@joshuafolkken/kit 1.1514.0 → 1.1784.0

package/scripts/hooks/pre-commit-lint.ts

@@ -3,10 +3,14 @@ import { fileURLToPath } from 'node:url'
 import { core_budget } from '#scripts/gate/core-budget'
 import {
 	CSPELL_COMMIT_CACHE_FLAGS,
+	ESLINT_COMMIT_CACHE_FILE,
 	ESLINT_COMMIT_CACHE_FLAGS,
 	PRETTIER_CACHE_FLAGS,
 } from '#scripts/josh/josh-command-types'
+import { FAIL_EXIT_CODE } from '#scripts/lib/buffered-process'
 import { resolve_spawn_exit } from '#scripts/lib/spawn-exit'
+import { eslint_cache_dependencies } from '#scripts/lint/eslint-cache-dependencies'
+import { eslint_daemon } from '#scripts/lint/eslint-daemon'
 import { execa } from 'execa'
 
 // The pre-commit hook's cspell, prettier and eslint runs over the staged files. They go through here
@@ -21,6 +25,7 @@ import { execa } from 'execa'
 const ARGV_OFFSET = 2
 const USAGE_ERROR_EXIT_CODE = 2
 const PNPM = 'pnpm'
+const ESLINT = 'eslint'
 
 const TOOL_ARGUMENTS: Readonly<Record<string, ReadonlyArray<string>>> = {
 	cspell: [
@@ -58,18 +63,40 @@ function build_arguments(
 	return [...tool_arguments, ...staged_files]
 }
 
+// eslint goes through the lane's warm daemon when one is reachable (joshuafolkken/kit#4358): the same
+// argument list and the same cache file, without paying the config and plugin load per commit. It
+// runs inside the tool's core-budget reservation like the cold route does.
+//
+// A merge or checkout can change only the files a staged file imports, and the content cache keeps
+// the staged file's verdict: its entry is dropped first when they changed (joshuafolkken/kit#4415).
+async function run_eslint(command_arguments: ReadonlyArray<string>): Promise<number> {
+	const result = await eslint_cache_dependencies.guard(
+		ESLINT_COMMIT_CACHE_FILE,
+		async () => await eslint_daemon.run_or_cold(command_arguments),
+	)
+	if (result.output !== '') process.stdout.write(result.output)
+
+	return result.exit_code ?? FAIL_EXIT_CODE
+}
+
 async function run_tool(command_arguments: ReadonlyArray<string>): Promise<number> {
 	const result = await execa(PNPM, command_arguments, { stdio: 'inherit', reject: false })
 
 	return resolve_spawn_exit(PNPM, result)
 }
 
+async function run_reserved(tool: string, staged_files: ReadonlyArray<string>): Promise<number> {
+	const command_arguments = build_arguments(tool, staged_files) ?? []
+	if (tool === ESLINT) return await run_eslint(command_arguments)
+
+	return await run_tool(command_arguments)
+}
+
 async function run(argv: ReadonlyArray<string>): Promise<number> {
 	const [tool = '', ...staged_files] = argv
-	const command_arguments = build_arguments(tool, staged_files)
 	const budget = TOOL_BUDGETS[tool]
 
-	if (command_arguments === undefined || budget === undefined) {
+	if (budget === undefined) {
 		console.error(USAGE)
 
 		return USAGE_ERROR_EXIT_CODE
@@ -77,7 +104,7 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 
 	return await core_budget.with_command_reservation(
 		core_budget.CORE_WEIGHTS[budget],
-		async () => await run_tool(command_arguments),
+		async () => await run_reserved(tool, staged_files),
 		{ memory_mb: core_budget.MEMORY_MB[budget], command: `pre-commit ${tool}` },
 	)
 }

package/scripts/hooks/pre-push-unit.ts

@@ -130,10 +130,12 @@ function format_miss(reason: string): string {
 // as foreign load (joshuafolkken/kit#3874). Only the miss reserves: a reused record runs nothing, and a
 // claim there could make a push wait out a full ledger for a suite it then skips.
 async function run_reserved_suite(vitest_arguments: ReadonlyArray<string>): Promise<number> {
+	const claim = gate_plan.DIRECT_UNIT_CLAIM
+
 	return await core_budget.with_command_reservation(
-		gate_plan.direct_unit_weight(),
+		claim.core_weight(),
 		async () => await test_unit_guard.run_guarded_unit(process.cwd(), vitest_arguments),
-		{ memory_mb: gate_plan.direct_unit_memory(), command: 'pre-push test:unit' },
+		{ memory_mb: claim.memory_mb(), command: 'pre-push test:unit', is_unit: claim.is_unit_claim },
 	)
 }
 

