@rtorcato/repo-tooling 3.15.3 → 3.16.1

package/AGENTS.md

@@ -14,7 +14,7 @@ Every command supports `--json` and a non-interactive mode. Combine with `--yes`
 
 | Command | Non-interactive | JSON output | Use case |
 |---|---|---|---|
-| `setup --preset <name>` | ✅ | `--dry-run` only | Scaffold a new project. Presets: `library`, `web-app`, `node-api`, `nextjs-app`, `react-app`, `swift-library`. |
+| `setup --preset <name>` | ✅ (non-TTY, or with `--yes`) | `--dry-run` only | Scaffold a new project. Presets: `minimal`, `library`, `web-app`, `node-api`, `nextjs-app`, `react-app`, `swift-library`. In an interactive terminal it first prints the file list and lets you deselect; pass `--yes` for the one-shot behaviour. |
 | `setup --config <path>` | ✅ | `--dry-run` only | Scaffold with a full `ProjectConfig` JSON file. See `setup --config-schema`. |
 | `setup --config-schema` | ✅ | ✅ (JSON Schema) | Print the JSON Schema for `ProjectConfig`. Use to validate configs before scaffolding. |
 | `setup --dry-run` | ✅ | ✅ | Print resolved config + file list without writing. Pair with `--preset` or `--config`. |
@@ -110,7 +110,7 @@ A fixer may also **refuse** — the target file holds something the generator ca
 ## Conventions in this repo
 
 - Conventional commits enforced via commitlint; header max 100 chars, body/footer line length unenforced
-- Biome for lint + format (run via `pnpm exec biome check --config-path=tooling/biome/biome.json src scripts`)
+- Biome for lint + format (run via `pnpm run check`, i.e. `biome check .` over the whole repo — the same script this package emits to consumers)
 - Tests live alongside source in `tests/`; vitest with no separate config
 - semantic-release runs on push to `main`; `fix:` → patch, `feat:` → minor, `chore:` / `docs:` → no release
 

package/README.md

@@ -35,10 +35,16 @@ npx @rtorcato/repo-tooling setup
 Non-interactive — scaffold from a named preset in one shot (CI-friendly):
 
 ```bash
-npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install
-# presets: library | web-app | node-api | nextjs-app | react-app | swift-library
+npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install --yes
+# presets: minimal | library | web-app | node-api | nextjs-app | react-app | swift-library
 ```
 
+Run without `--yes` in a terminal and the preset first prints every file it would
+write and lets you uncheck the parts you don't want (git hooks, commitlint,
+releases, Dependabot/CodeQL, badges, AI agent rules). Piped or redirected — CI —
+it writes everything in one shot, exactly as before. `minimal` is tsconfig +
+Biome + Vitest and nothing else.
+
 `swift-library` scaffolds a SwiftPM package (manifest, sources, tests, SwiftLint,
 Periphery, macOS CI) instead of an npm one — see the
 [Swift guide](https://rtorcato.github.io/repo-tooling/guides/swift).

package/dist/base/checks.js

@@ -266,6 +266,12 @@ export async function checkDependabot(dir) {
                 if (!automerge.includes("steps.gate.outputs.safe == 'true'")) {
                     deltas.push('auto-merge workflow trusts the dev-minor group name (missing peerDependencies check)');
                 }
+                // #452: a repo that took the #423 pair has CI action bumps waiting on a
+                // human for no benefit — they reach no consumer. Drift in the
+                // convenience direction, not the safety one, but still drift.
+                if (!automerge.includes("package-ecosystem == 'github-actions'")) {
+                    deltas.push('auto-merge workflow leaves CI action bumps to a human (#452)');
+                }
             }
             else {
                 deltas.push('missing dependabot-automerge workflow');

package/dist/cli/commands/setup-presets.js

@@ -1,6 +1,7 @@
 import { swiftFileList } from '../../languages/swift/scaffold.js';
 import { BIOME_CONFIG } from '../generators/linting.js';
 export const PRESET_NAMES = [
+    'minimal',
     'library',
     'web-app',
     'node-api',
@@ -22,6 +23,33 @@ const BASE = {
 };
 export function buildPresetConfig(name, projectName) {
     switch (name) {
+        // tsconfig + biome + vitest, nothing else (#461). Deliberately not spread
+        // from BASE: BASE hardcodes git hooks, commitlint, security automation,
+        // badges and the AI agent files, and every other case only ever adds to
+        // it — so no preset built on BASE can produce a small repo.
+        //
+        // `node-api` is the only projectType that adds nothing of its own:
+        // `library` would pull in publint, attw, a size-limit budget and a
+        // dist/-rooted exports map that `bundler: 'none'` never builds, and the
+        // three app types each seed a framework. It says "plain Node package",
+        // which is what this preset scaffolds.
+        case 'minimal':
+            return {
+                projectName,
+                language: 'js',
+                projectType: 'node-api',
+                typescript: { enabled: true, config: 'base' },
+                linting: { tool: 'biome' },
+                formatting: { tool: 'biome' },
+                testing: { framework: 'vitest', environment: 'node' },
+                gitHooks: false,
+                commitLint: false,
+                semanticRelease: false,
+                securityAutomation: false,
+                bundler: 'none',
+                badges: false,
+                aiSetup: false,
+            };
         case 'library':
             return {
                 ...BASE,
@@ -208,7 +236,7 @@ export function computeFileList(config) {
     if (config.language === 'swift')
         return swiftFileList(config);
     const files = ['package.json', '.repo-tooling.json'];
-    files.push('.editorconfig', '.nvmrc', 'knip.json', '.vscode/extensions.json');
+    files.push('.editorconfig', '.nvmrc', '.gitignore', 'knip.json', '.vscode/extensions.json');
     if (config.typescript.enabled) {
         files.push('tsconfig.json', 'reset.d.ts');
     }
@@ -238,7 +266,7 @@ export function computeFileList(config) {
         files.push('cypress.config.ts', 'cypress/support/e2e.ts', 'cypress/support/commands.ts', 'tests/e2e/example.cy.ts');
     }
     if (config.gitHooks) {
-        files.push('.husky/pre-commit', '.gitignore');
+        files.push('.husky/pre-commit');
     }
     if (config.commitLint) {
         files.push('.husky/commit-msg', 'commitlint.config.mjs');

