@rtorcato/repo-tooling 3.5.0 → 3.7.0

package/AGENTS.md

@@ -6,7 +6,7 @@ Orientation for coding agents working with `@rtorcato/repo-tooling`. Human-reada
 
 A one-package JavaScript / TypeScript tooling distribution. Ships every preset (TypeScript, Biome, ESLint, Prettier, Vitest, Jest, Commitlint, semantic-release, tsup, esbuild, Vite, Playwright) plus a CLI to scaffold and audit projects. Consumers get one install.
 
-**Swift** repos (detected via `Package.swift`) are covered end to end: `setup --preset swift-library` scaffolds a SwiftPM package, and `doctor`/`fix` run the language-agnostic checks plus SwiftLint / Periphery / `.gitignore` / `Package.swift`. Python and Perl are audit-only for now. See `src/languages/` — one directory per language module, `src/base/` for what's shared.
+**Swift** repos (detected via `Package.swift`) are covered end to end: `setup --preset swift-library` scaffolds a SwiftPM package, and `doctor`/`fix` run the language-agnostic checks plus SwiftLint / Periphery / `.gitignore` / `Package.swift`. **Python** repos (detected via `pyproject.toml` / `setup.py`) get `doctor`/`fix` — Ruff / mypy / pytest / `.gitignore` / CI / git hooks — but no `setup` preset yet. **Perl** distributions (detected via `cpanfile` / `Makefile.PL` / `dist.ini`) get the same deal: Perl::Critic / perltidy / `.gitignore` / CI / git hooks, no `setup` preset. See `src/languages/` — one directory per language module, `src/base/` for what's shared.
 
 ## CLI surface (agent-friendly)
 

package/dist/base/checks.js

@@ -233,7 +233,21 @@ export async function checkDependabot(dir) {
         hint: 'Run `npx @rtorcato/repo-tooling fix dependabot` (or `fix renovate`) to scaffold weekly dep updates',
     };
 }
-export async function checkCodeQL(dir) {
+/**
+ * `languages` is the detected module's `codeqlLanguages`. An empty list means
+ * CodeQL ships no analyzer for this language at all (Perl, #289) — reporting it
+ * as missing would send the user to `fix codeql`, whose generator correctly
+ * writes nothing for an empty matrix, so they'd get a silent no-op and a check
+ * that never goes green.
+ */
+export async function checkCodeQL(dir, languages) {
+    if (languages.length === 0) {
+        return {
+            check: 'CodeQL',
+            status: 'ok',
+            detail: 'not applicable — CodeQL has no analyzer for this language',
+        };
+    }
     const workflowsDir = path.join(dir, '.github', 'workflows');
     if (!(await fs.pathExists(workflowsDir))) {
         return {

package/dist/base/fixers.js

@@ -11,6 +11,7 @@
  * language-shaped (CI steps, recorded tool choices), so each module ships its
  * own — see src/base/ci.ts for the shell they share.
  */
+import chalk from 'chalk';
 import { installAgentRules, installAiSetup } from '../cli/generators/agent-rules.js';
 import { generateCommunityHealth } from '../cli/generators/community-health.js';
 import { generateCommitlintConfig } from '../cli/generators/git.js';
@@ -78,7 +79,14 @@ export const BASE_FIXERS = [
         appliesTo: ['CodeQL'],
         outputs: ['.github/workflows/codeql.yml'],
         async run({ targetDir }) {
-            const { codeqlLanguages } = await moduleFor(targetDir);
+            const { codeqlLanguages, label } = await moduleFor(targetDir);
+            // Say so rather than reporting a successful fix that wrote nothing: the
+            // generator correctly emits no workflow for an empty matrix (Perl, #289),
+            // and a silent no-op reads as "done".
+            if (codeqlLanguages.length === 0) {
+                console.error(chalk.yellow(`   skipped — CodeQL has no ${label} analyzer`));
+                return { filesWritten: [] };
+            }
             return { filesWritten: await generateCodeQLWorkflow(targetDir, codeqlLanguages) };
         },
     },

