@bensandee/tooling 0.37.0 → 0.38.0

package/dist/bin.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { d as debug, f as debugExec, h as note, l as createRealExecutor$1, m as log, p as isEnvVerbose, t as runDockerCheck, u as isExecSyncError } from "./check-Ceom_OgJ.mjs";
+import { d as debug, f as debugExec, g as note, h as log, l as createRealExecutor$1, m as redact, p as isEnvVerbose, t as runDockerCheck, u as isExecSyncError } from "./check-hutCTIXe.mjs";
 import { defineCommand, runMain } from "citty";
 import * as p from "@clack/prompts";
 import { isCancel, select } from "@clack/prompts";
 import path from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync, execSync } from "node:child_process";
 import JSON5 from "json5";
 import { parse } from "jsonc-parser";
 import { z } from "zod";
@@ -102,6 +102,7 @@ function detectProject(targetDir) {
 		hasPackageJson: exists("package.json"),
 		hasTsconfig: exists("tsconfig.json"),
 		hasOxlintConfig: exists("oxlint.config.ts"),
+		oxlintExtendsRecommended: fileContains(path.join(targetDir, "oxlint.config.ts"), "@bensandee/config/oxlint/recommended"),
 		hasLegacyOxlintJson: exists(".oxlintrc.json"),
 		hasGitignore: exists(".gitignore"),
 		hasVitestConfig: exists("vitest.config.ts") || exists("vitest.config.mts"),
@@ -170,6 +171,15 @@ function detectLegacyConfigs(targetDir) {
 	}
 	return results;
 }
+/** Check whether a file exists and contains a given substring. */
+function fileContains(filePath, substring) {
+	if (!existsSync(filePath)) return false;
+	try {
+		return readFileSync(filePath, "utf-8").includes(substring);
+	} catch (_error) {
+		return false;
+	}
+}
 /** Read and parse existing package.json, or return undefined. */
 function readPackageJson(targetDir) {
 	const pkgPath = path.join(targetDir, "package.json");
@@ -455,6 +465,11 @@ function buildDefaultConfig(targetDir, flags) {
 }
 //#endregion
 //#region src/utils/fs.ts
+/** Verify that a relative path resolves within the target directory. */
+function assertContained(targetDir, rel) {
+	const resolved = path.resolve(targetDir, rel);
+	if (!resolved.startsWith(targetDir + path.sep) && resolved !== targetDir) throw new FatalError(`Path traversal detected: ${rel} resolves outside target directory`);
+}
 /**
 * Compare file content, using parsed comparison for JSON files to ignore
 * formatting differences. Falls back to exact string comparison for JSONC
@@ -495,9 +510,18 @@ function createContext(config, confirmOverwrite) {
 		config,
 		targetDir: config.targetDir,
 		packageJson: pkgRaw ? parsePackageJson(pkgRaw) : void 0,
-		exists: (rel) => fileExists(config.targetDir, rel),
-		read: (rel) => readFile(config.targetDir, rel),
+		exists: (rel) => {
+			const resolved = path.resolve(config.targetDir, rel);
+			if (!resolved.startsWith(config.targetDir + path.sep) && resolved !== config.targetDir) return false;
+			return fileExists(config.targetDir, rel);
+		},
+		read: (rel) => {
+			const resolved = path.resolve(config.targetDir, rel);
+			if (!resolved.startsWith(config.targetDir + path.sep) && resolved !== config.targetDir) return;
+			return readFile(config.targetDir, rel);
+		},
 		write: (rel, content) => {
+			assertContained(config.targetDir, rel);
 			if (!rel.startsWith(".tooling-archived/")) {
 				const existing = readFile(config.targetDir, rel);
 				if (existing !== void 0 && !contentEqual(rel, existing, content)) {
@@ -509,6 +533,7 @@ function createContext(config, confirmOverwrite) {
 			if (rel === "package.json") ctx.packageJson = parsePackageJson(content);
 		},
 		remove: (rel) => {
+			assertContained(config.targetDir, rel);
 			const fullPath = path.join(config.targetDir, rel);
 			if (existsSync(fullPath)) rmSync(fullPath);
 		},
@@ -560,7 +585,7 @@ const DockerCheckConfigSchema = z.object({
 	envFile: z.string().optional().meta({ description: "Environment file for compose" }),
 	services: z.array(z.string()).optional().meta({ description: "Services to check (default: all)" }),
 	healthChecks: z.array(DeclarativeHealthCheckSchema).optional().meta({ description: "Health check definitions" }),
-	buildCommand: z.string().optional().meta({ description: "Command to build images before checking" }),
+	buildCommand: z.array(z.string()).optional().meta({ description: "Command to build images before checking (e.g. [\"pnpm\", \"image:build\"])" }),
 	buildCwd: z.string().optional().meta({ description: "Working directory for build command" }),
 	timeoutMs: z.number().int().positive().optional().meta({ description: "Overall timeout in milliseconds" }),
 	pollIntervalMs: z.number().int().positive().optional().meta({ description: "Poll interval in milliseconds" })
@@ -596,7 +621,9 @@ const ToolingConfigSchema = z.strictObject({
 		dockerfile: z.string().meta({ description: "Path to Dockerfile relative to package" }),
 		context: z.string().default(".").meta({ description: "Docker build context relative to package" })
 	})).optional().meta({ description: "Docker package overrides (package name → config)" }),
-	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" })
+	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" }),
+	registryHost: z.string().optional().meta({ description: "Docker registry hostname (e.g. ghcr.io, code.example.com)" }),
+	registryNamespace: z.string().optional().meta({ description: "Docker registry namespace (e.g. ghcr.io/myorg, code.example.com/myorg)" })
 });
 /** Load saved tooling config from the target directory. Returns undefined if missing, throws on invalid. */
 function loadToolingConfig(targetDir) {
@@ -855,14 +882,15 @@ function readRepoName(executor, cwd) {
 function buildImage(executor, pkg, cwd, extraArgs) {
 	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
 	const contextPath = path.resolve(cwd, pkg.docker.context);
-	const command = [
-		"docker build",
-		`-f ${dockerfilePath}`,
-		`-t ${pkg.imageName}:latest`,
+	executor.execInherit("docker", [
+		"build",
+		"-f",
+		dockerfilePath,
+		"-t",
+		`${pkg.imageName}:latest`,
 		...extraArgs,
 		contextPath
-	].join(" ");
-	executor.execInherit(command);
+	]);
 }
 /**
 * Detect packages with docker config in .tooling.json and build each one.