package/dist/cli/commands/setup.js

@@ -9,6 +9,60 @@ import { formatGeneratedFiles } from '../utils/format.js';
 import { installDependencies } from '../utils/install.js';
 import { LOCKFILE_NAME, writeLockfile } from '../utils/lockfile.js';
 import { buildPresetConfig, computeFileList, CONFIG_SCHEMA, PRESET_NAMES, validateProjectConfig, } from './setup-presets.js';
+/**
+ * The opinionated extras a preset turns on, in the order they're offered for
+ * review. Each one writes files (or a README block) the user never asked for by
+ * name, which is the complaint in #461.
+ */
+const REVIEWABLE_FEATURES = [
+    { key: 'gitHooks', label: 'Git hooks (Husky + lint-staged)' },
+    { key: 'commitLint', label: 'Conventional commit linting (commitlint)' },
+    { key: 'semanticRelease', label: 'Automated releases (semantic-release)' },
+    { key: 'securityAutomation', label: 'Security automation (Dependabot + CodeQL)' },
+    { key: 'badges', label: 'README status badges' },
+    { key: 'aiSetup', label: 'AI agent rules (AGENTS.md, CLAUDE.md, Cursor, Copilot)' },
+];
+/**
+ * A preset run may only ask questions when a human is on both ends of the pipe.
+ * Redirect either direction and this is CI — the case `--preset` exists for —
+ * where the one-shot behaviour has to stay exactly as it was.
+ */
+function isInteractiveTerminal() {
+    return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+/**
+ * Show what the preset resolved to and let the user drop parts of it before a
+ * single file is written (#461).
+ */
+async function reviewPresetConfig(config) {
+    const files = computeFileList(config);
+    console.log(chalk.cyan(`\n📄 This preset writes ${files.length} files:\n`));
+    for (const file of files)
+        console.log(chalk.gray(`   ${file}`));
+    console.log();
+    const enabled = REVIEWABLE_FEATURES.filter((feature) => config[feature.key] === true);
+    if (enabled.length === 0)
+        return config;
+    const { features } = await inquirer.prompt([
+        {
+            type: 'checkbox',
+            name: 'features',
+            message: '🧹 Uncheck anything you do not want:',
+            choices: enabled.map((feature) => ({
+                name: feature.label,
+                value: feature.key,
+                checked: true,
+            })),
+        },
+    ]);
+    const kept = new Set(features);
+    const reviewed = { ...config };
+    for (const feature of enabled) {
+        if (!kept.has(feature.key))
+            reviewed[feature.key] = false;
+    }
+    return reviewed;
+}
 /** `null` means the run was declined, not that it failed — see promptForConfig. */
 async function resolveConfig(options) {
     if (options.config && options.preset) {
@@ -38,7 +92,10 @@ async function resolveConfig(options) {
             throw new Error(`Unknown preset: ${options.preset}. Available: ${PRESET_NAMES.join(', ')}`);
         }
         const projectName = path.basename(path.resolve(options.directory));
-        return buildPresetConfig(options.preset, projectName);
+        const config = buildPresetConfig(options.preset, projectName);
+        if (options.dryRun || options.yes || !isInteractiveTerminal())
+            return config;
+        return reviewPresetConfig(config);
     }
     return promptForConfig(path.resolve(options.directory));
 }

package/dist/cli/generators/index.js

@@ -53,10 +53,11 @@ export async function generateConfigs(config, targetDir) {
     if (config.testing.framework !== 'none') {
         await generateTestingConfigs(config, targetDir);
     }
-    // Generate git configurations
-    if (config.gitHooks || config.commitLint) {
-        await generateGitConfigs(config, targetDir);
-    }
+    // Unconditional: generateGitConfigs already gates husky and commitlint on
+    // their own flags, and the .gitignore it also writes has nothing to do with
+    // either. Gating the whole call meant any scaffold that declined git hooks —
+    // which is every `minimal` run (#461) — got no .gitignore at all.
+    await generateGitConfigs(config, targetDir);
     // Generate GitHub Actions workflow
     await generateGitHubActions(config, targetDir);
     // Generate security automation (Dependabot + CodeQL)

