@workerstack/repo 0.0.0-stage → 0.1.0

package/cli/check-env-modules.test.ts

@@ -0,0 +1,85 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { checkEnvModules } from "./check-env-modules.ts";
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const dir of dirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+/** A temp git repo holding `files` (path → content); `track` adds them all to the index. */
+function repoWith(files: Record<string, string>, track = true): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "check-env-module-"));
+  dirs.push(dir);
+  execFileSync("git", ["init", "-q"], { cwd: dir });
+  for (const [rel, content] of Object.entries(files)) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), content);
+  }
+  if (track) execFileSync("git", ["add", "-A"], { cwd: dir });
+  return dir;
+}
+
+const PKG = "{}\n";
+const ENV = "export {};\n";
+
+const SIBLINGS = {
+  "packages/a/package.json": PKG,
+  "packages/a/src/env.ts": ENV,
+  "packages/a/lib/env.ts": ENV,
+};
+const ROOT_PAIR = { "package.json": PKG, "env.ts": ENV, "src/env.ts": ENV };
+const ROOT_LINE = "env: env.ts and src/env.ts are both env.ts in .; keep one";
+
+describe("checkEnvModules", () => {
+  it("fails two env.ts under one package.json, naming both sorted", () => {
+    const dir = repoWith(SIBLINGS);
+    expect(checkEnvModules(dir)).toEqual([
+      "env: packages/a/lib/env.ts and packages/a/src/env.ts are both env.ts in packages/a; keep one",
+    ]);
+  });
+
+  it("lists the packages in sorted order", () => {
+    const dir = repoWith({
+      "packages/b/package.json": PKG,
+      "packages/b/env.ts": ENV,
+      "packages/b/src/env.ts": ENV,
+      ...SIBLINGS,
+    });
+    expect(checkEnvModules(dir).map((line) => line.split(" in ")[1])).toEqual([
+      "packages/a; keep one",
+      "packages/b; keep one",
+    ]);
+  });
+});
+
+describe("checkEnvModules, other layouts", () => {
+  it("passes one env.ts per package", () => {
+    const dir = repoWith({
+      "packages/a/package.json": PKG,
+      "packages/a/env.ts": ENV,
+      "packages/b/package.json": PKG,
+      "packages/b/env.ts": ENV,
+    });
+    expect(checkEnvModules(dir)).toEqual([]);
+  });
+
+  it("shows the root package as a dot", () => {
+    expect(checkEnvModules(repoWith(ROOT_PAIR))).toEqual([ROOT_LINE]);
+  });
+
+  it("skips a gitignored env.ts and counts an untracked one", () => {
+    const files = { ".gitignore": "ignored/\n", "package.json": PKG, "env.ts": ENV, "ignored/env.ts": ENV };
+    expect(checkEnvModules(repoWith(files))).toEqual([]);
+    expect(checkEnvModules(repoWith({ ...files, "src/env.ts": ENV }, false))).toEqual([ROOT_LINE]);
+  });
+
+  it("is empty outside a git repo", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "check-env-module-"));
+    dirs.push(dir);
+    expect(checkEnvModules(dir)).toEqual([]);
+  });
+});

package/cli/check-env-modules.ts

@@ -0,0 +1,56 @@
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { ENV_FILE, MANIFEST } from "./env.constants.ts";
+
+const ROOT = ".";
+
+/** Tracked and untracked, non-ignored files under `cwd`, posix and relative to it; none outside a git repo. */
+function listFiles(cwd: string): string[] {
+  try {
+    const out = execFileSync("git", ["ls-files", "-z", "-co", "--exclude-standard"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return [...new Set(out.split("\0").filter((rel) => rel !== ""))];
+  } catch {
+    return [];
+  }
+}
+
+/** The folder of the nearest `package.json` at or above `rel`'s folder, `.` for the root or none. */
+function packageOf(rel: string, manifests: ReadonlySet<string>): string {
+  let dir = path.posix.dirname(rel);
+  while (dir !== ROOT) {
+    if (manifests.has(dir)) return dir;
+    dir = path.posix.dirname(dir);
+  }
+  return ROOT;
+}
+
+/** `a, b and c`; a pair is `a and b`. */
+function listOf(items: readonly string[]): string {
+  const rest = [...items];
+  const last = rest.pop();
+  return `${rest.join(", ")} and ${last}`;
+}
+
+/**
+ * One line per package with two or more `env.ts` files, sorted by package: the schema of a package's environment
+ * lives in one module. Tracked and untracked non-ignored files count.