package/dist/base/git-hooks.js

@@ -0,0 +1,43 @@
+/**
+ * Committed git hooks for languages that can't use Husky (#309).
+ *
+ * Husky is an npm package, so a repo whose toolchain has no node can't use it.
+ * The node-free equivalent is a committed hooks directory that git is pointed at
+ * with `core.hooksPath` — identical mechanics whatever the language; only the
+ * hook bodies differ. Swift and Python both land here rather than each carrying
+ * their own copy of the write-then-chmod-then-git-config dance.
+ */
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+import fs from 'fs-extra';
+/** Best-effort `git config` — a missing git or a non-repo dir is not a failure. */
+function gitConfig(cwd, key, value) {
+    return new Promise((resolve) => {
+        execFile('git', ['-C', cwd, 'config', key, value], (err) => resolve(!err));
+    });
+}
+/**
+ * Writes both hooks and points git at them. Returns the files written —
+ * `core.hooksPath` is per-clone local config, not a file, so it's reported
+ * separately rather than pretending to be a repo change.
+ */
+export async function installGitHooks(targetDir, hooksDirName, scripts) {
+    const hooksDir = path.join(targetDir, hooksDirName);
+    await fs.ensureDir(hooksDir);
+    const filesWritten = [];
+    for (const [name, content] of [
+        ['pre-commit', scripts.preCommit],
+        ['pre-push', scripts.prePush],
+    ]) {
+        const hookPath = path.join(hooksDir, name);
+        await fs.writeFile(hookPath, content);
+        await fs.chmod(hookPath, 0o755);
+        filesWritten.push(`${hooksDirName}/${name}`);
+    }
+    // Guard on .git: `fix --diff` shadow-runs fixers in a temp copy that excludes
+    // .git, and that copy can land inside another repo — an unguarded `git config`
+    // there would rewrite the *parent* repo's hooksPath during a mere preview.
+    const isRepo = await fs.pathExists(path.join(targetDir, '.git'));
+    const hooksPathSet = isRepo ? await gitConfig(targetDir, 'core.hooksPath', hooksDirName) : false;
+    return { filesWritten, hooksPathSet };
+}

