@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/split/split-resolution.ts

@@ -0,0 +1,107 @@
+import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { SPLIT_ROUTE_LABEL } from '#scripts/issue/issue-labels'
+import { issue_read } from '#scripts/issue/issue-read'
+import { session_cite } from '#scripts/issue/session-cite'
+import {
+	lane_ledger,
+	type LedgerEntry,
+	type SplitFiledEntry,
+	type SplitNoticeEntry,
+} from '#scripts/lane/lane-ledger'
+import { lane_ledger_write } from '#scripts/lane/lane-ledger-write'
+import { split_assess } from './split-assess'
+
+// **What answers a split notice** (joshuafolkken/kit#4695). Of the lanes the notice reached, none split
+// and none recorded why it stayed one Issue (joshuafolkken/kit#4676): the notice asked, and nothing
+// checked. The pre-gate `josh run:cut` now does. A noticed Issue passes once it has either answer:
+//
+// - **a split child** — a `josh issue:file --route split` filed from its lane, recorded in the lane
+//   ledger as the filing lands;
+// - **a reason** — a trusted Issue comment carrying the filing's own reason line
+//   (`split_assess.REASON_PREFIX`), so one declaration reads the same at filing and before the gate.
+
+const { REASON_PREFIX } = split_assess
+const NOTICE_SECTION = `split-assessment.md → "${split_assess.NOTICE_SECTION}"`
+const UNREAD_NOTE = 'Its comments could not be read, so no recorded reason was found. '
+
+function is_notice(entry: LedgerEntry): entry is SplitNoticeEntry {
+	return entry.kind === lane_ledger.KIND.SPLIT_NOTICE
+}
+
+function is_split_child(entry: LedgerEntry): entry is SplitFiledEntry {
+	return entry.kind === lane_ledger.KIND.SPLIT_FILED
+}
+
+// The ledger's split notices, oldest first — `josh lane:stats` counts the lanes they reached.
+function notices(entries: ReadonlyArray<LedgerEntry>): ReadonlyArray<SplitNoticeEntry> {
+	return entries.filter((entry) => is_notice(entry))
+}
+
+// The Issues whose lane filed a split child.
+function split_issues(entries: ReadonlyArray<LedgerEntry>): ReadonlySet<number> {
+	return new Set(entries.filter((entry) => is_split_child(entry)).map((entry) => entry.issue))
+}
+
+function is_reason_line(line: string): boolean {
+	const text = line.trim()
+
+	return text.startsWith(REASON_PREFIX) && text !== REASON_PREFIX
+}
+
+function has_reason(bodies: ReadonlyArray<string>): boolean {
+	return bodies.some((body) => body.split('\n').some((line) => is_reason_line(line)))
+}
+
+// The trusted comments' bodies, or `undefined` when the listing could not be read.
+async function trusted_comments(issue: number): Promise<ReadonlyArray<string> | undefined> {
+	const json = await git_gh_issue_read.issue_list_comments(String(issue))
+	const comments = await issue_read.parse_comments(json)
+
+	return comments === undefined ? undefined : issue_read.trusted_bodies(comments)
+}
+
+function refusal_text(notice: SplitNoticeEntry, bodies: ReadonlyArray<string> | undefined): string {
+	const counted = `${String(notice.files)} file(s), ${String(notice.lines)} line(s), tests excluded`
+	const unread = bodies === undefined ? UNREAD_NOTE : ''
+	const answers = `post an Issue comment with the line \`${REASON_PREFIX} <理由>\`, or file the rest with \`pnpm josh issue:file --route split\``
+
+	return `${session_cite.issue(notice.issue)} got the split notice (${counted}) and has neither a recorded reason nor a split child. ${unread}Either ${answers}, then run \`pnpm josh run:cut ${String(notice.issue)}\` again — ${NOTICE_SECTION}`
+}
+
+// The refusal for a noticed Issue that has no answer yet, else `undefined`. The ledger is read first,
+// so an Issue the notice never reached costs no GitHub read.
+async function refusal(
+	issue: number,
+	entries: ReadonlyArray<LedgerEntry>,
+): Promise<string | undefined> {
+	const notice = notices(entries).findLast((entry) => entry.issue === issue)
+
+	if (notice === undefined || split_issues(entries).has(issue)) return undefined
+	const bodies = await trusted_comments(issue)
+
+	return bodies !== undefined && has_reason(bodies) ? undefined : refusal_text(notice, bodies)
+}
+
+// The refusal against this repository's lane ledger; outside a repository there is none to read.
+async function ledger_refusal(issue: number): Promise<string | undefined> {
+	const ledger = await lane_ledger.target()
+
+	return ledger === undefined ? undefined : await refusal(issue, lane_ledger.read_entries(ledger))
+}
+
+interface Filing {
+	route: string | undefined
+	found_during: string | undefined
+	child: string
+}
+
+// What `josh issue:file` just filed: a split child is recorded against the lane it was found in. Any
+// other route, and a filing found in no lane, record nothing.
+async function record_child({ route, found_during, child }: Filing): Promise<void> {
+	if (route !== SPLIT_ROUTE_LABEL || found_during === undefined) return
+	await lane_ledger_write.record_split_filed({ issue: Number(found_during), child })
+}
+
+const split_resolution = { ledger_refusal, notices, record_child, refusal, split_issues }
+
+export { split_resolution }

