@joshuafolkken/kit 1.983.0 → 1.1003.0

package/scripts/init/start-steps.ts

@@ -1,12 +1,13 @@
 import path from 'node:path'
-import { git_gh_exec } from '#scripts/git/git-gh-exec'
 import { repository_labels } from '#scripts/repo/repository-labels'
 import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
-import { execaSync } from 'execa'
 import { main as init_main } from './init'
 import { PACKAGE_DIR } from './init-paths'
+import { kit_setup_state } from './kit-setup-state'
 import type { ProjectProfile, ProjectShape } from './project-profile'
+import { start_exec } from './start-exec'
 import { start_plan, type GitState, type StartStep, type Visibility } from './start-plan'
+import { start_setup_pr } from './start-setup-pr'
 
 interface StepContext {
 	root: string
@@ -20,38 +21,28 @@ const GH_INSTALL_HINT =
 const GH_AUTH_HINT =
 	'GitHub CLI is not signed in. Run gh auth login, then run josh start again. Nothing was changed.'
 
-function succeeds(command: string, args: ReadonlyArray<string>, root: string): boolean {
-	return execaSync(command, args, { cwd: root, reject: false }).exitCode === 0
-}
-
-function read_output(
-	command: string,
-	args: ReadonlyArray<string>,
-	root: string,
-): string | undefined {
-	const result = execaSync(command, args, { cwd: root, reject: false })
-
-	return result.exitCode === 0 ? result.stdout.trim() : undefined
-}
-
-// Every step spawned here dials GitHub directly, past a scanner's loopback proxy, the same as every
-// other `gh` spawn under scripts/ (joshuafolkken/kit#2436); a local `git` step is unaffected by it.
-function run(command: string, args: ReadonlyArray<string>, root: string): void {
-	execaSync(command, args, { ...git_gh_exec.direct_environment(), cwd: root, stdio: 'inherit' })
-}
+const { succeeds, read_output, run } = start_exec
 
 function read_git_state(root: string, shape: ProjectShape): GitState {
 	const { has_git, has_github } = shape
 
 	if (!has_git) {
-		return { has_git, has_github, has_origin: false, branch: undefined, has_commits: false }
+		return {
+			has_git,
+			has_github,
+			has_origin: false,
+			branch: undefined,
+			has_commits: false,
+			has_kit_committed: false,
+		}
 	}
 
 	const has_origin = succeeds('git', ['remote', 'get-url', 'origin'], root)
 	const branch = read_output('git', ['symbolic-ref', '--short', 'HEAD'], root)
 	const has_commits = succeeds('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], root)
+	const has_kit_committed = kit_setup_state.is_kit_committed(root)
 
-	return { has_git, has_github, has_origin, branch, has_commits }
+	return { has_git, has_github, has_origin, branch, has_commits, has_kit_committed }
 }
 
 // Every step talks to GitHub, so the CLI is checked before the first write rather than at the step
@@ -82,7 +73,7 @@ function initialize(context: StepContext): void {
 function commit_all(context: StepContext): void {
 	run('git', ['add', '--all'], context.root)
 	// The first commit of a new repository has no branch to come from, so the hook that keeps commits
-	// off main — installed by the initialize step in a node project — would refuse the only commit
+	// off main — installed by the initialize step in a full project — would refuse the only commit
 	// that has to land there.
 	run('git', ['commit', '--no-verify', '--message', 'Initial commit'], context.root)
 	// A repository created by an older `git init` may name its unborn branch `master`.
@@ -103,21 +94,30 @@ function add_missing_labels(): void {
 	repository_labels.ensure_labels('{owner}/{repo}')
 }
 
-const STEP_ACTIONS: Readonly<Record<StartStep, (context: StepContext) => void>> = {
+// Main already has a history here, so the setup reaches it the way every other change does: through
+// an Issue and a pull request a person merges (joshuafolkken/kit#2816).
+async function open_setup_pull_request(context: StepContext): Promise<void> {
+	await start_setup_pr.open(context.root)
+}
+
+type StepAction = (context: StepContext) => void | Promise<void>
+
+const STEP_ACTIONS: Readonly<Record<StartStep, StepAction>> = {
 	git_init: create_git_repository,
 	initialize,
 	commit: commit_all,
 	repository: create_github_repository,
 	labels: add_missing_labels,
+	setup_pr: open_setup_pull_request,
 }
 
