@rtorcato/repo-tooling 3.38.0 → 3.38.2

package/dist/base/checks.js

@@ -3,7 +3,7 @@ import fs from 'fs-extra';
 import { BLOCK_START, hasStaleAgentBlock } from '../cli/generators/agent-rules.js';
 import { BADGE_START, hasPublicOnlyBadges } from '../cli/generators/badges.js';
 import { claudeSkillStatus, SHIPPED_SKILLS, skillDiffCommand, } from '../cli/generators/claude-skills.js';
-import { DEPENDABOT_CONFIG_PATHS, dependabotIgnoreRules } from '../cli/generators/security.js';
+import { DEPENDABOT_CONFIG_PATHS, dependabotConfigDeltas, dependabotEcosystemFor, dependabotIgnoreRules, } from '../cli/generators/security.js';
 import { detectNestedLanguages } from '../cli/utils/detect-language.js';
 /**
  * Root-only detection is the decision (#317), not an oversight — but it used to
@@ -244,12 +244,7 @@ export async function checkDependabot(dir) {
             // depends on it. Flag any config that predates it so `fix dependabot` can
             // bring the pair up to standard.
             const content = await fs.readFile(candidatePath, 'utf8');
-            const deltas = [];
-            for (const group of ['production-minor', 'dev-minor', 'major-updates']) {
-                if (!new RegExp(`^\\s*${group}:`, 'm').test(content)) {
-                    deltas.push(`missing \`${group}\` group`);
-                }
-            }
+            const deltas = dependabotConfigDeltas(content, await dependabotEcosystemFor(dir));
             const automergePath = path.join(dir, '.github', 'workflows', 'dependabot-automerge.yml');
             if (await fs.pathExists(automergePath)) {
                 // Pre-#423 workflows gated on the semver type alone, so production
@@ -720,7 +715,9 @@ export async function checkPrePushHook(dir, p) {
 }
 export async function checkReadmeBadges(dir, audience, 
 /** `fix` target that rebuilds the badge block, or null when the language has none. */
-fixTarget) {
+fixTarget, 
+/** The repo's own package name — only its badges can 404; others' resolve fine (#634). */
+name) {
     const check = 'README badges';
     const hint = fixTarget
         ? `Run \`npx @rtorcato/repo-tooling fix ${fixTarget}\` to add CI/npm/coverage/license badges`
@@ -729,7 +726,7 @@ fixTarget) {
     const readme = (await fs.pathExists(readmePath)) ? await fs.readFile(readmePath, 'utf8') : '';
     if (audience === 'private') {
         // Only a problem if a private/app repo carries badges that would 404.
-        if (readme && hasPublicOnlyBadges(readme)) {
+        if (readme && hasPublicOnlyBadges(readme, name)) {
             return {
                 check,
                 status: 'drift',

