@rtorcato/repo-tooling 3.10.1 → 3.11.0

package/dist/base/fixers.js

@@ -27,6 +27,23 @@ import { detectLanguage } from '../cli/utils/detect-language.js';
 import { resolveLanguageModule } from '../languages/registry.js';
 import { applyGithubSettings } from './github-settings.js';
 import { closeCompletedMilestones } from './milestones.js';
+/**
+ * A fixer giving up on something the user has to resolve — a wrong flag, not a
+ * crash. Thrown rather than printed-and-exited because a fixer runs underneath
+ * `--json`: only the command layer knows whether the failure should surface as
+ * an error payload on stdout or a red line on stderr. `code` joins the same
+ * vocabulary as the command's own `no-lockfile` / `unknown-target` errors.
+ */
+export class FixerAbort extends Error {
+    code;
+    hint;
+    constructor(code, message, hint) {
+        super(message);
+        this.code = code;
+        this.hint = hint;
+        this.name = 'FixerAbort';
+    }
+}
 /** The repo's language module, resolved from its marker files. */
 async function moduleFor(targetDir) {
     return resolveLanguageModule(await detectLanguage(targetDir));
@@ -34,16 +51,17 @@ async function moduleFor(targetDir) {
 /**
  * Where to install user-global skills, asking only when nothing resolves. Under
  * `--yes` / `--json` a prompt is not available — `--json` would have its payload
- * corrupted by one — so an unresolvable destination becomes an advisory and a
- * no-op rather than a guess at a directory the user never mentioned.
+ * corrupted by one — and guessing at a directory the user never mentioned is not
+ * an option either, so the run fails: `--skills-dir` is required in that case
+ * (#411). It used to warn and no-op, which exited 0 with an empty `filesWritten`
+ * that no `--json` consumer could tell apart from "already up to date".
  */
 async function resolveInstallDir(explicit, assumeYes) {
     const { dir } = await resolveSkillsDir(explicit);
     if (dir)
         return dir;
     if (assumeYes) {
-        console.error(chalk.yellow('   skipped — no ~/.claude/skills found; pass --skills-dir <path>'));
-        return null;
+        throw new FixerAbort('no-skills-dir', 'no ~/.claude/skills found, and --yes/--json cannot prompt for one', 'pass --skills-dir <path>');
     }
     const { answer } = await inquirer.prompt([
         {

package/dist/base/github-settings.js

@@ -115,7 +115,15 @@ async function probeRepo(exec) {
             autoMerge: d.allow_auto_merge === true,
             squashMerge: d.allow_squash_merge === true,
             deleteOnMerge: d.delete_branch_on_merge === true,
-            mergeVisible: ['allow_auto_merge', 'allow_squash_merge', 'delete_branch_on_merge'].every((k) => typeof d[k] === 'boolean'),
+            mergeCommit: d.allow_merge_commit === true,
+            rebaseMerge: d.allow_rebase_merge === true,
+            mergeVisible: [
+                'allow_auto_merge',
+                'allow_squash_merge',
+                'delete_branch_on_merge',
+                'allow_merge_commit',
+                'allow_rebase_merge',
+            ].every((k) => typeof d[k] === 'boolean'),
         },
     };
 }
@@ -197,6 +205,16 @@ async function checkBranchProtection(exec, nwo, branch) {
         };
     return { check, status: 'ok', detail: `${branch} protected per standard` };
 }
+/**
+ * Squash is required *and exclusive* (#410). Leaving merge-commit or rebase
+ * enabled only makes them available on the merge button, and one mis-click puts
+ * every intermediate branch commit on the default branch: semantic-release then
+ * reads subjects nobody reviewed (a stray `fix:` inside a docs PR cuts a
+ * release), and `ai-issue-loop`'s Pass 2 stops finding the `(#N)` squash subject
+ * it uses to confirm work landed, so worktrees leak. Observed on `js-common`
+ * #204, whose CONTRIBUTING already said squash-only — the rule existed, nothing
+ * enforced it.
+ */
 function checkMergeSettings(info) {
     const check = 'Merge settings';
     // The token can't see the merge-setting fields (no admin:read) — skip rather
@@ -210,14 +228,18 @@ function checkMergeSettings(info) {
         deltas.push('squash-merge disabled');
     if (!info.deleteOnMerge)
         deltas.push('delete-branch-on-merge disabled');
+    if (info.mergeCommit)
+        deltas.push('merge commits allowed (squash only)');
+    if (info.rebaseMerge)
+        deltas.push('rebase merging allowed (squash only)');
     if (deltas.length)
         return {
             check,
             status: 'drift',
             detail: deltas.join('; '),
-            hint: 'Enable auto-merge, squash-merge, and delete-branch-on-merge in repo settings',
+            hint: 'Enable auto-merge and delete-branch-on-merge, and make squash the only merge method',
         };
-    return { check, status: 'ok', detail: 'auto-merge, squash-merge, delete-on-merge all on' };
+    return { check, status: 'ok', detail: 'squash-only, auto-merge and delete-on-merge on' };
 }
 async function checkWorkflowPermissions(exec, nwo) {
     const check = 'Workflow permissions';
@@ -370,7 +392,7 @@ export function buildGhApplyCommands(state) {
     const commands = [];
     if (state.merge)
         commands.push({
-            label: 'merge settings (auto-merge, squash, delete-on-merge)',
+            label: 'merge settings (squash-only, auto-merge, delete-on-merge)',
             args: [
                 'api',
                 '-X',
@@ -382,6 +404,10 @@ export function buildGhApplyCommands(state) {
                 'allow_squash_merge=true',
                 '-F',
                 'delete_branch_on_merge=true',
+                '-F',
+                'allow_merge_commit=false',
+                '-F',
+                'allow_rebase_merge=false',
             ],
         });
     if (state.protection)