package/scripts/sync/claude-settings-merge.ts

@@ -1,5 +1,6 @@
 import { json_format } from '#scripts/config-merge/json-format'
 import { hook_command_rewrite } from '#scripts/init/hook-command-rewrite'
+import { json_value } from '#scripts/lib/json-value'
 
 // `josh sync` used to replace a project's `.claude/settings.json` with the distributed file, which
 // deleted every hook and permission the project had added — and `.claude/settings.local.json` is
@@ -29,10 +30,6 @@ const WITHDRAWN_KIT_PERMISSIONS: ReadonlySet<unknown> = new Set([
 	'Bash(git commit --all*)',
 ])
 
-function is_json_object(value: unknown): value is JsonObject {
-	return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
 function as_array(value: unknown): Array<unknown> {
 	return Array.isArray(value) ? value : []
 }
@@ -46,7 +43,7 @@ function merge_objects(kit: JsonObject, own: JsonObject, merge_entry: EntryMerge
 }
 
 function merge_kit_value(kit: unknown, own: unknown): unknown {
-	if (!is_json_object(kit) || !is_json_object(own)) return kit
+	if (!json_value.is_record(kit) || !json_value.is_record(own)) return kit
 
 	return merge_objects(kit, own, (_key, kit_entry, own_entry) =>
 		merge_kit_value(kit_entry, own_entry),
@@ -68,7 +65,7 @@ function without_withdrawn(value: unknown): unknown {
 // The withdrawn entries are taken out of every list first, so one goes even when kit no longer ships
 // the list it sat in.
 function merge_permissions(kit: unknown, own: unknown): unknown {
-	if (!is_json_object(kit) || !is_json_object(own)) return kit
+	if (!json_value.is_record(kit) || !json_value.is_record(own)) return kit
 	const kept = Object.entries(own).map(([key, value]) => [key, without_withdrawn(value)] as const)
 
 	return merge_objects(kit, Object.fromEntries(kept), (_key, kit_entry, own_entry) =>
@@ -77,7 +74,7 @@ function merge_permissions(kit: unknown, own: unknown): unknown {
 }
 
 function is_kit_handler(handler: unknown): boolean {
-	if (!is_json_object(handler)) return false
+	if (!json_value.is_record(handler)) return false
 	const { command } = handler
 
 	return typeof command === 'string' && hook_command_rewrite.is_kit_hook_command(command)
@@ -85,7 +82,7 @@ function is_kit_handler(handler: unknown): boolean {
 
