@joshuafolkken/kit 1.3044.0 → 1.3099.0

package/scripts/gate/machine-capacity.ts

@@ -16,8 +16,8 @@ import { execa } from 'execa'
 // average trails by a minute, so a gate started just after another one finished would see the finished
 // one's load as external and wait out the decay. `os.cpus()` is one read with no process spawned.
 //
-// A failed reading answers undefined so CI runners and containers, whose host CPU times may not
-// describe their quota, can budget by core count without a misleading memory constraint.
+// Unavailable readings stay undefined. Admission distinguishes an unsupported memory probe from a
+// failed supported probe; CPU quotas still fall back to the declared core count.
 //
 // **`run:board` draws its machine gauges from the same reading**, so what the
 // board shows a person is what the gate admits against — the gate reading the free memory as none
@@ -84,6 +84,8 @@ const SYSCTL_LINE = /^(?<name>[\w.]+): (?<value>\d+)$/gmu
 interface MachineReading {
 	busy_cores: number | undefined
 	available_mb: number | undefined
+	memory_supported?: boolean | undefined
+	total_mb?: number | undefined
 	memory_pressured?: boolean | undefined
 	run_queue?: number | undefined
 }
@@ -328,6 +330,8 @@ async function read_machine(
 		run_queue: is_host ? loadavg()[0] : undefined,
 		available_mb: pressured_available(memory_after, memory_before),
 		memory_pressured: is_pressured(memory_before, memory_after),
+		memory_supported: process.platform === 'darwin' || process.platform === 'linux',
+		total_mb: totalmem() / BYTES_PER_MB,
 	}
 }
 

package/scripts/gate/metrics-totals.ts

@@ -1,5 +1,6 @@
 import { buffered_process, type BufferedProcessResult } from '#scripts/lib/buffered-process'
 import { release_approval_prune } from '#scripts/release/release-approval-prune'
+import { gate_tree, type GateTree } from './gate-tree'
 import { project_checks } from './project-checks'
 
 // kit's metrics ratchet totals (`josh metrics --totals-only`), brought forward from the detached
@@ -78,6 +79,16 @@ const metrics_totals = {
 	REVIEW_REFUSAL_HEADING,
 	growth_notice,
 	rerecord,
+	// Finish the existing approval writer before fixing the tree any verification will read.
+	async rerecorded_tree(
+		read: () => Promise<GateTree> = gate_tree.read_gate_tree,
+		directory: string = process.cwd(),
+	): Promise<GateTree> {
+		const tree = await read()
+		const is_rerecorded = await metrics_totals.rerecord(directory, tree.files)
+
+		return is_rerecorded ? await read() : tree
+	},
 	totals_check,
 	totals_refusal,
 }

package/scripts/gate/path-glob.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+import { path_glob } from './path-glob'
+
+const RUST_SOURCES = 'src/**/*.rs'
+const CRATE = 'crates/core'
+const MANIFEST = 'Cargo.toml'
+
+describe('path_glob.matches', () => {
+	it.each([
+		['a glob', 'src/lib/parse.rs', RUST_SOURCES, true],
+		['a bare directory, over a file under it', `${CRATE}/src/lib.rs`, CRATE, true],
+		['an exact file', MANIFEST, MANIFEST, true],
+		['a glob, over a path outside it', 'docs/guide.md', RUST_SOURCES, false],
+		['a bare directory, over a sibling sharing its prefix', `${CRATE}-x/a.rs`, CRATE, false],
+	])('answers %s', (_case, file, pattern, expected) => {
+		expect(path_glob.matches(file, pattern)).toBe(expected)
+	})
+})