@@ -917,7 +945,13 @@ function runDockerPublish(executor, config) {
 	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
 	if (!config.dryRun) {
 		log.info(`Logging in to ${config.registryHost}...`);
-		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
+		const loginResult = executor.exec("docker", [
+			"login",
+			config.registryHost,
+			"-u",
+			config.username,
+			"--password-stdin"
+		], { input: config.password });
 		debugExec(config, "docker login", loginResult);
 		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
 	} else log.info("[dry-run] Skipping docker login");
@@ -930,12 +964,16 @@ function runDockerPublish(executor, config) {
 				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
 				allTags.push(ref);
 				log.info(`Tagging ${pkg.imageName} → ${ref}`);
-				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
+				const tagResult = executor.exec("docker", [
+					"tag",
+					pkg.imageName,
+					ref
+				]);
 				debugExec(config, `docker tag ${pkg.imageName} ${ref}`, tagResult);
 				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
 				if (!config.dryRun) {
 					log.info(`Pushing ${ref}...`);
-					const pushResult = executor.exec(`docker push ${ref}`);
+					const pushResult = executor.exec("docker", ["push", ref]);
 					debugExec(config, `docker push ${ref}`, pushResult);
 					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
 				} else log.info(`[dry-run] Skipping push for ${ref}`);
@@ -944,7 +982,7 @@ function runDockerPublish(executor, config) {
 	} finally {
 		if (!config.dryRun) {
 			log.info(`Logging out from ${config.registryHost}...`);
-			executor.exec(`docker logout ${config.registryHost}`);
+			executor.exec("docker", ["logout", config.registryHost]);
 		}
 	}
 	log.info(`Published ${String(allTags.length)} image tag(s)`);
@@ -1143,7 +1181,29 @@ function computeNodeVersionYaml(ctx) {
 }
 //#endregion
 //#region src/generators/publish-ci.ts
-function publishSteps(nodeVersionYaml) {
+/**
+* Check whether the project has a repository URL in package.json.
+* When true, the CLI can derive DOCKER_REGISTRY_HOST and DOCKER_REGISTRY_NAMESPACE
+* at runtime, so workflows can omit those env vars.
+*/
+function hasRepositoryUrl(ctx) {
+	const raw = ctx.read("package.json");
+	if (!raw) return false;
+	return parsePackageJson(raw)?.repository !== void 0;
+}
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv$1(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
+function publishSteps(nodeVersionYaml, registryDerivable) {
 	return [
 		{ step: { uses: "actions/checkout@v6" } },
 		{ step: { uses: "pnpm/action-setup@v5" } },
@@ -1154,13 +1214,7 @@ function publishSteps(nodeVersionYaml) {
 		{ step: { run: "pnpm install --frozen-lockfile" } },
 		{ step: {
 			name: "Publish Docker images",
-			env: {
-				DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-				DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
-				DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-				DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-				RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-			},
+			env: dockerPublishEnv$1(registryDerivable),
 			run: "pnpm exec bst docker:publish"
 		} }
 	];
@@ -1203,7 +1257,7 @@ async function generateDeployCi(ctx) {
 	};
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const steps = publishSteps(computeNodeVersionYaml(ctx));
+	const steps = publishSteps(computeNodeVersionYaml(ctx), hasRepositoryUrl(ctx));
 	const content = buildWorkflowYaml({
 		ci: ctx.config.ci,
 		name: "Publish",
@@ -1284,8 +1338,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1300,8 +1354,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1316,8 +1370,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1332,8 +1386,8 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1351,8 +1405,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1367,8 +1421,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1383,8 +1437,8 @@ const ROOT_DEV_DEPS = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1424,8 +1478,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1440,8 +1494,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1458,8 +1512,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1476,8 +1530,8 @@ function addReleaseDeps(deps, config) {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.0",
-				"commit-and-tag-version": "12.7.0",
-				"knip": "5.87.0",
+				"commit-and-tag-version": "12.7.1",
+				"knip": "6.0.3",
 				"lefthook": "2.1.4",
 				"oxfmt": "0.41.0",
 				"oxlint": "1.56.0",
@@ -1509,15 +1563,15 @@ async function generatePackageJson(ctx) {
 	}
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
-	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.37.0";
-	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
+	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.2";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.38.0";
+	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.10.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1532,8 +1586,8 @@ async function generatePackageJson(ctx) {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.0",
