@joshuafolkken/kit 1.2116.0 → 1.3041.0

package/.claude/skills/workflow-commands/progress-watcher.md

@@ -1,6 +1,7 @@
 # The progress watcher — every implementing run
 
-**Read this file in full when the run's hold is claimed, before the watcher starts.** It is a
+**"Progress while the run is quiet" is never fetched: `run:entry` prints it after its own section
+outside a lane child, and `run:progress --wait` as it starts — once per session.** It is a
 point-of-use document, never an entry read, and the single source of the heartbeat for `fullrun`,
 `halfrun`, `prrun` and the `backlogrun` parent alike. `kickoff` starts none.
 
@@ -26,25 +27,14 @@ relays none. **It exits only on one of three, and the command computes which:**
 **A report is not an exit, and neither is a decline** — with no run recorded it keeps waiting, and the
 `--hours` exit says so on standard error.
 
-**`pnpm josh run:watcher:guard` detects a missed restart** — via `pretool-guard` it refuses the next
-tool call while lane children are in flight and the watcher's record is stale, once per run.
-
 **`--mark` at every real report** — `pnpm josh run:progress --mark` in the same turn restarts the
-silence clock (`docs/josh-commands-run.md` → "`josh run:progress`").
-
-**Do not keep a progress clock of your own** — the hook refuses the arm
-(`scripts/rules/early-heartbeat.ts` → `decide`), though a single correctly-spaced arm is allowed.
-`--wait` is not a wait timer.
-
-**The default interval is twenty minutes, overridable — by the person, not the run.**
-`JOSH_PROGRESS_INTERVAL_MINUTES` moves both sides; `josh` → `progress_interval_minutes` in
-`package.json` sits one step below it. **`--interval` moves the watcher alone** — quieter, never the
-guard stricter.
+silence clock; the interval and its overrides are the person's (`docs/josh-commands-board.md` →
+"`josh run:progress`"). **Do not keep a progress clock of your own** — the hook refuses the arm.
 
 ### What a report says
 
-**Every unscheduled progress statement is answered by `pnpm josh run:progress --once`** — under
-`backlogrun`, `pnpm josh run:board --chat` in one code block — the reply to an explicit ask and
+**Every unscheduled progress statement is answered by `pnpm josh run:board --chat`** in one code
+block — a `backlogrun`, a `fullrun` or a `halfrun` alike — the reply to an explicit ask and
 the note just after a run starts alike; each is exempt from the interval and records the report
 itself, so no `--mark` beside it. **Relay its lines verbatim** — round, rephrase
 or re-label nothing, and **never write a clock time the command did not print**; where a field is
@@ -56,10 +46,10 @@ person's own; **no session relays the stream** — name the board command once,
 asked; the person starts it, or the `josh: run board` task in `.vscode/tasks.json`, by hand.
 `pnpm josh run:event --watch` stays for following the raw events one by one. `pnpm josh run:wake --list` is the one-line read for a person who types for it.
 **A request for periodic progress is never a CronCreate job** — on screen, name `pnpm josh run:board`;
-off-screen, start `pnpm josh run:board --every <minutes>` in the background (`docs/josh-commands-run.md`).
+off-screen, start `pnpm josh run:board --every <minutes>` in the background (`docs/josh-commands-board.md`).
 
 **A stop is the only interrupt**: a `backlogrun` that has stopped ends with
-`pnpm josh run:carry --end --stopped "<reason>"`, which sends one ⏸️ confirmation; a parked child sends
+`pnpm josh run:report --end --stopped "<reason>"`, which sends one ⏸️ confirmation; a parked child sends
 its own (`backlogrun-park.md`).
 