 // A matcher group left with no handler of the project's own was kit's alone, and goes with them.
 function without_kit_handlers(group: unknown): unknown {
-	if (!is_json_object(group)) return group
+	if (!json_value.is_record(group)) return group
 	const handlers = as_array(group[HOOKS_KEY]).filter((handler) => !is_kit_handler(handler))
 
 	return handlers.length === 0 ? undefined : { ...group, [HOOKS_KEY]: handlers }
@@ -104,7 +101,7 @@ function own_hook_events(own: JsonObject): JsonObject {
 }
 
 function merge_hooks(kit: unknown, own: unknown): unknown {
-	if (!is_json_object(kit) || !is_json_object(own)) return kit
+	if (!json_value.is_record(kit) || !json_value.is_record(own)) return kit
 
 	return merge_objects(kit, own_hook_events(own), (_event, kit_groups, groups) => [
 		...as_array(kit_groups),
@@ -120,13 +117,9 @@ function merge_top_level(key: string, kit: unknown, own: unknown): unknown {
 }
 
 function parse_object(content: string): JsonObject | undefined {
-	try {
-		const parsed: unknown = JSON.parse(content)
+	const parsed = json_value.parse_or_undefined(content)
 
-		return is_json_object(parsed) ? parsed : undefined
-	} catch {
-		return undefined
-	}
+	return json_value.is_record(parsed) ? parsed : undefined
 }
 
 // A file that does not parse as a JSON object has nothing the merge can keep, so it is replaced with

package/scripts/sync/directory-copy-guard.ts

@@ -1,7 +1,8 @@
-import { cpSync, lstatSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { cpSync, lstatSync, readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { transform_copied_content } from '#scripts/init/init-copy-content'
 import { error_text } from '#scripts/lib/error-message'
+import { file_reader } from '#scripts/lib/read-file'
 import { file_content } from './file-content'
 
 // `josh init` and `josh sync` both copy a distributed directory with `cpSync`, and both have to
@@ -20,17 +21,11 @@ type DestinationKind = 'absent' | 'directory' | 'other'
 // says the opposite — something is there and cannot be inspected — and ENOTDIR says a component of
 // the path is a file, which is also something rather than nothing. Reading either as absent would
 // send the caller into the `cpSync` that then throws uncaught, the abort this module exists to stop.
-const ABSENT_CODE = 'ENOENT'
-
-function error_code_of(error: unknown): string {
-	return error instanceof Error && 'code' in error ? String(error.code) : ''
-}
-
 function classify_path(candidate_path: string): DestinationKind {
 	try {
 		return lstatSync(candidate_path).isDirectory() ? 'directory' : 'other'
 	} catch (error) {
-		return error_code_of(error) === ABSENT_CODE ? 'absent' : 'other'
+		return file_reader.is_absent(error) ? 'absent' : 'other'
 	}
 }
 
@@ -79,7 +74,7 @@ function is_transformable(candidate_path: string): boolean {
 function transform_copied_file(file_path: string): void {
 	const content = readFileSync(file_path, 'utf8')
 	const transformed = transform_copied_content(file_path, content)
-	if (transformed !== content) writeFileSync(file_path, transformed)
+	if (transformed !== content) file_content.write_contained(file_path, transformed)
 }
 
 // The walk reads the SOURCE listing and rewrites the matching destination paths, never the

package/scripts/sync/file-content.ts

@@ -1,9 +1,10 @@
-import { lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { lstatSync, mkdirSync, readFileSync, readlinkSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
+import { PROJECT_ROOT } from '#scripts/init/init-paths'
+import { file_reader } from '#scripts/lib/read-file'
 
-function is_absent_error(error: unknown): boolean {
-	return error instanceof Error && 'code' in error && error.code === 'ENOENT'
-}
+const PATH_SEPARATORS = path.sep === '\\' ? /[/\\]/u : /\//u
+const MAX_RESOLVE_STEPS = 4096
 
 function is_read_denied(error: unknown): boolean {
 	return (
@@ -15,7 +16,7 @@ function is_regular_existing_file(destination_path: string): boolean {
 	try {
 		return lstatSync(destination_path).isFile()
 	} catch (error) {
-		if (is_absent_error(error)) return false
+		if (file_reader.is_absent(error)) return false
 		throw error
 	}
 }
@@ -37,13 +38,82 @@ function is_same_file_content(destination_path: string, content: string | Buffer
 	return does_read_match(destination_path, expected)
 }
 
