@rtorcato/repo-tooling 3.45.0 → 4.1.0

package/dist/cli/generators/brand.js

@@ -6,8 +6,9 @@
  * PNG, so a banner can be recoloured, retitled or resized instead of being a
  * committed binary nobody can regenerate.
  *
- * Everything in the emitted SVGs is derived from the consuming repo — name and
- * tagline from its package.json, accent from its own docs theme or favicon —
+ * Everything in the emitted SVGs is derived from the consuming repo — name from
+ * its package.json, tagline from `rules.brand.tagline` in .repo-tooling.json or
+ * else the package.json description (#666), accent from its own docs theme or favicon —
  * and falls back to a neutral grey. Nothing about any particular org is baked
  * in; the templates are meant to be hand-edited afterwards.
  */
@@ -94,14 +95,29 @@ async function accentFromFavicon(targetDir) {
     }
     return null;
 }
-export async function resolveBrandMeta(pkg, targetDir) {
+/**
+ * The narrowest tagline budget any canvas uses (the mobile banner). A tagline
+ * that needs more than two lines of it crowds the layout and gets cut off.
+ */
+const TAGLINE_MAX_CHARS = 42;
+/** True when `tagline` fits in two lines on every canvas, without an ellipsis. */
+export function taglineFits(tagline) {
+    const words = tagline.split(/\s+/).filter(Boolean).join(' ');
+    return wrapText(tagline, TAGLINE_MAX_CHARS, 2).join(' ') === words;
+}
+/**
+ * `tagline` is `rules.brand.tagline` from .repo-tooling.json: a short line
+ * written for the banner. Without it the package.json description stands in,
+ * which is often a full sentence too long for the canvas (#666).
+ */
+export async function resolveBrandMeta(pkg, targetDir, tagline) {
     const pkgName = typeof pkg?.name === 'string' ? pkg.name : undefined;
     const name = pkgName?.split('/').pop() ?? path.basename(path.resolve(targetDir));
     const description = typeof pkg?.description === 'string' ? pkg.description : '';
     const accent = (await accentFromDocsTheme(targetDir)) ?? (await accentFromFavicon(targetDir)) ?? NEUTRAL_ACCENT;
     return {
         name,
-        tagline: description || 'Add a one-line tagline to package.json "description".',
+        tagline: tagline || description || 'Add a short tagline as rules.brand.tagline in .repo-tooling.json.',
         accent,
         install: pkgName && pkg?.private !== true ? pkgName : null,
     };
@@ -268,8 +284,8 @@ export async function repointReadmeBanners(targetDir) {
  * README still on the old root-level paths. Every file is written only when
  * absent, so `fix brand` is idempotent.
  */
-export async function generateBrand(pkg, targetDir) {
-    const meta = await resolveBrandMeta(pkg, targetDir);
+export async function generateBrand(pkg, targetDir, tagline) {
+    const meta = await resolveBrandMeta(pkg, targetDir, tagline);
     const written = [];
     const files = [
         ['brand/banner.svg', bannerSvg(meta)],
@@ -282,6 +298,10 @@ export async function generateBrand(pkg, targetDir) {
         if (w)
             written.push(w);
     }
+    // stderr, not stdout: `fix --json` owns stdout (#357).
+    if (written.some((f) => f.endsWith('.svg')) && !taglineFits(meta.tagline)) {
+        console.error('   warning: the tagline needs more than two lines and will be cut off on the mobile banner — set a shorter one as rules.brand.tagline in .repo-tooling.json');
+    }
     const readme = await repointReadmeBanners(targetDir);
     if (readme)
         written.push(readme);