-function run_step(
+async function run_step(
 	step: StartStep,
 	context: StepContext,
 	completed: ReadonlyArray<StartStep>,
-): void {
+): Promise<void> {
 	try {
-		STEP_ACTIONS[step](context)
+		await STEP_ACTIONS[step](context)
 	} catch (error) {
 		const cause = error instanceof Error ? error.message : String(error)
 
@@ -125,12 +125,12 @@ function run_step(
 	}
 }
 
-function run_steps(steps: ReadonlyArray<StartStep>, context: StepContext): void {
+async function run_steps(steps: ReadonlyArray<StartStep>, context: StepContext): Promise<void> {
 	for (const [index, step] of steps.entries()) {
 		const position = `${String(index + 1)}/${String(steps.length)}`
 
 		console.info(`\n[${position}] ${start_plan.STEP_LABELS[step]}`)
-		run_step(step, context, steps.slice(0, index))
+		await run_step(step, context, steps.slice(0, index))
 	}
 }
 

package/scripts/init/start.ts

@@ -13,7 +13,7 @@ import { start_steps } from './start-steps'
 
 const ARGUMENT_START_INDEX = 2
 const READY_MESSAGE = 'GitHub workflow ready. Use kickoff new in your assistant to plan an Issue.'
-const START_USAGE = 'josh start [--profile static|node] [--yes] [--github] [--public]'
+const START_USAGE = 'josh start [--profile basic|full] [--yes] [--github] [--public]'
 const YES_FLAG = '--yes'
 const GITHUB_FLAG = '--github'
 const PUBLIC_FLAG = '--public'
@@ -72,7 +72,11 @@ function prepare(args: ReadonlyArray<string>, is_tty: boolean, root: string): Pr
 
 	stop_on(start_steps.github_cli_refusal(root))
 
-	return { steps: plan.steps, interaction, choices: { options, shape, consent, root } }
+	return {
+		steps: plan.steps,
+		interaction,
+		choices: { options, shape, consent, root, steps: plan.steps },
+	}
 }
 
 async function main(args: ReadonlyArray<string>, is_tty: boolean): Promise<void> {
@@ -82,7 +86,7 @@ async function main(args: ReadonlyArray<string>, is_tty: boolean): Promise<void>
 	const profile = await resolve_profile(choices, interaction)
 	const { root, options } = choices
 
-	start_steps.run_steps(steps, { root, profile, visibility: options.visibility })
+	await start_steps.run_steps(steps, { root, profile, visibility: options.visibility })
 	console.info(`\n${READY_MESSAGE}`)
 }
 

package/scripts/josh/__snapshots__/josh-command-map.test.ts.snap

@@ -450,7 +450,7 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
       ],
     ],
     "init": [
-      "[--profile static|node] [--no-install]",
+      "[--profile basic|full] [--no-install]",
       "developer",
       [
         "files",
@@ -766,7 +766,7 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
       ],
     ],
     "profile": [
-      "[--profile static|node]",
+      "[--profile basic|full]",
       "developer",
       [
         "files",
@@ -1112,7 +1112,7 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
       ],
     ],
     "start": [
-      "[--profile static|node] [--yes] [--github] [--public]",
+      "[--profile basic|full] [--yes] [--github] [--public]",
       "developer",
       [
         "files",

package/scripts/josh/josh-commands-development.ts

@@ -22,7 +22,7 @@ const DEV_COMMANDS: Record<string, CommandEntry> = {
 	},
 	lint: {
 		script: 'scripts/lint/lint-parallel.ts',
-		description: 'Check code with prettier and eslint (skips a tool a static project lacks)',
+		description: 'Check code with prettier and eslint (skips a tool a basic project lacks)',
 		category: 'Development',
 		reference: ['', 'developer', ['processes']],
 	},
@@ -61,7 +61,7 @@ const DEV_COMMANDS: Record<string, CommandEntry> = {
 	},
 	format: {
 		script: 'scripts/lint/format.ts',
-		description: 'Format code with prettier and eslint (skips a tool a static project lacks)',
+		description: 'Format code with prettier and eslint (skips a tool a basic project lacks)',
 		category: 'Development',
 		reference: ['', 'developer', ['files', 'processes']],
 	},
@@ -183,7 +183,7 @@ const DEV_COMMANDS: Record<string, CommandEntry> = {
 	},
 	check: {
 		script: 'scripts/gate/type-check-command.ts',
-		description: 'Type-check with tsc (skips a static project with no TypeScript to check)',
+		description: 'Type-check with tsc (skips a basic project with no TypeScript to check)',
 		category: 'Development',
 		reference: ['[arguments...]', 'developer', ['processes']],
 	},

