@hublo/sentinel 1.1.0-alpha.4 → 1.1.0-alpha.5

package/README.md

@@ -43,17 +43,20 @@ A large monorepo accumulates:
 
 sentinel writes **standard config files** into a project (each just `extends` a sentinel preset) and runs the checks. Your editor and the tools read those **normal files natively**, they never call sentinel at runtime, so nothing is coupled to it or brittle.
 
-> **Shipped today:** the **TypeScript** and **lint** tools. The `--test` / `--build` snippets
-> below illustrate the end state and land with their own ticket.
+> **Shipped today:** the **TypeScript**, **lint** and **format** tools. The `--test` / `--build`
+> snippets below illustrate the end state and land with their own ticket.
 
 **Step 1 — put a module on sentinel** (once per module, by a dev; the files are committed). Run from the app dir; `--init` does it all, nothing is hand-edited:
 
 ```bash
-sentinel --init --typescript --preset <react|nest|node|svelte>
-sentinel --init --lint --preset <react|nest|node|svelte>
+sentinel --init --preset <react|nest|node|svelte>   # every role sentinel ships
 pnpm install   # fetch what --init declared, then commit
 ```
 
+With no target named, `--init` adopts every role, in the order that makes the result correct:
+the linter's autofix runs, then the formatter runs **last** and formats everything every role
+wrote. Naming one target (`--init --lint`) adopts just that role and leaves the rest alone.
+
 `--init` writes the config stubs, the `typecheck`/`lint`/... scripts, and pins the `@hublo/sentinel` devDependency into the module (no manual `pnpm add`); it scaffolds a `package.json` for a `project.json`-only module. It also applies, once, the workspace prep that module needs at the root, only when the root's own config shows it is needed (e.g. an i18next singleton override when the repo runs a second TypeScript, a release-age allow-list when the repo uses that pnpm gate). See the [adoption cheat sheet](docs/typescript-adoption.md) for the full list.
 
 Those files are tiny, they just point at a sentinel preset. What gets committed:
@@ -61,7 +64,26 @@ Those files are tiny, they just point at a sentinel preset. What gets committed:
 ```jsonc
 // .oxlintrc.json — generated. Adoption REPLACES eslint rather than sitting beside it, so
 // the module's eslint config is DELETED and this is the only linter config it keeps.
-{ "extends": ["./node_modules/@hublo/sentinel/oxlint/react.json"] }
+// The RULES live in the preset, so a preset change arrives by reinstalling. `ignorePatterns`
+// cannot: it does not cross an `extends` boundary, so it is written here, which is what
+// makes the file correct for your editor and for `oxlint -c` on its own.
+{
+  "extends": ["./node_modules/@hublo/sentinel/oxlint/react.json"],
+  "ignorePatterns": ["**/dist/**", "**/node_modules/**", "..."],
+}
+```
+
+```jsonc
+// .oxfmtrc.json — generated, and the one config that is NOT a stub: oxfmt has no `extends`
+// and ignores the key silently, so the preset's values are written in. Anything the module
+// deliberately formats differently is declared in `$sentinel.local` and survives a re-init.
+{
+  "$sentinel": { "preset": "base", "version": "1.1.0", "local": [] },
+  "printWidth": 80,
+  "semi": false,
+  "singleQuote": true,
+  "sortImports": { "groups": ["builtin", "external", "internal", ["parent", "index"], "sibling"] },
+}
 ```
 
 ```jsonc
@@ -70,7 +92,7 @@ Those files are tiny, they just point at a sentinel preset. What gets committed:
 {
   "extends": ["../../tsconfig.base.json", "@hublo/sentinel/tsconfig/react"],
   "compilerOptions": { "baseUrl": ".", "paths": { "@/*": ["./src/*"] } },
-  "include": ["src"]
+  "include": ["src"],
 }
 ```
 
@@ -82,11 +104,15 @@ And the app's `package.json` scripts route every check through the one CLI (run
 // package.json
 {
   "scripts": {
-    "lint": "sentinel --run --lint",
-    "lint:fix": "sentinel --run --lint --fix",
+    // `lint` checks BOTH, the way `prettier --check . && eslint .` used to. In the :fix
+    // pair the formatter runs last: the linter's autofix rewrites code.
