@williamthorsen/nmr 0.50.1 → 0.52.0

package/.meta/changelog.json

@@ -1,4 +1,75 @@
 [
+  {
+    "version": "0.52.0",
+    "date": "2026-10-24",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds a 📡 glyph before the host name in the rich-output `nmr` verdicts that name a host, for a passed, failed, or recalled run, which leaves plain output and verdicts reading `on this tree` unchanged. (#1105)",
+            "hash": "15c0d637325fff429ceae5aa5ec6e0ee19741daa",
+            "entry": 1
+          },
+          {
+            "description": "Adds the root command `lint:workflows` and its `nmr-actionlint` bin, which lint `.github/workflows/` with actionlint 1.7.12, including its shellcheck pass over each `run:` block with shellcheck 0.11.0, using binaries that nmr downloads on first use, checks against pinned SHA-256 checksums, and caches under `node_modules/.cache/nmr-tools/`. (#1107)",
+            "hash": "b4ddac2c4954a882d6be05962f9709e323ac3ece",
+            "entry": 1
+          },
+          {
+            "description": "Adds `lint:workflows` to the root `check`, `check:strict`, and `root:check` composites, which makes those composites and `nmr ci` fail on any actionlint finding in a repo that has workflows, need access to `github.com` on their first run, and fail on any platform other than macOS or Linux on x64 or arm64. (#1107)",
+            "hash": "b4ddac2c4954a882d6be05962f9709e323ac3ece",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that a delegated `nmr` command could not find a bin that the branch added to a workspace package, because the host's `pnpm install --frozen-lockfile` did not link new bins when the lockfile was unchanged. (#1108)",
+            "hash": "5b694689a51679ddfbb04f65a88d0757ca310f3f",
+            "entry": 1
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.51.0",
+    "date": "2026-10-24",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Widens the optional `vitest` peer range of `@williamthorsen/nmr` from `>=4.0.0 <5` to `>=4.0.0 <6`, adding support for Vitest 5, under which a bare `vitest` started from a package without its own config needs `--config` naming the root's `vitest.config.*`. (#1100)",
+            "hash": "7a8049951fd41ef398dd2b0fdb88de6086223906",
+            "entry": 1
+          },
+          {
+            "description": "Adds the `nmr-vitest` command and runs every package-scope `test*` script through it; when the package directory does not contain a `vitest.config.*` or `vite.config.*`, `nmr-vitest` passes `--config` naming the `vitest.config.*` at the monorepo root, and otherwise passes its arguments to Vitest unchanged. (#1100)",
+            "hash": "7a8049951fd41ef398dd2b0fdb88de6086223906",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Captures the output that passing tests leaked into the run, asserting on each error, hint, and `TAG_RESOLVE_FAILED` YAML warning emitted by the code under test, and pipes the stdio of the child processes run by tool tests so that their output does not reach the worker's streams. (#1097)",
+            "hash": "ed6e4187d7f30fa27eb59b495c5f51cf07eacdbc",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "0.50.1",
     "date": "2026-10-22",

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.42.0";
+export const __readyupVersion = "0.43.0";
 import { createRequire as __rdyCreateRequire } from 'node:module';
 const require = __rdyCreateRequire(import.meta.url);
 
@@ -7382,12 +7382,12 @@ import { isRecord, listTrackedFiles } from "readyup/check-utils";
 import { globSync } from "node:fs";
 import { basename, join, sep } from "node:path";
 
-// ../../node_modules/.pnpm/@williamthorsen+toolbelt.errors@0.8.3/node_modules/@williamthorsen/toolbelt.errors/dist/esm/4-release/isError.js
+// ../../node_modules/.pnpm/@williamthorsen+toolbelt.errors@0.8.4/node_modules/@williamthorsen/toolbelt.errors/dist/esm/4-release/isError.js
 function isError(error) {
   return error instanceof Error || Object.prototype.toString.call(error) === "[object Error]";
 }
 
-// ../../node_modules/.pnpm/@williamthorsen+toolbelt.errors@0.8.3/node_modules/@williamthorsen/toolbelt.errors/dist/esm/4-release/describeError.js
+// ../../node_modules/.pnpm/@williamthorsen+toolbelt.errors@0.8.4/node_modules/@williamthorsen/toolbelt.errors/dist/esm/4-release/describeError.js
 function describeError(error) {
   try {
     if (isError(error) && typeof error.message === "string" && error.message !== "") {
@@ -7646,6 +7646,7 @@ var TYPECHECK_STEP = { run: "typecheck", shouldDeclineArguments: true };
 var ROOT_TYPECHECK_STEP = { run: "root:typecheck", shouldDeclineArguments: true };
 var LINT_CHECK_STEP = { run: "lint:check", shouldRunInBackground: true };
 var LINT_STRICT_STEP = { run: "lint:strict", shouldRunInBackground: true };
+var LINT_WORKFLOWS_STEP = { run: "lint:workflows", shouldDeclineArguments: true };
 var workspaceScripts = {
   build: ["compile"],
   check: [LINT_CHECK_STEP, TYPECHECK_STEP, "fmt:check", "test"],
@@ -7660,12 +7661,12 @@ var workspaceScripts = {
   "lint:check": "eslint .",
   "lint:strict": "strict-lint",
   "report-catalog": "nmr-report-catalog",
-  test: `pnpm exec vitest ${GATE_PROJECTS}`,
-  "test:all": "pnpm exec vitest",
-  "test:coverage": `pnpm exec vitest ${GATE_PROJECTS} --coverage`,
-  "test:tool": "pnpm exec vitest --project tool",
-  "test:unit": "pnpm exec vitest --project unit",
-  "test:watch": `pnpm exec vitest ${GATE_PROJECTS} --watch`,
+  test: `nmr-vitest ${GATE_PROJECTS}`,
+  "test:all": "nmr-vitest",
+  "test:coverage": `nmr-vitest ${GATE_PROJECTS} --coverage`,
+  "test:tool": "nmr-vitest --project tool",
+  "test:unit": "nmr-vitest --project unit",
+  "test:watch": `nmr-vitest ${GATE_PROJECTS} --watch`,
   typecheck: "tsgo --noEmit",
   // The command is a string because neither half names an nmr command: Both are binaries.
   upgrade: "nmr-report-catalog && nmr-taze",
@@ -7678,8 +7679,8 @@ function buildRootScripts(workspaceGlobs) {
     "audit:dev": "pnpm exec v11y --dev",
     "audit:prod": "pnpm exec v11y --prod",
     build: ["-R build"],
-    check: [LINT_CHECK_STEP, TYPECHECK_STEP, "fmt:check", "test"],
-    "check:strict": [LINT_STRICT_STEP, TYPECHECK_STEP, "fmt:check", "test"],
+    check: [LINT_CHECK_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, "fmt:check", "test"],
+    "check:strict": [LINT_STRICT_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, "fmt:check", "test"],
     // Excludes the audit, which in CI has a workflow of its own. The narrowed check runs against the build, so
     // the build declines the arguments rather than being narrowed by them.
     ci: [{ run: "build", shouldDeclineArguments: true }, "check:strict"],
@@ -7691,11 +7692,12 @@ function buildRootScripts(workspaceGlobs) {
     lint: "eslint --fix .",
     "lint:check": "eslint .",
     "lint:strict": "strict-lint",
+    "lint:workflows": "nmr-actionlint",
     // The audit takes seconds and `ci` takes minutes, so the cheap gate fails first. The audit reads the
     // dependency tree, and an argument narrowing the code under test does not say anything about that tree.
     prepush: [{ run: "audit", shouldDeclineArguments: true }, "ci"],
     "report-overrides": "nmr-report-overrides",
-    "root:check": [ROOT_TYPECHECK_STEP, "fmt:check", "root:lint:check", "root:test"],
+    "root:check": [ROOT_TYPECHECK_STEP, "fmt:check", "root:lint:check", LINT_WORKFLOWS_STEP, "root:test"],
     "root:lint": `eslint --fix ${ignorePatterns}.`,
     "root:lint:check": `eslint ${ignorePatterns}.`,
     "root:lint:strict": `strict-lint ${ignorePatterns}.`,
@@ -9188,7 +9190,7 @@ function hasSupportedStrictLintVersion() {
   });
 }
 function getMinVersion() {
-  const pickedFields = { "version": "0.50.1" };
+  const pickedFields = { "version": "0.52.0" };
   if (typeof pickedFields["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }
@@ -9362,7 +9364,7 @@ var vitestChecks = [
     severity: "recommend",
     quiet: true,
     check: () => noReExportOnlyVitestConfigs(),
-    fix: "Delete these files. Vitest resolves config by walking up from the run root, so a per-package re-export is redundant"
+    fix: "Delete these files. `nmr-vitest` passes the root config to every package that does not have a config of its own, so a per-package re-export is redundant"
   }
 ];
 function everyTestFileNamesItsTier(cwd = process.cwd()) {

