@joshuafolkken/kit 1.3041.0 → 1.3092.0

package/scripts/gate/path-glob.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+import { path_glob } from './path-glob'
+
+const RUST_SOURCES = 'src/**/*.rs'
+const CRATE = 'crates/core'
+const MANIFEST = 'Cargo.toml'
+
+describe('path_glob.matches', () => {
+	it.each([
+		['a glob', 'src/lib/parse.rs', RUST_SOURCES, true],
+		['a bare directory, over a file under it', `${CRATE}/src/lib.rs`, CRATE, true],
+		['an exact file', MANIFEST, MANIFEST, true],
+		['a glob, over a path outside it', 'docs/guide.md', RUST_SOURCES, false],
+		['a bare directory, over a sibling sharing its prefix', `${CRATE}-x/a.rs`, CRATE, false],
+	])('answers %s', (_case, file, pattern, expected) => {
+		expect(path_glob.matches(file, pattern)).toBe(expected)
+	})
+})

package/scripts/gate/toolchain-inputs.consumer.test.ts

@@ -0,0 +1,36 @@
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { expect, it, onTestFinished } from 'vitest'
+import { toolchain_inputs } from './toolchain-inputs'
+
+const MANIFEST = 'package.json'
+const RULE = 'eslint/rule.js'
+const CONFIG = 'tsconfig.json'
+
+function inputs(): string {
+	// Distributed tests cannot import kit's unpublished tools/test helper; cleanup is registered below.
+	// eslint-disable-next-line no-restricted-syntax
+	const root = mkdtempSync(path.join(tmpdir(), 'consumer-toolchain-'))
+
+	onTestFinished(() => rmSync(root, { recursive: true, force: true }))
+	mkdirSync(path.join(root, 'eslint'))
+	writeFileSync(path.join(root, RULE), 'export default {}\n')
+	writeFileSync(path.join(root, MANIFEST), '{}\n')
+	symlinkSync(path.join(root, 'missing.json'), path.join(root, CONFIG))
+
+	return root
+}
+
+it('verifies every distributed toolchain operation without kit internals (ac-07c1d077)', () => {
+	const root = inputs()
+
+	expect(toolchain_inputs.paths(root)).toEqual([RULE, MANIFEST, CONFIG])
+	expect(toolchain_inputs.is_input(RULE)).toBe(true)
+	expect(toolchain_inputs.is_input(MANIFEST)).toBe(true)
+	expect(toolchain_inputs.is_input('eslint/rule.test.ts')).toBe(false)
+	const before = toolchain_inputs.digest(root)
+
+	writeFileSync(path.join(root, RULE), 'export default { changed: true }\n')
+	expect(toolchain_inputs.digest(root)).not.toBe(before)
+})

package/scripts/gh/fix-gh-packages-logic.ts

@@ -8,7 +8,7 @@ const TARBALL_PREFIX = '      tarball: '
 const FLOW_RESOLUTION_LINE_START = '\n    resolution: {'
 const FLOW_TARBALL_KEY = ', tarball: '
 const NPMRC_AUTH_TOKEN_PREFIX = `//${GH_PACKAGES_HOST}/:_authToken=`
-const REGISTRY_KEY = ':registry='
+const REGISTRY_KEY = ':registry'
 
 interface PackageResolution {
 	integrity?: string | undefined
@@ -44,29 +44,35 @@ function parse_lockfile_packages(raw: string): Record<string, LockfilePackage> {
 	return merged
 }
 
-function extract_gh_registry_scope(line: string): string | undefined {
+function registry_entry(line: string): [string, string] | undefined {
 	const trimmed = line.trim()
 	if (!trimmed.startsWith('@')) return undefined
-	const eq_index = trimmed.indexOf(REGISTRY_KEY)
-	if (eq_index === -1) return undefined
-	const registry = trimmed
-		.slice(eq_index + REGISTRY_KEY.length)
-		.trim()
-		.replace(/\/$/u, '')
-	if (registry !== `https://${GH_PACKAGES_HOST}`) return undefined
+	const eq_index = trimmed.indexOf('=')
+	const key = trimmed.slice(0, eq_index).trim()
+	if (eq_index === -1 || !key.endsWith(REGISTRY_KEY)) return undefined
 
