@brainervirus/workit-core 0.6.0 → 0.7.0

package/src/core/vcs-config.ts

@@ -3,7 +3,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { configDir } from "./config";
 import { resolveWorkspace } from "./workspaces";
-
+import { resolveBranchPolicyFor } from "./branch";
 // Ports of scripts/vcs/config.sh + verify-token.sh + token-create-urls.sh + merged-style.sh.
 // Token never printed.
 
@@ -14,22 +14,55 @@ export const vcsConfigPath = (): string =>
 
 const workspacesPath = (): string => path.join(configDir(), "workspaces.json");
 
-const vcsCwd = (cwd?: string): string => process.env.WORKFLOW_WORKSPACE_ROOT ?? cwd ?? process.cwd();
+const vcsCwd = (cwd?: string): string =>
+  process.env.WORKFLOW_WORKSPACE_ROOT ?? cwd ?? process.cwd();
 
-function readVcsJson(): { config: Record<string, any>; path: string; ok: boolean } {
-  const cfgPath = vcsConfigPath();
-  let config: Record<string, any> = {};
-  let ok = false;
-  if (fs.existsSync(cfgPath)) {
-    try {
-      const parsed = JSON.parse(fs.readFileSync(cfgPath, "utf8")) as unknown;
-      if (parsed && typeof parsed === "object") {
-        config = parsed as Record<string, any>;
-        ok = true;
-      }
-    } catch { /* missing or invalid */ }
+// RL-03b: the origin remote is the ground truth for PR creation. A stale global
+// provider (e.g. gitlab from another repo) must not drive glab on a
+// github.com-hosted checkout. Recognized hosts only — custom/self-hosted
+// remotes keep the configured provider, and a missing origin is untouched.
+const remoteProvider = (cwd: string): string | null => {
+  const r = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  if (r.status !== 0) return null;
+  const url = (r.stdout ?? "").trim();
+  if (/github\.com[:/]/.test(url)) return "github";
+  if (/gitlab\.com[:/]/.test(url)) return "gitlab";
+  return null;
+};
+
+// RL-01: typed vcs.json reader. Missing is a legitimate unconfigured state;
+// malformed (parse failure or a non-object) is reported with the exact path so
+// risky consumers stop instead of silently reading defaults.
+export type VcsConfigResult = {
+  status: "missing" | "valid" | "malformed";
+  path: string;
+  config: Record<string, any>;
+  error?: string;
+};
+
+export const readVcsConfig = (): VcsConfigResult => {
+  const file = vcsConfigPath();
+  let raw: string;
+  try {
+    raw = fs.readFileSync(file, "utf8");
+  } catch {
+    return { status: "missing", path: file, config: {} };
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, config: {}, error: `${file} is not valid JSON` };
   }
-  return { config, path: cfgPath, ok };
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    return { status: "valid", path: file, config: parsed as Record<string, any> };
+  }
+  return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
+};
+
+function readVcsJson(): { config: Record<string, any>; path: string; ok: boolean } {
+  const { status, path: cfgPath, config } = readVcsConfig();
+  return { config, path: cfgPath, ok: status === "valid" };
 }
 
 /** Port of scripts/vcs/config.sh — mode: load | summary | resolve. */
@@ -38,21 +71,50 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   const wsVcs = (ws?.vcs ?? {}) as Record<string, any>;
   const wsYt = (ws?.youtrack ?? {}) as Record<string, any>;
   const wsIssues = (ws?.issues ?? {}) as Record<string, any>;
-  const { config: cfg, path: cfgPath, ok: cfgOk } = readVcsJson();
+  const { status: cfgStatus, path: cfgPath, config: cfg, error: cfgError } = readVcsConfig();
 