package/dist/base/fixers.js

@@ -14,6 +14,7 @@
 import os from 'node:os';
 import path from 'node:path';
 import chalk from 'chalk';
+import fs from 'fs-extra';
 import inquirer from 'inquirer';
 import { installAgentRules, installAiSetup } from '../cli/generators/agent-rules.js';
 import { installClaudeSkill, resolveSkillsDir, SHIPPED_SKILLS, skillDiffCommand, } from '../cli/generators/claude-skills.js';
@@ -21,10 +22,10 @@ import { generateBrand } from '../cli/generators/brand.js';
 import { generateCommunityHealth } from '../cli/generators/community-health.js';
 import { generateCommitlintConfig } from '../cli/generators/git.js';
 import { generateCodeowners, generateEditorConfig } from '../cli/generators/misc.js';
-import { findDependabotIgnoreRules, generateCodeQLWorkflow, generateDependabotConfig, generateRenovateConfig, } from '../cli/generators/security.js';
+import { DEPENDABOT_AUTOMERGE_WORKFLOW, dependabotConfigDeltas, dependabotEcosystemFor, findDependabotIgnoreRules, generateCodeQLWorkflow, generateDependabotConfig, generateRenovateConfig, readDependabotConfig, } from '../cli/generators/security.js';
 import { classifyCopiedAssets } from '../cli/utils/copied-assets.js';
 import { copyPreset } from '../cli/utils/copy-preset.js';
-import { detectLanguage } from '../cli/utils/detect-language.js';
+import { detectAuditLanguage } from '../cli/utils/detect-language.js';
 import { resolveLanguageModule } from '../languages/registry.js';
 import { applyGithubSettings, applyReleaseEnvironment, RELEASE_ENV_CHECK, RELEASE_GATE_CHECK, } from './github-settings.js';
 import { applyLoopLabels } from './labels.js';
@@ -46,9 +47,16 @@ export class FixerAbort extends Error {
         this.name = 'FixerAbort';
     }
 }
-/** The repo's language module, resolved from its marker files. */
+/**
+ * The repo's language module, resolved from its marker files. No marker → no
+ * manifest ecosystem and no CodeQL matrix, rather than npm/JS guessed (#632).
+ */
 async function moduleFor(targetDir) {
-    return resolveLanguageModule(await detectLanguage(targetDir));
+    return (resolveLanguageModule(await detectAuditLanguage(targetDir)) ?? {
+        label: 'unrecognized-language',
+        codeqlLanguages: [],
+        dependabotEcosystem: null,
+    });
 }
 /**
  * Where to install user-global skills, asking only when nothing resolves. Under
@@ -149,6 +157,15 @@ export const BASE_FIXERS = [
         outputs: ['.github/dependabot.yml', '.github/workflows/dependabot-automerge.yml'],
         canFixDrift: true,
         async run({ targetDir }) {
+            const ecosystem = await dependabotEcosystemFor(targetDir);
+            // The config is already canonical for this repo's ecosystem, so only the
+            // workflow half drifts. Leave the config — and its repo-authored comments
+            // — alone rather than regenerate a file with nothing to change (#631).
+            const existing = await readDependabotConfig(targetDir);
+            if (existing && dependabotConfigDeltas(existing.content, ecosystem).length === 0) {
+                await fs.outputFile(path.join(targetDir, '.github', 'workflows', 'dependabot-automerge.yml'), DEPENDABOT_AUTOMERGE_WORKFLOW);
+                return { filesWritten: ['.github/workflows/dependabot-automerge.yml'] };
+            }
             // The template owns the whole file but emits no `ignore:` block, so
             // regenerating deletes any repo-local ignore rule — silently, and with
             // nothing in `doctor` to report the loss afterwards, because from the
@@ -159,8 +176,7 @@ export const BASE_FIXERS = [
             if (ignored) {
                 throw new FixerAbort('dependabot-ignore-rules', `refusing to overwrite ${ignored.file} — it has ${ignored.rules.length} \`ignore:\` rule(s) the canonical config does not reproduce: ${ignored.rules.join(', ')}`, `re-add the \`ignore:\` block after regenerating, or delete it from ${ignored.file} to accept the loss — then re-run \`fix dependabot\``);
             }
-            const { dependabotEcosystem } = await moduleFor(targetDir);
-            return { filesWritten: await generateDependabotConfig(targetDir, dependabotEcosystem) };
+            return { filesWritten: await generateDependabotConfig(targetDir, ecosystem) };
         },
     },
     {

