@joshuafolkken/kit 1.921.0 → 1.947.0

package/.claude/skills/workflow-commands/background-commands.md

@@ -126,5 +126,11 @@ act, so the run continues rather than stalling — the sanctioned boundary disti
 turn-end this section forbids. The boundary, its two commands and the resume verification are the
 `pre-gate-cut.md` skill document, its single source.
 
+**A headless lane child (`claude -p`) is where "a background command re-invokes the run" does not
+hold: its background Bash tasks are killed when its turn ends** (joshuafolkken/kit#2704). It hands the
+gate-to-merge region to `pnpm josh ship --detach` instead (`chain-rule.md` step 0); `pnpm josh
+rule:guard` refuses a backgrounded `josh gate` / `git` / `followup` there, and the `Stop` hook sends a
+child with a task still running back to wait rather than to notify.
+
 The operational section above is the single source of the rule. `followup.md`, `chain-rule.md` and
 `backlogrun-progress.md` → "Progress while the run is quiet" route here for it rather than restating it.

package/.claude/skills/workflow-commands/backlogrun-child.md

@@ -125,7 +125,7 @@ brief hands them to the unit.
    discretionary observation has**: a child files `route:tier-a` and `route:interrupt` only, and the
    parent files what survives — `SKILL.md` → §2i, the single source. **What the parent does with the
    rest is append it, not drop it**: an observation that cannot cite the depth-0 work it blocked
-   becomes one line in `docs/observations.md`, and a second line under the same key files it. **The
+   becomes one line in the observation ledger, and a second line under the same key files it. **The
    child never writes that file** — it cannot tell its observation from the sibling lane's.
 4. **Decisions taken and why**, where the decision was not already logged as an Issue comment.
 5. **What was left undone**, and under whose authority.

package/.claude/skills/workflow-commands/backlogrun-lanes.md

@@ -111,16 +111,17 @@ written.
 **Running unattended gets harder, not easier, and that is the honest trade.** Many lanes make the
 overlap between children real, and every overlap that becomes a conflict costs the child that loses the
 race a resolution, a re-run gate and a review ("Conflicts are not predicted" below), and parks it
-outright under that section's four conditions. The run finishes more work per hour **and** spends more
-of each child's budget on merge races. Do not report the first without the second.
+outright under that section's four conditions. Report the throughput gain only with its merge-race
+cost.
 
 ### Once per repository, before the first lane opens
 
 In the **primary checkout**, in this order, and never again per lane:
 
-1. `git switch main && git pull` — every lane is branched from this ref.
+1. `git switch main && git pull` — every lane branches from this ref.
 2. `pnpm josh latest:scope`, and the update on `required` — "`josh latest` runs once per session" above.
 3. `pnpm josh lane:prune` — closes the lanes an interruption left registered without a work tree.
+4. `pnpm josh run:tidy` — sweeps merged lanes and stashes (as `run:hold` does).
 
 **`pnpm josh latest` is never run inside a lane, whatever `latest:scope` answers there** — the command
 enforces it: `latest:scope` answers `skip` in a lane and `pnpm josh latest` refuses outright, fronted

package/.claude/skills/workflow-commands/backlogrun-progress.md

@@ -213,7 +213,7 @@ single non-numeric line as the verdict.
    `lane:await` watches local process presence and exits when any named child confirms-complete,
    waking the parent at the actual completion rather than at the next heartbeat interval. **The
    re-confirm delay and poll interval are the command's, not the agent's** — pass only the issue
-   numbers.
+   numbers. Without that wake (Codex), hand off instead — "A parent without a completion callback".
 
    **A `lane:await` wake is a confirmed-gone process, so classify the ending at once — do not wait out
    the silent-unit window** (joshuafolkken/kit#2277). `lane:await` exits only after the child's process
@@ -375,6 +375,11 @@ the check could not answer, and take `over`'s branch at that child.
 only moment where **this** child's work is all written down: the PR is merged, the working tree is clean
 on the default branch, and the epic's state on GitHub is complete.
 