 ### Who starts it, and what counts as a report

package/.claude/skills/workflow-commands/prrun.md

@@ -16,7 +16,7 @@ stop. A merged Issue is reached too, but the `entry #<N>` line after the stage l
 Where `fullrun` runs `pnpm josh followup` and merges, `prrun` does three things and stops:
 
 1. **Watch the pull request to mergeable** — `pnpm josh followup "<title> #<N>" --no-merge`
-   (`followup.md` → "Run `pnpm josh followup`", read in the same turn): required CI green and the AI
+   (`followup.md` → "Run `pnpm josh followup`", printed by `followup` as it starts): required CI green and the AI
    review findings resolved. A failure stops the run exactly as it stops a `fullrun`.
 2. **Mark the stop — `pnpm josh run:hold <N> --prrun-stop`.** It records the commit the pull request is
    on in this run's own hold, the record `fullrun #<N>` adopts (its prrun resume, `working-tree-hold.md`). **The hold and `in-progress` stay**: the run is not finished until the merge's tail runs.

package/.claude/skills/workflow-commands/retrospective.md

@@ -1,8 +1,9 @@
 # The end-of-run retrospective
 
-**Read it when `run:step` prints the retrospective step — not at the entry.** `SKILL.md` → §2's table
-keeps the rule: run what `run:step` prints once, file the improvements worth carrying, stack the rest,
-mark the step done. Read this file in full, in the same turn, before filing.
+**When `run:step` prints the retrospective step, the parent runs `pnpm josh run:handoff retrospective`
+in the background;** its unit reads this file. `SKILL.md` → §2's table keeps the rule: run the digest
+once, file the improvements worth carrying, stack the rest, mark the step done. Read it in full before
+filing.
 
 **When it fires is not a judgement.** `run:step` prints the step when `backlog:offer` marks the backlog
 drained, *before* the idle watch, so the watch picks up what it files; a run that stops without
@@ -10,7 +11,7 @@ draining — the failure guard, `--idle 0` — still prints it at the stop posit
 
 ## The digest is read, not skimmed
 
-The command `run:step` prints folds four existing measurements into one digest — it adds none:
+`run:step`'s digest folds four existing measurements into one — it adds none:
 
 - **Run cost & time by role.** A role whose wall-clock share runs ahead of its cost share is marked
   `waiting-heavy` — a candidate improvement, not a verdict: some roles wait by design.
@@ -22,17 +23,17 @@ The command `run:step` prints folds four existing measurements into one digest
 The two targets are **the run itself** (sections one, three, four) and **the repository** (section two,
 and anything the run surfaced that lives outside it).
 
-## What to file, and how the top two are chosen
+Weekly → `pnpm josh hook:ledger --period 7 --demote`.
 
-**The filing condition is the existing depth test, unchanged** (`observation-filing.md` → "The depth
-test"). What cannot pass it is not filed — not a shortfall, just not yet a finding.
+## What to file — the digest's `Improvement picks`
 
-**A cost regression is filed.** The digest's `File a cost regression: …` line passes the depth test as
-printed — measured, with the command it names as the reproduction — and ranks first: one Issue names
-every regressed row, and the scout keeps a repeat sighting from filing twice.
+**The digest ranks the picks and prints the top two's `issue:file` lines; the order is the command's
+(`tools/retrospective/retrospective-picks.ts`), not yours.** Write each body citing the pick's evidence
+and run its line. A cost regression ranks first and passes as printed — its line names the reproduction.
 
-**Order what passes by effect, and file the top two.** **The third onward is stacked in the observation
-ledger** (drained by `pnpm josh observations:flush`). **File nothing when nothing passes.**
+**Every other pick still faces the depth test** (`observation-filing.md` → "The depth test"): one that
+fails it is not filed, and the next pick does not move up. **The `stack:` lines go to the observation
+ledger** (drained by `pnpm josh observations:flush`); `Improvement picks: none` files nothing.
 
 **Exclude what is already filed or already done, through the existing scout** (`issue-scout.md`): file
 with `pnpm josh issue:file`, which scouts — an **open** candidate covering it means do not file, a
@@ -44,13 +45,13 @@ with `pnpm josh issue:file`, which scouts — an **open** candidate covering it
 `- 人の判断: 不要`, so `issue:file` applies the label (with the run label
 `prompts/collaboration-workflow/issue-template.md` requires). **`backlogrun-steps.md` → "What one
 invocation approves" is that judgement's single source.** Every brake still counts these filings: the
-ten-per-origin ceiling (with no origin, counted with the invocation's other no-origin filings), the WIP cap, `--max` and the `pnpm josh cost --cut` session budget.
+ten-per-origin ceiling (no-origin filings counted together), the WIP cap, `--max` and the `pnpm josh cost --cut` session budget.
 