package/dist/cli/commands/doctor.js

@@ -4,6 +4,10 @@ import fs from 'fs-extra';
 import { renderGitHubWorkflow } from '../../base/ci.js';
 import { githubJobs } from '../../languages/js/ci.js';
 import { inferProjectConfig } from '../../languages/js/fixers.js';
+import { PERL_GIT_HOOKS, runPerlChecks } from '../../languages/perl/checks.js';
+import { readPerlProject, renderPerlWorkflow } from '../../languages/perl/ci.js';
+import { PYTHON_GIT_HOOKS, runPythonChecks } from '../../languages/python/checks.js';
+import { readPyproject, renderPythonWorkflow } from '../../languages/python/ci.js';
 import { resolveLanguageModule } from '../../languages/registry.js';
 import { SWIFT_GIT_HOOKS, runSwiftChecks } from '../../languages/swift/checks.js';
 import { readSwiftPackage, renderSwiftWorkflow } from '../../languages/swift/ci.js';
@@ -155,7 +159,7 @@ async function runBaseChecks(dir, lock, opts) {
     }
     results.push(await checkGitHubActions(dir, opts.presetWorkflow));
     results.push(await checkDependabot(dir));
-    results.push(await checkCodeQL(dir));
+    results.push(await checkCodeQL(dir, opts.codeqlLanguages));
     // GitHub repo-settings drift (branch protection, merge settings, workflow
     // permissions). Read-only; self-skips as `ok` outside a live GitHub repo.
     results.push(...(await checkGitHubSettings(dir)));
@@ -172,12 +176,14 @@ export async function runDoctor(dir) {
     const lock = await readLockfile(targetDir);
     // Per-module dispatch (#285): the base checks (repo hygiene, CI, security,
     // GitHub settings) apply to any repo and run for every language. A supported
-    // module layers its own checks on top; an unsupported one (Swift/Perl/Python
-    // until their modules land) still gets the full base suite instead of the old
-    // wholesale skip. 'unknown' (bare dir mid-setup) resolves to JS so a fresh
-    // repo runs the full suite.
+    // module layers its own checks on top. 'unknown' (bare dir mid-setup)
+    // resolves to JS so a fresh repo runs the full suite.
     const language = await detectLanguage(targetDir);
     const languageModule = resolveLanguageModule(language);
+    // Every language in the registry has a module as of #289, so nothing reaches
+    // this today. It stays as the on-ramp: a language is added to the registry
+    // with `supported: false` first, and until its module lands its repos get the
+    // full base suite rather than the wholesale skip this replaced.
     if (!languageModule.supported) {
         const results = [
             {
@@ -185,14 +191,14 @@ export async function runDoctor(dir) {
                 status: 'ok',
                 detail: `detected ${languageModule.label} — running language-agnostic checks; ${languageModule.label}-specific checks land with its module (#139)`,
             },
-            // hooks: null — nothing here encodes a Python/Perl hook convention yet,
-            // and guessing one would nag every repo with a fix target that doesn't
-            // exist. #289/#290 fill it in.
+            // hooks: null — guessing a hook convention would nag every repo with a
+            // fix target that doesn't exist.
             ...(await runBaseChecks(targetDir, lock, {
                 hooks: null,
                 badges: { audience: 'public', fixTarget: null },
                 presetWorkflow: null,
                 language,
+                codeqlLanguages: languageModule.codeqlLanguages,
             })),
         ];
         return demoteDeclined(results, lock);
@@ -214,11 +220,60 @@ export async function runDoctor(dir) {
                 badges: { audience: 'public', fixTarget: null },
                 presetWorkflow: renderSwiftWorkflow(await readSwiftPackage(targetDir)),
                 language,
+                codeqlLanguages: languageModule.codeqlLanguages,
             })),
             ...(await runSwiftChecks(targetDir)),
         ];
         return demoteDeclined(results, lock);
     }
+    // Python suite (#290): same shape as Swift — base checks plus the module's
+    // own, and nothing JS-shaped, because a Python repo has no package.json.
+    if (languageModule.id === 'python') {
+        const results = [
+            {
+                check: 'language',
+                status: 'ok',
+                detail: 'detected Python (pyproject.toml / setup.py)',
+            },
+            ...(await runBaseChecks(targetDir, lock, {
+                hooks: PYTHON_GIT_HOOKS,
+                // A Python package on PyPI is public by default, so badges apply. No
+                // fixer: `fix badges` derives the block from package.json name and
+                // repository, which a Python repo hasn't got.
+                badges: { audience: 'public', fixTarget: null },
+                presetWorkflow: renderPythonWorkflow(await readPyproject(targetDir)),
+                language,
+                codeqlLanguages: languageModule.codeqlLanguages,
+            })),
+            ...(await runPythonChecks(targetDir)),
+        ];
+        return demoteDeclined(results, lock);
+    }
+    // Perl suite (#289): same shape as Swift and Python — base checks plus the
+    // module's own, and nothing JS-shaped, because a distribution has no
+    // package.json. CodeQL self-reports as not applicable: it ships no Perl
+    // analyzer, which `codeqlLanguages: []` in the registry encodes.
+    if (languageModule.id === 'perl') {
+        const results = [
+            {
+                check: 'language',
+                status: 'ok',
+                detail: 'detected Perl (cpanfile / Makefile.PL / dist.ini)',
+            },
+            ...(await runBaseChecks(targetDir, lock, {
+                hooks: PERL_GIT_HOOKS,
+                // A distribution released to CPAN is public by definition, so badges
+                // apply. No fixer: `fix badges` derives the block from package.json
+                // name and repository, which a Perl repo hasn't got.
+                badges: { audience: 'public', fixTarget: null },
+                presetWorkflow: renderPerlWorkflow(await readPerlProject(targetDir)),
+                language,
+                codeqlLanguages: languageModule.codeqlLanguages,
+            })),
+            ...(await runPerlChecks(targetDir)),
+        ];
+        return demoteDeclined(results, lock);
+    }
     // JS suite: the module's own checks, then the shared base ones. Only the
     // JS-shaped checks are listed here — re-listing the base suite is what made
     // any new base check silently skip JS repos (#309).
@@ -265,6 +320,7 @@ export async function runDoctor(dir) {
         badges: { audience: jsBadgeAudience(pkg), fixTarget: 'badges' },
         presetWorkflow: renderGitHubWorkflow(githubJobs(inferProjectConfig(pkg))),
         language,
+        codeqlLanguages: languageModule.codeqlLanguages,
     })));
     return demoteDeclined(results, lock);
 }