package/dist/cli/generators/linting.js

@@ -35,55 +35,17 @@ export const BIOME_CONFIG = 'biome.json';
  */
 export const BIOME_LEGACY_CONFIG = 'biome.jsonc';
 /**
- * Used when nothing in the target repo says which Biome will read the config —
- * a bare directory mid-`setup`, before `pnpm install` has run. Matches the
- * `$schema` the shipped preset carries.
- */
-const BIOME_SCHEMA_FALLBACK = '2.5.0';
-async function readJsonOrNull(filepath) {
-    try {
-        return (await fs.readJson(filepath));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * The `@biomejs/biome` actually installed under `targetDir`, or null when
- * node_modules isn't populated. This is the binary that will parse the config
- * and emit the schema-mismatch warning, so it is the only version worth
- * comparing a written `$schema` against — a declared range like `^2.5.0` says
- * nothing about which 2.x resolved (#424).
- */
-export async function installedBiomeVersion(targetDir) {
-    const installed = await readJsonOrNull(path.join(targetDir, 'node_modules', '@biomejs', 'biome', 'package.json'));
-    const match = typeof installed?.version === 'string' ? /(\d+\.\d+\.\d+)/.exec(installed.version) : null;
-    return match?.[1] ?? null;
-}
-/**
- * The Biome version the scaffolded `$schema` URL should name (#363).
+ * Unversioned on purpose (#468). A `$schema` naming an exact version is only
+ * ever right until the next `@biomejs/biome` bump, at which point Biome prints
+ * "The configuration schema version does not match the CLI version" on every
+ * invocation and doctor reports drift — so every Dependabot bump needed a hand
+ * edit before it could go green. Biome accepts `latest` and says nothing about
+ * it (verified against 2.5.5), which removes the failure class outright.
  *
- * A hardcoded version drifts the moment the consumer's Biome moves, and Biome
- * reports the mismatch on *every* invocation ("The configuration schema version
- * does not match the CLI version 2.5.7") — noise on a file the consumer never
- * wrote. The installed package wins because it is literally the binary that
- * will parse the file and emit that warning; the declared range is the next
- * best statement of intent when node_modules isn't populated yet.
+ * `latest` rather than dropping the key: editors still resolve a real schema
+ * for autocomplete and validation, which is the only reason the key is there.
  */
-export async function resolveBiomeSchemaVersion(targetDir) {
-    const installed = await installedBiomeVersion(targetDir);
-    if (installed)
-        return installed;
-    const pkg = await readJsonOrNull(path.join(targetDir, 'package.json'));
-    const deps = {
-        ...(pkg?.dependencies ?? {}),
-        ...(pkg?.devDependencies ?? {}),
-    };
-    // A range ("^2.5.0") carries the x.y.z we need just as an exact version does.
-    const declared = deps['@biomejs/biome'];
-    const match = typeof declared === 'string' ? /(\d+\.\d+\.\d+)/.exec(declared) : null;
-    return match?.[1] ?? BIOME_SCHEMA_FALLBACK;
-}
+const BIOME_SCHEMA_URL = 'https://biomejs.dev/schemas/latest/schema.json';
 /**
  * The thin pointer config — the same shape this repo dogfoods. `fix biome` used
  * to copy the whole preset inline instead, which meant the scaffolded file
@@ -95,9 +57,8 @@ export async function generateBiomeConfig(targetDir) {
     // file globs via `files.includes`; emitting the old 1.x `include`/`ignore`
     // keys here forced consumers to run `biome migrate` before `biome check`
     // would run at all.
-    const version = await resolveBiomeSchemaVersion(targetDir);
     const biomeConfig = {
-        $schema: `https://biomejs.dev/schemas/${version}/schema.json`,
+        $schema: BIOME_SCHEMA_URL,
         extends: ['@rtorcato/repo-tooling/biome'],
     };
     await fs.writeJson(path.join(targetDir, BIOME_CONFIG), biomeConfig, { spaces: 2 });

package/dist/cli/generators/security.js

@@ -123,13 +123,20 @@ export function dependabotIgnoreRules(content) {
     return rules;
 }
 /**
- * Auto-merges patch + minor Dependabot PRs **from the `dev-minor` group only**
- * once CI is green. Requires branch protection with required status checks on
- * the target branch — without it, \`gh pr merge --auto\` never fires.
+ * Auto-merges patch + minor Dependabot PRs from the \`dev-minor\` group **and the
+ * \`github-actions\` ecosystem** once CI is green. Requires branch protection with
+ * required status checks on the target branch — without it, \`gh pr merge --auto\`
+ * never fires.
  *
  * Everything else falls through to a human: production bumps ship to consumers
  * of a published package (#423), majors are breaking by definition, and an
- * ungrouped PR reports an empty \`dependency-group\`, so the gate fails closed.
+ * ungrouped npm PR reports an empty \`dependency-group\`, so the gate fails closed.
+ *
+ * CI action bumps are the one ungrouped case that is allowed through, matched on
+ * \`package-ecosystem\` (#452): they reach no consumer of the published package
+ * and land as \`ci(deps): …\`, which cuts no release. The counter-argument is real
+ * — a compromised action runs in CI holding \`GITHUB_TOKEN\` — so the majors
+ * exclusion and required status checks are doing the work here.
  *
  * The group name is the one \`dependabotConfig()\` writes — the two files are a
  * paired unit and have to move together.
@@ -201,10 +208,17 @@ jobs:
       # Belt and braces: the dev-minor group is already declared minor+patch in
       # dependabot.yml, but this workflow is the security gate and shouldn't
       # trust a config file a consumer repo can edit independently.
-      - name: Auto-merge dev-dependency patch and minor updates
+      #
+      # github-actions bumps are ungrouped, so they report an empty
+      # dependency-group and are matched by ecosystem instead (#452). They reach
+      # no consumer of the published package, and their squash subject is
+      # "ci(deps): …", which cuts no release. Majors still fall through to a
+      # human — the update-type clause below applies to them too.
+      - name: Auto-merge dev-dependency and CI action patch and minor updates
         if: |
           steps.gate.outputs.safe == 'true' &&
-          steps.metadata.outputs.dependency-group == 'dev-minor' &&
+          (steps.metadata.outputs.dependency-group == 'dev-minor' ||
+          steps.metadata.outputs.package-ecosystem == 'github-actions') &&
           (steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
           steps.metadata.outputs.update-type == 'version-update:semver-minor')
         run: gh pr merge --auto --squash "$PR_URL"