+ */
+export function checkEnvModules(cwd: string): string[] {
+  const files = listFiles(cwd);
+  const manifests = new Set(
+    files.filter((rel) => path.posix.basename(rel) === MANIFEST).map((rel) => path.posix.dirname(rel)),
+  );
+  const byPackage = new Map<string, string[]>();
+  for (const rel of files.filter((file) => path.posix.basename(file) === ENV_FILE)) {
+    const pkg = packageOf(rel, manifests);
+    byPackage.set(pkg, [...(byPackage.get(pkg) ?? []), rel]);
+  }
+  return [...byPackage]
+    .filter(([, found]) => found.length > 1)
+    .toSorted(([a], [b]) => a.localeCompare(b, "en"))
+    .map(([pkg, found]) => `env: ${listOf(found.toSorted())} are both ${ENV_FILE} in ${pkg}; keep one`);
+}

package/cli/check-magic.test.ts

@@ -0,0 +1,139 @@
+import { afterEach, expect, it } from "vitest";
+import { magicDiagnostics, withoutSkipped } from "./check-magic.ts";
+import {
+  BOUND,
+  cleanTemps,
+  COMPARED,
+  COPIES,
+  hit,
+  magicOf,
+  NAMES_NOTHING,
+  NUMBER,
+  plant,
+  SCHEMA,
+  SLOW,
+  STRING,
+} from "./magic/fixtures/magic-repo.ts";
+
+afterEach(cleanTemps);
+
+const RETRY = [
+  'import { Schema } from "./schema.ts";',
+  "",
+  'const FAST = "fast";',
+  "const t = delay(go, 5000);",
+  "",
+  "declare function delay(f: () => void, ms: number): number;",
+  "declare function go(): void;",
+  "export function retry(mode: string, s: Schema): number {",
+  "  void s.max(2048);",
+  "  if (mode === FAST) return t;",
+  "  if (t < 0) return 0;",
+  '  if (mode == "fast") return 0;',
+  "  return 1;",
+  "}",
+  "",
+].join("\n");
+
+it("reports each Usage hit at its line and column, in file and position order", () => {
+  expect(magicOf({ "src/retry.ts": RETRY, "src/schema.ts": SCHEMA })).toEqual([
+    hit("src/retry.ts:3:7", STRING, COPIES("FAST", "fast")),
+    hit("src/retry.ts:4:21", NUMBER, NAMES_NOTHING("5000")),
+    hit("src/retry.ts:9:14", NUMBER, BOUND(".max(2048)")),
+    hit("src/retry.ts:12:15", STRING, COMPARED("fast")),
+  ]);
+});
+
+it(
+  "groups files by their nearest tsconfig.json, so a package's paths resolve and its literal union passes",
+  { timeout: SLOW },
+  () => {
+    const api = {
+      compilerOptions: {
+        strict: true,
+        module: "preserve",
+        moduleResolution: "bundler",
+        paths: { "#modes": ["./src/modes.ts"] },
+      },
+      include: ["src"],
+    };
+    const root = plant({
+      "tsconfig.json": `${JSON.stringify({ compilerOptions: { strict: true }, include: ["src"] })}\n`,
+      "packages/api/tsconfig.json": `${JSON.stringify(api)}\n`,
+      "packages/api/src/modes.ts": 'export type Mode = "fast" | "slow";\nexport declare const current: Mode;\n',
+      "packages/api/src/use.ts": 'import { current } from "#modes";\nexport const fast = () => current === "fast";\n',
+      "src/root.ts": 'import { current } from "#modes";\nexport const fast = () => current === "fast";\n',
+    });
+    const found = magicDiagnostics(root, ["src/root.ts", "packages/api/src/use.ts", "packages/api/src/modes.ts"]);
+    expect(found).toEqual({ ok: true, value: [hit("src/root.ts:2:39", STRING, COMPARED("fast"))] });
+  },
+);
+
+it(
+  "finds a copy's comparisons in the package's other files when only the copy's file is checked",
+  { timeout: SLOW },
+  () => {
+    const root = plant({
