@joshuafolkken/kit 1.872.0 → 1.881.0

package/.github/workflows/publish.yml

@@ -5,7 +5,7 @@ on:
     types: [new-tag-created]
 
 jobs:
-  publish:
+  publish-github:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -13,6 +13,8 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.client_payload.tag }}
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -34,6 +36,41 @@ jobs:
 
       - run: pnpm install --frozen-lockfile --ignore-scripts
 
-      - run: pnpm publish --no-git-checks --tag latest
+      - run: pnpm publish --no-git-checks --tag latest --registry https://npm.pkg.github.com
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-npm:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.client_payload.tag }}
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Resolve pnpm version
+        id: pnpm-version
+        run: |
+          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
+          test -n "$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          version: ${{ steps.pnpm-version.outputs.version }}
+          install: false
+
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - run: pnpm pack --out "$RUNNER_TEMP/kit.tgz"
+
+      - name: Publish to npm
+        run: cd "$RUNNER_TEMP" && npm publish kit.tgz --access public --tag latest --registry https://registry.npmjs.org --userconfig /dev/null

package/README.md

@@ -8,12 +8,11 @@ Shared toolchain config and CLI for TypeScript projects — ESLint, Prettier, Ty
 ## Prerequisites
 
 - [Node.js](https://nodejs.org/) with [pnpm](https://pnpm.io/)
-- [gh CLI](https://cli.github.com/) — required for GitHub Packages authentication. Install via `brew install gh` (macOS), `winget install GitHub.cli` (Windows), or see the [gh installation docs](https://github.com/cli/cli#installation).
+- [gh CLI](https://cli.github.com/) for `josh version` and existing GitHub Packages consumers. It is not required to install kit from public npm; see [authentication.md](./docs/authentication.md) for setup when needed.
 
 ## Quick start
 
 ```bash
-gh auth login --scopes read:packages   # see docs/authentication.md for the full setup
 pnpm add -g @joshuafolkken/kit          # install the josh CLI globally
 josh help
 ```
@@ -25,9 +24,10 @@ Using the kit inside a project? See [docs/package.md](./docs/package.md).
 | Guide                                           | What it covers                                                                   |
 | ----------------------------------------------- | -------------------------------------------------------------------------------- |
 | [why.md](./docs/why.md)                         | Why kit exists — the AI-development problems it solves, for practitioners        |
-| [authentication.md](./docs/authentication.md)   | One-time GitHub Packages auth — `gh` token, `NODE_AUTH_TOKEN`, `.npmrc`          |
+| [authentication.md](./docs/authentication.md)   | GitHub Packages auth for existing projects                                       |
 | [cli.md](./docs/cli.md)                         | Install and use the global `josh` CLI                                            |
 | [package.md](./docs/package.md)                 | Use the kit as a project devDependency — configs, prompts, scripts, `josh init`  |
+| [publishing.md](./docs/publishing.md)           | First public npm release and trusted publishing setup                            |
 | [josh-commands.md](./docs/josh-commands.md)     | Full `josh` CLI command reference                                                |
 | [overview.md](./docs/overview.md)               | What the kit provides and how it works                                           |
 | [troubleshooting.md](./docs/troubleshooting.md) | `401`/`404` auth errors, `josh: command not found`, stale shim, version mismatch |

package/dist/hooks/batch-guard.js

@@ -9,10 +9,10 @@ import {
   load_environment_file,
   notice_refusal_path,
   refusal_path
-} from "./chunk-B2LIXYFL.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-FRJKVSK3.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/{chunk-KABG6AEW.js → chunk-264QY6KS.js}

@@ -1016,6 +1016,12 @@ var PROJECT_COMMANDS = {
     category: "Project",
     reference: ["", "developer", ["files"]]
   },
+  "registry:migrate": {
+    script: "scripts/registry-migration/migrate.ts",
+    description: "Migrate a kit-only project from GitHub Packages to public npm",
+    category: "Project",
+    reference: ["", "developer", ["files", "network", "processes"]]
+  },
   "sync:scope": {
     script: "scripts/sync/managed-config-scope-cli.ts",
     description: "Say whether this change touches a file josh sync distributes",
@@ -1237,6 +1243,7 @@ var ALIASES = {
   pt: "port",
   i: "init",
   sy: "sync",
+  rmi: "registry:migrate",
   sys: "sync:scope",
   g: "git",
   gp: "pr",