-	return trimmed.slice(0, eq_index)
+	return [key.slice(0, -REGISTRY_KEY.length), trimmed.slice(eq_index + 1).trim()]
 }
 
-function parse_gh_scopes(npmrc: string): Set<string> {
-	const scopes = new Set<string>()
+function parse_scope_registries(npmrc: string): Map<string, string> {
+	const registries = new Map<string, string>()
 
 	for (const line of npmrc.split('\n')) {
-		const scope = extract_gh_registry_scope(line)
-		if (scope !== undefined) scopes.add(scope)
+		const entry = registry_entry(line)
+		if (entry !== undefined) registries.set(...entry)
 	}
 
-	return scopes
+	return registries
+}
+
+function parse_gh_scopes(npmrc: string): Set<string> {
+	const entries = [...parse_scope_registries(npmrc)]
+
+	return new Set(
+		entries
+			.filter(([, registry]) => registry.replace(/\/$/u, '') === `https://${GH_PACKAGES_HOST}`)
+			.map(([scope]) => scope),
+	)
 }
 
 function extract_auth_token_from_line(line: string): string | undefined {
@@ -218,6 +224,7 @@ function resolve_token(
 
 const fix_gh_packages_logic = {
 	parse_gh_scopes,
+	parse_scope_registries,
 	parse_npmrc_auth_token,
 	parse_lockfile_packages,
 	package_path_from_key,

package/scripts/gh/gh-request-tally.ts

@@ -15,6 +15,9 @@
 // include that call's cost. The difference is an upper bound for this process: the account's other
 // processes spend the same allowance.
 
+import { run_startup } from '#scripts/run/startup/run-startup'
+import { gh_call_kind } from './gh-call-kind'
+
 interface CallCount {
 	calls: number
 	not_modified: number
@@ -97,6 +100,7 @@ function snapshot(): GhRequestTally {
 
 // `kind` is the call's `gh_call_kind` key.
 function count_call(kind: string): void {
+	run_startup.metric('api', gh_call_kind.class_of(kind))
 	if (core.read !== undefined) core.start ??= core.read()
 	tally.calls += 1
 	endpoint_of(kind).calls += 1

package/scripts/hooks/bash-revert.ts

@@ -5,6 +5,8 @@ import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { hook_decision } from '#scripts/josh/hook-decision'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { json_value } from '#scripts/lib/json-value'
+import { time_bundle_call } from '#scripts/time-runtime/time-bundle-call'
+import { time_shell } from '#scripts/time-runtime/time-shell'
 import { z } from 'zod'
 import { step_zero_notice } from './step-zero-notice'
 
@@ -16,7 +18,9 @@ import { step_zero_notice } from './step-zero-notice'
 // the edit it carried survives (#6812); a dirty file whose saved copy no longer matches its stamp is
 // only named — and the session is told which paths it may not write. A session that can
 // implement is never stamped nor reverted, and a path outside the runtime set (`.josh/`, a doc) is
-// left as the shell wrote it.
+// left as the shell wrote it. **Only a change the call's own command names is this shell's**
+// (joshuafolkken/kit#7495): another session sharing the checkout writes in the same window and a hash
+// cannot tell the writers apart, so a change the command does not name is left in place and named.
 
 const STAMP_PREFIX = 'josh-bash-revert-'
 const UNTRACKED = '??'
@@ -28,21 +32,27 @@ const OPERATIONAL_RECORDS = '.josh/'
 const BACKUP_DIRECTORY = '.josh/tmp/bash-revert'
 const BEFORE_CALL_DIRECTORY = 'before-call'
 const STAMP_EXTENSION = '.json'
+// Any run of characters a path word does not carry: quotes, spaces, operators.
+const PATH_BREAK = /[^\w./-]+/u
 const snapshot_schema = z.record(z.string(), z.string())
 
 type Snapshot = Record<string, string>
 
 // `revert` holds the dirty entries clean before the call; `restore` the files dirty before it whose
-// saved content matches the stamp; `keep` the rest dirty before it, which nothing can put back.
+// saved content matches the stamp; `keep` the rest dirty before it, which nothing can put back;
+// `unknown` the changed files the command does not name, whose writer may be another process.
 interface Moved {
 	revert: Array<string>
 	restore: Array<string>
 	keep: Array<string>
+	unknown: Array<string>
 }
 