+      "tsconfig.json": `${JSON.stringify({ compilerOptions: { strict: true }, include: ["src"] })}\n`,
+      "src/modes.ts": 'export const SLOW = "slow";\nexport const PLAIN = 7;\n',
+      "src/use.ts": 'import { SLOW } from "./modes.ts";\nexport const is = (m: string) => m === SLOW;\n',
+      "src/other.ts": "export const other = (m: string) => m.length;\n",
+      "src/other.test.ts": 'import { SLOW } from "./modes.ts";\nexport const t = (m: string) => m === SLOW;\n',
+    });
+    expect(magicDiagnostics(root, ["src/modes.ts"])).toEqual({
+      ok: true,
+      value: [hit("src/modes.ts:1:14", STRING, COPIES("SLOW", "slow"))],
+    });
+    // The copy lands in a file this run does not check, so it is left to the run that checks it.
+    expect(magicDiagnostics(root, ["src/use.ts"])).toEqual({ ok: true, value: [] });
+  },
+);
+
+it("checks ts, tsx, mts and cts sources, never tests, declarations, fixtures, e2e or vendored code", () => {
+  const BODY = "export const f = () => 5000;\n";
+  const skipped = [
+    "src/a.test.ts",
+    "src/a.spec.tsx",
+    "src/a.e2e.ts",
+    "src/a.reject.ts",
+    "types/a.d.ts",
+    "types/b.d.mts",
+    "src/fixtures/a.ts",
+    "e2e/a.ts",
+    "lib/vendor/a.ts",
+    "src/a.js",
+    "README.md",
+  ];
+  const checked = ["src/a.ts", "src/b.tsx", "src/c.mts", "src/d.cts"];
+  const files = Object.fromEntries([...skipped, ...checked].map((rel) => [rel, BODY]));
+  expect(magicOf(files).map((d) => d.file)).toEqual(checked);
+});
+
+it("reports a tsconfig.json typescript cannot read", () => {
+  const root = plant({ "pkg/tsconfig.json": "{", "pkg/a.ts": "export const a = 1;\n" });
+  const found = magicDiagnostics(root, ["pkg/a.ts"]);
+  expect(found.ok ? [] : found.errors).toEqual([expect.stringMatching(/^pkg\/tsconfig\.json: .+/)]);
+});
+
+it("withoutSkipped drops only the hits of the rule a skip names, in the files its globs match", () => {
+  const diagnostics = [
+    hit("src/a.ts:1:1", NUMBER, NAMES_NOTHING("5")),
+    hit("src/a.ts:2:1", STRING, COMPARED("x")),
+    hit("lib/b.ts:1:1", NUMBER, NAMES_NOTHING("5")),
+  ];
+  const skips = [{ files: ["src/*.ts"], rules: ["repo/magic-number"], reason: "tuning lives here" }];
+  expect(withoutSkipped(diagnostics, skips, ["src/a.ts", "lib/b.ts"])).toEqual(diagnostics.slice(1));
+  expect(withoutSkipped(diagnostics, [], ["src/a.ts", "lib/b.ts"])).toEqual(diagnostics);
+});
+
+const SHARDS = "export default { nightly: { shards: 8 } };\n";
+
+it("reports no magic number in the root workerstack.config.ts, which holds values, but does in the same literal elsewhere", () => {
+  const found = magicOf({ "workerstack.config.ts": SHARDS, "src/shards.ts": SHARDS });
+  expect(found).toEqual([hit("src/shards.ts:1:37", NUMBER, NAMES_NOTHING("8"))]);
+});
+
+it("reports a magic number in a workerstack.config.ts below the root", () => {
+  const found = magicOf({ "pkg/workerstack.config.ts": SHARDS });
+  expect(found).toEqual([hit("pkg/workerstack.config.ts:1:37", NUMBER, NAMES_NOTHING("8"))]);
+});

package/cli/check-magic.ts

@@ -0,0 +1,120 @@
+/**
+ * Magic numbers and strings, as lint diagnostics `repo(magic-number)` and `repo(magic-string)` that the baseline
+ * counts beside oxlint's. A script on the TypeScript compiler API, since only the type checker can tell a string
