@joshuafolkken/kit 1.872.0

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,132 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex, gender characteristics,
+gender identity and expression, level of experience, education, socio-economic
+status, nationality, personal appearance, race, caste, color, religion, or
+sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[INSERT CONTACT METHOD].
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available
+at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

package/GEMINI.md

@@ -0,0 +1,30 @@
+# Agent Instructions
+
+> **All rules for this repository live in [`CLAUDE.md`](./CLAUDE.md). Read it in full before doing
+> any work here, and follow every rule in it.** This file exists only to point at it.
+
+@CLAUDE.md
+
+`CLAUDE.md` is the single source. It is named for the tool that reads it by default, but nothing in
+it is Claude-specific — the naming conventions, quality limits, code-change rules, verification
+gate, git rules and collaboration workflow apply to whatever agent is doing the work.
+
+Rules that only apply while a particular command is running are not in `CLAUDE.md` either. It routes
+to them, and the routing is part of the rules: read the `<name>` skill when
+`CLAUDE.md` tells you to, and `prompts/*.md` when it names one.
+
+## Why this file is a pointer
+
+`AGENTS.md`, `GEMINI.md` and `CLAUDE.md` used to be three near-identical copies of the same rules,
+which meant one rule change had to be written three times and reviewed three times
+(joshuafolkken/kit#963). That is the clone the rules themselves prohibit — see "No clones —
+single-source" in `CLAUDE.md` — so the rules were single-sourced and these two became pointers.
+
+The `@CLAUDE.md` line above is Gemini CLI's own import syntax, which pulls the file in rather than
+relying on the agent to open it. It is written alongside the prose pointer rather than instead of
+it: an agent that does not understand the syntax reads the sentence, and one that does gets the
+rules without a tool call. **Neither form has been verified against a live Gemini CLI** — only
+Claude is in use here, and that decision is recorded in joshuafolkken/kit#970 under `## Decisions`.
+
+**Do not copy rules back into this file.** A rule added here is a fourth place to forget to update.
+Every change to how agents work in this repository belongs in `CLAUDE.md`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Joshua Folkken
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,41 @@
+# @joshuafolkken/kit
+
+Shared toolchain config and CLI for TypeScript projects — ESLint, Prettier, TypeScript, Lefthook, cspell, VS Code, and AI assistant files (CLAUDE.md, plus AGENTS.md / GEMINI.md pointing at it), wired together. It is framework-agnostic; the SvelteKit-specific layer lives in the separate [`@joshuafolkken/app-kit`](https://github.com/joshuafolkken/app-kit) package.
+
+- **`josh` CLI** — lint, format, type-check, git workflow, versioning, and security auditing from any directory.
+- **Project config package** — ESLint / Prettier / tsconfig presets, prompts, and scripts consumed as a devDependency.
+
+## Prerequisites
+
+- [Node.js](https://nodejs.org/) with [pnpm](https://pnpm.io/)
+- [gh CLI](https://cli.github.com/) — required for GitHub Packages authentication. Install via `brew install gh` (macOS), `winget install GitHub.cli` (Windows), or see the [gh installation docs](https://github.com/cli/cli#installation).
+
+## Quick start
+
+```bash
+gh auth login --scopes read:packages   # see docs/authentication.md for the full setup
+pnpm add -g @joshuafolkken/kit          # install the josh CLI globally
+josh help
+```
+
+Using the kit inside a project? See [docs/package.md](./docs/package.md).
+
+## Documentation
+
+| Guide                                           | What it covers                                                                   |
+| ----------------------------------------------- | -------------------------------------------------------------------------------- |
+| [why.md](./docs/why.md)                         | Why kit exists — the AI-development problems it solves, for practitioners        |
+| [authentication.md](./docs/authentication.md)   | One-time GitHub Packages auth — `gh` token, `NODE_AUTH_TOKEN`, `.npmrc`          |
+| [cli.md](./docs/cli.md)                         | Install and use the global `josh` CLI                                            |
+| [package.md](./docs/package.md)                 | Use the kit as a project devDependency — configs, prompts, scripts, `josh init`  |
+| [josh-commands.md](./docs/josh-commands.md)     | Full `josh` CLI command reference                                                |
+| [overview.md](./docs/overview.md)               | What the kit provides and how it works                                           |
+| [troubleshooting.md](./docs/troubleshooting.md) | `401`/`404` auth errors, `josh: command not found`, stale shim, version mismatch |
+
+## Contributing
+
+Community standards live in [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md); security reports go through [SECURITY.md](./SECURITY.md). Development conventions are documented in `CLAUDE.md`; `AGENTS.md` and `GEMINI.md` are pointers to it.
+
+## License
+
+MIT

