@joshuafolkken/kit 1.983.0 → 1.998.0

package/.claude/skills/workflow-commands/backlogrun-child.md

@@ -90,7 +90,7 @@ still bounded at 25 lines. `pnpm josh lane:dispatch` is where a lane's child is
 child over" in `backlogrun-lanes.md` carries the command.
 
 **The lane child uses the invoking CLI's `worker` profile.** Claude Code defaults to Anthropic
-`claude-opus-5-5` / `medium`; Codex uses `codex exec`, OpenAI `gpt-6-sol` / `medium`, workspace-write and
+`claude-opus-5-5` / `medium`; Codex uses `codex exec`, OpenAI `gpt-6.1-sol` / `medium`, workspace-write and
 JSONL. `JOSH_WORKER_MODEL` overrides Claude Code only; `JOSH_WORKER_EFFORT` covers both providers,
 and legacy `JOSH_LANE_*` applies only here. Bad markers, missing CLI/auth and failure
 refuse or park without fallback or retry.

package/.claude/skills/workflow-commands/backlogrun-steps.md

@@ -237,7 +237,7 @@ setting are `docs/josh-commands.md` → "`josh run:wake`".
 
 **Every unattended role runs with the provider selected from the invoking CLI and its own profile.**
 Codex sessions use OpenAI; Claude Code sessions use Anthropic. Anthropic uses scheduler
-`claude-opus-5-5`, worker `claude-opus-5-5` and reviewer `claude-opus-5-5`; OpenAI uses `gpt-6-sol`,
+`claude-opus-5-5`, worker `claude-opus-5-5` and reviewer `claude-opus-5-5`; OpenAI uses `gpt-6.1-sol`,
 with role efforts `medium`/`medium`/`high` (scheduler / worker / reviewer) for both. Role overrides
 resolve before launch; model overrides apply only to Claude Code, effort overrides to either provider,
 and legacy `JOSH_LANE_*` values to the worker only. Invalid configuration, a missing or conflicting

package/.github/workflows/sonar-qube.yml

@@ -19,16 +19,26 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    # A consumer that does not use SonarCloud has no SONAR_TOKEN, and the scan would fail on
+    # authentication and turn a required check red (joshuafolkken/kit#2815). `secrets` cannot be read
+    # in a step `if:`, so the secret is lifted into the job env and the steps branch on that instead.
+    # Token presence is the only signal that needs no consumer setup; a run GitHub withholds secrets
+    # from (a fork pull request, Dependabot without the secret) skips too — see sonar-hotspot-handling.md.
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
+      - name: Skip SonarQube Scan
+        if: env.SONAR_TOKEN == ''
+        run: echo "SonarQube scan skipped because SONAR_TOKEN is not set."
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: env.SONAR_TOKEN != ''
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
       - name: SonarQube Scan
+        if: env.SONAR_TOKEN != ''
         uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
         with:
           # Wait for the SonarCloud Quality Gate and fail this job (a required PR check) when the
           # gate is red, so a PR that introduces a Maintainability / code-smell finding cannot be
           # merged green. Without this flag the scan only uploads results and never blocks.
           args: -Dsonar.qualitygate.wait=true
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

package/CLAUDE.md

@@ -108,7 +108,7 @@ For every code modification, in order:
 
    - **Tests are required for ALL code changes** (bug fixes, timing/animation fixes and refactors included): bug fix → regression test; UI/animation/timing → E2E for the observable change; logic/utility → unit; refactor → tests pinning existing behavior BEFORE the change (`prompts/refactoring.md`).
    - **Non-runtime updates (pre-approved manual-only exception)**: a change touching no executable runtime code path may proceed with manual verification — declare it in Step 0 and state why. It covers docs, non-executable config, editor/IDE files, and cosmetic asset swaps with no selector/path change; the mechanically exempt (`*.md`, `.editorconfig`, `.idea/**`, `.vscode/**`, `prompts/**`) are recognized by the command below, and the rest stay the exemption a person declares. A test infeasible for a runtime change needs its reason stated and user approval.
-   - **static の HTML/CSS 例外:** `package.json` に `josh.profile: static` が記録され、変更が HTML/CSS だけなら自動テストの代わりにブラウザーで表示を確認する。対象ページを開き、想定する画面幅でレイアウト・リンク・HTML 内の操作を確認し、観察結果を報告する。HTML/CSS と同時に変更した場合も、JavaScript と TypeScript のファイルには自動テストが必要。`pnpm josh test:declared` はこの場合だけ理由を添えて `exempt` と表示する。
+   - **basic の手動確認例外:** `package.json` に `josh.profile: basic`（改名前の `static` も同じ）が記録され、変更が kit がテストを実行できない言語のファイル（HTML/CSS や Lua などのソース）だけなら、自動テストの代わりに手で確認する。HTML/CSS はブラウザーで対象ページを開き、想定する画面幅でレイアウト・リンク・HTML 内の操作を確認する。そのほかのソースは変更した処理を実際に動かす。どちらも観察結果を報告する。JavaScript と TypeScript のファイルには同時に変更した場合も自動テストが必要。`pnpm josh test:declared` はこの場合だけ理由を添えて `exempt` と表示する。
    - **The commit stage answers this mechanically**: `pnpm josh test:declared` prints `required` / `exempt` / `satisfied` from the changed paths, and a runtime change with no test is refused at `pnpm josh git -y` on `required` — add the declared test or declare the non-runtime exception, then reissue (`prompts/collaboration-workflow/rule-delivery.md`).
    - **Read a target's line headroom before editing: `pnpm josh lines <path>`** — near the limit, `Target` carries the splitting plan.
 