+ * compared to a plain `string` from one compared to a literal union, and no disable comment reaches it. Each file is
+ * checked in one program per nearest `tsconfig.json`, so a package's own paths and options resolve its imports.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { constString } from "./magic/magic-nodes.ts";
+import { magicNumbers } from "./magic/magic-numbers.ts";
+import type { MagicHit } from "./magic/magic-hit.ts";
+import { magicStrings } from "./magic/magic-strings.ts";
+import { CONFIG_FILE, type LintSkip } from "./config.ts";
+import type { Diagnostic, Result } from "./scripts/lint-baseline.ts";
+import { codeOf, skipFiles } from "./scripts/lint-skips.ts";
+import { RUNTIME_CONFIG } from "./tsconfig.constants.ts";
+import { isChecked, ownerOf, posix, setupOf, type Setup } from "./ts-program.ts";
+
+const byKey = (a: string, b: string) => Number(a > b) - Number(a < b);
+
+/** The names of the `const` strings `file` declares, which a comparison in another file could make copies. */
+function copyNames(file: ts.SourceFile): string[] {
+  const names: string[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isVariableDeclaration(node) && constString(node) !== null) names.push(node.name.getText());
+    ts.forEachChild(node, visit);
+  };
+  visit(file);
+  return names;
+}
+
+/** One group's files: its tsconfig dir (null for none), the root and the files to report in, as program paths. */
+type Group = { root: string; dir: string | null; targets: readonly string[] };
+
+/**
+ * The tsconfig's other checked files that mention a `const` string of the targets: a comparison there makes it a
+ * copy, reported in the target. Read as text first, so a run on a few files parses only the files that could.
+ */
+function extrasOf(group: Group, setup: Setup, program: ts.Program): string[] {
+  // The checker binds the files, which sets the parent links a declaration's const flag is read through.
+  program.getTypeChecker();
+  const names = program
+    .getSourceFiles()
+    .filter((file) => group.targets.includes(file.fileName))
+    .flatMap(copyNames);
+  if (names.length === 0) return [];
+  return setup.fileNames.filter((fileName) => {
+    const rel = path.posix.relative(group.root, fileName);
+    if (group.targets.includes(fileName) || !isChecked(rel) || ownerOf(group.root, rel) !== group.dir) return false;
+    const text = fs.readFileSync(fileName, "utf8");
+    return names.some((name) => text.includes(name));
+  });
+}
+
+/** Every hit in one group's targets, from one program over them and the files that may compare to their copies. */
+function groupHits(group: Group): Result<MagicHit[]> {
+  const setup = setupOf(group.root, group.dir, RUNTIME_CONFIG);
+  if (!setup.ok) return setup;
+  const { options } = setup.value;
+  const first = ts.createProgram({ rootNames: group.targets, options });
+  const extras = extrasOf(group, setup.value, first);
+  const roots = [...group.targets, ...extras];
+  const program = extras.length === 0 ? first : ts.createProgram({ rootNames: roots, options, oldProgram: first });
+  const owns = (fileName: string) => isChecked(path.posix.relative(group.root, fileName));
+  const context = { checker: program.getTypeChecker(), owns };
+  // The root config file holds values by definition, as a constants file does.