package/dist/cli/commands/doctor.js

@@ -11,7 +11,7 @@ import { readPyproject, renderPythonWorkflow } from '../../languages/python/ci.j
 import { resolveLanguageModule } from '../../languages/registry.js';
 import { SWIFT_GIT_HOOKS, runSwiftChecks } from '../../languages/swift/checks.js';
 import { readSwiftPackage, renderSwiftWorkflow } from '../../languages/swift/ci.js';
-import { detectLanguage } from '../utils/detect-language.js';
+import { detectAuditLanguage } from '../utils/detect-language.js';
 import { checkAgentUser } from '../../base/agent-user.js';
 import { checkGitHubSettings } from '../../base/github-settings.js';
 import { checkLoopLabels } from '../../base/labels.js';
@@ -244,7 +244,7 @@ async function runBaseChecks(dir, lock, opts) {
     if (lock?.rules?.mcp?.recommended?.length) {
         results.push(await checkRecommendedMcp(dir, lock.rules.mcp.recommended));
     }
-    results.push(await checkReadmeBadges(dir, opts.badges.audience, opts.badges.fixTarget));
+    results.push(await checkReadmeBadges(dir, opts.badges.audience, opts.badges.fixTarget, opts.badges.name));
     results.push(await checkCoverageUpload(dir));
     return results;
 }
@@ -253,20 +253,21 @@ export async function runDoctor(dir, skillsDir) {
     const lock = await readLockfile(targetDir);
     // Per-module dispatch (#285): the base checks (repo hygiene, CI, security,
     // GitHub settings) apply to any repo and run for every language. A supported
-    // module layers its own checks on top. 'unknown' (bare dir mid-setup)
-    // resolves to JS so a fresh repo runs the full suite.
-    const language = await detectLanguage(targetDir);
+    // module layers its own checks on top. 'unknown' (no marker) gets the base
+    // suite only — JS checks against a C++ or Go repo are all noise (#632).
+    const language = await detectAuditLanguage(targetDir);
     const languageModule = resolveLanguageModule(language);
-    // Every language in the registry has a module as of #289, so nothing reaches
-    // this today. It stays as the on-ramp: a language is added to the registry
-    // with `supported: false` first, and until its module lands its repos get the
+    // Also the on-ramp for a new language: it is added to the registry with
+    // `supported: false` first, and until its module lands its repos get the
     // full base suite rather than the wholesale skip this replaced.
-    if (!languageModule.supported) {
+    if (!languageModule?.supported) {
         const results = [
             {
                 check: 'language',
                 status: 'ok',
-                detail: `detected ${languageModule.label} — running language-agnostic checks; ${languageModule.label}-specific checks land with its module (#139)`,
+                detail: languageModule
+                    ? `detected ${languageModule.label} — running language-agnostic checks; ${languageModule.label}-specific checks land with its module (#139)`
+                    : 'no language marker (package.json, Package.swift, pyproject.toml, cpanfile, …) — running language-agnostic checks only',
             },
             // hooks: null — guessing a hook convention would nag every repo with a
             // fix target that doesn't exist.
@@ -275,7 +276,7 @@ export async function runDoctor(dir, skillsDir) {
                 badges: { audience: 'public', fixTarget: null },
                 presetWorkflow: null,
                 language,
-                codeqlLanguages: languageModule.codeqlLanguages,
+                codeqlLanguages: languageModule?.codeqlLanguages ?? [],
                 skillsDir,
             })),
         ];
@@ -407,7 +408,11 @@ export async function runDoctor(dir, skillsDir) {
     }
     results.push(...(await runBaseChecks(targetDir, lock, {
         hooks: jsGitHooksProfile(pkg),
-        badges: { audience: jsBadgeAudience(pkg), fixTarget: 'badges' },
+        badges: {
+            audience: jsBadgeAudience(pkg),
+            fixTarget: 'badges',
+            name: typeof pkg?.name === 'string' ? pkg.name : undefined,
+        },
         // Same `scripts` gating the fixer applies, or the workflow doctor
         // compares against would reference steps the fixer never writes (#364).
         presetWorkflow: renderGitHubWorkflow(githubJobs(inferProjectConfig(pkg), { scripts: scriptsOf(pkg) })),
@@ -521,7 +526,7 @@ export async function doctorCommand(options = {}) {
         const summary = summarize(results);
         console.log();
         console.log(`  Summary: ${chalk.green(`${summary.ok} ok`)}, ${chalk.yellow(`${summary.drift} drift`)}, ${chalk.red(`${summary.missing} missing`)}, ${chalk.gray(`${summary.optionalMissing} not configured`)}, ${chalk.blue(`${summary.declared} declared`)}\n`);
-        const suggestions = nextStepSuggestions(results, await detectLanguage(dir));
+        const suggestions = nextStepSuggestions(results, await detectAuditLanguage(dir));
         if (suggestions.length > 0) {
             console.log(chalk.bold('  Next steps:'));
             for (const s of suggestions) {

