@bensandee/tooling 0.36.0 → 0.38.0

package/dist/bin.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { d as debug, f as debugExec, h as note, l as createRealExecutor$1, m as log, p as isEnvVerbose, t as runDockerCheck, u as isExecSyncError } from "./check-Ceom_OgJ.mjs";
+import { d as debug, f as debugExec, g as note, h as log, l as createRealExecutor$1, m as redact, p as isEnvVerbose, t as runDockerCheck, u as isExecSyncError } from "./check-hutCTIXe.mjs";
 import { defineCommand, runMain } from "citty";
 import * as p from "@clack/prompts";
 import { isCancel, select } from "@clack/prompts";
 import path from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync, execSync } from "node:child_process";
 import JSON5 from "json5";
 import { parse } from "jsonc-parser";
 import { z } from "zod";
@@ -102,6 +102,7 @@ function detectProject(targetDir) {
 		hasPackageJson: exists("package.json"),
 		hasTsconfig: exists("tsconfig.json"),
 		hasOxlintConfig: exists("oxlint.config.ts"),
+		oxlintExtendsRecommended: fileContains(path.join(targetDir, "oxlint.config.ts"), "@bensandee/config/oxlint/recommended"),
 		hasLegacyOxlintJson: exists(".oxlintrc.json"),
 		hasGitignore: exists(".gitignore"),
 		hasVitestConfig: exists("vitest.config.ts") || exists("vitest.config.mts"),
@@ -170,6 +171,15 @@ function detectLegacyConfigs(targetDir) {
 	}
 	return results;
 }
+/** Check whether a file exists and contains a given substring. */
+function fileContains(filePath, substring) {
+	if (!existsSync(filePath)) return false;
+	try {
+		return readFileSync(filePath, "utf-8").includes(substring);
+	} catch (_error) {
+		return false;
+	}
+}
 /** Read and parse existing package.json, or return undefined. */
 function readPackageJson(targetDir) {
 	const pkgPath = path.join(targetDir, "package.json");
@@ -455,6 +465,11 @@ function buildDefaultConfig(targetDir, flags) {
 }
 //#endregion
 //#region src/utils/fs.ts
+/** Verify that a relative path resolves within the target directory. */
+function assertContained(targetDir, rel) {
+	const resolved = path.resolve(targetDir, rel);
+	if (!resolved.startsWith(targetDir + path.sep) && resolved !== targetDir) throw new FatalError(`Path traversal detected: ${rel} resolves outside target directory`);
+}
 /**
 * Compare file content, using parsed comparison for JSON files to ignore
 * formatting differences. Falls back to exact string comparison for JSONC
@@ -495,9 +510,18 @@ function createContext(config, confirmOverwrite) {
 		config,
 		targetDir: config.targetDir,
 		packageJson: pkgRaw ? parsePackageJson(pkgRaw) : void 0,
-		exists: (rel) => fileExists(config.targetDir, rel),
-		read: (rel) => readFile(config.targetDir, rel),
+		exists: (rel) => {
+			const resolved = path.resolve(config.targetDir, rel);
+			if (!resolved.startsWith(config.targetDir + path.sep) && resolved !== config.targetDir) return false;
+			return fileExists(config.targetDir, rel);
+		},
+		read: (rel) => {
+			const resolved = path.resolve(config.targetDir, rel);
+			if (!resolved.startsWith(config.targetDir + path.sep) && resolved !== config.targetDir) return;
+			return readFile(config.targetDir, rel);
+		},
 		write: (rel, content) => {
+			assertContained(config.targetDir, rel);
 			if (!rel.startsWith(".tooling-archived/")) {
 				const existing = readFile(config.targetDir, rel);
 				if (existing !== void 0 && !contentEqual(rel, existing, content)) {
@@ -509,6 +533,7 @@ function createContext(config, confirmOverwrite) {
 			if (rel === "package.json") ctx.packageJson = parsePackageJson(content);
 		},
 		remove: (rel) => {
+			assertContained(config.targetDir, rel);
 			const fullPath = path.join(config.targetDir, rel);
 			if (existsSync(fullPath)) rmSync(fullPath);
 		},
@@ -560,7 +585,7 @@ const DockerCheckConfigSchema = z.object({
 	envFile: z.string().optional().meta({ description: "Environment file for compose" }),
 	services: z.array(z.string()).optional().meta({ description: "Services to check (default: all)" }),
 	healthChecks: z.array(DeclarativeHealthCheckSchema).optional().meta({ description: "Health check definitions" }),
-	buildCommand: z.string().optional().meta({ description: "Command to build images before checking" }),
+	buildCommand: z.array(z.string()).optional().meta({ description: "Command to build images before checking (e.g. [\"pnpm\", \"image:build\"])" }),
 	buildCwd: z.string().optional().meta({ description: "Working directory for build command" }),
 	timeoutMs: z.number().int().positive().optional().meta({ description: "Overall timeout in milliseconds" }),
 	pollIntervalMs: z.number().int().positive().optional().meta({ description: "Poll interval in milliseconds" })
@@ -596,7 +621,9 @@ const ToolingConfigSchema = z.strictObject({
 		dockerfile: z.string().meta({ description: "Path to Dockerfile relative to package" }),
 		context: z.string().default(".").meta({ description: "Docker build context relative to package" })
 	})).optional().meta({ description: "Docker package overrides (package name → config)" }),
-	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" })
+	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" }),
+	registryHost: z.string().optional().meta({ description: "Docker registry hostname (e.g. ghcr.io, code.example.com)" }),
+	registryNamespace: z.string().optional().meta({ description: "Docker registry namespace (e.g. ghcr.io/myorg, code.example.com/myorg)" })
 });
 /** Load saved tooling config from the target directory. Returns undefined if missing, throws on invalid. */
 function loadToolingConfig(targetDir) {
@@ -855,14 +882,15 @@ function readRepoName(executor, cwd) {
 function buildImage(executor, pkg, cwd, extraArgs) {
 	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
 	const contextPath = path.resolve(cwd, pkg.docker.context);
-	const command = [
-		"docker build",
-		`-f ${dockerfilePath}`,
-		`-t ${pkg.imageName}:latest`,
+	executor.execInherit("docker", [
+		"build",
+		"-f",
+		dockerfilePath,
+		"-t",
+		`${pkg.imageName}:latest`,
 		...extraArgs,
 		contextPath
-	].join(" ");
-	executor.execInherit(command);
+	]);
 }
 /**
 * Detect packages with docker config in .tooling.json and build each one.
@@ -917,7 +945,13 @@ function runDockerPublish(executor, config) {
 	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
 	if (!config.dryRun) {
 		log.info(`Logging in to ${config.registryHost}...`);
-		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
+		const loginResult = executor.exec("docker", [
+			"login",
+			config.registryHost,
+			"-u",
+			config.username,
+			"--password-stdin"
+		], { input: config.password });
 		debugExec(config, "docker login", loginResult);
 		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
 	} else log.info("[dry-run] Skipping docker login");
@@ -930,12 +964,16 @@ function runDockerPublish(executor, config) {
 				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
 				allTags.push(ref);
 				log.info(`Tagging ${pkg.imageName} → ${ref}`);
-				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
+				const tagResult = executor.exec("docker", [
+					"tag",
+					pkg.imageName,
+					ref
+				]);
 				debugExec(config, `docker tag ${pkg.imageName} ${ref}`, tagResult);
 				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
 				if (!config.dryRun) {
 					log.info(`Pushing ${ref}...`);
-					const pushResult = executor.exec(`docker push ${ref}`);
+					const pushResult = executor.exec("docker", ["push", ref]);
 					debugExec(config, `docker push ${ref}`, pushResult);
 					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
 				} else log.info(`[dry-run] Skipping push for ${ref}`);
@@ -944,7 +982,7 @@ function runDockerPublish(executor, config) {
 	} finally {
 		if (!config.dryRun) {
 			log.info(`Logging out from ${config.registryHost}...`);
-			executor.exec(`docker logout ${config.registryHost}`);
+			executor.exec("docker", ["logout", config.registryHost]);
 		}
 	}
 	log.info(`Published ${String(allTags.length)} image tag(s)`);
@@ -1143,7 +1181,29 @@ function computeNodeVersionYaml(ctx) {
 }
 //#endregion
 //#region src/generators/publish-ci.ts
-function publishSteps(nodeVersionYaml) {
+/**
+* Check whether the project has a repository URL in package.json.