package/scripts/josh/josh-commands-project.ts

@@ -4,7 +4,7 @@ import type { CommandEntry } from './josh-command-types'
 // no identifier format allows. The same disable sits at the top of `josh-commands-maintenance.ts`
 // for the same reason.
 /* eslint-disable @typescript-eslint/naming-convention */
-const PROFILE_ARGUMENTS = '[--profile static|node]'
+const PROFILE_ARGUMENTS = '[--profile basic|full]'
 const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 	profile: {
 		script: 'scripts/init/project-profile-cli.ts',
@@ -14,7 +14,7 @@ const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 	},
 	start: {
 		script: 'scripts/init/start.ts',
-		description: 'Create a new project for the GitHub Issue workflow, from git init to labels',
+		description: 'Set a project up for the GitHub Issue workflow, from git init to the setup PR',
 		category: 'Project',
 		reference: [
 			`${PROFILE_ARGUMENTS} [--yes] [--github] [--public]`,

package/scripts/lane/lane-leftover.ts

@@ -0,0 +1,143 @@
+import { createHash } from 'node:crypto'
+import { existsSync, lstatSync, readdirSync, readFileSync, readlinkSync, rmSync } from 'node:fs'
+import path from 'node:path'
+import { git_spawn } from '#scripts/git/git-spawn'
+
+// A lane directory git no longer registers as a work tree (joshuafolkken/kit#2857).
+//
+// **Nothing else can see it.** `lane:list` and `lane:prune` read `git worktree list`, so a directory
+// whose registration is gone is invisible to both, and `git worktree add` refuses its path for good —
+// the lane for that issue cannot be opened again until someone deletes it by hand. `lane:open` asks
+// here before it adds the tree.
+//
+// **The test for removing it is that removing it loses nothing**, not a list of names. Every file in
+// it has to be one the repository already holds with the same content, so it is a checkout git would
+// write again; the one exception is the `.git` file, a pointer to the registration that is gone. A
+// list of generated names would break the next time a file is generated, and would delete whatever
+// shares one of those names.
+
+// `git ls-tree -r -z`: `<mode> <type> <object>\t<path>`, entries separated by NUL — the `-z` form
+// leaves a path with an unusual character unquoted, so it can be compared to the path on disk.
+const TREE_ENTRY_PATTERN = /^\d+ blob (?<object>[\da-f]+)\t(?<path>.+)$/su
+const GIT_POINTER = '.git'
+const GITDIR_PREFIX = 'gitdir: '
+// The foreign paths a refusal names before it summarizes the rest as a count.
+const NAMED_PATH_LIMIT = 10
+
+// One blob entry as `[path, object id]`; a tree, a commit (a submodule) or the trailing empty entry is
+// none.
+function tree_entry(entry: string): Array<[string, string]> {
+	const { path: entry_path, object } = TREE_ENTRY_PATTERN.exec(entry)?.groups ?? {}
+
+	if (entry_path === undefined || object === undefined) return []
+
+	return [[entry_path, object]]
+}
+
+function parse_tree(listing: string): Map<string, string> {
+	return new Map(listing.split('\0').flatMap((entry) => tree_entry(entry)))
+}
+
+// The object id git gives this file — a symbolic link's is that of its target string, as git stores it.
+function blob_id(file: string): string {
+	const content = lstatSync(file).isSymbolicLink()
+		? Buffer.from(readlinkSync(file))
+		: readFileSync(file)
+
+	// SHA-1 because it is git's object id, compared rather than trusted — a repository on the SHA-256
+	// object format matches nothing here, so its leftovers are refused rather than removed.
+	// eslint-disable-next-line sonarjs/hashing -- git's object id, not a security digest
+	return createHash('sha1')
+		.update(`blob ${String(content.length)}\0`)
+		.update(content)
+		.digest('hex')
+}
+
+// Walked one level at a time because `readdirSync`'s `recursive` option descends into a symbolic link
+// to a directory, which would list the repository's own files under the link's path as foreign.