@@ -122,7 +122,7 @@ For every code modification, in order:
 Run the full verification set **in order**; do not skip, reorder, or report completion on a failed or skipped step without the user agreeing. Inside a `fullrun` / `backlogrun` the gate runs beside the review and the merge chain (`workflow-commands` skill → §2, `prompts/review.md`).
 
 0. **Test gate** — no tests added? Continue only under the non-runtime exception (Step 0) or explicit approval; otherwise stop and add tests.
-   static プロファイルの HTML/CSS だけの変更には、Step 0 の手動ブラウザー確認を適用できる。
+   basic プロファイルで kit がテストできない言語のファイルだけの変更には、Step 0 の手動確認を適用できる。
 1. **Refactor** — `prompts/refactoring.md`, until no high/medium items remain.
 2. **`pnpm josh gate`** — lint, type check, spell check and unit tests concurrently. One gate per run; while implementing re-run a single check by name (`pnpm josh lint:related` / `pnpm josh cspell:dot` / `pnpm josh test:related`).
 3. **Self-review** — a subagent runs `/code-review` per `prompts/review.md` (never a main-line `Skill` load); level from the changed paths, at most two rounds, high/medium findings resolved. `prompts/review.md` → "Review round cap".

package/README.md

@@ -1,52 +1,62 @@
 # @joshuafolkken/kit
 
-A development toolkit for AI-assisted work. `josh init` gives an AI assistant (Claude Code, Codex, Gemini, Cursor) the project's rules, formatting and checks in one command. With `kickoff`, `fullrun` and `backlogrun`, the agent then takes a GitHub Issue through plan → implement → verify → PR → merge, the same way in every project. Why kit exists: [why.md](./docs/why.md) (Japanese).
+A development toolkit for AI-assisted work. `josh start` (or `josh init`, for a project that will not use the GitHub Issue workflow) gives an AI assistant (Claude Code, Codex, Gemini, Cursor) the project's rules, formatting and checks in one command. With `kickoff`, `fullrun` and `backlogrun`, the agent then takes a GitHub Issue through plan → implement → verify → PR → merge, the same way in every project. Why kit exists: [why.md](./docs/why.md) (Japanese).
 
 ## What your project gets
 
 kit picks a [profile](./docs/init.md#project-profiles) from one question — does the project use Node tooling?
 
-| Your project                             | Profile  | What you get                                                      |
-| ---------------------------------------- | -------- | ----------------------------------------------------------------- |
-| Node project (JavaScript / TypeScript)   | `node`   | The full set: ESLint, type check, unit and E2E tests, Git hooks   |
-| HTML / CSS (browser JavaScript included) | `static` | Formatting (Prettier), AI assistant files, Git / VS Code settings |
-| Another language (Python, Rust, Go, …)   | `static` | AI assistant files and Git / VS Code settings only                |
+| Your project                             | Profile | What you get                                                      |
+| ---------------------------------------- | ------- | ----------------------------------------------------------------- |
+| Node project (JavaScript / TypeScript)   | `full`  | The full set: ESLint, type check, unit and E2E tests, Git hooks   |
+| HTML / CSS (browser JavaScript included) | `basic` | Formatting (Prettier), AI assistant files, Git / VS Code settings |
+| Another language (Python, Rust, Go, …)   | `basic` | AI assistant files and Git / VS Code settings only                |
 
-In a `static` project, `josh` skips each check that has nothing to run and says why.
+In a `basic` project, `josh` skips each check that has nothing to run and says why.
 
 ## Quick start
 
-Requires [Node.js](https://nodejs.org/) 22.19.0+ and [pnpm](https://pnpm.io/) for every profile ([getting-started.md](./docs/getting-started.md)); the [gh CLI](https://cli.github.com/) for `josh version` and the Issue workflow is required by `josh start` and optional otherwise. Run in your project directory.
+Requires [Node.js](https://nodejs.org/) 22.19.0+ and [pnpm](https://pnpm.io/) 12+ for every profile ([how to install them](./docs/setup/basic.md#1-check-the-prerequisites)); the [gh CLI](https://cli.github.com/) for `josh version` and the Issue workflow is required by `josh start` and optional otherwise. Run in your project directory.
 