package/dist/cli/index.js

@@ -29,6 +29,7 @@ program
     .option('-d, --directory <path>', 'Target directory for setup', process.cwd())
     .option('--skip-install', 'Skip installing dependencies')
     .option('--preset <name>', 'Skip prompts; use defaults for a project type')
+    .option('-y, --yes', 'With --preset in a terminal, skip the file-list review and write everything')
     .option('--config <path>', 'Skip prompts; read a ProjectConfig or .repo-tooling.json lockfile from <path>')
     .option('--dry-run', 'Print the resolved config and file list, write nothing')
     .option('--config-schema', 'Print the JSON Schema for ProjectConfig and exit')

package/dist/languages/js/checks.js

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import fs from 'fs-extra';
 import { checkFile, hookHasUncommented } from '../../base/checks.js';
-import { installedBiomeVersion } from '../../cli/generators/linting.js';
 import { CLAUDE_SETTINGS_FILE, readClaudeSettings, workspaceSymlinkDirs, worktreeSymlinkDirs, } from '../../cli/generators/agent-rules.js';
 import { WORKSPACE_FILE, dependsOnEsbuild, familyGlob, missingPnpmSettings, } from '../../cli/generators/pnpm-workspace.js';
 const PACKAGE = '@rtorcato/repo-tooling';
@@ -163,38 +162,38 @@ export const BIOME_FILE_CHECK = {
 };
 /**
  * The Biome check plus the one thing a contents-only matcher can't see: whether
- * the `$schema` URL still names the Biome that will read it (#424).
+ * the `$schema` URL still pins a version (#424, #468).
  *
- * `fix biome` writes the URL from the version resolved at scaffold time, and
- * nothing re-checked it afterwards — so once the repo's Biome moved on, every
- * single invocation (the pre-commit hook included) printed "The configuration
- * schema version does not match the CLI version", while doctor stayed clean.
+ * It began as a drift check — the URL named the Biome resolved at scaffold
+ * time, nothing re-checked it, and once the repo's Biome moved on every single
+ * invocation (the pre-commit hook included) printed "The configuration schema
+ * version does not match the CLI version" while doctor stayed clean.
  *
- * Compared against the *installed* package only, never the declared range: an
- * exact match is what Biome itself demands, and `^2.5.0` doesn't say which 2.x
- * resolved. With no node_modules there is nothing to be wrong about, so the
- * check says nothing rather than guessing.
+ * Chasing the installed version was treating the symptom: an exact pin is
+ * *only ever* correct until the next bump, so every `@biomejs/biome` update
+ * failed the build until someone hand-edited a URL. `fix biome` now writes the
+ * unpinned `latest`, and this reads as a migration signal instead — any
+ * surviving pin is a repo that predates the unpinning, whatever version it
+ * names. That makes it independent of node_modules, so it also fires on a
+ * fresh clone, and it goes quiet for good once the repo is migrated.
  */
 export async function checkBiome(dir) {
     const result = await checkFile(dir, BIOME_FILE_CHECK);
     if (result.status !== 'ok')
         return result;
-    const installed = await installedBiomeVersion(dir);
-    if (!installed)
-        return result;
     // The same candidate checkFile settled on — first one that exists wins.
     for (const candidate of BIOME_FILE_CHECK.candidates) {
         const filepath = path.join(dir, candidate);
         if (!(await fs.pathExists(filepath)))
             continue;
         const url = readSchemaUrl(await fs.readFile(filepath, 'utf8'));
-        const targeted = url?.includes('biomejs.dev') ? schemaUrlVersion(url)?.join('.') : null;
-        if (targeted && targeted !== installed) {
+        const pinned = url?.includes('biomejs.dev') ? schemaUrlVersion(url)?.join('.') : null;
+        if (pinned) {
             return {
                 check: BIOME_FILE_CHECK.check,
                 status: 'drift',
-                detail: `${candidate} targets Biome ${targeted} but @biomejs/biome ${installed} is installed`,
-                hint: 'Run `npx @rtorcato/repo-tooling fix biome` to rewrite the $schema URL',