-**Close with `pnpm josh run:carry --retrospective --summary "<result>" --owner "$PPID"`.** It marks the
+**Close with `pnpm josh run:carry --retrospective --summary "<result>"`.** It marks the
 carry record so `run:step` prints `stop` from then on; the mark survives a session cut and is removed at
 `pnpm josh run:carry --end`, so one invocation runs it exactly once. **`--summary` is required** — it is
 written as a `retrospective` event, so a zero-filing retrospective differs from one that never ran; name
 the issues filed (or none) and the candidates dropped with why.
 
 **A dispatched lane child never reaches any of this** — the batch runs it at its own end; `run:step`
-answers `stop` for a lane child at the stop position.
+answers a lane child `stop` there.

package/.claude/skills/workflow-commands/split-assessment.md

@@ -1,21 +1,26 @@
 # The split assessment — one definition, every entry point
 
-Before any entry point starts work on an Issue, decide whether the request is **one** deliverable or
-several. Every command applies it identically.
+Before work on an Issue starts, decide whether it is **one** deliverable or several; every entry
+point applies this.
 
 ## The question
 
 **The default is not to split.** Two questions have to answer yes **together**:
 
-1. **Does the request contain two or more deliverables that could each be merged separately?**
-2. **Does the whole of it clearly exceed what one verification gate can confirm in one pass?** The
-   guide is **about 10 changed files and about 400 changed lines** (test files excluded).
-   Under that, it is one Issue however many separable pieces a reader can name inside it.
+1. Mergeable parts (separability)?
+2. Over guide? (test files excluded) Docs/snapshots/listings count.
 
-A change that must land in one commit to be correct is one deliverable however big it is; **separability
-alone no longer splits anything**. **"Clearly" is the operative word** — a run that has to argue past
-the numbers has answered no. They are read against the whole request's estimate, and 11 files is not
-thereby a split.
+The same trailing 3-day period as the implement budget;
+median implement minutes per 100 actual changed lines;
+implement budget ÷ measured minutes per 100 lines × 100 → line guide;
+line guide × (fallback file guide / fallback line guide) → file guide.
+Floor (also the unmeasured fallback):
+**more than 8 changed files or more than 200 changed lines**.
+
+Past **the cap (1.5 × guide)** or the bar (2 × budget): split or say why.
+Merged lanes' median actual / declared ratios per axis, apart from speed; unmeasured: 2.
+First `lane:plan` answers `split` past declared files × files ratio (files, hunks), bar (lines);
+`--single`, a re-plan or a dispatched lane → `size warning` (`lane-plan-size.ts`).
 
 ## The same two questions decide the filing-time fold
 
@@ -39,17 +44,20 @@ a judgement, so its `split` is the size condition met, not a decision to divide.
 
 ## Over the guide before the gate
 
-**Trigger: `pnpm josh main:merge` prints a `split notice`** — the branch's diff, untracked files
-included, answers `split` on `split:assess`; the first `pnpm josh lint:related` or `pnpm josh
-test:related` past the guide prints it earlier, once per Issue. Take one action on it, before `pnpm josh run:cut <N>`
-(`chain-rule.md` step 1) — the cut ends the turn, and the resumed run does not see the notice:
+**Size is judged before dispatch: at filing (`issue:file`) and at `lane:plan` only.
+A dispatched lane is never split: it is finished to the end, and never splits, spills or stops for size.**
+
+**Trigger: a dispatched lane's first `lane:plan` is past its bar.** It answers `clear` with one
+`size warning` and nothing on the ledger; a re-plan, `run:cut` and `run:chain` print none. Go on implementing.
 