+### A parent without a completion callback hands off at its first dispatch
+
+**A finished command never re-invokes a Codex parent, so after a dispatch `run:step` prints the `--cut`
+below the cut cap, `wait` at it** (joshuafolkken/kit#2653): dispatch the wave, run it, end the turn.
+
 ### The lane child reuses this measurement mid-implementation
 
 **The same `pnpm josh cost --over` measurement bounds a lane child's context _during_ implementation, not
@@ -534,20 +539,16 @@ to untangle**: `epic:next` detects it and exits with an error.
 ### The parent keeps no clock of its own — the watcher's exit is the wake
 
 **After hand-off, the supervisor's driver owns the mechanical clock.** `backlog:drive` polls lane
-completion and the backlog inside the detached process, without waking an AI parent. The historical
-parent-turn instructions below apply only while an AI session is handling a returned judgment branch;
-they do not schedule the supervisor's normal loop. `run:progress --wait` remains the source of human
-heartbeat lines, and `run:report` remains the final report source.
+completion and the backlog inside the detached process, without waking an AI parent; the parent-turn
+instructions below apply only to a returned judgment branch. `run:progress --wait` stays the heartbeat
+source and `run:report` the final report.
 
-**The numbers above are floors between asks, not a timer the parent sets.** A parent that sets one spends
-a turn per tick at the point its context is largest — the exact cost `run:progress` was built to remove.
-The watcher took the *reporting* out of the parent; the parent must not go on keeping the clock anyway,
-or the two run side by side and the run pays for both.
+**The numbers above are floors between asks, not a timer the parent sets** — one tick per turn, at the
+largest context, is the cost `run:progress` removed.
 
 The driver checks lane completion every five seconds and makes a new backlog offer no sooner than one
-minute after the previous offer, except after collecting a child. These waits cost no AI turns.
-The progress watcher keeps reporting on its own interval; a judgment session may still receive its
-exit as a prompt to act. The bounds above continue to apply to both processes.
+minute after the previous offer, except after collecting a child — waits that cost no AI turns. The
+watcher reports on its own interval, and a judgment session may take its exit as a prompt to act.
 
 #### The wake exists only while something is in flight
 

package/.claude/skills/workflow-commands/backlogrun-steps.md

@@ -535,7 +535,8 @@ ordinary way.
 **So every cut is taken at a merge, which is what lets a resumed session state its own `--active`**: a
 woken session picks the run up seconds after the merge the cut was taken at. The one shape that puts a
 cut inside a watch — the backlog answering `exhausted` while this run's own children are still
-merging — is the same, because the woken session has just merged a child.
+merging — is the same, because the woken session has just merged a child. A Codex parent's cut is the one
+taken at a dispatch instead (`backlogrun-progress.md` → "A parent without a completion callback").
 
 **The 8-hour whole-run bound is untouched and still outranks all of this** — it is measured from the
 record's `started_at` across every cut, so a run cannot watch its way past it in 30-minute pieces.

package/.claude/skills/workflow-commands/observation-filing.md

@@ -176,7 +176,7 @@ joshuafolkken/kit#1726 is the worked case: its own body says the depth test woul
 and it was filed anyway, because **discarding it was the only alternative on offer**
 (joshuafolkken/kit#1728).
 
-- **The destination is `docs/observations.md` in the repository the observation is about** — the same
+- **The destination is `docs/maintainers/observations.md` in the repository the observation is about** — the same
   repository the Issue would have been filed into. **The count and the append are both run in that
   repository's checkout**, resolved the way §2c (`target-repository.md`) resolves any cross-repository target, and the file is
   created on the first append where that repository has none. **The subject decides, never the
@@ -230,7 +230,7 @@ watched. **A missing file is not a count of zero, though** — there `grep` exit
 number at all, so an empty answer means create the ledger, never that this is a first sighting.
 
 ```bash
-grep -c '^- k:<slug> |' <that repository's checkout>/docs/observations.md || true
+grep -c '^- k:<slug> |' <that repository's checkout>/docs/maintainers/observations.md || true
 ```
 
 Free-text comparison is what the key exists to replace, so two lines that read alike under different
@@ -255,7 +255,7 @@ that is empty on every other machine**, and every sighting was a first one, whic
 joshuafolkken/kit#1728 created the ledger to end.
 
