@sous-io/sous 0.2.17 → 0.2.18

package/docs/markdown/commands.md

@@ -231,9 +231,22 @@ Example: `sous repo link sous-recipes ~/Projects/sous-recipes`, or `sous repo li
 --generate-branch --latest --yes`
 
 ### `sous repo unlink REPO`
-Stops reading a repository from a working copy and goes back to published versions; `REPO` is the short name as
-it appears in `sous.links.json` (see [File formats](repositories-file-formats.md)). `--global` removes the
-machine-wide link, not this project's; `--dry-run` prints what changes. Example: `sous repo unlink sous-recipes`
+Stops reading a repository from a working copy, goes back to the versions the lockfile pins, and rebuilds the
+project; `REPO` is the short name as it appears in `sous.links.json` (see
+[File formats](repositories-file-formats.md)). On its own it also fetches the repository's index, with a short
+timeout, and reports any newer published version the ranges allow, without moving anything; when the index
+cannot be fetched in time it says it could not check. The checkout stays where it is unless `--remove` is passed.
+Takes `--dry-run`, `--no-build`, `--answer` and `--answers-file`.
+
+- `--global`: remove the machine-wide link, not this project's.
+- `--update`: move this repository's pins to the newest versions their ranges allow before rebuilding. It runs
+  the same code as `sous subscription update REPO`.
+- `--remove`: delete the checkout as well, but only one sous cloned itself; a checkout linked by path is refused
+  with an error. Uncommitted changes, commits no remote has and stashes are listed first and asked about.
+- `-y, --yes`: answer every question this command asks: deleting a checkout that holds work, the update plan,
+  and the trust question for a repository a newer version needs (also `--force`, `--trust`).
+
+Example: `sous repo unlink sous-recipes --update`
 
 ### `sous repo init [DIRECTORY]`
 Creates a new recipe repository in a directory, defaulting to the current one; `--dry-run` prints the files it
@@ -306,6 +319,20 @@ Example: `sous subscription add workflow/task-files@^1.2.0 --answer apiUrl=https
 Removes a subscription and everything only it brought in, then rebuilds so those files are gone. Also spelled
 `sous unsubscribe`. Takes `--dry-run` and `--no-build`. Example: `sous subscription remove workflow/task-files`
 
+### `sous subscription update [REF]`
+Moves the lockfile's pins to the newest published versions their ranges allow, then rebuilds the project. With
+no `REF` it covers every subscription; a `REF` naming a repository, a namespace or a recipe narrows it, and
+everything outside it stays where it is pinned. It fetches every trusted repository's index first, never widens
+a range, moves dependencies with the closure, and changes only the lockfile, never the subscriptions. It prints
+the plan and asks once; with nothing to update it says so and asks nothing. See
+[Moving to newer versions](repositories-consuming.md#moving-to-newer-versions). Takes `--no-build`, `--answer`
+and `--answers-file`, and `--dry-run`, which fetches the indexes but downloads no recipe and writes nothing.
+
+- `-y, --yes`: accept the plan, and trust any repository a newer version needs (also `--force`, `--trust`).
+- `--accept-first`: when `REF` matches several things, take the first one listed.
+
+Example: `sous subscription update workflow/task-files`
+
 ### `sous subscription list`
 Lists the subscriptions this project declares, switched-off ones included, with the range each resolves within,
 the versions the lockfile pins, the latest version each of those recipes has published, where it came from and
@@ -317,7 +344,8 @@ only the subscriptions that have pinned something. Example: `sous subscription l
 
 `namespace` reads the cached indexes and the lockfile, so it works offline. A trusted repository whose index has
 never been fetched is named at the end of a listing, not left out. Both commands take the
-[browsing flags](#flags-that-browse); with `--installed` the recipe count is the number installed.
+[browsing flags](#flags-that-browse); with `--installed` the recipe count is the number installed. The core version this installation of sous
+ships is listed even while the cached index does not publish it yet.
 