+function walk_files(directory: string, relative: string): Array<string> {
+	return readdirSync(path.join(directory, relative), { withFileTypes: true }).flatMap((entry) => {
+		const child = relative === '' ? entry.name : `${relative}/${entry.name}`
+
+		return entry.isDirectory() ? walk_files(directory, child) : [child]
+	})
+}
+
+// Every file under `directory` as a repository path, symbolic links included and never followed.
+function list_files(directory: string): Array<string> {
+	return walk_files(directory, '')
+}
+
+// The `.git` file is disposable only while the registration it points to is gone: one that still
+// resolves is a live work tree — a `lane:open` of the same issue may be checking it out right now.
+function is_dangling_pointer(directory: string): boolean {
+	const file = path.join(directory, GIT_POINTER)
+
+	if (!lstatSync(file).isFile()) return false
+
+	const pointer = readFileSync(file, 'utf8').trim()
+
+	if (!pointer.startsWith(GITDIR_PREFIX)) return false
+
+	return !existsSync(path.resolve(directory, pointer.slice(GITDIR_PREFIX.length)))
+}
+
+function is_reclaimable_file(
+	directory: string,
+	relative: string,
+	tracked: ReadonlyMap<string, string>,
+): boolean {
+	if (relative === GIT_POINTER) return is_dangling_pointer(directory)
+
+	return tracked.get(relative) === blob_id(path.join(directory, relative))
+}
+
+/**
+ * The paths under `directory` whose removal would lose something — empty when it holds nothing but
+ * the repository's own files and the `.git` pointer. A `.git` directory is a repository of its own,
+ * so it is foreign as a whole rather than walked.
+ */
+function foreign_paths(directory: string, tracked: ReadonlyMap<string, string>): Array<string> {
+	const pointer = lstatSync(path.join(directory, GIT_POINTER), { throwIfNoEntry: false })
+
+	if (pointer?.isDirectory() === true) return [GIT_POINTER]
+
+	return list_files(directory).filter(
+		(relative) => !is_reclaimable_file(directory, relative, tracked),
+	)
+}
+
+function refusal(directory: string, foreign: ReadonlyArray<string>): Error {
+	const named = foreign.slice(0, NAMED_PATH_LIMIT).join(', ')
+	const rest = foreign.length - NAMED_PATH_LIMIT
+	const more = rest > 0 ? ` and ${String(rest)} more` : ''
+
+	return new Error(
+		`${directory} already exists but git does not register it as a work tree, and it holds files the repository does not: ${named}${more}. It was left in place so nothing is lost — move those files out, delete the directory, and open the lane again.`,
+	)
+}
+
+/**
+ * Clear the way for `git worktree add` at `directory`, which the caller has found unregistered.
+ * Absent is nothing to do; holding only the repository's own files, it is removed; anything else is
+ * refused with the paths that would have been lost.
+ */
+async function reclaim(directory: string): Promise<void> {
+	if (!existsSync(directory)) return
+
+	const tracked = parse_tree(await git_spawn.read(['ls-tree', '-r', '-z', '--full-tree', 'HEAD']))
+	const foreign = foreign_paths(directory, tracked)
+
+	if (foreign.length > 0) throw refusal(directory, foreign)
+
+	rmSync(directory, { force: true, recursive: true })
+}
+
+const lane_leftover = {
+	blob_id,
+	foreign_paths,
+	parse_tree,
+	reclaim,
+}
+
+export { lane_leftover }

package/scripts/lane/lane-open.ts

@@ -5,6 +5,7 @@ import { git_worktree } from '#scripts/git/git-worktree'
 import { lane_cache } from './lane-cache'
 import { lane_environment } from './lane-environment'
 import { lane_install, type InstallResult } from './lane-install'
+import { lane_leftover } from './lane-leftover'
 import { lane_paths } from './lane-paths'
 import { lane_registry, type LaneInfo } from './lane-registry'
 import { lane_seed_policy } from './lane-seed'
@@ -234,6 +235,18 @@ async function materialize(plan: LanePlan, source_root: string): Promise<void> {
 	}
 }
 