package/scripts/hooks/pretool-guard-cli.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env tsx
-import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
 import { hook_decision } from '#scripts/josh/hook-decision'
 import { pretool_guard } from './pretool-guard'
@@ -11,11 +10,5 @@ import { pretool_guard } from './pretool-guard'
 // `dist/hooks/pretool-guard.js`, so the bundled hook ran no guard at all and every refusal failed open.
 // An entry nothing imports keeps the self-invoke in the file that is actually launched.
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-	if (process.stdin.isTTY) hook_decision.report_no_payload('pretool:guard')
-	else {
-		const raw_payload = await text(process.stdin)
-
-		hook_decision.load_environment_file()
-		await pretool_guard.respond(raw_payload)
-	}
+	await hook_decision.respond_from_stdin('pretool:guard', pretool_guard.respond)
 }

package/scripts/hooks/pretool-guard.ts

@@ -11,6 +11,7 @@ import { run_poll_hook } from '#scripts/run/run-poll-hook'
 import { run_watcher_hook } from '#scripts/run/run-watcher-hook'
 import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { batch_outcome } from './batch-guard'
+import { shell_rules_notice } from './shell-rules-notice'
 import { step_zero_notice } from './step-zero-notice'
 
 // One PreToolUse process for the three guards that used to be three. A Bash
@@ -52,12 +53,13 @@ function combine_outcomes(
 	return outcomes.find((outcome) => !is_clear(outcome)) ?? CLEAR
 }
 
-// The Step 0 reminder is the last word: asked only where every guard stayed
-// clear, so a refusal or another notice never spends its once-per-session stamp unseen.
-function with_step_zero_notice(outcome: GuardOutcome, raw_payload: string): GuardOutcome {
+// The once-per-session reminders are the last word: asked only where every guard stayed clear, so a
+// refusal or another notice never spends their stamps unseen. Step 0 answers an edit and the shell
+// rules a Bash call, so at most one of them speaks on a call.
+function with_session_notice(outcome: GuardOutcome, raw_payload: string): GuardOutcome {
 	if (!is_clear(outcome)) return outcome
 
-	const notice = step_zero_notice.notice(raw_payload)
+	const notice = step_zero_notice.notice(raw_payload) ?? shell_rules_notice.notice(raw_payload)
 
 	return notice === undefined ? outcome : { reason: undefined, notice, fault: undefined }
 }
@@ -75,9 +77,9 @@ function guard_outcome(raw_payload: string): GuardOutcome {
 	return combine_outcomes(outcomes, delivered_rules.delivery(raw_payload))
 }
 
-// The synchronous verdict the Codex adapter asks for, with the Step 0 reminder as its last layer.
+// The synchronous verdict the Codex adapter asks for, with the session reminders as its last layer.
 function pretool_outcome(raw_payload: string): GuardOutcome {
-	return with_step_zero_notice(guard_outcome(raw_payload), raw_payload)
+	return with_session_notice(guard_outcome(raw_payload), raw_payload)
 }
 
 // The Step 0 notice fires once, on the first runtime-file edit: the moment a lane child's plan turns
@@ -116,7 +118,7 @@ async function pretool_outcome_async(raw_payload: string): Promise<GuardOutcome>
 
 	if (reason !== undefined) return { reason, notice: undefined, fault: undefined }
 
-	const outcome = with_step_zero_notice(base, raw_payload)
+	const outcome = with_session_notice(base, raw_payload)
 
 	await mark_phase(outcome)
 
@@ -140,26 +142,36 @@ function rewrite_context(note: string, outcome: GuardOutcome): string {
 	return [note, outcome.notice ?? outcome.fault].filter(Boolean).join('\n\n')
 }
 