package/.readyup/manifest.json

@@ -3,9 +3,9 @@
   "kits": [
     {
       "bundledDependencies": {
-        "@williamthorsen/toolbelt.errors": "0.8.3",
-        "@williamthorsen/toolbelt.filesystem": "0.9.3",
-        "@williamthorsen/toolbelt.packaging": "0.6.3",
+        "@williamthorsen/toolbelt.errors": "0.8.4",
+        "@williamthorsen/toolbelt.filesystem": "0.9.4",
+        "@williamthorsen/toolbelt.packaging": "0.6.4",
         "@williamthorsen/toolbelt.terminal": "0.2.1",
         "ansi-regex": "6.4.0",
         "ansi-styles": "6.2.3",
@@ -24,7 +24,7 @@
           "checklist": "nmr",
           "checks": [
             "@williamthorsen/nmr in devDependencies",
-            "@williamthorsen/nmr >= 0.50.1",
+            "@williamthorsen/nmr >= 0.52.0",
             "pnpm-workspace.yaml exists",
             "catalogued dependencies use catalog:",
             "package.json has packageManager field",
@@ -191,7 +191,7 @@
           "path": "lib/shared-configs.ts"
         },
         {
-          "hash": "b3bdf8ee",
+          "hash": "66043902",
           "kind": "module",
           "path": "lib/vitest.ts"
         },
@@ -201,7 +201,7 @@
           "path": "lib/workspace-build.ts"
         },
         {
-          "hash": "9dc20288",
+          "hash": "0d9124f7",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -224,7 +224,7 @@
           "path": "../src/config.ts"
         },
         {
-          "hash": "d2448f72",
+          "hash": "b8e98c81",
           "kind": "module",
           "path": "../src/default-scripts.ts"
         },
@@ -316,10 +316,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.42.0",
+      "readyupVersion": "0.43.0",
       "source": "kits/default.ts",
       "sourceHash": "9fd61bf4",
-      "targetHash": "8ee3ff93"
+      "targetHash": "547201fd"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.52.0 — 2026-10-24
+
+### 🎉 Features
+
+- Adds a 📡 glyph before the host name in the rich-output `nmr` verdicts that name a host, for a passed, failed, or recalled run, which leaves plain output and verdicts reading `on this tree` unchanged. (#1105)
+- Adds the root command `lint:workflows` and its `nmr-actionlint` bin, which lint `.github/workflows/` with actionlint 1.7.12, including its shellcheck pass over each `run:` block with shellcheck 0.11.0, using binaries that nmr downloads on first use, checks against pinned SHA-256 checksums, and caches under `node_modules/.cache/nmr-tools/`. (#1107)
+- Adds `lint:workflows` to the root `check`, `check:strict`, and `root:check` composites, which makes those composites and `nmr ci` fail on any actionlint finding in a repo that has workflows, need access to `github.com` on their first run, and fail on any platform other than macOS or Linux on x64 or arm64. (#1107)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that a delegated `nmr` command could not find a bin that the branch added to a workspace package, because the host's `pnpm install --frozen-lockfile` did not link new bins when the lockfile was unchanged. (#1108)
+
+## 0.51.0 — 2026-10-24
+
+### 🎉 Features
+
+- Widens the optional `vitest` peer range of `@williamthorsen/nmr` from `>=4.0.0 <5` to `>=4.0.0 <6`, adding support for Vitest 5, under which a bare `vitest` started from a package without its own config needs `--config` naming the root's `vitest.config.*`. (#1100)
+- Adds the `nmr-vitest` command and runs every package-scope `test*` script through it; when the package directory does not contain a `vitest.config.*` or `vite.config.*`, `nmr-vitest` passes `--config` naming the `vitest.config.*` at the monorepo root, and otherwise passes its arguments to Vitest unchanged. (#1100)
+
+### 🧪 Tests
+
+- Captures the output that passing tests leaked into the run, asserting on each error, hint, and `TAG_RESOLVE_FAILED` YAML warning emitted by the code under test, and pipes the stdio of the child processes run by tool tests so that their output does not reach the worker's streams. (#1097)
+
 ## 0.50.1 — 2026-10-22
 
 ### 🐛 Bug fixes

package/README.md

@@ -5,12 +5,17 @@
 Context-aware script runner for pnpm monorepos. Includes an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.50.1 (2026-10-22)
+## Release notes — v0.52.0 (2026-10-24)
+
+### 🎉 Features
+
+- Adds a 📡 glyph before the host name in the rich-output `nmr` verdicts that name a host, for a passed, failed, or recalled run, which leaves plain output and verdicts reading `on this tree` unchanged. (#1105)
+- Adds the root command `lint:workflows` and its `nmr-actionlint` bin, which lint `.github/workflows/` with actionlint 1.7.12, including its shellcheck pass over each `run:` block with shellcheck 0.11.0, using binaries that nmr downloads on first use, checks against pinned SHA-256 checksums, and caches under `node_modules/.cache/nmr-tools/`. (#1107)
+- Adds `lint:workflows` to the root `check`, `check:strict`, and `root:check` composites, which makes those composites and `nmr ci` fail on any actionlint finding in a repo that has workflows, need access to `github.com` on their first run, and fail on any platform other than macOS or Linux on x64 or arm64. (#1107)
 
 ### 🐛 Bug fixes
 
-- Fixes the issue that the `self-hosted runner` checklist in the `nmr` readyup kit joined every readiness failure into one semicolon-separated line, which hid that a public repo rules out the runner whatever else holds; a public repo now reports its visibility alone, and a private repo lists each failure on its own line. (#1091)
-- Fixes the issue that the checklist's missing-runner message stated a recent `williamthorsen/hq` allocation as the cause, when it is only a possible one. (#1091)
+- Fixes the issue that a delegated `nmr` command could not find a bin that the branch added to a workspace package, because the host's `pnpm install --frozen-lockfile` did not link new bins when the lockfile was unchanged. (#1108)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -57,7 +62,7 @@ From the monorepo root:
 ```bash
 nmr test    # Run root tests + recursive workspace tests
 nmr build   # Build all packages
-nmr ci      # Build, then run the strict checks
+nmr ci      # Build, then run the strict checks, workflow lint included
 nmr prepush # Run everything the remote runs, before a push
 ```
 
@@ -80,11 +85,11 @@ nmr detects the directory from which it is invoked and selects the right scripts
 
 nmr's key feature is that the same command runs different scripts depending on where it is invoked. It walks up from the current directory to find `pnpm-workspace.yaml`, then checks whether the current directory is inside a workspace package directory.
 
-| Where `nmr` is invoked            | Registry used     | Working directory | `nmr test` runs                                                      |
-| --------------------------------- | ----------------- | ----------------- | -------------------------------------------------------------------- |
-| Monorepo root                     | Root scripts      | Monorepo root     | `root:test`, then `-R test`                                          |
-| Inside a workspace package        | Workspace scripts | The package root  | `pnpm exec vitest --project unit --project tool` (that package only) |
-| Anywhere, with `--workspace-root` | Root scripts      | Monorepo root     | `root:test`, then `-R test`                                          |
+| Where `nmr` is invoked            | Registry used     | Working directory | `nmr test` runs                                                |
+| --------------------------------- | ----------------- | ----------------- | -------------------------------------------------------------- |
+| Monorepo root                     | Root scripts      | Monorepo root     | `root:test`, then `-R test`                                    |
+| Inside a workspace package        | Workspace scripts | The package root  | `nmr-vitest --project unit --project tool` (that package only) |
+| Anywhere, with `--workspace-root` | Root scripts      | Monorepo root     | `root:test`, then `-R test`                                    |
 
 Relative paths in a script resolve against that working directory, not the invocation directory.
 