+* When true, the CLI can derive DOCKER_REGISTRY_HOST and DOCKER_REGISTRY_NAMESPACE
+* at runtime, so workflows can omit those env vars.
+*/
+function hasRepositoryUrl(ctx) {
+	const raw = ctx.read("package.json");
+	if (!raw) return false;
+	return parsePackageJson(raw)?.repository !== void 0;
+}
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv$1(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
+function publishSteps(nodeVersionYaml, registryDerivable) {
 	return [
 		{ step: { uses: "actions/checkout@v6" } },
 		{ step: { uses: "pnpm/action-setup@v5" } },
@@ -1154,13 +1214,7 @@ function publishSteps(nodeVersionYaml) {
 		{ step: { run: "pnpm install --frozen-lockfile" } },
 		{ step: {
 			name: "Publish Docker images",
-			env: {
-				DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-				DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
-				DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-				DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-				RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-			},
+			env: dockerPublishEnv$1(registryDerivable),
 			run: "pnpm exec bst docker:publish"
 		} }
 	];
@@ -1203,7 +1257,7 @@ async function generateDeployCi(ctx) {
 	};
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const steps = publishSteps(computeNodeVersionYaml(ctx));
+	const steps = publishSteps(computeNodeVersionYaml(ctx), hasRepositoryUrl(ctx));
 	const content = buildWorkflowYaml({
 		ci: ctx.config.ci,
 		name: "Publish",
@@ -1284,8 +1338,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1300,8 +1354,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1316,8 +1370,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1332,8 +1386,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1351,8 +1405,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1367,8 +1421,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1383,8 +1437,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1416,8 +1470,6 @@ function isWorkspacePackage(ctx, packageName) {
 	} catch (_error) {}
 	return false;
 }
-/** Deps that should not be blindly bumped to latest (version-sensitive). */
-const UPDATE_EXCLUDE = new Set(["@types/node"]);
 /** Add release-strategy-specific devDeps to a deps record. */
 function addReleaseDeps(deps, config) {
 	switch (config.releaseStrategy) {
@@ -1426,8 +1478,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1442,8 +1494,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1460,8 +1512,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1478,8 +1530,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1493,47 +1545,6 @@ function addReleaseDeps(deps, config) {
 			break;
 	}
 }
-/** Returns the list of pinned devDependency names that the tool would add for a given config. */
-function getAddedDevDepNames(config) {
-	const deps = { ...ROOT_DEV_DEPS };
-	if (config.structure !== "monorepo") Object.assign(deps, PER_PACKAGE_DEV_DEPS);
-	deps["@bensandee/config"] = "0.9.1";
-	deps["@bensandee/tooling"] = "0.36.0";
-	if (config.formatter === "oxfmt") deps["oxfmt"] = {
-		"@changesets/cli": "2.30.0",
-		"@release-it/bumper": "7.0.5",
-		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
-		"lefthook": "2.1.4",
-		"oxfmt": "0.41.0",
-		"oxlint": "1.56.0",
-		"prettier": "3.8.1",
-		"release-it": "19.2.4",
-		"tsdown": "0.21.4",
-		"typescript": "5.9.3",
-		"vitest": "4.1.0",
-		"pnpm": "10.32.1"
-	}["oxfmt"];
-	if (config.formatter === "prettier") deps["prettier"] = {
-		"@changesets/cli": "2.30.0",
-		"@release-it/bumper": "7.0.5",
-		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
-		"lefthook": "2.1.4",
-		"oxfmt": "0.41.0",
-		"oxlint": "1.56.0",
-		"prettier": "3.8.1",
-		"release-it": "19.2.4",
-		"tsdown": "0.21.4",
-		"typescript": "5.9.3",
-		"vitest": "4.1.0",
-		"pnpm": "10.32.1"
-	}["prettier"];
-	addReleaseDeps(deps, config);
-	return Object.keys(deps).filter((name) => !UPDATE_EXCLUDE.has(name));
-}
 async function generatePackageJson(ctx) {
 	const filePath = "package.json";
 	const existing = ctx.read(filePath);
@@ -1552,15 +1563,15 @@ async function generatePackageJson(ctx) {
 	}
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
-	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.36.0";
-	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
+	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.2";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.38.0";
+	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.10.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1575,8 +1586,8 @@ async function generatePackageJson(ctx) {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1659,8 +1670,8 @@ async function generatePackageJson(ctx) {
 			"@changesets/cli": "2.30.0",
 			"@release-it/bumper": "7.0.5",
 			"@types/node": "24.12.0",
-			"commit-and-tag-version": "12.7.0",
-			"knip": "5.87.0",
+			"commit-and-tag-version": "12.7.1",
+			"knip": "6.0.3",
 			"lefthook": "2.1.4",
 			"oxfmt": "0.41.0",
 			"oxlint": "1.56.0",
@@ -2405,6 +2416,7 @@ function buildSettings(ctx) {
 		`Bash(${pm} knip)`,
 		`Bash(${pm} knip *)`,
 		`Bash(${pm} check)`,
+		`Bash(${pm} ci:check)`,
 		`Bash(${pm} exec oxlint *)`,
 		`Bash(${pm} exec knip *)`,
 		"Bash(git status *)",
@@ -2578,7 +2590,7 @@ async function generateClaudeSettings(ctx) {
 }
 //#endregion
 //#region src/generators/release-it.ts
-function buildConfig$2(ci, isMonorepo) {
+function buildConfig$3(ci, isMonorepo) {
 	const config = {
 		$schema: "https://unpkg.com/release-it/schema/release-it.json",
 		git: {
@@ -2606,7 +2618,7 @@ async function generateReleaseIt(ctx) {
 		action: "skipped",
 		description: "release-it not requested"
 	};
-	const content = JSON.stringify(buildConfig$2(ctx.config.ci, ctx.config.structure === "monorepo"), null, 2) + "\n";
+	const content = JSON.stringify(buildConfig$3(ctx.config.ci, ctx.config.structure === "monorepo"), null, 2) + "\n";
 	const existing = ctx.read(filePath);
 	if (existing) {
 		if (contentEqual(filePath, existing, content)) return {
@@ -2629,7 +2641,7 @@ async function generateReleaseIt(ctx) {
 }
 //#endregion
 //#region src/generators/changesets.ts
-function buildConfig$1() {
+function buildConfig$2() {
 	return {
 		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
 		changelog: "@changesets/cli/changelog",
@@ -2649,7 +2661,7 @@ async function generateChangesets(ctx) {
 		action: "skipped",
 		description: "Changesets not requested"
 	};
-	const content = JSON.stringify(buildConfig$1(), null, 2) + "\n";
+	const content = JSON.stringify(buildConfig$2(), null, 2) + "\n";
 	const existing = ctx.read(filePath);
 	if (existing) return {
 		filePath,
@@ -2732,7 +2744,19 @@ function simpleReleaseCommand() {
 		"pnpm exec bst release:simple $FLAGS"
 	].join("\n");
 }
-function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
+function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	const releaseStep = { step: {
 		name: "Release",
 		env: {
@@ -2748,13 +2772,7 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