 ### `sous namespace list`
 Lists every namespace the trusted repositories publish, how many recipes each holds, and how much of it this
@@ -354,8 +382,10 @@ Prints what `.sous/sous.lock.json` pins: the recipe, the version, the repository
 ### `sous lock rebuild`
 Recomputes the whole lockfile from the subscriptions the config declares and the cached indexes, starting from
 empty, so an entry nothing holds any more is dropped rather than carried through: the repair for a file that
-drifted through a hand edit or a bad merge. It asks nothing, grants no trust and downloads nothing. Takes
-`--dry-run`. Example: `sous lock rebuild --dry-run`
+drifted through a hand edit or a bad merge. It asks nothing, grants no trust and downloads nothing. The core
+version this installation of sous ships resolves even when the cached index has not published it yet, exactly
+as it does in a build. To move pins to versions published since the last fetch, use `sous subscription update`.
+Takes `--dry-run`. Example: `sous lock rebuild --dry-run`
 
 ## vars
 

package/docs/markdown/repositories-authoring.md

@@ -289,8 +289,29 @@ and freshness checks no longer apply to it. Builds say so every time.
 Run 'sous repo unlink my-recipes' to go back to published versions.
 ```
 
-`sous repo unlink` removes the map entry and nothing else: the checkout stays where it is, and its path is
-printed so you can delete it. Unlinking a name linked in the other scope says which scope holds it.
+### Unlink, and pick up your release
+
+Linking never touches the lockfile, so `sous repo unlink my-recipes` goes back to exactly the versions pinned
+before the link, and rebuilds the project so its outputs match them. It also fetches the repository's index,
+with a short timeout, and says whether a newer version the ranges allow has been published since; it moves
+nothing, and when the index cannot be fetched in time it says it could not check. Unlinking a name linked in
+the other scope says which scope holds it.
+
+Once your change is released, one of these moves the project onto it:
+
+```bash
+sous repo unlink my-recipes --update       # unlink, move this repository's pins, then rebuild
+sous subscription update my-recipes        # the same move, when nothing is linked any more
+```
+
+`--update` runs exactly the code `sous subscription update my-recipes` runs: every pin the repository supplies
+moves to the newest version its range allows, after one plan and one question. See
+[Moving to newer versions](repositories-consuming.md#moving-to-newer-versions).
+
+The checkout stays where it is unless you pass `--remove`, because `sous repo submit` uses a leftover checkout to
+revise a proposal that is still open. `--remove` deletes it only when sous cloned it; a checkout you linked by
+path is yours, and sous refuses with an error. Before deleting, sous lists anything in the checkout that exists
+nowhere else (uncommitted changes, commits no remote has, and stashes) and asks; `--yes` answers ahead.
 
 ### How a checkout compares with upstream
 

package/docs/markdown/repositories-consuming.md

@@ -220,7 +220,48 @@ build` instead. The `Latest version` column beside it is read from the cache, or
 `sous repo list` shows each trusted repository with its provider, origin, whether it is linked, its
 recipe count and its URL; `--verbose` adds a `Namespaces:` line under each row. `sous lock show`
 prints the other half: every version your lockfile pins, where it came from and who holds it. When
-that file has drifted, `sous lock rebuild` recomputes it from your subscriptions.
+that file has drifted, `sous lock rebuild` recomputes it from your subscriptions and the cached
+indexes, fetching nothing.
+
+## Moving to newer versions
+
+A build holds the versions the lockfile pins, so a newer release reaches the project only when
+something moves the pin. `sous subscription update` is that step:
+
+```term
+$ sous subscription update workflow/qa-variables
+  Updating the recipe 'qa-recipes:workflow/qa-variables' changes the lockfile:
+
+    • Adding workflow/qa-helper version 1.0.0
+    • Updating workflow/qa-variables from version 0.1.0 to version 0.2.0
+
+  Update the lockfile? (y/N)
+```
+
+It fetches every trusted repository's index first, so a version published a minute ago counts.
+With no reference it covers every subscription; a reference names a repository, a namespace or a
+recipe, at any level of qualification, and everything outside it stays exactly where it is pinned.
+What it will and will not do:
+
+- A pin moves only within the range its subscription declares, or the range the recipe depending
+  on it declares; a range is never widened. Prereleases count only for a subscription that opted
+  into them.
+- Dependencies move with the closure: a dependency a newer version adds is pinned, and one it
+  dropped leaves the lockfile unless something else still holds it.
+- Only the lockfile changes. Your subscriptions stay exactly as they are written.
+- It prints the plan and asks once; `--yes` accepts it, and a run with no terminal and no `--yes`
+  fails naming the flag. With nothing to update it says so and asks nothing.
+- A repository a newer version needs that the project does not trust goes through the usual trust
+  question, and new questions the newer versions ask are asked the way subscribing asks them.
+- A repository whose index cannot be fetched is skipped and named, and its pins stay put.
+- A linked repository's pins move too, and the plan notes that builds keep reading the checkout
+  until it is unlinked.
+- The built-in `core` subscription never moves: its range is exactly the running sous version, so
+  upgrading sous is what moves it.
+
+It rebuilds the project afterwards. `--dry-run` fetches the indexes and prints the plan, and
+downloads no recipe and writes nothing, so the dependencies and questions of a version this machine
+does not hold yet are named rather than listed. `--no-build` skips the rebuild.
 
 ## Remove a subscription
 
@@ -290,7 +331,8 @@ lapsed (`store.freshnessSeconds`, five minutes by default), or when a command fo
 check never breaks a build, because the cached index is used instead. Always-pull changes what
 happens after that check, not how often it happens: a repository or subscription marked
 `alwaysPull` takes a newer in-range version rather than the locked one; set it with
-`--always-pull`, or on either entry in the config.
+`--always-pull`, or on either entry in the config. Without it, `sous subscription update` is how a
+pin moves; see [Moving to newer versions](#moving-to-newer-versions).
 
 Every other repository the lockfile pins from is checked on the same window, only to tell you what
 is newer. A build lists each recipe with a newer version inside the range declared for it, beside

package/docs/markdown/repositories-file-formats.md

@@ -252,7 +252,8 @@ freshness checks; entries are keyed by the repository's configured short name.
 ```
 
