
 import { init_install, type InstallStep } from './init-install'
@@ -8,7 +10,6 @@ import { project_profile } from './project-profile'
 
 const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
 const NODE_MODULES = 'node_modules'
-const PACKAGE_JSON = 'package.json'
 // The basic template lists exactly the build scripts kit's own dependency tree carries, which is
 // what installing kit alone needs approved.
 const KIT_BUILDS_TEMPLATE = 'templates/pnpm-workspace.basic.yaml'
@@ -45,10 +46,8 @@ function kit_build_flags(template: string): Array<string> {
 }
 
 function has_kit_dependency(project_root: string): boolean {
-	const manifest_path = path.join(project_root, PACKAGE_JSON)
-	if (!existsSync(manifest_path)) return false
-	const parsed: unknown = JSON.parse(readFileSync(manifest_path, 'utf8'))
-	const manifest = dependency_fields_schema.parse(parsed)
+	if (!existsSync(package_manifest.manifest_path(project_root))) return false
+	const manifest = package_manifest.read_manifest(project_root, dependency_fields_schema)
 	const names = Object.keys({ ...manifest.dependencies, ...manifest.devDependencies })
 
 	return names.includes(KIT_PACKAGE_NAME)
@@ -77,9 +76,11 @@ function handoff_step(args: ReadonlyArray<string>): InstallStep {
 // pnpm walks up to the nearest `package.json`, so without one here it installs kit into whatever
 // project an ancestor directory holds and rewrites that project's files.
 function ensure_project_manifest(project_root: string): void {
-	const manifest_path = path.join(project_root, PACKAGE_JSON)
+	const manifest_path = package_manifest.manifest_path(project_root)
 
-	if (!existsSync(manifest_path)) writeFileSync(manifest_path, init_basic.initial_manifest())
+	if (existsSync(manifest_path)) return
+
+	file_content.write_contained(manifest_path, init_basic.initial_manifest())
 }
 
 function is_handed_off(): boolean {

package/scripts/init/init-dry-run-report.ts

@@ -1,4 +1,5 @@
 import { json_value } from '#scripts/lib/json-value'
+import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
 
 type ChangeKind = 'create' | 'merge' | 'overwrite' | 'delete'
 
@@ -10,7 +11,6 @@ interface FileChange {
 
 type JsonRecord = Record<string, unknown>
 
-const PACKAGE_JSON = 'package.json'
 const JSON_EXTENSION = '.json'
 const KIND_WIDTH = 'overwrite'.length
 const NO_CHANGES = '  (no file changes)'

package/scripts/init/init-dry-run.ts

@@ -41,7 +41,7 @@ interface DryRunSplit {
 }
 
 const DRY_RUN_FLAG = '--dry-run'
-const INIT_SCRIPT = 'scripts/init/init.ts'
+const INIT_SCRIPT = 'scripts/init/init-main.ts'
 const SCRATCH_PREFIX = 'josh-init-dry-run-'
 const DEFAULT_BRANCH = 'main'
 const TITLE = 'josh init --dry-run — nothing was written. The setup would:'

package/scripts/init/init-file-action.ts

@@ -1,13 +1,13 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { file_content } from '#scripts/sync/file-content'
 import type { FileAction } from './init-actions'
 
 const SAMPLE_INDENT_WIDTH = 4
 const SAMPLE_INDENT = ' '.repeat(SAMPLE_INDENT_WIDTH)
 
 function write_new_file(action: FileAction, destination_path: string): void {
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, action.create())
+	file_content.write_contained(destination_path, action.create())
 	console.info(`  ✔ created   ${action.dest}`)
 }
 
@@ -17,14 +17,12 @@ function show_sample(action: FileAction): void {
 	console.info(action.create().replaceAll(/^/gmu, () => SAMPLE_INDENT))
 }
 
-// A file that already holds the sample needs nothing added, so only one that differs gets it shown —
-// for a create-only file (no merge) as for a merge that only migrates a kit-written line (#3069).
+// A file that already holds the sample needs nothing added, so only a create-only file (no merge)
+// that differs gets it shown (#3069).
 function report_unchanged(action: FileAction, existing: string): void {
 	const is_sample_missing = existing !== action.create()
-	const should_show_sample =
-		action.merge === undefined || action.should_show_sample_when_unchanged === true
 