-// The envelope that replaces the outcome's own when a lane child backgrounded `josh ship` alone:
-// the call is run in the foreground instead of being refused. A refusal from
-// any guard still wins, and a notice the outcome carried rides along in the same context.
+function foreground_input_of(
+	raw_payload: string,
+	is_lane_child?: () => boolean,
+): Record<string, unknown> | undefined {
+	const call = guarded_call(raw_payload)
+
+	return call === undefined ? undefined : lane_background.foreground_input(call, is_lane_child)
+}
+
+// The envelope that replaces the outcome's own when a lane child runs `josh ship` alone: the call is
+// run in the foreground at the cap instead of being refused or moved aside. A refusal from any guard
+// still wins, and a notice the outcome carried rides along in the same context. On top of a row's
+// rewrite — `raw_payload` is then the rewritten call — it keeps that row's notes and its lack of a
+// permission decision, so the cap is never lost to a pipefail or tail rewrite (joshuafolkken/kit#4101).
 function foreground_rewrite(
 	outcome: GuardOutcome,
 	raw_payload: string,
 	is_lane_child?: () => boolean,
+	rewrite?: RuleRewrite,
 ): string | undefined {
-	if (outcome.reason !== undefined) return undefined
-
-	const call = guarded_call(raw_payload)
 	const input =
-		call === undefined ? undefined : lane_background.foreground_input(call, is_lane_child)
+		outcome.reason === undefined ? foreground_input_of(raw_payload, is_lane_child) : undefined
 
 	if (input === undefined) return undefined
 
-	return hook_decision.rewrite_envelope(
-		input,
-		rewrite_context(lane_background.FOREGROUND_NOTE, outcome),
-	)
+	const note = [rewrite?.note, lane_background.FOREGROUND_NOTE].filter(Boolean).join('\n\n')
+	const envelope_of =
+		rewrite === undefined ? hook_decision.rewrite_envelope : hook_decision.flow_rewrite_envelope
+
+	return envelope_of(input, rewrite_context(note, outcome))
 }
 
 // The rows' rewrite carries no permission decision: whatever else the line runs meets its own prompt.
@@ -174,7 +186,8 @@ function rule_envelope(
 
 // The hook's one write: a rewrite where one applies, the outcome's own envelope otherwise.
 function emit(raw_payload: string, outcome: GuardOutcome, rewrite?: RuleRewrite): void {
-	const envelope = rule_envelope(outcome, rewrite) ?? foreground_rewrite(outcome, raw_payload)
+	const envelope =
+		foreground_rewrite(outcome, raw_payload, undefined, rewrite) ?? rule_envelope(outcome, rewrite)
 
 	if (envelope === undefined) hook_decision.emit_outcome(outcome)
 	else process.stdout.write(`${envelope}\n`)

package/scripts/hooks/reserved-run.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { command_memory } from '#scripts/gate/command-memory'
 import { core_budget } from '#scripts/gate/core-budget'
 import { unit_worker_share } from '#scripts/test/unit-worker-share'
 import { execa } from 'execa'
@@ -18,6 +19,11 @@ import { execa } from 'execa'
 // being rewritten around it — and a second copy of the claim-run-release dance is the clone
 // `CLAUDE.md` prohibits. The weight is the caller's, passed on the command line beside the command, so
 // the reservation these two conservative numbers stand for lives at the one place a person reads them.
+//
+// **The memory is read off the command, not left at zero** (joshuafolkken/kit#4582): a lane wrapped a
+// four-worker typed eslint here and the 12 GB it held was admitted beside four other lanes. The
+// wrapped command's tool and worker count give its `MEMORY_MB` (`command-memory.ts`); `--memory <MB>`
+// overrides that estimate.
 
 // `process.argv` is [runner, script, ...arguments].
 const FIRST_ARGUMENT_INDEX = 2
@@ -30,24 +36,74 @@ const FAIL_EXIT_CODE = 1
 // cumulative sum and let a later reservation admit past the budget the ledger exists to hold.
 const MIN_WEIGHT = 1
 
+const MEMORY_FLAG = '--memory'
+// `--memory <MB>`: the flag and its value.
+const MEMORY_OPTION_LENGTH = 2
+// An explicit `--memory` claims at least one MB; zero is the absence the estimate already stands for.
+const MIN_MEMORY_MB = 1
+// An argument that is one shell word with no quoting.
+const PLAIN_WORD = /^[\w./=:@%+,-]+$/u
+// A single quote inside a single-quoted word: close, escaped quote, reopen.
+const ESCAPED_QUOTE = String.raw`'\''`
+
 interface ReservedCommand {
 	weight: number
+	// The explicit `--memory <MB>`, which overrides the estimate read off the command.
+	memory_mb: number | undefined
 	command: ReadonlyArray<string>
 }
 