package/scripts/gate/toolchain-inputs.consumer.test.ts

@@ -0,0 +1,36 @@
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { expect, it, onTestFinished } from 'vitest'
+import { toolchain_inputs } from './toolchain-inputs'
+
+const MANIFEST = 'package.json'
+const RULE = 'eslint/rule.js'
+const CONFIG = 'tsconfig.json'
+
+function inputs(): string {
+	// Distributed tests cannot import kit's unpublished tools/test helper; cleanup is registered below.
+	// eslint-disable-next-line no-restricted-syntax
+	const root = mkdtempSync(path.join(tmpdir(), 'consumer-toolchain-'))
+
+	onTestFinished(() => rmSync(root, { recursive: true, force: true }))
+	mkdirSync(path.join(root, 'eslint'))
+	writeFileSync(path.join(root, RULE), 'export default {}\n')
+	writeFileSync(path.join(root, MANIFEST), '{}\n')
+	symlinkSync(path.join(root, 'missing.json'), path.join(root, CONFIG))
+
+	return root
+}
+
+it('verifies every distributed toolchain operation without kit internals (ac-07c1d077)', () => {
+	const root = inputs()
+
+	expect(toolchain_inputs.paths(root)).toEqual([RULE, MANIFEST, CONFIG])
+	expect(toolchain_inputs.is_input(RULE)).toBe(true)
+	expect(toolchain_inputs.is_input(MANIFEST)).toBe(true)
+	expect(toolchain_inputs.is_input('eslint/rule.test.ts')).toBe(false)
+	const before = toolchain_inputs.digest(root)
+
+	writeFileSync(path.join(root, RULE), 'export default { changed: true }\n')
+	expect(toolchain_inputs.digest(root)).not.toBe(before)
+})

package/scripts/gate/verification-inputs.ts

@@ -3,6 +3,7 @@ import path from 'node:path'
 import { config_fingerprint } from '#eslint/config-fingerprint.js'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { lint_related_scope } from '#scripts/lint/lint-related-scope'
+import { test_runner_config } from '#scripts/test/test-runner-config'
 import { gate_labels } from './gate-labels'
 import { input_fingerprint } from './input-fingerprint'
 import { toolchain_inputs } from './toolchain-inputs'
@@ -52,7 +53,7 @@ const PRETTIER_CONFIG_PREFIX = '.prettierrc'
 // A file name starting with one of these configures the TypeScript program a check compiles, and the
 // test runner for the unit step.
 const COMPILER_CONFIG_PREFIXES = ['tsconfig', 'svelte.config.'] as const
-const TEST_CONFIG_PREFIXES = [...COMPILER_CONFIG_PREFIXES, 'vitest.config.', 'vite.config.']
+const TEST_CONFIG_PREFIXES = [...COMPILER_CONFIG_PREFIXES, ...test_runner_config.PREFIXES]
 
 // A file name starting with one of these, a path under one of the directories, or a module the eslint
 // config imports configures prettier, eslint or the TypeScript program its type-aware rules read.

package/scripts/gh/fix-gh-packages-logic.ts

@@ -8,7 +8,7 @@ const TARBALL_PREFIX = '      tarball: '
 const FLOW_RESOLUTION_LINE_START = '\n    resolution: {'
 const FLOW_TARBALL_KEY = ', tarball: '
 const NPMRC_AUTH_TOKEN_PREFIX = `//${GH_PACKAGES_HOST}/:_authToken=`
-const REGISTRY_KEY = ':registry='
+const REGISTRY_KEY = ':registry'
 
 interface PackageResolution {
 	integrity?: string | undefined
@@ -44,29 +44,35 @@ function parse_lockfile_packages(raw: string): Record<string, LockfilePackage> {
 	return merged
 }
 
-function extract_gh_registry_scope(line: string): string | undefined {
+function registry_entry(line: string): [string, string] | undefined {
 	const trimmed = line.trim()
 	if (!trimmed.startsWith('@')) return undefined
-	const eq_index = trimmed.indexOf(REGISTRY_KEY)
-	if (eq_index === -1) return undefined
-	const registry = trimmed
-		.slice(eq_index + REGISTRY_KEY.length)
-		.trim()
-		.replace(/\/$/u, '')
-	if (registry !== `https://${GH_PACKAGES_HOST}`) return undefined
+	const eq_index = trimmed.indexOf('=')
+	const key = trimmed.slice(0, eq_index).trim()
+	if (eq_index === -1 || !key.endsWith(REGISTRY_KEY)) return undefined
 
