@rtorcato/repo-tooling 3.16.0 → 3.16.2

package/dist/cli/generators/linting.js

@@ -35,55 +35,17 @@ export const BIOME_CONFIG = 'biome.json';
  */
 export const BIOME_LEGACY_CONFIG = 'biome.jsonc';
 /**
- * Used when nothing in the target repo says which Biome will read the config —
- * a bare directory mid-`setup`, before `pnpm install` has run. Matches the
- * `$schema` the shipped preset carries.
- */
-const BIOME_SCHEMA_FALLBACK = '2.5.0';
-async function readJsonOrNull(filepath) {
-    try {
-        return (await fs.readJson(filepath));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * The `@biomejs/biome` actually installed under `targetDir`, or null when
- * node_modules isn't populated. This is the binary that will parse the config
- * and emit the schema-mismatch warning, so it is the only version worth
- * comparing a written `$schema` against — a declared range like `^2.5.0` says
- * nothing about which 2.x resolved (#424).
- */
-export async function installedBiomeVersion(targetDir) {
-    const installed = await readJsonOrNull(path.join(targetDir, 'node_modules', '@biomejs', 'biome', 'package.json'));
-    const match = typeof installed?.version === 'string' ? /(\d+\.\d+\.\d+)/.exec(installed.version) : null;
-    return match?.[1] ?? null;
-}
-/**
- * The Biome version the scaffolded `$schema` URL should name (#363).
+ * Unversioned on purpose (#468). A `$schema` naming an exact version is only
+ * ever right until the next `@biomejs/biome` bump, at which point Biome prints
+ * "The configuration schema version does not match the CLI version" on every
+ * invocation and doctor reports drift — so every Dependabot bump needed a hand
+ * edit before it could go green. Biome accepts `latest` and says nothing about
+ * it (verified against 2.5.5), which removes the failure class outright.
  *
- * A hardcoded version drifts the moment the consumer's Biome moves, and Biome
- * reports the mismatch on *every* invocation ("The configuration schema version
- * does not match the CLI version 2.5.7") — noise on a file the consumer never
- * wrote. The installed package wins because it is literally the binary that
- * will parse the file and emit that warning; the declared range is the next
- * best statement of intent when node_modules isn't populated yet.
+ * `latest` rather than dropping the key: editors still resolve a real schema
+ * for autocomplete and validation, which is the only reason the key is there.
  */
-export async function resolveBiomeSchemaVersion(targetDir) {
-    const installed = await installedBiomeVersion(targetDir);
-    if (installed)
-        return installed;
-    const pkg = await readJsonOrNull(path.join(targetDir, 'package.json'));
-    const deps = {
-        ...(pkg?.dependencies ?? {}),
-        ...(pkg?.devDependencies ?? {}),
-    };
-    // A range ("^2.5.0") carries the x.y.z we need just as an exact version does.
-    const declared = deps['@biomejs/biome'];
-    const match = typeof declared === 'string' ? /(\d+\.\d+\.\d+)/.exec(declared) : null;
-    return match?.[1] ?? BIOME_SCHEMA_FALLBACK;
-}
+const BIOME_SCHEMA_URL = 'https://biomejs.dev/schemas/latest/schema.json';
 /**
  * The thin pointer config — the same shape this repo dogfoods. `fix biome` used
  * to copy the whole preset inline instead, which meant the scaffolded file
@@ -95,9 +57,8 @@ export async function generateBiomeConfig(targetDir) {
     // file globs via `files.includes`; emitting the old 1.x `include`/`ignore`
     // keys here forced consumers to run `biome migrate` before `biome check`
     // would run at all.
-    const version = await resolveBiomeSchemaVersion(targetDir);
     const biomeConfig = {
-        $schema: `https://biomejs.dev/schemas/${version}/schema.json`,
+        $schema: BIOME_SCHEMA_URL,
         extends: ['@rtorcato/repo-tooling/biome'],
     };
     await fs.writeJson(path.join(targetDir, BIOME_CONFIG), biomeConfig, { spaces: 2 });