+    "lint": "sentinel --run --lint && sentinel --run --format",
+    "lint:fix": "sentinel --run --lint --fix && sentinel --run --format --fix",
+    "format": "sentinel --run --format",
+    "format:fix": "sentinel --run --format --fix",
     "typecheck": "sentinel --run --typescript",
-    "test": "sentinel --run --test"
-  }
+    "test": "sentinel --run --test",
+  },
 }
 ```
 
@@ -121,6 +147,10 @@ pnpm dlx @hublo/sentinel@<exact-version> --inspect --typescript --module <name>
 
 ## Docs & cheat sheets
 
+- [`docs/performance.md`](docs/performance.md) — the measured baseline (`pnpm bench`), so a regression is something you can see rather than argue about, and what is deliberately left unoptimised.
+- [`docs/using-sentinel.md`](docs/using-sentinel.md) — every verb for every role, scoping a run to some files, what a fully adopted module looks like, and how versions move between modules.
+- [`docs/lint-adoption.md`](docs/lint-adoption.md) — migrating a module from ESLint to Oxlint: the two steps, what `--init` writes and removes, the two react tiers, and the failures worth recognising.
+- [`docs/format-adoption.md`](docs/format-adoption.md) — migrating a module from Prettier to oxfmt: why this config is materialized rather than a stub, how a module keeps its own formatting, and what did not survive the move.
 - [`docs/typescript-adoption.md`](docs/typescript-adoption.md) — the adoption cheat sheet: the two adoption steps, the command model (verb x type x location), options, reading a report, and troubleshooting.
 - [`docs/typescript-traces.md`](docs/typescript-traces.md) — a **generated, versioned** reference of live command + output traces (every verb, option, config result and edge case) against the mock monorepo. Regenerate after CLI changes with `pnpm docs:traces`.
 
@@ -471,7 +501,7 @@ Yes. Per app (app A defaults to eslint, app B to biome), or even in the same app
 Most tools expose `extends` or a plugin mechanism to compose config, so the stub just points at the sentinel preset. For the rare tool that doesn't, sentinel exposes the config **directly**, it generates the full config from its preset (still one source, drift-checked).
 
 **What does an nx `project.json` look like?**
-nx is a **task runner**: it just runs the target's script. So `project.json` barely changes, the lint / test / typecheck targets run the `package.json` scripts (which call sentinel), or stay nx-inferred. nx keeps the graph, affected set, and cache; sentinel provides the config + execution.
+nx is a **task runner**: it just runs the target's script, so the command belongs in `package.json` and nx infers a target from it (verified: it does this even when the module also has a `project.json`). Adoption therefore REMOVES the role's target from `project.json`, leaving every other one alone, and writes only what nx alone needs (cache inputs) into the `nx` block of `package.json`. Each role a module adopts decouples one more thing from nx and shrinks that file. nx keeps the graph, affected set, and cache; sentinel provides the config + execution.
 
 ## Roadmap
 

package/dist/bin/sentinel.js

@@ -3,18 +3,20 @@ import {
   PRESET_NAMES,
   TARGETS,
   VERBS,
+  WORKSPACE_ROOT_MARKER,
   availableTargets,
   describeFramework,
   dispatch,
+  ensureWorkspacePrep,
+  findWorkspaceRoot,
   palette,
   readNxProjectName,
-  readOwnPackage,
   readOwnVersion,
   readProjectPackageJson,
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-FLLX5MN3.js";
+} from "../chunk-NAUACDXT.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
@@ -73,9 +75,6 @@ function discoverModules(cwd2, options = {}) {
   return modules.filter((module) => affected.has(module.name));
 }
 
-// src/core/settings.ts
-var WORKSPACE_ROOT_MARKER = "nx.json";
-
 // src/core/context.ts
 var MODULE_MARKERS = ["package.json", "project.json"];
 function isModuleDir(cwd2) {
@@ -109,6 +108,71 @@ function resolveContext(cwd2, opts2) {
   );
 }
 
+// src/cli/run-init.ts
+function asMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function runInit(ctx) {
+  const { modules, scope } = resolveContext(ctx.cwd, { module: ctx.module, ci: false });
+  const [module] = modules;
+  if (scope === "all" || scope === "affected" || !module) {
+    ctx.fail(
+      "--init writes files: target one module (run from its directory, or pass --module). Adopting every module at once is intentionally not allowed \u2014 adopt gradually."