-// `<weight> -- <command> [args...]`. `undefined` is a usage error: a missing separator, a weight that
-// is not an integer of at least one core, or nothing to run.
+function is_integer_from(value: number, floor: number): boolean {
+	return Number.isSafeInteger(value) && value >= floor
+}
+
+// The options between the weight and the separator: none, or `--memory <MB>` with a positive integer.
+// `undefined` is a usage error.
+function parse_memory(
+	options: ReadonlyArray<string>,
+): { memory_mb: number | undefined } | undefined {
+	if (options.length === 0) return { memory_mb: undefined }
+
+	const memory_mb = Number(options[1])
+	const is_memory_option = options.length === MEMORY_OPTION_LENGTH && options[0] === MEMORY_FLAG
+
+	return is_memory_option && is_integer_from(memory_mb, MIN_MEMORY_MB) ? { memory_mb } : undefined
+}
+
+// `<weight> [--memory <MB>] -- <command> [args...]`. `undefined` is a usage error: a missing
+// separator, a weight that is not an integer of at least one core, a malformed `--memory`, or nothing
+// to run.
 function parse_arguments(argv: ReadonlyArray<string>): ReservedCommand | undefined {
 	const NOT_FOUND = -1
 	const separator = argv.indexOf(COMMAND_SEPARATOR)
 	const weight = Number(argv[WEIGHT_INDEX])
-	const is_valid_weight = Number.isSafeInteger(weight) && weight >= MIN_WEIGHT
+	const memory = parse_memory(argv.slice(WEIGHT_INDEX + 1, Math.max(separator, 0)))
+	const command = argv.slice(separator + 1)
 
-	if (separator === NOT_FOUND || !is_valid_weight) return undefined
+	if (separator === NOT_FOUND || !is_integer_from(weight, MIN_WEIGHT)) return undefined
 
-	const command = argv.slice(separator + 1)
+	return memory !== undefined && command.length > 0 ? { weight, ...memory, command } : undefined
+}
+
+// An argument as one shell word: a plain one as written, anything else single-quoted. **The estimate
+// re-reads the command as a shell line**, so `git commit -m "a; eslint ."` joined bare would be cut at
+// the `;` and reserved as an eslint run.
+function shell_word(argument: string): string {
+	if (PLAIN_WORD.test(argument)) return argument
+
+	return `'${argument.split("'").join(ESCAPED_QUOTE)}'`
+}
+
+// What the claim carries to the ledger: the command named on the waiting line, and the memory it
+// holds — the explicit `--memory`, else the estimate read off the command (`command-memory.ts`), else
+// none, the 0 MB a command the table does not know counted before.
+function reservation_options(parsed: ReservedCommand): {
+	command: string
+	memory_mb: number | undefined
+} {
+	const command = parsed.command.map((argument) => shell_word(argument)).join(' ')
 
-	return command.length > 0 ? { weight, command } : undefined
+	return { command, memory_mb: parsed.memory_mb ?? command_memory.estimated_memory_mb(command) }
 }
 
 // `stdio: 'inherit'` so the command's own progress reaches the push, and `reject: false` so a failing
@@ -64,7 +120,9 @@ async function run_reserved(argv: ReadonlyArray<string>): Promise<number> {
 	const parsed = parse_arguments(argv)
 
 	if (parsed === undefined) {
-		process.stderr.write('reserved-run: usage: reserved-run <weight> -- <command> [args...]\n')
+		process.stderr.write(
+			'reserved-run: usage: reserved-run <weight> [--memory <MB>] -- <command> [args...]\n',
+		)
 
 		return FAIL_EXIT_CODE
 	}
@@ -78,7 +136,7 @@ async function run_reserved(argv: ReadonlyArray<string>): Promise<number> {
 	return await core_budget.with_core_reservation(
 		parsed.weight,
 		async () => await run_command(parsed.command),
-		{ command: parsed.command.join(' ') },
+		reservation_options(parsed),
 	)
 }
 
@@ -86,6 +144,6 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
 	process.exitCode = await run_reserved(process.argv.slice(FIRST_ARGUMENT_INDEX))
 }
 
