@rtorcato/repo-tooling 3.10.0 → 3.10.2

package/dist/base/fixers.js

@@ -27,6 +27,23 @@ import { detectLanguage } from '../cli/utils/detect-language.js';
 import { resolveLanguageModule } from '../languages/registry.js';
 import { applyGithubSettings } from './github-settings.js';
 import { closeCompletedMilestones } from './milestones.js';
+/**
+ * A fixer giving up on something the user has to resolve — a wrong flag, not a
+ * crash. Thrown rather than printed-and-exited because a fixer runs underneath
+ * `--json`: only the command layer knows whether the failure should surface as
+ * an error payload on stdout or a red line on stderr. `code` joins the same
+ * vocabulary as the command's own `no-lockfile` / `unknown-target` errors.
+ */
+export class FixerAbort extends Error {
+    code;
+    hint;
+    constructor(code, message, hint) {
+        super(message);
+        this.code = code;
+        this.hint = hint;
+        this.name = 'FixerAbort';
+    }
+}
 /** The repo's language module, resolved from its marker files. */
 async function moduleFor(targetDir) {
     return resolveLanguageModule(await detectLanguage(targetDir));
@@ -34,16 +51,17 @@ async function moduleFor(targetDir) {
 /**
  * Where to install user-global skills, asking only when nothing resolves. Under
  * `--yes` / `--json` a prompt is not available — `--json` would have its payload
- * corrupted by one — so an unresolvable destination becomes an advisory and a
- * no-op rather than a guess at a directory the user never mentioned.
+ * corrupted by one — and guessing at a directory the user never mentioned is not
+ * an option either, so the run fails: `--skills-dir` is required in that case
+ * (#411). It used to warn and no-op, which exited 0 with an empty `filesWritten`
+ * that no `--json` consumer could tell apart from "already up to date".
  */
 async function resolveInstallDir(explicit, assumeYes) {
     const { dir } = await resolveSkillsDir(explicit);
     if (dir)
         return dir;
     if (assumeYes) {
-        console.error(chalk.yellow('   skipped — no ~/.claude/skills found; pass --skills-dir <path>'));
-        return null;
+        throw new FixerAbort('no-skills-dir', 'no ~/.claude/skills found, and --yes/--json cannot prompt for one', 'pass --skills-dir <path>');
     }
     const { answer } = await inquirer.prompt([
         {

package/dist/cli/commands/fix.js

@@ -9,7 +9,7 @@ import { LOCKFILE_NAME, readLockfile, updateLockfileConfig, writeLockfile, } fro
 import { runDoctor } from './doctor.js';
 import { declinedInLock, lockfilePatchForTarget } from './fix-targets.js';
 import { computeFileList } from './setup-presets.js';
-import { BASE_FIXERS } from '../../base/fixers.js';
+import { BASE_FIXERS, FixerAbort, } from '../../base/fixers.js';
 import { FIXERS, readPackageJson } from '../../languages/js/fixers.js';
 import { PERL_FIXERS } from '../../languages/perl/fixers.js';
 import { PYTHON_FIXERS } from '../../languages/python/fixers.js';
@@ -398,9 +398,25 @@ export async function fixCommand(target, options = {}) {
             console.log(chalk.gray('   skipped\n'));
             return;
         }
+        // ponytail: only the targeted path is guarded, because the only fixer that
+        // aborts is `claude-skills` and it is explicitOnly — the bulk loop below
+        // cannot reach it. A non-explicitOnly fixer that throws FixerAbort would
+        // surface as an unhandled rejection there; guard the loop when one exists.
         const outcome = await applyFixer(fixer, effectiveResult, targetDir, pkg, lock, dryRun, silent, {
             skillsDir: options.skillsDir,
             assumeYes,
+        }).catch((err) => {
+            if (!(err instanceof FixerAbort))
+                throw err;
+            if (json) {
+                console.log(JSON.stringify({ directory: targetDir, target: fixer.target, error: err.code, hint: err.hint }, null, 2));
+            }
+            else {
+                console.error(chalk.red(`\n❌ ${fixer.target}: ${err.message}`));
+                if (err.hint)
+                    console.error(chalk.gray(`   ${err.hint}\n`));
+            }
+            process.exit(1);
         });
         actions.push(recordFor(fixer.target, result.check, effectiveResult.status, outcome.dryRun ? 'dry-run' : 'applied', outcome.filesWritten, conflict));
         if (json)