-const NONE_MOVED: Moved = { revert: [], restore: [], keep: [] }
+const NONE_MOVED: Moved = { revert: [], restore: [], keep: [], unknown: [] }
 
 const HANDOFF = 'This shell wrote runtime files; hand implementation to a worker lane.'
+const UNKNOWN_WRITER =
+	'Changed during the call by a writer its command does not name, so left in place:'
 
 function content_hash(file: string): string {
 	return existsSync(file) ? stamp_file.digest(readFileSync(file)) : ABSENT
@@ -74,13 +84,23 @@ function snapshot(root: string, entries: Array<string> = dirty_entries(root)): S
 	return Object.fromEntries(runtime.map((file) => [file, content_hash(path.join(root, file))]))
 }
 
-// The transcript of a consultation session's `Bash` call, the only call this guards.
-function guarded_transcript(raw_payload: string): string | undefined {
+interface GuardedCall {
+	transcript: string
+	command: string
+}
+
+// The transcript and command of a consultation session's `Bash` call, the only call this guards.
+function guarded_call(raw_payload: string): GuardedCall | undefined {
 	if (agent_session_role.can_implement()) return undefined
 
 	const payload = hook_decision.parse_hook_payload(raw_payload)
 
-	return payload?.tool_name === 'Bash' ? payload.transcript_path : undefined
+	if (payload?.tool_name !== 'Bash') return undefined
+
+	return {
+		transcript: payload.transcript_path,
+		command: time_shell.bash_command(payload.tool_input),
+	}
 }
 
 function copy_into(source: string, destination: string): void {
@@ -104,7 +124,7 @@ function save_dirty(before: Snapshot, root: string, saved: string): void {
 }
 
 function stamp(raw_payload: string, root: string = process.cwd()): void {
-	const transcript = guarded_transcript(raw_payload)
+	const transcript = guarded_call(raw_payload)?.transcript
 
 	if (transcript === undefined) return
 
@@ -158,6 +178,32 @@ function moved_entries(transcript: string, root: string): Moved {
 		}),
 		restore: intact,
 		keep: dirty.filter((file) => !intact.includes(file)),
+		unknown: [],
+	}
+}
+
+// A whole word of `command` is `file`, relative or under an absolute root — `src/app.ts` does not
+// name `src/app.tsx`. A read (`cat`, `grep`, a reading `josh` command — `time_bundle_call`'s reading)
+// names a file without writing it, so a change to one it reads is another writer's.
+function names(command: string, file: string): boolean {
+	if (time_bundle_call.bash_facts(command).is_bundleable) return false
+
+	return command.split(PATH_BREAK).some((word) => word === file || word.endsWith(`/${file}`))
+}
+
+// Splits the moved files into the ones `command` names, this shell's, and the rest, `unknown`.
+function attributed(moved: Moved, command: string): Moved {
+	const changed = [
+		...moved.revert.map((entry) => entry_file(entry)),
+		...moved.restore,
+		...moved.keep,
+	]
+
+	return {
+		revert: moved.revert.filter((entry) => names(command, entry_file(entry))),
+		restore: moved.restore.filter((file) => names(command, file)),
+		keep: moved.keep.filter((file) => names(command, file)),
+		unknown: changed.filter((file) => !names(command, file)),
 	}
 }
 
@@ -199,41 +245,43 @@ function put_back(moved: Moved, root: string, backup: string, saved: string): vo
 	for (const file of moved.restore) restore_saved(file, root, backup, saved)
 }
 