package/dist/cli/commands/fix-targets.js

@@ -64,11 +64,43 @@ const SWIFT_FIX_TARGETS = {
     // (no `.testTarget(`) there's nothing to run, and rewriting Package.swift
     // isn't safe. The check's own hint covers both halves.
 };
+/** The same shadowing for the Python module (#290). */
+const PYTHON_FIX_TARGETS = {
+    'Git hooks': 'python-git-hooks',
+    'Pre-push hook': 'python-git-hooks',
+    'GitHub Actions': 'python-ci',
+    'GitLab CI': 'python-gitlab-ci',
+    Ruff: 'ruff',
+    mypy: 'mypy',
+    pytest: 'pytest',
+    'Python .gitignore': 'python-gitignore',
+    // `pyproject.toml` and `Python tests` are deliberately absent, for the same
+    // reason `Swift tests` is: the fix is content only the project can write
+    // (package metadata, actual tests). Their own hints say what to add.
+    // `lockfile` too — see the note at the top of src/languages/python/fixers.ts.
+};
+/** The same shadowing for the Perl module (#289). */
+const PERL_FIX_TARGETS = {
+    'Git hooks': 'perl-git-hooks',
+    'Pre-push hook': 'perl-git-hooks',
+    'GitHub Actions': 'perl-ci',
+    'GitLab CI': 'perl-gitlab-ci',
+    'Perl::Critic': 'perlcritic',
+    perltidy: 'perltidy',
+    'Perl .gitignore': 'perl-gitignore',
+    // `Perl distribution` and `Perl tests` are deliberately absent, for the same
+    // reason `Swift tests` is: the fix is content only the project can write
+    // (dependency metadata, actual tests). Their own hints say what to add.
+    // `lockfile` too — see the note at the top of src/languages/perl/fixers.ts.
+};
+const FIX_TARGETS_BY_LANGUAGE = {
+    swift: SWIFT_FIX_TARGETS,
+    python: PYTHON_FIX_TARGETS,
+    perl: PERL_FIX_TARGETS,
+};
 export function getFixTargetForCheck(checkName, language) {
-    if (language === 'swift' && SWIFT_FIX_TARGETS[checkName]) {
-        return SWIFT_FIX_TARGETS[checkName];
-    }
-    return FIX_TARGETS[checkName] ?? null;
+    const overrides = language ? FIX_TARGETS_BY_LANGUAGE[language] : undefined;
+    return overrides?.[checkName] ?? FIX_TARGETS[checkName] ?? null;
 }
 /**
  * For a given doctor check name, returns true when the lockfile records that
@@ -168,6 +200,8 @@ export function lockfilePatchForTarget(target, lock) {
             return c.commitLint ? null : { commitLint: true };
         case 'husky':
         case 'swift-git-hooks':
+        case 'python-git-hooks':
+        case 'perl-git-hooks':
             return c.gitHooks ? null : { gitHooks: true };
         case 'semantic-release':
         case 'swift-release':

package/dist/cli/commands/fix.js

@@ -11,19 +11,32 @@ import { declinedInLock, lockfilePatchForTarget } from './fix-targets.js';
 import { computeFileList } from './setup-presets.js';
 import { BASE_FIXERS } from '../../base/fixers.js';
 import { FIXERS, readPackageJson } from '../../languages/js/fixers.js';
+import { PERL_FIXERS } from '../../languages/perl/fixers.js';
+import { PYTHON_FIXERS } from '../../languages/python/fixers.js';
 import { SWIFT_FIXERS } from '../../languages/swift/fixers.js';
 import { detectLanguage } from '../utils/detect-language.js';
+/** The module-specific fixer set per detected language (#286, #289, #290, #303). */
+const LANGUAGE_FIXERS = {
+    swift: SWIFT_FIXERS,
+    python: PYTHON_FIXERS,
+    perl: PERL_FIXERS,
+};
 /**
- * The fixers that apply to a repo, by detected language (#286, #303): the
- * language-agnostic base set plus the module's own. Swift repos get the Swift
- * module; everything else (including a bare dir mid-setup) gets JS, the
- * historical default.
+ * The fixers that apply to a repo, by detected language: the language-agnostic
+ * base set plus the module's own. Anything without a module of its own
+ * (including a bare dir mid-setup) gets JS, the historical default.
  */
 function fixersForLanguage(language) {
-    return [...BASE_FIXERS, ...(language === 'swift' ? SWIFT_FIXERS : FIXERS)];
+    return [...BASE_FIXERS, ...(LANGUAGE_FIXERS[language] ?? FIXERS)];
 }
 /** Every fixer across every language — for `--list` and the unknown-target hint. */
-const ALL_FIXERS = [...BASE_FIXERS, ...FIXERS, ...SWIFT_FIXERS];
+const ALL_FIXERS = [
+    ...BASE_FIXERS,
+    ...FIXERS,
+    ...SWIFT_FIXERS,
+    ...PYTHON_FIXERS,
+    ...PERL_FIXERS,
+];
 export function getFixers() {
     return ALL_FIXERS;
 }

