@rtorcato/repo-tooling 3.31.0 → 3.31.2

package/dist/cli/generators/claude-skills.js

@@ -11,6 +11,7 @@ import fs from 'fs-extra';
 import { realGitExec } from '../../base/git-identity.js';
 import { getPackageRoot } from '../utils/copy-preset.js';
 import { shellQuote } from '../utils/shell.js';
+import { isNewerVersion, resolveShippedVersion } from '../utils/version.js';
 /**
  * Skills this package owns the content of and keeps up to date. The loop first —
  * it is the pipeline; the other three are its drivers (burst, on-ramp, status).
@@ -115,47 +116,6 @@ export function classifySkillContent(installed, shipped) {
         return 'unknown';
     return recorded === hashSkillContent(installed) ? 'pristine' : 'modified';
 }
-function versionParts(version) {
-    return version.split('.').map((n) => Number.parseInt(n, 10) || 0);
-}
-/** True when `a` is a strictly higher version than `b`. Prerelease tags are ignored. */
-export function isNewerVersion(a, b) {
-    const [left, right] = [versionParts(a), versionParts(b)];
-    for (let i = 0; i < 3; i++) {
-        const [x, y] = [left[i] ?? 0, right[i] ?? 0];
-        if (x !== y)
-            return x > y;
-    }
-    return false;
-}
-/**
- * The version to stamp, given what `package.json` claims.
- *
- * In a published tarball that field is authoritative — `@semantic-release/npm`
- * rewrites it before packing. In a *git checkout* it is not: this repo runs
- * semantic-release without `@semantic-release/git` (#417), so nothing ever
- * writes the released version back and the field sits at whatever it was last
- * hand-set to. Observed 2026-08-22: `package.json` 3.11.0 against npm 3.21.1,
- * ten minor versions of drift.
- *
- * That mattered because the stamp feeds the downgrade guard below: a skill
- * installed from npm could not be updated from a local checkout, and the
- * refusal claimed the installed copy was "newer" when only its *label* was.
- *
- * So when the package root is a git checkout, take the nearest tag as well and
- * keep whichever is higher. Monotonic on purpose — this can only ever raise the
- * answer, so a tagless, shallow, or git-less environment keeps today's
- * behaviour rather than silently stamping something lower.
- */
-export async function resolveShippedVersion(root, pkgVersion, git = realGitExec) {
-    if (!(await fs.pathExists(path.join(root, '.git'))))
-        return pkgVersion;
-    const described = await git(['describe', '--tags', '--abbrev=0'], root);
-    const tag = described?.trim().replace(/^v/, '');
-    if (!tag || !/^\d+\.\d+/.test(tag))
-        return pkgVersion;
-    return isNewerVersion(tag, pkgVersion) ? tag : pkgVersion;
-}
 /** The skill source and the package version that will be stamped into it. */
 export async function readShippedSkill(name = SHIPPED_SKILL, git = realGitExec) {
     const root = getPackageRoot();