-function block_reason(moved: Moved, backup: string): string {
-	const parts = [HANDOFF]
-
-	if (moved.revert.length > 0) {
-		parts.push(`Reverted: ${moved.revert.map((entry) => entry_file(entry)).join(', ')}.`)
-	}
-
-	if (moved.restore.length > 0) {
-		parts.push(`Restored to their content before the call: ${moved.restore.join(', ')}.`)
-	}
-
-	if (moved.revert.length + moved.restore.length > 0) {
-		parts.push(`Their content before the revert: ${backup}/.`)
-	}
-
-	if (moved.keep.length > 0) {
-		parts.push(`Changed, kept as dirty before the call: ${moved.keep.join(', ')}.`)
-	}
+// Each sentence of the block with the files it is about; one about no file is left out.
+function reason_parts(moved: Moved, backup: string): Array<[Array<string>, string]> {
+	const reverted = moved.revert.map((entry) => entry_file(entry))
+	const put_back_files = [...reverted, ...moved.restore]
+
+	return [
+		[[...put_back_files, ...moved.keep], HANDOFF],
+		[reverted, `Reverted: ${reverted.join(', ')}.`],
+		[moved.restore, `Restored to their content before the call: ${moved.restore.join(', ')}.`],
+		[put_back_files, `Their content before the revert: ${backup}/.`],
+		[moved.keep, `Changed, kept as dirty before the call: ${moved.keep.join(', ')}.`],
+		[moved.unknown, `${UNKNOWN_WRITER} ${moved.unknown.join(', ')}.`],
+	]
+}
 
-	return parts.join(' ')
+function block_reason(moved: Moved, backup: string): string {
+	return reason_parts(moved, backup)
+		.filter(([files]) => files.length > 0)
+		.map(([, sentence]) => sentence)
+		.join(' ')
 }
 
 // The block a `PostToolUse` hook answers with, naming the moved paths, or nothing to say.
 function revert(raw_payload: string, root: string = process.cwd()): string | undefined {
-	const transcript = guarded_transcript(raw_payload)
+	const call = guarded_call(raw_payload)
+
+	if (call === undefined) return undefined
 
-	if (transcript === undefined) return undefined
+	const moved = attributed(moved_entries(call.transcript, root), call.command)
 
-	const moved = moved_entries(transcript, root)
+	const { revert: reverted, restore: restored, keep, unknown } = moved
 
-	if (moved.revert.length + moved.restore.length + moved.keep.length === 0) return undefined
+	if ([reverted, restored, keep, unknown].every((files) => files.length === 0)) return undefined
 
 	const backup = path.join(BACKUP_DIRECTORY, new Date().toISOString().replaceAll(':', '-'))
 
-	put_back(moved, root, path.join(root, backup), saved_directory(transcript, root))
+	put_back(moved, root, path.join(root, backup), saved_directory(call.transcript, root))
 
 	return JSON.stringify({ decision: 'block', reason: block_reason(moved, backup) })
 }

package/scripts/hooks/format-edited-file.ts

@@ -8,6 +8,7 @@ import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { eslint_daemon } from '#scripts/lint/eslint-daemon'
 import { eslint_daemon_calls } from '#scripts/lint/eslint-daemon-calls'
 import { eslint_trim } from '#scripts/lint/eslint-trim'
+import { format_steps } from '#scripts/lint/format-steps'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { execa } from 'execa'
 import { z } from 'zod'
@@ -343,20 +344,17 @@ async function collect_unfixed(
 	runner: CommandRunner,
 	project_root: string,
 ): Promise<string> {
-	let unfixed = ''
-
-	for (const command of plan) {
+	const results = await format_steps.in_order(plan, async (command) => {
 		try {
-			// eslint-disable-next-line no-await-in-loop -- formatters rewrite the same file, in plan order
-			unfixed = eslint_unfixed(command, await runner(command, project_root)) ?? unfixed
+			return eslint_unfixed(command, await runner(command, project_root))
 		} catch {
 			// One formatter failing to start is not a reason to skip the next: prettier runs last, and
 			// it is the one whose output the project's own lint step checks.
-			continue
+			return ''
 		}
-	}
+	})
 
-	return unfixed
+	return results.findLast(Boolean) ?? ''
 }
 
 // The edited file as the daemon read it, or nothing when no eslint command linted it — a `.json`

package/scripts/hooks/implementation-shell.ts

@@ -7,8 +7,9 @@ import { implementation_shell_nested } from './implementation-shell-nested'
 import { step_zero_notice } from './step-zero-notice'
 