-- Keep it one Issue — it must land together: one Issue comment with the line
-  `- 分割しない理由: <理由>`, citing the counts.
-- Carve the rest out — the unimplemented part merges separately: `pnpm josh issue:file --route split --found-during <N>`
-  it, narrow this Issue's acceptance criteria to this branch, then gate.
+- An independent new requirement found in the lane → file it as an observation, without `--route split`.
+  `issue:file --route split --found-during <N>` from lane `#N` is refused.
+- At the merge, a diff past the Issue's declared size × the growth factor, capped at the guide
+  (no declaration: the guide), on either axis, is recorded as a pre-split miss with its declared and
+  actual size (`scripts/lane/lane-size-record.ts`). `pnpm josh lane:stats --period <days>` counts and lists the misses;
+  use them to tune the pre-dispatch assessment.
 
-Neither on record: the pre-gate `run:cut` answers `split-unresolved`. The notice never creates an epic.
+The quality gates, the clash and unread checks, and the review stay stops. The warning never creates an epic.
 
 ## What each entry point does with the answer
 
@@ -73,8 +81,10 @@ condition to evaluate.** **An entry point that applies a different condition is
 is the non-closing home for the split rationale.
 
 **Each split child is filed with the `route:split` label** —
-`pnpm josh issue:file "<sub-title>" --body-file <body-file> --route split` — and judged for
-`auto-ok` like any filing (`kickoff.md` → "Words typed after `new`").
+`pnpm josh issue:file "<sub-title>" --body-file .josh/tmp/body.md --route split` — and judged like any
+filing (`kickoff.md` → "Words typed after `new`").
+
+Over the bar before dispatch → a split-only unit answers question 1 (`scripts/backlog/backlog-drive-split-unit.ts`).
 
 ## Promote, or create a new epic
 
@@ -96,7 +106,7 @@ Issue, where the split creates the epic (`backlogrun-child.md` → "When `#N` is
 `fullrun` and `halfrun` **stop** after filing the children and the epic — typing `fullrun` approved
 **one** Issue. Report what was filed and end with:
 
-> Please run `backlogrun #<E> --only` to execute this epic.
+> Please run `pnpm josh backlogrun <E> --only` to execute this epic.
 
 ## There is no `kickoff epic`
 

package/.claude/skills/workflow-commands/target-repository.md

@@ -35,7 +35,7 @@ backlogrun joshuafolkken/kit#<N> --only
   finding to record and no draft to prepare.
 - **No prefix leaves the behavior exactly as it was** — the target is the session's repository.
 - **`kickoff` needs no checkout**: name the target repository with `--repo <owner/repo>` on every
-  `pnpm josh issue:file` call and in the path of every `gh api` call, and never clone. The one exception
+  `pnpm josh issue:file` and `pnpm josh issue:read` call, and never clone. The one exception
   is the split path's epic, since `pnpm josh epic` only writes the repository it runs in — run it in
   that repository's checkout. With no checkout there, file the children, report that the epic could
   not be created, and stop — a hand-built `gh api …/issues` filing of the epic is refused by the
@@ -48,7 +48,7 @@ backlogrun joshuafolkken/kit#<N> --only
   `confirmation` Telegram — never clone, never stash. Otherwise the commands that act on the target
   execute in that checkout.
 - **A named epic is exempt from the whole bullet above**: `owner/repo#E` names where the *epic* lives,
-  not where its children are implemented. Its state is read against that repository through `gh api`,
+  not where its children are implemented. Its state is read through `josh issue:read <E> --repo`,
   so that repository needs no checkout. The checkout rules bind each child at implementation time,
   against **that child's** repository ("Concurrency" in `backlogrun.md`).
 - **Independent of `into <target>`**: this says which repository the run acts on, `into` says which

package/.claude/skills/workflow-commands/working-tree-hold.md

@@ -33,8 +33,9 @@ josh run:release --force` is the one spelling that removes a record this run did
 `busy` message names it.
 