-const reserved_run = { parse_arguments, run_reserved }
+const reserved_run = { parse_arguments, reservation_options, run_reserved }
 
 export { reserved_run }

package/scripts/hooks/run-hook.sh

@@ -5,12 +5,15 @@
 # A hook command in `.claude/settings.json` / `.codex/hooks.json` only moves to the project root
 # (`scripts/init/hook-launch.ts`) and calls this script, so everything every hook shares lives here once:
 #
-# - The root prefix has already cleared the git location variables a git hook exports, or kept them
-#   when the checkout needs them; this script starts no `git` of its own (joshuafolkken/kit#3946).
+# - The git location variables a git hook exports are cleared when the checkout resolves without
+#   them, so the hook's own git calls act on the checkout it stands in, and kept when the git metadata
+#   lives outside the work tree. `git` starts only when one of them is set — a hook runs on every tool
+#   call (joshuafolkken/kit#3946, joshuafolkken/kit#4187). The list is `GIT_LOCATION_VARIABLES`
+#   (`scripts/git/git-location-environment.ts`), held to it by `run-hook.test.ts`.
 # - The pre-built bundle `dist/hooks/<name>.js` runs once its gate passes; otherwise the live source
 #   runs through josh, whose command is the name with its first `-` turned into `:`
 #   (`pretool-guard` → `pretool:guard`).
-# - In kit's own checkout the gate is `hook-bundle-ready.ts`, which rebuilds stale bundles
+# - In kit's own checkout the gate is the kit-only `tools/hooks/hook-bundle-ready.ts`, which rebuilds stale bundles
 #   (joshuafolkken/kit#2984) and then runs the bundle — or the josh fallback — itself, so a hook call
 #   starts node once (joshuafolkken/kit#3327). In an installed package it is a presence check: the
 #   published bundles cannot be stale against a source the consumer never edits, and Node strips no
@@ -20,6 +23,12 @@
 # - An `if`/`else`, never `&&`/`||`: a guard's refusal is a non-zero exit, and a chain would read it as
 #   a missing bundle and run the hook twice.
 
+location_variables='GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE'
+if [ -n "$GIT_ALTERNATE_OBJECT_DIRECTORIES$GIT_COMMON_DIR$GIT_DIR$GIT_INDEX_FILE$GIT_NAMESPACE$GIT_OBJECT_DIRECTORY$GIT_WORK_TREE" ] &&
+	(unset $location_variables && git rev-parse --show-toplevel >/dev/null 2>&1); then
+	unset $location_variables
+fi
+
 hook_name=$1
 shift
 case $0 in
@@ -35,6 +44,6 @@ case $0 in
 	if [ -d "$package_dir/dist/hooks" ]; then exec node "$bundle" "$@"; else exec node "$package_dir/dist/josh.js" "$josh_command" "$@"; fi
 	;;
 *)
-	exec node --disable-warning=ExperimentalWarning "$hooks_dir/hook-bundle-ready.ts" "$hook_name" "$josh_command" "$@"
+	exec node --disable-warning=ExperimentalWarning "$package_dir/tools/hooks/hook-bundle-ready.ts" "$hook_name" "$josh_command" "$@"
 	;;
 esac

package/scripts/hooks/shell-rules-notice.ts

@@ -0,0 +1,37 @@
+import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
+import { hook_decision } from '#scripts/josh/hook-decision'
+
+// The two most-refused Bash rows, `file-body` and `piped-verification`, delivered ahead of the call
+// that would break them. A refusal teaches the rule only after the call was composed, and each
+// refusal is a round trip spent rewriting it (joshuafolkken/kit#3996). The first Bash call of a
+// session comes before any of those, so the hook that sees it carries the two rules as a notice.
+//
+// **The rows themselves are unchanged.** They still refuse on every occurrence; this only puts their
+// text in front of the first call, the way `step-zero-notice.ts` delivers Step 0 at the first edit.
+//
+// **Once per session**, on a stamp keyed by the transcript. A stamp that cannot be written stays
+// silent rather than repeating the notice on every call.
+const STAMP_PREFIX = 'josh-shell-rules-notice-'
+
+const NOTICE =
+	'Shell rules: change an existing file with Edit or Write, never a script or heredoc that writes it (file-edits.md); run a josh check with no pipe or under `set -o pipefail`, never `| head` (output-bounds.md).'
+
+const STAMP = hook_decision.create_refusal_stamp(STAMP_PREFIX)
+
+function notice(raw_payload: string): string | undefined {
+	const payload = hook_decision.parse_hook_payload(raw_payload)
+
+	if (payload?.tool_name !== cost_blocks.BASH_TOOL) return undefined
+
+	const target = STAMP.path(payload.transcript_path)
+
+	if (STAMP.last_ms(target) !== hook_decision.NEVER_MS || !STAMP.record(target, Date.now())) {
+		return undefined
+	}
+
+	return NOTICE
+}
+
+const shell_rules_notice = { NOTICE, notice, stamp_path: STAMP.path }
+
+export { shell_rules_notice }