package/dist/cli/index.js

@@ -251,6 +251,36 @@ const TOOL_CATALOG = [
         exports: [],
         fixTarget: 'periphery',
     },
+    {
+        name: 'Ruff',
+        description: 'Python linter and formatter in one tool (replaces flake8, isort, pyupgrade, black)',
+        exports: [],
+        fixTarget: 'ruff',
+    },
+    {
+        name: 'mypy',
+        description: 'Python static type checker configuration (strict on your code, lenient on untyped deps)',
+        exports: [],
+        fixTarget: 'mypy',
+    },
+    {
+        name: 'pytest',
+        description: 'Python test runner configuration (strict markers and config, warnings as errors)',
+        exports: [],
+        fixTarget: 'pytest',
+    },
+    {
+        name: 'Perl::Critic',
+        description: 'Perl linter configuration (severity 3, with the family rule exceptions)',
+        exports: [],
+        fixTarget: 'perlcritic',
+    },
+    {
+        name: 'perltidy',
+        description: 'Perl formatter configuration (Perl Best Practices layout at 100 columns)',
+        exports: [],
+        fixTarget: 'perltidy',
+    },
     {
         name: 'AI Agent Setup',
         description: 'Scaffold AGENTS.md, CLAUDE.md, Cursor/Copilot rules, Claude skill, MCP example',

package/dist/cli/utils/copy-preset.js

@@ -51,6 +51,31 @@ export const PRESETS = {
         target: '.periphery.yml',
         desc: 'Periphery dead-code scan configuration (retains public API)',
     },
+    ruff: {
+        source: 'tooling/python/ruff.toml',
+        target: 'ruff.toml',
+        desc: 'Ruff configuration (lint + format — replaces flake8, isort, pyupgrade and black)',
+    },
+    mypy: {
+        source: 'tooling/python/mypy.ini',
+        target: 'mypy.ini',
+        desc: 'mypy configuration (strict on your code, lenient on untyped dependencies)',
+    },
+    pytest: {
+        source: 'tooling/python/pytest.ini',
+        target: 'pytest.ini',
+        desc: 'pytest configuration (strict markers and config, warnings as errors)',
+    },
+    perlcritic: {
+        source: 'tooling/perl/perlcriticrc',
+        target: '.perlcriticrc',
+        desc: 'Perl::Critic configuration (severity 3, with the family rule exceptions)',
+    },
+    perltidy: {
+        source: 'tooling/perl/perltidyrc',
+        target: '.perltidyrc',
+        desc: 'perltidy configuration (Perl Best Practices layout at 100 columns)',
+    },
     'claude-skill': {
         source: 'tooling/claude/repo-tooling.md',
         target: '.claude/skills/repo-tooling.md',