+  const rootConfig = path.posix.join(group.root, CONFIG_FILE);
+  const walked = program.getSourceFiles().filter((file) => roots.includes(file.fileName));
+  const hits = walked.flatMap((file) => {
+    const numbers =
+      group.targets.includes(file.fileName) && file.fileName !== rootConfig ? magicNumbers(file, context.checker) : [];
+    return [...numbers, ...magicStrings(file, context)];
+  });
+  return { ok: true, value: hits.filter((hit) => group.targets.includes(hit.fileName)) };
+}
+
+/** The hits as diagnostics, each once, in file then position order. */
+function diagnosticsOf(root: string, hits: readonly MagicHit[]): Diagnostic[] {
+  const unique = new Map(hits.map((hit) => [`${hit.fileName}:${hit.at}:${hit.rule}`, hit]));
+  const sorted = [...unique.values()].sort((a, b) => byKey(a.fileName, b.fileName) || a.at - b.at);
+  return sorted.map((hit) => {
+    const file = path.posix.relative(root, hit.fileName);
+    const rule = codeOf(hit.rule);
+    return { file, rule, line: `${file}:${hit.line}:${hit.column}: error ${rule}: ${hit.message}` };
+  });
+}
+
+/**
+ * The magic hits in the checked files among `files` (root-relative POSIX paths), in oxlint's line form, sorted by file
+ * and position; or why a tsconfig.json could not be read.
+ */
+export function magicDiagnostics(root: string, files: readonly string[]): Result<Diagnostic[]> {
+  const real = posix(fs.realpathSync(root));
+  const groups = new Map<string | null, string[]>();
+  for (const rel of files.filter(isChecked)) {
+    const dir = ownerOf(real, rel);
+    groups.set(dir, [...(groups.get(dir) ?? []), path.posix.join(real, rel)]);
+  }
+  const hits: MagicHit[] = [];
+  for (const [dir, targets] of groups) {
+    const found = groupHits({ root: real, dir, targets });
+    if (!found.ok) return found;
+    hits.push(...found.value);
+  }
+  return { ok: true, value: diagnosticsOf(real, hits) };
+}
+
+/** `diagnostics` without those of a rule a skip turns off in a file of `files` its globs match. */
+export function withoutSkipped(
+  diagnostics: readonly Diagnostic[],
+  skips: readonly LintSkip[],
+  files: readonly string[],
+): Diagnostic[] {
+  const off = skips.flatMap((skip) => {
+    const matched = skipFiles(skip.files, files);
+    return skip.rules.flatMap((rule) => matched.map((file) => `${file} ${codeOf(rule)}`));
+  });
+  return diagnostics.filter((d) => !off.includes(`${d.file} ${d.rule}`));
+}

package/cli/check-manifests.constants.ts

@@ -0,0 +1,4 @@
+/** A quoted span in a script; a separator inside one is an argument, not the end of a call. */
+export const QUOTED_SPAN: RegExp = /'[^']*'|"[^"]*"/g;
+/** The separators that end one tool call and start the next in a script. */
+export const CALL_SEPARATOR: RegExp = /&&|;/;

package/cli/check-manifests.test.ts

@@ -0,0 +1,210 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { checkManifests } from "./check-manifests.ts";
+import { readWorkspace } from "./sync/workspace.ts";
+
+const temps: string[] = [];
+afterEach(() => {
+  for (const dir of temps.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+const PIN = `bun@${Bun.version}`;
+
+/** Writes each manifest into a temp repo, reads it as `repo check` does and returns the problem lines. */
+function problems(files: Record<string, object>): string[] {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "workerstack-manifests-"));
+  temps.push(root);
+  for (const [rel, content] of Object.entries(files)) {
+    const file = path.join(root, rel);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(content));
+  }
+  const result = readWorkspace(root);
+  if (!result.ok) throw new Error(result.errors.join("\n"));
+  return checkManifests(result.workspace);
+}
+
+describe("checkManifests", () => {