package/dist/cli/commands/fix.js

@@ -14,20 +14,21 @@ import { FIXERS, readPackageJson } from '../../languages/js/fixers.js';
 import { PERL_FIXERS } from '../../languages/perl/fixers.js';
 import { PYTHON_FIXERS } from '../../languages/python/fixers.js';
 import { SWIFT_FIXERS } from '../../languages/swift/fixers.js';
-import { detectLanguage } from '../utils/detect-language.js';
+import { detectAuditLanguage } from '../utils/detect-language.js';
 /** The module-specific fixer set per detected language (#286, #289, #290, #303). */
 const LANGUAGE_FIXERS = {
+    js: FIXERS,
     swift: SWIFT_FIXERS,
     python: PYTHON_FIXERS,
     perl: PERL_FIXERS,
 };
 /**
  * The fixers that apply to a repo, by detected language: the language-agnostic
- * base set plus the module's own. Anything without a module of its own
- * (including a bare dir mid-setup) gets JS, the historical default.
+ * base set plus the module's own. A repo with no marker gets the base set only —
+ * the JS fixers would run against a missing package.json (#632).
  */
 function fixersForLanguage(language) {
-    return [...BASE_FIXERS, ...(LANGUAGE_FIXERS[language] ?? FIXERS)];
+    return [...BASE_FIXERS, ...(LANGUAGE_FIXERS[language] ?? [])];
 }
 /** Every fixer across every language — for `--list` and the unknown-target hint. */
 const ALL_FIXERS = [
@@ -133,8 +134,16 @@ async function previewFixer(fixer, result, targetDir, pkg, lock) {
             },
         });
         // assumeYes: a preview must never prompt.
+        let written;
         try {
-            await fixer.run({ targetDir: tmpDir, pkg, result, lock, assumeYes: true });
+            ;
+            ({ filesWritten: written } = await fixer.run({
+                targetDir: tmpDir,
+                pkg,
+                result,
+                lock,
+                assumeYes: true,
+            }));
         }
         catch (err) {
             // A fixer that refuses has nothing to preview. Swallow it here rather than
@@ -146,14 +155,21 @@ async function previewFixer(fixer, result, targetDir, pkg, lock) {
         }
         const previews = [];
         const seen = new Set();
-        for (const output of fixer.outputs) {
+        // Declared outputs miss globbed writes (apps/docs/**), so also take what the
+        // shadow run reported writing.
+        const candidates = [
+            ...fixer.outputs,
+            ...written.map((f) => (path.isAbsolute(f) ? path.relative(tmpDir, f) : f)),
+        ];
+        for (const output of candidates) {
             const rel = outputToRelativePath(output);
-            if (seen.has(rel))
+            if (seen.has(rel) || rel.startsWith('..'))
                 continue;
             seen.add(rel);
             const tmpPath = path.join(tmpDir, rel);
             const realPath = path.join(targetDir, rel);
-            if (!(await fs.pathExists(tmpPath)))
+            const stat = await fs.stat(tmpPath).catch(() => null);
+            if (!stat?.isFile())
                 continue;
             const newContent = await fs.readFile(tmpPath, 'utf-8');
             const existed = await fs.pathExists(realPath);
@@ -197,12 +213,34 @@ function printPreviews(previews) {
         }
     }
 }
+/**
+ * What a fixer would actually change. Shadow-runs it like `--diff` does, except
+ * for safe-add fixers: some of those write remote state or the home dir, so they
+ * are never executed — and since they only create missing files, the declared
+ * outputs that already exist are dropped instead.
+ */
+async function dryRunFiles(fixer, result, targetDir, pkg, lock) {
+    if ((fixer.riskLevel ?? 'destructive') === 'safe-add') {
+        const missing = [];
+        for (const out of fixer.outputs) {
+            if (!(await fs.pathExists(path.join(targetDir, outputToRelativePath(out))))) {
+                missing.push(out);
+            }
+        }
+        return missing;
+    }
+    const previews = await previewFixer(fixer, result, targetDir, pkg, lock);
+    return previews.filter((p) => p.kind !== 'unchanged').map((p) => p.path);
+}
 async function applyFixer(fixer, result, targetDir, pkg, lock, dryRun, silent, opts) {
     if (dryRun) {
+        const files = await dryRunFiles(fixer, result, targetDir, pkg, lock);
         if (!silent) {
-            console.log(chalk.cyan(`  [dry-run] would write: ${fixer.outputs.join(', ')}`));
+            console.log(chalk.cyan(files.length > 0
+                ? `  [dry-run] would write: ${files.join(', ')}`
+                : '  [dry-run] nothing to write'));
         }
-        return { filesWritten: [], dryRun: true };
+        return { filesWritten: files, dryRun: true };
     }
     const { filesWritten } = await fixer.run({ targetDir, pkg, result, lock, ...opts });
     if (!silent && filesWritten.length > 0) {
@@ -332,7 +370,7 @@ export async function fixCommand(target, options = {}) {
     }
     const pkg = await readPackageJson(targetDir);
     const lock = await readLockfile(targetDir);
-    const fixers = fixersForLanguage(await detectLanguage(targetDir));
+    const fixers = fixersForLanguage(await detectAuditLanguage(targetDir));
     // Same --skills-dir the claude-skills fixer writes to, so the diagnosis fix
     // acts on and the install it performs agree on one directory (#485).
     const results = await runDoctor(targetDir, options.skillsDir);
@@ -489,7 +527,8 @@ export async function fixCommand(target, options = {}) {
         // A fixer that refuses (e.g. dependabot, when the existing config carries
         // repo-local `ignore:` rules the template can't reproduce) is a skip, not a
         // crash — the remaining findings still deserve their fixers. The reason goes
-        // to stderr so it survives `--json`.
+        // to stderr so it survives `--json`. An unexpected error is skipped the same
+        // way (#636): rethrowing it killed the walk mid-run with no JSON on stdout.
         let outcome;
         try {
             outcome = await applyFixer(fixer, result, targetDir, pkg, lock, dryRun, silent, {
@@ -499,12 +538,15 @@ export async function fixCommand(target, options = {}) {
             });
         }
         catch (err) {
-            if (!(err instanceof FixerAbort))
-                throw err;
             actions.push(recordFor(fixer.target, result.check, result.status, 'skipped', [], conflict));
-            console.error(chalk.red(`    refused — ${err.message}`));
-            if (err.hint)
-                console.error(chalk.gray(`    ${err.hint}`));
+            if (err instanceof FixerAbort) {
+                console.error(chalk.red(`    refused — ${err.message}`));
+                if (err.hint)
+                    console.error(chalk.gray(`    ${err.hint}`));
+            }
+            else {
+                console.error(chalk.red(`    failed — ${err instanceof Error ? err.message : String(err)}`));
+            }
             skippedCount++;
             continue;
         }