 **Release what the claim recorded.** A `#N` entry releases `<N>`. A **`new` entry claimed before its
-Issue existed**, so once it files `<N>` it runs `pnpm josh run:hold --adopt <N>`, which re-keys the
-record to `<N>` and applies `in-progress`; from then on every stop releases with `run:release <N>`.
+Issue existed**, so once it files `<N>` it runs `pnpm josh run:entry <N> --adopt`, whose
+`run:hold --adopt <N>` re-keys the record to `<N>` and applies `in-progress`; from then on every stop
+releases with `run:release <N>`.
 A `new` stop before filing releases with the **bare** form.
 
 **Releasing is the run's, not a person's memory.** `pnpm josh followup` releases on a merged run; an

package/.codex/hooks.json

@@ -6,8 +6,18 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision --session-start",
-						"timeout": 180
+						"command": "sh \"$( (unset GIT_DIR GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)/scripts/hooks/run-hook.sh\" audit-provision --session-start",
+						"timeout": 90
+					}
+				]
+			},
+			{
+				"matcher": "clear",
+				"hooks": [
+					{
+						"type": "command",
+						"command": "sh \"$( (unset GIT_DIR GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)/scripts/hooks/run-hook.sh\" audit-provision --session-model",
+						"timeout": 10
 					}
 				]
 			}
@@ -17,7 +27,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
+						"command": "sh \"$( (unset GIT_DIR GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)/scripts/hooks/run-hook.sh\" session-lang",
 						"timeout": 10
 					}
 				]
@@ -25,11 +35,11 @@
 		],
 		"PreToolUse": [
 			{
-				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|Agent|Task|apply_patch",
+				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|Agent|Task|Glob|Grep|WebFetch|apply_patch|functions.apply_patch|exec_command|functions.exec_command|exec|functions.exec",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
+						"command": "sh \"$( (unset GIT_DIR GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)/scripts/hooks/run-hook.sh\" codex-hook-adapter pretool",
 						"timeout": 20
 					}
 				]
@@ -37,11 +47,11 @@
 		],
 		"PostToolUse": [
 			{
-				"matcher": "Edit|Write|apply_patch",
+				"matcher": "Edit|Write|Bash|apply_patch|functions.apply_patch|exec_command|functions.exec_command|exec|functions.exec",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
+						"command": "sh \"$( (unset GIT_DIR GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)/scripts/hooks/run-hook.sh\" codex-hook-adapter posttool",
 						"timeout": 90
 					}
 				]
@@ -53,7 +63,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
+						"command": "sh \"$( (unset GIT_DIR GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)/scripts/hooks/run-hook.sh\" stop-guard",
 						"timeout": 20
 					}
 				]

package/.cursorrules

@@ -1,7 +1,6 @@
 # Agent Instructions
 
-> **All rules for this repository live in [`CLAUDE.md`](./CLAUDE.md). Read it in full before doing
-> any work here, and follow every rule in it.** This file exists only to point at it.
+> **All rules for this repository live in [`CLAUDE.md`](./CLAUDE.md). Read it in full before any work.**
 
 **No hooks are configured for Cursor** — apply every hook-delivered rule yourself, per `prompts/collaboration-workflow/principles.md` → "Claude Code 以外のエージェントでの読み替え". Do not copy rules back into this file.
 

package/.github/actions/change-scope/action.yml

@@ -0,0 +1,19 @@
+name: Classify changes
+description: Classify documentation changes and consumer package changes without installing dependencies.
+outputs:
+  runtime:
+    description: Whether executable checks are required.
+    value: ${{ steps.scope.outputs.runtime }}
+  publish:
+    description: Whether the consumer package changed.
+    value: ${{ steps.scope.outputs.publish }}
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-node
+    - id: scope
+      shell: bash
+      env:
+        CHANGE_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        CHANGE_HEAD: ${{ github.sha }}
+      run: node "$GITHUB_WORKSPACE/scripts/gate/change-scope-action.ts"

package/.github/actions/setup-pnpm/action.yml

@@ -1,8 +1,8 @@
 name: Setup pnpm
 description: >
   Resolve the project's pnpm version, set pnpm up, and — unless `install` is false — restore the
-  pnpm store, install safe-chain from its hash-verified release installer and install the
-  dependencies through it.
+  pnpm store, install the hash-verified safe-chain release and install the dependencies through
+  it.
 