-		"commit-and-tag-version": "12.7.0",
-		"knip": "5.87.0",
+		"commit-and-tag-version": "12.7.1",
+		"knip": "6.0.3",
 		"lefthook": "2.1.4",
 		"oxfmt": "0.41.0",
 		"oxlint": "1.56.0",
@@ -1616,8 +1670,8 @@ async function generatePackageJson(ctx) {
 			"@changesets/cli": "2.30.0",
 			"@release-it/bumper": "7.0.5",
 			"@types/node": "24.12.0",
-			"commit-and-tag-version": "12.7.0",
-			"knip": "5.87.0",
+			"commit-and-tag-version": "12.7.1",
+			"knip": "6.0.3",
 			"lefthook": "2.1.4",
 			"oxfmt": "0.41.0",
 			"oxlint": "1.56.0",
@@ -2690,7 +2744,19 @@ function simpleReleaseCommand() {
 		"pnpm exec bst release:simple $FLAGS"
 	].join("\n");
 }
-function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
+function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	const releaseStep = { step: {
 		name: "Release",
 		env: {
@@ -2706,13 +2772,7 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
 	const dockerStep = { step: {
 		name: "Publish Docker images",
 		if: "success()",
-		env: {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
-			DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-			DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-		},
+		env: dockerPublishEnv(registryDerivable),
 		run: "pnpm exec bst docker:publish"
 	} };
 	return [
@@ -2721,10 +2781,10 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
 		...hasDocker ? [dockerStep] : []
 	];
 }
-function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker) {
+function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	switch (strategy) {
 		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker);
+		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 		default: return null;
 	}
 }
@@ -2745,7 +2805,8 @@ async function generateReleaseCi(ctx) {
 	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
 	const nodeVersionYaml = computeNodeVersionYaml(ctx);
 	const hasDocker = hasDockerPackages(ctx);
-	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker);
+	const registryDerivable = hasRepositoryUrl(ctx);
+	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 	if (!steps) return {
 		filePath,
 		action: "skipped",
@@ -3140,112 +3201,116 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push("# Migration Prompt");
-	sections.push("");
-	sections.push(`_Generated by \`@bensandee/tooling@0.37.0 repo:sync\` on ${timestamp}_`);
-	sections.push("");
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.38.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
-		sections.push("## Files changed");
-		sections.push("");
-		for (const r of changed) {
+		const items = changed.map((r) => {
 			const label = r.action === "archived" ? "archived" : r.action;
-			sections.push(`- \`${r.filePath}\` (${label}) — ${r.description}`);
-		}
-		sections.push("");
+			return `- \`${r.filePath}\` (${label}) — ${r.description}`;
+		}).join("\n");
+		sections.push(`## Files changed\n\n${items}\n`);
 	}
 	const tasks = [];
-	const legacyToRemove = detected.legacyConfigs.filter((legacy) => !(legacy.tool === "prettier" && config.formatter === "prettier"));
-	if (legacyToRemove.length > 0) {
-		tasks.push("### Remove legacy tooling");
-		tasks.push("");
-		for (const legacy of legacyToRemove) {
-			const replacement = {
-				eslint: "oxlint",
-				prettier: "oxfmt",
-				jest: "vitest",
-				webpack: "tsdown",
-				rollup: "tsdown"
-			}[legacy.tool];
-			tasks.push(`- Remove ${legacy.tool} config files (${legacy.files.map((f) => `\`${f}\``).join(", ")}). This project now uses **${replacement}**.`);
-			tasks.push(`  - Uninstall ${legacy.tool}-related packages from devDependencies`);
-			if (legacy.tool === "eslint") tasks.push("  - Migrate any custom ESLint rules that don't have oxlint equivalents");
-			if (legacy.tool === "jest") tasks.push("  - Migrate jest-specific test utilities (jest.mock, jest.fn) to vitest equivalents (vi.mock, vi.fn)");
-		}
-		tasks.push("");
+	addLegacyToolingTasks(tasks, config, detected);
+	addArchivedFileTasks(tasks, results);
+	addOxlintTasks(tasks, results, detected);
+	addMonorepoTasks(tasks, config, detected);
+	addTestGenerationTasks(tasks, results);
+	if (tasks.length > 0) {
+		sections.push(`## Migration tasks\n\n${tasks.join("\n")}`);
+		sections.push(`## Ground rules
+
+Prefer fixing root causes over suppressing issues:
+
+- **Lint errors**: fix the code, not disable comments
+- **Type errors**: add proper types, not \`any\` or \`@ts-expect-error\`
+- **Test failures**: fix the test or bug, don't skip/delete
+- **Knip findings**: remove unused code, don't add ignores
+
+It is OK to add new packages (e.g. \`zod\`, \`@bensandee/common\`) to resolve errors. Only suppress an issue with a comment explaining why the fix is not feasible.
+`);
 	}
+	sections.push(`## Verify
+
+Run \`pnpm check\` and fix any errors. This runs the full pipeline:
+build → typecheck → lint → test → format → knip
+
+When everything passes, run \`/init\` to generate a \`CLAUDE.md\` for this repository.