 	const dockerStep = { step: {
 		name: "Publish Docker images",
 		if: "success()",
-		env: {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
-			DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-			DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-		},
+		env: dockerPublishEnv(registryDerivable),
 		run: "pnpm exec bst docker:publish"
 	} };
 	return [
@@ -2763,10 +2781,10 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
 		...hasDocker ? [dockerStep] : []
 	];
 }
-function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker) {
+function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	switch (strategy) {
 		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker);
+		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 		default: return null;
 	}
 }
@@ -2787,7 +2805,8 @@ async function generateReleaseCi(ctx) {
 	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
 	const nodeVersionYaml = computeNodeVersionYaml(ctx);
 	const hasDocker = hasDockerPackages(ctx);
-	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker);
+	const registryDerivable = hasRepositoryUrl(ctx);
+	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 	if (!steps) return {
 		filePath,
 		action: "skipped",
@@ -2836,7 +2855,7 @@ function requiredCommands(formatter) {
 		}
 	};
 }
-function buildConfig(formatter) {
+function buildConfig$1(formatter) {
 	return [
 		"pre-commit:",
 		"  commands:",
@@ -2940,7 +2959,7 @@ function cleanPackageJson(ctx, results) {
 }
 async function generateLefthook(ctx) {
 	const filePath = "lefthook.yml";
-	const content = buildConfig(ctx.config.formatter);
+	const content = buildConfig$1(ctx.config.formatter);
 	const results = [];
 	archiveHuskyHooks(ctx, results);
 	archiveLintStagedConfigs(ctx, results);
@@ -3081,6 +3100,72 @@ async function generateVscodeSettings(ctx) {
 	return results;
 }
 //#endregion
+//#region src/generators/versionrc.ts
+function buildConfig() {
+	return {
+		header: "# Changelog\n\nAll notable changes to this project will be documented in this file.\n",
+		types: [
+			{
+				type: "feat",
+				section: "Features"
+			},
+			{
+				type: "fix",
+				section: "Bug Fixes"
+			},
+			{
+				type: "chore",
+				section: "Chores"
+			},
+			{
+				type: "refactor",
+				section: "Refactoring"
+			},
+			{
+				type: "perf",
+				section: "Performance"
+			},
+			{
+				type: "docs",
+				hidden: true
+			},
+			{
+				type: "style",
+				hidden: true
+			},
+			{
+				type: "test",
+				hidden: true
+			},
+			{
+				type: "ci",
+				hidden: true
+			}
+		],
+		tagPrefix: "v"
+	};
+}
+async function generateVersionrc(ctx) {
+	const filePath = ".versionrc.json";
+	if (ctx.config.releaseStrategy !== "simple") return {
+		filePath,
+		action: "skipped",
+		description: "simple release not requested"
+	};
+	if (ctx.exists(filePath)) return {
+		filePath,
+		action: "skipped",
+		description: "Existing versionrc config preserved"
+	};
+	const content = JSON.stringify(buildConfig(), null, 2) + "\n";
+	ctx.write(filePath, content);
+	return {
+		filePath,
+		action: "created",
+		description: "Generated .versionrc.json"
+	};
+}
+//#endregion
 //#region src/generators/pipeline.ts
 /** Run all generators sequentially and return their results. */
 async function runGenerators(ctx) {
@@ -3098,6 +3183,7 @@ async function runGenerators(ctx) {
 	results.push(await generateCi(ctx));
 	results.push(...await generateClaudeSettings(ctx));
 	results.push(await generateReleaseIt(ctx));
+	results.push(await generateVersionrc(ctx));
 	results.push(await generateChangesets(ctx));
 	results.push(await generateReleaseCi(ctx));
 	results.push(await generateDeployCi(ctx));
@@ -3110,173 +3196,121 @@ async function runGenerators(ctx) {
 //#region src/generators/migrate-prompt.ts
 /**
 * Generate a context-aware AI migration prompt based on what the CLI did.
-* This prompt can be pasted into Claude Code (or similar) to finish the migration.
+* Piped into Claude Code via `cat .tooling-migrate.md | claude`.
 */
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push("# Migration Prompt");
-	sections.push("");
-	sections.push(`_Generated by \`@bensandee/tooling@0.36.0 repo:sync\` on ${timestamp}_`);
-	sections.push("");
-	sections.push("The following prompt was generated by `@bensandee/tooling repo:sync`. Paste it into Claude Code or another AI assistant to finish migrating this repository.");
-	sections.push("");
-	sections.push("> **Tip:** Before starting, run `/init` in Claude Code to generate a `CLAUDE.md` that gives the AI a complete picture of your repository's structure, conventions, and build commands.");
-	sections.push("");
-	sections.push("## What was changed");
-	sections.push("");
-	const created = results.filter((r) => r.action === "created");
-	const updated = results.filter((r) => r.action === "updated");
-	const skipped = results.filter((r) => r.action === "skipped");
-	const archived = results.filter((r) => r.action === "archived");
-	if (created.length > 0) {
-		sections.push("**Created:**");
-		for (const r of created) sections.push(`- \`${r.filePath}\` — ${r.description}`);
-		sections.push("");
-	}
-	if (updated.length > 0) {
-		sections.push("**Updated:**");
-		for (const r of updated) sections.push(`- \`${r.filePath}\` — ${r.description}`);
-		sections.push("");
-	}
-	if (archived.length > 0) {
-		sections.push("**Archived:**");
-		for (const r of archived) sections.push(`- \`${r.filePath}\` — ${r.description}`);
-		sections.push("");
-	}
-	if (skipped.length > 0) {
-		sections.push("**Skipped (review these):**");
-		for (const r of skipped) sections.push(`- \`${r.filePath}\` — ${r.description}`);
-		sections.push("");
-	}
-	sections.push("## Migration tasks");
-	sections.push("");
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.38.0 repo:sync\` on ${timestamp}_\n`);
+	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
+	if (changed.length > 0) {
+		const items = changed.map((r) => {
+			const label = r.action === "archived" ? "archived" : r.action;
+			return `- \`${r.filePath}\` (${label}) — ${r.description}`;
+		}).join("\n");
+		sections.push(`## Files changed\n\n${items}\n`);
+	}
+	const tasks = [];
+	addLegacyToolingTasks(tasks, config, detected);
+	addArchivedFileTasks(tasks, results);
+	addOxlintTasks(tasks, results, detected);
+	addMonorepoTasks(tasks, config, detected);
+	addTestGenerationTasks(tasks, results);
+	if (tasks.length > 0) {
+		sections.push(`## Migration tasks\n\n${tasks.join("\n")}`);
+		sections.push(`## Ground rules
+
+Prefer fixing root causes over suppressing issues:
+
+- **Lint errors**: fix the code, not disable comments
+- **Type errors**: add proper types, not \`any\` or \`@ts-expect-error\`
+- **Test failures**: fix the test or bug, don't skip/delete
+- **Knip findings**: remove unused code, don't add ignores
+
+It is OK to add new packages (e.g. \`zod\`, \`@bensandee/common\`) to resolve errors. Only suppress an issue with a comment explaining why the fix is not feasible.