 - **An ordinary run never commits the ledger, and that is enforced rather than remembered.**
-  `pnpm josh git` stages with `docs/observations.md` excluded, in the one staging step every entry
+  `pnpm josh git` stages with `docs/maintainers/observations.md` excluded, in the one staging step every entry
   point goes through (`scripts/git/git-staging.ts`), so a `fullrun` in the primary checkout **cannot**
   carry a ledger line into an Issue that has nothing to do with it. It is not a rule a run has to
   remember at the commit — a run that had to would be the run that forgets.

package/.claude/skills/workflow-commands/prerequisite.md

@@ -18,7 +18,7 @@ another is the failure this section exists to prevent:
 | A defect originating in **another package**                                 | File the upstream Issue and **stop** — Tier A for a first-party target; a third-party one is Tier C, recorded and drafted rather than filed (`CLAUDE.md` → "Cross-package problems"; `prompts/collaboration-workflow/upstream-interrupt.md`) |
 | This Issue was really **several** (a split)                                 | File the children and the epic and **stop** — except under `backlogrun`, whose authorization already covers a batch, so the children are filed and run through (`split-assessment.md`) |
 | Another Issue in **this** repository has to land first (**a prerequisite**) | This section                                                                                                            |
-| Something worth filing that is **none of the three** (**an observation**)   | File it **without asking** — Tier A for a first-party target — and **carry the run straight on**: nothing is stashed, nothing is parked (§2i). **A delegated child does not file here**, and a filing at depth 1 or deeper cites the depth-0 work it blocked; one that cannot cite it goes to `docs/observations.md` and is filed on its second sighting — all of them §2i's |
+| Something worth filing that is **none of the three** (**an observation**)   | File it **without asking** — Tier A for a first-party target — and **carry the run straight on**: nothing is stashed, nothing is parked (§2i). **A delegated child does not file here**, and a filing at depth 1 or deeper cites the depth-0 work it blocked; one that cannot cite it goes to `docs/maintainers/observations.md` and is filed on its second sighting — all of them §2i's |
 
 **File the prerequisite with the `route:tier-a` label**, so a Tier A filing made during implementation
 stays countable by filing route afterwards. **This paragraph belongs to the prerequisite row, not to

package/.github/workflows/ci.yml

@@ -4,9 +4,13 @@ on:
   push:
     branches: [main]
 
+  # No `labeled` / `unlabeled`: a label added right after the pull request opens started a second
+  # run on the same commit, the concurrency block below cancelled one of the two, and a cancelled
+  # run left in the newer check suite blocked the merge (joshuafolkken/kit#2712). The one check that
+  # reads labels runs in `pr-classification.yml` instead.
   pull_request:
     branches: [main]
-    types: [opened, synchronize, reopened, labeled, unlabeled]
+    types: [opened, synchronize, reopened]
 
 # A push run is grouped by the commit it carries, so a later push to main never cancels an earlier
 # one. Without the sha every push to main shares one group — `github.ref` is `refs/heads/main` for
@@ -23,6 +27,12 @@ concurrency:
 # set the JOSH_PLAYWRIGHT_BROWSERS repository variable to a space-separated list to widen it.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
+  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
+  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
+  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
+  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
+  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
+  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
 
 jobs:
   node-26-pnpm:
@@ -308,7 +318,11 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:
@@ -352,10 +366,6 @@ jobs:
       - name: Run verification gate
         run: pnpm josh gate --verbose --no-unit
 