 # The one place kit's own workflows prepare pnpm (joshuafolkken/kit#2982). Every job that installed
 # dependencies used to carry these steps itself, and `publish.yml` — the workflow holding the npm
@@ -22,8 +22,8 @@ inputs:
     default: 'true'
   cache:
     description: >
-      Restore and save the pnpm store. A release job passes false, so nothing another run saved
-      reaches a job that holds publish credentials.
+      Restore and save the pnpm store and the safe-chain download. A release job passes false, so
+      nothing another run saved reaches a job that holds publish credentials.
     required: false
     default: 'true'
   runtime:
@@ -55,28 +55,101 @@ runs:
     # (joshuafolkken/kit#5315). Caching it in pnpm's store, rather than taking Node from setup-node's
     # tool cache, keeps setup-node the one place the default Node version is written.
     - name: Setup pnpm
-      uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
+      uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2
       with:
         version: ${{ steps.pnpm-version.outputs.version }}
         runtime: ${{ inputs.runtime }}
         cache: ${{ inputs.install == 'true' && inputs.cache == 'true' }}
         install: false
 
-    # The safe-chain release and the SHA-256 of that release's install-safe-chain.sh. The installer
-    # puts the safe-chain binary under ~/.safe-chain/bin and adds it to PATH beside the shims;
-    # `pnpm dlx … setup-ci` left only the shims, which then let every install through without a scan
-    # (joshuafolkken/kit#2711). `josh latest` moves both together.
+    # The safe-chain release and the SHA-256 of that release's install-safe-chain.sh, which `josh
+    # latest` moves together, and with them the cache key. The release asset for this runner sits
+    # beside them: the installer's own `linuxstatic` / `macos` naming, so its baked digest matches.
+    - name: Pin safe-chain
+      id: safe-chain-pin
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        SAFE_CHAIN_INSTALLER_VERSION: 1.5.27
+        SAFE_CHAIN_INSTALLER_SHA256: 600ebddcb3aaf1fd53653a8d7985df44528722c0f5ee7eb9fff86f26a1a4e5a8
+      run: |
+        case "$RUNNER_OS-$RUNNER_ARCH" in
+          Linux-X64) binary=safe-chain-linuxstatic-x64 ;;
+          Linux-ARM64) binary=safe-chain-linuxstatic-arm64 ;;
+          macOS-X64) binary=safe-chain-macos-x64 ;;
+          macOS-ARM64) binary=safe-chain-macos-arm64 ;;
+          *) echo "::error::No safe-chain binary for $RUNNER_OS-$RUNNER_ARCH"; exit 1 ;;
+        esac
+        echo "version=$SAFE_CHAIN_INSTALLER_VERSION" >> "$GITHUB_OUTPUT"
+        echo "sha256=$SAFE_CHAIN_INSTALLER_SHA256" >> "$GITHUB_OUTPUT"
+        echo "binary=$binary" >> "$GITHUB_OUTPUT"
+
+    # The release download, so a GitHub Releases outage does not turn every job red before its tests
+    # (joshuafolkken/kit#6833). Off with `cache`, like the store, so a release job runs nothing
+    # another run saved (joshuafolkken/kit#4633). What it restores is verified like a fresh download.
+    - name: Restore safe-chain
+      id: safe-chain-cache
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.safe-chain-download
+        key: safe-chain-${{ runner.os }}-${{ runner.arch }}-${{ steps.safe-chain-pin.outputs.version }}-${{ steps.safe-chain-pin.outputs.sha256 }}
+
+    # Through the REST API's asset path with the job token: anonymous `releases/download` returned
+    # 504 throughout a GitHub outage that authenticated requests passed (joshuafolkken/kit#6849).
+    # curl and node rather than `gh`, which the Playwright container some jobs run in does not carry.
+    # The token stays in this step, which runs no third-party code, and in a curl config it removes;