package/dist/cli/generators/badges.js

@@ -56,9 +56,29 @@ export function buildBadgeBlock(inputs) {
     const row = buildBadgeRow(inputs);
     return row ? `${BADGE_START}\n${row}\n${BADGE_END}` : '';
 }
-/** True when the text carries npm/bundlephobia/codecov badges (which 404 on private/unpublished). */
-export function hasPublicOnlyBadges(text) {
-    return /img\.shields\.io\/npm\/|bundlephobia|codecov\.io/.test(text);
+/**
+ * True when the text carries npm/bundlephobia/codecov badges (which 404 on
+ * private/unpublished). Given `name`, npm/bundlephobia badges count only when
+ * they point at that package — a README may advertise *other* packages (#634).
+ */
+export function hasPublicOnlyBadges(text, name) {
+    if (/codecov\.io/.test(text))
+        return true;
+    if (!name)
+        return /img\.shields\.io\/npm\/|bundlephobia/.test(text);
+    const refs = text.matchAll(/(?:img\.shields\.io\/npm\/[\w-]+|bundlephobia\/[\w-]+|bundlephobia\.com\/package)\/([^\s)"'?#]+)/g);
+    for (const [, raw = ''] of refs) {
+        let ref = raw;
+        try {
+            ref = decodeURIComponent(raw);
+        }
+        catch {
+            // Malformed escape — compare the raw text.
+        }
+        if (ref === name || ref.startsWith(`${name}/`))
+            return true;
+    }
+    return false;
 }
 /**
  * Insert or refresh the badge block in a README. Replaces an existing delimited