-	return trimmed.slice(0, eq_index)
+	return [key.slice(0, -REGISTRY_KEY.length), trimmed.slice(eq_index + 1).trim()]
 }
 
-function parse_gh_scopes(npmrc: string): Set<string> {
-	const scopes = new Set<string>()
+function parse_scope_registries(npmrc: string): Map<string, string> {
+	const registries = new Map<string, string>()
 
 	for (const line of npmrc.split('\n')) {
-		const scope = extract_gh_registry_scope(line)
-		if (scope !== undefined) scopes.add(scope)
+		const entry = registry_entry(line)
+		if (entry !== undefined) registries.set(...entry)
 	}
 
-	return scopes
+	return registries
+}
+
+function parse_gh_scopes(npmrc: string): Set<string> {
+	const entries = [...parse_scope_registries(npmrc)]
+
+	return new Set(
+		entries
+			.filter(([, registry]) => registry.replace(/\/$/u, '') === `https://${GH_PACKAGES_HOST}`)
+			.map(([scope]) => scope),
+	)
 }
 
 function extract_auth_token_from_line(line: string): string | undefined {
@@ -218,6 +224,7 @@ function resolve_token(
 
 const fix_gh_packages_logic = {
 	parse_gh_scopes,
+	parse_scope_registries,
 	parse_npmrc_auth_token,
 	parse_lockfile_packages,
 	package_path_from_key,

package/scripts/gh/gh-request-tally.ts

@@ -15,6 +15,9 @@
 // include that call's cost. The difference is an upper bound for this process: the account's other
 // processes spend the same allowance.
 
+import { run_startup } from '#scripts/run/startup/run-startup'
+import { gh_call_kind } from './gh-call-kind'
+
 interface CallCount {
 	calls: number
 	not_modified: number
@@ -97,6 +100,7 @@ function snapshot(): GhRequestTally {
 
 // `kind` is the call's `gh_call_kind` key.
 function count_call(kind: string): void {
+	run_startup.metric('api', gh_call_kind.class_of(kind))
 	if (core.read !== undefined) core.start ??= core.read()
 	tally.calls += 1
 	endpoint_of(kind).calls += 1

package/scripts/hooks/bash-revert.ts

@@ -5,6 +5,8 @@ import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { hook_decision } from '#scripts/josh/hook-decision'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { json_value } from '#scripts/lib/json-value'
+import { time_bundle_call } from '#scripts/time-runtime/time-bundle-call'
+import { time_shell } from '#scripts/time-runtime/time-shell'
 import { z } from 'zod'
 import { step_zero_notice } from './step-zero-notice'
 
@@ -16,7 +18,9 @@ import { step_zero_notice } from './step-zero-notice'
 // the edit it carried survives (#6812); a dirty file whose saved copy no longer matches its stamp is
 // only named — and the session is told which paths it may not write. A session that can
 // implement is never stamped nor reverted, and a path outside the runtime set (`.josh/`, a doc) is
-// left as the shell wrote it.
+// left as the shell wrote it. **Only a change the call's own command names is this shell's**
+// (joshuafolkken/kit#7495): another session sharing the checkout writes in the same window and a hash
+// cannot tell the writers apart, so a change the command does not name is left in place and named.
 
 const STAMP_PREFIX = 'josh-bash-revert-'
 const UNTRACKED = '??'
@@ -28,21 +32,27 @@ const OPERATIONAL_RECORDS = '.josh/'
 const BACKUP_DIRECTORY = '.josh/tmp/bash-revert'
 const BEFORE_CALL_DIRECTORY = 'before-call'
 const STAMP_EXTENSION = '.json'
+// Any run of characters a path word does not carry: quotes, spaces, operators.
+const PATH_BREAK = /[^\w./-]+/u
 const snapshot_schema = z.record(z.string(), z.string())
 
 type Snapshot = Record<string, string>
 
 // `revert` holds the dirty entries clean before the call; `restore` the files dirty before it whose
-// saved content matches the stamp; `keep` the rest dirty before it, which nothing can put back.
+// saved content matches the stamp; `keep` the rest dirty before it, which nothing can put back;
+// `unknown` the changed files the command does not name, whose writer may be another process.
 interface Moved {
 	revert: Array<string>
 	restore: Array<string>
 	keep: Array<string>
+	unknown: Array<string>
 }
 