@@ -206,7 +211,7 @@ export default {
 
 ```console
 $ nmr --delegate-to imac2 ci
-✅ my-repo: ci: passed on imac2 in 1m 48s
+✅ my-repo: ci: passed on 📡 imac2 in 1m 48s
 ```
 
 A delegation consults the [check-result cache](#check-result-cache) first, so a tree that already passed is not sent to the host; a pass that a host earned does not satisfy a run here. A repo whose checks must run on the machine that has the tree declares `delegate: false` in its config. [Delegating to another machine](docs/delegate.md) covers the user config, `--delegate`, `NMR_DELEGATE`, the rules that decide where a command runs, which commands can be delegated, how nmr chooses among several hosts, how the cache is consulted, what the host runs, how failures are reported, and setting up the host.
@@ -317,7 +322,7 @@ rdy list --from npm:@williamthorsen/nmr  # what nmr publishes
 - [Machine lock](docs/machine-lock.md): Which commands wait for one another, where the lock lives, and bypassing it
 - [Delegating to another machine](docs/delegate.md): The user config, `--delegate`, `--delegate-to`, `NMR_DELEGATE`, where a command runs, choosing among several hosts, what the host runs, and setting it up
 - [Dependency upgrades](docs/upgrades.md): `nmr upgrade`, the upgrade policy, `report-catalog`, `report-overrides`, and `nmr-taze`
-- [Standalone utilities](docs/utilities.md): `nmr-clean`, `nmr-compile`, `nmr-fmt`, and `ensure-prepublish-hooks`
+- [Standalone utilities](docs/utilities.md): `nmr-actionlint`, `nmr-clean`, `nmr-compile`, `nmr-fmt`, `nmr-vitest`, and `ensure-prepublish-hooks`
 - [Shared Vitest config](docs/vitest.md): Test tiers, test selections, the conventions check, and customization
 - [Shared Prettier config](docs/prettier.md): What it formats and how to customize it
 - [Workspace introspection](docs/workspace.md): The two workspace lookups

package/bin/nmr-actionlint.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+try {
+  await import('../dist/esm/cli-actionlint.js');
+} catch (error) {
+  if (error.code === 'ERR_MODULE_NOT_FOUND') {
+    process.stderr.write('nmr-actionlint: build output not found; run `pnpm run bootstrap` first\n');
+  } else {
+    process.stderr.write(`nmr-actionlint: failed to load: ${error.message}\n`);
+  }
+  process.exit(1);
+}

package/bin/nmr-vitest.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+try {
+  await import('../dist/esm/cli-vitest.js');
+} catch (error) {
+  if (error.code === 'ERR_MODULE_NOT_FOUND') {
+    process.stderr.write('nmr-vitest: build output not found; run `pnpm run bootstrap` first\n');
+  } else {
+    process.stderr.write(`nmr-vitest: failed to load: ${error.message}\n`);
+  }
+  process.exit(1);
+}

package/dist/esm/check-cache.js

@@ -11,6 +11,7 @@ export const DEFAULT_CACHEABLE_COMMANDS = [
     'fmt:check',
     'lint:check',
     'lint:strict',
+    'lint:workflows',
     'root:check',
     'root:lint:check',
     'root:lint:strict',

package/dist/esm/cli-actionlint.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/cli-actionlint.js

@@ -0,0 +1,12 @@
+import process from 'node:process';
+import { reportError } from '@williamthorsen/nmr-core';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { runActionlint } from "./commands/actionlint.js";
+import { findMonorepoRoot } from "./workspace.js";
+try {
+    process.exitCode = await runActionlint(findMonorepoRoot(), process.argv.slice(2));
+}
+catch (error) {
+    reportError(describeError(error));
+    process.exitCode = 1;
+}

package/dist/esm/cli-vitest.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/cli-vitest.js

@@ -0,0 +1,3 @@
+import process from 'node:process';
+import { runNmrVitest } from "./commands/run-vitest.js";
+process.exitCode = runNmrVitest(process.argv.slice(2), process.cwd());

package/dist/esm/commands/actionlint.d.ts

@@ -0,0 +1,23 @@
+import { type WorkflowTool } from './workflow-tools.js';
+/** How a spawned actionlint ended. */
+export interface ActionlintOutcome {
+    error?: Error | undefined;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}
+export interface RunActionlintOptions {
+    /** Directory under which the pinned tools are cached; defaults to `node_modules/.cache/nmr-tools` at the root. */
+    cacheRoot?: string;
+    ensure?: (tool: WorkflowTool, cacheRoot: string) => Promise<string>;
+    spawn?: (file: string, args: string[], cwd: string) => ActionlintOutcome;
+}
+/**
+ * Lints the monorepo's GitHub Actions workflows with the pinned actionlint, running its shellcheck pass with the
+ * pinned shellcheck, and returns actionlint's exit status. A repo without a workflows directory passes.
+ */
+export declare function runActionlint(monorepoRoot: string, args: readonly string[], options?: RunActionlintOptions): Promise<number>;
+/**
+ * Builds actionlint's arguments. The pyflakes integration is disabled so that the result does not depend on whether
+ * the machine happens to have pyflakes on `PATH`.
+ */
+export declare function buildActionlintArgs(shellcheckPath: string, args: readonly string[]): string[];

package/dist/esm/commands/actionlint.js

@@ -0,0 +1,31 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { describeSignalExitCode } from "../child-process.js";
+import { ensureTool } from "./workflow-tools.js";
+const WORKFLOWS_DIR = path.join('.github', 'workflows');
+export async function runActionlint(monorepoRoot, args, options = {}) {
+    if (!fs.existsSync(path.join(monorepoRoot, WORKFLOWS_DIR))) {
+        console.info(`No workflows to lint: ${WORKFLOWS_DIR}/ does not exist.`);
+        return 0;
+    }
+    const cacheRoot = options.cacheRoot ?? path.join(monorepoRoot, 'node_modules', '.cache', 'nmr-tools');
+    const ensure = options.ensure ?? ((tool, root) => ensureTool(tool, { cacheRoot: root }));
+    const actionlintPath = await ensure('actionlint', cacheRoot);
+    const shellcheckPath = await ensure('shellcheck', cacheRoot);
+    const outcome = (options.spawn ?? spawnInherited)(actionlintPath, buildActionlintArgs(shellcheckPath, args), monorepoRoot);
+    if (outcome.error !== undefined) {
+        throw new Error(`Cannot run actionlint: ${outcome.error.message}`, { cause: outcome.error });
+    }
+    if (outcome.signal !== null) {
+        return describeSignalExitCode(outcome.signal);
+    }
+    return outcome.status ?? 1;
+}
+export function buildActionlintArgs(shellcheckPath, args) {
+    return [`-shellcheck=${shellcheckPath}`, '-pyflakes=', ...args];
+}
+function spawnInherited(file, args, cwd) {
+    const result = spawnSync(file, args, { cwd, stdio: 'inherit' });
+    return { error: result.error, signal: result.signal, status: result.status };
+}

package/dist/esm/commands/run-vitest.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Runs the Vitest that `cwd` resolves, naming the monorepo root's config when the working directory does not have
+ * one of its own, and returns the exit code to report.
+ */
+export declare function runNmrVitest(argv: string[], cwd?: string): number;
+/**
+ * Returns `argv` with `--config` naming the monorepo root's `vitest.config.*` prepended, or `argv` unchanged when
+ * it already names a config, when `cwd` contains a Vitest or Vite config that Vitest loads itself, or when there is
+ * no monorepo root config to name.
+ *
+ * Vitest 5 does not search parent directories for a config, so a package without its own would otherwise run
+ * without the shared one.
+ */
+export declare function chooseVitestConfigArgs(argv: string[], cwd: string): string[];