-function write_text_if_changed(destination_path: string, content: string): boolean {
-	if (is_same_file_content(destination_path, content)) return false
+function read_symlink(target: string): string | undefined {
+	if (!lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink()) return undefined
+
+	return readlinkSync(target)
+}
+
+function split_components(target: string): Array<string> {
+	return target.split(PATH_SEPARATORS).filter((part) => part !== '' && part !== '.')
+}
+
+// One component, as the kernel takes it: `..` steps up from the real directory reached so far, and
+// a link — dangling or not — splices its own text in, from the root when it is absolute.
+function enter_component(current: string, name: string, pending: Array<string>): string {
+	if (name === '..') return path.dirname(current)
+
+	const next = path.join(current, name)
+	const link = read_symlink(next)
+	if (link === undefined) return next
+	const root = path.isAbsolute(link) ? path.parse(link).root : ''
+
+	pending.unshift(...split_components(link.slice(root.length)))
+
+	return root === '' ? current : root
+}
+
+// Where a write to `target` lands. The path is walked component by component rather than through
+// `path.resolve` or `realpathSync`: the first folds `link/..` lexically while the kernel climbs
+// out of where `link` points, and the second refuses the not-yet-created file a dangling link
+// names. A link cycle the walk would never leave is cut off rather than spun on.
+function resolve_write_path(target: string): string {
+	const absolute = path.isAbsolute(target) ? target : `${process.cwd()}${path.sep}${target}`
+	let current = path.parse(absolute).root
+	const pending = split_components(absolute.slice(current.length))
+
+	for (let steps = 0; steps <= MAX_RESOLVE_STEPS; steps += 1) {
+		const name = pending.shift()
+		if (name === undefined) return current
+		current = enter_component(current, name, pending)
+	}
+
+	throw new Error(`Refusing to write ${target}: too many links`)
+}
+
+function is_within(root: string, target: string): boolean {
+	const relative = path.relative(root, target)
+
+	return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)
+}
+
+// Only a path named inside the project is held to it: one the caller names elsewhere (a scratch
+// directory) is that caller's choice, and the link the guard is for sits inside the project.
+function does_escape_project(destination_path: string): boolean {
+	if (!is_within(path.resolve(PROJECT_ROOT), path.resolve(destination_path))) return false
+
+	return !is_within(resolve_write_path(PROJECT_ROOT), resolve_write_path(destination_path))
+}
+
+// A symlinked destination is written through, and one pointing outside the project (`~/.zshrc`)
+// would let a sync overwrite a file the project does not own. A link that stays inside —
+// `CLAUDE.md` → `AGENTS.md`, `.agents/skills` — is written through as before. The check runs before
+// the parent directories are created, so a directory link to outside gets none created through it.
+function write_contained(destination_path: string, content: string | Buffer): void {
+	if (does_escape_project(destination_path)) {
+		throw new Error(`Refusing to write ${destination_path}: it resolves outside the project`)
+	}
 
 	mkdirSync(path.dirname(destination_path), { recursive: true })
 	writeFileSync(destination_path, content)
+}
+
+function write_text_if_changed(destination_path: string, content: string): boolean {
+	if (is_same_file_content(destination_path, content)) return false
+
+	write_contained(destination_path, content)
 
 	return true
 }
 
-export const file_content = { is_same_file_content, write_text_if_changed }
+export const file_content = { is_same_file_content, write_contained, write_text_if_changed }

package/scripts/sync/sync-ai-files.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { init_ai_copy } from '#scripts/init/init-ai-copy'
 import { transform_copied_content } from '#scripts/init/init-copy-content'
@@ -16,7 +16,6 @@ import { skill_migration, type MigrationResult } from './skill-migration'
 import { sync_hook_safety } from './sync-hook-safety'
 
 const WORKSPACE_YAML = 'pnpm-workspace.yaml'
-const PACKAGE_JSON = 'package.json'
 const CLAUDE_MD_FILENAME = 'CLAUDE.md'
 const CLAUDE_SETTINGS_FILE = '.claude/settings.json'
 const CODEX_HOOKS_FILE = '.codex/hooks.json'
@@ -37,7 +36,7 @@ function should_skip_hook_file(filename: string): boolean {
 	if (filename !== CLAUDE_SETTINGS_FILE && filename !== CODEX_HOOKS_FILE) return false
 	const warning = sync_hook_safety.hook_write_warning(
 		PROJECT_ROOT,
-		sync_hook_safety.read_version_at(path.join(PACKAGE_DIR, PACKAGE_JSON)),
+		sync_hook_safety.read_version_at(PACKAGE_DIR),
 		filename,
 	)
 	if (warning === undefined) return false
@@ -191,8 +190,7 @@ function sync_claude_md(destination_path: string, shape?: ProjectShape): void {
 		return
 	}
 