+`);
+	return sections.join("\n");
+}
+const LEGACY_REPLACEMENTS = {
+	eslint: "oxlint",
+	prettier: "oxfmt",
+	jest: "vitest",
+	webpack: "tsdown",
+	rollup: "tsdown"
+};
+function addLegacyToolingTasks(tasks, config, detected) {
+	const legacyToRemove = detected.legacyConfigs.filter((legacy) => !(legacy.tool === "prettier" && config.formatter === "prettier"));
+	if (legacyToRemove.length === 0) return;
+	const items = legacyToRemove.map((legacy) => {
+		const replacement = LEGACY_REPLACEMENTS[legacy.tool];
+		const files = legacy.files.map((f) => `\`${f}\``).join(", ");
+		const lines = [`- Remove ${legacy.tool} config files (${files}). This project now uses **${replacement}**.`, `  - Uninstall ${legacy.tool}-related packages from devDependencies`];
+		if (legacy.tool === "eslint") lines.push("  - Migrate any custom ESLint rules that don't have oxlint equivalents");
+		if (legacy.tool === "jest") lines.push("  - Migrate jest-specific test utilities (jest.mock, jest.fn) to vitest equivalents (vi.mock, vi.fn)");
+		return lines.join("\n");
+	});
+	tasks.push(`### Remove legacy tooling\n\n${items.join("\n")}\n`);
+}
+function addArchivedFileTasks(tasks, results) {
 	const archived = results.filter((r) => r.action === "archived");
-	if (archived.length > 0) {
-		tasks.push("### Review archived files");
-		tasks.push("");
-		tasks.push("The originals have been saved to `.tooling-archived/`. For each, diff the old version against the new one and port any capabilities the new file lacks:");
-		tasks.push("");
-		for (const r of archived) tasks.push(`- \`${r.filePath}\` → \`.tooling-archived/${r.filePath}\``);
-		tasks.push("");
-		tasks.push("If the project previously used `husky` and `lint-staged`, remove them from `devDependencies`. Delete `.tooling-archived/` when done.");
-		tasks.push("");
-	}
-	const oxlintWasSkipped = results.find((r) => r.filePath === "oxlint.config.ts")?.action === "skipped";
+	if (archived.length === 0) return;
+	const items = archived.map((r) => `- \`${r.filePath}\` → \`.tooling-archived/${r.filePath}\``).join("\n");
+	tasks.push(`### Review archived files
+
+The originals have been saved to \`.tooling-archived/\`. For each, diff the old version against the new one and port any capabilities the new file lacks:
+
+${items}
+
+Delete \`.tooling-archived/\` when done.
+`);
+}
+function addOxlintTasks(tasks, results, detected) {
 	if (detected.hasLegacyOxlintJson) {
-		tasks.push("### Migrate .oxlintrc.json to oxlint.config.ts");
-		tasks.push("");
-		tasks.push("Compare `.oxlintrc.json` rules against `@bensandee/config/oxlint/recommended`. Port any custom rules/overrides into `oxlint.config.ts`, then delete `.oxlintrc.json`.");
-		tasks.push("");
-	} else if (oxlintWasSkipped && detected.hasOxlintConfig) {
-		tasks.push("### Verify oxlint.config.ts extends recommended rules");
-		tasks.push("");
-		tasks.push("Ensure `oxlint.config.ts` imports and extends `@bensandee/config/oxlint/recommended`:");
-		tasks.push("");
-		tasks.push("```ts");
-		tasks.push("import recommended from \"@bensandee/config/oxlint/recommended\";");
-		tasks.push("import { defineConfig } from \"oxlint\";");
-		tasks.push("");
-		tasks.push("export default defineConfig({ extends: [recommended] });");
-		tasks.push("```");
-		tasks.push("");
-	}
-	if (config.structure === "monorepo" && !detected.hasPnpmWorkspace) {
-		tasks.push("### Migrate to monorepo structure");
-		tasks.push("");
-		tasks.push("This project was converted to a monorepo. Complete the migration:");
-		tasks.push("");
-		tasks.push("1. Move existing source into `packages/<name>/`");
-		tasks.push("2. Split root `package.json` into workspace manifest + package-level `package.json`");
-		tasks.push("3. Move `tsconfig.json` into the package, add project references to root");
-		tasks.push("4. Create a package-level `tsdown.config.ts`");
-		tasks.push("5. Update import paths and build scripts");
-		tasks.push("");
-	}
-	if (results.some((r) => r.filePath === "test/example.test.ts" && r.action === "created")) {
-		tasks.push("### Generate tests");
-		tasks.push("");
-		tasks.push("A starter test was created at `test/example.test.ts`. Review `src/` and create additional tests covering exported functions and edge cases.");
-		tasks.push("");
+		tasks.push(`### Migrate .oxlintrc.json to oxlint.config.ts
+
+Compare \`.oxlintrc.json\` rules against \`@bensandee/config/oxlint/recommended\`. Port any custom rules/overrides into \`oxlint.config.ts\`, then delete \`.oxlintrc.json\`.
+`);
+		return;
 	}
-	if (tasks.length > 0) {
-		sections.push("## Migration tasks");
-		sections.push("");
-		sections.push(...tasks);
-		sections.push("## Ground rules");
-		sections.push("");
-		sections.push("Prefer fixing root causes over suppressing issues:");
-		sections.push("");
-		sections.push("- **Lint errors**: fix the code, not disable comments");
-		sections.push("- **Type errors**: add proper types, not `any` or `@ts-expect-error`");
-		sections.push("- **Test failures**: fix the test or bug, don't skip/delete");
-		sections.push("- **Knip findings**: remove unused code, don't add ignores");
-		sections.push("");
-		sections.push("It is OK to add new packages (e.g. `zod`, `@bensandee/common`) to resolve errors. Only suppress an issue with a comment explaining why the fix is not feasible.");
-		sections.push("");
-	}
-	sections.push("## Verify");
-	sections.push("");
-	sections.push("Run `pnpm check` and fix any errors. This runs the full pipeline:");
-	sections.push("build → typecheck → lint → test → format → knip");
-	sections.push("");
-	sections.push("When everything passes, run `/init` to generate a `CLAUDE.md` for this repository.");
-	sections.push("");
-	return sections.join("\n");
+	if (results.find((r) => r.filePath === "oxlint.config.ts")?.action === "skipped" && detected.hasOxlintConfig && !detected.oxlintExtendsRecommended) tasks.push(`### Verify oxlint.config.ts extends recommended rules
+
+Ensure \`oxlint.config.ts\` imports and extends \`@bensandee/config/oxlint/recommended\`:
+
+\`\`\`ts
+import recommended from "@bensandee/config/oxlint/recommended";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({ extends: [recommended] });
+\`\`\`
+`);
+}
+function addMonorepoTasks(tasks, config, detected) {
+	if (config.structure !== "monorepo" || detected.hasPnpmWorkspace) return;
+	tasks.push(`### Migrate to monorepo structure
+
+This project was converted to a monorepo. Complete the migration:
+
+1. Move existing source into \`packages/<name>/\`
+2. Split root \`package.json\` into workspace manifest + package-level \`package.json\`
+3. Move \`tsconfig.json\` into the package, add project references to root
+4. Create a package-level \`tsdown.config.ts\`
+5. Update import paths and build scripts
+`);
+}
+function addTestGenerationTasks(tasks, results) {
+	if (!results.some((r) => r.filePath === "test/example.test.ts" && r.action === "created")) return;
+	tasks.push(`### Generate tests
+
+A starter test was created at \`test/example.test.ts\`. Review \`src/\` and create additional tests covering exported functions and edge cases.