package/dist/cli/generators/package-json.js

@@ -1,3 +1,4 @@
+import chalk from 'chalk';
 import fs from 'fs-extra';
 import path from 'node:path';
 import { PNPM_FALLBACK_VERSION, detectPnpmVersion } from './misc.js';
@@ -8,6 +9,8 @@ export async function generatePackageJson(config, targetDir) {
         existingPackageJson = await fs.readJson(packageJsonPath);
     }
     const includeTreeshake = Boolean(config.treeshakeCheck && config.projectType === 'library');
+    const generatedScripts = getScripts(config, { includeTreeshake });
+    const existingScripts = existingPackageJson?.scripts ?? {};
     const packageJson = {
         name: config.projectName,
         version: '0.1.0',
@@ -17,10 +20,7 @@ export async function generatePackageJson(config, targetDir) {
         // generated workflows carry no `version:` input (#364).
         packageManager: `pnpm@${detectPnpmVersion() ?? PNPM_FALLBACK_VERSION}`,
         ...existingPackageJson,
-        scripts: {
-            ...getScripts(config, { includeTreeshake }),
-            ...existingPackageJson?.scripts,
-        },
+        scripts: resolveScripts(config, generatedScripts, existingScripts),
         dependencies: {
             ...existingPackageJson?.dependencies,
         },
@@ -66,6 +66,30 @@ export async function generatePackageJson(config, targetDir) {
     // (see ensureBuildApprovals in build.ts).
     await fs.writeJson(packageJsonPath, packageJson, { spaces: 2 });
 }
+/**
+ * Merge the generated scripts with what the package.json already had. Existing
+ * values win — that merge-don't-clobber policy is what makes re-running `setup`
+ * on a live repo safe.
+ *
+ * `build` on a library is the one exception. The library branch of
+ * generatePackageJson overwrites the whole publish contract
+ * (main/module/types/exports) unconditionally, and that contract names files
+ * only the preset's bundler emits: a preserved `build: tsc` produces
+ * dist/index.js + dist/index.d.ts and never the ./dist/index.cjs that `main`
+ * and every `require` condition point at, so `pnpm build && npm publish` ships
+ * a package whose CJS entry points 404 (#570). Owning the contract means owning
+ * its producer; the replacement is announced rather than silent.
+ */
+function resolveScripts(config, generated, existing) {
+    const scripts = { ...generated, ...existing };
+    if (config.projectType !== 'library' || !generated.build)
+        return scripts;
+    if (existing.build && existing.build !== generated.build) {
+        console.warn(chalk.yellow(`⚠️  Replaced "build": "${existing.build}" with "${generated.build}" — the library exports map names files only ${config.bundler} emits.`));
+    }
+    scripts.build = generated.build;
+    return scripts;
+}
 function getScripts(config, opts = {}) {
     const scripts = {};
     // TypeScript scripts

package/dist/cli/index.js

@@ -3,12 +3,12 @@ import path from 'node:path';
 import chalk from 'chalk';
 import { Command } from 'commander';
 import fs from 'fs-extra';
-import packageJson from '../../package.json' with { type: 'json' };
 import { doctorCommand } from './commands/doctor.js';
 import { fixCommand } from './commands/fix.js';
 import { loopGuardCommand } from './commands/loop-guard.js';
 import { setupProject } from './commands/setup.js';
 import { copyPreset, PRESETS } from './utils/copy-preset.js';
+import { getToolVersion } from './utils/version.js';
 async function isSelfRepo(dir) {
     try {
         const pkg = await fs.readJson(path.join(dir, 'package.json'));
@@ -22,7 +22,7 @@ const program = new Command();
 program
     .name('@rtorcato/repo-tooling')
     .description('🛠️  JavaScript and TypeScript tooling setup for modern projects')
-    .version(packageJson.version);
+    .version(await getToolVersion());
 program
     .command('setup')
     .alias('init')

package/dist/cli/utils/lockfile.js

@@ -1,8 +1,8 @@
 import path from 'node:path';
 import fs from 'fs-extra';
-import packageJson from '../../../package.json' with { type: 'json' };
 import { CONFIG_SCHEMA, validateProjectConfig } from '../commands/setup-presets.js';
 import { SHIPPED_SKILLS } from '../generators/claude-skills.js';
+import { getToolVersion } from './version.js';
 export const LOCKFILE_NAME = '.repo-tooling.json';
 // Package and bin name used before the js-tooling→repo-tooling rename (#272).
 // The bin no longer exists and the package is 404 on the registry, so any
@@ -243,7 +243,7 @@ export async function writeLockfile(dir, config, assets) {
         record: {
             config,
             ...(carried && Object.keys(carried).length > 0 ? { assets: carried } : {}),
-            writtenBy: `@rtorcato/repo-tooling@${packageJson.version}`,
+            writtenBy: `@rtorcato/repo-tooling@${await getToolVersion()}`,
             writtenAt: new Date().toISOString(),
         },
         ...(existing?.rules ? { rules: existing.rules } : {}),