package/dist/hooks/{chunk-I4D3NVUD.js → chunk-36UE53LS.js}

@@ -1,13 +1,13 @@
 import {
   lane_child_marker
-} from "./chunk-3PWPYDD2.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   time_bundle_call,
   time_format,
   time_round_trips,
   time_spans,
   time_transcript_line
-} from "./chunk-D2PIDYJR.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/lane/lane-guard-policy.ts
 var DEFAULT_MODE = "refuse";

package/dist/hooks/{chunk-WCYPBPJC.js → chunk-4OXFU3MK.js}

@@ -29,28 +29,28 @@ import {
   run_watcher_guard,
   shell_segments,
   tail_commands
-} from "./chunk-2XIGZQMQ.js";
+} from "./chunk-VGYSA2NT.js";
 import {
   batch_outcome
-} from "./chunk-B2LIXYFL.js";
+} from "./chunk-FRJKVSK3.js";
 import {
   investigation_refusal
-} from "./chunk-E55NKX5F.js";
+} from "./chunk-ZBK4XRAS.js";
 import {
   duplicate_read_outcome
-} from "./chunk-2RUPMGGV.js";
+} from "./chunk-PRDCNGA6.js";
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision,
   lane_child_marker,
   run_issue_number
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_attribute,
@@ -61,7 +61,7 @@ import {
   lane_paths,
   stamp_file,
   time_shell
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/hooks/pretool-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-ABVEVV2M.js → chunk-6MQCXEEA.js}

@@ -1,7 +1,7 @@
 import {
   ESLINT_EDIT_CACHE_FLAGS,
   time_density_hook
-} from "./chunk-44M6JXGV.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/hooks/format-edited-file.ts
 import { existsSync as existsSync3 } from "node:fs";

package/dist/hooks/{chunk-46EEEHC3.js → chunk-FNFOLFFV.js}

@@ -3,7 +3,7 @@ import {
   stamp_file,
   time_density_hook,
   time_hook_transcript
-} from "./chunk-44M6JXGV.js";
+} from "./chunk-264QY6KS.js";
 import {
   josh_environment_file
 } from "./chunk-FXAKJKTB.js";

package/dist/hooks/{chunk-5U5EZYG6.js → chunk-FRJKVSK3.js}

@@ -1,10 +1,10 @@
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-KFH4H7W7.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-46EEEHC3.js";
+} from "./chunk-FNFOLFFV.js";
 
 // scripts/hooks/batch-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-2RUPMGGV.js → chunk-PRDCNGA6.js}

@@ -1,16 +1,16 @@
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   json_value,
   time_spans
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/delegation/duplicate-read-guard.ts
 import { statSync } from "node:fs";

package/dist/hooks/{chunk-WMN4TSVF.js → chunk-VGYSA2NT.js}

@@ -1,7 +1,7 @@
 import {
   lane_child_marker,
   run_issue_number
-} from "./chunk-GOPHRLGO.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_blocks,
@@ -11,7 +11,7 @@ import {
   time_density_hook,
   time_shell,
   time_transcript_line
-} from "./chunk-PDVHQITQ.js";
+} from "./chunk-264QY6KS.js";
 import {
   ENV_FILE_NAME,
   LANE_SEAT_KEY,

package/dist/hooks/{chunk-A5YJ3H7E.js → chunk-Y5OYCU2F.js}

@@ -1,16 +1,16 @@
 import {
   time_batch_guard
-} from "./chunk-XAI3YTHJ.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-TLZ27PCY.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   cost_blocks,
   cost_transcript,
   time_bundle_call,
   time_shell,
   time_spans
-} from "./chunk-KMV4OY77.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/delegation/investigation-reads.ts
 import path from "node:path";

package/dist/hooks/{chunk-4QHBNAI4.js → chunk-ZBK4XRAS.js}

@@ -1,12 +1,12 @@
 import {
   investigation_reads
-} from "./chunk-G7JL2A5K.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy
-} from "./chunk-HDEXAOUM.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-N3MJADY7.js";
+} from "./chunk-FNFOLFFV.js";
 