-      - name: Check release classification
-        if: github.event_name == 'pull_request'
-        run: pnpm josh pr:classification
-
   # The other half of the gate, on a runner of its own. It carries the same setup steps as
   # `static-checks` rather than sharing them: a GitHub job is its own machine, so every job that
   # needs Node sets Node up, and this workflow already writes that preamble once per job. The
@@ -411,7 +421,11 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:
@@ -623,7 +637,11 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:

package/.github/workflows/pr-classification.yml

@@ -0,0 +1,76 @@
+name: Release classification
+
+# The release-classification check, on its own because it is the one check that reads labels
+# (joshuafolkken/kit#2712). While it lived in CI, CI had to rerun on `labeled` / `unlabeled`; `josh pr`
+# labels a pull request the moment it opens, so every pull request started two CI runs on one commit,
+# and CI's per-ref concurrency cancelled one of them. GitHub judges a check name by its newest check
+# suite, and which of the two runs sat in the newer suite was a race — when it was the cancelled one,
+# the pull request stayed BLOCKED until someone reran it.
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+# Deliberately no `concurrency` block. Cancelling is exactly what left the blocking suite behind, and
+# nothing here needs it: every run reads the pull request's labels as they stand when it runs, not as
+# its event carried them, so whichever suite GitHub counts as newest holds a current verdict.
+
+jobs:
+  classification:
+    name: Release classification
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: read
+      pull-requests: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+
+      - name: Configure GitHub Packages authentication for existing projects
+        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
+
+      - name: Resolve pnpm version
+        id: pnpm-version
+        run: |
+          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
+          test -n "$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Setup pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          version: ${{ steps.pnpm-version.outputs.version }}
+          install: false
+
+      - name: Resolve pnpm store path
+        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
+
+      - name: Setup pnpm store cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.PNPM_STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Setup safe-chain
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+
+      - name: Install dependencies
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Check release classification
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: pnpm josh pr:classification

package/README.md

@@ -1,41 +1,67 @@
 # @joshuafolkken/kit
 
-Shared toolchain config and CLI for TypeScript projects — ESLint, Prettier, TypeScript, Lefthook, cspell, VS Code, and AI assistant files (CLAUDE.md, plus AGENTS.md / GEMINI.md pointing at it), wired together. It is framework-agnostic; the SvelteKit-specific layer lives in the separate [`@joshuafolkken/app-kit`](https://github.com/joshuafolkken/app-kit) package.
+A development toolkit that sets up a repository for AI-assisted work with one command. `josh init` gives an AI assistant (Claude Code, Codex, Gemini, Cursor) the project's rules, and the `josh` CLI runs the checks and the Git / GitHub Issue workflow the same way in every project. You stop copying config between repositories and re-explaining conventions to the assistant.
 
-- **`josh` CLI** — lint, format, type-check, git workflow, versioning, and security auditing from any directory.
-- **Project config package** — ESLint / Prettier / tsconfig presets, prompts, and scripts consumed as a devDependency.
+## What your project gets
 
-## Prerequisites
+kit does not branch by language. It asks one question — does the project use Node tooling? — and picks a [profile](./docs/init.md#project-profiles):
 
-- [Node.js](https://nodejs.org/) with [pnpm](https://pnpm.io/)
-- [gh CLI](https://cli.github.com/) for `josh version` and existing GitHub Packages consumers. It is not required to install kit from public npm; see [authentication.md](./docs/authentication.md) for setup when needed.
+| Your project                             | Profile  | What you get                                                      |
+| ---------------------------------------- | -------- | ----------------------------------------------------------------- |
+| Node project (JavaScript / TypeScript)   | `node`   | The full set: ESLint, type check, unit and E2E tests, Git hooks   |
+| HTML / CSS (browser JavaScript included) | `static` | Formatting (Prettier), AI assistant files, Git / VS Code settings |
+| Another language (Python, Rust, Go, …)   | `static` | AI assistant files and Git / VS Code settings only                |
+
+kit adds no linter or test runner for languages other than JavaScript and TypeScript; in a `static` project, `josh` skips each check that has nothing to run and says why.
 
 ## Quick start
 
+In your project directory:
+
 ```bash
-pnpm add -g @joshuafolkken/kit          # install the josh CLI globally
-josh help
+pnpm add -D --allow-build=esbuild @joshuafolkken/kit
+pnpm exec josh init
+pnpm install
+pnpm josh format
+pnpm josh gate
 ```
 
-Using the kit inside a project? See [docs/package.md](./docs/package.md).
+It needs [Node.js](https://nodejs.org/) 22.19.0 or later with [pnpm](https://pnpm.io/), even for a `static` project; [getting-started.md](./docs/getting-started.md) installs both. The global `josh` command ([cli.md](./docs/cli.md)) and the [gh CLI](https://cli.github.com/) for `josh version` and the GitHub Issue workflow are optional.
 