+`);
 }
 //#endregion
 //#region src/commands/repo-init.ts
@@ -3464,15 +3529,16 @@ function lineDiff(oldText, newText) {
 /** Create an executor that runs real commands, fetches, and reads the filesystem. */
 function createRealExecutor() {
 	return {
-		exec(command, options) {
+		exec(file, args, options) {
 			try {
 				return {
-					stdout: execSync(command, {
+					stdout: execFileSync(file, args, {
 						cwd: options?.cwd,
 						env: {
 							...process.env,
 							...options?.env
 						},
+						input: options?.input,
 						encoding: "utf-8",
 						stdio: [
 							"pipe",
@@ -3496,8 +3562,8 @@ function createRealExecutor() {
 				};
 			}
 		},
-		execInherit(command, options) {
-			execSync(command, {
+		execInherit(file, args, options) {
+			execFileSync(file, args, {
 				cwd: options?.cwd,
 				env: options?.env ? {
 					...process.env,
@@ -3554,6 +3620,19 @@ function createRealExecutor() {
 		}
 	};
 }
+/**
+* Compute sliding version tags from a semver version string.
+* For "1.2.3" returns ["v1", "v1.2", "latest"]. Strips prerelease suffixes.
+*/
+function computeSlidingTags(version) {
+	const parts = (version.split("-")[0] ?? version).split(".");
+	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
+	return [
+		`v${parts[0]}`,
+		`v${parts[0]}.${parts[1]}`,
+		"latest"
+	];
+}
 /** Parse "New tag:" lines from changeset publish output. */
 function parseNewTags(output) {
 	const tags = [];
@@ -3595,7 +3674,7 @@ const RETRY_BASE_DELAY_MS = 1e3;
 async function responseBodyText(res) {
 	try {
 		const text = await res.text();
-		return text.length > 500 ? text.slice(0, 500) + "…" : text;
+		return redact(text.length > 500 ? text.slice(0, 500) + "…" : text);
 	} catch {
 		return "(could not read response body)";
 	}
@@ -3822,19 +3901,23 @@ async function runVersionMode(executor, config) {
 			debug(config, "Temporarily disabled changeset commit:true");
 		}
 	}
-	const versionResult = executor.exec("pnpm changeset version", { cwd: config.cwd });
+	const versionResult = executor.exec("pnpm", ["changeset", "version"], { cwd: config.cwd });
 	debugExec(config, "pnpm changeset version", versionResult);
 	if (originalConfig) executor.writeFile(changesetConfigPath, originalConfig);
 	if (versionResult.exitCode !== 0) throw new FatalError(`pnpm changeset version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr}`);
-	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm install --no-frozen-lockfile", { cwd: config.cwd }));
+	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm", ["install", "--no-frozen-lockfile"], { cwd: config.cwd }));
 	const { title, body } = buildPrContent(executor, config.cwd, packagesBefore);
 	debug(config, `PR title: ${title}`);
-	const addResult = executor.exec("git add -A", { cwd: config.cwd });
+	const addResult = executor.exec("git", ["add", "-A"], { cwd: config.cwd });
 	if (addResult.exitCode !== 0) throw new FatalError(`git add failed: ${addResult.stderr || addResult.stdout}`);
 	const remainingChangesets = executor.listChangesetFiles(config.cwd);
 	if (remainingChangesets.length > 0) log.warn(`Changeset files still present after versioning: ${remainingChangesets.join(", ")}`);
 	debug(config, `Changeset files after versioning: ${remainingChangesets.length > 0 ? remainingChangesets.join(", ") : "(none — all consumed)"}`);
-	const commitResult = executor.exec("git commit -m \"chore: version packages\"", { cwd: config.cwd });
+	const commitResult = executor.exec("git", [
+		"commit",
+		"-m",
+		"chore: version packages"
+	], { cwd: config.cwd });
 	debugExec(config, "git commit", commitResult);
 	if (commitResult.exitCode !== 0) {
 		log.info("Nothing to commit after versioning");
@@ -3850,7 +3933,12 @@ async function runVersionMode(executor, config) {
 			pr: "none"
 		};
 	}
-	const pushResult = executor.exec(`git push origin "HEAD:refs/heads/${BRANCH}" --force`, { cwd: config.cwd });
+	const pushResult = executor.exec("git", [
+		"push",
+		"origin",
+		`HEAD:refs/heads/${BRANCH}`,
+		"--force"
+	], { cwd: config.cwd });
 	debugExec(config, "git push", pushResult);
 	if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 	const conn = {
@@ -3888,14 +3976,18 @@ async function runVersionMode(executor, config) {
 /** Mode 2: publish to npm, push tags, and create Forgejo releases. */
 async function runPublishMode(executor, config) {
 	log.info("No changesets — publishing packages");
-	const publishResult = executor.exec("pnpm changeset publish", { cwd: config.cwd });
+	const publishResult = executor.exec("pnpm", ["changeset", "publish"], { cwd: config.cwd });
 	debugExec(config, "pnpm changeset publish", publishResult);
 	if (publishResult.exitCode !== 0) throw new FatalError(`pnpm changeset publish failed (exit code ${String(publishResult.exitCode)}):\n${publishResult.stderr}`);
 	const stdoutTags = parseNewTags(publishResult.stdout + "\n" + publishResult.stderr);
 	debug(config, `Tags from publish stdout: ${stdoutTags.length > 0 ? stdoutTags.join(", ") : "(none)"}`);