 `path` is absolute; `origin` is `clone` when sous cloned the working copy itself and `path` when it was
-pointed at an existing checkout, and unlinking removes the entry while leaving either in place. Both the
+pointed at an existing checkout. Unlinking removes the entry and leaves the checkout in place, unless
+`sous repo unlink --remove` is asked to delete one sous cloned; it never deletes a `path` checkout. Both the
 project's `.sous/sous.links.json` and `$SOUS_HOME/sous.links.json` are read, and the project's entries win.
 
 ## Configuration keys

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sous-io/sous",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates",
   "type": "module",
   "license": "Apache-2.0",

package/recipes/core/sous-skills/sous.recipe.yaml

@@ -11,7 +11,7 @@ formatVersion: 1
 
 namespace: core
 name: sous-skills
-version: 0.2.17
+version: 0.2.18
 
 description: >-
   The skills that teach an agent what sous is and how it works: which files sous

package/src/commands/repo/unlink.ts

@@ -1,35 +1,72 @@
+import fs from "node:fs";
+import path from "node:path";
 import { Args, Flags } from "@oclif/core";
 import { BaseCommand } from "../../base-command.js";
-import { ConfigError } from "../../lib/errors.js";
+import { buildProjectOutputs } from "../../lib/build-service.js";
+import { ConfigError, isConfigError } from "../../lib/errors.js";
 import {
+  NonInteractiveError,
+  isInteractive,
+  nonInteractiveError,
+  wantsHelp,
+} from "../../lib/interactive.js";
+import {
+  globalReposDir,
+  projectReposDir,
   readGlobalLinks,
   readProjectLinks,
   writeGlobalLinks,
   writeProjectLinks,
 } from "../../lib/repos/links.js";
+import { hasNoUnsavedWork, unsavedWork, type UnsavedWork } from "../../lib/repos/git-clone.js";
+import {
+  subscriptionServiceFor,
+  type SubscriptionService,
+} from "../../lib/repos/subscription-service.js";
+import type { RepoLink } from "../../lib/repos/formats/links-map.js";
+import { collectProvidedAnswers } from "../../lib/vars/index.js";
+import { formatAskReport } from "../../lib/vars/ask.js";
 import {
+  BULLET,
   blankLine,
   dryRunNotice,
   footer,
+  heading,
+  indent,
   log,
+  note,
+  paragraph,
   section,
   showCommandVars,
   showVariables,
+  subheading,
+  warning,
 } from "../../utils/formatting.js";
+import { askYesNo } from "../../utils/prompts.js";
+import { answerFlags, confirmationFlag } from "../../utils/flags.js";
 