package/dist/cli/utils/version.js

@@ -0,0 +1,68 @@
+/**
+ * The one answer to "what version of this package is running" (#572).
+ *
+ * There were two. `--version` and the lockfile's `writtenBy` read the imported
+ * `package.json` directly; the Claude-skills stamp went through
+ * `resolveShippedVersion`, which corrects for the drift documented below. A
+ * single `doctor` run could report both — the skills check saying 3.31.0 while
+ * `writtenBy` in the same run said 3.11.0. Everything now calls
+ * `getToolVersion()`.
+ */
+import path from 'node:path';
+import fs from 'fs-extra';
+import packageJson from '../../../package.json' with { type: 'json' };
+import { realGitExec } from '../../base/git-identity.js';
+import { getPackageRoot } from './copy-preset.js';
+function versionParts(version) {
+    return version.split('.').map((n) => Number.parseInt(n, 10) || 0);
+}
+/** True when `a` is a strictly higher version than `b`. Prerelease tags are ignored. */
+export function isNewerVersion(a, b) {
+    const [left, right] = [versionParts(a), versionParts(b)];
+    for (let i = 0; i < 3; i++) {
+        const [x, y] = [left[i] ?? 0, right[i] ?? 0];
+        if (x !== y)
+            return x > y;
+    }
+    return false;
+}
+/**
+ * The version to report, given what `package.json` claims.
+ *
+ * In a published tarball that field is authoritative — `@semantic-release/npm`
+ * rewrites it before packing. In a *git checkout* it is not: this repo runs
+ * semantic-release without `@semantic-release/git` (#417), so nothing ever
+ * writes the released version back and the field sits at whatever it was last
+ * hand-set to. Observed 2026-08-22: `package.json` 3.11.0 against npm 3.21.1,
+ * ten minor versions of drift.
+ *
+ * That mattered first because the stamp feeds the skills downgrade guard: a
+ * skill installed from npm could not be updated from a local checkout, and the
+ * refusal claimed the installed copy was "newer" when only its *label* was.
+ *
+ * So when the package root is a git checkout, take the nearest tag as well and
+ * keep whichever is higher. Monotonic on purpose — this can only ever raise the
+ * answer, so a tagless, shallow, or git-less environment keeps today's
+ * behaviour rather than silently reporting something lower.
+ */
+export async function resolveShippedVersion(root, pkgVersion, git = realGitExec) {
+    if (!(await fs.pathExists(path.join(root, '.git'))))
+        return pkgVersion;
+    const described = await git(['describe', '--tags', '--abbrev=0'], root);
+    const tag = described?.trim().replace(/^v/, '');
+    if (!tag || !/^\d+\.\d+/.test(tag))
+        return pkgVersion;
+    return isNewerVersion(tag, pkgVersion) ? tag : pkgVersion;
+}
+let cached;
+/**
+ * This package's version, for `--version`, `writtenBy`, and the skill stamps.
+ *
+ * Memoized: in a checkout `resolveShippedVersion` spawns `git describe`, and
+ * nothing about the answer changes mid-process. An npm install has no `.git`
+ * under the package root, so that path costs one `pathExists` and no subprocess.
+ */
+export function getToolVersion() {
+    cached ??= resolveShippedVersion(getPackageRoot(), String(packageJson.version));
+    return cached;
+}