 ## Documentation
 
-| Guide                                           | What it covers                                                                   |
-| ----------------------------------------------- | -------------------------------------------------------------------------------- |
-| [why.md](./docs/why.md)                         | Why kit exists — the AI-development problems it solves, for practitioners        |
-| [authentication.md](./docs/authentication.md)   | GitHub Packages auth for existing projects                                       |
-| [cli.md](./docs/cli.md)                         | Install and use the global `josh` CLI                                            |
-| [package.md](./docs/package.md)                 | Use the kit as a project devDependency — configs, prompts, scripts, `josh init`  |
-| [publishing.md](./docs/publishing.md)           | First public npm release and trusted publishing setup                            |
-| [josh-commands.md](./docs/josh-commands.md)     | Full `josh` CLI command reference                                                |
-| [overview.md](./docs/overview.md)               | What the kit provides and how it works                                           |
-| [troubleshooting.md](./docs/troubleshooting.md) | `401`/`404` auth errors, `josh: command not found`, stale shim, version mismatch |
+**Get started**
+
+- [getting-started.md](./docs/getting-started.md) — first install for an `index.html` site or a non-Node project (`static`)
+- [package.md](./docs/package.md) — add kit to a Node project (`node`)
+- [how-to.md](./docs/how-to.md) — step-by-step guides by task: update, release, run Issues, fix a failing gate
+
+**Understand kit**
+
+- [why.md](./docs/why.md) — the problems kit exists to solve
+- [overview.md](./docs/overview.md) — what kit sets up and how it works
+
+**Commands and configuration**
+
+- [cli.md](./docs/cli.md) — install the global `josh` command
+- [josh-commands.md](./docs/josh-commands.md) — every `josh` command ([catalog](./docs/josh-command-catalog.md))
+- [init.md](./docs/init.md) — what `josh init` creates, per profile
+- [sync.md](./docs/sync.md) — what `josh sync` updates after an upgrade
+- [manual-config.md](./docs/manual-config.md) — use the presets without `josh init`
+- [package-api.md](./docs/package-api.md) — the config presets and libraries the package exports
+
+**AI workflow and operations**
+
+- [scripts-ai.md](./docs/scripts-ai.md) — Telegram notifications and the Issue workflow commands
+- [cloud-session.md](./docs/cloud-session.md) — running in an agent container
+- [eval.md](./docs/eval.md) — measuring whether the agent rules are followed
+- [troubleshooting.md](./docs/troubleshooting.md) — install and auth errors
+- [authentication.md](./docs/authentication.md) — existing GitHub Packages installs only
 
 ## Contributing
 
-Community standards live in [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md); security reports go through [SECURITY.md](./SECURITY.md). Development conventions are documented in `CLAUDE.md`; `AGENTS.md` and `GEMINI.md` are pointers to it.
+Community standards live in [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md); security reports go through [SECURITY.md](./SECURITY.md). Development conventions are in [CLAUDE.md](./CLAUDE.md); releases are in [publishing.md](./docs/publishing.md), and maintainer records in [docs/maintainers/](./docs/maintainers/).
 
 ## License
 
-MIT
+[MIT](./LICENSE)

package/dist/hooks/batch-guard.js

@@ -9,12 +9,12 @@ import {
   load_environment_file,
   notice_refusal_path,
   refusal_path
-} from "./chunk-77RLKZ5V.js";
-import "./chunk-3HZ5MJIW.js";
-import "./chunk-OYU6KPRA.js";
-import "./chunk-UULARQ5Q.js";
-import "./chunk-FXAKJKTB.js";
-import "./chunk-SSX23SJ2.js";
+} from "./chunk-V7RH56HU.js";
+import "./chunk-OM5VDM6F.js";
+import "./chunk-O3PEDF3M.js";
+import "./chunk-EYFJ74MJ.js";
+import "./chunk-WPALEIRX.js";
+import "./chunk-RKUAD3I6.js";
 export {
   DISABLED_VALUES,
   SWITCH_ENV_KEY,