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, ensured)
+	file_content.write_contained(destination_path, ensured)
 	console.info(`  ✔ synced    ${CLAUDE_MD_FILENAME}`)
 }
 

package/scripts/sync/sync-configs.ts

@@ -1,9 +1,10 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR } from '#scripts/init/init-paths'
 import { vscode_tasks } from '#scripts/init/vscode-tasks'
 import { string_array_schema, vscode_settings_schema } from '#scripts/lib/schemas'
+import { file_content } from './file-content'
 
 type MergeFunction = (existing: string) => string
 
@@ -26,7 +27,7 @@ function sync_with_merge(
 		return
 	}
 
-	writeFileSync(destination_path, merged)
+	file_content.write_contained(destination_path, merged)
 	console.info(`  ✔ synced    ${destination_name}`)
 }
 
@@ -107,7 +108,7 @@ function sync_secretlint_config(destination_path: string): void {
 		return
 	}
 
-	writeFileSync(destination_path, init_logic.generate_secretlint_config())
+	file_content.write_contained(destination_path, init_logic.generate_secretlint_config())
 	console.info('  ✔ created   .secretlintrc.json')
 }
 
@@ -143,29 +144,16 @@ function sync_vscode_settings_json(destination_path: string): void {
 	)
 }
 
-// Creates the file when absent, unlike the other `.vscode` syncs: the folder-open board task is the
-// whole point of distributing it, and a consumer
-// without a tasks.json has nothing of its own to protect. An existing file keeps every task whose
-// label kit does not ship.
+// Like the other `.vscode` syncs, never creates the file: `josh init` does, and a project without it
+// opted out. An existing file keeps every task whose label kit does not ship.
 function sync_vscode_tasks_json(destination_path: string): void {
-	const kit_content = readFileSync(
-		path.join(PACKAGE_DIR, '.vscode', vscode_tasks.VSCODE_TASKS_FILENAME),
-		'utf8',
+	const kit_tasks = vscode_tasks.read_kit_tasks(
+		readFileSync(path.join(PACKAGE_DIR, '.vscode', vscode_tasks.VSCODE_TASKS_FILENAME), 'utf8'),
 	)
 
-	if (existsSync(destination_path)) {
-		const kit_tasks = vscode_tasks.read_kit_tasks(kit_content)
-
-		sync_with_merge(destination_path, '.vscode/tasks.json', (existing) =>
-			vscode_tasks.merge_tasks(existing, kit_tasks),
-		)
-
-		return
-	}
-
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, kit_content)
-	console.info('  ✔ created   .vscode/tasks.json')
+	sync_with_merge(destination_path, '.vscode/tasks.json', (existing) =>
+		vscode_tasks.merge_tasks(existing, kit_tasks),
+	)
 }
 
 const sync_configs = {

package/scripts/sync/sync-hook-safety.ts

@@ -1,6 +1,5 @@
-import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
-import { json_value } from '#scripts/lib/json-value'
+import { package_manifest } from '#scripts/lib/package-manifest'
 import { package_version_schema } from '#scripts/lib/schemas'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
 import semver from 'semver'
@@ -18,20 +17,15 @@ import semver from 'semver'
 
 const NODE_MODULES = 'node_modules'
 
-function read_version_at(package_json_path: string): string | undefined {
-	if (!existsSync(package_json_path)) return undefined
-	const parsed = package_version_schema.safeParse(
-		json_value.parse_or_undefined(readFileSync(package_json_path, 'utf8')),
-	)
-
-	return parsed.success ? parsed.data.version : undefined
+function read_version_at(package_directory: string): string | undefined {
+	return package_manifest.read_manifest_if_valid(package_directory, package_version_schema)?.version
 }
 