 // scripts/delegation/investigation-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/codex-hook-adapter.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env tsx
 import {
   pretool_guard
-} from "./chunk-WCYPBPJC.js";
-import "./chunk-2XIGZQMQ.js";
+} from "./chunk-4OXFU3MK.js";
+import "./chunk-VGYSA2NT.js";
 import {
   build_envelope,
   compose_context,
   format_edited_payload
-} from "./chunk-BIWLABFK.js";
-import "./chunk-B2LIXYFL.js";
-import "./chunk-E55NKX5F.js";
-import "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
+} from "./chunk-6MQCXEEA.js";
+import "./chunk-FRJKVSK3.js";
+import "./chunk-ZBK4XRAS.js";
+import "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   time_density_hook
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 

package/dist/hooks/duplicate-read-guard.js

@@ -9,11 +9,11 @@ import {
   is_enabled,
   notice_refusal_path,
   refusal_path
-} from "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/format-edited.js

@@ -15,8 +15,8 @@ import {
   relative_to_root,
   resolve_invocations,
   select_invocation
-} from "./chunk-BIWLABFK.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-6MQCXEEA.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-SSX23SJ2.js";
 export {
   ESLINT_DAEMON,

package/dist/hooks/investigation-guard.js

@@ -10,11 +10,11 @@ import {
   is_enabled,
   load_environment_file,
   refusal_path
-} from "./chunk-E55NKX5F.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-ZBK4XRAS.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/pretool-guard.js

@@ -3,15 +3,15 @@ import {
   pretool_guard,
   pretool_outcome,
   pretool_outcome_async
-} from "./chunk-WCYPBPJC.js";
-import "./chunk-2XIGZQMQ.js";
-import "./chunk-B2LIXYFL.js";
-import "./chunk-E55NKX5F.js";
-import "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-4OXFU3MK.js";
+import "./chunk-VGYSA2NT.js";
+import "./chunk-FRJKVSK3.js";
+import "./chunk-ZBK4XRAS.js";
+import "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/stop-guard.js

@@ -15,20 +15,20 @@ import {
   run_hold,
   run_invocation,
   run_watcher_guard
-} from "./chunk-2XIGZQMQ.js";
+} from "./chunk-VGYSA2NT.js";
 import {
   session_language
 } from "./chunk-6V5OPIUU.js";
 import {
   hook_decision,
   lane_child_marker
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PROJECT_ROOT,
   stamp_file,
   time_density_hook,
   time_hook_transcript
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 

package/dist/josh.js

@@ -1173,6 +1173,12 @@ var PROJECT_COMMANDS = {
     category: "Project",
     reference: ["", "developer", ["files"]]
   },
+  "registry:migrate": {
+    script: "scripts/registry-migration/migrate.ts",
+    description: "Migrate a kit-only project from GitHub Packages to public npm",
+    category: "Project",
+    reference: ["", "developer", ["files", "network", "processes"]]
+  },
   "sync:scope": {
     script: "scripts/sync/managed-config-scope-cli.ts",
     description: "Say whether this change touches a file josh sync distributes",
@@ -1403,6 +1409,7 @@ var ALIASES = {
   pt: "port",
   i: "init",
   sy: "sync",
+  rmi: "registry:migrate",
   sys: "sync:scope",
   g: "git",
   gp: "pr",

package/package.json

@@ -1,8 +1,12 @@
 {
-  "version": "1.872.0",
+  "version": "1.881.0",
   "name": "@joshuafolkken/kit",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/joshuafolkken/kit.git"
+  },
   "engines": {
     "node": ">=22.19.0"
   },
@@ -166,4 +170,4 @@
     "build": "tsx scripts/build/build-bin.ts && tsx scripts/build/build-hooks.ts && tsx scripts/build/build-version.ts && tsx scripts/build/build-config-merge.ts && tsx scripts/build/build-managed-marker.ts && tsx scripts/build/build-self-sync-guard.ts && tsx scripts/build/build-claude-md.ts",
     "josh": "tsx scripts/josh/josh.ts"
   }
-}
+}

package/scripts/init/distributed-paths.ts

@@ -17,11 +17,11 @@ const ESLINT_PACKAGE_PREFIX = `${KIT_PACKAGE_PATH_PREFIX}eslint/`
 const GITHUB_REPO_BLOB_BASE = 'https://github.com/joshuafolkken/kit/blob/main/'
 const GITHUB_REPO_TREE_BASE = 'https://github.com/joshuafolkken/kit/tree/main/'
 