 	const expectedTags = computeExpectedTags(executor.listWorkspacePackages(config.cwd));
 	debug(config, `Expected tags from workspace packages: ${expectedTags.length > 0 ? expectedTags.join(", ") : "(none)"}`);
-	const remoteTags = parseRemoteTags(executor.exec("git ls-remote --tags origin", { cwd: config.cwd }).stdout);
+	const remoteTags = parseRemoteTags(executor.exec("git", [
+		"ls-remote",
+		"--tags",
+		"origin"
+	], { cwd: config.cwd }).stdout);
 	debug(config, `Remote tags: ${remoteTags.length > 0 ? remoteTags.join(", ") : "(none)"}`);
 	const remoteSet = new Set(remoteTags);
 	const tagsToPush = reconcileTags(expectedTags, remoteTags, stdoutTags);
@@ -3929,11 +4021,19 @@ async function runPublishMode(executor, config) {
 	const errors = [];
 	for (const tag of allTags) try {
 		if (!remoteSet.has(tag)) {
-			if (executor.exec(`git tag -l ${JSON.stringify(tag)}`, { cwd: config.cwd }).stdout.trim() === "") {
-				const tagResult = executor.exec(`git tag ${JSON.stringify(tag)}`, { cwd: config.cwd });
+			if (executor.exec("git", [
+				"tag",
+				"-l",
+				tag
+			], { cwd: config.cwd }).stdout.trim() === "") {
+				const tagResult = executor.exec("git", ["tag", tag], { cwd: config.cwd });
 				if (tagResult.exitCode !== 0) throw new FatalError(`Failed to create tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
 			}
-			const pushTagResult = executor.exec(`git push origin refs/tags/${tag}`, { cwd: config.cwd });
+			const pushTagResult = executor.exec("git", [
+				"push",
+				"origin",
+				`refs/tags/${tag}`
+			], { cwd: config.cwd });
 			if (pushTagResult.exitCode !== 0) throw new FatalError(`Failed to push tag ${tag}: ${pushTagResult.stderr || pushTagResult.stdout}`);
 		}
 		if (await ensureRelease(executor, conn, tag) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
@@ -3946,6 +4046,31 @@ async function runPublishMode(executor, config) {
 		log.warn(`Failed to process ${tag}: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	if (errors.length > 0) throw new TransientError(`Failed to create releases for: ${errors.map((e) => e.tag).join(", ")}`);
+	const slidingTags = allTags.flatMap((t) => {
+		const atIndex = t.lastIndexOf("@");
+		if (atIndex <= 0) return [];
+		const name = t.slice(0, atIndex);
+		return computeSlidingTags(t.slice(atIndex + 1)).map((suffix) => `${name}@${suffix}`);
+	});
+	if (slidingTags.length > 0) {
+		for (const tag of slidingTags) {
+			const tagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				tag
+			], { cwd: config.cwd });
+			if (tagResult.exitCode !== 0) log.warn(`Warning: Failed to create sliding tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
+		}
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags.map((t) => `refs/tags/${t}`),
+			"--force"
+		], { cwd: config.cwd });
+		debugExec(config, "force-push sliding tags", forcePushResult);
+		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
+		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
+	}
 	return {
 		mode: "publish",
 		tags: allTags
@@ -4035,15 +4160,28 @@ function parseGitUrl(urlStr) {
 function configureGitAuth(executor, conn, cwd) {
 	const host = conn.serverUrl.replace(/^https?:\/\//, "");
 	const authUrl = `https://x-access-token:${conn.token}@${host}/${conn.repository}`;
-	executor.exec(`git remote set-url origin ${authUrl}`, { cwd });
+	executor.exec("git", [
+		"remote",
+		"set-url",
+		"origin",
+		authUrl
+	], { cwd });
 }
 /** Configure git user.name and user.email for CI bot commits. */
 function configureGitIdentity(executor, platform, cwd) {
 	const isGitHub = platform === "github";
 	const name = isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]";
 	const email = isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost";
-	executor.exec(`git config user.name "${name}"`, { cwd });
-	executor.exec(`git config user.email "${email}"`, { cwd });
+	executor.exec("git", [
+		"config",
+		"user.name",
+		name
+	], { cwd });
+	executor.exec("git", [
+		"config",
+		"user.email",
+		email
+	], { cwd });
 }
 //#endregion
 //#region src/commands/release-changesets.ts
@@ -4084,7 +4222,11 @@ function buildReleaseConfig(flags) {
 function getCurrentBranch(executor, cwd) {
 	const ref = process.env["GITHUB_REF"];
 	if (ref?.startsWith("refs/heads/")) return ref.slice(11);
-	return executor.exec("git rev-parse --abbrev-ref HEAD", { cwd }).stdout.trim();
+	return executor.exec("git", [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], { cwd }).stdout.trim();
 }
 /** Core release logic — testable with a mock executor. */
 async function runRelease(config, executor) {
@@ -4155,9 +4297,15 @@ async function triggerForgejo(conn, ref, inputs) {
 }
 function triggerGitHub(ref, inputs) {
 	const executor = createRealExecutor();
-	const inputFlags = Object.entries(inputs).map(([k, v]) => `-f ${k}=${v}`).join(" ");
-	const cmd = `gh workflow run release.yml --ref ${ref}${inputFlags ? ` ${inputFlags}` : ""}`;
-	const result = executor.exec(cmd, { cwd: process.cwd() });