+`);
+	}
+	sections.push(`## Verify
+
+Run \`pnpm check\` and fix any errors. This runs the full pipeline:
+build → typecheck → lint → test → format → knip
+
+When everything passes, run \`/init\` to generate a \`CLAUDE.md\` for this repository.
+`);
+	return sections.join("\n");
+}
+const LEGACY_REPLACEMENTS = {
+	eslint: "oxlint",
+	prettier: "oxfmt",
+	jest: "vitest",
+	webpack: "tsdown",
+	rollup: "tsdown"
+};
+function addLegacyToolingTasks(tasks, config, detected) {
 	const legacyToRemove = detected.legacyConfigs.filter((legacy) => !(legacy.tool === "prettier" && config.formatter === "prettier"));
-	if (legacyToRemove.length > 0) {
-		sections.push("### Remove legacy tooling");
-		sections.push("");
-		for (const legacy of legacyToRemove) {
-			const replacement = {
-				eslint: "oxlint",
-				prettier: "oxfmt",
-				jest: "vitest",
-				webpack: "tsdown",
-				rollup: "tsdown"
-			}[legacy.tool];
-			sections.push(`- Remove ${legacy.tool} config files (${legacy.files.map((f) => `\`${f}\``).join(", ")}). This project now uses **${replacement}**.`);
-			sections.push(`  - Uninstall ${legacy.tool}-related packages from devDependencies`);
-			if (legacy.tool === "eslint") sections.push("  - Migrate any custom ESLint rules that don't have oxlint equivalents");
-			if (legacy.tool === "jest") sections.push("  - Migrate any jest-specific test utilities (jest.mock, jest.fn) to vitest equivalents (vi.mock, vi.fn)");
-		}
-		sections.push("");
-	}
-	if (archived.length > 0) {
-		sections.push("### Review archived files");
-		sections.push("");
-		sections.push("The following files were modified or replaced. The originals have been saved to `.tooling-archived/`:");
-		sections.push("");
-		for (const r of archived) sections.push(`- \`${r.filePath}\` → \`.tooling-archived/${r.filePath}\``);
-		sections.push("");
-		sections.push("For each archived file, **diff the old version against the new one** and look for features, categories, or modules that were enabled in the original but are missing from the replacement. Focus on broad capability gaps rather than individual rule strictness (in general, being stricter is fine). Examples of what to look for:");
-		sections.push("");
-		sections.push("- **Lint configs**: enabled plugin categories (e.g. `jsx-a11y`, `import`, `react`, `nextjs`), custom `plugins` or `overrides`, file-scoped rule blocks");
-		sections.push("- **TypeScript configs**: compiler features like `jsx`, `paths`, `baseUrl`, or `references` that affect build behavior");
-		sections.push("- **Other configs**: feature flags, custom presets, or integrations that go beyond the default template");
-		sections.push("");
-		sections.push("If the old config had capabilities the new one lacks, port them into the new file. Then:");
-		sections.push("");
-		sections.push("1. If the project previously used `husky` and `lint-staged`, remove them from `devDependencies`");
-		sections.push("2. Delete the `.tooling-archived/` directory when migration is complete");
-		sections.push("");
-	}
-	const oxlintWasSkipped = results.find((r) => r.filePath === "oxlint.config.ts")?.action === "skipped";
+	if (legacyToRemove.length === 0) return;
+	const items = legacyToRemove.map((legacy) => {
+		const replacement = LEGACY_REPLACEMENTS[legacy.tool];
+		const files = legacy.files.map((f) => `\`${f}\``).join(", ");
+		const lines = [`- Remove ${legacy.tool} config files (${files}). This project now uses **${replacement}**.`, `  - Uninstall ${legacy.tool}-related packages from devDependencies`];
+		if (legacy.tool === "eslint") lines.push("  - Migrate any custom ESLint rules that don't have oxlint equivalents");
+		if (legacy.tool === "jest") lines.push("  - Migrate jest-specific test utilities (jest.mock, jest.fn) to vitest equivalents (vi.mock, vi.fn)");
+		return lines.join("\n");
+	});
+	tasks.push(`### Remove legacy tooling\n\n${items.join("\n")}\n`);
+}
+function addArchivedFileTasks(tasks, results) {
+	const archived = results.filter((r) => r.action === "archived");
+	if (archived.length === 0) return;
+	const items = archived.map((r) => `- \`${r.filePath}\` → \`.tooling-archived/${r.filePath}\``).join("\n");
+	tasks.push(`### Review archived files
+
+The originals have been saved to \`.tooling-archived/\`. For each, diff the old version against the new one and port any capabilities the new file lacks:
+
+${items}
+
+Delete \`.tooling-archived/\` when done.
+`);
+}
+function addOxlintTasks(tasks, results, detected) {
 	if (detected.hasLegacyOxlintJson) {
-		sections.push("### Migrate .oxlintrc.json to oxlint.config.ts");
-		sections.push("");
-		sections.push("A new `oxlint.config.ts` has been generated using `defineConfig` from the `oxlint` package. The existing `.oxlintrc.json` needs to be migrated:");
-		sections.push("");
-		sections.push("1. Read `.oxlintrc.json` and compare its `rules` against the rules provided by `@bensandee/config/oxlint/recommended` (check `node_modules/@bensandee/config`). Most standard rules are already included in the recommended config.");
-		sections.push("2. If there are any custom rules, overrides, settings, or `jsPlugins` not covered by the recommended config, add them to `oxlint.config.ts` alongside the `extends`.");
-		sections.push("3. Delete `.oxlintrc.json`.");
-		sections.push("4. Run `pnpm lint` to verify the new config works correctly.");
-		sections.push("");
-	} else if (oxlintWasSkipped && detected.hasOxlintConfig) {
-		sections.push("### Verify oxlint.config.ts includes recommended rules");
-		sections.push("");
-		sections.push("The existing `oxlint.config.ts` was kept as-is. Verify that it extends the recommended config from `@bensandee/config/oxlint`:");
-		sections.push("");
-		sections.push("1. Open `oxlint.config.ts` and check that it imports and extends `@bensandee/config/oxlint/recommended`.");
-		sections.push("2. The expected pattern is:");
-		sections.push("   ```ts");
-		sections.push("   import recommended from \"@bensandee/config/oxlint/recommended\";");
-		sections.push("   import { defineConfig } from \"oxlint\";");
-		sections.push("");
-		sections.push("   export default defineConfig({ extends: [recommended] });");
-		sections.push("   ```");
-		sections.push("3. If it uses a different pattern, update it to extend the recommended config while preserving any project-specific customizations.");
-		sections.push("4. Run `pnpm lint` to verify the config works correctly.");
-		sections.push("");
-	}
-	if (config.structure === "monorepo" && !detected.hasPnpmWorkspace) {
-		sections.push("### Migrate to monorepo structure");
-		sections.push("");
-		sections.push("This project was converted from a single repo to a monorepo. Complete the migration:");
-		sections.push("");
-		sections.push("1. Move existing source into `packages/<name>/` (using the existing package name)");
-		sections.push("2. Split the root `package.json` into a root workspace manifest + package-level `package.json`");
-		sections.push("3. Move the existing `tsconfig.json` into the package and update the root tsconfig with project references");
-		sections.push("4. Create a package-level `tsdown.config.ts` in the new package");
-		sections.push("5. Update any import paths or build scripts affected by the move");
-		sections.push("");
-	}
-	const skippedConfigs = skipped.filter((r) => r.filePath !== "ci" && r.description !== "Not a monorepo");
-	if (skippedConfigs.length > 0) {
-		sections.push("### Review skipped files");
-		sections.push("");
-		sections.push("The following files were left unchanged. Review them for compatibility:");
-		sections.push("");
-		for (const r of skippedConfigs) sections.push(`- \`${r.filePath}\` — ${r.description}`);
-		sections.push("");
-	}
-	if (results.some((r) => r.filePath === "test/example.test.ts" && r.action === "created")) {
-		sections.push("### Generate tests");
-		sections.push("");
-		sections.push("A starter test was created at `test/example.test.ts`. Now:");