package/dist/cli/generators/git.js

@@ -1,5 +1,6 @@
 import fs from 'fs-extra';
 import path from 'node:path';
+import { hookHasUncommented } from '../../base/checks.js';
 export const PRE_PUSH_HOOK_CONTENT = `echo "🔍 Running pre-push verify..."
 pnpm verify
 STATUS=$?
@@ -25,10 +26,7 @@ export async function generateHuskyConfig(config, targetDir) {
     // Pre-commit hook. husky v10 format: just the command — the v9 shebang +
     // `. "$(dirname ...)/_/husky.sh"` bootstrap is deprecated (warns on every
     // hook run in v9, fails outright in v10).
-    const preCommitPath = path.join(huskyDir, 'pre-commit');
-    const preCommitContent = 'npx lint-staged\n';
-    await fs.writeFile(preCommitPath, preCommitContent);
-    await fs.chmod(preCommitPath, 0o755);
+    await ensureHookRuns(path.join(huskyDir, 'pre-commit'), /\blint-staged\b/, 'npx lint-staged\n');
     // Pre-push hook — only when the package.json already has a `verify` script.
     // In the setup flow, generatePackageJson runs before this and writes verify
     // when 2+ tools are enabled. In the `fix husky` path, a pre-existing verify
@@ -63,9 +61,24 @@ export async function generateHuskyConfig(config, targetDir) {
 export async function generatePrePushHook(targetDir) {
     const huskyDir = path.join(targetDir, '.husky');
     await fs.ensureDir(huskyDir);
-    const prePushPath = path.join(huskyDir, 'pre-push');
-    await fs.writeFile(prePushPath, PRE_PUSH_HOOK_CONTENT);
-    await fs.chmod(prePushPath, 0o755);
+    await ensureHookRuns(path.join(huskyDir, 'pre-push'), /\bpnpm\s+verify\b/, PRE_PUSH_HOOK_CONTENT, 'pnpm verify\n');
+}
+/**
+ * Write a missing hook; append the command to an existing hook that lacks it.
+ * Never replaces a hand-written hook (#629). Husky runs hooks with `sh -e`, so
+ * an appended command still fails the hook when it fails.
+ */
+async function ensureHookRuns(hookPath, runs, fresh, line = fresh) {
+    if (!(await fs.pathExists(hookPath))) {
+        await fs.writeFile(hookPath, fresh);
+    }
+    else {
+        const existing = await fs.readFile(hookPath, 'utf-8');
+        if (hookHasUncommented(existing, runs))
+            return;
+        await fs.writeFile(hookPath, `${existing.replace(/\n*$/, '\n')}${line}`);
+    }
+    await fs.chmod(hookPath, 0o755);
 }
 /** Package versions the commit-msg hook needs on disk to run at all. */
 export const COMMITLINT_DEPS = {