 // A consultation scope's pre-execution check (joshuafolkken/kit#6586): a shell runs unless it makes a
-// change no later check takes back. A runtime file a call changes is restored after it
-// (`bash-revert.ts`); a visible write to one is still refused here, as is every call
+// change no later check takes back. A runtime file a call changes and names is restored after it
+// (`bash-revert.ts`; one it does not name is only reported, #7495); a visible write to one is still
+// refused here, as is every call
 // `implementation-shell-deny.ts` names — in a segment, a substitution or a program another one launches.
 const FILE_PROGRAMS: ReadonlySet<string> = new Set(['tee', 'touch', 'rm', 'truncate'])
 // The other programs that write the files their arguments name. `bash-revert.ts` restores only the

package/scripts/init/distributed-paths.ts

@@ -20,10 +20,13 @@ const GITHUB_REPO_TREE_BASE = 'https://github.com/joshuafolkken/kit/tree/main/'
 // The consumer imports kit's published, already path-transformed rules. A tracked bootstrap note
 // remains readable before installation, while the rule body stays in the package (kit#1878).
 const CLAUDE_MD_IMPORT_LINE = '@node_modules/@joshuafolkken/kit/dist/CLAUDE.md'
-const OLD_CLAUDE_MD_BOOTSTRAP =
-	'> Fresh checkout: if kit is not installed, run `pnpm install` first, then reread this file before doing any other work.'
+// Earlier bootstrap notes, oldest first. Sync replaces each in place with the current one.
+const OLD_CLAUDE_MD_BOOTSTRAPS = [
+	'> Fresh checkout: if kit is not installed, run `pnpm install` first, then reread this file before doing any other work.',
+	'> Fresh checkout: before `pnpm install`, run `pnpm config get "@joshuafolkken:registry"` from the project root to check the effective registry, including user-level settings. If it points to GitHub Packages, [set up authentication](https://github.com/joshuafolkken/kit/blob/main/docs/authentication.md#1-get-a-token-from-the-gh-cli) first. Then run `pnpm install` and reread this file before doing any other work.',
+]
 const CLAUDE_MD_BOOTSTRAP =
-	'> Fresh checkout: before `pnpm install`, run `pnpm config get "@joshuafolkken:registry"` from the project root to check the effective registry, including user-level settings. If it points to GitHub Packages, [set up authentication](https://github.com/joshuafolkken/kit/blob/main/docs/authentication.md#1-get-a-token-from-the-gh-cli) first. Then run `pnpm install` and reread this file before doing any other work.'
+	'> Fresh checkout: before `pnpm install`, run `pnpm config get "@joshuafolkken:registry"` from the project root to check the effective registry, including user-level settings. If it points to GitHub Packages, [migrate the project to npm](https://github.com/joshuafolkken/kit/blob/main/docs/registry-migration.md) first, or [set up authentication](https://github.com/joshuafolkken/kit/blob/main/docs/authentication.md#1-get-a-token-from-the-gh-cli) while it still installs from there. Then run `pnpm install` and reread this file before doing any other work.'
 
 // A span containing `*` is excluded: it is a **glob**, not a reference to a file a consumer can
 // open. A distributed document that writes a directory set as `prompts/**` means "anything beneath
@@ -81,12 +84,22 @@ function transform_distributed_paths(content: string): string {
 	return transform_documentation_paths(with_tests)
 }
 
+function replace_old_bootstraps(content: string): string {
+	let updated = content
+
+	for (const old of OLD_CLAUDE_MD_BOOTSTRAPS) {
+		updated = updated.replace(old, () => CLAUDE_MD_BOOTSTRAP)
+	}
+
+	return updated
+}
+
 // Keep the bootstrap note ahead of the import so an agent can read it in a fresh checkout. Preserve
 // project additions and update older one-line files without duplicating either line.
 function ensure_claude_md_import(existing: string | undefined): string {
 	if (existing === undefined) return `${CLAUDE_MD_BOOTSTRAP}\n\n${CLAUDE_MD_IMPORT_LINE}\n`
 