+                detail: `${candidate} pins Biome ${pinned} in $schema — the next @biomejs/biome bump past it breaks every Biome run`,
+                hint: 'Run `npx @rtorcato/repo-tooling fix biome` to drop the version from the $schema URL',
             };
         }
         return result;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.15.3",
+	"version": "3.16.1",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [
@@ -27,10 +27,10 @@
 		"dev": "pnpm --filter @rtorcato/docs dev",
 		"docs:build": "pnpm --filter @rtorcato/docs build",
 		"==================== Common ====================": "",
-		"lint": "pnpm exec biome lint --config-path=biome.json src scripts",
-		"format": "pnpm exec biome format --config-path=biome.json src scripts",
-		"check:fix": "pnpm exec biome check --config-path=biome.json --fix src scripts",
-		"check": "pnpm exec biome check --config-path=biome.json src scripts",
+		"lint": "pnpm exec biome lint .",
+		"format": "pnpm exec biome format .",
+		"check:fix": "pnpm exec biome check --fix .",
+		"check": "pnpm exec biome check .",
 		"prepare": "is-ci || husky",
 		"typecheck": "tsc --noEmit --project src/cli/tsconfig.json",
 		"test": "vitest",
@@ -237,15 +237,15 @@
 		"inquirer": "^14.0.2"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.5",
+		"@biomejs/biome": "^2.5.8",
 		"@types/diff": "^8.0.0",
-		"@commitlint/cli": "^21.2.1",
-		"@commitlint/config-conventional": "^21.2.0",
+		"@commitlint/cli": "^21.2.2",
+		"@commitlint/config-conventional": "^21.2.2",
 		"@commitlint/types": "^21.2.0",
 		"@eslint/js": "^10.0.1",
 		"@ianvs/prettier-plugin-sort-imports": "^4.4.2",
-		"@next/eslint-plugin-next": "^16.2.11",
-		"@playwright/test": "^1.62.0",
+		"@next/eslint-plugin-next": "^16.3.0",
+		"@playwright/test": "^1.62.1",
 		"@rollup/plugin-typescript": "^12.0.0",
 		"@semantic-release/commit-analyzer": "^13.0.1",
 		"@semantic-release/exec": "^7.1.0",
@@ -254,43 +254,43 @@
 		"@semantic-release/release-notes-generator": "^14.1.1",
 		"@total-typescript/ts-reset": "0.6.1",
 		"@types/fs-extra": "^11.0.4",
-		"@types/node": "^26.1.1",
-		"@typescript-eslint/eslint-plugin": "^8.65.0",
-		"@typescript-eslint/parser": "^8.65.0",
-		"@vitejs/plugin-react": "^6.0.4",
+		"@types/node": "^26.2.0",
+		"@typescript-eslint/eslint-plugin": "^8.67.0",
+		"@typescript-eslint/parser": "^8.67.0",
+		"@vitejs/plugin-react": "^6.0.5",
 		"@vitest/coverage-v8": "^4.1.10",
 		"commitizen": "^4.3.1",
-		"conventional-changelog-conventionalcommits": "^10.2.1",
+		"conventional-changelog-conventionalcommits": "^10.3.0",
 		"cz-conventional-changelog": "^3.3.0",
-		"esbuild": "^0.28.0",
+		"esbuild": "^0.28.2",
 		"esbuild-node-externals": "^2.0.0",
-		"eslint": "10.8.0",
+		"eslint": "10.8.1",
 		"eslint-plugin-import": "^2.32.0",
-		"eslint-plugin-jest": "29.16.0",
+		"eslint-plugin-jest": "29.16.1",
 		"husky": "^9.1.7",
 		"is-ci": "^4.1.0",
 		"jest": "^30.4.2",
 		"jsdom": "^30.0.1",
-		"knip": "^6.29.0",
+		"knip": "^6.32.2",
 		"prettier": "^3.9.6",
 		"rimraf": "6.1.3",
-		"rollup": "^4.62.0",
-		"semantic-release": "^25.0.8",
+		"rollup": "^4.62.4",
+		"semantic-release": "^25.0.9",
 		"ts-jest": "^29.4.12",
 		"tslib": "^2.8.0",
 		"tsup": "8.5.1",
 		"typescript": "^7.0.2",
-		"typescript-eslint": "^8.65.0",
+		"typescript-eslint": "^8.67.0",
 		"vitest": "^4.1.10"
 	},
 	"peerDependencies": {
 		"@biomejs/biome": "^2.5.0",
 		"@commitlint/cli": "^20.0.0 || ^21.0.0",
-		"@commitlint/config-conventional": "^21.2.0",
+		"@commitlint/config-conventional": "^21.2.2",
 		"@commitlint/types": "^21.2.0",
 		"@eslint/js": "^9.0.0",
 		"@ianvs/prettier-plugin-sort-imports": "^4.0.0",
-		"@next/eslint-plugin-next": "^16.2.11",
+		"@next/eslint-plugin-next": "^16.3.0",
 		"@rollup/plugin-typescript": "^12.0.0",
 		"@semantic-release/changelog": "^6.0.0",
 		"@semantic-release/commit-analyzer": "^13.0.0",

package/skills/ai-issue-loop/SKILL.md

@@ -52,6 +52,20 @@ header names the agent *and* says why it is wearing a human's face:
 
 `🤖 *Automated — <which agent> via ai-issue-loop. Posted under the owner's account by an agent; not a human message. There is no separate GitHub account for AI agents, so this appears under @<owner>'s avatar.*`
 