package/dist/esm/commands/run-vitest.js

@@ -0,0 +1,79 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import process from 'node:process';
+import { reportError } from '@williamthorsen/nmr-core';
+import { findMonorepoRoot as findMonorepoRootOrNothing } from '@williamthorsen/nmr-core/workspace';
+import { describeSignalExitCode } from "../child-process.js";
+import { isObject } from "../helpers/type-guards.js";
+const VITEST_PACKAGE = 'vitest';
+const SUPPORTED_VITEST_RANGE = '>=4.0.0 <6';
+const CONFIG_EXTENSIONS = ['ts', 'mts', 'cts', 'js', 'mjs', 'cjs'];
+export function runNmrVitest(argv, cwd = process.cwd()) {
+    const cli = resolveVitestCli(cwd);
+    if (!cli.ok) {
+        reportError(`nmr-vitest: ${cli.error}`);
+        return 1;
+    }
+    const result = spawnSync(process.execPath, [cli.cliPath, ...chooseVitestConfigArgs(argv, cwd)], {
+        cwd,
+        stdio: 'inherit',
+    });
+    if (result.error) {
+        reportError(`nmr-vitest: could not run \`${VITEST_PACKAGE}\` (${result.error.message}).`);
+        return 1;
+    }
+    if (result.signal !== null)
+        return describeSignalExitCode(result.signal);
+    return result.status ?? 1;
+}
+export function chooseVitestConfigArgs(argv, cwd) {
+    if (namesConfig(argv))
+        return argv;
+    if (findConfigFile(cwd, ['vitest.config', 'vite.config']) !== undefined)
+        return argv;
+    const monorepoRoot = findMonorepoRootOrNothing(cwd);
+    if (monorepoRoot === undefined)
+        return argv;
+    const rootConfig = findConfigFile(monorepoRoot, ['vitest.config']);
+    return rootConfig === undefined ? argv : ['--config', rootConfig, ...argv];
+}
+function findConfigFile(dir, stems) {
+    for (const stem of stems) {
+        for (const extension of CONFIG_EXTENSIONS) {
+            const candidate = path.join(dir, `${stem}.${extension}`);
+            if (existsSync(candidate))
+                return candidate;
+        }
+    }
+    return undefined;
+}
+function namesConfig(argv) {
+    for (const arg of argv) {
+        if (arg === '--')
+            return false;
+        if (arg === '--config' || arg === '-c' || arg.startsWith('--config='))
+            return true;
+    }
+    return false;
+}
+function resolveVitestCli(cwd) {
+    const missingResult = {
+        ok: false,
+        error: `requires Vitest ${SUPPORTED_VITEST_RANGE}, but \`${VITEST_PACKAGE}\` could not be resolved from ${cwd}. Install a version in that range as the \`${VITEST_PACKAGE}\` peer dependency.`,
+    };
+    let manifestPath;
+    try {
+        manifestPath = createRequire(path.join(cwd, 'package.json')).resolve(`${VITEST_PACKAGE}/package.json`);
+    }
+    catch {
+        return missingResult;
+    }
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    const bin = isObject(manifest) && isObject(manifest['bin']) ? manifest['bin'][VITEST_PACKAGE] : undefined;
+    if (typeof bin !== 'string') {
+        return { ok: false, error: `\`${VITEST_PACKAGE}\` at ${path.dirname(manifestPath)} does not declare a CLI.` };
+    }
+    return { ok: true, cliPath: path.resolve(path.dirname(manifestPath), bin) };
+}

package/dist/esm/commands/workflow-tools.d.ts

@@ -0,0 +1,39 @@
+/** A program that `nmr-actionlint` downloads rather than takes from `PATH`. */
+export type WorkflowTool = 'actionlint' | 'shellcheck';
+/** A supported pair of `process.platform` and `process.arch`, joined by a hyphen. */
+export type ToolPlatform = 'darwin-arm64' | 'darwin-x64' | 'linux-arm64' | 'linux-x64';
+/** One release of a tool: where each platform's archive is, its SHA-256, and the binary's path inside it. */
+export interface ToolPin {
+    archiveMember: string;
+    assets: Record<ToolPlatform, {
+        sha256: string;
+        url: string;
+    }>;
+    version: string;
+}
+export type ToolPins = Record<WorkflowTool, ToolPin>;
+/** The subset of `fetch` that the download uses. */
+export type FetchFunction = (url: string, init?: RequestInit) => Promise<Response>;
+export interface EnsureToolOptions {
+    /** Directory under which each tool version is cached in a directory of its own. */
+    cacheRoot: string;
+    arch?: string;
+    fetch?: FetchFunction;
+    pins?: ToolPins;
+    platform?: NodeJS.Platform;
+}
+/**
+ * The pinned releases. To move a pin, change its version and URLs and take each SHA-256 from the release's `digest`
+ * as `gh api repos/{owner}/{repo}/releases/tags/{tag}` reports it, confirming actionlint's against the release's
+ * `checksums.txt`. The pins move only with a release of nmr.
+ */
+export declare const TOOL_PINS: ToolPins;
+/**
+ * Returns the path of the tool's pinned binary, downloading, verifying, and caching it first on a cache miss.
+ *
+ * A failure at any step leaves the cache without the tool, and a concurrent run never sees a partial binary: The
+ * binary is assembled in a scratch directory beside its target and renamed into place only once verified.
+ */
+export declare function ensureTool(tool: WorkflowTool, options: EnsureToolOptions): Promise<string>;
+/** Maps Node's platform and architecture onto a supported pair, rejecting every other pair. */
+export declare function resolveToolPlatform(platform: NodeJS.Platform, arch: string): ToolPlatform;

package/dist/esm/commands/workflow-tools.js

@@ -0,0 +1,140 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { UserError } from "../UserError.js";
+const SUPPORTED_PLATFORMS = ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64'];
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+const ACTIONLINT_RELEASE = 'https://github.com/rhysd/actionlint/releases/download/v1.7.12';
+const SHELLCHECK_RELEASE = 'https://github.com/koalaman/shellcheck/releases/download/v0.11.0';
+export const TOOL_PINS = {
+    actionlint: {
+        archiveMember: 'actionlint',
+        assets: {
+            'darwin-arm64': {
+                sha256: 'aba9ced2dee8d27fecca3dc7feb1a7f9a52caefa1eb46f3271ea66b6e0e6953f',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_darwin_arm64.tar.gz`,
+            },
+            'darwin-x64': {
+                sha256: '5b44c3bc2255115c9b69e30efc0fecdf498fdb63c5d58e17084fd5f16324c644',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_darwin_amd64.tar.gz`,
+            },
+            'linux-arm64': {
+                sha256: '325e971b6ba9bfa504672e29be93c24981eeb1c07576d730e9f7c8805afff0c6',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_linux_arm64.tar.gz`,
+            },
+            'linux-x64': {
+                sha256: '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_linux_amd64.tar.gz`,
+            },
+        },
+        version: '1.7.12',
+    },
+    shellcheck: {
+        archiveMember: 'shellcheck-v0.11.0/shellcheck',
+        assets: {
+            'darwin-arm64': {
+                sha256: '339b930feb1ea764467013cc1f72d09cd6b869ebf1013296ba9055ab2ffbd26f',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.darwin.aarch64.tar.gz`,
+            },
+            'darwin-x64': {
+                sha256: 'c2c15e08df0e8fbc374c335b230a7ee958c313fa5714817a59aa59f1aa594f51',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.darwin.x86_64.tar.gz`,
+            },
+            'linux-arm64': {
+                sha256: '68a8133197a50beb8803f8d42f9908d1af1c5540d4bb05fdfca8c1fa47decefc',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.linux.aarch64.tar.gz`,
+            },
+            'linux-x64': {
+                sha256: 'b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.linux.x86_64.tar.gz`,
+            },
+        },
+        version: '0.11.0',
+    },
+};
+export async function ensureTool(tool, options) {
+    const pin = (options.pins ?? TOOL_PINS)[tool];
+    const asset = pin.assets[resolveToolPlatform(options.platform ?? process.platform, options.arch ?? process.arch)];
+    const targetDir = path.join(options.cacheRoot, `${tool}-${pin.version}`);
+    const binaryPath = path.join(targetDir, tool);
+    if (fs.existsSync(binaryPath)) {
+        return binaryPath;
+    }
+    createCacheRoot(options.cacheRoot);
+    const scratchDir = `${targetDir}.tmp-${process.pid}`;
+    fs.rmSync(scratchDir, { force: true, recursive: true });
+    fs.mkdirSync(scratchDir);
+    try {
+        const archive = await download(asset.url, options.fetch ?? globalThis.fetch);
+        const actualSha256 = createHash('sha256').update(archive).digest('hex');
+        if (actualSha256 !== asset.sha256) {
+            throw new Error(`Checksum mismatch for ${asset.url}: expected sha256 ${asset.sha256}, got ${actualSha256}`);
+        }
+        const archivePath = path.join(scratchDir, 'archive.tar.gz');
+        fs.writeFileSync(archivePath, archive);
+        const extractDir = path.join(scratchDir, 'extract');
+        fs.mkdirSync(extractDir);
+        extractMember(archivePath, extractDir, pin.archiveMember);
+        const stageDir = path.join(scratchDir, 'stage');
+        fs.mkdirSync(stageDir);
+        const stagedBinary = path.join(stageDir, tool);
+        fs.renameSync(path.join(extractDir, pin.archiveMember), stagedBinary);
+        fs.chmodSync(stagedBinary, 0o755);
+        publishStage(stageDir, targetDir, binaryPath);
+    }
+    finally {
+        fs.rmSync(scratchDir, { force: true, recursive: true });
+    }
+    return binaryPath;
+}
+export function resolveToolPlatform(platform, arch) {
+    const key = `${platform}-${arch}`;
+    const supported = SUPPORTED_PLATFORMS.find((candidate) => candidate === key);
+    if (supported === undefined) {
+        throw new UserError(`Workflow linting does not support ${key}; the supported platforms are ${SUPPORTED_PLATFORMS.join(', ')}`);
+    }
+    return supported;
+}
+function createCacheRoot(cacheRoot) {
+    try {
+        fs.mkdirSync(cacheRoot, { recursive: true });
+    }
+    catch (error) {
+        throw new Error(`Cannot create the tool cache at ${cacheRoot}`, { cause: error });
+    }
+}
+async function download(url, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+    }
+    catch (error) {
+        throw new Error(`Cannot download ${url}: ${describeError(error)}`, { cause: error });
+    }
+    if (!response.ok) {
+        throw new Error(`Cannot download ${url}: HTTP ${response.status}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+function extractMember(archivePath, extractDir, member) {
+    const result = spawnSync('tar', ['-xzf', archivePath, '-C', extractDir, member], { encoding: 'utf8' });
+    if (result.error !== undefined) {
+        throw new Error(`Cannot run tar to extract ${member}: ${result.error.message}`, { cause: result.error });
+    }
+    if (result.status !== 0) {
+        throw new Error(`tar could not extract ${member} from ${archivePath}: ${result.stderr.trim()}`);
+    }
+}
+function publishStage(stageDir, targetDir, binaryPath) {
+    try {
+        fs.renameSync(stageDir, targetDir);
+    }
+    catch (error) {
+        if (!fs.existsSync(binaryPath)) {
+            throw error;
+        }
+    }
+}