-	if (is_sample_missing && should_show_sample) show_sample(action)
+	if (is_sample_missing && action.merge === undefined) show_sample(action)
 	else console.info(`  ✔ unchanged ${action.dest}`)
 }
 
@@ -38,7 +36,7 @@ function merge_existing_file(action: FileAction, destination_path: string): void
 		return
 	}
 
-	writeFileSync(destination_path, merged)
+	file_content.write_contained(destination_path, merged)
 	console.info(`  ✔ updated   ${action.dest}`)
 }
 

package/scripts/init/init-logic-json-merge.ts

@@ -4,7 +4,7 @@ import { parse_jsonc } from '#scripts/config-merge/parse-jsonc'
 import { patch_json_key } from '#scripts/config-merge/patch-json-key'
 import { json_object_schema, string_array_schema, string_record_schema } from '#scripts/lib/schemas'
 import { safe_chain_preinstall } from '#scripts/safe-chain/preinstall-command'
-import { apply_jf_migrations, remove_retired_scripts } from './init-logic-migrate'
+import { init_logic_migrate } from './init-logic-migrate'
 import { PACKAGE_JSON_KEY_ORDER } from './init-logic-package-key-order'
 import { kit_base_preset } from './kit-base-preset'
 import { EXTENDS_FIELD, tsconfig_preset_migration } from './tsconfig-preset-migration'
@@ -203,7 +203,7 @@ function merge_package_scripts(content: string, scripts: Record<string, string>)
 	const parsed = parse_jsonc(content)
 	const raw = parsed['scripts']
 	const existing = raw === undefined ? {} : string_record_schema.parse(raw)
-	const migrated = remove_retired_scripts(apply_jf_migrations(existing))
+	const migrated = init_logic_migrate.migrate_scripts(existing)
 	const to_add = missing_entries(migrated, scripts)
 	const did_migrate = JSON.stringify(migrated) !== JSON.stringify(existing)
 

package/scripts/init/init-logic-migrate.ts

@@ -1,89 +1,16 @@
 import { safe_chain_preinstall } from '#scripts/safe-chain/preinstall-command'
 
-const PREINSTALL_KEY = 'preinstall'
-const JF_PREFIX = 'jf-'
-const JOSH_PREFIX = 'josh '
+// The one `scripts` migration `josh init` still makes: a safe-chain `preinstall` an earlier kit
+// wrote. The `jf-` values, the pre-josh values and the retired managed scripts were dropped once no
+// consumer carried them (joshuafolkken/kit#4187); this one is removable from kit 2.0.0.
+function migrate_scripts(scripts: Record<string, string>): Record<string, string> {
+	const current = scripts['preinstall']
 
-// The plain values kit wrote before its scripts became josh subcommands (#80). `check` is left out:
-// its value is the one `sv create` writes itself, so it cannot be told apart from the project's own.
-const PRE_JOSH_SCRIPT_VALUES: ReadonlyMap<string, string> = new Map([
-	['lint', 'pnpm lint:prettier && pnpm lint:eslint'],
-	['lint:prettier', 'prettier --check .'],
-	['lint:eslint', 'eslint . --cache --cache-strategy content'],
-	['format', 'pnpm format:prettier && pnpm format:eslint'],
-	['format:prettier', 'prettier --write .'],
-	['format:eslint', 'eslint . --fix --cache --cache-strategy content'],
-	['cspell', 'cspell lint --no-must-find-files --no-progress "**/*.{ts,js,md,yaml,yml,json}"'],
-	['cspell:dot', 'pnpm cspell . --dot'],
-	['test:unit', 'vitest run'],
-	['lefthook:install', 'lefthook install'],
-	['lefthook:uninstall', 'lefthook uninstall'],
-	['lefthook:commit', 'lefthook run pre-commit'],
-	['lefthook:push', 'lefthook run pre-push'],
-	['main:sync', 'git checkout main && git pull'],
-	['main:merge', 'git pull origin main'],
-	['check:ci', 'svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --threshold error'],
-])
+	if (current === undefined) return scripts
 