-const NONE_MOVED: Moved = { revert: [], restore: [], keep: [] }
+const NONE_MOVED: Moved = { revert: [], restore: [], keep: [], unknown: [] }
 
 const HANDOFF = 'This shell wrote runtime files; hand implementation to a worker lane.'
+const UNKNOWN_WRITER =
+	'Changed during the call by a writer its command does not name, so left in place:'
 
 function content_hash(file: string): string {
 	return existsSync(file) ? stamp_file.digest(readFileSync(file)) : ABSENT
@@ -74,13 +84,23 @@ function snapshot(root: string, entries: Array<string> = dirty_entries(root)): S
 	return Object.fromEntries(runtime.map((file) => [file, content_hash(path.join(root, file))]))
 }
 
-// The transcript of a consultation session's `Bash` call, the only call this guards.
-function guarded_transcript(raw_payload: string): string | undefined {
+interface GuardedCall {
+	transcript: string
+	command: string
+}
+
+// The transcript and command of a consultation session's `Bash` call, the only call this guards.
+function guarded_call(raw_payload: string): GuardedCall | undefined {
 	if (agent_session_role.can_implement()) return undefined
 
 	const payload = hook_decision.parse_hook_payload(raw_payload)
 
-	return payload?.tool_name === 'Bash' ? payload.transcript_path : undefined
+	if (payload?.tool_name !== 'Bash') return undefined
+
+	return {
+		transcript: payload.transcript_path,
+		command: time_shell.bash_command(payload.tool_input),
+	}
 }
 
 function copy_into(source: string, destination: string): void {
@@ -104,7 +124,7 @@ function save_dirty(before: Snapshot, root: string, saved: string): void {
 }
 
 function stamp(raw_payload: string, root: string = process.cwd()): void {
-	const transcript = guarded_transcript(raw_payload)
+	const transcript = guarded_call(raw_payload)?.transcript
 
 	if (transcript === undefined) return
 
@@ -158,6 +178,32 @@ function moved_entries(transcript: string, root: string): Moved {
 		}),
 		restore: intact,
 		keep: dirty.filter((file) => !intact.includes(file)),
+		unknown: [],
+	}
+}
+
+// A whole word of `command` is `file`, relative or under an absolute root — `src/app.ts` does not
+// name `src/app.tsx`. A read (`cat`, `grep`, a reading `josh` command — `time_bundle_call`'s reading)
+// names a file without writing it, so a change to one it reads is another writer's.
+function names(command: string, file: string): boolean {
+	if (time_bundle_call.bash_facts(command).is_bundleable) return false
+
+	return command.split(PATH_BREAK).some((word) => word === file || word.endsWith(`/${file}`))
+}
+
+// Splits the moved files into the ones `command` names, this shell's, and the rest, `unknown`.
+function attributed(moved: Moved, command: string): Moved {
+	const changed = [
+		...moved.revert.map((entry) => entry_file(entry)),
+		...moved.restore,
+		...moved.keep,
+	]
+
+	return {
+		revert: moved.revert.filter((entry) => names(command, entry_file(entry))),
+		restore: moved.restore.filter((file) => names(command, file)),
+		keep: moved.keep.filter((file) => names(command, file)),
+		unknown: changed.filter((file) => !names(command, file)),
 	}
 }
 
@@ -199,41 +245,43 @@ function put_back(moved: Moved, root: string, backup: string, saved: string): vo
 	for (const file of moved.restore) restore_saved(file, root, backup, saved)
 }
 