-### The project is already on GitHub, or will not use GitHub
+One question picks the command: will the project use the GitHub Issue workflow (`kickoff`, `fullrun`, `backlogrun`)? The [profile](./docs/init.md#project-profiles) is chosen the same way either way.
+
+### The project will use the GitHub Issue workflow
 
 ```bash
-pnpm --allow-build=esbuild dlx @joshuafolkken/kit init
-pnpm josh gate
+pnpm add -D --allow-build=esbuild --allow-build=unrs-resolver @joshuafolkken/kit
+pnpm exec josh start
 ```
 
-### The project has no GitHub repository yet, and will use the Issue workflow
+With or without Git and a GitHub repository: `josh start` creates what is missing, and when `main` already has commits it opens a pull request with only kit's files for you to merge.
+
+### The project will not use the GitHub Issue workflow
 
 ```bash
-pnpm add -D --allow-build=esbuild --allow-build=unrs-resolver @joshuafolkken/kit
-pnpm exec josh start
+pnpm --allow-build=esbuild dlx @joshuafolkken/kit init
+pnpm josh gate
 ```
 
-`josh start` also runs `git init` when needed and creates and pushes the GitHub repository. Details: [init.md → `josh init` or `josh start`](./docs/init.md#josh-init-or-josh-start).
+What each command does in each starting state: [init.md → `josh init` or `josh start`](./docs/init.md#josh-init-or-josh-start).
+
+The step-by-step version of these commands, with what each one creates: [Set up the basic profile](./docs/setup/basic.md) · [Set up the full profile](./docs/setup/full.md).
 
 ## Documentation
 
-**Get started**
+**Set up**
+
+- [setup/basic.md](./docs/setup/basic.md) — a `basic` project, from an empty machine
+- [setup/full.md](./docs/setup/full.md) — a Node project, with `josh init` or `josh start`
+- [cli.md](./docs/cli.md) — the global `josh` command
+- [troubleshooting.md](./docs/troubleshooting.md) — install and auth errors
+
+**Use**
 
-- [getting-started.md](./docs/getting-started.md) — first install for a `static` project
-- [package.md](./docs/package.md) — add kit to a Node project
+- [overview.md](./docs/overview.md) — what kit sets up and how it works
 - [tutorial.md](./docs/tutorial.md) — your first change with an agent, from Issue to merge
 - [how-to.md](./docs/how-to.md) — guides by task
-- [overview.md](./docs/overview.md) — what kit sets up and how it works
 
 **Commands and configuration**
 
-- [cli.md](./docs/cli.md) — the global `josh` command
 - [josh-commands.md](./docs/josh-commands.md) — every `josh` command ([catalog](./docs/josh-command-catalog.md))
 - [init.md](./docs/init.md) — what `josh init` creates
 - [sync.md](./docs/sync.md) — what `josh sync` updates
@@ -58,7 +68,6 @@ pnpm exec josh start
 - [scripts-ai.md](./docs/scripts-ai.md) — Issue workflow commands and Telegram notifications
 - [cloud-session.md](./docs/cloud-session.md) — running in an agent container
 - [eval.md](./docs/eval.md) — measuring rule adherence
-- [troubleshooting.md](./docs/troubleshooting.md) — install and auth errors
 - [authentication.md](./docs/authentication.md) — existing GitHub Packages installs only
 
 ## Contributing

package/dist/CLAUDE.md

@@ -108,7 +108,7 @@ For every code modification, in order:
 