-		sections.push("");
-		sections.push("1. Review the existing source code in `src/`");
-		sections.push("2. Create additional test files following the starter test's patterns (import style, describe/it structure)");
-		sections.push("3. Focus on edge cases and core business logic");
-		sections.push("4. Aim for meaningful coverage of exported functions and key code paths");
-		sections.push("");
-	}
-	sections.push("## Ground rules");
-	sections.push("");
-	sections.push("It is OK to add new packages (e.g. `zod`, `@bensandee/common`) if they are needed to resolve errors.");
-	sections.push("");
-	sections.push("When resolving errors from the checklist below, prefer fixing the root cause over suppressing the issue. For example:");
-	sections.push("");
-	sections.push("- **Lint errors**: fix the code rather than adding disable comments or rule exceptions");
-	sections.push("- **Test failures**: update the test or fix the underlying bug rather than skipping or deleting the test");
-	sections.push("- **Knip findings**: remove genuinely unused code/exports/dependencies rather than adding ignores to `knip.config.ts`");
-	sections.push("- **Type errors**: add proper types rather than using `any` or `@ts-expect-error`");
-	sections.push("");
-	sections.push("Only suppress an issue if there is a clear, documented reason why the fix is not feasible (e.g. a third-party type mismatch). Leave a comment explaining why.");
-	sections.push("");
-	sections.push("## Verification checklist");
-	sections.push("");
-	sections.push("Run each of these commands and fix any errors before moving on:");
-	sections.push("");
-	sections.push("1. `pnpm install`");
-	const updateCmd = `pnpm update --latest ${getAddedDevDepNames(config).join(" ")}`;
-	sections.push(`2. \`${updateCmd}\` — bump added dependencies to their latest versions`);
-	sections.push("3. `pnpm typecheck` — fix any type errors");
-	sections.push("4. `pnpm build` — fix any build errors");
-	sections.push("5. `pnpm test` — fix any test failures");
-	sections.push("6. `pnpm lint` — fix the code to satisfy lint rules");
-	sections.push("7. `pnpm knip` — remove unused exports, dependencies, and dead code");
-	sections.push("8. `pnpm format` — fix any formatting issues");
-	sections.push("");
-	return sections.join("\n");
+		tasks.push(`### Migrate .oxlintrc.json to oxlint.config.ts
+
+Compare \`.oxlintrc.json\` rules against \`@bensandee/config/oxlint/recommended\`. Port any custom rules/overrides into \`oxlint.config.ts\`, then delete \`.oxlintrc.json\`.
+`);
+		return;
+	}
+	if (results.find((r) => r.filePath === "oxlint.config.ts")?.action === "skipped" && detected.hasOxlintConfig && !detected.oxlintExtendsRecommended) tasks.push(`### Verify oxlint.config.ts extends recommended rules
+
+Ensure \`oxlint.config.ts\` imports and extends \`@bensandee/config/oxlint/recommended\`:
+
+\`\`\`ts
+import recommended from "@bensandee/config/oxlint/recommended";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({ extends: [recommended] });
+\`\`\`
+`);
+}
+function addMonorepoTasks(tasks, config, detected) {
+	if (config.structure !== "monorepo" || detected.hasPnpmWorkspace) return;
+	tasks.push(`### Migrate to monorepo structure
+
+This project was converted to a monorepo. Complete the migration:
+
+1. Move existing source into \`packages/<name>/\`
+2. Split root \`package.json\` into workspace manifest + package-level \`package.json\`
+3. Move \`tsconfig.json\` into the package, add project references to root
+4. Create a package-level \`tsdown.config.ts\`
+5. Update import paths and build scripts
+`);
+}
+function addTestGenerationTasks(tasks, results) {
+	if (!results.some((r) => r.filePath === "test/example.test.ts" && r.action === "created")) return;
+	tasks.push(`### Generate tests
+
+A starter test was created at \`test/example.test.ts\`. Review \`src/\` and create additional tests covering exported functions and edge cases.
+`);
 }
 //#endregion
 //#region src/commands/repo-init.ts
@@ -3301,11 +3335,11 @@ function contextAsDockerReader(ctx) {
 function logDetectionSummary(ctx) {
 	if (ctx.config.publishDocker) {
 		const dockerPackages = detectDockerPackages(contextAsDockerReader(ctx), ctx.targetDir, ctx.config.name);
-		if (dockerPackages.length > 0) log.info(`Docker images: ${dockerPackages.map((pkg) => pkg.imageName).join(", ")}`);
+		if (dockerPackages.length > 0) log.info(`Docker images to build and publish: ${dockerPackages.map((pkg) => pkg.imageName).join(", ")}`);
 	}
 	if (ctx.config.publishNpm) {
 		const publishable = getPublishablePackages(ctx.targetDir, ctx.config.structure, ctx.packageJson);
-		if (publishable.length > 0) log.info(`npm packages: ${publishable.map((pkg) => pkg.name).join(", ")}`);
+		if (publishable.length > 0) log.info(`npm packages to publish: ${publishable.map((pkg) => pkg.name).join(", ")}`);
 	}
 }
 async function runInit(config, options = {}) {
@@ -3353,22 +3387,19 @@ async function runInit(config, options = {}) {
 	if (created.length > 0) summaryLines.push(`Created: ${created.map((r) => r.filePath).join(", ")}`);
 	if (updated.length > 0) summaryLines.push(`Updated: ${updated.map((r) => r.filePath).join(", ")}`);
 	note(summaryLines.join("\n"), "Summary");
-	if (!options.noPrompt) {
-		log.info(`Migration prompt written to ${promptPath}`);
-		log.info("In Claude Code, run: \"Execute the steps in .tooling-migrate.md\"");
-	}
-	const bensandeeDeps = getAddedDevDepNames(config).filter((name) => name.startsWith("@bensandee/"));
+	if (!options.noPrompt) log.info(`Migration prompt written to ${promptPath}`);
+	const packageJsonChanged = results.some((r) => r.filePath === "package.json" && (r.action === "created" || r.action === "updated"));
 	const hasLockfile = ctx.exists("pnpm-lock.yaml");
-	if (bensandeeDeps.length > 0 && hasLockfile) {
-		log.info("Updating @bensandee/* packages...");
+	if (packageJsonChanged && hasLockfile) {
+		log.info("package.json changed — running pnpm install...");
 		try {
-			execSync(`pnpm update --latest ${bensandeeDeps.join(" ")}`, {
+			execSync("pnpm install", {
 				cwd: config.targetDir,
 				stdio: "inherit",
-				timeout: 6e4
+				timeout: 12e4
 			});
 		} catch (_error) {
-			log.warn("Could not update @bensandee/* packages — run pnpm install manually");
+			log.warn("pnpm install failed — run it manually");
 		}
 	}
 	if (hasChanges && ctx.exists("package.json")) try {
@@ -3379,10 +3410,10 @@ async function runInit(config, options = {}) {
 		});
 	} catch (_error) {}
 	note([
-		"1. Run: pnpm install",
-		"2. Run: pnpm check",
-		...options.noPrompt ? [] : ["3. In Claude Code, run: \"Execute the steps in .tooling-migrate.md\""]
-	].join("\n"), "Next steps");
+		...packageJsonChanged && !hasLockfile ? ["Run: pnpm install"] : [],
+		"Run: pnpm check",
+		...!options.noPrompt ? ["Run: claude \"Execute the migration steps in .tooling-migrate.md\""] : []
+	].map((step, i) => `${i + 1}. ${step}`).join("\n"), "Next steps");
 	return results;
 }
 //#endregion
@@ -3498,15 +3529,16 @@ function lineDiff(oldText, newText) {
 /** Create an executor that runs real commands, fetches, and reads the filesystem. */
 function createRealExecutor() {
 	return {
-		exec(command, options) {
+		exec(file, args, options) {
 			try {
 				return {
-					stdout: execSync(command, {
+					stdout: execFileSync(file, args, {
 						cwd: options?.cwd,
 						env: {
 							...process.env,
 							...options?.env
 						},
+						input: options?.input,
 						encoding: "utf-8",
 						stdio: [
 							"pipe",
@@ -3530,8 +3562,8 @@ function createRealExecutor() {
 				};
 			}
 		},
-		execInherit(command, options) {
-			execSync(command, {
+		execInherit(file, args, options) {
+			execFileSync(file, args, {
 				cwd: options?.cwd,
 				env: options?.env ? {
 					...process.env,
@@ -3588,6 +3620,19 @@ function createRealExecutor() {
 		}
 	};
 }
+/**
+* Compute sliding version tags from a semver version string.