package/dist/cli/generators/docs-site.js

@@ -3,6 +3,7 @@ import fs from 'fs-extra';
 import selfPackageJson from '../../../package.json' with { type: 'json' };
 import { copyPreset, PRESETS } from '../utils/copy-preset.js';
 import { buildBadgeRow, parseRepository } from './badges.js';
+import { DOCS_SITE_BUILDS, mergeAllowBuilds } from './pnpm-workspace.js';
 import { inferSubpathsFromExports } from './treeshake.js';
 /**
  * What a scaffolded docs site should depend on for *this* CLI — read from the
@@ -64,24 +65,25 @@ async function writeIfMissing(targetDir, rel, contents) {
     await fs.writeFile(file, contents);
     return rel;
 }
-/** Ensure `pnpm-workspace.yaml` lists `apps/*` (idempotent). */
+/**
+ * Ensure `pnpm-workspace.yaml` lists `apps/*` and approves the site's build
+ * scripts (idempotent).
+ */
 async function ensureWorkspace(targetDir) {
     const rel = 'pnpm-workspace.yaml';
     const file = path.join(targetDir, rel);
-    if (await fs.pathExists(file)) {
-        const body = await fs.readFile(file, 'utf8');
-        // Already a workspace covering apps/* (either `apps/*` or a broader glob).
-        if (/^\s*-\s*['"]?apps\/\*/m.test(body))
-            return null;
-        if (/^packages:/m.test(body)) {
-            const next = body.replace(/^packages:\n/m, "packages:\n  - 'apps/*'\n");
-            await fs.writeFile(file, next);
-            return rel;
-        }
-        await fs.writeFile(file, `packages:\n  - 'apps/*'\n\n${body}`);
-        return rel;
+    const body = (await fs.pathExists(file)) ? await fs.readFile(file, 'utf8') : '';
+    let next = body;
+    // Already a workspace covering apps/* (either `apps/*` or a broader glob).
+    if (!/^\s*-\s*['"]?apps\/\*/m.test(body)) {
+        next = /^packages:/m.test(body)
+            ? body.replace(/^packages:\n/m, "packages:\n  - 'apps/*'\n")
+            : `packages:\n  - 'apps/*'\n${body ? `\n${body}` : ''}`;
     }
-    await fs.writeFile(file, "packages:\n  - 'apps/*'\n");
+    next = mergeAllowBuilds(next, DOCS_SITE_BUILDS);
+    if (next === body)
+        return null;
+    await fs.writeFile(file, next);
     return rel;
 }
 /** The GitHub Pages base path Docusaurus serves under, e.g. `/repo-tooling/`. */
@@ -380,6 +382,16 @@ export default defineConfig({
 })
 `;
 }
+// routeBasePath is '/docs', so the site root has no page of its own and the
+// navbar logo links to a 404 on every page (#664). Redirect it to the docs.
+// Tabs/no semicolons to match the Biome preset the consuming repo is linted with.
+const HOME_PAGE = `import { Redirect } from '@docusaurus/router'
+import useBaseUrl from '@docusaurus/useBaseUrl'
+
+export default function Home() {
+\treturn <Redirect to={useBaseUrl('/docs')} />
+}
+`;
 const SMOKE_SPEC = `import { expect, test } from '@playwright/test'
 
 // Smoke test: assert the built site serves and its core UI renders. Deliberately
@@ -426,6 +438,7 @@ export async function generateDocsSite(pkg, targetDir, options = {}) {
         [`${DOCS_APP}/sidebars.ts`, SIDEBARS],
         [`${DOCS_APP}/tsconfig.json`, TSCONFIG],
         [`${DOCS_APP}/src/css/custom.css`, customCss(accent)],
+        [`${DOCS_APP}/src/pages/index.tsx`, HOME_PAGE],
         [`${DOCS_APP}/docs/intro.md`, introDoc(meta, badges)],
         [`${DOCS_APP}/playwright.config.ts`, playwrightConfig(meta)],
         [`${DOCS_APP}/tests/smoke.spec.ts`, SMOKE_SPEC],

package/dist/cli/generators/pnpm-workspace.js

@@ -156,6 +156,32 @@ function insertUnder(yaml, key, item) {
     lines.splice(at + 1, 0, item);
     return lines.join('\n');
 }
+/**
+ * The build-script decisions a Docusaurus site needs under pnpm 11 (#663): it
+ * pulls in all four, and an undecided one fails the install. core-js's
+ * postinstall is only a banner, so it is declined; esbuild and sharp compile.
+ */
+export const DOCS_SITE_BUILDS = {
+    'core-js': false,
+    'core-js-pure': false,
+    esbuild: true,
+    sharp: true,
+};
+/**
+ * Merge `builds` into the `allowBuilds:` map, adding only the packages that
+ * carry no decision yet — an existing value, whichever way it went, stays.
+ */
+export function mergeAllowBuilds(yaml, builds) {
+    const entries = Object.entries(builds)
+        .filter(([name]) => !approved(yaml, name))
+        .map(([name, allow]) => `  ${asKey(name)}: ${allow}`)
+        .join('\n');
+    if (!entries)
+        return yaml;
+    if (section(yaml, 'allowBuilds'))
+        return insertUnder(yaml, 'allowBuilds', entries);
+    return `${yaml.replace(/\n*$/, '\n')}\nallowBuilds:\n${entries}\n`;
+}
 /** Merge every missing managed setting into `yaml` and return the new contents. */
 export function upsertPnpmSettings(yaml, needsEsbuild, glob) {
     let next = yaml;