 // The version of kit installed in the consumer's node_modules — the bundle the rewritten hooks
 // actually run. Undefined before the first install, which is safe: a fresh install receives the
 // matching bundle, so there is nothing older to break.
 function installed_consumer_version(project_root: string): string | undefined {
-	return read_version_at(path.join(project_root, NODE_MODULES, KIT_PACKAGE_NAME, 'package.json'))
+	return read_version_at(path.join(project_root, NODE_MODULES, KIT_PACKAGE_NAME))
 }
 
 // Unsafe only when both versions are known AND the installed bundle the hooks run is older than the

package/scripts/sync/sync-main.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { main } from './sync'
+
+// The `josh sync` entry, kept apart from `sync.ts` because `init.ts` imports that one: a bundle is one
+// file, so a main guard there would fire for every command that carries it (joshuafolkken/kit#4186).
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	main(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/sync/sync.ts

@@ -1,13 +1,12 @@
-#!/usr/bin/env tsx
-import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { dependabot_cooldown } from '#scripts/dependabot/dependabot-cooldown'
 import { project_checks } from '#scripts/gate/project-checks'
 import { gh_spawn } from '#scripts/gh/gh-spawn'
-import { basic_path_migration } from '#scripts/init/basic-path-migration'
 import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
 import { project_profile } from '#scripts/init/project-profile'
+import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
 import { repository_labels } from '#scripts/repo/repository-labels'
 import { project_config } from '#scripts/safe-chain/project-config'
@@ -19,9 +18,7 @@ import { file_content } from './file-content'
 import { sync_ai_files } from './sync-ai-files'
 import { sync_configs } from './sync-configs'
 
-const PACKAGE_JSON = 'package.json'
-const PACKAGE_JSON_UNCHANGED_MSG = '  ✔ unchanged package.json'
-const BASIC_PRETTIER_CONFIG = 'prettier.config.mjs'
+const PACKAGE_JSON_UNCHANGED_MSG = `  ✔ unchanged ${PACKAGE_JSON}`
 
 function did_migrate_prettierrc(destination_path: string): boolean {
 	const legacy_path = path.join(path.dirname(destination_path), '.prettierrc')
@@ -29,7 +26,7 @@ function did_migrate_prettierrc(destination_path: string): boolean {
 
 	const existing = readFileSync(legacy_path, 'utf8')
 
-	writeFileSync(
+	file_content.write_contained(
 		destination_path,
 		init_logic.merge_prettier_config(existing, path.dirname(destination_path)),
 	)
@@ -48,7 +45,7 @@ function write_merged_prettier_config(destination_path: string): void {
 		return
 	}
 
-	writeFileSync(destination_path, merged)
+	file_content.write_contained(destination_path, merged)
 	console.info('  ✔ synced    prettier.config.js')
 }
 
@@ -64,20 +61,6 @@ function sync_prettier_config(destination_path: string): void {
 	write_merged_prettier_config(destination_path)
 }
 
-// A basic project's prettier config written under the static profile name still imports the static
-// preset path; it is moved onto the basic one with the rule `josh init` applies.
-function sync_basic_prettier_config(destination_path: string): void {
-	if (!existsSync(destination_path)) return
-
-	const existing = readFileSync(destination_path, 'utf8')
-	const did_change = file_content.write_text_if_changed(
-		destination_path,
-		basic_path_migration.migrate_basic_paths(existing),
-	)
-
-	console.info(`  ✔ ${did_change ? 'synced   ' : 'unchanged'} ${BASIC_PRETTIER_CONFIG}`)
-}
-
 function sync_playwright_config(destination_path: string): void {
 	if (!existsSync(destination_path)) return
 
@@ -90,7 +73,7 @@ function sync_playwright_config(destination_path: string): void {
 		return
 	}
 
-	writeFileSync(destination_path, template)
+	file_content.write_contained(destination_path, template)
 	console.info('  ✔ synced    playwright.config.ts')
 }
 