+// Both refusals run before the seat is claimed, so neither leaves a lock behind. A directory at the
+// lane's path that git does not register is `lane_leftover`'s to remove or refuse
+// (joshuafolkken/kit#2857).
+async function clear_the_way(
+	root: string,
+	issue: string,
+	lanes: ReadonlyArray<LaneInfo>,
+): Promise<void> {
+	guard_unreadable(root, lanes)
+	await lane_leftover.reclaim(lane_paths.lane_directory(root, issue))
+}
+
 /**
  * Open the lane for `issue`, or say why it was not opened.
  *
@@ -253,7 +266,7 @@ async function open_lane(issue: string): Promise<OpenOutcome> {
 
 	const root = lane_paths.lane_root(repository_root)
 
-	guard_unreadable(root, lanes)
+	await clear_the_way(root, issue, lanes)
 
 	const plan = build_plan(repository_root, root, issue, lanes)
 

package/scripts/lint/cspell-cached.ts

@@ -23,8 +23,8 @@ const CSPELL_ARGS = [
 
 // The wrapper puts cache transfer directly around cspell rather than around the whole gate (#2060),
 // so a later failing check cannot prevent a completed cache from reaching the primary checkout.
-function static_skip_reason(directory: string): string | undefined {
-	if (!project_checks.is_static(directory)) return undefined
+function basic_skip_reason(directory: string): string | undefined {
+	if (!project_checks.is_basic(directory)) return undefined
 
 	if (!project_checks.has_config(directory, project_checks.CSPELL_CONFIGS)) {
 		return 'no cspell configuration was found'
@@ -36,7 +36,7 @@ function static_skip_reason(directory: string): string | undefined {
 }
 
 async function run(extra_arguments: ReadonlyArray<string> = []): Promise<number> {
-	const reason = static_skip_reason(process.cwd())
+	const reason = basic_skip_reason(process.cwd())
 
 	if (reason !== undefined) {
 		console.info(project_checks.skip_notice('cspell', reason))

package/scripts/lint/format.ts

@@ -19,7 +19,7 @@ async function run_step(args: ReadonlyArray<string>, directory: string): Promise
 
 // prettier first, deliberately: `eslint --fix` exits 1 whenever a non-autofixable error remains, so
 // putting it first would mean one unused variable anywhere in the tree stops prettier from running.
-// A static project without Prettier or ESLint is skipped with the same reason `josh lint` prints
+// A basic project without Prettier or ESLint is skipped with the same reason `josh lint` prints
 // (joshuafolkken/kit#2693, joshuafolkken/kit#2606).
 async function run_unless_skipped(
 	check: string,

package/scripts/lint/lint-parallel.ts

@@ -64,8 +64,8 @@ function lint_exit_code(prettier: BufferedProcessResult, eslint: BufferedProcess
 // The two checks are run from here whether they were pointed at the whole tree or at one change's
 // files, so `josh lint:related` reaches prettier and eslint through the same buffering, the same
 // "one failure does not abort the other" reading, and the same exit code (joshuafolkken/kit#1298) —
-// and through the same static-project skip, so a narrowed run never reaches a tool the whole-tree
-// run would have skipped (joshuafolkken/kit#2709). The skip reasons answer nothing for a node
+// and through the same basic-project skip, so a narrowed run never reaches a tool the whole-tree
+// run would have skipped (joshuafolkken/kit#2709). The skip reasons answer nothing for a full
 // project, so the one path serves both profiles.
 async function run_lint_checks(
 	prettier_args: ReadonlyArray<string>,

package/scripts/propagate/propagate-steps.ts

@@ -1,5 +1,7 @@
+import { pr_classification } from '#scripts/ci/pr-classification'
 import { git_gh_exec } from '#scripts/git/git-gh-exec'
 import { git_gh_issue_write } from '#scripts/git/git-gh-issue-write'
+import { OTHER_CHANGE_LABEL } from '#scripts/git/issue-labels'
 import { GATE_COMMAND } from '#scripts/josh/josh-command-types'
 import { build_upgrade_shell_command } from '#scripts/version/upgrade-shell-command'
 import { create_version_command_config } from '#scripts/version/version-command-config'
@@ -62,6 +64,10 @@ const PROPAGATE_ORIGIN =
 	'Opened by `josh propagate` from the supplier repository after the release was published.'
 const RUN_NOTE =
 	'The upgrade, the managed-file sync and the verification gate have already run here.'
+// `josh git` refuses to open a pull request for an issue that declares no release classification
+// (joshuafolkken/kit#2666), so the upgrade issue declares one. A dependency upgrade changes no code of
+// the consumer's own, which is what `other-change` covers (joshuafolkken/kit#2858).
+const UPGRADE_CLASSIFICATION = OTHER_CHANGE_LABEL
 const EMPTY_PLAN_TITLE = 'Upgrade the installed toolkits'
 const LAST_SEPARATOR = ' and '
 const NAME_SEPARATOR = ', '
@@ -95,7 +101,14 @@ function plan_body(plan: ReleasePlan): string {
 		.map((release) => `\`${release.package_name}@${release.version}\``)
 		.join(NAME_SEPARATOR)
 