-// The single line a consumer's CLAUDE.md carries: an import of kit's published, already
-// path-transformed rules. The consumer's own additions sit below it. Distributed at publish time via
-// dist/CLAUDE.md (build-claude-md.ts) rather than byte-copied at sync time, so a package update alone
-// keeps the rules current (joshuafolkken/kit#1878).
+// The consumer imports kit's published, already path-transformed rules. A tracked bootstrap note
+// remains readable before installation, while the rule body stays in the package (kit#1878).
 const CLAUDE_MD_IMPORT_LINE = '@node_modules/@joshuafolkken/kit/dist/CLAUDE.md'
+const CLAUDE_MD_BOOTSTRAP =
+	'> Fresh checkout: if kit is not installed, run `pnpm install` first, then reread this file before doing any other work.'
 
 // A span containing `*` is excluded: it is a **glob**, not a reference to a file a consumer can
 // open. A distributed document that writes a directory set as `prompts/**` means "anything beneath
@@ -79,15 +79,18 @@ function transform_distributed_paths(content: string): string {
 	return transform_documentation_paths(with_tests)
 }
 
-// The consumer CLAUDE.md is one @import of kit's published rules plus whatever the project adds below
-// it. Ensure the import line is present without disturbing those additions: an absent file becomes
-// the line alone, a file already carrying it is returned untouched, and any other file keeps all its
-// content with the import prepended. The substring check makes it idempotent.
+// Keep the bootstrap note ahead of the import so an agent can read it in a fresh checkout. Preserve
+// project additions and update older one-line files without duplicating either line.
 function ensure_claude_md_import(existing: string | undefined): string {
-	if (existing === undefined) return `${CLAUDE_MD_IMPORT_LINE}\n`
-	if (existing.includes(CLAUDE_MD_IMPORT_LINE)) return existing
+	if (existing === undefined) return `${CLAUDE_MD_BOOTSTRAP}\n\n${CLAUDE_MD_IMPORT_LINE}\n`
 
-	return `${CLAUDE_MD_IMPORT_LINE}\n\n${existing}`
+	if (existing.includes(CLAUDE_MD_IMPORT_LINE)) {
+		if (existing.includes(CLAUDE_MD_BOOTSTRAP)) return existing
+
+		return `${CLAUDE_MD_BOOTSTRAP}\n\n${existing}`
+	}
+
+	return `${CLAUDE_MD_BOOTSTRAP}\n\n${CLAUDE_MD_IMPORT_LINE}\n\n${existing}`
 }
 
 const distributed_paths = {

package/scripts/init/hook-command-bootstrap.ts

@@ -0,0 +1,51 @@
+import { spawnSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { git_location_environment } from '#scripts/git/git-location-environment'
+
+interface HookResult {
+	status: number | null
+	stdout: string
+	stderr: string
+}
+
+function create_partial_install(temporary_root: string): void {
+	const package_root = path.join(temporary_root, 'node_modules/@joshuafolkken/kit')
+	const hook_path = path.join(package_root, 'dist/hooks/pretool-guard.js')
+
+	mkdirSync(path.dirname(hook_path), { recursive: true })
+	writeFileSync(path.join(package_root, 'package.json'), '{}')
+	writeFileSync(hook_path, "process.stdout.write('guard ran')")
+}
+
+function run_in_temporary_checkout(command: string, is_partial_install = false): HookResult {
+	const temporary_root = mkdtempSync(path.join(tmpdir(), 'kit-hook-bootstrap-'))
+	const git_environment = {
+		...process.env,
+		...git_location_environment.location_free_environment(),
+	}
+
+	try {
+		spawnSync('git', ['init', '-q'], {
+			cwd: temporary_root,
+			env: git_environment,
+		})
+
+		if (is_partial_install) create_partial_install(temporary_root)
+
+		const { status, stdout, stderr } = spawnSync('sh', ['-c', command], {
+			cwd: temporary_root,
+			encoding: 'utf8',
+			env: git_environment,
+		})
+
+		return { status, stdout, stderr }
+	} finally {
+		rmSync(temporary_root, { recursive: true, force: true })
+	}
+}
+
+const hook_command_bootstrap = { run_in_temporary_checkout }
+
+export { hook_command_bootstrap }