-	const updated = existing.replace(OLD_CLAUDE_MD_BOOTSTRAP, () => CLAUDE_MD_BOOTSTRAP)
+	const updated = replace_old_bootstraps(existing)
 
 	if (updated.includes(CLAUDE_MD_IMPORT_LINE)) {
 		if (updated.includes(CLAUDE_MD_BOOTSTRAP)) return updated
@@ -101,7 +114,7 @@ function ensure_claude_md_import(existing: string | undefined): string {
 // or a switch from full, leaves these behind for it to remove.
 const FULL_CLAUDE_MD_LINES = new Set([
 	CLAUDE_MD_BOOTSTRAP,
-	OLD_CLAUDE_MD_BOOTSTRAP,
+	...OLD_CLAUDE_MD_BOOTSTRAPS,
 	CLAUDE_MD_IMPORT_LINE,
 ])
 

package/scripts/init/init-actions.ts

@@ -2,6 +2,8 @@ import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import { json_format } from '#scripts/config-merge/json-format'
 import { string_array_schema, vscode_settings_schema } from '#scripts/lib/schemas'
+import { migrate_lock } from '#scripts/registry-migration/migrate-lock'
+import { npm_acquisition } from '#scripts/registry-migration/npm-acquisition'
 import { init_logic } from './init-logic'
 import { package_path, PROJECT_ROOT } from './init-paths'
 import type { ProjectShape } from './project-profile'
@@ -201,8 +203,20 @@ function build_gitignore_action(): FileAction {
 	)
 }
 
+function build_npmrc_actions(): Array<FileAction> {
+	if (!npm_acquisition.can_manage(PROJECT_ROOT)) return []
+
+	return [
+		build_action(
+			'.npmrc',
+			() => migrate_lock.npmrc(''),
+			(existing) => init_logic.merge_npmrc(existing, PROJECT_ROOT),
+		),
+	]
+}
+
 function build_basic_actions(shape: ProjectShape): ReadonlyArray<FileAction> {
-	const actions: Array<FileAction> = []
+	const actions: Array<FileAction> = [...build_npmrc_actions()]
 	if (shape.has_git) actions.push(build_gitignore_action())
 	if (shape.has_typescript) actions.push(build_basic_tsconfig_action())
 
@@ -226,6 +240,7 @@ function build_file_actions(shape?: ProjectShape): ReadonlyArray<FileAction> {
 	if (shape?.profile === 'basic') return build_basic_actions(shape)
 
 	return [
+		...build_npmrc_actions(),
 		...(shape?.has_git === false ? [] : [build_gitignore_action()]),
 		build_eslint_action(),
 		build_action(

package/scripts/init/init-bootstrap.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import path from 'node:path'
 import { package_manifest } from '#scripts/lib/package-manifest'
 import { file_content } from '#scripts/sync/file-content'
+import { sync_configs } from '#scripts/sync/sync-configs'
 import { z } from 'zod'
 import { init_basic } from './init-basic'
 import { init_install, type InstallStep } from './init-install'
@@ -130,6 +131,7 @@ function hand_off(
 	const install = kit_install_step(has_kit_dependency(project_root), template)
 
 	ensure_project_manifest(project_root)
+	sync_configs.sync_npmrc(path.join(project_root, NPMRC_FILE))
 	ensure_release_age(project_root, template)
 	if (!init_install.did_step_succeed(install, project_root)) return install_failure(install)
 	if (!init_install.did_step_succeed(handoff_step(args), project_root)) return HANDOFF_FAILURE