package/SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.x     | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please do not report it publicly.
+
+- **Preferred**: Open a [draft security advisory](https://github.com/joshuafolkken/kit/security/advisories/new) on GitHub.
+- **Alternative**: Email [joshuafolkken@gmail.com](mailto:joshuafolkken@gmail.com) directly.
+
+We aim to acknowledge reports within **48 hours** and provide a resolution or mitigation plan within **7 days** for confirmed vulnerabilities.
+
+## Published Package Contents
+
+The following files are intentionally included in the published npm package and distributed to consuming projects via `josh sync`:
+
+- `.mcp.json` — MCP server configuration for the Svelte documentation server. Contains only the public endpoint `https://mcp.svelte.dev/mcp`. No credentials or private URLs.
+- `.coderabbit.yaml`, `.cursorrules` — AI tool configurations with no sensitive data.
+- `templates/`, `prompts/` — Markdown and config templates. No credentials.
+
+Sensitive runtime secrets (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`) are stored only in a local `.env` file which is gitignored and never committed to the repository.
+
+## MCP External Endpoints
+
+This project ships `.mcp.json` which connects to external MCP servers at runtime (e.g. `https://mcp.svelte.dev/mcp`). These servers are treated as trusted third-party services. Consumers should be aware that:
+
+- MCP tool responses from external servers are not sandboxed — treat them as you would any external API call.
+- If the external endpoint is compromised or returns malicious content, the AI agent executing the tool may act on it.
+- Review and pin the MCP server URL before deploying in sensitive environments.