package/dist/cli/index.js

@@ -5,13 +5,6 @@ import { Command } from 'commander';
 import fs from 'fs-extra';
 import { doctorCommand } from './commands/doctor.js';
 import { fixCommand } from './commands/fix.js';
-import { loopCleanupCommand } from './commands/loop-cleanup.js';
-import { loopEnvCommand } from './commands/loop-env.js';
-import { loopGuardCommand } from './commands/loop-guard.js';
-import { loopCommentCommand, loopVerdictCommand } from './commands/loop-marker.js';
-import { loopReapCommand } from './commands/loop-reap.js';
-import { loopTickCommand } from './commands/loop-tick.js';
-import { loopWorktreeAddCommand } from './commands/loop-worktree.js';
 import { setupProject } from './commands/setup.js';
 import { copyPreset, PRESETS } from './utils/copy-preset.js';
 import { getToolVersion } from './utils/version.js';
@@ -297,12 +290,6 @@ const TOOL_CATALOG = [
         exports: [],
         fixTarget: 'ai',
     },
-    {
-        name: 'Claude skills',
-        description: 'Install the ai-issue-loop skill into ~/.claude/skills (user-global, opt-in — see --skills-dir)',
-        exports: [],
-        fixTarget: 'claude-skills',
-    },
 ];
 program
     .command('list')
@@ -326,9 +313,6 @@ program
     .description('🩺 Diagnose project alignment with @rtorcato/repo-tooling presets')
     .option('-d, --directory <path>', 'Target directory to diagnose', process.cwd())
     .option('--json', 'Emit machine-readable JSON output')
-    // The read side of `fix --skills-dir` (#485). No --yes/--json requirement
-    // here: doctor never writes, so an unresolved directory is just reported.
-    .option('--skills-dir <path>', 'Where `fix claude-skills` installs user-global agent skills (default: ~/.claude/skills). Pass the same path `fix` was given, or the skill reports as not installed')
     // Rules are per-repo (#563): this compares them against another repo's, and
     // only reports. Never drift, never a fixer, never part of the exit code.
     .option('--rules-from <owner/repo>', "Report how this repo's config and rules differ from that repo's .repo-tooling.json (informational; read via `gh`)")
@@ -343,11 +327,6 @@ program
     .option('--list', 'List all registered fix targets and exit')
     .option('--resync', 'Re-scaffold every file recorded in .repo-tooling.json')
     .option('--diff', 'Show a unified diff of each change before confirming')
-    .option('--skills-dir <path>', 'Where `fix claude-skills` installs user-global agent skills (default: ~/.claude/skills). Required with --yes/--json when that directory does not exist')
-    // Deliberately not folded into --yes: unattended runs pass --yes, and this is
-    // the one overwrite that destroys work living outside the repo (#480).
-    .option('--force-skills', 'Let `fix claude-skills` overwrite a locally modified skill instead of refusing')
-    .option('--gh-config-dir <path>', 'gh profile signed in as rules.aiLoop.agentUser, for `fix ai-loop-identity` (default: ~/.config/gh-<agentUser>)')
     .action((target, options) => fixCommand(target, {
     directory: options.directory,
     yes: options.yes,
@@ -356,88 +335,21 @@ program
     list: options.list,
     resync: options.resync,
     diff: options.diff,
-    skillsDir: options.skillsDir,
-    forceSkills: options.forceSkills,
-    ghConfigDir: options.ghConfigDir,
 }));
-// Mechanics the ai-issue-loop skill used to describe in prose-with-shell (#519).
-// Deliberately outside the isSelfRepo hook below: the loop runs against this
-// repo like any other, and a guard that refuses here would guard nothing.
-const loop = program.command('loop').description('🔁 ai-issue-loop mechanics as tested commands');
-loop
-    .command('guard')
-    .description('🛡️  Repair a wrongly-bare main checkout and gate the node_modules rebuild')
-    .option('--root <path>', 'Main checkout the loop branches worktrees from', process.cwd())
-    .option('--worktree-root <path>', 'Where ai-* worktrees live (default: <root>-worktrees)')
-    .option('--removed', 'A worktree was removed this tick — consider rebuilding node_modules')
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', '\nExit codes:\n' +
-    '  0  root is a usable work tree (healthy, or repaired in place) — continue the tick\n' +
-    '  1  repair was attempted and failed; the root is still bare — halt the tick\n' +
-    '  2  root is not a repairable main checkout (bare clone, linked worktree, or not a repo) — halt the tick\n')