package/scripts/hooks/stop-actions.ts

@@ -3,6 +3,7 @@ import { issue_cite } from '#scripts/issue/issue-cite'
 import { issue_cite_cli } from '#scripts/issue/issue-cite-cli'
 import { session_cite } from '#scripts/issue/session-cite'
 import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { stdout_on_stderr } from '#scripts/lib/stdout-on-stderr'
 import { telegram_test } from '#scripts/notify/telegram-test'
 import type { CliValues } from '#scripts/notify/telegram-test-logic'
 import { issue_citation } from '#scripts/rules/issue-citation'
@@ -124,26 +125,6 @@ async function run_action(action: StopAction): Promise<string | undefined> {
 	return await cite(action.references)
 }
 
-// **The hook's stdout is the decision envelope, so nothing else may reach it**: the reused calls report
-// on stdout (`josh run:release`'s verdict token, the notify's sent line) and are sent to stderr instead.
-type StreamWrite = typeof process.stdout.write
-
-function set_stdout_write(stream_write: StreamWrite): void {
-	process.stdout.write = stream_write
-}
-
-async function on_stderr<T>(work: () => Promise<T>): Promise<T> {
-	const saved = { write: process.stdout.write.bind(process.stdout) }
-
-	set_stdout_write(process.stderr.write.bind(process.stderr))
-
-	try {
-		return await work()
-	} finally {
-		set_stdout_write(saved.write)
-	}
-}
-
 // A throw is an action that did not take, the same as one that answered it had failed.
 async function attempt(action: StopAction): Promise<string | undefined> {
 	try {
@@ -160,7 +141,7 @@ function is_notice(notice: string | undefined): notice is string {
 // In order, one at a time: the notify reports the hold the release then ends. The first failure is the
 // one refused with, as the rule order put it first.
 async function settle(actions: ReadonlyArray<StopAction>): Promise<Settled> {
-	const notices = await on_stderr(
+	const notices = await stdout_on_stderr.run(
 		async () => await bounded_pool.bounded_map(actions, SEQUENTIAL, attempt),
 	)
 	const failed = actions.find((_action, index) => notices[index] === undefined)

package/scripts/hooks/stop-guard.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env tsx
-import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
 import { agent_headless } from '#scripts/agent/agent-headless'
 import { backlog_ready } from '#scripts/backlog/backlog-ready'
@@ -10,6 +9,7 @@ import { hook_decision } from '#scripts/josh/hook-decision'
 import { session_language } from '#scripts/josh/session-language'
 import { lane_child_marker } from '#scripts/lane/lane-child-marker'
 import { lane_handoff } from '#scripts/lane/lane-handoff'
+import { stdout_on_stderr } from '#scripts/lib/stdout-on-stderr'
 import { filing_cap } from '#scripts/rules/filing-cap'
 import { lane_background } from '#scripts/rules/lane-background'
 import { lane_park } from '#scripts/rules/lane-park'
@@ -101,7 +101,7 @@ function is_cut_stop(tail: string): boolean {
 	)
 }
 
-// The session language the refusal is written for — `write_stop_decision` has already loaded the `.env`.
+// The session language the refusal is written for — `respond_from_stdin` has already loaded the `.env`.
 function session_lang(): string {
 	return session_language.resolve_session_lang().lang
 }
@@ -208,13 +208,18 @@ async function run_report_checks(): Promise<void> {
 	await run_stranded_detect.run_stranded_check()
 }
 
-// Nothing reaches stdout on an ordinary stop, so what the harness parses stays empty unless the stop is
-// held or the hook acted on it (`stop-actions.ts`).
-async function write_stop_decision(raw_payload: string): Promise<void> {
-	hook_decision.load_environment_file()
+async function decided_envelope(raw_payload: string): Promise<string | undefined> {
 	await run_report_checks()
 