package/scripts/init/init-logic.ts

@@ -1,5 +1,6 @@
 import { json_format } from '#scripts/config-merge/json-format'
 import { vscode_settings_schema } from '#scripts/lib/schemas'
+import { npm_acquisition } from '#scripts/registry-migration/npm-acquisition'
 import { safe_chain_preinstall } from '#scripts/safe-chain/preinstall-command'
 import { distributed_paths } from './distributed-paths'
 import { init_logic_deploy_vps } from './init-logic-deploy-vps'
@@ -89,6 +90,9 @@ const AI_COPY_FILES: ReadonlyArray<string> = [
 	'scripts/gate/change-scope-action.ts',
 	'scripts/gate/path-glob.ts',
 	'scripts/gate/toolchain-inputs.ts',
+	'scripts/gate/change-scope-action.integration.test.ts',
+	'scripts/gate/path-glob.test.ts',
+	'scripts/gate/toolchain-inputs.consumer.test.ts',
 	'.github/pull_request_template.md',
 	'.github/release.yml',
 	'.claude/settings.json',
@@ -263,11 +267,13 @@ function append_missing_lines(existing: string, missing: ReadonlyArray<string>):
 // the credential expanded, and that setting can live in a deploy platform's dashboard — so no
 // reading of the repository tells an inert auth line apart from a live one. Deleting it took down a
 // working production deploy. See docs/authentication.md §4(d).
-function merge_npmrc(content: string): string {
+function merge_npmrc(content: string, root?: string): string {
 	const lines = content.split('\n')
 	const kept = lines.filter((line) => !LEGACY_NPMRC_LINES.has(line.trim()))
 
-	return kept.length === lines.length ? content : kept.join('\n')
+	const merged = kept.length === lines.length ? content : kept.join('\n')
+
+	return root === undefined ? merged : npm_acquisition.merge_npmrc(merged, root)
 }
 
 // A gitignore line worth appending during a union merge: real ignore patterns only.
@@ -361,10 +367,15 @@ function get_suggested_scripts(): Record<string, string> {
 // Drop the suggested `prepare` when the consumer already runs fix-gh-packages in
 // any script, so re-running `josh init` does not re-inject a duplicate hook that
 // fights the consumer's intentional consolidation.
-function get_suggested_scripts_for_content(content: string): Record<string, string> {
-	const scripts = get_suggested_scripts()
+function get_suggested_scripts_for_content(
+	content: string,
+	is_npm = false,
+): Record<string, string> {
+	const scripts = is_npm
+		? { ...get_suggested_scripts(), prepare: `(${GUARDED_LEFTHOOK_CMD} || true)` }
+		: get_suggested_scripts()
 	const has_fix = init_logic_json_merge.has_package_scripts_marker(content, FIX_GH_PACKAGES_MARKER)
-	if (!has_fix) return scripts
+	if (!has_fix || is_npm) return scripts
 
 	return Object.fromEntries(Object.entries(scripts).filter(([key]) => key !== PREPARE_KEY))
 }
@@ -387,11 +398,13 @@ function upgrade_prepare_lefthook_warning(content: string): string {
 // Append the guarded lifecycle commands to an existing `prepare` when no script yet runs
 // fix-gh-packages, so the dev-only hooks land in `prepare` instead of being lost when the
 // suggested-scripts merge skips the already-present `prepare` key.
-function merge_prepare_lifecycle_cmd(content: string): string {
+function merge_prepare_lifecycle_cmd(content: string, is_npm = false): string {
 	const has_fix = init_logic_json_merge.has_package_scripts_marker(content, FIX_GH_PACKAGES_MARKER)
-	if (has_fix) return content
+	if (has_fix && !is_npm) return content
+
+	const command = is_npm ? `(${GUARDED_LEFTHOOK_CMD} || true)` : PREPARE_CMD
 
-	return init_logic_json_merge.merge_package_script_suffix(content, PREPARE_KEY, PREPARE_CMD)
+	return init_logic_json_merge.merge_package_script_suffix(content, PREPARE_KEY, command)
 }
 
 // Migration: remove a kit-managed `postinstall` (one running the fix-gh-packages
@@ -399,6 +412,9 @@ function merge_prepare_lifecycle_cmd(content: string): string {
 // rather than the bare marker avoids stripping a consumer's unrelated postinstall that
 // merely mentions `fix-gh-packages` (e.g. `npm run my-fix-gh-packages-helper`).
 function strip_managed_postinstall(content: string): string {
+	const legacy = `${LEGACY_GUARDED_LEFTHOOK_CMD}; ${GUARDED_FIX_GH_PACKAGES_CMD}; true`
+	if (!npm_acquisition.is_script_value(content, LEGACY_POSTINSTALL_KEY, legacy)) return content
+
 	return init_logic_json_merge.remove_script_with_marker(
 		content,
 		LEGACY_POSTINSTALL_KEY,
@@ -406,6 +422,20 @@ function strip_managed_postinstall(content: string): string {
 	)
 }
 