package/dist/cli/generators/agent-rules.js

@@ -1,7 +1,9 @@
+import { glob } from 'node:fs/promises';
 import path from 'node:path';
 import fs from 'fs-extra';
 import { copyPreset, getPackageRoot } from '../utils/copy-preset.js';
 import { LEGACY_TOOL_NAME } from '../utils/lockfile.js';
+import { parseWorkspacePackages } from './misc.js';
 import { installSkillsInstallDocs } from './skills-install.js';
 /**
  * All agent rule files are generated from one source of truth — the shipped
@@ -41,6 +43,62 @@ function asObject(value) {
         ? value
         : null;
 }
+/**
+ * True when `rel` resolves to something at or under `targetDir`. The entries
+ * this guards end up in `worktree.symlinkDirectories`, which Claude Code reads
+ * as symlink targets — an escaping path would point a worktree symlink outside
+ * the repo, so a workspace glob is never trusted to stay inside on its own.
+ */
+function isInside(targetDir, rel) {
+    const outward = path.relative(path.resolve(targetDir), path.resolve(targetDir, rel));
+    return outward !== '' && !outward.startsWith('..') && !path.isAbsolute(outward);
+}
+/**
+ * The repo's own workspace globs, from `pnpm-workspace.yaml` and/or
+ * package.json `workspaces` (both array and `{ packages: [] }` forms). Both
+ * are read because a pnpm repo can keep its globs in either file.
+ *
+ * Negations (`!apps/x`) are dropped, and so is anything absolute or containing
+ * a `..` segment: a `packages: - '../shared-lib'` entry reads as plausible in a
+ * monorepo but would write an out-of-repo symlink target into settings.json.
+ */
+async function workspaceGlobs(targetDir) {
+    const yamlFile = path.join(targetDir, 'pnpm-workspace.yaml');
+    const yaml = (await fs.pathExists(yamlFile)) ? await fs.readFile(yamlFile, 'utf-8') : '';
+    const pkg = asObject(await fs.readJson(path.join(targetDir, 'package.json')).catch(() => null));
+    const field = Array.isArray(pkg?.workspaces)
+        ? pkg.workspaces
+        : asObject(pkg?.workspaces)?.packages;
+    const declared = Array.isArray(field) ? field : [];
+    return [...parseWorkspacePackages(yaml), ...declared].filter((g) => typeof g === 'string' &&
+        !g.startsWith('!') &&
+        !path.isAbsolute(g) &&
+        !g.split(/[\\/]/).includes('..'));
+}
+/**
+ * The nested `<workspace>/node_modules` to symlink alongside the root one
+ * (#406). Without them a workspace-scoped command in a fresh worktree fails on
+ * a missing binary — `pnpm --filter <pkg> build` can't find its bin shims —
+ * which reads as a broken toolchain rather than a missing symlink.
+ *
+ * Derived from the repo's own workspace globs, never a hardcoded layout: this
+ * is a public CLI and every consumer nests its packages differently.
+ * Workspaces with no `node_modules` in the main checkout are skipped, because
+ * an entry pointing at nothing warns on every worktree creation.
+ */
+export async function workspaceSymlinkDirs(targetDir) {
+    const globs = await workspaceGlobs(targetDir);
+    if (globs.length === 0)
+        return [];
+    const found = [];
+    for await (const match of glob(globs.map((g) => `${g}/node_modules`), { cwd: targetDir })) {
+        // Belt and braces: the glob result is what actually gets written, so it is
+        // re-checked for containment even though the input globs were filtered.
+        if (isInside(targetDir, match))
+            found.push(match.split(path.sep).join('/'));
+    }
+    return found.sort();
+}
 /** Parsed `.claude/settings.json`, or null when absent, malformed, or not an object. */
 export async function readClaudeSettings(targetDir) {
     try {
@@ -74,10 +132,8 @@ export async function installClaudeSettings(targetDir) {
     if (!settings)
         return null;
     const existing = worktreeSymlinkDirs(settings);
-    const symlinkDirectories = [
-        ...existing,
-        ...WORKTREE_SYMLINK_DIRS.filter((d) => !existing.includes(d)),
-    ];
+    const wanted = [...WORKTREE_SYMLINK_DIRS, ...(await workspaceSymlinkDirs(targetDir))];
+    const symlinkDirectories = [...existing, ...wanted.filter((d) => !existing.includes(d))];
     const worktree = { ...asObject(settings.worktree), symlinkDirectories };
     await fs.outputJson(file, { ...settings, worktree }, { spaces: 2 });
     return CLAUDE_SETTINGS_FILE;