 /**
- * `sous repo unlink` stops reading a repository from a working copy and goes
- * back to published versions.
+ * `sous repo unlink` stops reading a repository from a working copy, goes back
+ * to the versions the lockfile pins, and rebuilds the project.
+ *
+ * Linking never touches the lockfile, so unlinking returns to exactly the
+ * versions pinned before the link. Three ways to finish, one per flag:
+ *
+ *   - On its own, it fetches the repository's index with a short timeout and
+ *     reports, as a fact, any newer published version the ranges allow. Nothing
+ *     moves.
+ *   - `--update` runs the same code as `sous subscription update <repository>`,
+ *     so the pins move to those newer versions before the rebuild.
+ *   - `--remove` deletes the checkout, and only one sous cloned itself. A
+ *     checkout linked by path belongs to its owner and is never deleted. Work
+ *     that exists nowhere else is listed first and asked about.
  *
- * It only ever removes a map entry. The checkout stays exactly where it is,
- * because sous did not necessarily put it there, and even when it did, deleting
- * a directory that may hold uncommitted work is not something a command like
- * this should decide on its own. The path is printed so the user can delete it
- * themselves if they want to.
+ * Without `--remove` the checkout stays exactly where it is, because `sous repo
+ * submit` uses a leftover checkout to revise a proposal that is still open.
  */
 export default class RepoUnlink extends BaseCommand {
   static description =
-    "Stop reading a repository from a working copy and go back to published versions";
+    "Stop reading a repository from a working copy and go back to its pinned versions";
 
   /**
    * The other spelling of the topic. It lives under a hidden topic, so it is
@@ -39,6 +76,8 @@ export default class RepoUnlink extends BaseCommand {
 
   static examples = [
     "<%= config.bin %> repo unlink sous-recipes",
+    "<%= config.bin %> repo unlink sous-recipes --update",
+    "<%= config.bin %> repo unlink sous-recipes --remove",
     "<%= config.bin %> repo unlink sous-recipes --global",
   ];
 
@@ -52,14 +91,31 @@ export default class RepoUnlink extends BaseCommand {
   static flags = {
     ...BaseCommand.baseFlags,
     global: Flags.boolean({
+      description: "Remove the machine-wide link rather than this project's link",
+      default: false,
+    }),
+    update: Flags.boolean({
       description:
-        "Remove the machine-wide link rather than this project's link",
+        "Move this repository's pins to the newest versions their ranges allow before rebuilding",
       default: false,
     }),
+    remove: Flags.boolean({
+      description: "Delete the checkout as well, when sous cloned it",
+      default: false,
+    }),
+    // One flag answers every question this command can ask: deleting a
+    // checkout that holds work, the update plan, and the trust question for a
+    // repository a newer version needs.
+    yes: confirmationFlag({ extraAliases: ["trust"] }),
     "dry-run": Flags.boolean({
       description: "Print what would change without writing anything",
       default: false,
     }),
+    "no-build": Flags.boolean({
+      description: "Unlink without rebuilding the project",
+      default: false,
+    }),
+    ...answerFlags(),
   };
 
   async run(): Promise<void> {
@@ -67,12 +123,13 @@ export default class RepoUnlink extends BaseCommand {
     const { sousDir } = this.configContext;
     const isGlobal = flags.global;
     const name = args.repo;
+    const dryRun = flags["dry-run"];
 
     showCommandVars({
       Project: this.projectLabel,
       Repository: name,
       Scope: isGlobal ? "this machine" : "this project",
-      "Dry Run": flags["dry-run"],
+      "Dry Run": dryRun,
     });
 
     section("Unlinking a repository");
@@ -84,31 +141,287 @@ export default class RepoUnlink extends BaseCommand {
       throw new ConfigError(this.notLinkedMessage(name, isGlobal, sousDir));
     }
 
-    if (flags["dry-run"]) {
+    const service = subscriptionServiceFor({
+      configContext: this.configContext,
+      settings: this.settings,
+      shellEnv: this.shellEnv,
+    });
+
+    // Everything that can refuse is settled before anything is written, so a
+    // refusal leaves the link exactly as it was.
+    if (flags.update && service.currentRepos()[name] === undefined) {
+      throw new ConfigError(
+        `'${name}' is linked, but this project does not trust a repository by that ` +
+          `name, so it has no pins to update.\n` +
+          `  Nothing was changed; the link is still in place.`
+      );
+    }
+    if (flags.remove) this.assertRemovable(name, entry, isGlobal, sousDir);
+    const work = flags.remove ? unsavedWork(entry.path) : undefined;
+
+    if (dryRun) {
       dryRunNotice(`would unlink '${name}', which points at ${entry.path}`);
-      dryRunNotice("the checkout itself would be left where it is");
+      dryRunNotice(
+        flags.remove
+          ? "the checkout would be deleted"
+          : "the checkout itself would be left where it is"
+      );
+      if (work !== undefined && !hasNoUnsavedWork(work)) this.describeUnsavedWork(work);
+      if (flags.update) await service.update({ repo: name, dryRun: true });
       footer();
       return;
     }
 