-	const envelope = await stop_actions.envelope_of(await outcome_of(raw_payload), session_lang())
+	return await stop_actions.envelope_of(await outcome_of(raw_payload), session_lang())
+}
+
+// Nothing reaches stdout on an ordinary stop, so what the harness parses stays empty unless the stop is
+// held or the hook acted on it (`stop-actions.ts`). The report checks print too — a strand's skipped
+// notify line — and text ahead of the envelope makes the harness drop the refusal, as the #4091 child's
+// lane-background block was (joshuafolkken/kit#4101), so everything before the write goes to stderr.
+async function write_stop_decision(raw_payload: string): Promise<void> {
+	const envelope = await stdout_on_stderr.run(async () => await decided_envelope(raw_payload))
 
 	if (envelope === undefined) return
 
@@ -224,8 +229,7 @@ async function write_stop_decision(raw_payload: string): Promise<void> {
 const stop_guard = { outcome_of, stop_outcome_for_payload }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-	if (process.stdin.isTTY) hook_decision.report_no_payload('stop:guard')
-	else await write_stop_decision(await text(process.stdin))
+	await hook_decision.respond_from_stdin('stop:guard', write_stop_decision)
 }
 
 export { stop_guard, write_stop_decision }

package/scripts/init/hook-command-rewrite.ts

@@ -49,8 +49,19 @@ const PLAIN_KIT_COMMANDS: ReadonlySet<string> = new Set(
 		'session:lang',
 	].map((command) => `${PNPM_JOSH_PREFIX}${command}`),
 )
-// The values below are matched inside raw JSON text, so the root prefix is taken in its escaped form.
-const PROJECT_ROOT_PREFIX = JSON.stringify(hook_launch.PROJECT_ROOT_PREFIX).slice(1, -1)
+// The root prefix kit wrote until joshuafolkken/kit#4187 moved the git location variables into the
+// launcher. A consumer's file still carries it until its next sync, which replaces it with the current
+// one. History, never edited; removable from kit 2.0.0.
+const LOCATION_VARIABLES =
+	'GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE'
+const ROOT_LOOKUP = 'git rev-parse --show-toplevel'
+const LEGACY_ROOT_PREFIX = `if project_root="$(unset ${LOCATION_VARIABLES}; ${ROOT_LOOKUP} 2>/dev/null)"; then unset ${LOCATION_VARIABLES}; else project_root="$(${ROOT_LOOKUP})"; fi && cd "$project_root" && `
+// The values below are matched inside raw JSON text, so each root prefix is taken in its escaped form.
+const ROOT_PREFIXES: ReadonlyArray<string> = [
+	hook_launch.PROJECT_ROOT_PREFIX,
+	LEGACY_ROOT_PREFIX,
+].map((prefix) => JSON.stringify(prefix).slice(1, -1))
+const [PROJECT_ROOT_PREFIX = ''] = ROOT_PREFIXES
 // Capture the value of every `"command"` field, escapes and all, so the rewrites below touch command
 // values alone — never an echo reminder's prose or a `"description"` that merely mentions the string.
 const COMMAND_FIELD = /("command":\s*")((?:[^"\\]|\\.)*)(")/gu
@@ -76,10 +87,13 @@ function rewrite_command_value(value: string): string {
 }
 
 // kit's own commands already start from the root (`hook-launch.ts`), and so does an already-rewritten
-// value. The prefix is taken off before the rewrite and put back after it, so the install guard sits
-// behind the `cd` it depends on and a second pass never doubles the prefix.
+// value. The prefix — the current one or the one before it — is taken off before the rewrite and the
+// current one put back after it, so the install guard sits behind the `cd` it depends on and a second
+// pass never doubles the prefix.
 function without_root_prefix(value: string): string {
-	return value.startsWith(PROJECT_ROOT_PREFIX) ? value.slice(PROJECT_ROOT_PREFIX.length) : value
+	const prefix = ROOT_PREFIXES.find((candidate) => value.startsWith(candidate)) ?? ''
+
+	return value.slice(prefix.length)
 }
 