package/dist/esm/default-scripts.js

@@ -4,6 +4,7 @@ const TYPECHECK_STEP = { run: 'typecheck', shouldDeclineArguments: true };
 const ROOT_TYPECHECK_STEP = { run: 'root:typecheck', shouldDeclineArguments: true };
 const LINT_CHECK_STEP = { run: 'lint:check', shouldRunInBackground: true };
 const LINT_STRICT_STEP = { run: 'lint:strict', shouldRunInBackground: true };
+const LINT_WORKFLOWS_STEP = { run: 'lint:workflows', shouldDeclineArguments: true };
 export const workspaceScripts = {
     build: ['compile'],
     check: [LINT_CHECK_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
@@ -18,12 +19,12 @@ export const workspaceScripts = {
     'lint:check': 'eslint .',
     'lint:strict': 'strict-lint',
     'report-catalog': 'nmr-report-catalog',
-    test: `pnpm exec vitest ${GATE_PROJECTS}`,
-    'test:all': 'pnpm exec vitest',
-    'test:coverage': `pnpm exec vitest ${GATE_PROJECTS} --coverage`,
-    'test:tool': 'pnpm exec vitest --project tool',
-    'test:unit': 'pnpm exec vitest --project unit',
-    'test:watch': `pnpm exec vitest ${GATE_PROJECTS} --watch`,
+    test: `nmr-vitest ${GATE_PROJECTS}`,
+    'test:all': 'nmr-vitest',
+    'test:coverage': `nmr-vitest ${GATE_PROJECTS} --coverage`,
+    'test:tool': 'nmr-vitest --project tool',
+    'test:unit': 'nmr-vitest --project unit',
+    'test:watch': `nmr-vitest ${GATE_PROJECTS} --watch`,
     typecheck: 'tsgo --noEmit',
     upgrade: 'nmr-report-catalog && nmr-taze',
     'view-coverage': 'open coverage/index.html',
@@ -35,8 +36,8 @@ export function buildRootScripts(workspaceGlobs) {
         'audit:dev': 'pnpm exec v11y --dev',
         'audit:prod': 'pnpm exec v11y --prod',
         build: ['-R build'],
-        check: [LINT_CHECK_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
-        'check:strict': [LINT_STRICT_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
+        check: [LINT_CHECK_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
+        'check:strict': [LINT_STRICT_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
         ci: [{ run: 'build', shouldDeclineArguments: true }, 'check:strict'],
         clean: 'nmr-clean',
         fix: ['lint', 'fmt'],
@@ -46,9 +47,10 @@ export function buildRootScripts(workspaceGlobs) {
         lint: 'eslint --fix .',
         'lint:check': 'eslint .',
         'lint:strict': 'strict-lint',
+        'lint:workflows': 'nmr-actionlint',
         prepush: [{ run: 'audit', shouldDeclineArguments: true }, 'ci'],
         'report-overrides': 'nmr-report-overrides',
-        'root:check': [ROOT_TYPECHECK_STEP, 'fmt:check', 'root:lint:check', 'root:test'],
+        'root:check': [ROOT_TYPECHECK_STEP, 'fmt:check', 'root:lint:check', LINT_WORKFLOWS_STEP, 'root:test'],
         'root:lint': `eslint --fix ${ignorePatterns}.`,
         'root:lint:check': `eslint ${ignorePatterns}.`,
         'root:lint:strict': `strict-lint ${ignorePatterns}.`,

package/dist/esm/glyphs.d.ts

@@ -5,5 +5,5 @@
  * `noop` is a neutral circle: Nothing ran because the repo asked for nothing to run, which is neither a
  * failure nor a block.
  */
-export declare const NMR_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"overrides" | "clean" | "catalog" | "noop" | "package" | "recording", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
+export declare const NMR_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"overrides" | "clean" | "host" | "catalog" | "noop" | "package" | "recording", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
 export type NmrGlyphName = keyof (typeof NMR_GLYPHS)['rich'];

package/dist/esm/glyphs.js

@@ -2,6 +2,7 @@ import { defineGlyphSet } from '@williamthorsen/nmr-core';
 export const NMR_GLYPHS = defineGlyphSet({
     catalog: { plain: '', rich: '\u{1F4DA}' },
     clean: { plain: '', rich: '\u{1F9F9}' },
+    host: { plain: '', rich: '\u{1F4E1}' },
     noop: { plain: 'NOOP', rich: '\u{26AA}' },
     overrides: { plain: '', rich: '\u{1F512}' },
     package: { plain: '', rich: '\u{1F4E6}' },