package/dist/cli/generators/misc.js

@@ -256,7 +256,7 @@ export async function ensurePackageManager(targetDir, version = detectPnpmVersio
  * YAML dependency. Matches `- 'apps/*'` / `- "apps/*"` / `- apps/*` entries
  * under the `packages:` key, stopping at the next top-level key.
  */
-function parseWorkspacePackages(yaml) {
+export function parseWorkspacePackages(yaml) {
     const globs = [];
     let inPackages = false;
     for (const line of yaml.split('\n')) {

package/dist/languages/js/checks.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import fs from 'fs-extra';
 import { hookHasUncommented } from '../../base/checks.js';
-import { CLAUDE_SETTINGS_FILE, readClaudeSettings, worktreeSymlinkDirs, } from '../../cli/generators/agent-rules.js';
+import { CLAUDE_SETTINGS_FILE, readClaudeSettings, workspaceSymlinkDirs, worktreeSymlinkDirs, } from '../../cli/generators/agent-rules.js';
 import { WORKSPACE_FILE, dependsOnEsbuild, familyGlob, missingPnpmSettings, } from '../../cli/generators/pnpm-workspace.js';
 const PACKAGE = '@rtorcato/repo-tooling';
 const NODE_MIN_MAJOR = 22;
@@ -980,13 +980,20 @@ export async function checkClaudeWorktreeSettings(dir) {
             hint: `Repair the JSON in ${CLAUDE_SETTINGS_FILE} by hand — \`fix ai\` refuses to overwrite it`,
         };
     }
-    if (worktreeSymlinkDirs(settings).includes('node_modules')) {
-        return { check, status: 'ok', detail: 'worktree.symlinkDirectories carries node_modules' };
+    const recorded = worktreeSymlinkDirs(settings);
+    const wanted = ['node_modules', ...(await workspaceSymlinkDirs(dir))];
+    const missing = wanted.filter((d) => !recorded.includes(d));
+    if (missing.length === 0) {
+        return {
+            check,
+            status: 'ok',
+            detail: `worktree.symlinkDirectories carries ${wanted.join(', ')}`,
+        };
     }
     return {
         check,
         status: 'optional-missing',
-        detail: `${CLAUDE_SETTINGS_FILE} has no worktree.symlinkDirectories entry for node_modules`,
+        detail: `${CLAUDE_SETTINGS_FILE} has no worktree.symlinkDirectories entry for ${missing.join(', ')}`,
         hint,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.10.0",
+	"version": "3.10.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [

package/skills/ai-issue-loop/SKILL.md

@@ -32,13 +32,14 @@ the protected branch — it would deadlock every PR.
 
 **If you ever switch to real approvals** — a second GitHub account reviewing as
 someone else, so `--approve` works and the `ai-ok-*` labels become unnecessary —
-know that `@rtorcato/repo-tooling` will fight you. Its `GITHUB_STANDARD`
-(`src/base/github-settings.ts`) treats any `required_pull_request_reviews` as
-drift because required review deadlocks solo Dependabot auto-merge, and
-`fix github-settings` silently PUTs it back to `null`. So the next unrelated
-`doctor`/`fix` run would strip your approval rule and hand merges back to the
-labels, with nothing in the output tying it to this pipeline. Change the standard
-there first, or don't go down that path.
+first check what else writes your branch protection. Any repo-settings tool that
+treats `required_pull_request_reviews` as drift will PUT it back to `null` on its
+next run, because required review deadlocks solo Dependabot auto-merge. Your
+approval rule vanishes, merges hand themselves back to the labels, and nothing in
+that tool's output ties the change to this pipeline. `@rtorcato/repo-tooling`,
+which ships this skill, is one such tool — its repo-settings standard asserts
+`required_pull_request_reviews: null`, so change that standard before you rely on
+real approvals.
 
 The same constraint makes everything an agent posts *look* hand-written by the
 owner. So **every comment any agent leaves — review, blocked, gave-up, declined —