    - **Tests are required for ALL code changes** (bug fixes, timing/animation fixes and refactors included): bug fix → regression test; UI/animation/timing → E2E for the observable change; logic/utility → unit; refactor → tests pinning existing behavior BEFORE the change (`node_modules/@joshuafolkken/kit/prompts/refactoring.md`).
    - **Non-runtime updates (pre-approved manual-only exception)**: a change touching no executable runtime code path may proceed with manual verification — declare it in Step 0 and state why. It covers docs, non-executable config, editor/IDE files, and cosmetic asset swaps with no selector/path change; the mechanically exempt (`*.md`, `.editorconfig`, `.idea/**`, `.vscode/**`, `prompts/**`) are recognized by the command below, and the rest stay the exemption a person declares. A test infeasible for a runtime change needs its reason stated and user approval.
-   - **static の HTML/CSS 例外:** `package.json` に `josh.profile: static` が記録され、変更が HTML/CSS だけなら自動テストの代わりにブラウザーで表示を確認する。対象ページを開き、想定する画面幅でレイアウト・リンク・HTML 内の操作を確認し、観察結果を報告する。HTML/CSS と同時に変更した場合も、JavaScript と TypeScript のファイルには自動テストが必要。`pnpm josh test:declared` はこの場合だけ理由を添えて `exempt` と表示する。
+   - **basic の手動確認例外:** `package.json` に `josh.profile: basic`（改名前の `static` も同じ）が記録され、変更が kit がテストを実行できない言語のファイル（HTML/CSS や Lua などのソース）だけなら、自動テストの代わりに手で確認する。HTML/CSS はブラウザーで対象ページを開き、想定する画面幅でレイアウト・リンク・HTML 内の操作を確認する。そのほかのソースは変更した処理を実際に動かす。どちらも観察結果を報告する。JavaScript と TypeScript のファイルには同時に変更した場合も自動テストが必要。`pnpm josh test:declared` はこの場合だけ理由を添えて `exempt` と表示する。
    - **The commit stage answers this mechanically**: `pnpm josh test:declared` prints `required` / `exempt` / `satisfied` from the changed paths, and a runtime change with no test is refused at `pnpm josh git -y` on `required` — add the declared test or declare the non-runtime exception, then reissue (`node_modules/@joshuafolkken/kit/prompts/collaboration-workflow/rule-delivery.md`).
    - **Read a target's line headroom before editing: `pnpm josh lines <path>`** — near the limit, `Target` carries the splitting plan.
 
@@ -122,7 +122,7 @@ For every code modification, in order:
 Run the full verification set **in order**; do not skip, reorder, or report completion on a failed or skipped step without the user agreeing. Inside a `fullrun` / `backlogrun` the gate runs beside the review and the merge chain (`workflow-commands` skill → §2, `node_modules/@joshuafolkken/kit/prompts/review.md`).
 
 0. **Test gate** — no tests added? Continue only under the non-runtime exception (Step 0) or explicit approval; otherwise stop and add tests.
-   static プロファイルの HTML/CSS だけの変更には、Step 0 の手動ブラウザー確認を適用できる。
+   basic プロファイルで kit がテストできない言語のファイルだけの変更には、Step 0 の手動確認を適用できる。
 1. **Refactor** — `node_modules/@joshuafolkken/kit/prompts/refactoring.md`, until no high/medium items remain.
 2. **`pnpm josh gate`** — lint, type check, spell check and unit tests concurrently. One gate per run; while implementing re-run a single check by name (`pnpm josh lint:related` / `pnpm josh cspell:dot` / `pnpm josh test:related`).
 3. **Self-review** — a subagent runs `/code-review` per `node_modules/@joshuafolkken/kit/prompts/review.md` (never a main-line `Skill` load); level from the changed paths, at most two rounds, high/medium findings resolved. `node_modules/@joshuafolkken/kit/prompts/review.md` → "Review round cap".

package/dist/hooks/batch-guard.js

@@ -9,10 +9,10 @@ import {
   load_environment_file,
   notice_refusal_path,
   refusal_path
-} from "./chunk-P3UX7SFN.js";
-import "./chunk-ASUZGZFT.js";
-import "./chunk-APVOACVT.js";
-import "./chunk-47SPMGOD.js";
+} from "./chunk-A2H5I2VD.js";
+import "./chunk-56LGMJJV.js";
+import "./chunk-GBJUERYK.js";
+import "./chunk-PAXMLGSS.js";
 import "./chunk-WPALEIRX.js";
 import "./chunk-RKUAD3I6.js";
 export {

package/dist/hooks/{chunk-ZT65LR3U.js → chunk-4GDR2YTV.js}

@@ -1,16 +1,16 @@
 import {
   investigation_reads
-} from "./chunk-RFPHKU7C.js";
+} from "./chunk-WMIR5SNX.js";
 import {
   lane_guard_policy
-} from "./chunk-ASUZGZFT.js";
+} from "./chunk-56LGMJJV.js";
 import {
   hook_decision
-} from "./chunk-APVOACVT.js";
+} from "./chunk-GBJUERYK.js";
 import {
   json_value,
   time_spans
-} from "./chunk-47SPMGOD.js";
+} from "./chunk-PAXMLGSS.js";
 
 // scripts/delegation/duplicate-read-guard.ts
 import { statSync } from "node:fs";

package/dist/hooks/{chunk-ASUZGZFT.js → chunk-56LGMJJV.js}

@@ -1,13 +1,13 @@
 import {
   lane_child_marker
-} from "./chunk-APVOACVT.js";
+} from "./chunk-GBJUERYK.js";
 import {
   time_bundle_call,
   time_format,
   time_round_trips,
   time_spans,
   time_transcript_line
-} from "./chunk-47SPMGOD.js";
+} from "./chunk-PAXMLGSS.js";
 
 // scripts/lane/lane-guard-policy.ts
 var DEFAULT_MODE = "refuse";