package/dist/languages/js/checks.js

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import fs from 'fs-extra';
 import { checkFile, hookHasUncommented } from '../../base/checks.js';
-import { installedBiomeVersion } from '../../cli/generators/linting.js';
 import { CLAUDE_SETTINGS_FILE, readClaudeSettings, workspaceSymlinkDirs, worktreeSymlinkDirs, } from '../../cli/generators/agent-rules.js';
 import { WORKSPACE_FILE, dependsOnEsbuild, familyGlob, missingPnpmSettings, } from '../../cli/generators/pnpm-workspace.js';
 const PACKAGE = '@rtorcato/repo-tooling';
@@ -163,38 +162,38 @@ export const BIOME_FILE_CHECK = {
 };
 /**
  * The Biome check plus the one thing a contents-only matcher can't see: whether
- * the `$schema` URL still names the Biome that will read it (#424).
+ * the `$schema` URL still pins a version (#424, #468).
  *
- * `fix biome` writes the URL from the version resolved at scaffold time, and
- * nothing re-checked it afterwards — so once the repo's Biome moved on, every
- * single invocation (the pre-commit hook included) printed "The configuration
- * schema version does not match the CLI version", while doctor stayed clean.
+ * It began as a drift check — the URL named the Biome resolved at scaffold
+ * time, nothing re-checked it, and once the repo's Biome moved on every single
+ * invocation (the pre-commit hook included) printed "The configuration schema
+ * version does not match the CLI version" while doctor stayed clean.
  *
- * Compared against the *installed* package only, never the declared range: an
- * exact match is what Biome itself demands, and `^2.5.0` doesn't say which 2.x
- * resolved. With no node_modules there is nothing to be wrong about, so the
- * check says nothing rather than guessing.
+ * Chasing the installed version was treating the symptom: an exact pin is
+ * *only ever* correct until the next bump, so every `@biomejs/biome` update
+ * failed the build until someone hand-edited a URL. `fix biome` now writes the
+ * unpinned `latest`, and this reads as a migration signal instead — any
+ * surviving pin is a repo that predates the unpinning, whatever version it
+ * names. That makes it independent of node_modules, so it also fires on a
+ * fresh clone, and it goes quiet for good once the repo is migrated.
  */
 export async function checkBiome(dir) {
     const result = await checkFile(dir, BIOME_FILE_CHECK);
     if (result.status !== 'ok')
         return result;
-    const installed = await installedBiomeVersion(dir);
-    if (!installed)
-        return result;
     // The same candidate checkFile settled on — first one that exists wins.
     for (const candidate of BIOME_FILE_CHECK.candidates) {
         const filepath = path.join(dir, candidate);
         if (!(await fs.pathExists(filepath)))
             continue;
         const url = readSchemaUrl(await fs.readFile(filepath, 'utf8'));
-        const targeted = url?.includes('biomejs.dev') ? schemaUrlVersion(url)?.join('.') : null;
-        if (targeted && targeted !== installed) {
+        const pinned = url?.includes('biomejs.dev') ? schemaUrlVersion(url)?.join('.') : null;
+        if (pinned) {
             return {
                 check: BIOME_FILE_CHECK.check,
                 status: 'drift',