+function upgrade_npm_lifecycle(content: string, root: string): string {
+	if (!npm_acquisition.is_npm_only(root)) return content
+	const stripped = strip_managed_postinstall(content)
+	const prepared =
+		stripped === content
+			? content
+			: init_logic_json_merge.merge_package_scripts(stripped, {
+					prepare: `(${GUARDED_LEFTHOOK_CMD} || true)`,
+				})
+	const merged = stripped === content ? prepared : merge_prepare_lifecycle_cmd(prepared, true)
+
+	return npm_acquisition.merge_lifecycle(merged, root, GUARDED_FIX_GH_PACKAGES_CMD)
+}
+
 const init_logic = {
 	...init_logic_templates,
 	...init_logic_workspace,
@@ -433,6 +463,7 @@ const init_logic = {
 	VSCODE_EXTENSIONS_FILENAME,
 	SAFE_CHAIN_CMD,
 	GUARDED_LEFTHOOK_CMD,
+	GUARDED_FIX_GH_PACKAGES_CMD,
 	upgrade_prepare_lefthook_warning,
 	get_development_engines_value,
 	get_ai_copy_files,
@@ -442,6 +473,7 @@ const init_logic = {
 	get_suggested_scripts_for_content,
 	merge_prepare_lifecycle_cmd,
 	strip_managed_postinstall,
+	upgrade_npm_lifecycle,
 }
 
 export { init_logic }

package/scripts/init/init.ts

@@ -5,6 +5,7 @@ import { doctor_io } from '#scripts/doctor/doctor-io'
 import { error_text } from '#scripts/lib/error-message'
 import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
 import { package_version_schema, with_package_manager_schema } from '#scripts/lib/schemas'
+import { npm_acquisition } from '#scripts/registry-migration/npm-acquisition'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
 import { pack_hook } from '#scripts/safe-chain/pack-hook'
 import { security_updates } from '#scripts/security/security-updates'
@@ -78,7 +79,10 @@ function get_kit_self_dependency(): Record<string, string> {
 // the toolchain is added here: without it the first `josh gate` after `pnpm install` fails.
 function apply_dependency_merges(content: string, has_git = true): string {
 	const migrated = init_logic.strip_managed_postinstall(content)
-	const suggested = init_logic.get_suggested_scripts_for_content(migrated)
+	const suggested = init_logic.get_suggested_scripts_for_content(
+		migrated,
+		npm_acquisition.is_npm_only(PROJECT_ROOT),
+	)
 	const merged = init_logic.merge_package_scripts(
 		migrated,
 		has_git
@@ -97,12 +101,16 @@ function apply_dependency_merges(content: string, has_git = true): string {
 function apply_package_json_merges(content: string, has_git = true): string {
 	const with_kit = apply_dependency_merges(content, has_git)
 	const upgraded = has_git ? init_logic.upgrade_prepare_lefthook_warning(with_kit) : with_kit
-	const with_lifecycle = has_git ? init_logic.merge_prepare_lifecycle_cmd(upgraded) : upgraded
+	const with_lifecycle = has_git
+		? init_logic.merge_prepare_lifecycle_cmd(upgraded, npm_acquisition.is_npm_only(PROJECT_ROOT))
+		: upgraded
 	const kit_pm = get_kit_package_manager()
 	const with_pm =
 		kit_pm === undefined ? with_lifecycle : init_logic.merge_package_manager(with_lifecycle, kit_pm)
 	const with_de = init_logic.merge_development_engines(with_pm, get_kit_development_engines())
-	const sorted = init_logic.sort_package_json_keys(with_de)
+	const sorted = init_logic.sort_package_json_keys(
+		init_logic.upgrade_npm_lifecycle(with_de, PROJECT_ROOT),
+	)
 
 	// Pin devEngines.packageManager.version to the packageManager just written so a
 	// freshly scaffolded (or re-initialized) consumer never trips the pnpm