+    );
+  }
+  const available = availableTargets();
+  if (ctx.targetsExplicit) {
+    const unwired = ctx.targets.filter((type) => !available.includes(type));
+    if (unwired.length > 0) {
+      ctx.fail(
+        `target(s) not available yet: ${unwired.map((t) => `--${t}`).join(", ")}. Available now: ${available.map((t) => `--${t}`).join(", ") || "(none yet)"}.`
+      );
+    }
+  }
+  const toRun = ctx.targets.filter((type) => available.includes(type)).sort((a, b) => Number(a === "format") - Number(b === "format"));
+  let worst = 0;
+  for (const type of toRun) {
+    try {
+      const code = await dispatch({
+        verb: ctx.verb,
+        target: type,
+        runner: ctx.runner,
+        cwd: module.root,
+        preset: ctx.preset,
+        dryRun: ctx.dryRun,
+        json: ctx.json
+      });
+      worst = Math.max(worst, code);
+    } catch (error) {
+      process.stderr.write(`
+sentinel (${type}): ${asMessage(error)}
+`);
+      worst = Math.max(worst, 1);
+    }
+  }
+  if (worst === 0) {
+    const root = findWorkspaceRoot(module.root);
+    if (root) {
+      const changes = ensureWorkspacePrep({
+        root,
+        dryRun: ctx.dryRun,
+        // Only when the FORMAT role actually adopted: a module still formatted by the root
+        // must not be excluded from it.
+        formattedModule: toRun.includes("format") ? module.root : void 0
+      });
+      const prefix = ctx.dryRun ? "  dry run: " : "  ";
+      for (const change of changes) process.stderr.write(`${prefix}${change}
+`);
+      if (changes.length > 0 && !ctx.dryRun) {
+        process.stderr.write(
+          palette(process.stderr).dim("  run `pnpm install` to apply the workspace changes\n")
+        );
+      }
+    }
+  }
+  return worst;
+}
+
 // src/core/orchestrate.ts
 async function analyse(params) {
   const results = [];
@@ -191,7 +255,7 @@ async function analyse(params) {
           worstCode = Math.max(worstCode, result.code);
         } else if (params.verb === "inspect") {
           const [config, adoption] = await Promise.all([adapter.inspect(ctx), adapter.status(ctx)]);
-          const ok = !adoption.adopted || adoption.conformant;
+          const ok = !adoption.unreadable && (!adoption.adopted || adoption.conformant);
           results.push({
             project: module.name,
             target,
@@ -206,7 +270,7 @@ async function analyse(params) {
           if (!ok) worstCode = Math.max(worstCode, 1);
         } else {
           const status = await adapter.status(ctx);
-          const ok = !status.adopted || status.conformant;
+          const ok = !status.unreadable && (!status.adopted || status.conformant);
           results.push({
             project: module.name,
             target,
@@ -269,14 +333,26 @@ function isRuleList(value) {
 var RULE_BLOCKS = [
   { key: "deferred", label: "deferred (phase 1, non-breaking):" },
   { key: "disabled", label: "not enforced, by decision:" },
-  { key: "downgraded", label: "reported, but not blocking:" }
+  { key: "downgraded", label: "reported, but not blocking:" },
+  // The format role's equivalent. A rule parked and an option overridden are the same kind of
+  // fact: this module deliberately does not do what the standard says, and someone should be
+  // able to see every such decision in one place, with the reason beside it.