 function rewrite_hook_commands(content: string, is_codex = false): string {

package/scripts/init/hook-launch.ts

@@ -1,31 +1,29 @@
-import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
-
 // The shell command a Claude Code hook is launched with, so it starts without a `pnpm` wrapper — and,
 // for a consumer, without the `dist/josh.js` dispatcher re-spawning `tsx` for the hook's `.ts`.
 // Each hook is pre-built to its own `dist/hooks/<name>.js`
 // (`scripts/build/build-hooks.ts`) and launched directly with `node`.
 //
 // **The command starts from the project root, never from wherever the session happens to be**.
-// Every path after the prefix is relative, so a hook fired from a
-// subdirectory would otherwise miss its script. The root is git's, resolved with the location
-// variables a git hook exports cleared first, and resolved with them only when that fails — git
-// metadata outside the work tree. When the cleared lookup succeeds the variables are cleared for the
-// hook too, so its own git calls act on the checkout it stands in. The consumer rewrite
-// (`hook-command-rewrite.ts`) keeps this prefix, so both sides stay one mechanism for Claude Code and
-// Codex alike.
-//
-// **A hook runs on every tool call, so its launch spawns as little as it can** (joshuafolkken/kit#3946):
-// the shell's own `unset` clears the variables rather than an `env` process, and that one lookup
-// both finds the root and decides whether the variables stay — `git` starts once.
+// Every path after the prefix is relative, so a hook fired from a subdirectory would otherwise miss its
+// script. Claude Code names the root in `CLAUDE_PROJECT_DIR`, so its hooks start no `git` to find it;
+// Codex runs a hook in the session's directory and names no root, so there the root is git's — asked
+// first without the git location variables a git hook leaks, since a relative or bare `GIT_DIR` read
+// from a subdirectory names the wrong work tree, and with them only when the checkout does not resolve
+// without them (its metadata lives outside the work tree). A lookup that fails ends the command before
+// the launcher (joshuafolkken/kit#4187).
 //
-// **Everything after the root is one script** (`scripts/hooks/run-hook.sh`): the bundle-ready gate and
-// the live-source fallback live there once, so each hook command names only its hook.
+// **Everything after the root is one script** (`scripts/hooks/run-hook.sh`): the git location
+// variables a git hook exports, the bundle-ready gate and the live-source fallback live there once, so
+// each hook command names only its hook. The consumer rewrite (`hook-command-rewrite.ts`) keeps this
+// prefix, so both sides stay one mechanism for Claude Code and Codex alike.
+
+import { GIT_LOCATION_VARIABLES } from '#scripts/git/git-location-environment'
 
 const HOOK_DIST_DIR = 'dist/hooks'
 const RUN_HOOK_SCRIPT = 'scripts/hooks/run-hook.sh'
-const LOCATION_VARIABLES = GIT_LOCATION_VARIABLES.join(' ')
 const ROOT_LOOKUP = 'git rev-parse --show-toplevel'
-const PROJECT_ROOT_PREFIX = `if project_root="$(unset ${LOCATION_VARIABLES}; ${ROOT_LOOKUP} 2>/dev/null)"; then unset ${LOCATION_VARIABLES}; else project_root="$(${ROOT_LOOKUP})"; fi && cd "$project_root" && `
+const CODEX_ROOT = `$( (unset ${GIT_LOCATION_VARIABLES.join(' ')}; ${ROOT_LOOKUP} 2>/dev/null) || ${ROOT_LOOKUP})`
+const PROJECT_ROOT_PREFIX = `project_root="\${CLAUDE_PROJECT_DIR:-${CODEX_ROOT}}" && cd "$project_root" && `
 
 // `name` is the hook's bundle under `dist/hooks` without `.js` (e.g. `pretool-guard`), followed by any
 // arguments it takes (e.g. `codex-hook-adapter pretool`).

package/scripts/init/init-actions.ts

@@ -2,7 +2,6 @@ import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import { json_format } from '#scripts/config-merge/json-format'
 import { string_array_schema, vscode_settings_schema } from '#scripts/lib/schemas'
-import { basic_path_migration } from './basic-path-migration'
 import { init_logic } from './init-logic'
 import { package_path, PROJECT_ROOT } from './init-paths'
 import type { ProjectShape } from './project-profile'
@@ -20,9 +19,6 @@ interface FileAction {
 	dest: string
 	create: () => string
 	merge?: (existing: string) => string
-	// A merge that only migrates a kit-written line, for a file kit otherwise leaves to the project:
-	// when it changes nothing, the file is reported with the sample to add, as one with no merge is.
-	should_show_sample_when_unchanged?: boolean
 }
 
 function read_package_file(relative_path: string): string {
@@ -215,8 +211,6 @@ function build_basic_actions(shape: ProjectShape): ReadonlyArray<FileAction> {
 			dest: BASIC_PRETTIER_CONFIG,
 			create: () =>
 				"import { config } from '@joshuafolkken/kit/prettier/basic'\n\nexport default config\n",
-			merge: (existing) => basic_path_migration.migrate_basic_paths(existing),
-			should_show_sample_when_unchanged: true,
 		})
 	}