package/scripts/init/hook-command-rewrite.ts

@@ -21,6 +21,9 @@ const BUNDLE_INVOCATION = `node ${claude_plugin_config.MARKETPLACE_PATH}/dist/jo
 // The per-hook bundle directory a fresh clone builds, and where it lives inside the installed package.
 const HOOK_BUNDLE_DIR = `${hook_launch.HOOK_DIST_DIR}/`
 const CONSUMER_HOOK_BUNDLE_DIR = `${claude_plugin_config.MARKETPLACE_PATH}/${HOOK_BUNDLE_DIR}`
+const CONSUMER_PACKAGE_MANIFEST = `${claude_plugin_config.MARKETPLACE_PATH}/package.json`
+const MISSING_INSTALL_NOTICE = 'kit hooks inactive: run pnpm install, then reread CLAUDE.md'
+const MISSING_INSTALL_GUARD = `if [ ! -f ${CONSUMER_PACKAGE_MANIFEST} ]; then echo '${MISSING_INSTALL_NOTICE}' >&2; exit 0; fi; `
 const CODEX_ADAPTER_BUNDLE = `node ${CONSUMER_HOOK_BUNDLE_DIR}codex-hook-adapter.js`
 const CODEX_HOOKS_DESTINATION = '.codex/hooks.json'
 const CODEX_ROOT_PREFIX = String.raw`cd \"$(git rev-parse --show-toplevel)\" && `
@@ -43,11 +46,16 @@ function rebase_bundle_directory(value: string): string {
 // independent whichever order they run. The fallback rewrite is idempotent too (`BUNDLE_INVOCATION`
 // holds no `pnpm josh `), so the whole rewrite is safe to run more than once.
 function rewrite_command_value(value: string): string {
-	return rebase_bundle_directory(value)
+	const rewritten = rebase_bundle_directory(value)
 		.split(PNPM_JOSH_PREFIX)
 		.join(BUNDLE_INVOCATION)
 		.split(CODEX_ADAPTER_SOURCE)
 		.join(CODEX_ADAPTER_BUNDLE)
+
+	if (!rewritten.includes(claude_plugin_config.MARKETPLACE_PATH)) return rewritten
+	if (rewritten.includes(MISSING_INSTALL_GUARD)) return rewritten
+
+	return `${MISSING_INSTALL_GUARD}${rewritten}`
 }
 
 function rewrite_hook_commands(content: string, is_codex = false): string {

package/scripts/init/init-logic.ts

@@ -13,15 +13,9 @@ const DEV_ENGINES_VALUE = {
 	packageManager: { name: 'pnpm', version: '>=12.1.0', onFail: 'error' },
 }
 
-// The `@joshuafolkken:registry` mapping stays — it is a registry mapping, not a credential,
-// and pnpm honors it from a project .npmrc unconditionally. The matching `_authToken` line is
-// deliberately absent: by default pnpm >= 11.6 refuses to expand environment variables in
-// credentials read from a project .npmrc (the file is committed, so expansion could leak the
-// token to an attacker-controlled registry), so distributing the line would only add an
-// `Ignored project-level auth setting` warning on every command. Not distributing it is not the
-// same as removing it — see merge_npmrc.
+// New projects resolve kit from public npm. Existing registry and auth lines remain untouched
+// by merge_npmrc so consumers of other GitHub Packages can migrate separately.
 const NPMRC_LINES: ReadonlyArray<string> = [
-	'@joshuafolkken:registry=https://npm.pkg.github.com',
 	'engine-strict=true',
 	'minimum-release-age=1440',
 	'confirmModulesPurge=false',

package/scripts/josh/__snapshots__/josh-command-map.test.ts.snap

@@ -102,6 +102,7 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
     "rh": "run:hold",
     "rl": "report:lint",
     "rmg": "run:merge",
+    "rmi": "registry:migrate",
     "rn": "run:next",
     "rp": "run:prep",
     "rpy": "repo:party",
@@ -787,6 +788,15 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
         "processes",
       ],
     ],
+    "registry:migrate": [
+      "",
+      "developer",
+      [
+        "files",
+        "network",
+        "processes",
+      ],
+    ],
     "release": [
       "[version]",
       "maintainer",