package/dist/esm/remote-host-session.js

@@ -14,6 +14,8 @@ export function runHostSession(params) {
     const COMMAND_NOT_FOUND_EXIT_CODE = 127;
     const DELEGATION_FAILURE_EXIT_CODE = 255;
     const STOP_GRACE_MS = 5_000;
+    const NODE_MODULES_DIR = path.join(params.rootDir, 'node_modules');
+    const BINS_RECORD_PATH = path.join(NODE_MODULES_DIR, '.nmr-delegate-bins');
     const token = crypto.randomUUID();
     let isHolding = false;
     let activeChild;
@@ -36,6 +38,10 @@ export function runHostSession(params) {
                 return;
             }
         }
+        const binsFingerprint = readBinsFingerprint();
+        if (binsFingerprint === undefined || readBinsRecord() !== binsFingerprint) {
+            removeWorkspaceState();
+        }
         const install = await runPhase('pnpm', ['install', '--frozen-lockfile'], params.rootDir, {
             ...process.env,
             CI: 'true',
@@ -46,6 +52,8 @@ export function runHostSession(params) {
             fail('install', install);
             return;
         }
+        if (binsFingerprint !== undefined)
+            writeBinsRecord(binsFingerprint);
         emit({ kind: 'run' });
         fs.mkdirSync(params.runDir, { recursive: true });
         fs.mkdirSync(params.passManifestDir, { recursive: true });
@@ -146,6 +154,42 @@ export function runHostSession(params) {
             return true;
         return state.holder !== undefined && isProcessGone(state.holder.pid);
     }
+    function readBinsFingerprint() {
+        let listing;
+        try {
+            listing = childProcess.execFileSync('git', ['ls-files', '-z', '--', '*package.json'], {
+                cwd: params.rootDir,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+        }
+        catch {
+            return undefined;
+        }
+        const lines = listing
+            .split('\0')
+            .filter((file) => path.basename(file) === 'package.json')
+            .toSorted()
+            .map((file) => {
+            try {
+                const manifest = JSON.parse(fs.readFileSync(path.join(params.rootDir, file), 'utf8'));
+                const fields = typeof manifest === 'object' && manifest !== null ? { ...manifest } : {};
+                return JSON.stringify([file, fields['name'], fields['bin']]);
+            }
+            catch {
+                return JSON.stringify([file]);
+            }
+        });
+        return crypto.createHash('sha256').update(lines.join('\n')).digest('hex');
+    }
+    function readBinsRecord() {
+        try {
+            return fs.readFileSync(BINS_RECORD_PATH, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    }
     function readErrorCode(error) {
         return typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
     }
@@ -218,6 +262,14 @@ export function runHostSession(params) {
             fs.rmSync(LOCK_PATH, { force: true });
         }
     }
+    function removeWorkspaceState() {
+        const names = fs.existsSync(NODE_MODULES_DIR) ? fs.readdirSync(NODE_MODULES_DIR) : [];
+        for (const name of names) {
+            if (name.startsWith('.pnpm-workspace-state') && name.endsWith('.json')) {
+                fs.rmSync(path.join(NODE_MODULES_DIR, name), { force: true });
+            }
+        }
+    }
     function runPhase(file, args, cwd, env) {
         const head = [];
         const tail = [];
@@ -274,4 +326,12 @@ export function runHostSession(params) {
         catch {
         }
     }
+    function writeBinsRecord(fingerprint) {
+        try {
+            fs.mkdirSync(NODE_MODULES_DIR, { recursive: true });
+            fs.writeFileSync(BINS_RECORD_PATH, fingerprint);
+        }
+        catch {
+        }
+    }
 }

package/dist/esm/tests.d.ts

@@ -21,7 +21,8 @@ export declare function checkTestFileConventions(options?: TestFileConventionsOp
  * remedy. Outside Vitest it does nothing.
  *
  * A second `@vitest/runner` copy is never handed the running state, and its `describe` fails with a bare `TypeError`.
- * The default `probe` comes from `vitest/suite`, which re-exports the same copy as the `describe` imported here.
+ * The default `probe` is `TestRunner.getCurrentSuite`, imported from the same `vitest` as `describe`, so both come from
+ * one runner copy.
  *
  * @internal - Exported only to enable testing
  */

package/dist/esm/tests.js

@@ -1,5 +1,4 @@
-import { describe, expect, it } from 'vitest';
-import { getCurrentSuite } from 'vitest/suite';
+import { describe, expect, it, TestRunner } from 'vitest';
 import { findMisplacedTestFiles, findUntieredTestFiles, TIER_NAMES } from "./tiers.js";
 import { findMonorepoRoot } from "./workspace.js";
 const MISPLACED_REMEDY = 'Every test file must be under a `__tests__` directory, the only place from which the shared Vitest config collects. Move each file below into one, or name its directory in `excludedBasenames`.';
@@ -18,7 +17,7 @@ export function checkTestFileConventions(options = {}) {
         });
     });
 }
-export function assertImportedRunnerIsActive(probe = getCurrentSuite) {
+export function assertImportedRunnerIsActive(probe = TestRunner.getCurrentSuite) {
     if (process.env['VITEST'] === undefined)
         return;
     try {

package/dist/esm/verdict.js

@@ -23,7 +23,7 @@ const MIN_CUT_BYTES = Buffer.byteLength(TRUNCATION_MARK);
 const REPLAY_MARKER = 'replayed:';
 function describeOutcome(verdict, style) {
     const statuses = STATUS_GLYPHS[style];
-    const onHost = verdict.host === undefined ? '' : ` on ${verdict.host}`;
+    const onHost = verdict.host === undefined ? '' : ` on ${formatHost(verdict.host, style)}`;
     switch (verdict.outcome) {
         case 'passed':
             return { marker: statuses.passed.text, phrase: `passed${onHost} in ${formatDuration(verdict.durationMs)}` };
@@ -35,9 +35,10 @@ function describeOutcome(verdict, style) {
         case 'recalled': {
             const saving = formatSaving(verdict.savedMs);
             const savingClause = saving === undefined ? '' : `, ${saving}`;
+            const source = verdict.host === undefined ? 'this tree' : formatHost(verdict.host, style);
             return {
                 marker: statuses.skipped.text,
-                phrase: `passed ${formatDuration(verdict.ageMs)} ago on ${verdict.host ?? 'this tree'}${savingClause}`,
+                phrase: `passed ${formatDuration(verdict.ageMs)} ago on ${source}${savingClause}`,
             };
         }
         case 'no-op':
@@ -87,6 +88,10 @@ function findCutTarget(sizesBytes, longestSizeBytes, overrunBytes) {
 function isWithinBudget(renderedLine) {
     return Buffer.byteLength(renderedLine) <= LINE_BUDGET_BYTES;
 }
+function formatHost(host, style) {
+    const glyph = NMR_GLYPHS[style].host.text;
+    return glyph === '' ? host : `${glyph} ${host}`;
+}
 function readAttribution(verdict) {
     if (verdict.outcome !== 'recalled' || verdict.replay === undefined) {
         return [];

package/docs/check-cache.md

@@ -10,7 +10,7 @@ The cache is a working-tree cache, not a build cache: It answers "has this exact
 
 ## What is cached
 
-Cacheable by default: `check`, `check:strict`, `ci`, `fix:check`, `fmt:check`, `lint:check`, `lint:strict`, `test`, `test:coverage`, `test:tool`, `test:unit`, `typecheck`, and the `root:` variants `root:check`, `root:lint:check`, `root:lint:strict`, `root:test`, `root:test:tool`, `root:test:unit`, and `root:typecheck`.
+Cacheable by default: `check`, `check:strict`, `ci`, `fix:check`, `fmt:check`, `lint:check`, `lint:strict`, `lint:workflows`, `test`, `test:coverage`, `test:tool`, `test:unit`, `typecheck`, and the `root:` variants `root:check`, `root:lint:check`, `root:lint:strict`, `root:test`, `root:test:tool`, `root:test:unit`, and `root:typecheck`.
 
 Everything else runs every time:
 
@@ -124,7 +124,7 @@ The excerpt is a line; nmr also keeps the run's whole transcript. `nmr --log <co
 ```console
 $ nmr --log test
 💾 nmr: test — recorded 2026-08-12T15:04:05.412Z (12m ago), ran in 12.4s
-$ pnpm exec vitest --project unit --project tool
+$ nmr-vitest --project unit --project tool
 
  ✓ src/__tests__/resolver.unit.test.ts (18 tests) 12ms
 

package/docs/delegate.md

@@ -5,7 +5,7 @@ nmr runs a command on another machine over SSH, against the working tree on this
 ```console
 $ nmr --delegate-to imac2 ci
 # ... the host's own output and verdicts ...
-✅ my-repo: ci: passed on imac2 in 1m 48s
+✅ my-repo: ci: passed on 📡 imac2 in 1m 48s
 ```
 
 A machine that runs several worktrees' checks at once runs out of memory, and the [machine lock](machine-lock.md) protects it by making the checks wait for one another. Delegation moves a check to a machine that has the room for it instead. Which hosts a machine can reach is a fact about the machine, so a user config on the machine, not the repo, names them and turns delegation on.
@@ -61,7 +61,7 @@ With several hosts, nmr asks every host at once, with one `ssh` call each, wheth
 