package/dist/hooks/{chunk-LC765SUA.js → chunk-3FWV6CFC.js}

@@ -1,23 +1,24 @@
 import {
   lane_child_marker,
   run_issue_number
-} from "./chunk-OYU6KPRA.js";
+} from "./chunk-O3PEDF3M.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_blocks,
   cost_usage,
+  json_value,
   lane_paths,
   stamp_file,
   time_density_hook,
   time_shell,
   time_transcript_line
-} from "./chunk-UULARQ5Q.js";
+} from "./chunk-EYFJ74MJ.js";
 import {
   ENV_FILE_NAME,
   LANE_SEAT_KEY,
   PORT_SEED_KEY,
   ports
-} from "./chunk-SSX23SJ2.js";
+} from "./chunk-RKUAD3I6.js";
 
 // scripts/rules/bash-triggers.ts
 function on_bash_command(is_match) {
@@ -111,6 +112,7 @@ var filing_cap = {
 import { platform } from "node:os";
 var GIT_COMMAND_UNIX = "/usr/bin/git";
 var PORCELAIN_FLAG = "--porcelain";
+var UNTRACKED_FILES_FLAG = "--untracked-files=all";
 function get_git_command() {
   if (platform() === "win32") {
     return String.raw`"C:\Program Files\Git\cmd\git.exe"`;
@@ -242,7 +244,7 @@ async function branch() {
   return await git_spawn.read(["rev-parse", "--abbrev-ref", "HEAD"]);
 }
 async function status() {
-  return await git_spawn.read(["status", PORCELAIN_FLAG, "--untracked-files=normal"]);
+  return await git_spawn.read(["status", PORCELAIN_FLAG, UNTRACKED_FILES_FLAG]);
 }
 async function repository_root() {
   return await git_spawn.read(["rev-parse", "--show-toplevel"]);
@@ -852,6 +854,10 @@ function detected_provider(environment) {
 function resolve_provider(environment = process.env) {
   return detected_provider(environment) ?? handed_provider(environment);
 }
+function has_completion_callback(environment = process.env) {
+  const selected = resolve_provider(environment);
+  return selected.kind !== "provider" || selected.provider !== OPENAI_PROVIDER;
+}
 function handoff_environment(environment = process.env) {
   const selected = resolve_provider(environment);
   return selected.kind === "provider" ? { [HANDED_PROVIDER_KEY]: selected.provider } : {};
@@ -916,6 +922,7 @@ var agent_role_profile = {
   WORKER,
   describe,
   handoff_environment,
+  has_completion_callback,
   is_safe_value,
   parse,
   phase_effort,
@@ -1511,6 +1518,112 @@ var run_cut = {
   worktree_git_directory_sync
 };
 