-function block_reason(moved: Moved, backup: string): string {
-	const parts = [HANDOFF]
-
-	if (moved.revert.length > 0) {
-		parts.push(`Reverted: ${moved.revert.map((entry) => entry_file(entry)).join(', ')}.`)
-	}
-
-	if (moved.restore.length > 0) {
-		parts.push(`Restored to their content before the call: ${moved.restore.join(', ')}.`)
-	}
-
-	if (moved.revert.length + moved.restore.length > 0) {
-		parts.push(`Their content before the revert: ${backup}/.`)
-	}
-
-	if (moved.keep.length > 0) {
-		parts.push(`Changed, kept as dirty before the call: ${moved.keep.join(', ')}.`)
-	}
+// Each sentence of the block with the files it is about; one about no file is left out.
+function reason_parts(moved: Moved, backup: string): Array<[Array<string>, string]> {
+	const reverted = moved.revert.map((entry) => entry_file(entry))
+	const put_back_files = [...reverted, ...moved.restore]
+
+	return [
+		[[...put_back_files, ...moved.keep], HANDOFF],
+		[reverted, `Reverted: ${reverted.join(', ')}.`],
+		[moved.restore, `Restored to their content before the call: ${moved.restore.join(', ')}.`],
+		[put_back_files, `Their content before the revert: ${backup}/.`],
+		[moved.keep, `Changed, kept as dirty before the call: ${moved.keep.join(', ')}.`],
+		[moved.unknown, `${UNKNOWN_WRITER} ${moved.unknown.join(', ')}.`],
+	]
+}
 
-	return parts.join(' ')
+function block_reason(moved: Moved, backup: string): string {
+	return reason_parts(moved, backup)
+		.filter(([files]) => files.length > 0)
+		.map(([, sentence]) => sentence)
+		.join(' ')
 }
 
 // The block a `PostToolUse` hook answers with, naming the moved paths, or nothing to say.
 function revert(raw_payload: string, root: string = process.cwd()): string | undefined {
-	const transcript = guarded_transcript(raw_payload)
+	const call = guarded_call(raw_payload)
+
+	if (call === undefined) return undefined
 
-	if (transcript === undefined) return undefined
+	const moved = attributed(moved_entries(call.transcript, root), call.command)
 
-	const moved = moved_entries(transcript, root)
+	const { revert: reverted, restore: restored, keep, unknown } = moved
 
-	if (moved.revert.length + moved.restore.length + moved.keep.length === 0) return undefined
+	if ([reverted, restored, keep, unknown].every((files) => files.length === 0)) return undefined
 
 	const backup = path.join(BACKUP_DIRECTORY, new Date().toISOString().replaceAll(':', '-'))
 
-	put_back(moved, root, path.join(root, backup), saved_directory(transcript, root))
+	put_back(moved, root, path.join(root, backup), saved_directory(call.transcript, root))
 
 	return JSON.stringify({ decision: 'block', reason: block_reason(moved, backup) })
 }

package/scripts/hooks/format-edited-file.ts

@@ -8,6 +8,7 @@ import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { eslint_daemon } from '#scripts/lint/eslint-daemon'
 import { eslint_daemon_calls } from '#scripts/lint/eslint-daemon-calls'
 import { eslint_trim } from '#scripts/lint/eslint-trim'
+import { format_steps } from '#scripts/lint/format-steps'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { execa } from 'execa'
 import { z } from 'zod'
@@ -343,20 +344,17 @@ async function collect_unfixed(
 	runner: CommandRunner,
 	project_root: string,
 ): Promise<string> {
-	let unfixed = ''
-
-	for (const command of plan) {
+	const results = await format_steps.in_order(plan, async (command) => {
 		try {
-			// eslint-disable-next-line no-await-in-loop -- formatters rewrite the same file, in plan order
-			unfixed = eslint_unfixed(command, await runner(command, project_root)) ?? unfixed
+			return eslint_unfixed(command, await runner(command, project_root))
 		} catch {
 			// One formatter failing to start is not a reason to skip the next: prettier runs last, and
 			// it is the one whose output the project's own lint step checks.
-			continue
+			return ''
 		}
-	}
+	})
 