-    .action(loopGuardCommand);
-loop
-    .command('env')
-    .description('🧭 Resolve ROOT, WT_ROOT, OWNER_REPO, AGENT_USER, HUMAN_USER and ME once')
-    .option('-d, --dir <path>', 'Directory to resolve from — main checkout or any worktree', process.cwd())
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', "\nWithout --json, prints KEY='value' lines for eval. Empty means none.\n" +
-    'Exits 1 when the checkout or its GitHub repo cannot be resolved.\n')
-    .action(loopEnvCommand);
-loop
-    .command('cleanup')
-    .description('🧹 Remove ai-* worktrees whose PR landed on main or was closed')
-    .option('--root <path>', 'Main checkout the loop branches worktrees from', process.cwd())
-    .option('--worktree-root <path>', 'Where ai-* worktrees live (default: <root>-worktrees)')
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', '\nPass `removed` from --json to `loop guard --removed`.\n' +
-    'Exits 1 when a worktree removal failed.\n')
-    .action(loopCleanupCommand);
-loop
-    .command('worktree')
-    .description('🌳 Loop worktree mechanics')
-    .command('add <slug>')
-    .description('🌱 Create ai-<issue>-<slug> off origin/main, link its deps, assert none are missing')
-    .option('--root <path>', 'Main checkout to branch the worktree from', process.cwd())
-    .option('--worktree-root <path>', 'Where ai-* worktrees live (default: <root>-worktrees)')
-    .option('--base <ref>', 'Ref to branch from', 'origin/main')
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', '\nExit 1 when the worktree was not created or a symlinkDirectories entry is left\n' +
-    'unlinked — do not spawn an implementer. needsInstall means no list was declared.\n')
-    .action(loopWorktreeAddCommand);
-loop
-    .command('reap')
-    .description('🪦 Report agents stalled past 45 minutes and what to do about each')
-    .option('--root <path>', 'Main checkout the loop branches worktrees from', process.cwd())
-    .option('--worktree-root <path>', 'Where ai-* worktrees live (default: <root>-worktrees)')
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', '\nRead-only: prints a verdict per stall (block / drop-label / remove-worktree).\n' +
-    'Exits 1 when a gh query failed and the report is incomplete.\n')
-    .action(loopReapCommand);
-loop
-    .command('comment <pr>')
-    .description("💬 Upsert the loop's one decision-marker comment on a PR")
-    .requiredOption('--body-file <path>', 'Comment text, without the marker (- for stdin)')
-    .option('-d, --dir <path>', 'Directory to resolve the GitHub repo from', process.cwd())
-    .option('--json', 'Emit machine-readable JSON output')
-    .action(loopCommentCommand);
-loop
-    .command('verdict <pr>')
-    .description("⚖️  Read a reviewer arm's verdict marker for the PR's current head")
-    .requiredOption('--arm <arm>', 'Reviewer arm: code or sec')
-    .option('-d, --dir <path>', 'Directory to resolve the GitHub repo from', process.cwd())
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', '\nPrints PASS, PASS-NOTES, CHANGES, or an empty line when none is posted.\n' +
-    'Exits 1 when the PR or its reviews cannot be read.\n')
-    .action(loopVerdictCommand);
-loop
-    .command('tick')
-    .description("📋 Compute one tick's work list — guard, cleanup, reap, verdicts, pickups")
-    .option('--root <path>', 'Main checkout, or any worktree of it', process.cwd())
-    .option('--json', 'Emit machine-readable JSON output')
-    .addHelpText('after', '\nWrites no GitHub state: the caller applies every label, comment and spawn.\n' +
-    "Exit 1 or 2 halts the tick (loop guard's codes, or an unresolvable checkout).\n")
-    .action(loopTickCommand);
+// The ai-issue-loop pipeline moved to @rtorcato/repo-ai (#658). Kept as a
+// pointer so a stale skill calling `repo-tooling loop …` fails loudly with the
+// fix, instead of commander's generic "unknown command".
+program
+    .command('loop', { hidden: true })
+    .argument('[args...]')
+    .allowUnknownOption()
+    .helpOption(false)
+    .action(() => {
+    console.error(chalk.red('`repo-tooling loop` moved to @rtorcato/repo-ai.') +
+        '\n  Run `npx @rtorcato/repo-ai loop …`, and refresh the skills with' +
+        '\n  `npx @rtorcato/repo-ai fix claude-skills --force-skills`.');
+    process.exitCode = 1;
+});
 program.hook('preAction', async (_, actionCommand) => {
     const name = actionCommand.name();
     if (name === 'setup' || name === 'doctor' || name === 'fix') {