package/dist/cli/generators/security.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import fs from 'fs-extra';
 import { renderCodeQLWorkflow } from '../../base/ci.js';
 import { LANGUAGES } from '../../languages/registry.js';
+import { detectLanguage } from '../utils/detect-language.js';
 /**
  * The canonical dependency-update standard shared by every @rtorcato repo.
  *
@@ -73,6 +74,37 @@ export const DEPENDABOT_CONFIG_PATHS = [
     '.github/dependabot.yml',
     '.github/dependabot.yaml',
 ];
+/**
+ * The manifest ecosystem a repo's dependabot.yml should cover, or null when it
+ * has none — Perl, or a repo with no recognised manifest at all (#631). Unlike
+ * `resolveLanguageModule`, `unknown` does not fall back to npm here: a C++ repo
+ * with no package.json has nothing for an npm block to update.
+ */
+export async function dependabotEcosystemFor(dir) {
+    const language = await detectLanguage(dir);
+    return language === 'unknown' ? null : LANGUAGES[language].dependabotEcosystem;
+}
+/**
+ * How an existing dependabot.yml falls short of `dependabotConfig(ecosystem)`.
+ * The canonical groups live on the manifest block, so a repo with no manifest
+ * ecosystem is not expected to carry them (#631).
+ */
+export function dependabotConfigDeltas(content, ecosystem) {
+    if (ecosystem === null)
+        return [];
+    return ['production-minor', 'dev-minor', 'major-updates']
+        .filter((group) => !new RegExp(`^\\s*${group}:`, 'm').test(content))
+        .map((group) => `missing \`${group}\` group`);
+}
+/** The existing dependabot config, in Dependabot's resolution order, or null. */
+export async function readDependabotConfig(dir) {
+    for (const file of DEPENDABOT_CONFIG_PATHS) {
+        const candidate = path.join(dir, file);
+        if (await fs.pathExists(candidate))
+            return { file, content: await fs.readFile(candidate, 'utf8') };
+    }
+    return null;
+}
 /**
  * The `ignore:` rules an existing dependabot.yml carries, named by
  * `dependency-name` (#422).
@@ -236,14 +268,11 @@ export const DEPENDABOT_FILES = [
  * they live in — or null when there is nothing to lose (#422).
  */
 export async function findDependabotIgnoreRules(targetDir) {
-    for (const file of DEPENDABOT_CONFIG_PATHS) {
-        const candidate = path.join(targetDir, file);
-        if (!(await fs.pathExists(candidate)))
-            continue;
-        const rules = dependabotIgnoreRules(await fs.readFile(candidate, 'utf8'));
-        return rules.length > 0 ? { file, rules } : null;
-    }
-    return null;
+    const existing = await readDependabotConfig(targetDir);
+    if (!existing)
+        return null;
+    const rules = dependabotIgnoreRules(existing.content);
+    return rules.length > 0 ? { file: existing.file, rules } : null;
 }
 /**
  * Scaffold the canonical Dependabot setup: the grouped \`dependabot.yml\` **and**

package/dist/cli/generators/typedoc.js

@@ -32,9 +32,12 @@ export async function generateTypedocConfig(pkg, targetDir) {
     };
     await fs.writeJson(path.join(targetDir, 'typedoc.json'), config, { spaces: 2 });
 }
+/** The path written, or null when a docs.yml already exists — never replaced (#629). */
 export async function generateTypedocWorkflow(targetDir) {
-    const workflowsDir = path.join(targetDir, '.github', 'workflows');
-    await fs.ensureDir(workflowsDir);
-    await fs.writeFile(path.join(workflowsDir, 'docs.yml'), DOCS_WORKFLOW);
-    return '.github/workflows/docs.yml';
+    const rel = '.github/workflows/docs.yml';
+    const workflowPath = path.join(targetDir, rel);
+    if (await fs.pathExists(workflowPath))
+        return null;
+    await fs.outputFile(workflowPath, DOCS_WORKFLOW);
+    return rel;
 }