 ```console
 $ NMR_DELEGATE=imac2,imac3 nmr ci
-✅ my-repo: ci: passed on imac3 in 1m 52s
+✅ my-repo: ci: passed on 📡 imac3 in 1m 52s
 ```
 
 - **A single host is not asked.** The delegation goes to it directly.
@@ -98,7 +98,7 @@ $ nmr --delegate-to imac2 ci
 
 nmr records the working tree as it is on disk as a commit: tracked changes, staged or not, and untracked files that git does not ignore. This is the tree that a local run checks. The commit is built in a temporary index, so the repository's index, refs, and stash do not change.
 
-nmr pushes the commit to a checkout on the host under `~/.cache/nmr/delegate/`, without running the repository's `pre-push` hook, then runs `pnpm install --frozen-lockfile` and the command from the directory that corresponds to the local one, with nmr's own flags as they were given. The host keeps one checkout for each repository on each machine that delegates to it, so concurrent delegations from different worktrees do not share one, and `node_modules` and build output persist between runs. nmr does not remove these checkouts.
+nmr pushes the commit to a checkout on the host under `~/.cache/nmr/delegate/`, without running the repository's `pre-push` hook, then runs `pnpm install --frozen-lockfile` and the command from the directory that corresponds to the local one, with nmr's own flags as they were given. The host keeps one checkout for each repository on each machine that delegates to it, so concurrent delegations from different worktrees do not share one, and `node_modules` and build output persist between runs. When the workspace packages' `bin` entries differ from those of the checkout's last successful install, nmr first removes pnpm's workspace state, so that the install links the new bins, which an unchanged lockfile would otherwise let pnpm skip; that install reruns the workspace's `prepare` scripts. nmr does not remove these checkouts.
 
 - **Ignored files stay here.** A command that needs a gitignored file, such as a local `.env`, does not find it on the host.
 - **A repository with submodules cannot be delegated**, nor can a tree containing a nested repository, because the snapshot does not include their content. A delegation flag refuses such a tree; under `NMR_DELEGATE` or the user config, the command runs here, and nmr prints one line saying why.
@@ -123,7 +123,7 @@ The host's nmr prints its output and verdicts, and nmr here adds one verdict for
 A failure of the delegation itself, rather than of the command, exits 255, the status with which `ssh` reports its own failures, and names the step that failed, after what that step printed:
 
 ```console
-❌ my-repo: ci: failed on imac2 in 10.0s (exit 255) — could not prepare imac2
+❌ my-repo: ci: failed on 📡 imac2 in 10.0s (exit 255) — could not prepare imac2
 ```
 
 The steps are `prepare`, which reaches the host and creates the checkout, `push`, `check out`, and `install`. A connection lost while the command runs is reported as `lost connection to <host>`.

package/docs/scripts.md

@@ -182,7 +182,7 @@ Neither is bound to a git hook. `prepush` is named for when a developer runs it,
 
 ### Check and quality
 
-`check` and `check:strict` start their lint step first and [run it in the background](#running-a-step-in-the-background), alongside typecheck, the format check, and the tests.
+`check` and `check:strict` start their lint step first and [run it in the background](#running-a-step-in-the-background), alongside typecheck, the format check, and the tests. At the root, both then run [`lint:workflows`](#workflow-lint) before typecheck, and `root:check` runs it after `root:lint:check`.
 
 Neither gate computes coverage: Instrumentation multiplies the wall time of the run that they exist to keep short. Coverage is [`test:coverage`](vitest.md#test-selections), run as a step of its own; a repo that wants it inside the gate [overrides](#configuration) `check:strict`.
 
@@ -194,6 +194,14 @@ Requires `eslint` >= 10 and, for `lint:strict`, `@williamthorsen/strict-lint` >=
 
 The run never enters a package, so per-package `lint:pre` and `lint:post` hooks do not fire from the root. They still run from inside the package and under `nmr -F <package> lint`.
 
+### Workflow lint
+
+`lint:workflows`, a root command, lints the GitHub Actions workflows under `.github/workflows/` with [actionlint](https://github.com/rhysd/actionlint), including its shellcheck pass over every `run:` block, and fails on any finding. A repo without `.github/workflows/` passes. The command runs `nmr-actionlint`, which forwards trailing arguments to actionlint, so `nmr lint:workflows .github/workflows/ci.yaml` lints that file alone; inside `check`, `check:strict`, and `root:check`, the step declines them.
+
+The result does not depend on what the machine has installed. nmr pins actionlint 1.7.12 and shellcheck 0.11.0, downloads each from its upstream GitHub release on first use, verifies it against the SHA-256 recorded in nmr, and caches it under `node_modules/.cache/nmr-tools/` at the monorepo root. The first run therefore needs access to `github.com`, and a failed download or a checksum mismatch fails the command. The pyflakes integration is off. The pins move only with a release of nmr.
+
+The supported platforms are macOS and Linux on x64 and arm64; on any other, the command fails and names the platform. actionlint reads its own configuration from `.github/actionlint.yaml`, through which a repo can ignore a finding.
+
 ### Root-only
 
 The `root:`-prefixed commands operate on root-level code only (not workspace packages).

package/docs/utilities.md

@@ -1,6 +1,14 @@
 # Standalone utilities
 
-The binaries behind nmr's default `clean`, `compile`, and `fmt` commands, and a check for the `prepublishOnly` hooks of publishable packages.
+The binaries behind nmr's default `clean`, `compile`, `fmt`, `lint:workflows`, and package `test` commands, and a check for the `prepublishOnly` hooks of publishable packages.
+
+## `nmr-actionlint`
+
+Lint the monorepo's GitHub Actions workflows with pinned actionlint and shellcheck binaries, forwarding any arguments to actionlint. This is the default root `lint:workflows` script; [Workflow lint](scripts.md#workflow-lint) covers the pins, the download, and the supported platforms.
+
+```bash
+nmr-actionlint
+```
 
 ## `nmr-clean`
 
@@ -63,6 +71,16 @@ Pass `--no-cache`, or set `NMR_NO_CACHE=1`, to run uncached. `nmr --no-cache fmt
 nmr-fmt --check --no-cache
 ```
 
+## `nmr-vitest`
+
+Run Vitest from a package directory with the monorepo's shared config. Vitest 5 does not search parent directories for a config, so `nmr-vitest` names it: When the working directory does not contain a `vitest.config.*` or `vite.config.*` of its own, it passes `--config` naming the `vitest.config.*` at the monorepo root, the directory that contains `pnpm-workspace.yaml`. It does not search the directories in between. A package with a config of its own, a monorepo root without a `vitest.config.*`, and a directory outside any monorepo all run Vitest without the flag. An explicit `--config` or `-c` ahead of any `--` passes through unchanged, and so does every other argument. This is the command behind every package-scope `test*` script.
+
+`vitest` is an optional peer dependency (`>=4.0.0 <6`), resolved from the working directory alone and never from nmr's installation, because a second copy of the runner is not handed the state of the one that loads the tests. Run without it, `nmr-vitest` fails with an error naming the peer and the range. Its exit status is Vitest's, or 128 plus the signal number when a signal ends Vitest.
+
+```bash
+nmr-vitest --project unit --project tool
+```
+
 ## `ensure-prepublish-hooks`
 
 Verify that all publishable workspace packages have a `prepublishOnly` script. Exits non-zero if any are missing.

package/docs/vitest.md

@@ -4,7 +4,7 @@ The Vitest config that `@williamthorsen/nmr/vitest` publishes: its test tiers an
 
 The [README](../README.md#shared-vitest-config) shows the one-line config file.
 
-`vitest` is a peer dependency (`>=4.0.0 <5`), declared optional; the consuming repo provides it, and repos that never import this subpath are unaffected. `vite` is an optional peer as well (`>=8.0.0 <9`), required only by the [`tsconfigPaths` setting](#resolving-through-tsconfig-paths); a repo that declares a `vite` of its own below that range sees an unmet-peer warning whether or not it sets the flag.
+`vitest` is a peer dependency (`>=4.0.0 <6`), declared optional; the consuming repo provides it, and repos that never import this subpath are unaffected. `vite` is an optional peer as well (`>=8.0.0 <9`), required only by the [`tsconfigPaths` setting](#resolving-through-tsconfig-paths); a repo that declares a `vite` of its own below that range sees an unmet-peer warning whether or not it sets the flag.
 
 ## Test tiers
 
@@ -58,6 +58,8 @@ Every package resolves the same six test commands. Nothing is detected on disk:
 
 To narrow to a single project, go through `test:all`: `nmr test:all --project remote`. Narrowing through `test` does not work, because a second `--project` widens the selection rather than restricting it.
 