package/cspell/index.yaml

@@ -0,0 +1,177 @@
+version: '0.2'
+useGitignore: true
+language: en
+ignorePaths:
+  - '**/.git/**'
+  # joshuafolkken/kit#1114: where Claude Code puts its bridge work trees — a full checkout of the
+  # project, on another branch, inside a directory this package ships. `useGitignore` above does not
+  # reach them: git excludes them through `.git/info/exclude`, a per-checkout file that is never
+  # committed and that nothing outside git reads. Left in, a spell check fails on a word introduced
+  # by work on a different branch, in a file the current one does not contain — the same gap that
+  # published them to npm until joshuafolkken/kit#1107 and linted them until joshuafolkken/kit#1112.
+  # `**/` rather than a root anchor, because a monorepo puts a package's work trees under it.
+  - '**/.claude/worktrees/**'
+  # joshuafolkken/kit#1256: the verification gate's own cache files. `useGitignore` above covers
+  # them in this repository, but the flags that write them ship in the same package version as this
+  # file while the matching `.gitignore` entries only reach a consumer on its next `josh sync` — so
+  # a consumer that upgrades and runs `pnpm josh gate` first has `josh cspell:dot` read whatever the
+  # other checks just wrote: measured at 125 spelling issues from one build-info file, with nothing
+  # misspelled in the tree. Naming them here makes the exclusion independent of that ordering. The
+  # build-info file appears only where the type check falls through to `josh check`; a project whose
+  # type check resolves to `josh-app check:ci` never writes one, and `.eslintcache` is written
+  # everywhere.
+  # joshuafolkken/kit#1332: the edit hook's own eslint cache, written wherever the hook runs. It is
+  # separate from `.eslintcache` above so that a hook run cannot delete the gate's copy, or overwrite
+  # it while the gate is linting the whole tree beside the review.
+  # joshuafolkken/kit#1347: `josh lint:related` has its own for the same reason — an implementation
+  # loop calls it while the gate lints the whole tree, and two eslint runs on one cache file discard
+  # each other's entries.
+  - '**/.eslintcache'
+  - '**/.eslintcache.edit'
+  - '**/.eslintcache.related'
+  - '**/.tsbuildinfo'
+  - '**/.cspellcache'
+  - '**/.gitignore'
+  - '**/pnpm-lock.yaml'
+  - '**/.vscode/**'
+  - '.wrangler/**'
+  - '.coderabbit.yaml'
+  #   - '**/*.d.ts'
+  #   - '**/*.map'
+  #   - '**/*.min.js'
+  #   - '**/*.svg'
+words:
+  # Git's `--show-toplevel` flag is added to every Codex hook command when `josh sync` copies the
+  # hooks into a consumer. The consumer spell-checks that transformed file with this dictionary.
+  - toplevel
+  # The POSIX call named in the shell error a lane close leaves behind when it removes the directory
+  # the shell is sitting in (joshuafolkken/kit#1587). Distributed, because `epicrun.md` quotes that
+  # message so the failure can be searched for, and `josh sync` copies that skill.
+  - getcwd
+  # The process-listing command `epicrun.md` names among the traces a stopped delegated unit leaves
+  # (joshuafolkken/kit#1212). Distributed, because the skill that names it is copied by `josh sync`.
+  - pgrep
+  # The shell variable naming the parent process, which `josh run:carry --owner "$PPID"` passes so the
+  # record can name the long-lived session spending the budget (joshuafolkken/kit#1722). Distributed,
+  # because `backlogrun.md` types that command and `josh sync` copies that skill.
+  - PPID
+  # The phase `josh time` reports for everything a run does once its pull request is open
+  # (joshuafolkken/kit#1299). Distributed, because `docs/josh-commands.md` names it in the phase list.
+  - wrapup
+  # What `josh time`'s bundling block calls a call that could have gone out beside another
+  # (joshuafolkken/kit#1607). Distributed, because `docs/josh-commands.md` and `turn-batching.md` name it.
+  - bundleable
+  # The alias for `josh lane:launch`, the composite lane-start command (joshuafolkken/kit#2162).
+  # Distributed, because `docs/josh-commands.md` and `backlogrun-lanes.md` name it and `josh sync`
+  # copies that skill. The other lane aliases are three letters, below cspell's checked-word length.
+  - lnla
+  # What a re-runnable tree-state check is and `josh run:hold` is not (joshuafolkken/kit#926): a
+  # question that may be put again once the tree it read has been reclaimed. Distributed, because
+  # `epicrun.md` names it and `josh sync` copies that skill. cspell derives neither this nor
+  # "re-askable" from "ask".
+  - askable
+  # The single-process guard command wired to the distributed `.claude/settings.json` PreToolUse hook
+  # (`josh pretool:guard`), and the matching Codex adapter phase. Distributed, because `josh sync`
+  # copies that settings file and the package carries the provider adapter.
+  - pretool
+  - posttool
+  - delegatable
+  - backgrounding
+  - unretried
+  - epicrun
+  - unwritable
+  - backlink
+  - bttf
+  - COLLAB
+  - cursorrules
+  - EDITMSG
+  - elif
+  - emnapi
+  - esbenp
+  - Folkken
+  - gsub
+  - joshuastudio
+  - QUBE
+  - aikidosec
+  - anthropics
+  - arrowdown
+  - autoincrement
+  - autorestart
+  - backlogrun
+  - betterauth
+  - coderabbit
+  - coderabbitai
+  - cooldown
+  - darkmode
+  - domcontentloaded
+  - esbuild
+  - eslintcache
+  - fetchpriority
+  - fullrun
+  - halfrun
+  - hotspot
+  - Hotspot
+  - hotspots
+  - Hotspots
+  - ianvs
+  - imagetools
+  - inlang
+  - jgame
+  - joshuafolkken
+  - newbot
+  - userinfobot
+  - lefthook
+  - mischeck
+  - multicriteria
+  - narratively
+  - networkidle
+  - NOSONAR
+  - noopener
+  - noreferrer
+  - nosniff
+  - octocat
+  - osv
+  - paraglide
+  - pipefail
+  - reassignable
+  - sonarjs
+  - sonarqube
+  - sonarcloud
+  - sonarqubecloud
+  # SonarCloud's own rule-key prefixes for the taint-analysis engine, cited by the S8707
+  # suppression in `sonar-project.properties`. Distributed, because `josh init` copies that file.
+  - tssecurity
+  - jssecurity
+  - qualitygate
+  - Dsonar
+  - Stylesheet
+  - sveltekit
+  - unrs
+  - vite
+  - Vitest
+  - webp
+  - workerd
+  - zstd
+  - docstrings
+  - esac
+  - languagetool
+  - sandboxed
+  - shellcheck
+  - unawaited
+  - entrancy
+  - startswith
+  - unreviewed
+  # Words the skills `josh sync` copies into a consumer use. They belong here rather than in kit's
+  # own `cspell.config.yaml`, because a consumer spell-checks the copies and resolves them only
+  # through this dictionary (joshuafolkken/kit#1092). `scripts/gate/cspell-distributed-words.test.ts` is
+  # what keeps the two in step.
+  - worktrees
+  # The singular joined it once `epicrun.md` had to name the git subcommand itself — `git worktree
+  # add <dir> <existing-branch>`, the restore no `josh lane:*` command reaches (joshuafolkken/kit#1587).
+  - worktree
+  - evals
+  # How `background-commands.md` (the §2h body since joshuafolkken/kit#1873) names a command already
+  # sent to the background (joshuafolkken/kit#1510), and the gate as the first command a run can send
+  # there. It is a skill `josh sync` copies, so the words have to resolve here.
+  - backgrounded
+  - backgroundable