+// scripts/rules/shell-segments.ts
+var SEGMENT_SEPARATOR = /&&|\|\||;|\n/u;
+function segments_of(command) {
+  return command.split(SEGMENT_SEPARATOR).map((segment) => segment.trim());
+}
+function is_josh_command(segment, names) {
+  const named = time_shell.josh_command_of(segment);
+  if (!named.startsWith(time_shell.JOSH_PREFIX)) return false;
+  return names.has(named.slice(time_shell.JOSH_PREFIX.length));
+}
+var shell_segments = {
+  SEGMENT_SEPARATOR,
+  is_josh_command,
+  segments_of
+};
+
+// scripts/rules/run-tail.ts
+var SEGMENT_PREFIX = String.raw`(?:\(\s*)?(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:npx\s+|pnpm\s+(?:exec\s+|run\s+)?)?`;
+var WORD_END = String.raw`(?=\s|$|\))`;
+var PUSH_STEP_SEGMENT = new RegExp(String.raw`^${SEGMENT_PREFIX}josh\s+(?:git|g)${WORD_END}`, "u");
+var CONFIRMED_FLAG = new RegExp(String.raw`(?:^|\s)(?:-y|--yes)${WORD_END}`, "u");
+var SKIPS_THE_PUSH = new RegExp(String.raw`(?:^|\s)--skip-push${WORD_END}`, "u");
+var BACKGROUND_KEY = "run_in_background";
+var QUOTED_SPAN = /"[^"]*"|'[^']*'/gu;
+function flags_of(segment) {
+  return segment.replaceAll(QUOTED_SPAN, " ");
+}
+function is_push_step_segment(segment) {
+  if (!PUSH_STEP_SEGMENT.test(segment)) return false;
+  const flags = flags_of(segment);
+  if (SKIPS_THE_PUSH.test(flags)) return false;
+  return CONFIRMED_FLAG.test(flags);
+}
+function is_push_step(command) {
+  return shell_segments.segments_of(command).some((segment) => is_push_step_segment(segment));
+}
+function is_backgrounded(input) {
+  if (!json_value.is_record(input)) return false;
+  return input[BACKGROUND_KEY] === true;
+}
+function is_push_step_call(call) {
+  if (call.name !== cost_blocks.BASH_TOOL) return false;
+  return is_push_step(time_shell.bash_command(call.input));
+}
+function is_backgrounded_push_step(call) {
+  if (!is_backgrounded(call.input)) return false;
+  return is_push_step_call(call);
+}
+function is_foreground_push_step(call) {
+  if (is_backgrounded(call.input)) return false;
+  return is_push_step_call(call);
+}
+function decide3() {
+  return true;
+}
+var RUN_TAIL_REASON = '\u26D4 run tail: this issues the commit-push-PR step in the foreground, where the harness decides when to stop waiting. Reissue it with `run_in_background` set. In `fullrun #1501` this call was given a 900-second timeout, the harness detached it at its own 600-second cap, and nothing read the output for a further 6m28s \u2014 45m03s of wall clock on about 17 minutes of work (joshuafolkken/kit#1510). **Never give a foreground call a timeout above the harness cap**: the cap decides, not the number. A backgrounded call re-invokes you when it exits, so the completion notification is what resumes the run. **When it arrives, the turn that reads it goes straight through any branch-2 filing and `pnpm josh epic:bundle` to `pnpm josh followup` \u2014 the turn never ends at the push.** CI went green 6m06s before the merge started in that run, and it started only because the person asked; joshuafolkken/kit#1333 had already settled that the merge is issued in the turn the review closes. While the push runs, do the work that writes nothing \u2014 drafting the completion body to a file, deciding the branch-2 disposition. `pnpm josh followup` itself stays in the **foreground** \u2014 nearly every step after it reads its result. But a tail does follow the merge, measured at 3.0 min and 5.9% of a run (joshuafolkken/kit#1462), so empty it beforehand: the steps that read the merge result stay after `followup`, and the rest are composed in the turn that issues it, bar the one exception background-commands.md names. The procedure is `.claude/skills/workflow-commands/background-commands.md`, "A command that can take minutes is issued in the background". **This rule fires on every foreground push, not once per run**, so reissuing the same call in the foreground will be refused again.';
+var run_tail = {
+  RUN_TAIL_REASON,
+  decide: decide3,
+  is_backgrounded_push_step,
+  is_foreground_push_step,
+  is_push_step,
+  is_push_step_call
+};
+
+// scripts/rules/lane-background.ts