+    if (work !== undefined) await this.confirmRemoval(entry.path, work, flags.yes);
+
     delete map.links[name];
     const linksPath = isGlobal ? writeGlobalLinks(map) : writeProjectLinks(sousDir, map);
 
     showVariables({
       Repository: name,
-      "Checkout left at": entry.path,
-      "Updated": linksPath,
+      Checkout: entry.path,
+      Updated: linksPath,
+    });
+
+    blankLine();
+    paragraph(`'${name}' is read from the versions the lockfile pins again.`);
+
+    if (flags.update) {
+      await this.updatePins(service, name, flags);
+    } else {
+      await this.reportNewerVersions(service, name);
+    }
+
+    if (flags.remove) {
+      fs.rmSync(entry.path, { recursive: true, force: true });
+      blankLine();
+      paragraph(`The checkout sous cloned at ${entry.path} was deleted.`);
+    } else {
+      blankLine();
+      paragraph(
+        entry.origin === "clone"
+          ? `The checkout sous cloned is still at ${entry.path}.`
+          : `The checkout at ${entry.path} was yours to begin with, and has not been touched.`
+      );
+    }
+
+    footer();
+
+    if (!flags["no-build"]) await this.rebuildProject(name);
+  }
+
+  /**
+   * Refuses to delete a checkout sous did not create, or one that is not where
+   * sous clones to. The link records its origin; a path-linked checkout belongs
+   * to whoever linked it.
+   *
+   * @param name - The repository's short name.
+   * @param entry - The link being removed.
+   * @param isGlobal - Whether it is the machine-wide link.
+   * @param sousDir - The project's `.sous/` directory.
+   */
+  private assertRemovable(
+    name: string,
+    entry: RepoLink,
+    isGlobal: boolean,
+    sousDir: string
+  ): void {
+    if (entry.origin !== "clone") {
+      throw new ConfigError(
+        `Sous did not create the checkout at ${entry.path}, so it will not delete it.\n` +
+          `  '${name}' was linked to a checkout that was already there. Nothing was ` +
+          `changed; unlink without '--remove' to keep the checkout, and delete it ` +
+          `yourself if you want it gone.`
+      );
+    }
+
+    const root = isGlobal ? globalReposDir() : projectReposDir(sousDir);
+    const relative = path.relative(root, entry.path);
+    if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
+      throw new ConfigError(
+        `The checkout at ${entry.path} is not inside ${root}, where sous clones ` +
+          `checkouts, so sous will not delete it.\n` +
+          `  Nothing was changed; unlink without '--remove' and delete it yourself if ` +
+          `you want it gone.`
+      );
+    }
+  }
+
+  /**
+   * Lists what deleting the checkout would lose, and asks before going on. A
+   * checkout with nothing to lose is deleted without a question.
+   *
+   * @param checkout - The checkout's path.
+   * @param work - What an inspection of it found.
+   * @param yes - Whether the confirmation flag answered the question already.
+   */
+  private async confirmRemoval(
+    checkout: string,
+    work: UnsavedWork,
+    yes: boolean
+  ): Promise<void> {
+    if (hasNoUnsavedWork(work)) return;
+
+    this.describeUnsavedWork(work);
+    if (yes) return;
+
+    if (!isInteractive()) {
+      throw nonInteractiveError({
+        prompt: `whether to delete the checkout at ${checkout}, and the work listed above`,
+        remedy:
+          "pass '--yes' (spelled '-y', '--force' or '-f' if you prefer) to delete it " +
+          "without being asked.",
+      });
+    }
+
+    const proceed = await askYesNo("Delete the checkout, and this work with it?");
+    if (!proceed) {
+      throw new ConfigError(
+        `Nothing was changed: the checkout at ${checkout} was not deleted, and the ` +
+          `link is still in place.`
+      );
+    }
+  }
+
+  /**
+   * Prints what exists only in the checkout, as a list.
+   *
+   * @param work - What an inspection of the checkout found.
+   */
+  private describeUnsavedWork(work: UnsavedWork): void {
+    blankLine();
+    warning("The checkout holds work that exists nowhere else, and deleting it loses that work.");
+    blankLine();
+
+    const group = (title: string, items: string[]): void => {
+      if (items.length === 0) return;
+      log(indent(title));
+      for (const item of items) log(indent(`${BULLET} ${item}`, 4));
+      blankLine();
+    };
+
+    if (work.unknown !== undefined) {
+      group("Sous could not inspect it, so it may hold anything:", [work.unknown]);
+    }
+    group("Uncommitted changes:", work.uncommitted);
+    group("Commits no remote has:", work.unpushed);
+    group("Stashes:", work.stashes);
+  }
+
+  /**
+   * Moves the repository's pins through the same code `sous subscription
+   * update` runs. A failure there is reported with the fact that the link is
+   * already gone, since that part has happened.
+   *
+   * @param service - The subscription service.
+   * @param name - The repository's short name.
+   * @param flags - The confirmation and answer flags.
+   */
+  private async updatePins(
+    service: SubscriptionService,
+    name: string,
+    flags: { yes: boolean; answer?: string[]; "answers-file"?: string }
+  ): Promise<void> {
+    blankLine();
+    subheading("Updating the pins");
+
+    const provided = collectProvidedAnswers({
+      ...(flags.answer === undefined ? {} : { answer: flags.answer }),
+      ...(flags["answers-file"] === undefined ? {} : { answersFile: flags["answers-file"] }),
     });
 