package/dist/cli/commands/fix.js

@@ -9,7 +9,7 @@ import { LOCKFILE_NAME, readLockfile, updateLockfileConfig, writeLockfile, } fro
 import { runDoctor } from './doctor.js';
 import { declinedInLock, lockfilePatchForTarget } from './fix-targets.js';
 import { computeFileList } from './setup-presets.js';
-import { BASE_FIXERS } from '../../base/fixers.js';
+import { BASE_FIXERS, FixerAbort, } from '../../base/fixers.js';
 import { FIXERS, readPackageJson } from '../../languages/js/fixers.js';
 import { PERL_FIXERS } from '../../languages/perl/fixers.js';
 import { PYTHON_FIXERS } from '../../languages/python/fixers.js';
@@ -398,9 +398,25 @@ export async function fixCommand(target, options = {}) {
             console.log(chalk.gray('   skipped\n'));
             return;
         }
+        // ponytail: only the targeted path is guarded, because the only fixer that
+        // aborts is `claude-skills` and it is explicitOnly — the bulk loop below
+        // cannot reach it. A non-explicitOnly fixer that throws FixerAbort would
+        // surface as an unhandled rejection there; guard the loop when one exists.
         const outcome = await applyFixer(fixer, effectiveResult, targetDir, pkg, lock, dryRun, silent, {
             skillsDir: options.skillsDir,
             assumeYes,
+        }).catch((err) => {
+            if (!(err instanceof FixerAbort))
+                throw err;
+            if (json) {
+                console.log(JSON.stringify({ directory: targetDir, target: fixer.target, error: err.code, hint: err.hint }, null, 2));
+            }
+            else {
+                console.error(chalk.red(`\n❌ ${fixer.target}: ${err.message}`));
+                if (err.hint)
+                    console.error(chalk.gray(`   ${err.hint}\n`));
+            }
+            process.exit(1);
         });
         actions.push(recordFor(fixer.target, result.check, effectiveResult.status, outcome.dryRun ? 'dry-run' : 'applied', outcome.filesWritten, conflict));
         if (json)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.10.1",
+	"version": "3.11.0",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [

package/skills/ai-issue-loop/SKILL.md

@@ -32,13 +32,14 @@ the protected branch — it would deadlock every PR.
 
 **If you ever switch to real approvals** — a second GitHub account reviewing as
 someone else, so `--approve` works and the `ai-ok-*` labels become unnecessary —
-know that `@rtorcato/repo-tooling` will fight you. Its `GITHUB_STANDARD`
-(`src/base/github-settings.ts`) treats any `required_pull_request_reviews` as
-drift because required review deadlocks solo Dependabot auto-merge, and
-`fix github-settings` silently PUTs it back to `null`. So the next unrelated
-`doctor`/`fix` run would strip your approval rule and hand merges back to the
-labels, with nothing in the output tying it to this pipeline. Change the standard
-there first, or don't go down that path.
+first check what else writes your branch protection. Any repo-settings tool that
+treats `required_pull_request_reviews` as drift will PUT it back to `null` on its
+next run, because required review deadlocks solo Dependabot auto-merge. Your
+approval rule vanishes, merges hand themselves back to the labels, and nothing in
+that tool's output ties the change to this pipeline. `@rtorcato/repo-tooling`,
+which ships this skill, is one such tool — its repo-settings standard asserts
+`required_pull_request_reviews: null`, so change that standard before you rely on
+real approvals.
 
 The same constraint makes everything an agent posts *look* hand-written by the
 owner. So **every comment any agent leaves — review, blocked, gave-up, declined —
@@ -805,10 +806,14 @@ times against one trivial issue and watch the labels advance.
 ## Repo prerequisites
 
 ```bash
-gh api repos/$OWNER_REPO --jq '{allow_squash_merge, allow_auto_merge, delete_branch_on_merge}'
+gh api repos/$OWNER_REPO --jq '{allow_squash_merge, allow_merge_commit, allow_rebase_merge, allow_auto_merge, delete_branch_on_merge}'
 gh api repos/$OWNER_REPO/branches/main/protection --jq '{contexts: .required_status_checks.contexts, reviews: .required_pull_request_reviews}'
 ```
 
-Need: squash + auto-merge + delete-on-merge all true, at least one required
-status check, and `required_pull_request_reviews: null`. See the
-`github-pr-workflow` skill for the one-time bootstrap.
+Need: auto-merge + delete-on-merge + squash all true, **`allow_merge_commit` and
+`allow_rebase_merge` both false**, at least one required status check, and
+`required_pull_request_reviews: null`. Squash has to be the *only* method, not
+merely an available one: Pass 2 confirms a PR landed by finding its `(#N)` squash
+subject on `main`, and a merge commit leaves nothing to find — the worktree then
+survives every tick and its `ai-wip` slot leaks. See the `github-pr-workflow`
+skill for the one-time bootstrap.