+  it("passes a private single-package root with sideEffects false and a pinned bun", () => {
+    expect(
+      problems({ "package.json": { name: "a", private: true, sideEffects: false, packageManager: "bun@1.4.4" } }),
+    ).toEqual([]);
+  });
+
+  it("passes a published single-package root with a version", () => {
+    expect(
+      problems({
+        "package.json": { name: "a", version: "1.0.0", private: false, sideEffects: false, packageManager: PIN },
+      }),
+    ).toEqual([]);
+  });
+
+  it("accepts a prerelease pin", () => {
+    expect(
+      problems({ "package.json": { private: true, sideEffects: false, packageManager: "bun@1.5.0-canary.3" } }),
+    ).toEqual([]);
+  });
+});
+
+describe("checkManifests missing fields", () => {
+  it("reports a missing private", () => {
+    expect(problems({ "package.json": { sideEffects: false, packageManager: PIN } })).toEqual([
+      'package.json: "private" is missing; set true, or false to publish it',
+    ]);
+  });
+
+  it("reports a missing sideEffects", () => {
+    const files = {
+      "package.json": { private: true, workspaces: ["packages/*"], packageManager: PIN },
+      "packages/web/package.json": { name: "web", private: true },
+    };
+    expect(problems(files)).toEqual(['packages/web/package.json: "sideEffects" is missing; set it to false']);
+  });
+
+  it.each([
+    [["*.css"], '["*.css"]'],
+    [true, "true"],
+    ["false", '"false"'],
+  ])("reports sideEffects %j and names the CSS fix", (value, shown) => {
+    const files = {
+      "package.json": { private: true, workspaces: ["packages/*"], packageManager: PIN },
+      "packages/ui/package.json": { private: true, sideEffects: value },
+    };
+    expect(problems(files)).toEqual([
+      `packages/ui/package.json: "sideEffects" is ${shown}; set it to false and import CSS from an app entry`,
+    ]);
+  });
+});
+
+describe("checkManifests versions and packageManager", () => {
+  it("reports a version on a private package", () => {
+    const files = {
+      "package.json": { private: true, workspaces: ["packages/*"], packageManager: PIN },
+      "packages/api/package.json": { private: true, version: "1.0.0", sideEffects: false },
+    };
+    expect(problems(files)).toEqual(['packages/api/package.json: private packages have no "version"; delete it']);
+  });
+
+  it("allows a version on a package that is not private", () => {
+    const files = {
+      "package.json": { private: true, workspaces: ["packages/*"], packageManager: PIN },
+      "packages/api/package.json": { private: false, version: "1.0.0", sideEffects: false },
+    };
+    expect(problems(files)).toEqual([]);
+  });
+
+  it("reports a version on a private root", () => {
+    expect(
+      problems({ "package.json": { private: true, version: "0.0.0", sideEffects: false, packageManager: PIN } }),
+    ).toEqual(['package.json: private packages have no "version"; delete it']);
+  });
+});
+
+describe("checkManifests packageManager", () => {
+  it("reports a missing packageManager with the running bun version", () => {
+    expect(problems({ "package.json": { private: true, sideEffects: false } })).toEqual([
+      `package.json: "packageManager" is missing; set it to "${PIN}"`,
+    ]);
+  });
+
+  it.each([["bun@^1.4"], ["bun@1.4"], ["bun@latest"], ["pnpm@9.0.0"], ["bun@1.4.4+sha"]])(
+    "reports packageManager %s as not an exact bun pin",
+    (value) => {
+      expect(problems({ "package.json": { private: true, sideEffects: false, packageManager: value } })).toEqual([
+        `package.json: "packageManager" is "${value}"; pin an exact version like "${PIN}"`,
+      ]);
+    },
+  );
+
+  it("reports a packageManager that is not a string", () => {