+  { key: "overrides", label: "formatted differently from the repo standard:" }
 ];
+var MAX_INLINE_WIDTH = 60;
 function renderValue(key, value, p) {
   if ((key === "errors" || key === "implicitAny") && typeof value === "number") {
     return value > 0 ? p.fail(String(value)) : p.ok(String(value));
   }
   if (key === "implicitAny" && value === "deferred") return p.warn("deferred");
-  return typeof value === "string" ? value : JSON.stringify(value);
+  if (typeof value === "string") return value;
+  const json = JSON.stringify(value);
+  if (json !== void 0 && json.length > MAX_INLINE_WIDTH && typeof value === "object" && value) {
+    const count = Array.isArray(value) ? value.length : Object.keys(value).length;
+    const noun = Array.isArray(value) ? "entries" : "keys";
+    return p.dim(`{${count} ${noun}, see --json}`);
+  }
+  return json;
 }
 function renderUnsupportedRow(item, p) {
   const reason = typeof item.reason === "string" ? ` ${p.dim(`(${item.reason})`)}` : "";
@@ -345,71 +421,76 @@ function renderStatusSummary(items, p) {
   return `  ${p.strong("coverage:")} ${c.adopted}/${c.total} adopted ${p.dim("\xB7")} ${c.conformant}/${c.adopted} conformant${drift}`;
 }
 
-// src/core/workspace-prep.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname, join as join3 } from "path";
-var OVERRIDE_KEY = "i18next>typescript";
-var NATIVE_TS_ALIAS = "@typescript/native";
-var WORKSPACE_YAML = "pnpm-workspace.yaml";
-var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
-var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
-function findWorkspaceRoot(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync2(join3(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
+// src/cli/run-verb.ts
+async function runVerb(ctx) {
+  const { modules, scope } = resolveContext(ctx.cwd, { module: ctx.module, ci: ctx.ci });
+  const out = palette(process.stdout);
+  const err = palette(process.stderr);
+  const shaped = ctx.verb === "run" && ctx.json ? "report" : ctx.verb;
+  const replacement = {
+    report: "--run --json",
+    status: "--inspect"
+  };
+  const instead = replacement[ctx.verb];
+  if (instead) {
+    process.stderr.write(
+      err.warn(`sentinel: --${ctx.verb} is deprecated, use ${instead}`) + " (it still works)\n"
+    );
   }
-}
-function declaredNativeTs(pkg) {
-  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
-  if (!spec) return void 0;
-  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
-  return version || void 0;
-}
-function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join3(root, "package.json");
-  if (!existsSync2(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
-  const want = declaredNativeTs(pkg);
-  if (!want) return void 0;
-  const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (have === want) return void 0;
-  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} (i18next singleton)`;
-  pkg.pnpm ??= {};
-  pkg.pnpm.overrides ??= {};
-  pkg.pnpm.overrides[OVERRIDE_KEY] = want;
-  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-  return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
-}
-function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join3(root, WORKSPACE_YAML);
-  if (!existsSync2(yamlPath)) return void 0;
-  const own = readOwnPackage().name;
-  const lines = readFileSync2(yamlPath, "utf8").split("\n");
-  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
-  if (keyIdx === -1) return void 0;
-  let lastItemIdx = keyIdx;
-  let indent = "  ";
-  for (let i = keyIdx + 1; i < lines.length; i++) {
-    const match = lines[i]?.match(LIST_ITEM);
-    if (!match) break;
-    indent = match[1] ?? indent;
-    lastItemIdx = i;
-    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
+  if (ctx.toolArgs.length > 0) {
+    process.stderr.write(
+      err.warn(
+        `sentinel: NOT the standard check \u2014 passing ${ctx.toolArgs.join(" ")} to the ${ctx.targets[0]} tool.`
+      ) + "\n"
+    );
   }
-  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
-  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
-  writeFileSync(yamlPath, lines.join("\n"));
-  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
-}
-function ensureWorkspacePrep(opts2) {
-  const dryRun = Boolean(opts2.dryRun);
-  return [
-    ensureI18nextSingleton(opts2.root, dryRun),
-    ensureReleaseAgeAllowList(opts2.root, dryRun)
-  ].filter((message) => message !== void 0);
+  const started = Date.now();
+  const { results, worstCode } = await analyse({
+    verb: shaped,
+    targets: ctx.targets,
+    modules,
+    runner: ctx.runner,
+    preset: ctx.preset,
+    targetsExplicit: ctx.targetsExplicit,
+    maxDiagnostics: ctx.maxDiagnostics,
+    ci: ctx.ci,
+    fix: ctx.fix,
+    toolArgs: ctx.toolArgs,
+    // Per-module progress is a HUMAN affordance: it tells someone staring at a slow sweep
+    // that it is alive. On this monorepo's 441 projects it is 441 lines that bury the four
+    // that matter, and it is pure noise in a captured log. So emit it only for an
+    // interactive terminal; a pipe, CI, or a generated trace gets the results and the
+    // one-line summary, which is all any of them can use.