package/dist/cli/utils/lockfile.js

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import fs from 'fs-extra';
 import { CONFIG_SCHEMA, validateProjectConfig } from '../commands/setup-presets.js';
-import { SHIPPED_SKILLS } from '../generators/claude-skills.js';
 import { getToolVersion } from './version.js';
 export const LOCKFILE_NAME = '.repo-tooling.json';
 // Package and bin name used before the js-tooling→repo-tooling rename (#272).
@@ -51,9 +50,8 @@ export const DEFAULT_RULES = {
  * `pnpm schema:generate` and gated by tests/cli/utils/lockfile-schema.test.ts.
  *
  * A function, not a const: lockfile.ts sits in an import cycle with
- * setup-presets.ts (via the swift scaffolder) and with claude-skills.ts (via
- * copy-preset.ts), so CONFIG_SCHEMA and SHIPPED_SKILLS are both in their TDZ
- * while this module evaluates. Reading them here, at call time, is safe.
+ * setup-presets.ts (via the swift scaffolder), so CONFIG_SCHEMA is in its TDZ
+ * while this module evaluates. Reading it here, at call time, is safe.
  */
 // ponytail: key sets are compiler-checked against the type; a changed field
 // *type* (string → number) still needs both lines edited by hand.
@@ -113,7 +111,7 @@ export function lockfileSchema() {
                     aiLoop: {
                         type: 'object',
                         additionalProperties: false,
-                        description: 'Settings for the ai-issue-loop skills. Repo-scoped on purpose: committed here they travel with the repo and survive a new laptop.',
+                        description: 'Settings for the ai-issue-loop skills from @rtorcato/repo-ai. Repo-scoped on purpose: committed here they travel with the repo and survive a new laptop.',
                         properties: {
                             agentUser: {
                                 type: 'string',
@@ -123,8 +121,8 @@ export function lockfileSchema() {
                     },
                     requiredSkills: {
                         type: 'array',
-                        items: { type: 'string', enum: SHIPPED_SKILLS },
-                        description: 'Agent skills this repo\'s workflows depend on. doctor compares each installed copy\'s stamped hash against the shipped one and reports a missing or stale skill — always as "not configured", never drift, because it probes the machine rather than the repo. It never runs the fixer for you.',
+                        items: { type: 'string' },
+                        description: "Agent skills this repo's workflows depend on. Audited by `npx @rtorcato/repo-ai doctor`, which reports a missing or stale installed copy; it never installs one for you.",
                     },
                     mcp: {
                         type: 'object',
@@ -162,6 +160,17 @@ export function lockfileSchema() {
                         additionalProperties: { type: 'string', minLength: 1 },
                         description: 'Declared exceptions: doctor check name → the reason this repo deliberately deviates. The reason is mandatory and non-empty — doctor shows the check as `declared` with it (never hidden) and stops failing the run for it. An entry naming a check doctor does not run is itself reported as drift.',
                     },
+                    brand: {
+                        type: 'object',
+                        additionalProperties: false,
+                        description: 'Inputs to `fix brand`, which scaffolds the banner and social-card SVGs.',
+                        properties: {
+                            tagline: {
+                                type: 'string',
+                                description: 'Short line for the banners and social card, used in place of the package.json description. Keep it to two lines of about 42 characters; `fix brand` warns when it is longer.',
+                            },
+                        },
+                    },
                 },
             },
         },