-	return [`Carry ${specs} into this repository.`, '', plan.origin, RUN_NOTE].join('\n')
+	return [
+		`Carry ${specs} into this repository.`,
+		'',
+		plan.origin,
+		RUN_NOTE,
+		'',
+		pr_classification.declaration(UPGRADE_CLASSIFICATION),
+	].join('\n')
 }
 
 function issue_body(package_name: string, version: string): string {

package/scripts/rules/filing-cap.ts

@@ -129,6 +129,7 @@ const filing_cap = {
 	ROW,
 	current_turn,
 	decide,
+	is_prompt_line,
 	prior_filing_count,
 	turn_filing_count,
 }

package/scripts/rules/issue-citation.ts

@@ -171,6 +171,28 @@ function bare_references(message: string): ReadonlyArray<string> {
 	return [...new Set(found)]
 }
 
+// Every reference the prompt carries, each as written — `#N` or `owner/repo#N` — with none of the
+// citation exclusions applied: a number pasted inside a fence or a quote is still the person's.
+function prompt_references(prompt: string): ReadonlySet<string> {
+	const found = new Set<string>()
+
+	for (const match of prompt.matchAll(ISSUE_NUMBER)) {
+		found.add(repo_prefix(prompt, match.index) + match[0])
+	}
+
+	return found
+}
+
+// **A number the person's prompt already carried is quoted, not cited** (joshuafolkken/kit#2819). A
+// pasted log from another repository holds its own `#1`…`#7`; `issue:cite` would link them to this
+// repository's unrelated Issues, so following the refusal would make the reply wrong. Only the exact
+// reference the prompt wrote is exempt, so a bare `#N` the run brought in itself is still refused.
+function unquoted_references(message: string, prompt: string): ReadonlyArray<string> {
+	const quoted = prompt_references(prompt)
+
+	return bare_references(message).filter((reference) => !quoted.has(reference))
+}
+
 function has_bare_reference(message: string): boolean {
 	return bare_references(message).length > 0
 }
@@ -237,6 +259,13 @@ function linkify(message: string, slug: string): string {
 	return out.join('\n')
 }
 
-const issue_citation = { bare_references, cite_arguments, has_bare_reference, linkify, prose_lines }
+const issue_citation = {
+	bare_references,
+	cite_arguments,
+	has_bare_reference,
+	linkify,
+	prose_lines,
+	unquoted_references,
+}
 