+    onProgress: process.stderr.isTTY ? (done, total, name) => process.stderr.write(err.dim(`  [${done}/${total}] ${name}
+`)) : void 0
+  });
+  const summary = generateSummaries(results, ctx.targets);
+  if (ctx.json) {
+    const base = ctx.verb === "status" || ctx.verb === "inspect" ? { ...summary, coverage: statusCoverage(summary.results) } : summary;
+    const payload = ctx.toolArgs.length > 0 ? { ...base, toolArgs: ctx.toolArgs } : base;
+    process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+  } else if (ctx.verb === "status" || ctx.verb === "inspect" && modules.length > 1) {
+    for (const item of summary.results) process.stdout.write(renderStatusRow(item, out) + "\n");
+    process.stdout.write(renderStatusSummary(summary.results, out) + "\n");
+  } else {
+    for (const item of summary.results) {
+      process.stdout.write(renderSummary(item, out) + "\n");
+    }
+  }
+  process.stderr.write(
+    err.dim(`  ${modules.length} module(s) [${scope}] in ${Date.now() - started}ms
+`)
+  );
+  if (ctx.targetsExplicit && summary.skipped.length > 0) {
+    const avail = availableTargets();
+    process.stderr.write(
+      err.fail(
+        `sentinel: target(s) not available yet: ${summary.skipped.map((t) => `--${t}`).join(", ")}. Available now: ${avail.length ? avail.map((t) => `--${t}`).join(", ") : "(none yet)"}.`
+      ) + "\n"
+    );
+    return 1;
+  }
+  return ctx.verb === "run" || ctx.ci ? worstCode : 0;
 }
 
 // src/shared/node-version.ts
@@ -459,7 +540,7 @@ program.name("sentinel").description("One CLI that guards code health: presets,
   "100"
 ).addHelpText(
   "after",
-  "\n  -- <tool options>      --run only, one type: pass the rest to the tool itself\n                         e.g. -- --noImplicitAny (tsc), -- --deny-warnings (oxlint)"
+  "\n  -- <options|files>     --run only, one type: pass the rest to the tool itself\n                         e.g. -- --noImplicitAny (tsc), -- --deny-warnings (oxlint).\n                         A trailing FILE or directory scopes the run to it, which is\n                         what a commit hook wants: -- src/a.ts src/b.ts"
 ).addHelpText(
   "after",
   [
@@ -470,6 +551,7 @@ program.name("sentinel").description("One CLI that guards code health: presets,
     "  sentinel --run --json                              # from root \u2192 all types, machine output",
     "  sentinel --run --ci                                # from root \u2192 affected only",
     "  sentinel --inspect --typescript                    # from root \u2192 adoption + what is deferred",
+    "  sentinel --init --preset react                     # adopt EVERY role: lint, format, typescript",
     "  sentinel --init --typescript --preset react       # set up the current module + workspace",
     "  sentinel --run --typescript -- --noImplicitAny     # ask the tool a question of your own"
   ].join("\n")
@@ -505,7 +587,7 @@ function parseFlavour(value) {
   }
   return value;
 }
-function asMessage(err) {
+function asMessage2(err) {
   return err instanceof Error ? err.message : String(err);
 }
 var verb = pickOne("verb", VERBS);
@@ -549,130 +631,6 @@ if (toolArgs.length > 0) {
     );
   }
 }
-async function runVerb() {
-  const { modules, scope } = resolveContext(cwd, { module: opts.module, ci: Boolean(opts.ci) });
-  const out = palette(process.stdout);
-  const err = palette(process.stderr);
-  const shaped = verb === "run" && opts.json ? "report" : verb;
-  const replacement = {
-    report: "--run --json",
-    status: "--inspect"
-  };
-  const instead = replacement[verb];
-  if (instead) {
-    process.stderr.write(
-      err.warn(`sentinel: --${verb} is deprecated, use ${instead}`) + " (it still works)\n"
-    );
-  }
-  if (toolArgs.length > 0) {
-    process.stderr.write(
-      err.warn(
-        `sentinel: NOT the standard check \u2014 passing ${toolArgs.join(" ")} to the ${targets[0]} tool.`
-      ) + "\n"
-    );
-  }
-  const started = Date.now();
-  const { results, worstCode } = await analyse({
-    verb: shaped,
-    targets,
-    modules,
-    runner: opts.runner,
-    preset,
-    targetsExplicit,
-    maxDiagnostics,
-    ci: Boolean(opts.ci),
-    fix: Boolean(opts.fix),
-    toolArgs,
-    // Per-module progress is a HUMAN affordance: it tells someone staring at a slow sweep
-    // that it is alive. On this monorepo's 441 projects it is 441 lines that bury the four
-    // that matter, and it is pure noise in a captured log. So emit it only for an
-    // interactive terminal; a pipe, CI, or a generated trace gets the results and the
-    // one-line summary, which is all any of them can use.