package/dist/cli/utils/detect-language.js

@@ -5,6 +5,10 @@ import fs from 'fs-extra';
  * wins. One language per repo root; multi-language monorepos stay out of scope
  * (#139, reaffirmed in #317 — the audit is root-only, but says so via
  * `detectNestedLanguages`). A dir with no marker → 'unknown' (base checks only).
+ *
+ * One exception to the order: `Package.swift` beats a `package.json` that ships
+ * no JS (no `main`/`exports`/`bin`) — a Swift package whose root `package.json`
+ * only drives its docs site is a Swift repo (#633).
  */
 const MARKERS = [
     ['js', ['package.json']],
@@ -12,7 +16,14 @@ const MARKERS = [
     ['perl', ['cpanfile', 'Makefile.PL', 'dist.ini']],
     ['python', ['pyproject.toml', 'setup.py']],
 ];
+/** True when `package.json` declares a JS entry point — the repo ships JS, not just tooling. */
+async function shipsJs(dir) {
+    const pkg = await fs.readJson(path.join(dir, 'package.json')).catch(() => null);
+    return Boolean(pkg && (pkg.main || pkg.exports || pkg.bin));
+}
 export async function detectLanguage(dir) {
+    if ((await fs.pathExists(path.join(dir, 'Package.swift'))) && !(await shipsJs(dir)))
+        return 'swift';
     for (const [language, candidates] of MARKERS) {
         for (const candidate of candidates) {
             if (await fs.pathExists(path.join(dir, candidate)))
@@ -21,6 +32,20 @@ export async function detectLanguage(dir) {
     }
     return 'unknown';
 }
+/**
+ * The language doctor/fix audit a repo as. Like `detectLanguage`, except a fresh
+ * dir — nothing but dotfiles (`.git`, the lockfile) — is audited as JS, the
+ * default `setup` scaffolds, so its full suite shows what is still to come. A
+ * dir with real content and no marker (C++, Go, a README) stays 'unknown' and
+ * gets the base checks only (#632).
+ */
+export async function detectAuditLanguage(dir) {
+    const language = await detectLanguage(dir);
+    if (language !== 'unknown')
+        return language;
+    const entries = await fs.readdir(dir).catch(() => []);
+    return entries.every((entry) => entry.startsWith('.')) ? 'js' : 'unknown';
+}
 /** Never worth descending into, and expensive when we do. */
 const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'target', 'vendor', '.build']);
 /**

package/dist/languages/js/checks.js

@@ -1147,7 +1147,10 @@ export async function checkExportsBuildable(dir, pkg, exec) {
 }
 /** Who this package's README badges are for — feeds the base badge check (#309). */
 export function jsBadgeAudience(pkg) {
-    if (!pkg || pkg.private === true)
+    // No package.json: nothing here is published, so no npm badge can be ours (#634).
+    if (!pkg)
+        return 'not-applicable';
+    if (pkg.private === true)
         return 'private';
     return isPublishableLibrary(pkg) ? 'public' : 'not-applicable';
 }

package/dist/languages/js/fixers.js

@@ -304,6 +304,11 @@ export const FIXERS = [
         canFixDrift: true,
         async run({ targetDir, pkg }) {
             const pkgPath = path.join(targetDir, 'package.json');
+            // Refuse before writing any hook: lint-staged lives in package.json, so a
+            // repo without a readable one cannot be wired (#636).
+            if (!pkg) {
+                throw new FixerAbort('no-package-json', 'no readable package.json — husky needs one for lint-staged', 'add a package.json, then re-run');
+            }
             const existingLintStaged = pkg?.['lint-staged'] ?? {};
             await generateHuskyConfig(inferProjectConfig(pkg), targetDir);
             const updated = (await fs.readJson(pkgPath));
@@ -690,7 +695,7 @@ export const FIXERS = [
             await generateTypedocConfig(pkg, targetDir);
             const workflow = await generateTypedocWorkflow(targetDir);
             const pkgPath = path.join(targetDir, 'package.json');
-            const filesWritten = ['typedoc.json', workflow];
+            const filesWritten = workflow ? ['typedoc.json', workflow] : ['typedoc.json'];
             if (await fs.pathExists(pkgPath)) {
                 const pkgData = (await fs.readJson(pkgPath));
                 const scripts = pkgData.scripts ?? {};

package/dist/languages/registry.js

@@ -29,9 +29,11 @@ export const LANGUAGES = {
     },
 };
 /**
- * Resolve the module for a detected language. `unknown` (a bare dir mid-setup)
- * maps to JS — the historical default so a fresh repo still gets the full suite.
+ * Resolve the module for a detected language, or null for `unknown` — a repo
+ * with no marker (C++, Go, a README) gets the base suite only, never JS (#632).
+ * A fresh, empty dir never arrives as `unknown`: `detectAuditLanguage` audits
+ * it as JS, and setup's language picker defaults it to JS itself.
  */
 export function resolveLanguageModule(language) {
-    return language === 'unknown' ? LANGUAGES.js : LANGUAGES[language];
+    return language === 'unknown' ? null : LANGUAGES[language];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.38.0",
+	"version": "3.38.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [