@vodmal/vdx-cli 0.24.0 → 0.26.0

package/src/narrow.ts

@@ -0,0 +1,56 @@
+/**
+ * What a parsed file (JSON, YAML, TOML) or a caught error holds is `unknown` until checked.
+ * These helpers check it on the way in, so the code past them works with real types.
+ */
+
+export type Dict = Record<string, unknown>;
+
+/** A plain object — not null, not an array. */
+export function isDict(v: unknown): v is Dict {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/** `v` when it is a plain object, else undefined. */
+export function dict(v: unknown): Dict | undefined {
+  return isDict(v) ? v : undefined;
+}
+
+/**
+ * The value under `keys`, one level per key — an object's property or an array's index ("0");
+ * undefined as soon as a level is not an object.
+ */
+export function at(v: unknown, ...keys: string[]): unknown {
+  let cur = v;
+  for (const k of keys) {
+    if (typeof cur !== 'object' || cur === null) return undefined;
+    cur = (cur as Dict)[k];
+  }
+  return cur;
+}
+
+/** `v` when it is a string, else undefined. */
+export function str(v: unknown): string | undefined {
+  return typeof v === 'string' ? v : undefined;
+}
+
+/** `v` when it is an array, else an empty one. */
+export function list(v: unknown): unknown[] {
+  return Array.isArray(v) ? (v as unknown[]) : [];
+}
+
+export function isStringList(v: unknown): v is string[] {
+  return Array.isArray(v) && v.every((x) => typeof x === 'string');
+}
+
+/** The message of a caught value, whatever was thrown. */
+export function errorMessage(e: unknown): string {
+  return e instanceof Error ? e.message : String(e);
+}
+
+/** What a failed child process said: its stderr, else the error's message. */
+export function stderrOf(e: unknown): string {
+  const err = at(e, 'stderr');
+  if (typeof err === 'string' && err) return err;
+  if (Buffer.isBuffer(err) && err.length > 0) return err.toString();
+  return errorMessage(e);
+}

package/src/personal-hooks.ts

@@ -92,17 +92,25 @@ function stateOf(h: PersonalHook, root: string | null, deps: PersonalHookDeps):
   let drift: string | null = null;
   if (have.length === 0 && command === null) drift = 'not in ~/.gitconfig';
   else if (command !== h.command) drift = `its command in ~/.gitconfig differs from the profile`;
-  else if (events(h).some((e) => !have.includes(e))) drift = `not bound to ${events(h).filter((e) => !have.includes(e)).join(', ')}`;
+  else if (events(h).some((e) => !have.includes(e)))
+    drift = `not bound to ${events(h)
+      .filter((e) => !have.includes(e))
+      .join(', ')}`;
 
   let local: string | null = null;
   if (root !== null) {
-    if (deps.git(['-C', root, 'config', '--local', '--get', `${key}.enabled`]) === 'false') local = 'off in this repository';
-    else if (deps.git(['-C', root, 'config', '--local', '--get', `${key}.command`]) !== null) local = 'own command in this repository';
+    if (deps.git(['-C', root, 'config', '--local', '--get', `${key}.enabled`]) === 'false')
+      local = 'off in this repository';
+    else if (deps.git(['-C', root, 'config', '--local', '--get', `${key}.command`]) !== null)
+      local = 'own command in this repository';
   }
   return { hook: h, drift, local };
 }
 
-export function checkPersonalHooks(projectRoot: string | null, deps: PersonalHookDeps = defaultPersonalHookDeps()): CheckResult | null {
+export function checkPersonalHooks(
+  projectRoot: string | null,
+  deps: PersonalHookDeps = defaultPersonalHookDeps(),
+): CheckResult | null {
   const hooks = applicableHooks(deps);
   if (!hooks) return null;
   const id = 'personal-hooks';
@@ -132,7 +140,10 @@ export function checkPersonalHooks(projectRoot: string | null, deps: PersonalHoo
     };
   }
 
-  const missing = missingMachinePaths(hooks.map((h) => h.command), deps.home);
+  const missing = missingMachinePaths(
+    hooks.map((h) => h.command),
+    deps.home,
+  );
   if (missing.length > 0) {
     return {
       id,

package/src/predicates.ts

@@ -15,8 +15,9 @@ import {
 import { checkingJobs, ciSystems, ciTaskCalls, mainPushSteps, readWorkflows, shippingJobs, upstream } from './gha.ts';
 import { detectHookFrameworks } from './hooks.ts';
 import { covers, expandTasks, isVocabularyTask, projectTaskCalls } from './vocabulary.ts';
+import { at, isStringList, str } from './narrow.ts';
 
-type Args = Record<string, any>;
+export type Args = Record<string, unknown>;
 
 /** A fact vdx could not read here — a CI system or a hosting it does not inspect. */
 export interface Unknown {
@@ -42,7 +43,7 @@ const DEFAULT_TEST_PATTERN =
 
 function testPattern(args: Args): RegExp {
   try {
-    return new RegExp(String(args.pattern ?? DEFAULT_TEST_PATTERN));
+    return new RegExp(str(args.pattern) ?? DEFAULT_TEST_PATTERN);
   } catch {
     return new RegExp(DEFAULT_TEST_PATTERN);
   }
@@ -102,7 +103,7 @@ export const REGISTRY: Record<string, PredicateFn> = {
   has_file: (args, ctx) => fileExists(ctx, String(args.path)),
 
   file_contains: (args, ctx) => {
-    const paths: string[] = Array.isArray(args.paths) ? args.paths : [String(args.path)];
+    const paths = isStringList(args.paths) ? args.paths : [String(args.path)];
     const expanded = expandPaths(paths, ctx);
     let re: RegExp;
     try {
@@ -119,7 +120,7 @@ export const REGISTRY: Record<string, PredicateFn> = {
 
   package_present: (args, ctx) => {
     if (typeof args === 'string') return isPackagePresent(args, 'any', ctx);
-    return isPackagePresent(String(args.name), String(args.ecosystem ?? 'any'), ctx);
+    return isPackagePresent(String(args.name), str(args.ecosystem) ?? 'any', ctx);
   },
 
   tsc_flag: (args, ctx) => {
@@ -132,9 +133,7 @@ export const REGISTRY: Record<string, PredicateFn> = {
 
   phpstan_level_at_least: (args, ctx) => {
     const text =
-      readText(ctx, 'phpstan.neon') ||
-      readText(ctx, 'phpstan.dist.neon') ||
-      readText(ctx, 'phpstan.neon.dist');
+      readText(ctx, 'phpstan.neon') || readText(ctx, 'phpstan.dist.neon') || readText(ctx, 'phpstan.neon.dist');
     if (!text) return false;
     const m = text.match(/^\s*level:\s*(\d+|max)/m);
     if (!m || !m[1]) return false;
@@ -145,7 +144,7 @@ export const REGISTRY: Record<string, PredicateFn> = {
   gh_workflow_blocks_pr: (args, ctx) => {
     const dir = path.join(ctx.projectRoot, '.github', 'workflows');
     if (!fs.existsSync(dir)) return false;
-    const wanted = args.check_name ? String(args.check_name) : null;
+    const wanted = str(args.check_name) || null;
     try {
       for (const f of fs.readdirSync(dir)) {
         if (!/\.ya?ml$/.test(f)) continue;
@@ -168,21 +167,19 @@ export const REGISTRY: Record<string, PredicateFn> = {
       const text = readText(ctx, f);
       if (text && new RegExp(`^${hook}:`, 'm').test(text)) return true;
     }
-    const composer = readJson(ctx, 'composer.json');
-    if (composer?.extra?.hooks?.[hook]) return true;
-    return false;
+    return Boolean(at(readJson(ctx, 'composer.json'), 'extra', 'hooks', hook));
   },
 
   config_value: (args, ctx) => {
-    const filePath = String(args.path ?? '');
-    const jsonpath = String(args.jsonpath ?? '');
+    const filePath = str(args.path) ?? '';
+    const jsonpath = str(args.jsonpath) ?? '';
     if (!filePath || !jsonpath) return false;
     const data = readStructured(ctx, filePath);
     if (data === null || data === undefined) return false;
     const value = resolveConfigPath(data, jsonpath);
 
     // Operator resolution: explicit `op`, otherwise infer from arg shape.
-    let op = args.op ? String(args.op) : null;
+    let op = str(args.op) || null;
     if (!op) {
       if (args.equals !== undefined) op = 'equals';
       else if (args.gte !== undefined) op = 'gte';
@@ -236,8 +233,7 @@ export const REGISTRY: Record<string, PredicateFn> = {
     }),
 
   /** L4 (library): the testing job runs across a matrix. */
-  gha_test_matrix: (args, ctx) =>
-    ciVerdict(ctx, () => [...checkingJobs(ctx, testPattern(args))].some((j) => j.matrix)),
+  gha_test_matrix: (args, ctx) => ciVerdict(ctx, () => [...checkingJobs(ctx, testPattern(args))].some((j) => j.matrix)),
 
   /** L4 (service): whatever CI ships on a push to main waits, via `needs:`, for a checking job. */
   gha_ship_needs_checks: (args, ctx) =>

package/src/publish.ts

@@ -3,6 +3,7 @@ import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import type { AuditResult } from './audit.ts';
 import { stackForDir, type Ctx } from './facts.ts';
+import { at, dict, errorMessage, stderrOf, str } from './narrow.ts';
 
 export type BumpKind = 'patch' | 'minor' | 'major';
 
@@ -72,7 +73,10 @@ export function bumpSemver(current: string, kind: BumpKind): string {
 
 export function compareSemver(a: string, b: string): number {
   const norm = (s: string) =>
-    s.replace(/^v/, '').split(/[.\-+]/).map((p) => parseInt(p, 10) || 0);
+    s
+      .replace(/^v/, '')
+      .split(/[.\-+]/)
+      .map((p) => parseInt(p, 10) || 0);
   const pa = norm(a);
   const pb = norm(b);
   for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
@@ -112,7 +116,7 @@ const runGit: GitRunner = (args, cwd) =>
  * since the last fetch; nothing is fetched.
  */
 export function planPush(projectRoot: string, enabled: boolean, git: GitRunner = runGit): PushPlan {
-  let upstream: string | null = null;
+  let upstream: string | null;
   try {
     upstream = git(['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'], projectRoot).trim() || null;
   } catch {
@@ -141,10 +145,10 @@ function fetchPublishedVersion(packageName: string, npm: NpmRunner): string | nu
   try {
     const out = npm(['view', packageName, 'version']);
     return out.trim() || null;
-  } catch (e: any) {
-    const stderr = String(e?.stderr ?? e?.message ?? '');
+  } catch (e) {
+    const stderr = stderrOf(e);
     if (stderr.includes('E404') || stderr.includes('404 Not Found')) return null;
-    throw new Error(`npm view failed: ${stderr.split('\n')[0] ?? stderr}`);
+    throw new Error(`npm view failed: ${stderr.split('\n')[0] ?? stderr}`, { cause: e });
   }
 }
 
@@ -152,12 +156,10 @@ function fetchPublishedVersion(packageName: string, npm: NpmRunner): string | nu
  * The registry `npm publish` sends this package to, when it is not npm's
  * default: `publishConfig.registry`, else the scope's registry from npm config.
  */
-export function publishRegistry(
-  pkg: { name?: string; publishConfig?: { registry?: string } },
-  npm: NpmRunner,
-): string | null {
-  if (pkg.publishConfig?.registry) return pkg.publishConfig.registry;
-  const scope = pkg.name?.match(/^(@[^/]+)\//)?.[1];
+export function publishRegistry(pkg: unknown, npm: NpmRunner): string | null {
+  const registry = str(at(pkg, 'publishConfig', 'registry'));
+  if (registry) return registry;
+  const scope = str(at(pkg, 'name'))?.match(/^(@[^/]+)\//)?.[1];
   if (!scope) return null;
   try {
     const value = npm(['config', 'get', `${scope}:registry`]).trim();
@@ -181,8 +183,8 @@ export function checkNpmAuth(registry: string | null, npm: NpmRunner): Preflight
     const who = npm(registry ? ['whoami', '--registry', registry] : ['whoami']).trim();
     if (who) return { name: 'npm-auth', ok: true, message: `OK (logged in to ${where} as ${who})` };
     return { name: 'npm-auth', ok: false, message: `npm whoami answered nothing for ${where}. Run: ${login}`, fix };
-  } catch (e: any) {
-    const stderr = String(e?.stderr ?? e?.message ?? '');
+  } catch (e) {
+    const stderr = stderrOf(e);
     if (/E401|ENEEDAUTH/.test(stderr)) {
       return {
         name: 'npm-auth',
@@ -249,9 +251,7 @@ export function planPublish(
   // Resolve effective stack: prefer subpackage stack if primary_subpackage is set
   // (meta-projects publishing a nested lib, e.g. vdx itself with primary_subpackage=cli).
   const subpkg = audit.primary_subpackage;
-  const effectiveStack = subpkg
-    ? stackForDir(path.join(opts.projectRoot, subpkg))
-    : ctx.stack;
+  const effectiveStack = subpkg ? stackForDir(path.join(opts.projectRoot, subpkg)) : ctx.stack;
 
   if (effectiveStack !== 'node') {
     throw new Error(
@@ -267,9 +267,9 @@ export function planPublish(
     throw new Error(`vdx publish: package.json not found at ${pkgJsonPath}`);
   }
 
-  const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
-  const packageName: string = pkg.name ?? '(unnamed)';
-  const currentVersion: string = pkg.version ?? '0.0.0';
+  const pkg: unknown = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
+  const packageName = str(at(pkg, 'name')) ?? '(unnamed)';
+  const currentVersion = str(at(pkg, 'version')) ?? '0.0.0';
   const newVersion = bumpSemver(currentVersion, opts.bump);
 
   const preflight: PreflightCheck[] = [];
@@ -311,8 +311,8 @@ export function planPublish(
   let registryError: string | null = null;
   try {
     published = fetchPublishedVersion(packageName, npm);
-  } catch (e: any) {
-    registryError = e?.message ?? String(e);
+  } catch (e) {
+    registryError = errorMessage(e);
   }
   if (registryError) {
     preflight.push({
@@ -415,9 +415,10 @@ export function defaultPublishDeps(): PublishDeps {
 
 /** Set `version` in package-lock.json — the root and its own entry under `packages`. */
 export function bumpLockText(text: string, version: string): string {
-  const lock = JSON.parse(text);
-  lock.version = version;
-  if (lock.packages?.['']) lock.packages[''].version = version;
+  const lock = dict(JSON.parse(text)) ?? {};
+  lock['version'] = version;
+  const self = dict(at(lock, 'packages', ''));
+  if (self) self['version'] = version;
   return JSON.stringify(lock, null, 2) + '\n';
 }
 
@@ -501,8 +502,8 @@ export function executePublish(plan: PublishPlan, deps: PublishDeps = defaultPub
     fs.writeFileSync(file, next(text), 'utf8');
   };
   rewrite(plan.packageJsonPath, (text) => {
-    const pkg = JSON.parse(text);
-    pkg.version = plan.newVersion;
+    const pkg = dict(JSON.parse(text)) ?? {};
+    pkg['version'] = plan.newVersion;
     return JSON.stringify(pkg, null, 2) + '\n';
   });
   if (plan.lockPath) rewrite(plan.lockPath, (text) => bumpLockText(text, plan.newVersion));
@@ -520,11 +521,13 @@ export function executePublish(plan: PublishPlan, deps: PublishDeps = defaultPub
   for (const s of signals) process.on(s, holdOut);
   try {
     deps.run('npm', ['publish'], path.dirname(plan.packageJsonPath));
-  } catch (e: any) {
+  } catch (e) {
     for (const [file, text] of originals) fs.writeFileSync(file, text, 'utf8');
-    const what = e?.signal ? `interrupted (${e.signal})` : `failed (exit ${e?.status ?? '?'})`;
+    const signal = str(at(e, 'signal'));
+    const status = at(e, 'status');
+    const what = signal ? `interrupted (${signal})` : `failed (exit ${typeof status === 'number' ? status : '?'})`;
     deps.log(`✗ npm publish ${what}; reverted ${bumped.map((f) => path.basename(f)).join(' and ')}`);
-    throw new Error(`npm publish ${e?.signal ? 'interrupted' : 'failed'}`);
+    throw new Error(`npm publish ${signal ? 'interrupted' : 'failed'}`, { cause: e });
   } finally {
     for (const s of signals) process.off(s, holdOut);
   }
@@ -543,7 +546,9 @@ export function executePublish(plan: PublishPlan, deps: PublishDeps = defaultPub
     try {
       deps.run('git', ['push', '--follow-tags'], plan.projectRoot);
     } catch {
-      deps.log(`✗ git push failed — ${plan.packageName}@${plan.newVersion} is published and tagged here; push it: git push --follow-tags`);
+      deps.log(
+        `✗ git push failed — ${plan.packageName}@${plan.newVersion} is published and tagged here; push it: git push --follow-tags`,
+      );
       throw new Error('git push failed');
     }
     deps.log(`✓ pushed to ${push.upstream} with tag v${plan.newVersion}`);
@@ -599,7 +604,9 @@ export function renderPublishPlan(plan: PublishPlan): string {
     lines.push('## Pipeline (would execute on `vdx publish`)');
     lines.push('');
     if (fixable) {
-      const fixes = plan.preflight.filter((c) => !c.ok && c.fix).map((c) => `\`${c.fix!.cmd} ${c.fix!.args.join(' ')}\``);
+      const fixes = plan.preflight
+        .filter((c) => !c.ok && c.fix)
+        .map((c) => `\`${c.fix!.cmd} ${c.fix!.args.join(' ')}\``);
       lines.push(`0. ${fixes.join(', ')} — at a terminal, then the pre-flight again`);
     }
     lines.push(`1. Set \`version\` in ${files} → \`${plan.newVersion}\``);

package/src/report.ts

@@ -116,9 +116,7 @@ export function reportDoctorMarkdown(r: DoctorReport): string {
   const lines: string[] = [];
   lines.push('# vdx doctor report');
   lines.push('');
-  lines.push(
-    `**OK**: ${r.ok}  **Warning**: ${r.warning}  **Missing**: ${r.missing}`,
-  );
+  lines.push(`**OK**: ${r.ok}  **Warning**: ${r.warning}  **Missing**: ${r.missing}`);
   lines.push('');
   lines.push('| Check | Status | Detail | Remedy |');
   lines.push('|-------|:------:|--------|--------|');

package/src/rubric.ts

@@ -124,8 +124,8 @@ export function parseRubric(text: string, source: string): Rubric {
   }
   // нормализуем default_target (если кто-то напишет "L4" со spaces)
   for (const ax of data.axes) {
-    ax.default_target = (ax.default_target ?? 'L4') as LevelName;
-    ax.storage = (ax.storage ?? 'level') as Storage;
+    ax.default_target = ax.default_target ?? 'L4';
+    ax.storage = ax.storage ?? 'level';
   }
   if (compareSchema(schema, '0.3')! >= 0) {
     const bad = invalidPredicates(data);

package/src/run.ts

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as TOML from 'smol-toml';
+import { errorMessage } from './narrow.ts';
 
 export const LIFECYCLE_VERBS = ['up', 'down', 'build', 'test', 'check', 'fix'] as const;
 export type LifecycleVerb = (typeof LIFECYCLE_VERBS)[number];
@@ -13,10 +14,7 @@ export type VerbResolveResult =
       detail?: string;
     };
 
-export function resolveLifecycleVerb(
-  projectRoot: string,
-  verb: string,
-): VerbResolveResult {
+export function resolveLifecycleVerb(projectRoot: string, verb: string): VerbResolveResult {
   const miseTomlPath = path.join(projectRoot, 'mise.toml');
   if (!fs.existsSync(miseTomlPath)) {
     return { ok: false, reason: 'no-mise-toml' };
@@ -24,8 +22,8 @@ export function resolveLifecycleVerb(
   let parsed: unknown;
   try {
     parsed = TOML.parse(fs.readFileSync(miseTomlPath, 'utf8'));
-  } catch (e: any) {
-    return { ok: false, reason: 'parse-error', detail: e?.message ?? String(e) };
+  } catch (e) {
+    return { ok: false, reason: 'parse-error', detail: errorMessage(e) };
   }
   const tasks = (parsed as { tasks?: Record<string, unknown> })?.tasks;
   if (!tasks || typeof tasks !== 'object' || !(verb in tasks)) {
@@ -42,8 +40,7 @@ export function renderResolveError(
   switch (res.reason) {
     case 'no-mise-toml':
       return (
-        `vdx: no mise.toml in ${projectRoot}\n` +
-        `hint: run \`vdx init\` to generate one, or define it manually.\n`
+        `vdx: no mise.toml in ${projectRoot}\n` + `hint: run \`vdx init\` to generate one, or define it manually.\n`
       );
     case 'parse-error':
       return `vdx: failed to parse mise.toml: ${res.detail ?? 'unknown error'}\n`;

package/src/scoring.ts

@@ -95,15 +95,9 @@ function evalAxisFlags(axis: Axis, ctx: Ctx): LevelName {
   return achieved;
 }
 
-export function projectLevel(
-  results: AxisResult[],
-  rubric: Rubric,
-  suppressed: Set<string>,
-): LevelName {
+export function projectLevel(results: AxisResult[], rubric: Rubric, suppressed: Set<string>): LevelName {
   const supportingThreshold = rubric.scoring.supporting_threshold ?? 0.8;
-  const visible = results.filter(
-    (r) => !suppressed.has(r.axis_id) && r.drift_kind !== 'excluded',
-  );
+  const visible = results.filter((r) => !suppressed.has(r.axis_id) && r.drift_kind !== 'excluded');
   const critical = visible.filter((r) => r.class === 'critical');
   const supporting = visible.filter((r) => r.class === 'supporting');
 

package/src/vocabulary.ts

@@ -5,6 +5,7 @@
  * predicates (what a hook runs), so both read "the project's task" the same way.
  */
 import { listAllTasks, readJson, readToml, type Ctx } from './facts.ts';
+import { at, dict, list } from './narrow.ts';
 
 export const LIFECYCLE_VOCABULARY = ['up', 'down', 'build', 'test', 'check', 'fix'] as const;
 
@@ -39,7 +40,11 @@ export function runnerCalls(command: string): string[] {
     const toks = tokenize(raw.trim());
     let i = 0;
     // `FOO=1 npm test`, `exec npm test`, `npx --no -- vdx test`
-    while (i < toks.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(toks[i]!) || ['exec', 'time', 'command'].includes(toks[i]!))) i++;
+    while (
+      i < toks.length &&
+      (/^[A-Za-z_][A-Za-z0-9_]*=/.test(toks[i]!) || ['exec', 'time', 'command'].includes(toks[i]!))
+    )
+      i++;
     const head = toks[i];
     if (!head) continue;
     const runner = head.split('/').pop()!;
@@ -95,11 +100,9 @@ export function isVocabularyTask(name: string, words: readonly string[] = ['test
 /** Tasks a task's definition calls: composer `@refs`, `npm run X` inside a script, mise `depends`/`run`. */
 export function taskChildren(ctx: Ctx, name: string): string[] {
   const out: string[] = [];
-  const composer = readJson(ctx, 'composer.json');
-  const entry = composer?.scripts?.[name];
+  const entry = at(readJson(ctx, 'composer.json'), 'scripts', name);
   if (entry !== undefined) {
-    const list = Array.isArray(entry) ? entry : [entry];
-    for (const e of list) {
+    for (const e of Array.isArray(entry) ? (entry as unknown[]) : [entry]) {
       if (typeof e !== 'string') continue;
       if (e.startsWith('@')) {
         const [ref, ...rest] = e.slice(1).trim().split(/\s+/);
@@ -110,14 +113,12 @@ export function taskChildren(ctx: Ctx, name: string): string[] {
       }
     }
   }
-  const pkg = readJson(ctx, 'package.json');
-  const script = pkg?.scripts?.[name];
+  const script = at(readJson(ctx, 'package.json'), 'scripts', name);
   if (typeof script === 'string') out.push(...runnerCalls(script));
-  const mise = readToml(ctx, 'mise.toml');
-  const task = mise?.tasks?.[name];
-  if (task && typeof task === 'object') {
-    if (Array.isArray(task.depends)) out.push(...task.depends.filter((d: unknown): d is string => typeof d === 'string'));
-    const runs = Array.isArray(task.run) ? task.run : [task.run];
+  const task = dict(at(readToml(ctx, 'mise.toml'), 'tasks', name));
+  if (task) {
+    out.push(...list(task['depends']).filter((d): d is string => typeof d === 'string'));
+    const runs = Array.isArray(task['run']) ? (task['run'] as unknown[]) : [task['run']];
     for (const r of runs) if (typeof r === 'string') out.push(...runnerCalls(r));
   }
   const tasks = listAllTasks(ctx);