+    let outcome;
+    try {
+      outcome = await service.update({ repo: name, yes: flags.yes, answers: provided });
+    } catch (error) {
+      if (!isConfigError(error)) throw error;
+      // The unlink has already happened, so the message says so before the
+      // reason the update stopped. A blocked question keeps its kind, so the
+      // command's help is still printed under it.
+      const message =
+        `'${name}' was unlinked, but its pins were not updated.\n` +
+        `${(error as ConfigError).message}`;
+      throw wantsHelp(error) ? new NonInteractiveError(message) : new ConfigError(message);
+    }
+
+    if (outcome.nothingToUpdate) return;
+
+    blankLine();
+    paragraph("The lockfile now pins the versions listed above.");
+
+    if (outcome.answers !== undefined) {
+      blankLine();
+      subheading("Variables");
+      for (const line of formatAskReport(outcome.answers)) log(line === "" ? "" : indent(line));
+    }
+  }
+
+  /**
+   * Says whether the repository publishes newer versions the ranges allow,
+   * without moving anything. The index is fetched with a short timeout; when it
+   * cannot be fetched, that is what is reported.
+   *
+   * @param service - The subscription service.
+   * @param name - The repository's short name.
+   */
+  private async reportNewerVersions(service: SubscriptionService, name: string): Promise<void> {
+    if (service.currentRepos()[name] === undefined) return;
+
+    blankLine();
+    subheading("Published versions");
     blankLine();
-    log(`  '${name}' now resolves to its published versions again.`);
-    log(
-      entry.origin === "clone"
-        ? "  sous cloned that checkout; it has been left in place, and you may delete it."
-        : "  That checkout was yours to begin with, and has not been touched."
+
+    const report = await service.newerPublishedVersions(name);
+    if (!report.checked) {
+      note(
+        `Sous could not check '${name}' for newer published versions. ` +
+          `${report.reason.split("\n")[0]!.trim()}`
+      );
+      return;
+    }
+
+    if (report.newer.length === 0) {
+      paragraph(
+        `Every pin from '${name}' is the newest published version its range allows.`
+      );
+      return;
+    }
+
+    paragraph(
+      `'${name}' publishes newer versions within range. The lockfile still pins the ` +
+        `older ones:`
     );
+    blankLine();
+    showVariables(
+      report.newer.map((entry) => ({
+        label: entry.key,
+        value: `${entry.from} pinned, ${entry.to} published`,
+      }))
+    );
+  }
+
+  /**
+   * Rebuilds the project, so its outputs come from the pinned versions rather
+   * than the checkout when this command returns.
+   *
+   * @param name - The repository that was unlinked, for the failure message.
+   */
+  private async rebuildProject(name: string): Promise<void> {
+    await this.reloadDiscoveredConfig();
+
+    heading("Building the project");
+
+    const succeeded = await buildProjectOutputs(this.settings, this.configContext);
 
     footer();
+
+    if (!succeeded) {
+      throw new ConfigError(
+        `'${name}' was unlinked, but the build that followed failed, so this project's ` +
+          `outputs may still hold what the checkout contributed. The unlink itself is ` +
+          `recorded; fix what the build reported above and run 'sous build' again.`
+      );
+    }
   }
 
   /**