-                detail: `${candidate} targets Biome ${targeted} but @biomejs/biome ${installed} is installed`,
-                hint: 'Run `npx @rtorcato/repo-tooling fix biome` to rewrite the $schema URL',
+                detail: `${candidate} pins Biome ${pinned} in $schema — the next @biomejs/biome bump past it breaks every Biome run`,
+                hint: 'Run `npx @rtorcato/repo-tooling fix biome` to drop the version from the $schema URL',
             };
         }
         return result;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.16.0",
+	"version": "3.16.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [
@@ -237,15 +237,15 @@
 		"inquirer": "^14.0.2"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.5",
+		"@biomejs/biome": "^2.5.8",
 		"@types/diff": "^8.0.0",
-		"@commitlint/cli": "^21.2.1",
-		"@commitlint/config-conventional": "^21.2.0",
+		"@commitlint/cli": "^21.2.2",
+		"@commitlint/config-conventional": "^21.2.2",
 		"@commitlint/types": "^21.2.0",
 		"@eslint/js": "^10.0.1",
 		"@ianvs/prettier-plugin-sort-imports": "^4.4.2",
-		"@next/eslint-plugin-next": "^16.2.11",
-		"@playwright/test": "^1.62.0",
+		"@next/eslint-plugin-next": "^16.3.0",
+		"@playwright/test": "^1.62.1",
 		"@rollup/plugin-typescript": "^12.0.0",
 		"@semantic-release/commit-analyzer": "^13.0.1",
 		"@semantic-release/exec": "^7.1.0",
@@ -254,43 +254,43 @@
 		"@semantic-release/release-notes-generator": "^14.1.1",
 		"@total-typescript/ts-reset": "0.6.1",
 		"@types/fs-extra": "^11.0.4",
-		"@types/node": "^26.1.1",
-		"@typescript-eslint/eslint-plugin": "^8.65.0",
-		"@typescript-eslint/parser": "^8.65.0",
-		"@vitejs/plugin-react": "^6.0.4",
+		"@types/node": "^26.2.0",
+		"@typescript-eslint/eslint-plugin": "^8.67.0",
+		"@typescript-eslint/parser": "^8.67.0",
+		"@vitejs/plugin-react": "^6.0.5",
 		"@vitest/coverage-v8": "^4.1.10",
 		"commitizen": "^4.3.1",
-		"conventional-changelog-conventionalcommits": "^10.2.1",
+		"conventional-changelog-conventionalcommits": "^10.3.0",
 		"cz-conventional-changelog": "^3.3.0",
-		"esbuild": "^0.28.0",
+		"esbuild": "^0.28.2",
 		"esbuild-node-externals": "^2.0.0",
-		"eslint": "10.8.0",
+		"eslint": "10.8.1",
 		"eslint-plugin-import": "^2.32.0",
-		"eslint-plugin-jest": "29.16.0",
+		"eslint-plugin-jest": "29.16.1",
 		"husky": "^9.1.7",
 		"is-ci": "^4.1.0",
 		"jest": "^30.4.2",
 		"jsdom": "^30.0.1",
-		"knip": "^6.29.0",
+		"knip": "^6.32.2",
 		"prettier": "^3.9.6",
 		"rimraf": "6.1.3",
-		"rollup": "^4.62.0",
-		"semantic-release": "^25.0.8",
+		"rollup": "^4.62.4",
+		"semantic-release": "^25.0.9",
 		"ts-jest": "^29.4.12",
 		"tslib": "^2.8.0",
 		"tsup": "8.5.1",
 		"typescript": "^7.0.2",
-		"typescript-eslint": "^8.65.0",
+		"typescript-eslint": "^8.67.0",
 		"vitest": "^4.1.10"
 	},
 	"peerDependencies": {
 		"@biomejs/biome": "^2.5.0",
 		"@commitlint/cli": "^20.0.0 || ^21.0.0",
-		"@commitlint/config-conventional": "^21.2.0",
+		"@commitlint/config-conventional": "^21.2.2",
 		"@commitlint/types": "^21.2.0",
 		"@eslint/js": "^9.0.0",
 		"@ianvs/prettier-plugin-sort-imports": "^4.0.0",
-		"@next/eslint-plugin-next": "^16.2.11",
+		"@next/eslint-plugin-next": "^16.3.0",
 		"@rollup/plugin-typescript": "^12.0.0",
 		"@semantic-release/changelog": "^6.0.0",
 		"@semantic-release/commit-analyzer": "^13.0.0",