 export { issue_citation }

package/scripts/rules/last-prompt.ts

@@ -0,0 +1,79 @@
+import { json_value } from '#scripts/lib/json-value'
+import { time_reported_failure } from '#scripts/time-runtime/time-reported-failure'
+import { z } from 'zod'
+import { filing_cap } from './filing-cap'
+
+// The text of the person's last prompt on a transcript tail — what the stop guard's citation row
+// reads to tell a `#N` the person quoted from one the run brought in itself (joshuafolkken/kit#2819).
+//
+// **A prompt is `filing_cap`'s prompt line, minus what the harness wrote there.** A skill's body is a
+// `user` line with no tool result too, but it carries `isMeta`; a background task's completion notice
+// and a subagent's hand-back carry an `origin` whose `kind` is not `human`. Each is the harness
+// speaking, not the person — and a notice can name the very Issue the run filed — so only a line with
+// no `origin` (an SDK prompt) or a `human` one is read.
+//
+// **A workflow invocation quotes nothing.** `fullrun #2819` names this repository's own Issue, so a
+// bare `#2819` in that run's report is a citation slip like any other, and the prompt yields no text —
+// a resumed lane child's prompt included, since it ends on the same invocation.
+
+const WORKFLOW_KEYWORDS: ReadonlySet<string> = new Set([
+	'kickoff',
+	'fullrun',
+	'halfrun',
+	'backlogrun',
+])
+const NO_PROMPT = ''
+const HUMAN_ORIGIN = 'human'
+// The word before the prompt's last one — where a trailing `fullrun #N` puts its keyword.
+const KEYWORD_BEFORE_ARGUMENT = -2
+
+const PROMPT_LINE_SCHEMA = z.object({
+	isMeta: z.boolean().nullish(),
+	origin: z.object({ kind: z.string().nullish() }).nullish(),
+	message: z.object({ content: z.unknown() }),
+})
+
+type PromptLine = z.infer<typeof PROMPT_LINE_SCHEMA>
+
+function is_person(line: PromptLine): boolean {
+	if (line.isMeta === true) return false
+
+	return line.origin === null || line.origin === undefined || line.origin.kind === HUMAN_ORIGIN
+}
+
+// The prompt line's text, or `undefined` when the harness wrote it or it does not read as one.
+function person_text(line: string): string | undefined {
+	const parsed = PROMPT_LINE_SCHEMA.safeParse(json_value.parse_or_undefined(line))
+
+	if (!parsed.success || !is_person(parsed.data)) return undefined
+
+	return time_reported_failure.result_text(parsed.data.message.content)
+}
+
+// A keyword opening the prompt is what a person types; a keyword before its one trailing argument is a
+// lane child's resume prompt, whose preamble ends on `fullrun #N` (`lane-child-invocation.ts`).
+function is_invocation(prompt: string): boolean {
+	const words = prompt.trim().split(/\s+/u)
+
+	return [words.at(0), words.at(KEYWORD_BEFORE_ARGUMENT)].some((word) =>
+		WORKFLOW_KEYWORDS.has(word ?? NO_PROMPT),
+	)
+}
+
+function prompt_line_text(line: string): string | undefined {
+	return filing_cap.is_prompt_line(line) ? person_text(line) : undefined
+}
+
+// The last person prompt on the tail; '' when none is on it or it is an invocation.
+function prompt_text(tail: string): string {
+	const text = tail
+		.split('\n')
+		.map((line) => prompt_line_text(line))
+		.findLast((one) => one !== undefined)
+
+	return text === undefined || is_invocation(text) ? NO_PROMPT : text
+}
+
+const last_prompt = { prompt_text }
+
+export { last_prompt }

package/scripts/rules/stop-rules.ts

@@ -49,6 +49,8 @@ interface StopContext {
 	notified: boolean
 	// The turn's session-facing reply text.
 	message: string
+	// The person's last prompt — a `#N` it already carried is quoted, not cited (joshuafolkken/kit#2819).
+	prompt: string
 	// This stop already forced a continuation earlier in the prompt — the loop-breaker Claude Code
 	// documents, so a run that will not comply is not blocked forever.
 	stop_hook_active: boolean
@@ -242,8 +244,8 @@ function needs_release(context: StopContext): boolean {
 	return is_held_idle(context) && context.tree_clean
 }
 
-function citation_reason(message: string): string | undefined {
-	const references = issue_citation.bare_references(message)
+function citation_reason(context: StopContext): string | undefined {
+	const references = issue_citation.unquoted_references(context.message, context.prompt)
 	if (references.length === 0) return undefined
 
 	return build_citation_reason(references)
@@ -255,7 +257,7 @@ function citation_reason(message: string): string | undefined {
 function reply_reason(context: StopContext): string | undefined {
 	if (needs_filing(context)) return FILING_OFFER_REASON
 
-	return citation_reason(context.message) ?? language_reason(context)
+	return citation_reason(context) ?? language_reason(context)
 }
 
 // The headless wait holds past the loop-breaker until the spin bound is reached.

package/scripts/run/run-hold.ts

@@ -170,10 +170,10 @@ function create_halfrun_stop_hold(target: string, issue: string, now: Date = new
 // be chosen that covers a `halfrun` stop or a `needs-human-review` stop: those are held across a
 // person's latency rather than a run's, and the thing that must not be trampled is sitting in the
 // tree where anyone can see it. An unreadable status is dirty, for the reason every other unreadable
-// state here blocks.
-async function is_tree_dirty(): Promise<boolean> {
+// state here blocks. `directory` asks the same of another work tree — a lane — instead of this one.
+async function is_tree_dirty(directory?: string): Promise<boolean> {
 	try {
-		const status = await git_command.status()
+		const status = await git_command.status(directory)
 
 		return status.trim() !== ''
 	} catch {