package/dist/languages/swift/scaffold.js

@@ -18,7 +18,7 @@ import { generateEditorConfig } from '../../cli/generators/misc.js';
 import { generateCodeQLWorkflow, generateDependabotConfig } from '../../cli/generators/security.js';
 import { copyPreset } from '../../cli/utils/copy-preset.js';
 import { LANGUAGES } from '../registry.js';
-import { readSwiftPackage, renderSwiftReleaseWorkflow, renderSwiftWorkflow } from './ci.js';
+import { parsePackageSwift, readSwiftPackage, renderSwiftReleaseWorkflow, renderSwiftWorkflow, } from './ci.js';
 import { SWIFT_HOOKS_DIR, installSwiftGitHooks } from './git-hooks.js';
 import { ensureSwiftGitignore } from './gitignore.js';
 /**
@@ -196,6 +196,10 @@ git tag 1.0.0 && git push origin 1.0.0
 /**
  * Relative paths `setup --dry-run` reports for a Swift config, in write order.
  * Kept beside the writer so the two can't drift.
+ *
+ * This is the greenfield list. Against a directory that already has a
+ * Package.swift the writer preserves it and skips the target scaffolding, so the
+ * preview over-reports there — the safe direction for a dry run.
  */
 export function swiftFileList(config) {
     const module = swiftModuleName(config.projectName);
@@ -225,12 +229,29 @@ export function swiftFileList(config) {
     files.push('README.md');
     return files;
 }
-/** Scaffold a SwiftPM library. The Swift arm of `generateConfigs`. */
+/**
+ * Scaffold a SwiftPM library. The Swift arm of `generateConfigs`.
+ *
+ * Package.swift is source, not config (#574): rewriting one that already exists
+ * renames the package after the *directory* and leaves the real `Sources/<Target>/`
+ * declared by no target — and `swift build` still exits 0, because SwiftPM just
+ * ignores the orphaned directory. So an existing manifest is left byte-identical
+ * and the module name is read back off it rather than derived from the directory,
+ * the same way the JS presets merge into a package.json instead of replacing it.
+ */
 export async function generateSwiftProject(config, targetDir) {
-    const module = swiftModuleName(config.projectName);
-    await fs.writeFile(path.join(targetDir, 'Package.swift'), packageSwift(module));
-    await fs.outputFile(path.join(targetDir, 'Sources', module, `${module}.swift`), sourceFile(module));
-    await fs.outputFile(path.join(targetDir, 'Tests', `${module}Tests`, `${module}Tests.swift`), testFile(module));
+    const manifestPath = path.join(targetDir, 'Package.swift');
+    const existingManifest = (await fs.pathExists(manifestPath))
+        ? parsePackageSwift(await fs.readFile(manifestPath, 'utf-8'))
+        : null;
+    const module = existingManifest?.products[0] ?? swiftModuleName(config.projectName);
+    // Nothing is scaffolded under Sources/ or Tests/ either: those would be
+    // directories for a target the existing manifest doesn't declare.
+    if (!existingManifest) {
+        await fs.writeFile(manifestPath, packageSwift(module));
+        await fs.outputFile(path.join(targetDir, 'Sources', module, `${module}.swift`), sourceFile(module));
+        await fs.outputFile(path.join(targetDir, 'Tests', `${module}Tests`, `${module}Tests.swift`), testFile(module));
+    }
     await copyPreset('swiftlint', targetDir);
     await copyPreset('periphery', targetDir);
     await ensureSwiftGitignore(targetDir);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.31.0",
+	"version": "3.31.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [

package/skills/ai-issue-loop/SKILL.md

@@ -964,14 +964,15 @@ review that already exists — `<ARM>` is `code` or `sec`:
 
 ```bash
 ME=$(gh api user --jq .login)   # the identity every loop agent posts as
+HEAD=$(gh pr view <N> --json headRefOid --jq .headRefOid)
 VERDICT=$(gh api "repos/$OWNER_REPO/pulls/<N>/reviews" --paginate --slurp \
-  | jq -r --arg me "$ME" '[add[]
-            | select(.user.login==$me)
+  | jq -r --arg me "$ME" --arg head "$HEAD" '[add[]
+            | select(.user.login==$me and .commit_id==$head)
             | (.body // "")
             | capture("<!-- ai-issue-loop:verdict:<ARM>:(?<v>[A-Z-]+) -->").v] | last // empty')
 ```
 
-Four details there are load-bearing:
+Five details there are load-bearing:
 
 - **`pulls/<N>/reviews`, because the prompt posts with `gh pr review --comment`.**
   That creates a *review*, which never appears under `issues/<N>/comments`. The
@@ -993,6 +994,19 @@ Four details there are load-bearing:
   count. Login, not `author_association`, because association wobbles with repo
   ownership (an org-owned repo never yields `OWNER`, even for its admins) while
   `gh api user` names exactly who this loop posts as.
+- **The head gate — `.commit_id==$head`, so a verdict expires with the diff it
+  read.** Every review carries the commit it was submitted against; ungated, the
+  read takes `last` over all of them, so after a fix round the newest marker is
+  still the *pre-fix* one and the tick adopts a verdict about a diff that no
+  longer exists. Both directions bite: a stale `CHANGES` re-applies `ai-changes`
+  for a finding the fix round already resolved, burning a round of two and
+  pushing the PR toward `ai-blocked` over nothing; a stale `PASS` is worse, since
+  it marks a rewritten diff reviewed when nothing read it. Scoped to the head, an
+  older marker reads as absent and that arm re-spawns — which is already the
+  behaviour for an arm that never posted. **This does not cost the #497 recovery
+  case** the read exists for: a reviewer that died between posting and labelling
+  posted against the head that is still current, so its marker still matches.
+  Only genuinely stale markers stop matching, which is the point.
 - **`(.body // "")` and `// empty`.** A review can have a null body, which
   `capture` throws on, aborting the whole filter; and `jq -r` prints a missing
   value as the literal string `null`, which is not empty and would read as a