+The package scripts run [`nmr-vitest`](utilities.md#nmr-vitest), which names the root config when a package does not have one of its own. Vitest 5 does not search parent directories for a config, so under it a bare `vitest`, or an editor's test runner, started from such a package needs `--config` naming the root's `vitest.config.*`; Vitest 4 finds it unaided. A repo that overrides a package `test*` script with its own `vitest` invocation passes the flag there too.
+
 A run that does not collect any test files passes. That is what lets `nmr test:tool` fan out across a monorepo in which most packages do not have any tool-tier tests, and it means a package without any tests at all does not need a `"test": ""` override.
 
 The root registry defines the same six names, so a command means the same thing from the monorepo root as from inside a package. Each fans out to root-level files and every workspace package.
@@ -100,7 +102,7 @@ checkTestFileConventions({ excludedBasenames: ['cypress', 'generated'] });
 
 **Paths that git ignores are out of scope for both.** The sweep skips every untracked path that git ignores under the swept root, and the shared configs exclude the same paths from collection, so local build output such as a stale `.netlify/` directory is neither reported nor run. Git decides what is ignored: A tracked file stays in scope even when it matches an ignore pattern. Outside a git repository, or when git cannot run, nothing counts as ignored and only the named directories are pruned. A generated directory that the repo's `.gitignore` already covers therefore does not need an entry in either list.
 
-Expect the first run to fail in a repo that has never gated this. Vitest 4 excludes only `node_modules` and `.git` by default, so a `__tests__` tree under a generated or vendored directory that git tracks is collected and runs today; naming that directory in both lists is the fix, rather than widening what nmr prunes for everyone.
+Expect the first run to fail in a repo that has never gated this. Vitest excludes only `node_modules` and `.git` by default, so a `__tests__` tree under a generated or vendored directory that git tracks is collected and runs today; naming that directory in both lists is the fix, rather than widening what nmr prunes for everyone.
 
 In a repo that has not declared the check, [nmr's readyup kit](../README.md#conformance-checks) reports both halves and warns that the check is missing. Once a test file under `__tests__` imports it, the kit skips both reports and names that file as the reason. Only the check reads the repo's `excludedBasenames`, and a kit report beside it could only repeat its findings or name a directory that the repo has pruned.
 
@@ -157,7 +159,7 @@ It folds across layers like the other two, the last layer to declare it winning.
 
 **It is an opt-in because its silent direction is the reverse of the two defaults'.** Leaving it off fails loudly, with an unresolved import naming the specifier. Turning it on is the silent direction, for a repo that declares `paths` for `tsc` alone: A specifier that resolved through a package's `exports` starts resolving through the alias instead, and nothing in the run reports the switch. A repo that does not declare `paths` is unaffected either way.
 
-**It requires Vite 8**, the version that introduced `resolve.tsconfigPaths`. nmr declares `vite` as an optional peer at `>=8.0.0 <9`, so a repo that declares a stale `vite` of its own sees a warning at install time. That check does not apply to a repo whose only Vite comes in through Vitest's own dependency, and Vitest 4 accepts Vite 6 and 7: On those, the emitted key does nothing and the aliased import fails exactly as it would with the flag off.
+**It requires Vite 8**, the version that introduced `resolve.tsconfigPaths`. nmr declares `vite` as an optional peer at `>=8.0.0 <9`, so a repo that declares a stale `vite` of its own sees a warning at install time. That check does not apply to a repo that does not declare `vite` itself, whose Vite is the one that Vitest brings in: a dependency under Vitest 4 and an auto-installed peer under Vitest 5. Both majors accept Vite 6 and 7: On those, the emitted key does nothing and the aliased import fails exactly as it would with the flag off.
 
 ## Customizing by scope
 
@@ -215,7 +217,7 @@ Both factories fold any number of layers left to right: A later layer wins on a
 
 Order matters for `setupFiles`, because a shared setup file establishes the environment in which the package's own then runs. A later layer's `project` block likewise wins over an earlier layer's `tiers` target: The nearer config is the more deliberate.
 
-**A package's own `vite.config.ts` also counts as that one config.** Vitest searches for a config by ascending from the run root and stopping at the first directory containing any of `vitest.config.*` or `vite.config.*`, so a package with only a Vite config ends the search there and never reaches the root config. Within a directory `vitest.config.*` is tried first, which makes the fix a Vitest config beside the Vite one, calling `defineVitestConfig()` as any other package config does. Without it the package does not declare any projects, and every tier-selecting command fails with `No projects matched the filter`, `nmr ci` among them. [nmr's readyup kit](../README.md#conformance-checks) reports a package in that state.
+**A package's own `vite.config.ts` also counts as that one config.** Vitest loads a `vitest.config.*` or `vite.config.*` that it finds in the run root, and [`nmr-vitest`](utilities.md#nmr-vitest) names the root config only for a package that does not contain either, so a package with only a Vite config never reaches the root config. Within a directory `vitest.config.*` is tried first, which makes the fix a Vitest config beside the Vite one, calling `defineVitestConfig()` as any other package config does. Without it the package does not declare any projects, and every tier-selecting command fails with `No projects matched the filter`, `nmr ci` among them. [nmr's readyup kit](../README.md#conformance-checks) reports a package in that state.
 
 **A path in a shared layer must be absolute.** Vitest resolves `setupFiles` against each project's own root, not against the module that declared the path, so a bare `'./vitest.setup.ts'` in a shared module names a different file in every package that consumes it -- and a package that happens to own a file by that name loads the wrong one instead of failing. The co-located form stays correct in a config file that declares the path directly.
 
@@ -249,7 +251,7 @@ The collection exclusions do not name fixtures, and that asymmetry is intentiona
 
 ## Root-scoped tests
 
-A monorepo's own root-level tests need a second config, because the package config is found by walking up from a package directory:
+A monorepo's own root-level tests need a second config, because [`nmr-vitest`](utilities.md#nmr-vitest) passes the root's `vitest.config.*` to every package that does not have a config of its own, and that config covers packages:
 
 ```ts
 // vitest.root.config.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.50.1",
+  "version": "0.52.0",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -58,12 +58,14 @@
   "bin": {
     "ensure-prepublish-hooks": "bin/ensure-prepublish-hooks.js",
     "nmr": "bin/nmr.js",
+    "nmr-actionlint": "bin/nmr-actionlint.js",
     "nmr-clean": "bin/nmr-clean.js",
     "nmr-compile": "bin/nmr-compile.js",
     "nmr-fmt": "bin/nmr-fmt.js",
     "nmr-report-catalog": "bin/nmr-report-catalog.js",
     "nmr-report-overrides": "bin/nmr-report-overrides.js",
-    "nmr-taze": "bin/nmr-taze.js"
+    "nmr-taze": "bin/nmr-taze.js",
+    "nmr-vitest": "bin/nmr-vitest.js"
   },
   "files": [
     ".meta/changelog.json",
@@ -77,9 +79,9 @@
     "!docs/*.v*.md"
   ],
   "dependencies": {
-    "@williamthorsen/nmr-core": "0.13.5",
-    "@williamthorsen/toolbelt.errors": "0.8.3",
-    "@williamthorsen/toolbelt.filesystem": "0.9.3",
+    "@williamthorsen/nmr-core": "0.13.6",
+    "@williamthorsen/toolbelt.errors": "0.8.4",
+    "@williamthorsen/toolbelt.filesystem": "0.9.4",
     "glob": "13.0.6",
     "prettier": "3.9.10",
     "prettier-plugin-sh": "0.20.2",
@@ -87,20 +89,20 @@
     "unconfig": "7.5.0"
   },
   "devDependencies": {
-    "@williamthorsen/toolbelt.testing": "0.6.3",
-    "@williamthorsen/toolbelt.vitest": "0.10.3",
+    "@williamthorsen/toolbelt.testing": "0.7.0",
+    "@williamthorsen/toolbelt.vitest": "0.12.0",
     "esbuild": "0.28.2",
-    "readyup": "0.42.0",
+    "readyup": "0.43.0",
     "tinyglobby": "0.2.17",
     "typescript": "6.0.3",
     "vite": "8.3.4",
-    "vitest": "4.1.11",
+    "vitest": "5.0.5",
     "yaml": "2.9.1"
   },
   "peerDependencies": {
     "typescript": ">=5.7.0 <7",
     "vite": ">=8.0.0 <9",
-    "vitest": ">=4.0.0 <5"
+    "vitest": ">=4.0.0 <6"
   },
   "peerDependenciesMeta": {
     "typescript": {