-    onProgress: process.stderr.isTTY ? (done, total, name) => process.stderr.write(err.dim(`  [${done}/${total}] ${name}
-`)) : void 0
-  });
-  const summary = generateSummaries(results, targets);
-  if (opts.json) {
-    const base = verb === "status" || verb === "inspect" ? { ...summary, coverage: statusCoverage(summary.results) } : summary;
-    const payload = toolArgs.length > 0 ? { ...base, toolArgs } : base;
-    process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
-  } else if (verb === "status" || verb === "inspect" && modules.length > 1) {
-    for (const item of summary.results) process.stdout.write(renderStatusRow(item, out) + "\n");
-    process.stdout.write(renderStatusSummary(summary.results, out) + "\n");
-  } else {
-    for (const item of summary.results) {
-      process.stdout.write(renderSummary(item, out) + "\n");
-    }
-  }
-  process.stderr.write(
-    err.dim(`  ${modules.length} module(s) [${scope}] in ${Date.now() - started}ms
-`)
-  );
-  if (targetsExplicit && summary.skipped.length > 0) {
-    const avail = availableTargets();
-    process.stderr.write(
-      err.fail(
-        `sentinel: target(s) not available yet: ${summary.skipped.map((t) => `--${t}`).join(", ")}. Available now: ${avail.length ? avail.map((t) => `--${t}`).join(", ") : "(none yet)"}.`
-      ) + "\n"
-    );
-    return 1;
-  }
-  return verb === "run" || opts.ci ? worstCode : 0;
-}
-async function runInit() {
-  const { modules, scope } = resolveContext(cwd, { module: opts.module, ci: false });
-  const [module] = modules;
-  if (scope === "all" || scope === "affected" || !module) {
-    program.error(
-      "--init writes files: target one module (run from its directory, or pass --module). Adopting every module at once is intentionally not allowed \u2014 adopt gradually."
-    );
-  }
-  const available = availableTargets();
-  if (targetsExplicit) {
-    const unwired = targets.filter((type) => !available.includes(type));
-    if (unwired.length > 0) {
-      program.error(
-        `target(s) not available yet: ${unwired.map((t) => `--${t}`).join(", ")}. Available now: ${available.map((t) => `--${t}`).join(", ") || "(none yet)"}.`
-      );
-    }
-  }
-  const toRun = targets.filter((type) => available.includes(type));
-  let worst = 0;
-  for (const type of toRun) {
-    try {
-      const code = await dispatch({
-        verb,
-        target: type,
-        runner: opts.runner,
-        cwd: module.root,
-        preset,
-        dryRun: Boolean(opts.dryRun),
-        json: Boolean(opts.json)
-      });
-      worst = Math.max(worst, code);
-    } catch (err) {
-      process.stderr.write(`
-sentinel (${type}): ${asMessage(err)}
-`);
-      worst = Math.max(worst, 1);
-    }
-  }
-  if (worst === 0) {
-    const root = findWorkspaceRoot(module.root);
-    if (root) {
-      const changes = ensureWorkspacePrep({ root, dryRun: Boolean(opts.dryRun) });
-      const prefix = opts.dryRun ? "  dry run: " : "  ";
-      for (const change of changes) process.stderr.write(`${prefix}${change}
-`);
-      if (changes.length > 0 && !opts.dryRun) {
-        process.stderr.write(
-          palette(process.stderr).dim("  run `pnpm install` to apply the workspace changes\n")
-        );
-      }
-    }
-  }
-  return worst;
-}
 async function exitWithoutTruncating(code) {
   process.exitCode = code;
   const stream = process.stdout;
@@ -683,13 +641,28 @@ async function main() {
   if (verb === "migrate") {
     program.error("--migrate is planned and not available yet; use --init to set a module up.");
   }
-  const runSelectedVerb = verb === "init" ? runInit : runVerb;
-  const exitCode = await runSelectedVerb();
+  const context = {
+    verb,
+    cwd,
+    targets,
+    targetsExplicit,
+    preset,
+    toolArgs,
+    maxDiagnostics,
+    module: opts.module,
+    runner: opts.runner,
+    ci: Boolean(opts.ci),
+    fix: Boolean(opts.fix),
+    json: Boolean(opts.json),
+    dryRun: Boolean(opts.dryRun),
+    fail: (message) => program.error(message)
+  };
+  const exitCode = verb === "init" ? await runInit(context) : await runVerb(context);
   await exitWithoutTruncating(exitCode);
 }
 main().catch((error) => {
   process.stderr.write(`
-sentinel: ${asMessage(error)}
+sentinel: ${asMessage2(error)}
 `);
   void exitWithoutTruncating(1);
 });