-const RETIRED_MANAGED_SCRIPTS = new Set<string>([
-	'git',
-	'git:followup',
-	'telegram:test',
-	'audit:security',
-	'prep',
-	'issue:prep',
-	'prevent-main-commit',
-	'check-commit-message',
-	'version:major',
-	'version:minor',
-	'version:patch',
-	'version:current',
-	'overrides:check',
-	'test:e2e',
-	'test',
-	'latest',
-	'latest:corepack',
-	'latest:update',
-	'check',
-	'check:svelte',
-	'check:svelte:ci',
-	...PRE_JOSH_SCRIPT_VALUES.keys(),
-])
-
-function migrate_jf_value(value: string): string {
-	if (!value.startsWith(JF_PREFIX)) return value
-
-	return `${JOSH_PREFIX}${value.slice(JF_PREFIX.length)}`
-}
-
-function migrate_script(key: string, value: string): string {
-	const migrated = migrate_jf_value(value)
-
-	return key === PREINSTALL_KEY ? safe_chain_preinstall.migrate_preinstall(migrated) : migrated
-}
-
-function apply_jf_migrations(scripts: Record<string, string>): Record<string, string> {
-	return Object.fromEntries(
-		Object.entries(scripts).map(([key, value]) => [key, migrate_script(key, value)]),
-	)
+	return { ...scripts, preinstall: safe_chain_preinstall.migrate_preinstall(current) }
 }
 
-function is_kit_written(key: string, value: string): boolean {
-	if (value.startsWith(JOSH_PREFIX) || value.startsWith(JF_PREFIX)) return true
-
-	return PRE_JOSH_SCRIPT_VALUES.get(key) === value
-}
-
-// A retired name alone does not make a script kit's: `sv create` writes its own `check`, which must
-// survive `josh init`. Only a value kit itself wrote is retired.
-function is_retired_script(key: string, value: string): boolean {
-	return RETIRED_MANAGED_SCRIPTS.has(key) && is_kit_written(key, value)
-}
-
-function remove_retired_scripts(scripts: Record<string, string>): Record<string, string> {
-	return Object.fromEntries(
-		Object.entries(scripts).filter(([key, value]) => !is_retired_script(key, value)),
-	)
-}
+const init_logic_migrate = { migrate_scripts }
 
-export { apply_jf_migrations, remove_retired_scripts, RETIRED_MANAGED_SCRIPTS }
+export { init_logic_migrate }

package/scripts/init/init-logic.ts

@@ -83,7 +83,6 @@ const AI_COPY_FILES: ReadonlyArray<string> = [
 	'.coderabbit.yaml',
 	'.gitattributes',
 	'.mcp.json',
-	'.ncurc.json',
 	'.prettierignore',
 	'SECURITY.md',
 	'pnpm-workspace.yaml',
@@ -100,7 +99,6 @@ const AI_COPY_FILES: ReadonlyArray<string> = [
 	'.github/actions/setup-node/action.yml',
 	'.github/pull_request_template.md',
 	'.github/release.yml',
-	'.github/dependabot.yml',
 	'.claude/settings.json',
 	'.codex/config.toml',
 	'.codex/hooks.json',
@@ -117,6 +115,9 @@ interface FileCopyMapping {
 // hand-edit stay here.
 const AI_COPY_FILE_MAPPINGS: ReadonlyArray<FileCopyMapping> = [
 	{ src: 'templates/workflows/ci.yml', dest: '.github/workflows/ci.yml' },
+	// A template rather than a copy of kit's own file: kit groups its github-actions bumps, which a
+	// consumer's auto-merge would hold whole once one bump touches an upstream-managed workflow.
+	{ src: 'templates/dependabot.yml', dest: '.github/dependabot.yml' },
 	// The counterpart to the distributed `.github/dependabot.yml`: without it a consumer receives
 	// the machinery that opens Dependabot pull requests and none of the machinery that closes them,
 	// so every github-actions bump sits green and unmerged.