package/dist/languages/js/fixers.js

@@ -225,13 +225,13 @@ export const FIXERS = [
         async run({ targetDir, pkg }) {
             const pkgPath = path.join(targetDir, 'package.json');
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const includeTreeshake = await fs.pathExists(path.join(targetDir, 'apps', 'treeshake-check', 'check.mjs'));
             const verify = composeVerifyScriptFromPkg(pkg, { includeTreeshake });
             if (!verify) {
-                console.log(chalk.gray('   not enough tools enabled to compose a verify chain — skipping (need 2+ of typecheck/lint/tests)'));
+                console.error(chalk.gray('   not enough tools enabled to compose a verify chain — skipping (need 2+ of typecheck/lint/tests)'));
                 return { filesWritten: [] };
             }
             const updated = { ...pkg };
@@ -256,7 +256,7 @@ export const FIXERS = [
         canFixDrift: true,
         async run({ targetDir, pkg }) {
             if (pkg?.private === true) {
-                console.log(chalk.gray('   skipping — package is private'));
+                console.error(chalk.gray('   skipping — package is private'));
                 return { filesWritten: [] };
             }
             const filesWritten = await generateSemanticReleaseConfig(targetDir);
@@ -315,7 +315,7 @@ export const FIXERS = [
                 overwrite: result.check === 'GitHub Actions',
             });
             if (!filesWritten.includes(CI_WORKFLOW)) {
-                console.log(chalk.yellow(`   ${CI_WORKFLOW} differs from the preset — left as-is; run \`fix github-actions --diff\` to see the delta`));
+                console.error(chalk.yellow(`   ${CI_WORKFLOW} differs from the preset — left as-is; run \`fix github-actions --diff\` to see the delta`));
             }
             return { filesWritten };
         },
@@ -518,17 +518,17 @@ export const FIXERS = [
         canFixDrift: false,
         async run({ targetDir, pkg }) {
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const workspaceName = pkg.name ?? null;
             if (!workspaceName) {
-                console.log(chalk.yellow('   package.json has no `name` — skipping'));
+                console.error(chalk.yellow('   package.json has no `name` — skipping'));
                 return { filesWritten: [] };
             }
             const { allCandidates, defaultAllowed } = inferSubpathsFromExports(pkg);
             if (allCandidates.length < 2 || !defaultAllowed) {
-                console.log(chalk.yellow('   package.json does not expose ≥2 subpath exports — tree-shake check needs multiple subpaths to be meaningful. Skipping.'));
+                console.error(chalk.yellow('   package.json does not expose ≥2 subpath exports — tree-shake check needs multiple subpaths to be meaningful. Skipping.'));
                 return { filesWritten: [] };
             }
             const allowedSubpath = defaultAllowed;
@@ -538,7 +538,7 @@ export const FIXERS = [
                 allowedSubpath,
                 forbiddenSubpaths,
             });
-            console.log(chalk.dim(`   Wired '${allowedSubpath}' as allowed; forbidden = [${forbiddenSubpaths.join(', ')}]. Edit apps/treeshake-check/check.mjs to tune.`));
+            console.error(chalk.dim(`   Wired '${allowedSubpath}' as allowed; forbidden = [${forbiddenSubpaths.join(', ')}]. Edit apps/treeshake-check/check.mjs to tune.`));
             return { filesWritten: written };
         },
     },
@@ -615,7 +615,7 @@ export const FIXERS = [
         async run({ targetDir, pkg }) {
             const pkgPath = path.join(targetDir, 'package.json');
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const updated = { ...pkg };
@@ -645,7 +645,7 @@ export const FIXERS = [
         async run({ targetDir, pkg }) {
             const pkgPath = path.join(targetDir, 'package.json');
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const updated = { ...pkg };
@@ -674,7 +674,7 @@ export const FIXERS = [
         canFixDrift: true,
         async run({ targetDir, pkg }) {
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const p = pkg;
@@ -687,7 +687,7 @@ export const FIXERS = [
                 isPrivate: p.private === true,
             });
             if (!block) {
-                console.log(chalk.yellow('   package.json has no name/repository to build badges from — skipping'));
+                console.error(chalk.yellow('   package.json has no name/repository to build badges from — skipping'));
                 return { filesWritten: [] };
             }
             const readmePath = path.join(targetDir, 'README.md');
@@ -708,7 +708,7 @@ export const FIXERS = [
         async run({ targetDir, pkg }) {
             const pkgPath = path.join(targetDir, 'package.json');
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const updated = { ...pkg };
@@ -718,7 +718,7 @@ export const FIXERS = [
             devDeps['@rtorcato/repo-tooling'] = 'latest';
             updated.devDependencies = devDeps;
             await fs.writeJson(pkgPath, updated, { spaces: 2 });
-            console.log(chalk.dim('   reminder: run `pnpm install` to install the new dep'));
+            console.error(chalk.dim('   reminder: run `pnpm install` to install the new dep'));
             return { filesWritten: ['package.json'] };
         },
     },
@@ -731,7 +731,7 @@ export const FIXERS = [
         canFixDrift: false,
         async run({ targetDir, pkg }) {
             if (!pkg) {
-                console.log(chalk.yellow('   no package.json found — skipping'));
+                console.error(chalk.yellow('   no package.json found — skipping'));
                 return { filesWritten: [] };
             }
             const config = inferProjectConfig(pkg);