@@ -106,7 +89,7 @@ function sync_deploy_vps(destination_path: string): void {
 		return
 	}
 
-	writeFileSync(destination_path, patched)
+	file_content.write_contained(destination_path, patched)
 	console.info('  ✔ synced    deploy-vps.yml')
 }
 
@@ -156,7 +139,7 @@ function sync_package_json_with(
 		return
 	}
 
-	writeFileSync(destination_path, transformed)
+	file_content.write_contained(destination_path, transformed)
 	console.info(synced_message)
 }
 
@@ -255,6 +238,13 @@ function report_repository_settings(name_with_owner: string | undefined): void {
 	repository_labels.ensure_labels(name_with_owner)
 }
 
+// Every file that restates the workspace's `minimumReleaseAge`: Safe Chain's `.aikido` and
+// Dependabot's `cooldown`.
+function sync_release_window_mirrors(root: string): void {
+	project_config.sync_project_config(root)
+	dependabot_cooldown.sync_dependabot_cooldown(root)
+}
+
 function sync_project_artifacts(is_force: boolean): void {
 	sync_ai_files.sync_ai_copy_all(is_force)
 	sync_prettier_config(path.join(PROJECT_ROOT, 'prettier.config.js'))
@@ -267,20 +257,19 @@ function sync_project_artifacts(is_force: boolean): void {
 
 	sync_sonar_with_template(name_with_owner, is_force)
 	sync_config_files()
-	// After `sync_ai_copy_all`, which may add the `pnpm-workspace.yaml` window `.aikido`'s age is
-	// derived from.
-	project_config.sync_project_config(PROJECT_ROOT)
+	// After `sync_ai_copy_all`, which may add the `pnpm-workspace.yaml` window both mirrors are derived
+	// from, and which rewrites `.github/dependabot.yml` itself.
+	sync_release_window_mirrors(PROJECT_ROOT)
 	sync_package_json_migrations(path.join(PROJECT_ROOT, PACKAGE_JSON))
 	report_repository_settings(name_with_owner)
 }
 
-// A basic project gets what `josh init` gives that profile and nothing more: its AI file set and the
-// move of its prettier preset path. The full toolchain's configs, Sonar, package.json migrations and
-// repository settings are never written into it.
+// A basic project gets what `josh init` gives that profile and nothing more: its AI file set. The full
+// toolchain's configs, Sonar, package.json migrations and repository settings are never written into
+// it.
 function sync_basic_artifacts(is_force: boolean): void {
 	console.info('profile: basic (package.json josh.profile)\n')
 	sync_ai_files.sync_ai_copy_all(is_force, project_profile.inspect_project(PROJECT_ROOT, 'basic'))
-	sync_basic_prettier_config(path.join(PROJECT_ROOT, BASIC_PRETTIER_CONFIG))
 }
 
 // Checked before anything is written, never per file: the damage is the whole run, and a partial
@@ -289,10 +278,10 @@ function sync_basic_artifacts(is_force: boolean): void {
 //
 // Only a recorded basic profile switches the file set; an unrecorded one stays full, as every
 // project initialized before the profile was recorded was set up.
-function main(): void {
+function main(args: ReadonlyArray<string> = []): void {
 	if (did_refuse_self_run(PACKAGE_DIR, PROJECT_ROOT)) return
 
-	const is_force = process.argv.includes('--force')
+	const is_force = args.includes('--force')
 
 	console.info('\n🔄 Syncing @joshuafolkken/kit AI files\n')
 	if (project_checks.is_basic(PROJECT_ROOT)) sync_basic_artifacts(is_force)
@@ -300,8 +289,6 @@ function main(): void {
 	console.info('\n✅ Done.\n')
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main()
-
 const sync = {
 	should_skip_hook_file: sync_ai_files.should_skip_hook_file,
 	sync_file_mapping: sync_ai_files.sync_file_mapping,
@@ -318,6 +305,7 @@ const sync = {
 	sync_prepare_lefthook_warning,
 	sync_safe_chain_preinstall,
 	sync_package_json_migrations,
+	sync_release_window_mirrors,
 	migrate_prettierrc: did_migrate_prettierrc,
 }