package/skills/ai-issue-loop/SKILL.md

@@ -70,9 +70,9 @@ drift with a second copy to maintain.
 
 | Label | On | Meaning |
 |---|---|---|
-| `ai-ready` | issue | Eligible for an agent. The hard gate. |
-| `ai-wip` | issue | Claimed; a worktree exists. |
-| `ai-blocked` | issue | Agent gave up; needs a human. |
+| `ai-ready` | issue | Eligible for an agent. The hard gate; **cleared on pickup**. |
+| `ai-wip` | issue | Claimed; a worktree exists. Never rides alongside `ai-ready`. |
+| `ai-blocked` | issue | Agent gave up; needs a human. Only a human re-adds `ai-ready`. |
 | `ai-review` | PR | Awaiting agent review. |
 | `ai-reviewing-code` | PR | `code-reviewer` claimed and running. Cleared with its verdict. |
 | `ai-reviewing-sec` | PR | `security-expert` claimed and running. Cleared with its verdict. |
@@ -400,13 +400,21 @@ Only then:
 git -C "$ROOT" worktree remove --force "$WT_DIR"   # the path found above, not a rebuilt one
 git -C "$ROOT" branch -D "$BRANCH" 2>/dev/null
 gh issue edit <N> --remove-label ai-wip 2>/dev/null
+# Still OPEN means the PR said only `Refs #N`; a `Closes #N` issue is already closed.
+if [ "$(gh issue view <N> --json state -q .state)" = OPEN ]; then
+  gh issue edit <N> --add-assignee @me
+fi
 ```
 
 A closed-unmerged PR is the exception: there is no squash to find, so skip the
 confirmation and remove — the work was abandoned deliberately.
 
-The issue itself closes from the PR body's `Closes #N`. This pass is what frees
-concurrency slots, so it must run before Pass 4.
+The issue itself closes from the PR body's `Closes #N`, so both edits are normally
+no-ops on a closed issue. A PR that said only `Refs #N` leaves it **open**, which is
+what the state check catches. The work has landed, so it must not go back in
+the queue; pickup already dropped `ai-ready`, and assigning it is what stops a
+merged issue sitting unowned instead (#429 had to be moved to `holding` by hand).
+This pass is what frees concurrency slots, so it must run before Pass 4.
 
 **Then reap the stalled.** Nothing can time out an agent: the Agent tool takes no
 timeout, and an agent whose session died leaves its labels behind with no process
@@ -432,8 +440,10 @@ work must never be reaped out from under itself.
 The **no PR exists** condition on the first row is what makes reaping safe. An
 agent that got as far as opening a PR has handed off to the label state machine
 and is no longer the thing being waited on; only a run that produced nothing is
-presumed dead. The reaped issue keeps its worktree removed, so a re-labelled
-`ai-ready` starts clean.
+presumed dead. Reaping deliberately does **not** restore `ai-ready` — `ai-blocked`
+means a human decides when the issue re-enters the queue, and the removed worktree
+means their re-label starts clean. The other two `ai-blocked` exits, Pass 3's
+ping-pong stop and an implementer handing back, leave it off for the same reason.
 
 **Every `ai-blocked` must say why, and land in front of a human.** So reaping always
 does three things together — label, assign, comment — and the comment opens with
@@ -448,9 +458,12 @@ puts it in the statusline and fires a notification with a sound.
 **Reaping is not always the right call — say so when it isn't.** The rule assumes a
 dead agent, but a stale `ai-wip` can also come from a run that was cancelled
 deliberately, in which case the work is fine and only the claim is stale. If you know
-the cause and it is benign, clear `ai-wip` **without** `ai-blocked` so Pass 4 can pick
-it straight back up, and say in the comment that you deviated and why. `ai-blocked`
-means *a human must look*; do not spend it on a claim you already understand.
+the cause and it is benign, **return it to the queue** — `gh issue edit <N> --add-label
+ai-ready --remove-label ai-wip`, no `ai-blocked` — so Pass 4 picks it straight back up,
+and say in the comment that you re-queued it, that you deviated, and why. Re-adding
+`ai-ready` is not optional: pickup cleared it, so clearing `ai-wip` alone drops the
+issue out of the queue silently, which is the worse failure. `ai-blocked` means *a
+human must look*; do not spend it on a claim you already understand.
 
 ### Pass 3 — review
 
@@ -769,9 +782,17 @@ Take the first `slots` issues. For each, **claim it first** so a concurrent tick
 can't double-pick:
 
 ```bash
-gh issue edit <N> --add-label ai-wip
+gh issue edit <N> --add-label ai-wip --remove-label ai-ready
 ```
 
+Dropping `ai-ready` is half the claim, not tidiness — the diagram above is a
+transition, not an accumulation. An issue left carrying both re-enters the queue
+the instant `ai-wip` clears for any reason other than the PR closing it, and the
+next tick spawns an agent to re-implement work already sitting in an open PR
+(#458, #467, #461, #452, all in one session). Every path that legitimately returns
+an issue to the queue therefore re-adds `ai-ready` explicitly; Pass 2's benign-stall
+path is the only one, and a human does the rest.
+
 **Then create the worktree yourself**, before spawning anything. `<slug>` is 3–4
 kebab-case words from the title:
 

package/tooling/biome/biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "$schema": "https://biomejs.dev/schemas/latest/schema.json",
   "root": false,
   "vcs": {
     "enabled": true,