+**Comment budget: ≤10 lines, and a clean outcome gets no comment at all.** A
+40-line comment on every PR trains the reader to skip all of them, including the
+one that matters — the same failure mode as `ai-notes` on every PR, below. Link
+the reviewer's `### Before merging` rather than restating it; a paraphrase is
+drift with a second copy to maintain.
+
+| Outcome | Comment |
+|---|---|
+| Clean and ready | **None.** `ai-ok-code, ai-ok-sec` + assigned + no `ai-review` already says it. |
+| `ai-notes` | ≤10 lines; link the reviewer's `### Before merging`. |
+| `ai-changes`, CI red, `ai-blocked` | ≤10 lines, action first, then the specific cause. |
+| Reviewer verdict | `### Before merging` plus at most 3 short paragraphs above it. |
+| Declining an issue | The one exception — a hard handoff needs its reasoning; see Pass 4. |
+
 ## Labels
 
 | Label | On | Meaning |
@@ -250,7 +264,10 @@ It lands in the user's *Assigned to you* view, and the labels then read as state
 than noise — `ai-ok-code, ai-ok-sec` with no `ai-review` means **waiting on you**. Both
 halves matter: Pass 3 only ever *adds* the `ai-ok-*` labels, so without the removal a
 finished PR keeps wearing `ai-review` forever and looks mid-review. Idempotent, so
-re-running a tick is harmless. Take no other action — do not merge.
+re-running a tick is harmless. Take no other action — do not merge, and **post no
+comment**: nothing is wrong, so those three labels are the whole message. A
+comment is how the loop records what a label cannot; a clean PR has nothing to
+record.
 
 **Never strip `ai-notes` here.** It is the whole point of the handoff: it has to
 survive to the moment of merging, which is the moment it is for. A ready PR reads
@@ -281,7 +298,8 @@ a required check, so nothing in the check list looked wrong either.
 
 Diff-scoped reviewers cannot catch this — they never see CI. So when a
 both-passed PR is not `CLEAN`, do not assign it as ready. Send it back, and
-**comment why**: the reviewers passed it, so the fix-round implementer would
+**comment why** — ≤10 lines, leading with what must change, then the failing
+check and its error. The reviewers passed it, so the fix-round implementer would
 otherwise read the comments and find no instruction to act on.
 
 ```bash
@@ -506,7 +524,10 @@ Reviewer prompt template:
 >
 > That section is what a human reads at merge time, so put anything you would
 > want them to know there rather than leaving it in the prose above — a finding
-> buried mid-paragraph does not survive the handoff. The bar is a finding that
+> buried mid-paragraph does not survive the handoff. For the same reason, **cap
+> the body at that section plus at most 3 short paragraphs above it**: no process
+> narration, no restating the diff, no listing what you checked and found fine.
+> The bar is a finding that
 > **changes what a human would do**: a semver implication, a deliberate
 > omission, a follow-up that must be filed. Not observations, not praise, not
 > restating the diff. Writing `Nothing.` is a real verdict and the common one —
@@ -543,7 +564,8 @@ Reviewer prompt template:
 > a Dependabot PR it suppresses auto-merge outright. Use `ai-changes` only when
 > you can name a concrete change an agent could make.
 >
-> Say nothing else and return a one-line summary.
+> Say nothing else and return a one-line summary — that governs your reply to the
+> orchestrator; the comment body is capped separately, above.
 
 **Dependabot PRs use a different prompt** — the one above would burn the tick on a
 lockfile. `js-common` #148 bumps 20 packages and its *entire* diff is
@@ -611,7 +633,8 @@ package/from/to table survives because it sits at the top; classify from that.
 > State in your comment which rule fired, name the packages that tripped it, and say
 > whether the body was truncated so the reader knows what you could and couldn't see.
 > Same `🤖 *Automated review — …*` header line, same closing `### Before merging`
-> section, and same one-verdict-label rule as above — **including clearing your
+> section, same 3-paragraph cap on the body, and same one-verdict-label rule as
+> above — **including clearing your
 > `<ai-reviewing-code|ai-reviewing-sec>` claim label in the same `gh pr edit`**.
 > Pass 3 claimed you with it before spawning you, and a claim left behind wedges
 > your half of the review until Pass 2 reaps it.
@@ -716,7 +739,9 @@ real work to reach is lost.
 
 The comment opens with the standard `🤖 *Automated …*` header — see the top of this
 file; it must state that no GitHub account exists for AI agents, so the comment
-wears the owner's avatar. Then, in the body:
+wears the owner's avatar. Then, in the body — **this is the one comment exempt
+from the ≤10-line budget, and only this one.** Declining is a hard handoff whose
+whole value is the reasoning; do not reach for this shape on a PR handoff:
 
 - **Why an agent cannot finish it**, concretely. "Not suitable" is useless. Name
   the blocker: binary assets it cannot author, a force-push past branch

package/skills/repo-tooling/SKILL.md

@@ -47,8 +47,9 @@ npx @rtorcato/repo-tooling fix <target> --diff           # unified diff before c
 ## Scaffolding a new project
 
 ```bash
-# Quick: from a named preset (library | web-app | node-api | nextjs-app | react-app | swift-library)
-npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install
+# Quick: from a named preset (minimal | library | web-app | node-api | nextjs-app | react-app | swift-library)
+# --yes skips the interactive file-list review; without it, a terminal lets you deselect.
+npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install --yes
 