-  const provider = String(wsVcs.provider ?? cfg.provider ?? "gitlab").toLowerCase();
-  const defaultTarget = String(wsVcs.defaultTargetBranch ?? cfg.defaultTargetBranch ?? "develop");
+  // Explicit workspace vcs.provider is the user's per-repo intent and wins;
+  // otherwise, with a determinate repo root (explicit cwd or host-provided
+  // WORKFLOW_WORKSPACE_ROOT), the origin remote is authoritative over the
+  // global default (RL-03b). Ambient process.cwd() callers keep the legacy
+  // config-only contract (CA-06 parity), so a stale global default cannot
+  // contaminate host-agnostic reads.
+  const root = vcsCwd(cwd);
+  const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
+  const provider = String(
+    wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? "gitlab",
+  ).toLowerCase();
+  // CA-05: workspace/global explicit target wins; when unset the resolved
+  // branch-policy preset supplies the default (gitflow->develop,
+  // github-flow->main, trunk-based->master, custom->develop). Shared by load
+  // and resolve so both surfaces stay consistent.
+  // CA-09: the one resolver wrapper — same policy resolution every consumer
+  // uses, so the tightened gate in branch-policy-resolver.test.ts stays green.
+  const defaultTarget = String(
+    wsVcs.defaultTargetBranch ??
+      cfg.defaultTargetBranch ??
+      resolveBranchPolicyFor(root).defaultTargetBranch ??
+      "develop",
+  );
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   // github issues path only when BOTH providers are github (mirrors WorkspaceConfig.issues).
   let issuesProvider: string | null = null;
   let linkOnPr: boolean | null = null;
-  if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
+  if (
+    provider === "github" &&
+    typeof wsIssues.provider === "string" &&
+    wsIssues.provider.toLowerCase() === "github"
+  ) {
     issuesProvider = "github";
     linkOnPr = typeof wsIssues.link_on_pr === "boolean" ? wsIssues.link_on_pr : null;
   }
 
   if (mode === "resolve") {
+    // RL-01: malformed vcs.json blocks resolution with an exact-path diagnostic
+    // instead of silently resolving defaults; a missing file is still a
+    // legitimate unconfigured state that falls back to defaults.
+    if (cfgStatus === "malformed") return { ok: false, error: cfgError, configPath: cfgPath };
     return {
       ok: true,
       workspace_name: ws?.name ?? null,
@@ -65,7 +127,12 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
     };
   }
 
-  if (!cfgOk) return { ok: false, error: "missing or invalid vcs.json" };
+  if (cfgStatus === "malformed") {
+    return { ok: false, error: cfgError, configPath: cfgPath };
+  }
+  if (cfgStatus === "missing") {
+    return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
+  }
 
   const prov = (cfg[provider] ?? {}) as Record<string, any>;
   const tokenFile = String(prov.tokenFile ?? path.join(configDir(), `${provider}.token`));
@@ -73,7 +140,8 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   let tokenOk = false;
   if (fs.existsSync(tokenPath)) {
     const token = fs.readFileSync(tokenPath, "utf8").trim();
-    const placeholder = !token || token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER);
+    const placeholder =
+      !token || token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER);
     tokenOk = !placeholder;
   }
 
@@ -93,7 +161,10 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
     link_on_pr: linkOnPr,
   };
   if (provider === "gitlab") {
-    out.gitlab = { host: prov.host ?? "gitlab.com", apiUrl: prov.apiUrl ?? "https://gitlab.com/api/v4" };
+    out.gitlab = {
+      host: prov.host ?? "gitlab.com",
+      apiUrl: prov.apiUrl ?? "https://gitlab.com/api/v4",
+    };
   } else if (provider === "github") {
     out.github = { host: prov.host ?? "github.com" };
   }
@@ -102,7 +173,7 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
 }
 
 /** Port of scripts/vcs/verify-token.sh — soft-fail JSON out, always exit 0. */
-export function vcsVerifyToken(): Record<string, any> {
+export async function vcsVerifyToken(): Promise<Record<string, any>> {
   const cfg = vcsConfig("load");
   if (!cfg.ok) return { ok: false, error: cfg.error ?? "vcs config not ready" };
   const provider = cfg.provider as string;
@@ -118,22 +189,49 @@ export function vcsVerifyToken(): Record<string, any> {
 
   if (provider === "gitlab") {
     const host = (cfg.gitlab as Record<string, any>)?.host ?? "gitlab.com";
-    const api = ((cfg.gitlab as Record<string, any>)?.apiUrl ?? `https://${host}/api/v4`).replace(/\/+$/, "");
-    const result = spawnSync("curl", ["-fsS", "-H", `PRIVATE-TOKEN: ${token}`, `${api}/user`], { encoding: "utf8" });
-    if (result.status !== 0) {
-      return { ok: false, provider, error: "GitLab API rejected token", detail: (result.stderr ?? result.stdout ?? "").slice(0, 200) };
-    }
+    const api = ((cfg.gitlab as Record<string, any>)?.apiUrl ?? `https://${host}/api/v4`).replace(
+      /\/+$/,
+      "",
+    );
+    let user: Record<string, any>;
     try {
-      const user = JSON.parse(result.stdout ?? "") as Record<string, any>;
-      return { ok: true, provider, username: user.username ?? user.login, name: user.name };
-    } catch {
-      return { ok: false, provider, error: "invalid JSON from GitLab /user" };
+      const res = await fetch(`${api}/user`, {
+        headers: { "PRIVATE-TOKEN": token },
+      });
+      if (!res.ok) {
+        return {
+          ok: false,
+          provider,
+          error: "GitLab API rejected token",
+          detail: (await res.text()).slice(0, 200),
+        };
+      }
+      user = JSON.parse(await res.text()) as Record<string, any>;
+    } catch (err) {
+      if (err instanceof SyntaxError) {
+        return { ok: false, provider, error: "invalid JSON from GitLab /user" };
+      }
+      return {
+        ok: false,
+        provider,
+        error: "GitLab API rejected token",
+        detail: (err instanceof Error ? err.message : "network error").slice(0, 200),
+      };
     }
+    return { ok: true, provider, username: user.username ?? user.login, name: user.name };
   }
   if (provider === "github") {
-    const result = spawnSync("gh", ["api", "user"], { encoding: "utf8", env: { ...process.env, GH_TOKEN: token } });
+    const result = spawnSync("gh", ["api", "user"], {
+      encoding: "utf8",
+      env: { ...process.env, GH_TOKEN: token },
+    });
     if (result.status !== 0) {
-      return { ok: false, provider, error: "GitHub API rejected token", detail: (result.stderr ?? result.stdout ?? "").slice(0, 200) };
+      return {
+        ok: false,
+        provider,
+        error: "GitHub API rejected token",
+        detail: (result.stderr ?? result.stdout ?? "").slice(0, 200),
+      };
     }
     try {
       const user = JSON.parse(result.stdout ?? "") as Record<string, any>;
@@ -156,32 +254,44 @@ export function vcsTokenCreateUrls(): Record<string, any> {
   const gitlab = (cfg.gitlab ?? {}) as Record<string, any>;
   const host = String(gitlab.host ?? "gitlab.com");
   const gitlabScopes = Array.isArray(defaults.gitlabScopes) ? defaults.gitlabScopes : ["api"];
-  const gitlabParams = new URLSearchParams({ name, description: desc, scopes: gitlabScopes.join(",") });
+  const gitlabParams = new URLSearchParams({
+    name,
+    description: desc,
+    scopes: gitlabScopes.join(","),
+  });
   const gitlabUrl = `https://${host}/-/user_settings/personal_access_tokens?${gitlabParams}`;
 
-  const githubPerms = defaults.githubPermissions ?? { pull_requests: "write", contents: "write", metadata: "read" };
+  const githubPerms = defaults.githubPermissions ?? {
+    pull_requests: "write",
+    contents: "write",
+    metadata: "read",
+  };
   const ghParams = new URLSearchParams({ name, description: desc, ...githubPerms });
   const githubFineUrl = `https://github.com/settings/personal-access-tokens/new?${ghParams}`;
 
-  const classicScopes = Array.isArray(defaults.githubClassicScopes) ? defaults.githubClassicScopes : ["repo"];
+  const classicScopes = Array.isArray(defaults.githubClassicScopes)
+    ? defaults.githubClassicScopes
+    : ["repo"];
   const githubClassicUrl = `https://github.com/settings/tokens/new?${new URLSearchParams({ description: name, scopes: classicScopes.join(",") })}`;
 
   const provider = String(cfg.provider ?? "gitlab").toLowerCase();
-  const active = {
-    gitlab: {
-      tokenFile: gitlab.tokenFile ?? path.join(configDir(), "gitlab.token"),
-      createUrl: gitlabUrl,
-      scopes: gitlabScopes,
-      name,
-    },
-    github: {
-      tokenFile: (cfg.github as Record<string, any>)?.tokenFile ?? path.join(configDir(), "github.token"),
-      createUrl: githubFineUrl,
-      createUrlClassic: githubClassicUrl,
-      permissions: githubPerms,
-      name,
-    },
-  }[provider] ?? {};
+  const active =
+    {
+      gitlab: {
+        tokenFile: gitlab.tokenFile ?? path.join(configDir(), "gitlab.token"),
+        createUrl: gitlabUrl,
+        scopes: gitlabScopes,
+        name,
+      },
+      github: {
+        tokenFile:
+          (cfg.github as Record<string, any>)?.tokenFile ?? path.join(configDir(), "github.token"),
+        createUrl: githubFineUrl,
+        createUrlClassic: githubClassicUrl,
+        permissions: githubPerms,
+        name,
+      },
+    }[provider] ?? {};
 
   return {
     tokenName: name,
@@ -189,13 +299,18 @@ export function vcsTokenCreateUrls(): Record<string, any> {
     activeProvider: provider,
     active,
     gitlab: { host, createUrl: gitlabUrl, scopes: gitlabScopes, tokenFile: gitlab.tokenFile },
-    github: { createUrl: githubFineUrl, createUrlClassic: githubClassicUrl, permissions: githubPerms, tokenFile: (cfg.github as Record<string, any>)?.tokenFile },
+    github: {
+      createUrl: githubFineUrl,
+      createUrlClassic: githubClassicUrl,
+      permissions: githubPerms,
+      tokenFile: (cfg.github as Record<string, any>)?.tokenFile,
+    },
   };
 }
 
 /** Port of scripts/vcs/merged-style.sh — recent merged MR/PR bodies for style reference. */
-export function mergedPrStyle(limit = 6): Record<string, any> {
-  const cfg = vcsConfig("load");
+export function mergedPrStyle(limit = 6, cwd?: string): Record<string, any> {
+  const cfg = vcsConfig("load", cwd);
   if (!cfg.ok || !cfg.tokenReady) return { ok: false, error: "vcs not configured" };
   const provider = cfg.provider as string;
   const token = fs.readFileSync(cfg.tokenPath as string, "utf8").trim();
@@ -203,31 +318,45 @@ export function mergedPrStyle(limit = 6): Record<string, any> {
 
   const descInfo = (desc: string, caseInsensitiveNotes = false): Record<string, any> => ({
     hasNotesSection: caseInsensitiveNotes ? /##\s*notes/i.test(desc) : /##\s*Notes/.test(desc),
-    sections: desc.split("\n").filter((l) => l.startsWith("## ")).map((l) => l.trim()),
+    sections: desc
+      .split("\n")
+      .filter((l) => l.startsWith("## "))
+      .map((l) => l.trim()),
     descriptionPreview: desc.slice(0, 600),
   });
 
   if (provider === "gitlab") {
-    const remote = spawnSync("git", ["remote", "get-url", "origin"], { encoding: "utf8" });
+    const remote = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
     if (remote.status !== 0) return { ok: false, error: "no origin remote" };
     const url = (remote.stdout ?? "").trim();
     const m = /gitlab\.com[:/](.+?)(?:\.git)?$/.exec(url);
     if (!m) return { ok: false, error: "not a gitlab.com origin" };
     const project = m[1];
     const env = { ...process.env, GITLAB_TOKEN: token };
-    const run = (args: string[]) => spawnSync("glab", ["api", ...args], { encoding: "utf8", env });
-    let r = run([`projects/${project.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`]);
+    const run = (args: string[]) =>
+      spawnSync("glab", ["api", ...args], { cwd, encoding: "utf8", env });
+    let r = run([
+      `projects/${project.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`,
+    ]);
     if (r.status !== 0) {
       r = run([`merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`]);
     }
     if (r.status !== 0) return { ok: false, error: "could not list merge requests" };
     for (const mr of JSON.parse(r.stdout ?? "[]") as Array<Record<string, any>>) {
       const desc = String(mr.description ?? "").trim();
-      examples.push({ title: mr.title, url: mr.web_url, squash: mr.squash, ...descInfo(desc, true) });
+      examples.push({
+        title: mr.title,
+        url: mr.web_url,
+        squash: mr.squash,
+        ...descInfo(desc, true),
+      });
     }
   } else if (provider === "github") {
-    const r = spawnSync("gh", ["pr", "list", "--state", "merged", "--limit", String(limit), "--json", "title,url,body"],
-      { encoding: "utf8", env: { ...process.env, GH_TOKEN: token } });
+    const r = spawnSync(
+      "gh",
+      ["pr", "list", "--state", "merged", "--limit", String(limit), "--json", "title,url,body"],
+      { cwd, encoding: "utf8", env: { ...process.env, GH_TOKEN: token } },
+    );
     if (r.status !== 0) return { ok: false, error: "could not list pull requests" };
     for (const pr of JSON.parse(r.stdout ?? "[]") as Array<Record<string, any>>) {
       const desc = String(pr.body ?? "").trim();

package/src/core/verify-parse.ts

@@ -3,7 +3,7 @@ export function parseVerifyOutput(stdout: string): Record<string, any> {
   const commands = [];
   const parts = stdout.split(/\n## /);
   for (const part of parts.slice(1)) {
-    const nl = part.indexOf('\n');
+    const nl = part.indexOf("\n");
     const label = part.slice(0, nl).trim();
     const body = part.slice(nl + 1);
     const cmdMatch = body.match(/^command: (.+)$/m);
@@ -18,7 +18,9 @@ export function parseVerifyOutput(stdout: string): Record<string, any> {
     }
   }
 
-  const summaryMatch = stdout.match(/# Summary[\s\S]*?passed: (\d+)[\s\S]*?failed: (\d+)[\s\S]*?skipped: (\d+)/);
+  const summaryMatch = stdout.match(
+    /# Summary[\s\S]*?passed: (\d+)[\s\S]*?failed: (\d+)[\s\S]*?skipped: (\d+)/,
+  );
   const passed = summaryMatch ? Number(summaryMatch[1]) : 0;
   const failed = summaryMatch ? Number(summaryMatch[2]) : 0;
   const skipped = summaryMatch ? Number(summaryMatch[3]) : 0;

package/src/core/verify-project.ts

@@ -0,0 +1,181 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { repoRoot } from "./repo-context";
+
+// Port of scripts/verify-project.sh — discover + run project verification checks
+// (npm/pnpm/yarn, cargo, pytest/ruff, CHANGELOG format). Output is parsed by
+// verify-parse.ts and keeps the same ## section text shape.
+
+export type VerifyResult = { stdout: string; stderr: string; exitCode: number; cwd: string };
+
+const commandOnPath = (name: string): boolean => {
+  const dirs = (process.env.PATH ?? "").split(path.delimiter);
+  // win32 executables carry an .exe suffix (pytest.exe), so probe both names.
+  const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
+  for (const dir of dirs) {
+    if (!dir) continue;
+    for (const candidateName of names) {
+      const candidate = path.join(dir, candidateName);
+      try {
+        statSync(candidate);
+        if (process.platform !== "win32") {
+          const mode = statSync(candidate).mode & 0o111;
+          if (mode === 0) continue;
+        }
+        return true;
+      } catch {
+        /* keep scanning */
+      }
+    }
+  }
+  return false;
+};
+
+const hasScript = (cwd: string, name: string): boolean => {
+  const pkgPath = path.join(cwd, "package.json");
+  if (!existsSync(pkgPath)) return false;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { scripts?: Record<string, string> };
+    return Boolean(pkg.scripts && typeof pkg.scripts[name] === "string");
+  } catch {
+    return false;
+  }
+};
+
+const packageRunner = (cwd: string): string => {
+  if (existsSync(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  const pkgPath = path.join(cwd, "package.json");
+  if (existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { packageManager?: string };
+      if (typeof pkg.packageManager === "string" && pkg.packageManager.startsWith("pnpm")) {
+        return "pnpm";
+      }
+    } catch {
+      /* fall through */
+    }
+  }
+  if (existsSync(path.join(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+};
+
+export function runVerifyProject(root: string, dryRun = false): VerifyResult {
+  // Shell parity: verify-project.sh did `root=$(git rev-parse --show-toplevel || pwd); cd "$root"`,
+  // so a run from a repo subdirectory still checks the repo root.
+  const cwd = repoRoot(root);
+  let passed = 0;
+  let failed = 0;
+  let skipped = 0;
+  const lines: string[] = [];
+  const stderrParts: string[] = [];
+
+  const runCheck = (label: string, cmd: string, args: string[]) => {
+    lines.push(`\n## ${label}\n\n`);
+    lines.push(`command: ${[cmd, ...args].join(" ")}\n\n`);
+    if (dryRun) {
+      lines.push("status: skipped (dry run)\n");
+      skipped += 1;
+      return;
+    }
+    const r = spawnSync(cmd, args, { cwd, encoding: "utf8" });
+    const so = (r.stdout ?? "").trimEnd();
+    if (so) lines.push(so + "\n");
+    const se = (r.stderr ?? "").trimEnd();
+    if (se) stderrParts.push(se);
+    if (r.status === 0) {
+      lines.push("\nstatus: pass\n");
+      passed += 1;
+    } else {
+      lines.push(`\nstatus: fail (exit ${r.status})\n`);
+      failed += 1;
+    }
+  };
+
+  const skipCheck = (label: string, reason: string) => {
+    lines.push(`\n## ${label}\n\nstatus: skipped (${reason})\n`);
+    skipped += 1;
+  };
+
+  lines.push("# Verification Context\n");
+  lines.push(`\nroot: ${cwd}\n`);
+  lines.push(`dry_run: ${String(dryRun)}\n`);
+
+  const pkgPath = path.join(cwd, "package.json");
+  if (existsSync(pkgPath)) {
+    const runner = packageRunner(cwd);
+    for (const script of ["lint", "format:check", "test", "build"]) {
+      if (hasScript(cwd, script)) {
+        if (runner === "npm") runCheck(script, "npm", ["run", script]);
+        else runCheck(script, runner, [script]);
+      } else {
+        skipCheck(script, `package.json has no ${script} script`);
+      }
+    }
+  } else {
+    skipCheck("javascript", "package.json not found");
+  }
+
+  const cargoManifest = existsSync(path.join(cwd, "Cargo.toml"))
+    ? "Cargo.toml"
+    : existsSync(path.join(cwd, "src-tauri/Cargo.toml"))
+      ? "src-tauri/Cargo.toml"
+      : "";
+  if (cargoManifest) {
+    runCheck("cargo fmt", "cargo", ["fmt", "--manifest-path", cargoManifest, "--", "--check"]);
+    runCheck("cargo clippy", "cargo", [
+      "clippy",
+      "--manifest-path",
+      cargoManifest,
+      "--all-targets",
+      "--",
+      "-D",
+      "warnings",
+    ]);
+    runCheck("cargo test", "cargo", ["test", "--manifest-path", cargoManifest, "--all-targets"]);
+  } else {
+    skipCheck("rust", "Cargo.toml not found");
+  }
+
+  if (
+    existsSync(path.join(cwd, "pyproject.toml")) ||
+    existsSync(path.join(cwd, "pytest.ini")) ||
+    existsSync(path.join(cwd, "tests"))
+  ) {
+    if (commandOnPath("pytest")) runCheck("pytest", "pytest", []);
+    else skipCheck("pytest", "pytest not available");
+    if (commandOnPath("ruff")) runCheck("ruff check", "ruff", ["check", "."]);
+    else skipCheck("ruff check", "ruff not available");
+  }
+
+  lines.push("\n## CHANGELOG.md format\n\n");
+  lines.push('command: grep -qi "## [Unreleased]" CHANGELOG.md\n\n');
+  const changelogPath = path.join(cwd, "CHANGELOG.md");
+  if (dryRun) {
+    lines.push("status: skipped (dry run)\n");
+    skipped += 1;
+  } else if (existsSync(changelogPath)) {
+    if (/## \[Unreleased\]/i.test(readFileSync(changelogPath, "utf8"))) {
+      lines.push("status: pass\n");
+      passed += 1;
+    } else {
+      lines.push("status: fail (missing ## [Unreleased])\n");
+      failed += 1;
+    }
+  } else {
+    lines.push("status: fail (missing CHANGELOG.md)\n");
+    failed += 1;
+  }
+
+  lines.push("\n# Summary\n\n");
+  lines.push(`passed: ${passed}\n`);
+  lines.push(`failed: ${failed}\n`);
+  lines.push(`skipped: ${skipped}\n`);
+
+  return {
+    stdout: lines.join(""),
+    stderr: stderrParts.join("\n"),
+    exitCode: failed > 0 ? 1 : 0,
+    cwd,
+  };
+}