+* For "1.2.3" returns ["v1", "v1.2", "latest"]. Strips prerelease suffixes.
+*/
+function computeSlidingTags(version) {
+	const parts = (version.split("-")[0] ?? version).split(".");
+	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
+	return [
+		`v${parts[0]}`,
+		`v${parts[0]}.${parts[1]}`,
+		"latest"
+	];
+}
 /** Parse "New tag:" lines from changeset publish output. */
 function parseNewTags(output) {
 	const tags = [];
@@ -3629,7 +3674,7 @@ const RETRY_BASE_DELAY_MS = 1e3;
 async function responseBodyText(res) {
 	try {
 		const text = await res.text();
-		return text.length > 500 ? text.slice(0, 500) + "…" : text;
+		return redact(text.length > 500 ? text.slice(0, 500) + "…" : text);
 	} catch {
 		return "(could not read response body)";
 	}
@@ -3856,19 +3901,23 @@ async function runVersionMode(executor, config) {
 			debug(config, "Temporarily disabled changeset commit:true");
 		}
 	}
-	const versionResult = executor.exec("pnpm changeset version", { cwd: config.cwd });
+	const versionResult = executor.exec("pnpm", ["changeset", "version"], { cwd: config.cwd });
 	debugExec(config, "pnpm changeset version", versionResult);
 	if (originalConfig) executor.writeFile(changesetConfigPath, originalConfig);
 	if (versionResult.exitCode !== 0) throw new FatalError(`pnpm changeset version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr}`);
-	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm install --no-frozen-lockfile", { cwd: config.cwd }));
+	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm", ["install", "--no-frozen-lockfile"], { cwd: config.cwd }));
 	const { title, body } = buildPrContent(executor, config.cwd, packagesBefore);
 	debug(config, `PR title: ${title}`);
-	const addResult = executor.exec("git add -A", { cwd: config.cwd });
+	const addResult = executor.exec("git", ["add", "-A"], { cwd: config.cwd });
 	if (addResult.exitCode !== 0) throw new FatalError(`git add failed: ${addResult.stderr || addResult.stdout}`);
 	const remainingChangesets = executor.listChangesetFiles(config.cwd);
 	if (remainingChangesets.length > 0) log.warn(`Changeset files still present after versioning: ${remainingChangesets.join(", ")}`);
 	debug(config, `Changeset files after versioning: ${remainingChangesets.length > 0 ? remainingChangesets.join(", ") : "(none — all consumed)"}`);
-	const commitResult = executor.exec("git commit -m \"chore: version packages\"", { cwd: config.cwd });
+	const commitResult = executor.exec("git", [
+		"commit",
+		"-m",
+		"chore: version packages"
+	], { cwd: config.cwd });
 	debugExec(config, "git commit", commitResult);
 	if (commitResult.exitCode !== 0) {
 		log.info("Nothing to commit after versioning");
@@ -3884,7 +3933,12 @@ async function runVersionMode(executor, config) {
 			pr: "none"
 		};
 	}
-	const pushResult = executor.exec(`git push origin "HEAD:refs/heads/${BRANCH}" --force`, { cwd: config.cwd });
+	const pushResult = executor.exec("git", [
+		"push",
+		"origin",
+		`HEAD:refs/heads/${BRANCH}`,
+		"--force"
+	], { cwd: config.cwd });
 	debugExec(config, "git push", pushResult);
 	if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 	const conn = {
@@ -3922,14 +3976,18 @@ async function runVersionMode(executor, config) {
 /** Mode 2: publish to npm, push tags, and create Forgejo releases. */
 async function runPublishMode(executor, config) {
 	log.info("No changesets — publishing packages");
-	const publishResult = executor.exec("pnpm changeset publish", { cwd: config.cwd });
+	const publishResult = executor.exec("pnpm", ["changeset", "publish"], { cwd: config.cwd });
 	debugExec(config, "pnpm changeset publish", publishResult);
 	if (publishResult.exitCode !== 0) throw new FatalError(`pnpm changeset publish failed (exit code ${String(publishResult.exitCode)}):\n${publishResult.stderr}`);
 	const stdoutTags = parseNewTags(publishResult.stdout + "\n" + publishResult.stderr);
 	debug(config, `Tags from publish stdout: ${stdoutTags.length > 0 ? stdoutTags.join(", ") : "(none)"}`);
 	const expectedTags = computeExpectedTags(executor.listWorkspacePackages(config.cwd));
 	debug(config, `Expected tags from workspace packages: ${expectedTags.length > 0 ? expectedTags.join(", ") : "(none)"}`);
-	const remoteTags = parseRemoteTags(executor.exec("git ls-remote --tags origin", { cwd: config.cwd }).stdout);
+	const remoteTags = parseRemoteTags(executor.exec("git", [
+		"ls-remote",
+		"--tags",
+		"origin"
+	], { cwd: config.cwd }).stdout);
 	debug(config, `Remote tags: ${remoteTags.length > 0 ? remoteTags.join(", ") : "(none)"}`);
 	const remoteSet = new Set(remoteTags);
 	const tagsToPush = reconcileTags(expectedTags, remoteTags, stdoutTags);
@@ -3963,11 +4021,19 @@ async function runPublishMode(executor, config) {
 	const errors = [];
 	for (const tag of allTags) try {
 		if (!remoteSet.has(tag)) {
-			if (executor.exec(`git tag -l ${JSON.stringify(tag)}`, { cwd: config.cwd }).stdout.trim() === "") {
-				const tagResult = executor.exec(`git tag ${JSON.stringify(tag)}`, { cwd: config.cwd });
+			if (executor.exec("git", [
+				"tag",
+				"-l",
+				tag
+			], { cwd: config.cwd }).stdout.trim() === "") {
+				const tagResult = executor.exec("git", ["tag", tag], { cwd: config.cwd });
 				if (tagResult.exitCode !== 0) throw new FatalError(`Failed to create tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