-	return unfixed
+	return results.findLast(Boolean) ?? ''
 }
 
 // The edited file as the daemon read it, or nothing when no eslint command linted it — a `.json`

package/scripts/hooks/implementation-shell.ts

@@ -7,8 +7,9 @@ import { implementation_shell_nested } from './implementation-shell-nested'
 import { step_zero_notice } from './step-zero-notice'
 
 // A consultation scope's pre-execution check (joshuafolkken/kit#6586): a shell runs unless it makes a
-// change no later check takes back. A runtime file a call changes is restored after it
-// (`bash-revert.ts`); a visible write to one is still refused here, as is every call
+// change no later check takes back. A runtime file a call changes and names is restored after it
+// (`bash-revert.ts`; one it does not name is only reported, #7495); a visible write to one is still
+// refused here, as is every call
 // `implementation-shell-deny.ts` names — in a segment, a substitution or a program another one launches.
 const FILE_PROGRAMS: ReadonlySet<string> = new Set(['tee', 'touch', 'rm', 'truncate'])
 // The other programs that write the files their arguments name. `bash-revert.ts` restores only the

package/scripts/init/distributed-paths.ts

@@ -20,10 +20,13 @@ const GITHUB_REPO_TREE_BASE = 'https://github.com/joshuafolkken/kit/tree/main/'
 // The consumer imports kit's published, already path-transformed rules. A tracked bootstrap note
 // remains readable before installation, while the rule body stays in the package (kit#1878).
 const CLAUDE_MD_IMPORT_LINE = '@node_modules/@joshuafolkken/kit/dist/CLAUDE.md'
-const OLD_CLAUDE_MD_BOOTSTRAP =
-	'> Fresh checkout: if kit is not installed, run `pnpm install` first, then reread this file before doing any other work.'
+// Earlier bootstrap notes, oldest first. Sync replaces each in place with the current one.
+const OLD_CLAUDE_MD_BOOTSTRAPS = [
+	'> Fresh checkout: if kit is not installed, run `pnpm install` first, then reread this file before doing any other work.',
+	'> Fresh checkout: before `pnpm install`, run `pnpm config get "@joshuafolkken:registry"` from the project root to check the effective registry, including user-level settings. If it points to GitHub Packages, [set up authentication](https://github.com/joshuafolkken/kit/blob/main/docs/authentication.md#1-get-a-token-from-the-gh-cli) first. Then run `pnpm install` and reread this file before doing any other work.',
+]
 const CLAUDE_MD_BOOTSTRAP =
-	'> Fresh checkout: before `pnpm install`, run `pnpm config get "@joshuafolkken:registry"` from the project root to check the effective registry, including user-level settings. If it points to GitHub Packages, [set up authentication](https://github.com/joshuafolkken/kit/blob/main/docs/authentication.md#1-get-a-token-from-the-gh-cli) first. Then run `pnpm install` and reread this file before doing any other work.'
+	'> Fresh checkout: before `pnpm install`, run `pnpm config get "@joshuafolkken:registry"` from the project root to check the effective registry, including user-level settings. If it points to GitHub Packages, [migrate the project to npm](https://github.com/joshuafolkken/kit/blob/main/docs/registry-migration.md) first, or [set up authentication](https://github.com/joshuafolkken/kit/blob/main/docs/authentication.md#1-get-a-token-from-the-gh-cli) while it still installs from there. Then run `pnpm install` and reread this file before doing any other work.'
 