+var LONG_RUNNING_COMMANDS = new Set(
+  ["gate", "git", "followup"].map((name) => `${time_shell.JOSH_PREFIX}${name}`)
+);
+var BACKGROUND_KEY2 = "run_in_background";
+function is_backgrounded2(input) {
+  return json_value.is_record(input) && input[BACKGROUND_KEY2] === true;
+}
+function runs_long_command(command) {
+  return time_shell.josh_commands_of(command).some((name) => LONG_RUNNING_COMMANDS.has(name));
+}
+function is_candidate(call) {
+  if (run_tail.is_push_step_call(call)) return true;
+  if (call.name !== cost_blocks.BASH_TOOL || !is_backgrounded2(call.input)) return false;
+  return runs_long_command(time_shell.bash_command(call.input));
+}
+function is_background_long_run(call, is_lane_child = () => lane_child_marker.is_child_of(process.cwd())) {
+  return is_candidate(call) && is_lane_child();
+}
+function pending_background_ids(tail) {
+  const lines = tail.split("\n").map((line) => time_transcript_line.parse_line(line));
+  const finished = new Set(lines.map((line) => line?.finished_background ?? ""));
+  const launched = lines.flatMap((line) => line?.blocks.map((block) => block.background_id) ?? []);
+  return launched.filter((id) => id !== "" && !finished.has(id));
+}
+var LANE_BACKGROUND_REASON = '\u26D4 lane background: this session is a dispatched lane child (`JOSH_LANE_CHILD`), a headless `claude -p` process whose background Bash tasks are killed when the turn ends \u2014 so a backgrounded `josh gate` / `josh git` / `josh followup` never re-invokes you; it dies at `exit code 143` (joshuafolkken/kit#2704, measured on the #2606 child: implementation, review and live verification done, the run parked instead of merged). Hand the gate-to-merge region to the detached supervisor instead: `pnpm josh ship --detach --review "<title> #<N>"` (add `--cite <N>`), then end the turn on `launched` / `busy` \u2014 `.claude/skills/workflow-commands/chain-rule.md` step 0 is the single source. A single check you must read before continuing runs in the foreground within the tool timeout; the commit-push step does not \u2014 in a child it too belongs to the detached ship, in either spelling. This rule fires on every occurrence, not once per run.';
+var LANE_BACKGROUND_STOP_REASON = "\u26D4 lane background stop: this is a dispatched lane child (`JOSH_LANE_CHILD`) and a background task it launched has not finished \u2014 ending this headless turn kills it, and nothing re-invokes you afterwards (joshuafolkken/kit#2704). Do not send a notification and do not stop: wait for the task in the foreground and act on its result, or re-issue the work through `pnpm josh ship --detach`, whose supervisor outlives the turn (`.claude/skills/workflow-commands/chain-rule.md` step 0). Do not repeat your previous reply.";
+var ROW2 = {
+  id: "lane-background",
+  is_trigger: (call) => is_background_long_run(call),
+  reason: LANE_BACKGROUND_REASON,
+  decide: () => true
+};
+var lane_background = {
+  LANE_BACKGROUND_REASON,
+  LANE_BACKGROUND_STOP_REASON,
+  ROW: ROW2,
+  is_background_long_run,
+  pending_background_ids
+};
+
 // scripts/git/issue-labels.ts
 var BUG_LABEL = "bug";
 var ENHANCEMENT_LABEL = "enhancement";
@@ -1530,22 +1643,6 @@ function has_label_name(labels, wanted) {
   return label_name_of(labels, wanted) !== void 0;
 }
 
-// scripts/rules/shell-segments.ts
-var SEGMENT_SEPARATOR = /&&|\|\||;|\n/u;
-function segments_of(command) {
-  return command.split(SEGMENT_SEPARATOR).map((segment) => segment.trim());
-}
-function is_josh_command(segment, names) {
-  const named = time_shell.josh_command_of(segment);
-  if (!named.startsWith(time_shell.JOSH_PREFIX)) return false;
-  return names.has(named.slice(time_shell.JOSH_PREFIX.length));
-}
-var shell_segments = {
-  SEGMENT_SEPARATOR,
-  is_josh_command,
-  segments_of
-};
-
 // scripts/rules/lane-park.ts
 var NOTIFY_COMMANDS = /* @__PURE__ */ new Set(["notify"]);
 var CONFIRMATION_TASK_TYPE = /(?:^|\s)--task-type[=\s]+["']?confirmation\b/u;
@@ -3295,6 +3392,8 @@ export {
   ALREADY_DONE_LABEL,
   has_any_label,
   has_label_name,
+  run_tail,
+  lane_background,
   lane_park,
   repo_party,
   FULL_PAGE_QUERY,