+    expect(problems({ "package.json": { private: true, sideEffects: false, packageManager: 4 } })).toEqual([
+      `package.json: "packageManager" is 4; pin an exact version like "${PIN}"`,
+    ]);
+  });
+});
+
+describe("checkManifests roots and packages", () => {
+  it("holds a monorepo root to private, version and packageManager but not sideEffects", () => {
+    expect(problems({ "package.json": { workspaces: ["packages/*"], version: "1.0.0", private: true } })).toEqual([
+      'package.json: private packages have no "version"; delete it',
+      `package.json: "packageManager" is missing; set it to "${PIN}"`,
+    ]);
+  });
+});
+
+describe("checkManifests workspaces", () => {
+  it("passes a two-package workspace", () => {
+    const files = {
+      "package.json": { private: true, workspaces: { packages: ["packages/*"] }, packageManager: "bun@1.4.4" },
+      "packages/api/package.json": { private: true, sideEffects: false },
+      "packages/web/package.json": { private: true, sideEffects: false },
+    };
+    expect(problems(files)).toEqual([]);
+  });
+
+  it("lists the root first, then each package by directory", () => {
+    const files = {
+      "package.json": { workspaces: ["packages/*"] },
+      "packages/web/package.json": {},
+      "packages/api/package.json": {},
+    };
+    expect(problems(files)).toEqual([
+      'package.json: "private" is missing; set true, or false to publish it',
+      `package.json: "packageManager" is missing; set it to "${PIN}"`,
+      'packages/api/package.json: "private" is missing; set true, or false to publish it',
+      'packages/api/package.json: "sideEffects" is missing; set it to false',
+      'packages/web/package.json: "private" is missing; set true, or false to publish it',
+      'packages/web/package.json: "sideEffects" is missing; set it to false',
+    ]);
+  });
+
+  it("leaves a root without package.json alone", () => {
+    expect(problems({})).toEqual([]);
+  });
+});
+
+describe("checkManifests chained root scripts", () => {
+  const root = { private: true, sideEffects: false, packageManager: "bun@1.4.4" };
+  const chain = (name: string, n: number) =>
+    `package.json: "${name}" chains ${n} tool calls with "&&" or ";"; make it one call, such as "repo ci"`;
+  const withScripts = (scripts: Record<string, string>) => problems({ "package.json": { ...root, scripts } });
+
+  it("names a script chained with &&", () => {
+    expect(withScripts({ test: "a && b" })).toEqual([chain("test", 2)]);
+  });
+
+  it("names a script chained with ;", () => {
+    expect(withScripts({ test: "a; b" })).toEqual([chain("test", 2)]);
+  });
+
+  it("counts three calls", () => {
+    expect(withScripts({ ci: "a && b ; c" })).toEqual([chain("ci", 3)]);
+  });
+
+  it("does not split inside quotes", () => {
+    expect(withScripts({ a: 'echo "a && b"', b: "echo 'a; b'", c: 'echo "it\'s && x" && y' })).toEqual([chain("c", 2)]);
+  });
+
+  it("leaves || and | alone, and ignores empty segments", () => {
+    expect(withScripts({ a: "a || b", b: "a | b", c: "a &&", d: "; a ;", e: "a" })).toEqual([]);
+  });
+});
+
+describe("checkManifests script shapes", () => {
+  const root = { private: true, sideEffects: false, packageManager: "bun@1.4.4" };
+
+  it("skips scripts that are not strings", () => {
+    expect(problems({ "package.json": { ...root, scripts: { a: 1 } } })).toEqual([]);
+    expect(problems({ "package.json": { ...root, scripts: "a && b" } })).toEqual([]);
+  });
+
+  it("judges only the root's scripts", () => {
+    const files = {
+      "package.json": { private: true, workspaces: ["packages/*"], packageManager: "bun@1.4.4" },
+      "packages/a/package.json": { private: true, sideEffects: false, scripts: { test: "a && b" } },
+    };
+    expect(problems(files)).toEqual([]);
+  });
+});