 // A span containing `*` is excluded: it is a **glob**, not a reference to a file a consumer can
 // open. A distributed document that writes a directory set as `prompts/**` means "anything beneath
@@ -81,12 +84,22 @@ function transform_distributed_paths(content: string): string {
 	return transform_documentation_paths(with_tests)
 }
 
+function replace_old_bootstraps(content: string): string {
+	let updated = content
+
+	for (const old of OLD_CLAUDE_MD_BOOTSTRAPS) {
+		updated = updated.replace(old, () => CLAUDE_MD_BOOTSTRAP)
+	}
+
+	return updated
+}
+
 // Keep the bootstrap note ahead of the import so an agent can read it in a fresh checkout. Preserve
 // project additions and update older one-line files without duplicating either line.
 function ensure_claude_md_import(existing: string | undefined): string {
 	if (existing === undefined) return `${CLAUDE_MD_BOOTSTRAP}\n\n${CLAUDE_MD_IMPORT_LINE}\n`
 
-	const updated = existing.replace(OLD_CLAUDE_MD_BOOTSTRAP, () => CLAUDE_MD_BOOTSTRAP)
+	const updated = replace_old_bootstraps(existing)
 
 	if (updated.includes(CLAUDE_MD_IMPORT_LINE)) {
 		if (updated.includes(CLAUDE_MD_BOOTSTRAP)) return updated
@@ -101,7 +114,7 @@ function ensure_claude_md_import(existing: string | undefined): string {
 // or a switch from full, leaves these behind for it to remove.
 const FULL_CLAUDE_MD_LINES = new Set([
 	CLAUDE_MD_BOOTSTRAP,
-	OLD_CLAUDE_MD_BOOTSTRAP,
+	...OLD_CLAUDE_MD_BOOTSTRAPS,
 	CLAUDE_MD_IMPORT_LINE,
 ])
 

package/scripts/init/init-actions.ts

@@ -2,6 +2,8 @@ import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import { json_format } from '#scripts/config-merge/json-format'
 import { string_array_schema, vscode_settings_schema } from '#scripts/lib/schemas'
+import { migrate_lock } from '#scripts/registry-migration/migrate-lock'
+import { npm_acquisition } from '#scripts/registry-migration/npm-acquisition'
 import { init_logic } from './init-logic'
 import { package_path, PROJECT_ROOT } from './init-paths'
 import type { ProjectShape } from './project-profile'
@@ -201,8 +203,20 @@ function build_gitignore_action(): FileAction {
 	)
 }
 
+function build_npmrc_actions(): Array<FileAction> {
+	if (!npm_acquisition.can_manage(PROJECT_ROOT)) return []
+
+	return [
+		build_action(
+			'.npmrc',
+			() => migrate_lock.npmrc(''),
+			(existing) => init_logic.merge_npmrc(existing, PROJECT_ROOT),
+		),
+	]
+}
+
 function build_basic_actions(shape: ProjectShape): ReadonlyArray<FileAction> {
-	const actions: Array<FileAction> = []
+	const actions: Array<FileAction> = [...build_npmrc_actions()]
 	if (shape.has_git) actions.push(build_gitignore_action())
 	if (shape.has_typescript) actions.push(build_basic_tsconfig_action())
 
@@ -226,6 +240,7 @@ function build_file_actions(shape?: ProjectShape): ReadonlyArray<FileAction> {
 	if (shape?.profile === 'basic') return build_basic_actions(shape)
 
 	return [
+		...build_npmrc_actions(),
 		...(shape?.has_git === false ? [] : [build_gitignore_action()]),
 		build_eslint_action(),
 		build_action(

package/scripts/init/init-bootstrap.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import path from 'node:path'
 import { package_manifest } from '#scripts/lib/package-manifest'
 import { file_content } from '#scripts/sync/file-content'
+import { sync_configs } from '#scripts/sync/sync-configs'
 import { z } from 'zod'
 import { init_basic } from './init-basic'
 import { init_install, type InstallStep } from './init-install'
@@ -130,6 +131,7 @@ function hand_off(
 	const install = kit_install_step(has_kit_dependency(project_root), template)
 
 	ensure_project_manifest(project_root)
+	sync_configs.sync_npmrc(path.join(project_root, NPMRC_FILE))
 	ensure_release_age(project_root, template)
 	if (!init_install.did_step_succeed(install, project_root)) return install_failure(install)
 	if (!init_install.did_step_succeed(handoff_step(args), project_root)) return HANDOFF_FAILURE