 # Full control: validate a config against the schema, preview, then write
 npx @rtorcato/repo-tooling setup --config-schema > project-config.schema.json

package/tooling/biome/biome.json

@@ -1,63 +1,64 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
-	"vcs": {
-		"enabled": true,
-		"clientKind": "git",
-		"useIgnoreFile": true
-	},
-	"files": {
-		"ignoreUnknown": false,
-		"includes": [
-			"**",
-			"!**/node_modules",
-			"!**/package.json",
-			"!**/tsconfig*.json",
-			"!**/dist",
-			"!**/coverage",
-			"!**/.git",
-			"!**/.github",
-			"!**/.vscode"
-		]
-	},
-	"formatter": {
-		"enabled": true,
-		"indentStyle": "tab",
-		"lineWidth": 100
-	},
-	"linter": {
-		"enabled": true,
-		"rules": {
-			"preset": "recommended",
-			"style": {
-				"noInferrableTypes": "off"
-			},
-			"complexity": {
-				"useLiteralKeys": "off"
-			},
-			"suspicious": {
-				"noExplicitAny": "off",
-				"noTemplateCurlyInString": "off"
-			}
-		}
-	},
-	"assist": {
-		"actions": {
-			"source": {
-				"organizeImports": "off"
-			}
-		}
-	},
-	"javascript": {
-		"formatter": {
-			"quoteStyle": "single",
-			"trailingCommas": "es5",
-			"semicolons": "asNeeded"
-		}
-	},
-	"json": {
-		"formatter": {
-			"indentStyle": "space",
-			"indentWidth": 2
-		}
-	}
+  "$schema": "https://biomejs.dev/schemas/latest/schema.json",
+  "root": false,
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": false,
+    "includes": [
+      "**",
+      "!**/node_modules",
+      "!**/package.json",
+      "!**/tsconfig*.json",
+      "!**/dist",
+      "!**/coverage",
+      "!**/.git",
+      "!**/.github",
+      "!**/.vscode"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "tab",
+    "lineWidth": 100
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended",
+      "style": {
+        "noInferrableTypes": "off"
+      },
+      "complexity": {
+        "useLiteralKeys": "off"
+      },
+      "suspicious": {
+        "noExplicitAny": "off",
+        "noTemplateCurlyInString": "off"
+      }
+    }
+  },
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "off"
+      }
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "es5",
+      "semicolons": "asNeeded"
+    }
+  },
+  "json": {
+    "formatter": {
+      "indentStyle": "space",
+      "indentWidth": 2
+    }
+  }
 }

package/tooling/changesets/config.json

@@ -1,11 +1,11 @@
 {
-	"$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
-	"changelog": "@changesets/cli/changelog",
-	"commit": false,
-	"fixed": [],
-	"linked": [],
-	"access": "public",
-	"baseBranch": "main",
-	"updateInternalDependencies": "patch",
-	"ignore": []
+  "$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
 }