+    # curl sends it to api.github.com alone, not across the redirect to the asset's signed URL.
+    - name: Fetch safe-chain
+      if: inputs.install == 'true' && steps.safe-chain-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        SAFE_CHAIN_INSTALLER_VERSION: ${{ steps.safe-chain-pin.outputs.version }}
+        SAFE_CHAIN_BINARY: ${{ steps.safe-chain-pin.outputs.binary }}
+      run: |
+        export CURL_HOME
+        CURL_HOME=$(mktemp -d "$RUNNER_TEMP/safe-chain-curl.XXXXXX")
+        trap 'rm -r "$CURL_HOME"' EXIT
+        printf '%s\n' 'retry = 3' 'retry-delay = 2' 'retry-max-time = 60' "header = \"Authorization: Bearer $GH_TOKEN\"" > "$CURL_HOME/.curlrc"
+        downloads="$HOME/.safe-chain-download"
+        mkdir -p "$downloads"
+        release=$(curl --proto '=https' -fsSL "https://api.github.com/repos/AikidoSec/safe-chain/releases/tags/$SAFE_CHAIN_INSTALLER_VERSION")
+        for asset in install-safe-chain.sh "$SAFE_CHAIN_BINARY"; do
+          url=$(printf '%s' "$release" | node -e 'const { assets } = JSON.parse(require("node:fs").readFileSync(0, "utf8")); const asset = assets.find((candidate) => candidate.name === process.argv[1]); if (asset === undefined) process.exit(1); console.log(asset.url)' "$asset")
+          curl --proto '=https' -fsSL -H 'Accept: application/octet-stream' "$url" -o "$downloads/$asset"
+        done
+
+    # The installer is checked against the pin, then the binary against the digest the release
+    # pipeline baked into that verified installer, so neither is used unverified. The installer is
+    # not run: on a fresh runner its `--ci` does no more than place the binary and run `setup-ci`,
+    # which this step does itself. The binary directory goes on PATH beside the shims, since shims
+    # without a reachable binary let every install through without a scan (joshuafolkken/kit#2711).
     - name: Setup safe-chain
       if: inputs.install == 'true'
       shell: bash
       env:
-        SAFE_CHAIN_INSTALLER_VERSION: 1.5.26
-        SAFE_CHAIN_INSTALLER_SHA256: 9e4af7107f06d9c0d758cb08fb36804c2af88e24972f3a9d3f8c2bd0ca002adf
+        SAFE_CHAIN_INSTALLER_SHA256: ${{ steps.safe-chain-pin.outputs.sha256 }}
+        SAFE_CHAIN_BINARY: ${{ steps.safe-chain-pin.outputs.binary }}
       run: |
-        installer="$RUNNER_TEMP/install-safe-chain.sh"
-        curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+        downloads="$HOME/.safe-chain-download"
+        installer="$downloads/install-safe-chain.sh"
         echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-        sh "$installer" --ci
+        platform=$(printf '%s' "${SAFE_CHAIN_BINARY#safe-chain-}" | tr 'a-z-' 'A-Z_')
+        binary_sha256=$(sed -n "s/^SHA256_${platform}=\"\([0-9a-f]\{64\}\)\"\$/\1/p" "$installer")
+        test -n "$binary_sha256"
+        echo "$binary_sha256  $downloads/$SAFE_CHAIN_BINARY" | sha256sum -c -
+        mkdir -p "$HOME/.safe-chain/bin"
+        install -m 755 "$downloads/$SAFE_CHAIN_BINARY" "$HOME/.safe-chain/bin/safe-chain"
+        "$HOME/.safe-chain/bin/safe-chain" setup-ci
+        echo "$HOME/.safe-chain/bin" >> "$GITHUB_PATH"
+
+    - name: Save safe-chain
+      if: inputs.install == 'true' && inputs.cache == 'true' && steps.safe-chain-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.safe-chain-download
+        key: ${{ steps.safe-chain-cache.outputs.cache-primary-key }}
 
     - name: Install dependencies
       if: inputs.install == 'true'

package/.github/dependabot.yml

@@ -22,6 +22,7 @@ updates:
     groups:
       publish-actions:
         patterns:
+          - 'actions/cache'
           - 'actions/checkout'
           - 'actions/download-artifact'
           - 'actions/setup-node'