+	const inputFlags = Object.entries(inputs).flatMap(([k, v]) => ["-f", `${k}=${v}`]);
+	const result = executor.exec("gh", [
+		"workflow",
+		"run",
+		"release.yml",
+		"--ref",
+		ref,
+		...inputFlags
+	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to trigger GitHub workflow: ${result.stderr || result.stdout || "unknown error"}`);
 	log.info(`Triggered release workflow on GitHub (ref: ${ref})`);
 }
@@ -4222,34 +4370,39 @@ async function mergeForgejo(conn, dryRun) {
 function mergeGitHub(dryRun) {
 	const executor = createRealExecutor();
 	if (dryRun) {
-		const prNum = executor.exec(`gh pr view ${HEAD_BRANCH} --json number --jq .number`, { cwd: process.cwd() }).stdout.trim();
+		const prNum = executor.exec("gh", [
+			"pr",
+			"view",
+			HEAD_BRANCH,
+			"--json",
+			"number",
+			"--jq",
+			".number"
+		], { cwd: process.cwd() }).stdout.trim();
 		if (!prNum) throw new FatalError(`No open PR found for branch ${HEAD_BRANCH}`);
 		log.info(`[dry-run] Would merge PR #${prNum} and delete branch ${HEAD_BRANCH}`);
 		return;
 	}
-	const result = executor.exec(`gh pr merge ${HEAD_BRANCH} --merge --delete-branch`, { cwd: process.cwd() });
+	const result = executor.exec("gh", [
+		"pr",
+		"merge",
+		HEAD_BRANCH,
+		"--merge",
+		"--delete-branch"
+	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to merge PR: ${result.stderr || result.stdout || "unknown error"}`);
 	log.info(`Merged changesets PR and deleted branch ${HEAD_BRANCH}`);
 }
 //#endregion
 //#region src/release/simple.ts
-/**
-* Compute sliding version tags from a semver version string.
-* For "1.2.3" returns ["v1", "v1.2"]. Strips prerelease suffixes.
-*/
-function computeSlidingTags(version) {
-	const parts = (version.split("-")[0] ?? version).split(".");
-	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
-	return [`v${parts[0]}`, `v${parts[0]}.${parts[1]}`];
-}
-/** Build the commit-and-tag-version command with appropriate flags. */
-function buildCommand(config) {
-	const args = ["pnpm exec commit-and-tag-version"];
+/** Build the commit-and-tag-version args. */
+function buildArgs(config) {
+	const args = ["exec", "commit-and-tag-version"];
 	if (config.dryRun) args.push("--dry-run");
 	if (config.firstRelease) args.push("--first-release");
-	if (config.releaseAs) args.push(`--release-as ${config.releaseAs}`);
-	if (config.prerelease) args.push(`--prerelease ${config.prerelease}`);
-	return args.join(" ");
+	if (config.releaseAs) args.push("--release-as", config.releaseAs);
+	if (config.prerelease) args.push("--prerelease", config.prerelease);
+	return args;
 }
 /** Read the current version from package.json. */
 function readVersion(executor, cwd) {
@@ -4266,14 +4419,18 @@ function platformType(config) {
 /** Run the full commit-and-tag-version release flow. */
 async function runSimpleRelease(executor, config) {
 	configureGitIdentity(executor, platformType(config), config.cwd);
-	const command = buildCommand(config);
-	log.info(`Running: ${command}`);
-	const versionResult = executor.exec(command, { cwd: config.cwd });
+	const args = buildArgs(config);
+	log.info(`Running: pnpm ${args.join(" ")}`);
+	const versionResult = executor.exec("pnpm", args, { cwd: config.cwd });
 	debugExec(config, "commit-and-tag-version", versionResult);
 	if (versionResult.exitCode !== 0) throw new FatalError(`commit-and-tag-version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr || versionResult.stdout}`);
 	const version = readVersion(executor, config.cwd);
 	debug(config, `New version: ${version}`);
-	const tagResult = executor.exec("git describe --tags --abbrev=0", { cwd: config.cwd });
+	const tagResult = executor.exec("git", [
+		"describe",
+		"--tags",
+		"--abbrev=0"
+	], { cwd: config.cwd });
 	debugExec(config, "git describe", tagResult);
 	const tag = tagResult.stdout.trim();
 	if (!tag) throw new FatalError("Could not determine the new tag from git describe");
@@ -4297,9 +4454,18 @@ async function runSimpleRelease(executor, config) {
 			configureGitAuth(executor, config.platform.conn, config.cwd);
 			debug(config, "Configured git remote with RELEASE_TOKEN auth");
 		}
-		const branch = executor.exec("git rev-parse --abbrev-ref HEAD", { cwd: config.cwd }).stdout.trim() || "main";
+		const branch = executor.exec("git", [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		], { cwd: config.cwd }).stdout.trim() || "main";
 		debug(config, `Pushing to origin/${branch}`);
-		const pushResult = executor.exec(`git push --follow-tags origin ${branch}`, { cwd: config.cwd });
+		const pushResult = executor.exec("git", [
+			"push",
+			"--follow-tags",
+			"origin",
+			branch
+		], { cwd: config.cwd });
 		debugExec(config, "git push", pushResult);
 		if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 		pushed = true;
@@ -4309,10 +4475,19 @@ async function runSimpleRelease(executor, config) {
 	if (!config.noSlidingTags && pushed) {
 		slidingTags = computeSlidingTags(version);
 		for (const slidingTag of slidingTags) {