package/dist/languages/js/ci.js

@@ -78,6 +78,13 @@ export function scriptsOf(pkg) {
 function hasScript(opts, script) {
     return !opts.scripts || script in opts.scripts;
 }
+/**
+ * A bundler, or a known `build` script — a plain-`tsc` repo records `bundler:
+ * 'none'` (#661) but still has a build to run.
+ */
+function buildsSomething(config, opts) {
+    return config.bundler !== 'none' || (opts.scripts !== undefined && 'build' in opts.scripts);
+}
 /** Emit a step only when the script it runs exists (or we can't know yet). */
 function stepFor(opts, script, step) {
     return hasScript(opts, script) ? step : null;
@@ -95,7 +102,7 @@ function jobSteps(steps) {
 export function githubJobs(config, opts = {}) {
     const hasTypeScript = config.typescript.enabled;
     const hasTests = config.testing.framework !== 'none';
-    const hasBuild = config.bundler !== 'none';
+    const hasBuild = buildsSomething(config, opts);
     const isLibrary = config.projectType === 'library';
     const hasCoverage = usesCoverage(config);
     const jobs = [DEPENDENCIES_JOB];
@@ -230,7 +237,7 @@ export function gitlabSpec(config, opts = {}) {
     const hasTypeScript = config.typescript.enabled;
     const hasTests = config.testing.framework !== 'none';
     const hasLint = config.linting.tool !== 'none';
-    const hasBuild = config.bundler !== 'none';
+    const hasBuild = buildsSomething(config, opts);
     const test = gitlabTest(config);
     const jobs = [
         ...(hasLint && hasScript(opts, lintScript(config))

package/dist/languages/js/fixers.js

@@ -79,8 +79,33 @@ import { LOCKFILE_NAME, writeLockfile } from '../../cli/utils/lockfile.js';
 // The fixer contract moved to src/base/fixers.ts when Swift became the second
 // module (#286) — import it from there.
 import { FixerAbort } from '../../base/fixers.js';
+// The bundlers ProjectConfig can record, in the order a repo carrying more than
+// one is attributed to (a vite app that also pulls in esbuild is a vite app).
+const BUNDLERS = ['tsup', 'vite', 'rolldown', 'rollup', 'esbuild'];
+const BUNDLER_CONFIGS = {
+    tsup: [
+        'tsup.config.ts',
+        'tsup.config.mts',
+        'tsup.config.js',
+        'tsup.config.mjs',
+        'tsup.config.json',
+    ],
+    vite: ['vite.config.ts', 'vite.config.mts', 'vite.config.js', 'vite.config.mjs'],
+    rolldown: ['rolldown.config.ts', 'rolldown.config.mjs', 'rolldown.config.js'],
+    rollup: ['rollup.config.ts', 'rollup.config.mjs', 'rollup.config.js'],
+    esbuild: ['build.mjs'],
+};
+/**
+ * The bundler the repo actually uses, from its deps or (given `dir`) its config
+ * file — `none` when there is neither. Never a preset default: a plain-`tsc`
+ * repo used to be recorded as tsup (#661).
+ */
+function detectBundler(deps, dir) {
+    return (BUNDLERS.find((b) => b in deps ||
+        (dir !== undefined && BUNDLER_CONFIGS[b].some((f) => fs.existsSync(path.join(dir, f))))) ?? 'none');
+}
 /** Exported so doctor can render the preset ci.yml it compares against (#349). */
-export function inferProjectConfig(pkg) {
+export function inferProjectConfig(pkg, dir) {
     const deps = {
         ...(pkg?.dependencies ?? {}),
         ...(pkg?.devDependencies ?? {}),
@@ -92,6 +117,7 @@ export function inferProjectConfig(pkg) {
         projectType = 'react-app';
     return {
         projectName: pkg?.name ?? 'project',
+        language: 'js',
         projectType,
         typescript: {
             enabled: true,
@@ -109,7 +135,7 @@ export function inferProjectConfig(pkg) {
         commitLint: true,
         semanticRelease: pkg?.private !== true,
         securityAutomation: true,
-        bundler: 'tsup',
+        bundler: detectBundler(deps, dir),
     };
 }
 export async function readPackageJson(dir) {
@@ -879,7 +905,9 @@ export const FIXERS = [
                 console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
-            const config = lock ? lock.record.config : inferProjectConfig(pkg);
+            const config = lock
+                ? lock.record.config
+                : inferProjectConfig(pkg, targetDir);
             // Recorded hashes win: they capture the pristine content at copy time,
             // which a byte-match against today's shipped asset can only approximate.
             const assets = { ...(await identifiablePresetHashes(targetDir)), ...lock?.record.assets };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.45.0",
+	"version": "4.1.0",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [

package/dist/base/agent-user.js

@@ -1,68 +0,0 @@
-import path from 'node:path';
-import fs from 'fs-extra';
-import { realGhExec } from './github-settings.js';
-/**
- * `aiLoop.agentUser` assignability (#530). The skills that consume the option
- * (`ai-issue-loop`, `ai-workflow`) verify it at runtime and *silently assign
- * nothing* on failure — by design, so a deleted bot account or a bot never
- * added as a collaborator degrades the loop with no visible symptom. This
- * check is where that failure becomes visible.
- *
- * Read-only, on the same `gh` seam as labels.ts and milestones.ts. Everything
- * derives from the consuming repo: the login from its lockfile, the repo from
- * its own remote via gh's `{owner}/{repo}` placeholders.
- */
-const CHECK = 'AI loop agent';
-/**
- * GitHub login shape: 1–39 chars, alphanumerics and single hyphens, no leading
- * or trailing hyphen. The injection boundary — the login is interpolated into
- * the API path below.
- */
-export const LOGIN = /^[a-zA-Z0-9](?:-?[a-zA-Z0-9]){0,38}$/;
-const skip = (reason) => ({
-    check: CHECK,
-    status: 'ok',
-    detail: `skipped — ${reason}`,
-});
-export async function checkAgentUser(dir, agentUser, exec) {
-    // Absent field ⇒ not applicable — the single-identity model is the default,
-    // not a requirement (#521).
-    if (!agentUser) {
-        return {
-            check: CHECK,
-            status: 'ok',
-            detail: 'not applicable — no rules.aiLoop.agentUser in .repo-tooling.json',
-        };
-    }
-    if (!LOGIN.test(agentUser)) {
-        return {
-            check: CHECK,
-            status: 'drift',
-            detail: `rules.aiLoop.agentUser "${agentUser}" is not a valid GitHub login`,
-            hint: 'Fix or remove rules.aiLoop.agentUser in .repo-tooling.json',
-        };
-    }
-    // Cheap gate first: no .git → never spawn (keeps tmp-dir doctor runs offline).
-    if (!(await fs.pathExists(path.join(dir, '.git'))))
-        return skip('not a git repository');
-    const gh = exec ?? ((args, stdin) => realGhExec(args, stdin, dir));
-    // 204 when the login can be assigned issues on this repo, 404 otherwise.
-    const r = await gh(['api', `repos/{owner}/{repo}/assignees/${agentUser}`]);
-    if (r.ok) {
-        return {
-            check: CHECK,
-            status: 'ok',
-            detail: `rules.aiLoop.agentUser "${agentUser}" is an assignable collaborator`,
-        };
-    }
-    if (/HTTP 404/.test(r.stderr)) {
-        return {
-            check: CHECK,
-            status: 'drift',
-            detail: `rules.aiLoop.agentUser "${agentUser}" is not an assignable collaborator — the loop skills will silently assign nothing`,
-            hint: `Add the account as a collaborator (\`gh api -X PUT repos/{owner}/{repo}/collaborators/${agentUser}\`) or remove rules.aiLoop.agentUser from .repo-tooling.json`,
-        };
-    }
-    // Offline, unauthenticated, or gh missing — not evidence of drift.
-    return skip('could not verify assignability');
-}