 			}
-			const pushTagResult = executor.exec(`git push origin refs/tags/${tag}`, { cwd: config.cwd });
+			const pushTagResult = executor.exec("git", [
+				"push",
+				"origin",
+				`refs/tags/${tag}`
+			], { cwd: config.cwd });
 			if (pushTagResult.exitCode !== 0) throw new FatalError(`Failed to push tag ${tag}: ${pushTagResult.stderr || pushTagResult.stdout}`);
 		}
 		if (await ensureRelease(executor, conn, tag) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
@@ -3980,6 +4046,31 @@ async function runPublishMode(executor, config) {
 		log.warn(`Failed to process ${tag}: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	if (errors.length > 0) throw new TransientError(`Failed to create releases for: ${errors.map((e) => e.tag).join(", ")}`);
+	const slidingTags = allTags.flatMap((t) => {
+		const atIndex = t.lastIndexOf("@");
+		if (atIndex <= 0) return [];
+		const name = t.slice(0, atIndex);
+		return computeSlidingTags(t.slice(atIndex + 1)).map((suffix) => `${name}@${suffix}`);
+	});
+	if (slidingTags.length > 0) {
+		for (const tag of slidingTags) {
+			const tagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				tag
+			], { cwd: config.cwd });
+			if (tagResult.exitCode !== 0) log.warn(`Warning: Failed to create sliding tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
+		}
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags.map((t) => `refs/tags/${t}`),
+			"--force"
+		], { cwd: config.cwd });
+		debugExec(config, "force-push sliding tags", forcePushResult);
+		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
+		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
+	}
 	return {
 		mode: "publish",
 		tags: allTags
@@ -4069,15 +4160,28 @@ function parseGitUrl(urlStr) {
 function configureGitAuth(executor, conn, cwd) {
 	const host = conn.serverUrl.replace(/^https?:\/\//, "");
 	const authUrl = `https://x-access-token:${conn.token}@${host}/${conn.repository}`;
-	executor.exec(`git remote set-url origin ${authUrl}`, { cwd });
+	executor.exec("git", [
+		"remote",
+		"set-url",
+		"origin",
+		authUrl
+	], { cwd });
 }
 /** Configure git user.name and user.email for CI bot commits. */
 function configureGitIdentity(executor, platform, cwd) {
 	const isGitHub = platform === "github";
 	const name = isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]";
 	const email = isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost";
-	executor.exec(`git config user.name "${name}"`, { cwd });
-	executor.exec(`git config user.email "${email}"`, { cwd });
+	executor.exec("git", [
+		"config",
+		"user.name",
+		name
+	], { cwd });
+	executor.exec("git", [
+		"config",
+		"user.email",
+		email
+	], { cwd });
 }
 //#endregion
 //#region src/commands/release-changesets.ts
@@ -4118,7 +4222,11 @@ function buildReleaseConfig(flags) {
 function getCurrentBranch(executor, cwd) {
 	const ref = process.env["GITHUB_REF"];
 	if (ref?.startsWith("refs/heads/")) return ref.slice(11);
-	return executor.exec("git rev-parse --abbrev-ref HEAD", { cwd }).stdout.trim();
+	return executor.exec("git", [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], { cwd }).stdout.trim();
 }
 /** Core release logic — testable with a mock executor. */
 async function runRelease(config, executor) {
@@ -4189,9 +4297,15 @@ async function triggerForgejo(conn, ref, inputs) {
 }
 function triggerGitHub(ref, inputs) {
 	const executor = createRealExecutor();
-	const inputFlags = Object.entries(inputs).map(([k, v]) => `-f ${k}=${v}`).join(" ");
-	const cmd = `gh workflow run release.yml --ref ${ref}${inputFlags ? ` ${inputFlags}` : ""}`;
-	const result = executor.exec(cmd, { cwd: process.cwd() });
+	const inputFlags = Object.entries(inputs).flatMap(([k, v]) => ["-f", `${k}=${v}`]);
+	const result = executor.exec("gh", [
+		"workflow",
+		"run",
+		"release.yml",
+		"--ref",
+		ref,
+		...inputFlags
+	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to trigger GitHub workflow: ${result.stderr || result.stdout || "unknown error"}`);
 	log.info(`Triggered release workflow on GitHub (ref: ${ref})`);
 }
@@ -4256,34 +4370,39 @@ async function mergeForgejo(conn, dryRun) {
 function mergeGitHub(dryRun) {
 	const executor = createRealExecutor();
 	if (dryRun) {
-		const prNum = executor.exec(`gh pr view ${HEAD_BRANCH} --json number --jq .number`, { cwd: process.cwd() }).stdout.trim();
+		const prNum = executor.exec("gh", [
+			"pr",
+			"view",
+			HEAD_BRANCH,
+			"--json",
+			"number",
+			"--jq",
+			".number"
+		], { cwd: process.cwd() }).stdout.trim();
 		if (!prNum) throw new FatalError(`No open PR found for branch ${HEAD_BRANCH}`);
 		log.info(`[dry-run] Would merge PR #${prNum} and delete branch ${HEAD_BRANCH}`);
 		return;
 	}
-	const result = executor.exec(`gh pr merge ${HEAD_BRANCH} --merge --delete-branch`, { cwd: process.cwd() });
+	const result = executor.exec("gh", [
+		"pr",
+		"merge",
+		HEAD_BRANCH,
+		"--merge",
+		"--delete-branch"
+	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to merge PR: ${result.stderr || result.stdout || "unknown error"}`);
 	log.info(`Merged changesets PR and deleted branch ${HEAD_BRANCH}`);
 }
 //#endregion
 //#region src/release/simple.ts
-/**
-* Compute sliding version tags from a semver version string.
-* For "1.2.3" returns ["v1", "v1.2"]. Strips prerelease suffixes.
-*/
-function computeSlidingTags(version) {
-	const parts = (version.split("-")[0] ?? version).split(".");
-	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
-	return [`v${parts[0]}`, `v${parts[0]}.${parts[1]}`];
-}
-/** Build the commit-and-tag-version command with appropriate flags. */
-function buildCommand(config) {
-	const args = ["pnpm exec commit-and-tag-version"];
+/** Build the commit-and-tag-version args. */
+function buildArgs(config) {
+	const args = ["exec", "commit-and-tag-version"];
 	if (config.dryRun) args.push("--dry-run");
 	if (config.firstRelease) args.push("--first-release");
-	if (config.releaseAs) args.push(`--release-as ${config.releaseAs}`);
-	if (config.prerelease) args.push(`--prerelease ${config.prerelease}`);
-	return args.join(" ");
+	if (config.releaseAs) args.push("--release-as", config.releaseAs);
+	if (config.prerelease) args.push("--prerelease", config.prerelease);
+	return args;
 }
 /** Read the current version from package.json. */
 function readVersion(executor, cwd) {
@@ -4300,14 +4419,18 @@ function platformType(config) {
 /** Run the full commit-and-tag-version release flow. */
 async function runSimpleRelease(executor, config) {
 	configureGitIdentity(executor, platformType(config), config.cwd);
-	const command = buildCommand(config);
-	log.info(`Running: ${command}`);
-	const versionResult = executor.exec(command, { cwd: config.cwd });
+	const args = buildArgs(config);
+	log.info(`Running: pnpm ${args.join(" ")}`);
+	const versionResult = executor.exec("pnpm", args, { cwd: config.cwd });
 	debugExec(config, "commit-and-tag-version", versionResult);
 	if (versionResult.exitCode !== 0) throw new FatalError(`commit-and-tag-version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr || versionResult.stdout}`);
 	const version = readVersion(executor, config.cwd);
 	debug(config, `New version: ${version}`);
-	const tagResult = executor.exec("git describe --tags --abbrev=0", { cwd: config.cwd });
+	const tagResult = executor.exec("git", [
+		"describe",
+		"--tags",
+		"--abbrev=0"
+	], { cwd: config.cwd });
 	debugExec(config, "git describe", tagResult);
 	const tag = tagResult.stdout.trim();
 	if (!tag) throw new FatalError("Could not determine the new tag from git describe");
@@ -4331,9 +4454,18 @@ async function runSimpleRelease(executor, config) {
 			configureGitAuth(executor, config.platform.conn, config.cwd);
 			debug(config, "Configured git remote with RELEASE_TOKEN auth");
 		}
-		const branch = executor.exec("git rev-parse --abbrev-ref HEAD", { cwd: config.cwd }).stdout.trim() || "main";
+		const branch = executor.exec("git", [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		], { cwd: config.cwd }).stdout.trim() || "main";
 		debug(config, `Pushing to origin/${branch}`);
-		const pushResult = executor.exec(`git push --follow-tags origin ${branch}`, { cwd: config.cwd });
+		const pushResult = executor.exec("git", [
+			"push",
+			"--follow-tags",
+			"origin",
+			branch
+		], { cwd: config.cwd });
 		debugExec(config, "git push", pushResult);
 		if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 		pushed = true;
@@ -4343,10 +4475,19 @@ async function runSimpleRelease(executor, config) {
 	if (!config.noSlidingTags && pushed) {
 		slidingTags = computeSlidingTags(version);
 		for (const slidingTag of slidingTags) {
-			const slidingTagResult = executor.exec(`git tag -f ${slidingTag}`, { cwd: config.cwd });
+			const slidingTagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				slidingTag
+			], { cwd: config.cwd });
 			if (slidingTagResult.exitCode !== 0) throw new FatalError(`Failed to create sliding tag ${slidingTag}: ${slidingTagResult.stderr || slidingTagResult.stdout}`);
 		}
-		const forcePushResult = executor.exec(`git push origin ${slidingTags.join(" ")} --force`, { cwd: config.cwd });
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags,
+			"--force"
+		], { cwd: config.cwd });
 		debugExec(config, "force-push sliding tags", forcePushResult);
 		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
 		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
@@ -4371,7 +4512,12 @@ async function createPlatformRelease(executor, config, tag) {
 		log.info(`Created Forgejo release for ${tag}`);
 		return true;
 	}
-	const ghResult = executor.exec(`gh release create ${tag} --generate-notes`, { cwd: config.cwd });
+	const ghResult = executor.exec("gh", [
+		"release",
+		"create",
+		tag,
+		"--generate-notes"
+	], { cwd: config.cwd });
 	debugExec(config, "gh release create", ghResult);
 	if (ghResult.exitCode !== 0) {
 		log.warn(`Warning: Failed to create GitHub release: ${ghResult.stderr || ghResult.stdout}`);
@@ -4609,6 +4755,45 @@ function requireEnv(name) {
 	if (!value) throw new FatalError(`Missing required environment variable: ${name}`);
 	return value;
 }
+/**
+* Derive the registry host from a repository URL hostname.
+* GitHub uses ghcr.io; all other hosts (Forgejo, GitLab, etc.) use the hostname directly.
+*/
+function registryHostFromHostname(hostname) {
+	return hostname === "github.com" ? "ghcr.io" : hostname;
+}
+/**
+* Resolve docker registry config using a fallback chain:
+* 1. Environment variables (DOCKER_REGISTRY_HOST / DOCKER_REGISTRY_NAMESPACE)
+* 2. .tooling.json registryHost / registryNamespace fields
+* 3. Derived from package.json repository URL
+*/
+function resolveRegistryConfig(cwd) {
+	const envHost = process.env["DOCKER_REGISTRY_HOST"];
+	const envNamespace = process.env["DOCKER_REGISTRY_NAMESPACE"];
+	if (envHost && envNamespace) return {
+		registryHost: envHost,
+		registryNamespace: envNamespace
+	};
+	const toolingConfig = loadToolingConfig(cwd);
+	const toolingHost = toolingConfig?.registryHost;
+	const toolingNamespace = toolingConfig?.registryNamespace;
+	if (toolingHost && toolingNamespace) return {
+		registryHost: envHost ?? toolingHost,
+		registryNamespace: envNamespace ?? toolingNamespace
+	};
+	const parsed = parseRepositoryUrl(cwd);
+	if (parsed) {
+		const derivedHost = registryHostFromHostname(parsed.hostname);
+		const owner = parsed.repository.split("/")[0];
+		const host = envHost ?? toolingHost ?? derivedHost;
+		return {
+			registryHost: host,
+			registryNamespace: envNamespace ?? toolingNamespace ?? `${host}/${owner}`
+		};
+	}
+	throw new FatalError("Could not determine docker registry. Set DOCKER_REGISTRY_HOST and DOCKER_REGISTRY_NAMESPACE, or add registryHost/registryNamespace to .tooling.json, or ensure package.json has a repository URL.");
+}
 const publishDockerCommand = defineCommand({
 	meta: {
 		name: "docker:publish",
@@ -4625,10 +4810,12 @@ const publishDockerCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
+		const cwd = process.cwd();
+		const { registryHost, registryNamespace } = resolveRegistryConfig(cwd);
 		const config = {
-			cwd: process.cwd(),
-			registryHost: requireEnv("DOCKER_REGISTRY_HOST"),
-			registryNamespace: requireEnv("DOCKER_REGISTRY_NAMESPACE"),
+			cwd,
+			registryHost,
+			registryNamespace,
 			username: requireEnv("DOCKER_USERNAME"),
 			password: requireEnv("DOCKER_PASSWORD"),
 			dryRun: args["dry-run"] === true,
@@ -4903,8 +5090,8 @@ function toHttpHealthChecks(checks) {
 }
 /** Write the generated check overlay to a temp file. Returns the absolute path. */
 function writeTempOverlay(content) {
-	const name = `tooling-check-overlay-${process.pid}.yaml`;
-	const filePath = path.join(tmpdir(), name);
+	const dir = mkdtempSync(path.join(tmpdir(), "tooling-check-"));
+	const filePath = path.join(dir, "overlay.yaml");
 	writeFileSync(filePath, content, "utf-8");
 	return filePath;
 }
@@ -4980,7 +5167,7 @@ const dockerCheckCommand = defineCommand({
 			if (!result.success) throw new FatalError(`Check failed (${result.reason}): ${result.message}`);
 		} finally {
 			try {
-				unlinkSync(tempOverlayPath);
+				rmSync(path.dirname(tempOverlayPath), { recursive: true });
 			} catch (_error) {}
 		}
 	}
@@ -4990,7 +5177,7 @@ const dockerCheckCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.36.0",
+		version: "0.38.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -5006,7 +5193,7 @@ const main = defineCommand({
 		"docker:check": dockerCheckCommand
 	}
 });
-console.log(`@bensandee/tooling v0.36.0`);
+console.log(`@bensandee/tooling v0.38.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);