package/tooling/claude/repo-tooling.md

@@ -51,8 +51,9 @@ npx @rtorcato/repo-tooling fix <target> --diff           # unified diff before c
 ## Scaffolding a new project
 
 ```bash
-# Quick: from a named preset (library | web-app | node-api | nextjs-app | react-app | swift-library)
-npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install
+# Quick: from a named preset (minimal | library | web-app | node-api | nextjs-app | react-app | swift-library)
+# --yes skips the interactive file-list review; without it, a terminal lets you deselect.
+npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install --yes
 
 # Full control: validate a config against the schema, preview, then write
 npx @rtorcato/repo-tooling setup --config-schema > project-config.schema.json

package/tooling/commitlint/commitlint.mjs

@@ -1,7 +1,7 @@
 export default {
-	extends: ["@commitlint/config-conventional"],
+	extends: ['@commitlint/config-conventional'],
 	ignores: [
-		(commit) => commit.includes("[skip ci]"),
+		(commit) => commit.includes('[skip ci]'),
 		// Bot commits are machine-written end to end, including headers long
 		// enough to trip header-max-length. Skipping them wholesale keeps bot
 		// PRs green — squash-merge uses the PR title, which is still linted on
@@ -12,43 +12,43 @@ export default {
 	],
 	rules: {
 		// Enforce strict type validation
-		"type-enum": [
+		'type-enum': [
 			2,
-			"always",
+			'always',
 			[
-				"build",
-				"chore",
-				"ci",
-				"docs",
-				"feat",
-				"fix",
-				"perf",
-				"refactor",
-				"revert",
-				"style",
-				"test",
+				'build',
+				'chore',
+				'ci',
+				'docs',
+				'feat',
+				'fix',
+				'perf',
+				'refactor',
+				'revert',
+				'style',
+				'test',
 			],
 		],
 		// 100 is the conventional-commits/semantic-release default. 72 was too
 		// tight: GitHub appends " (#NN)" to squash commits, overflowing the
 		// header on main and skipping the release.
-		"header-max-length": [2, "always", 100],
+		'header-max-length': [2, 'always', 100],
 		// Body/footer length is unenforced. Machine-written commits (agents,
 		// bots) don't wrap, and a `BREAKING CHANGE:` footer — the input
 		// semantic-release reads to cut a major — is the worst thing to make
 		// someone hand-rewrap. The subject rules below decide the release
 		// type and stay enforced.
-		"body-max-line-length": [0],
-		"footer-max-line-length": [0],
+		'body-max-line-length': [0],
+		'footer-max-line-length': [0],
 		// Enforce case rules (allow common patterns)
-		"subject-case": [0], // Disable case enforcement to allow flexibility
-		"type-case": [2, "always", "lower-case"],
+		'subject-case': [0], // Disable case enforcement to allow flexibility
+		'type-case': [2, 'always', 'lower-case'],
 		// Enforce required elements
-		"type-empty": [2, "never"],
-		"subject-empty": [2, "never"],
+		'type-empty': [2, 'never'],
+		'subject-empty': [2, 'never'],
 		// Enforce punctuation rules
-		"subject-full-stop": [2, "never", "."],
+		'subject-full-stop': [2, 'never', '.'],
 		// Enforce scope rules (optional but recommended)
-		"scope-case": [2, "always", "lower-case"],
+		'scope-case': [2, 'always', 'lower-case'],
 	},
-};
+}

package/tooling/nx/nx.json

@@ -1,24 +1,24 @@
 {
-	"$schema": "https://raw.githubusercontent.com/nrwl/nx/master/packages/nx/schemas/nx-schema.json",
-	"namedInputs": {
-		"default": ["{projectRoot}/**/*", "sharedGlobals"],
-		"production": ["default"],
-		"sharedGlobals": []
-	},
-	"targetDefaults": {
-		"build": {
-			"dependsOn": ["^build"],
-			"outputs": ["{projectRoot}/dist"],
-			"cache": true
-		},
-		"lint": { "cache": true },
-		"typecheck": {
-			"dependsOn": ["^build"],
-			"cache": true
-		},
-		"test": {
-			"dependsOn": ["^build"],
-			"cache": true
-		}
-	}
+  "$schema": "https://raw.githubusercontent.com/nrwl/nx/master/packages/nx/schemas/nx-schema.json",
+  "namedInputs": {
+    "default": ["{projectRoot}/**/*", "sharedGlobals"],
+    "production": ["default"],
+    "sharedGlobals": []
+  },
+  "targetDefaults": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": ["{projectRoot}/dist"],
+      "cache": true
+    },
+    "lint": { "cache": true },
+    "typecheck": {
+      "dependsOn": ["^build"],
+      "cache": true
+    },
+    "test": {
+      "dependsOn": ["^build"],
+      "cache": true
+    }
+  }
 }

package/tooling/oxlint/oxlintrc.json

@@ -1,28 +1,28 @@
 {
-	"$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
-	"categories": {
-		"correctness": "error",
-		"perf": "warn",
-		"suspicious": "warn",
-		"pedantic": "off",
-		"style": "off",
-		"restriction": "off",
-		"nursery": "off"
-	},
-	"plugins": ["typescript", "unicorn", "oxc", "import"],
-	"rules": {
-		"no-console": "warn",
-		"no-debugger": "error",
-		"no-empty": "warn",
-		"no-unused-vars": "off",
-		"@typescript-eslint/no-unused-vars": [
-			"warn",
-			{ "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }
-		],
-		"unicorn/filename-case": "off",
-		"unicorn/no-null": "off",
-		"unicorn/prevent-abbreviations": "off",
-		"import/no-default-export": "off"
-	},
-	"ignorePatterns": ["node_modules", "dist", "build", "coverage", ".next", "*.d.ts"]
+  "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
+  "categories": {
+    "correctness": "error",
+    "perf": "warn",
+    "suspicious": "warn",
+    "pedantic": "off",
+    "style": "off",
+    "restriction": "off",
+    "nursery": "off"
+  },
+  "plugins": ["typescript", "unicorn", "oxc", "import"],
+  "rules": {
+    "no-console": "warn",
+    "no-debugger": "error",
+    "no-empty": "warn",
+    "no-unused-vars": "off",
+    "@typescript-eslint/no-unused-vars": [
+      "warn",
+      { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }
+    ],
+    "unicorn/filename-case": "off",
+    "unicorn/no-null": "off",
+    "unicorn/prevent-abbreviations": "off",
+    "import/no-default-export": "off"
+  },
+  "ignorePatterns": ["node_modules", "dist", "build", "coverage", ".next", "*.d.ts"]
 }

package/tooling/release-please/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-	".": "0.0.0"
+  ".": "0.0.0"
 }

package/tooling/release-please/release-please-config.json

@@ -1,9 +1,9 @@
 {
-	"$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-	"packages": {
-		".": {
-			"release-type": "node",
-			"changelog-path": "CHANGELOG.md"
-		}
-	}
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "changelog-path": "CHANGELOG.md"
+    }
+  }
 }

package/tooling/rolldown/rolldown.config.mjs

@@ -24,7 +24,12 @@ import { defineConfig } from 'rolldown'
  * @param {import('./rolldown.config.d.mts').GetConfigOptions} [options]
  */
 export function getConfig(options = {}) {
-	const { input = 'src/index.ts', outDir = 'dist', sourcemap = true, external = isBareImport } = options
+	const {
+		input = 'src/index.ts',
+		outDir = 'dist',
+		sourcemap = true,
+		external = isBareImport,
+	} = options
 
 	return defineConfig({
 		input,