-			const slidingTagResult = executor.exec(`git tag -f ${slidingTag}`, { cwd: config.cwd });
+			const slidingTagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				slidingTag
+			], { cwd: config.cwd });
 			if (slidingTagResult.exitCode !== 0) throw new FatalError(`Failed to create sliding tag ${slidingTag}: ${slidingTagResult.stderr || slidingTagResult.stdout}`);
 		}
-		const forcePushResult = executor.exec(`git push origin ${slidingTags.join(" ")} --force`, { cwd: config.cwd });
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags,
+			"--force"
+		], { cwd: config.cwd });
 		debugExec(config, "force-push sliding tags", forcePushResult);
 		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
 		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
@@ -4337,7 +4512,12 @@ async function createPlatformRelease(executor, config, tag) {
 		log.info(`Created Forgejo release for ${tag}`);
 		return true;
 	}
-	const ghResult = executor.exec(`gh release create ${tag} --generate-notes`, { cwd: config.cwd });
+	const ghResult = executor.exec("gh", [
+		"release",
+		"create",
+		tag,
+		"--generate-notes"
+	], { cwd: config.cwd });
 	debugExec(config, "gh release create", ghResult);
 	if (ghResult.exitCode !== 0) {
 		log.warn(`Warning: Failed to create GitHub release: ${ghResult.stderr || ghResult.stdout}`);
@@ -4575,6 +4755,45 @@ function requireEnv(name) {
 	if (!value) throw new FatalError(`Missing required environment variable: ${name}`);
 	return value;
 }
+/**
+* Derive the registry host from a repository URL hostname.
+* GitHub uses ghcr.io; all other hosts (Forgejo, GitLab, etc.) use the hostname directly.
+*/
+function registryHostFromHostname(hostname) {
+	return hostname === "github.com" ? "ghcr.io" : hostname;
+}
+/**
+* Resolve docker registry config using a fallback chain:
+* 1. Environment variables (DOCKER_REGISTRY_HOST / DOCKER_REGISTRY_NAMESPACE)
+* 2. .tooling.json registryHost / registryNamespace fields
+* 3. Derived from package.json repository URL
+*/
+function resolveRegistryConfig(cwd) {
+	const envHost = process.env["DOCKER_REGISTRY_HOST"];
+	const envNamespace = process.env["DOCKER_REGISTRY_NAMESPACE"];
+	if (envHost && envNamespace) return {
+		registryHost: envHost,
+		registryNamespace: envNamespace
+	};
+	const toolingConfig = loadToolingConfig(cwd);
+	const toolingHost = toolingConfig?.registryHost;
+	const toolingNamespace = toolingConfig?.registryNamespace;
+	if (toolingHost && toolingNamespace) return {
+		registryHost: envHost ?? toolingHost,
+		registryNamespace: envNamespace ?? toolingNamespace
+	};
+	const parsed = parseRepositoryUrl(cwd);
+	if (parsed) {
+		const derivedHost = registryHostFromHostname(parsed.hostname);
+		const owner = parsed.repository.split("/")[0];
+		const host = envHost ?? toolingHost ?? derivedHost;
+		return {
+			registryHost: host,
+			registryNamespace: envNamespace ?? toolingNamespace ?? `${host}/${owner}`
+		};
+	}
+	throw new FatalError("Could not determine docker registry. Set DOCKER_REGISTRY_HOST and DOCKER_REGISTRY_NAMESPACE, or add registryHost/registryNamespace to .tooling.json, or ensure package.json has a repository URL.");
+}
 const publishDockerCommand = defineCommand({
 	meta: {
 		name: "docker:publish",
@@ -4591,10 +4810,12 @@ const publishDockerCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
+		const cwd = process.cwd();
+		const { registryHost, registryNamespace } = resolveRegistryConfig(cwd);
 		const config = {
-			cwd: process.cwd(),
-			registryHost: requireEnv("DOCKER_REGISTRY_HOST"),
-			registryNamespace: requireEnv("DOCKER_REGISTRY_NAMESPACE"),
+			cwd,
+			registryHost,
+			registryNamespace,
 			username: requireEnv("DOCKER_USERNAME"),
 			password: requireEnv("DOCKER_PASSWORD"),
 			dryRun: args["dry-run"] === true,
@@ -4869,8 +5090,8 @@ function toHttpHealthChecks(checks) {
 }
 /** Write the generated check overlay to a temp file. Returns the absolute path. */
 function writeTempOverlay(content) {
-	const name = `tooling-check-overlay-${process.pid}.yaml`;
-	const filePath = path.join(tmpdir(), name);
+	const dir = mkdtempSync(path.join(tmpdir(), "tooling-check-"));
+	const filePath = path.join(dir, "overlay.yaml");
 	writeFileSync(filePath, content, "utf-8");
 	return filePath;
 }
@@ -4946,7 +5167,7 @@ const dockerCheckCommand = defineCommand({
 			if (!result.success) throw new FatalError(`Check failed (${result.reason}): ${result.message}`);
 		} finally {
 			try {
-				unlinkSync(tempOverlayPath);
+				rmSync(path.dirname(tempOverlayPath), { recursive: true });
 			} catch (_error) {}
 		}
 	}
@@ -4956,7 +5177,7 @@ const dockerCheckCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.37.0",
+		version: "0.38.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -4972,7 +5193,7 @@ const main = defineCommand({
 		"docker:check": dockerCheckCommand
 	}
 });
-console.log(`@bensandee/tooling v0.37.0`);
+console.log(`@bensandee/tooling v0.38.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);