package/dist/base/ai-loop-identity.js

@@ -1,80 +0,0 @@
-/**
- * `fix ai-loop-identity` (#638): point this checkout's Claude sessions at a gh
- * profile signed in as `rules.aiLoop.agentUser`, so `loop guard` stops halting
- * on `identity: mismatch`. `.repo-tooling.json` (committed) says *who* the agent
- * is; the profile path is machine-specific, so it lands in the gitignored,
- * per-checkout `.claude/settings.local.json`.
- */
-import path from 'node:path';
-import fs from 'fs-extra';
-import { configuredAgentUser } from '../cli/commands/loop-guard.js';
-import { LOGIN } from './agent-user.js';
-import { FixerAbort } from './fixers.js';
-import { realGhExec } from './github-settings.js';
-export const SETTINGS_LOCAL = '.claude/settings.local.json';
-/** The profile dir the fixer looks in when `--gh-config-dir` is not given. */
-export function defaultGhConfigDir(agentUser, home) {
-    return path.join(home, '.config', `gh-${agentUser}`);
-}
-/**
- * Returns the files written. Writes nothing — and aborts with the `gh auth
- * login` command as the hint — unless the profile really is the agent account.
- */
-export async function setupAgentIdentity(targetDir, opts) {
-    const agentUser = await configuredAgentUser(targetDir);
-    if (!agentUser) {
-        console.error('   nothing to do — no rules.aiLoop.agentUser in .repo-tooling.json');
-        return [];
-    }
-    // The login comes from a committed file and becomes a path segment below.
-    if (!LOGIN.test(agentUser)) {
-        throw new FixerAbort('invalid-agent-user', `rules.aiLoop.agentUser "${agentUser}" is not a valid GitHub login`, 'Fix or remove rules.aiLoop.agentUser in .repo-tooling.json');
-    }
-    const dir = path.resolve(opts.ghConfigDir ?? defaultGhConfigDir(agentUser, opts.home));
-    const gh = opts.gh ?? ((args, env) => realGhExec(args, undefined, targetDir, env));
-    const login = (await fs.pathExists(dir))
-        ? await gh(['api', 'user', '--jq', '.login'], { GH_CONFIG_DIR: dir }).then((r) => r.ok ? r.stdout.trim() : '')
-        : '';
-    // GitHub logins are case-insensitive, so a case difference is one account.
-    if (login.toLowerCase() !== agentUser.toLowerCase()) {
-        throw new FixerAbort('agent-identity-unavailable', `${dir} is ${login ? `signed in as ${login}, not ${agentUser}` : `not signed in to gh as ${agentUser}`} — nothing written`, `Sign in once, in a browser logged in as ${agentUser}, then re-run:\n   GH_CONFIG_DIR=${dir} gh auth login --hostname github.com --web --scopes repo`);
-    }
-    const written = [];
-    const settingsPath = path.join(targetDir, SETTINGS_LOCAL);
-    let settings = {};
-    if (await fs.pathExists(settingsPath)) {
-        try {
-            settings = await fs.readJson(settingsPath);
-        }
-        catch {
-            throw new FixerAbort('settings-local-unparseable', `${SETTINGS_LOCAL} is not valid JSON — not overwriting it`, `Fix the file by hand, or add "env": {"GH_CONFIG_DIR": "${dir}"} to it yourself`);
-        }
-    }
-    const env = (settings.env ?? {});
-    if (env.GH_CONFIG_DIR !== dir) {
-        await fs.outputJson(settingsPath, { ...settings, env: { ...env, GH_CONFIG_DIR: dir } }, { spaces: 2 });
-        written.push(SETTINGS_LOCAL);
-    }
-    if (await ensureIgnored(targetDir))
-        written.push('.gitignore');
-    return written;
-}
-// ponytail: exact-line match on the usual spellings; a glob that happens to
-// cover the file gets a redundant (harmless) line. `git check-ignore` if that bites.
-const IGNORE_LINES = new Set([
-    SETTINGS_LOCAL,
-    `/${SETTINGS_LOCAL}`,
-    '.claude',
-    '.claude/',
-    '/.claude',
-    '/.claude/',
-]);
-async function ensureIgnored(targetDir) {
-    const file = path.join(targetDir, '.gitignore');
-    const existing = (await fs.pathExists(file)) ? await fs.readFile(file, 'utf-8') : '';
-    if (existing.split('\n').some((l) => IGNORE_LINES.has(l.trim())))
-        return false;
-    const separator = existing === '' || existing.endsWith('\n') ? '' : '\n';
-    await fs.writeFile(file, `${existing}${separator}${SETTINGS_LOCAL}\n`);
-    return true;
-}