@erclx/canon 5.42.0 → 5.43.0

package/src/migrate/session-defaults.ts

@@ -0,0 +1,138 @@
+/**
+ * Adds the session defaults the seeded `.claude/settings.json` carries to a
+ * target that was seeded before them.
+ *
+ * `canon claude init` copies a seed only when the file is absent, so a target
+ * holding its own settings never sees a later seed change. This verb adds each
+ * default only where the key is absent: a deny entry is never removed, and a
+ * person's `autoMemoryEnabled: true` is never overwritten.
+ */
+
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+  readSettings,
+  type SettingsKey,
+  type SettingsRecord,
+  serializeSettings,
+  writeSettings,
+} from '@/claude/settings'
+
+/** Both names, since `Task` is the tool's name before Claude Code renamed it. */
+export const DENIED_TOOLS: readonly string[] = ['Agent', 'Task']
+
+export interface SessionDefaultsPlan {
+  readonly keys: readonly SettingsKey[]
+  readonly next: SettingsRecord
+  readonly changed: boolean
+  /**
+   * True when the file holds no default at all. A file holding either one has
+   * been through the seed or this verb, so a missing deny there was removed
+   * on purpose, which is how an operator opts back into subagents.
+   */
+  readonly predates: boolean
+}
+
+export type SessionDefaultsRead =
+  | { readonly kind: 'refused'; readonly reason: string }
+  | { readonly kind: 'absent'; readonly path: string }
+  | {
+      readonly kind: 'planned'
+      readonly path: string
+      readonly indent: string
+      readonly plan: SessionDefaultsPlan
+    }
+
+export function settingsPath(root: string): string {
+  return join(root, '.claude', 'settings.json')
+}
+
+function isRecord(value: unknown): value is SettingsRecord {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/**
+ * Appends the denied tools a list lacks, keeping the list's own order, so the
+ * diff a person reads is the added entries alone.
+ */
+export function planSessionDefaults(
+  current: SettingsRecord,
+): SessionDefaultsPlan {
+  const next: SettingsRecord = { ...current }
+  const permissions = isRecord(current.permissions) ? current.permissions : {}
+  const deny = Array.isArray(permissions.deny) ? permissions.deny : []
+
+  const missing = DENIED_TOOLS.filter((tool) => !deny.includes(tool))
+  if (missing.length > 0) {
+    next.permissions = { ...permissions, deny: [...deny, ...missing] }
+  }
+
+  const memoryAbsent = !('autoMemoryEnabled' in current)
+  if (memoryAbsent) next.autoMemoryEnabled = false
+
+  const keys: SettingsKey[] = [
+    { label: 'permissions.deny', changed: missing.length > 0 },
+    { label: 'autoMemoryEnabled', changed: memoryAbsent },
+  ]
+  return {
+    keys,
+    next,
+    changed: keys.some((key) => key.changed),
+    predates: memoryAbsent && missing.length === DENIED_TOOLS.length,
+  }
+}
+
+/**
+ * Refuses rather than plans whenever a write could replace something the
+ * person owns: the toolkit's own settings, a file `JSON.parse` cannot read,
+ * or a `permissions` or `deny` value of an unexpected shape.
+ */
+export async function readSessionDefaults(
+  root: string,
+  protectedRoot: string,
+): Promise<SessionDefaultsRead> {
+  if (root === protectedRoot) {
+    return {
+      kind: 'refused',
+      reason:
+        'Cannot run against toolkit root. Files here are the source of truth.',
+    }
+  }
+
+  const path = settingsPath(root)
+  if (!existsSync(path)) return { kind: 'absent', path }
+
+  let read: Awaited<ReturnType<typeof readSettings>>
+  try {
+    read = await readSettings(path)
+  } catch (error) {
+    return {
+      kind: 'refused',
+      reason: error instanceof Error ? error.message : String(error),
+    }
+  }
+
+  const { permissions } = read.value
+  if (permissions !== undefined && !isRecord(permissions)) {
+    return { kind: 'refused', reason: `${path}: permissions is not an object` }
+  }
+  if (permissions?.deny !== undefined && !Array.isArray(permissions.deny)) {
+    return {
+      kind: 'refused',
+      reason: `${path}: permissions.deny is not a list`,
+    }
+  }
+
+  return {
+    kind: 'planned',
+    path,
+    indent: read.indent,
+    plan: planSessionDefaults(read.value),
+  }
+}
+
+export async function applySessionDefaults(
+  read: Extract<SessionDefaultsRead, { kind: 'planned' }>,
+): Promise<void> {
+  await writeSettings(read.path, serializeSettings(read.plan.next, read.indent))
+}

package/src/pr/local.ts

@@ -1,26 +1,11 @@
+import { belongsTo } from '@/listeners/belongs'
+import type { ListenerReader } from '@/listeners/machine'
 import { readAddresses } from '@/pr/evidence'
 
-/**
- * The folder linked worktrees sit under. A listener there belongs to another
- * branch even though its cwd sits inside the main checkout's toplevel.
- */
-const LINKED_WORKTREES = '.claude/worktrees'
-
-/** The state `/proc/net/tcp` writes for a socket in LISTEN. */
-const PROC_LISTEN_STATE = '0A'
-
 export type LocalRefusal = 'no-server' | 'no-listener-reader'
 
-export interface Listener {
-  readonly port: number
-  readonly pid: number
-}
-
-/** The machine reads a detection makes, injected so it can be driven without binding a socket. */
-export interface LocalRunner {
-  /** Every TCP socket in LISTEN with its owning pid, or undefined when this machine offers no way to read them. */
-  listListeners(): Promise<readonly Listener[] | undefined>
-  cwdOf(pid: number): Promise<string | undefined>
+/** The listener reads a detection makes plus an HTML probe, injected so it can be driven without binding a socket. */
+export interface LocalRunner extends ListenerReader {
   /** Whether the port serves an HTML page at its root inside the runner's timeout. */
   probe(port: number): Promise<boolean>
 }
@@ -29,22 +14,6 @@ export type LocalResult =
   | { readonly kind: 'found'; readonly port: number; readonly url: string }
   | { readonly kind: 'refused'; readonly reason: LocalRefusal }
 
-function isInside(path: string, root: string): boolean {
-  return path === root || path.startsWith(`${root}/`)
-}
-
-/**
- * Whether a process running in `cwd` serves this worktree. A tool that
- * changes into a subfolder before listening still counts, while a sibling
- * worktree nested under the main checkout's `.claude/worktrees/` does not.
- */
-function belongsTo(cwd: string, worktreeRoot: string): boolean {
-  return (
-    isInside(cwd, worktreeRoot) &&
-    !isInside(cwd, `${worktreeRoot}/${LINKED_WORKTREES}`)
-  )
-}
-
 /**
  * Finds the server this worktree is running: the lowest port whose listening
  * process runs inside the worktree and answers an HTTP probe. A port rather
@@ -76,40 +45,6 @@ export async function findLocalServer(
   return { kind: 'refused', reason: 'no-server' }
 }
 
-/** Reads `lsof -nP -iTCP -sTCP:LISTEN -Fpn` output, where a `p` line opens a process and each `n` line names one of its sockets. */
-export function parseLsofListeners(text: string): Listener[] {
-  const listeners: Listener[] = []
-  let pid: number | undefined
-  for (const line of text.split('\n')) {
-    if (line.startsWith('p')) pid = Number(line.slice(1))
-    if (!line.startsWith('n') || pid === undefined) continue
-    const port = Number(line.slice(line.lastIndexOf(':') + 1))
-    if (Number.isInteger(port) && port > 0) listeners.push({ pid, port })
-  }
-  return listeners
-}
-
-export interface ProcSocket {
-  readonly port: number
-  readonly inode: string
-}
-
-/** Reads `/proc/net/tcp` or `tcp6`, keeping each listening socket's port and inode for matching against `/proc/<pid>/fd`. */
-export function parseProcNetTcp(text: string): ProcSocket[] {
-  const sockets: ProcSocket[] = []
-  for (const line of text.split('\n').slice(1)) {
-    const fields = line.trim().split(/\s+/)
-    const local = fields[1]
-    const state = fields[3]
-    const inode = fields[9]
-    if (local === undefined || inode === undefined) continue
-    if (state !== PROC_LISTEN_STATE) continue
-    const port = Number.parseInt(local.slice(local.lastIndexOf(':') + 1), 16)
-    if (Number.isInteger(port) && port > 0) sockets.push({ port, inode })
-  }
-  return sockets
-}
-
 /**
  * Drops the address line of a marked body, hosted and local segments alike,
  * since the close that runs this also deletes the branch's preview

package/src/sync/check.ts

@@ -38,6 +38,7 @@ import {
   resolveChain,
 } from '@/tooling/manifest'
 import { scan } from '@/tooling/scan'
+import { isAddOn } from '@/tooling/stamp'
 import { readSkew, type SkewReport } from '@/version/skew'
 
 /**
@@ -302,6 +303,20 @@ export function buildToolingReport(
 function resolveRecorded(
   toolkitRoot: string,
   recorded: readonly string[],
+): Manifest[] {
+  const addOns = recorded
+    .map((name) => loadManifest(toolkitRoot, name))
+    .filter((manifest) => manifest !== undefined)
+    .filter(isAddOn)
+  const addOnNames = new Set(addOns.map((manifest) => manifest.name))
+  const core = recorded.filter((name) => !addOnNames.has(name))
+
+  return [...resolveCore(toolkitRoot, core), ...addOns]
+}
+
+function resolveCore(
+  toolkitRoot: string,
+  recorded: readonly string[],
 ): Manifest[] {
   const loaded = recorded
     .map((name) => loadManifest(toolkitRoot, name))

package/src/tooling/stamp.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { writeChainStamp } from '@/sync/stamp'
-import { isWholeStack, type Manifest } from '@/tooling/manifest'
+import { readStamp, stampedChain, writeChainStamp } from '@/sync/stamp'
+import { isWholeStack, loadManifest, type Manifest } from '@/tooling/manifest'
 import { readPackage } from '@/tooling/package'
 
 /**
@@ -17,7 +17,9 @@ export function isWorkspaceRoot(target: string): boolean {
 }
 
 /**
- * Records the chain an install resolved, and returns whether it wrote one. A
+ * Records the chain an install resolved, and returns the names it wrote, or
+ * nothing when it wrote none. The names are the merged list, which can carry
+ * stacks an earlier sync recorded. A
  * workspace root is the single refusal: one chain recorded there would be a
  * guess at what its packages hold, and the report reading tooling as unmeasured
  * is the true answer rather than a clean one.
@@ -27,16 +29,58 @@ export async function recordToolingChain(
   target: string,
   chain: readonly Manifest[],
   now: Date,
-): Promise<boolean> {
-  if (isWorkspaceRoot(target)) return false
-
-  await writeChainStamp(
-    target,
-    { domain: 'tooling', toolkitRoot },
-    recordedStacks(chain),
-    now,
+): Promise<string[] | undefined> {
+  if (isWorkspaceRoot(target)) return undefined
+
+  const merged = mergeAddOns(
+    toolkitRoot,
+    stampedChain(readStamp(target), 'tooling'),
+    chain,
   )
-  return true
+  await writeChainStamp(target, { domain: 'tooling', toolkitRoot }, merged, now)
+  return merged
+}
+
+/**
+ * An add-on stands alone beside a core chain, so syncing one must not displace
+ * the chain it layers onto. Base extends nothing and still heads a core chain.
+ */
+export function isAddOn(manifest: Manifest | undefined): boolean {
+  return (
+    manifest !== undefined &&
+    manifest.parent === undefined &&
+    manifest.name !== 'base'
+  )
+}
+
+/**
+ * Merges what this sync resolved into what an earlier one recorded. The core
+ * chain is the one just synced, or the recorded one when only add-ons synced.
+ * Add-ons accumulate after it, so a later stackless report measures them all.
+ */
+function mergeAddOns(
+  toolkitRoot: string,
+  recorded: readonly string[],
+  chain: readonly Manifest[],
+): string[] {
+  const synced = chain.filter(isWholeStack)
+  const syncedCore = synced.filter((m) => !isAddOn(m)).map((m) => m.name)
+  const syncedAddOns = synced.filter(isAddOn).map((m) => m.name)
+
+  const recordedManifests = recorded.map((name) => ({
+    name,
+    manifest: loadManifest(toolkitRoot, name),
+  }))
+  const recordedCore = recordedManifests
+    .filter(({ manifest }) => !isAddOn(manifest))
+    .map(({ name }) => name)
+  const recordedAddOns = recordedManifests
+    .filter(({ manifest }) => isAddOn(manifest))
+    .map(({ name }) => name)
+
+  const core = syncedCore.length > 0 ? syncedCore : recordedCore
+  const addOns = [...new Set([...recordedAddOns, ...syncedAddOns])]
+  return [...core, ...addOns]
 }
 
 /**

package/src/worktrees/stop.ts

@@ -0,0 +1,92 @@
+import { realpath } from 'node:fs/promises'
+import { belongsTo } from '@/listeners/belongs'
+import type { ListenerReader } from '@/listeners/machine'
+
+/** What a stop took, or would take on a dry run, from one worktree. */
+export interface StoppedServer {
+  readonly path: string
+  readonly pids: readonly number[]
+  readonly ports: readonly number[]
+}
+
+/**
+ * `unread` is a machine with no way to list sockets, which a reader must tell
+ * apart from `read` with nothing stopped, since the first says nothing about
+ * what is still listening.
+ */
+export type StopReport =
+  | { readonly kind: 'read'; readonly stopped: readonly StoppedServer[] }
+  | { readonly kind: 'unread' }
+
+export interface StopOptions {
+  readonly reader: ListenerReader
+  /** Sends SIGTERM and says whether it landed, so a pid that already exited is not counted. */
+  readonly kill?: (pid: number) => boolean
+  readonly dryRun: boolean
+}
+
+function sigterm(pid: number): boolean {
+  try {
+    process.kill(pid, 'SIGTERM')
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** A process cwd reads back resolved, so a path held through a symlink has to be too. */
+async function resolved(path: string): Promise<string> {
+  return realpath(path).catch(() => path)
+}
+
+/**
+ * Stops every server listening from inside one of the worktrees about to be
+ * removed, so none outlives the directory it serves. Each path is tested by the
+ * nesting rule `canon pr local` uses, so a listener in the main checkout or in
+ * a sibling under `.claude/worktrees/` is never signaled. The cwd is read
+ * against the given paths and never against `process.cwd()`, which a run from
+ * inside another worktree would otherwise make the only match.
+ */
+export async function stopListeners(
+  paths: readonly string[],
+  opts: StopOptions,
+): Promise<StopReport> {
+  const listeners = await opts.reader.listListeners()
+  if (listeners === undefined) return { kind: 'unread' }
+
+  const kill = opts.kill ?? sigterm
+  const roots = await Promise.all(paths.map(resolved))
+  const cwdByPid = new Map<number, string | undefined>()
+  const stopped: StoppedServer[] = []
+
+  for (const [index, root] of roots.entries()) {
+    const pids = new Set<number>()
+    const ports = new Set<number>()
+    for (const { pid, port } of listeners) {
+      if (!cwdByPid.has(pid)) cwdByPid.set(pid, await opts.reader.cwdOf(pid))
+      const cwd = cwdByPid.get(pid)
+      if (cwd === undefined || !belongsTo(cwd, root)) continue
+      pids.add(pid)
+      ports.add(port)
+    }
+
+    const landed = [...pids]
+      .sort((a, b) => a - b)
+      .filter((pid) => opts.dryRun || kill(pid))
+    if (landed.length === 0) continue
+    const landedSet = new Set(landed)
+    stopped.push({
+      path: paths[index] ?? root,
+      pids: landed,
+      ports: [
+        ...new Set(
+          listeners
+            .filter(({ pid, port }) => landedSet.has(pid) && ports.has(port))
+            .map(({ port }) => port),
+        ),
+      ].sort((a, b) => a - b),
+    })
+  }
+
+  return { kind: 'read', stopped }
+}

package/tooling/base/configs/.github/workflows/phase-label-gate.yml

@@ -11,14 +11,18 @@ on:
     types: [submitted, edited]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   phase-label-gate:
     name: 🏷️ Phase Label Gate
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main'
+    # Dependabot bodies carry upstream release notes that read as phase labels
+    if: github.event.pull_request.user.login != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main')
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/base/configs/commitlint.config.js

@@ -22,38 +22,18 @@ const subjectFirstWordCase = (parsed) => {
   ]
 }
 
-const CO_AUTHOR_TRAILER = /^co-authored-by:/i
-const CLAUDE_OR_ANTHROPIC = /\b(claude|anthropic)\b/i
-
-// Reads raw rather than footer, since the parser files a lone trailer under
-// body and leaves footer null.
-const noClaudeCoAuthor = (parsed) => {
-  const offending = (parsed.raw ?? '')
-    .split('\n')
-    .find(
-      (line) => CO_AUTHOR_TRAILER.test(line) && CLAUDE_OR_ANTHROPIC.test(line),
-    )
-
-  return [
-    offending === undefined,
-    `remove the co-author trailer crediting Claude or Anthropic: ${offending}`,
-  ]
-}
-
 const config = {
   extends: ['@commitlint/config-conventional'],
   plugins: [
     {
       rules: {
         'subject-first-word-case': subjectFirstWordCase,
-        'no-claude-co-author': noClaudeCoAuthor,
       },
     },
   ],
   rules: {
     'subject-case': [0],
     'subject-first-word-case': [2, 'always'],
-    'no-claude-co-author': [2, 'always'],
     'header-max-length': [2, 'always', 72],
     'scope-case': [2, 'always', 'lower-case'],
     'subject-full-stop': [2, 'never', '.'],

package/tooling/base/reference.md

@@ -17,7 +17,7 @@ Two configs fix how output looks and how commits read.
 - `.oxfmtrc.json` sets `semi: false`, `singleQuote: true`, `printWidth: 80`, and `sortPackageJson: false`, keeping the output Prettier wrote.
 - The `astro` stack repeats those options in its own copy, so copy a change here into it.
 - `commitlint.config.js` is an ESM default export extending `@commitlint/config-conventional`. It sets `header-max-length: 72`, `scope-case: lower-case`, and `subject-full-stop: never`.
-- Its `subject-case` rule is off, and a local `no-claude-co-author` rule refuses a `Co-authored-by` trailer that names Claude or Anthropic.
+- Its `subject-case` rule is off.
 - `.husky/` holds `pre-commit`, `commit-msg`, `pre-push`, `post-merge`, and `post-rewrite`.
 
 ### Verify runner

package/tooling/base/seeds/.github/workflows/verify.yml

@@ -6,13 +6,16 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   static-checks:
     name: 🛡️ Static Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/claude/reference.md

@@ -57,11 +57,11 @@ The `# Claude` group holds three entries, being `.canon/`, `.claude/worktrees/`,
 
 ## CLI
 
-| Command              | What it does                                                                                                                    |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| `canon claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                            |
-| `canon claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                       |
-| `canon claude setup` | Installs user-level config to `~/.claude/` once per machine: statusline, attribution, and the permissions allow and deny lists. |
+| Command              | What it does                                                                                                                                                                     |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `canon claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                                                                             |
+| `canon claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                                                                        |
+| `canon claude setup` | Installs user-level config to `~/.claude/` once per machine: statusline and the permissions allow and deny lists, and removes the empty attribution pair an earlier setup wrote. |
 
 ## CLAUDE.md
 
@@ -85,11 +85,17 @@ The seed at `tooling/claude/seeds/.claude/settings.json` ships hooks that pair w
 - A PostToolUse hook pairs with `standards-audit.sh`.
 - Project settings layer over user settings, so a project file carries only what is project-specific.
 
+### Session defaults
+
+The seed also sets two defaults every session in the target runs under.
+
+- `permissions.deny` holds `Agent` and `Task`, so no session spawns a subagent. Parallel work runs as separate background sessions instead.
+- `autoMemoryEnabled` is `false`. A person turns it back on for themselves in `settings.local.json`.
+- `canon migrate session-defaults` adds both to a target seeded before them, since sync never rewrites an existing settings file.
+
 ### User template
 
 The template at `tooling/claude/user/settings.template.json` is installed once per machine by `canon claude setup`.
 
-- It sets `attribution.commit` and `attribution.pr` to empty strings to suppress co-author tags.
 - It allows `Bash(bun run *)` under `permissions.allow`.
 - Its `permissions.deny` holds `Read(**/.env)` and `Read(**/.env.*)`, blocking accidental secret exposure across any project.
-- The deprecated `includeCoAuthoredBy` key is not used.

package/tooling/claude/seeds/.claude/settings.json

@@ -1,4 +1,8 @@
 {
+  "autoMemoryEnabled": false,
+  "permissions": {
+    "deny": ["Agent", "Task"]
+  },
   "hooks": {
     "PreToolUse": [
       {

package/tooling/claude/user/settings.template.json

@@ -1,8 +1,4 @@
 {
-  "attribution": {
-    "commit": "",
-    "pr": ""
-  },
   "permissions": {
     "allow": ["Bash(bun run *)"],
     "deny": ["Read(**/.env)", "Read(**/.env.*)"]

package/tooling/cloudflare/configs/.github/workflows/deploy.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -50,7 +50,7 @@ jobs:
         run: bun run build
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist
@@ -84,7 +84,7 @@ jobs:
       # as dead weight breaks the deploy on every push.
       - name: Checkout
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         if: steps.secrets-check.outputs.skip == 'false'
@@ -94,7 +94,7 @@ jobs:
 
       - name: Download artifact
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist
@@ -104,7 +104,7 @@ jobs:
       - name: Publish
         id: publish
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/tooling/public/configs/.github/dependabot.yml

@@ -0,0 +1,12 @@
+# canon-no-seed: an add-on stack's config with no root counterpart by design.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+    groups:
+      actions:
+        update-types: [minor, patch]

package/tooling/public/configs/.github/workflows/release-please.yml

@@ -0,0 +1,30 @@
+name: Release
+# canon-no-seed: an add-on stack's workflow with no root counterpart by design, since the toolkit cuts its own releases through its own workflow.
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  release-please:
+    name: 🏷️ Release Please
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    # Queues rather than cancels, since a cancel can land after the release exists and before its outputs do
+    concurrency:
+      group: release-please
+      cancel-in-progress: false
+    steps:
+      - name: Release Please
+        uses: googleapis/release-please-action@v5
+        with:
+          # A personal token lets CI run on the release pull request, which the default token's bot author does not
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json