code-foundry 0.25.0 → 0.27.0

package/.github/workflows/test.yml

@@ -61,15 +61,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile unit >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile unit >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -87,7 +87,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh unit
+        run: node .code-foundry/src/runtime.mjs ci unit
       - name: Upload coverage
         if: >-
           always() &&
@@ -122,15 +122,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile integration >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -148,7 +148,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh integration
+        run: node .code-foundry/src/runtime.mjs ci integration
 
   e2e:
     name: E2E
@@ -167,15 +167,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile e2e >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile e2e >> "$GITHUB_OUTPUT"
       - name: Cache browser binaries
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
         uses: ./.github/actions/cache
@@ -205,7 +205,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh e2e
+        run: node .code-foundry/src/runtime.mjs ci e2e
 
   smoke:
     name: Smoke
@@ -224,15 +224,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile smoke >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile smoke >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -250,4 +250,4 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh smoke
+        run: node .code-foundry/src/runtime.mjs ci smoke

package/.github/workflows/test_self-ci.yml

@@ -16,7 +16,7 @@ jobs:
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-latest
       unit-runner: ubuntu-slim
     secrets: inherit

package/AGENTS.md

@@ -7,7 +7,8 @@ They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.
 ## Mission
 
 - Keep formatting, linting, type checking, builds, tests, and coverage reproducible locally and in CI.
-- Prefer the versions pinned in `.mise.toml`.
+- Prefer the repository's configured toolchain; `toolchain: auto` uses native
+  tools unless an existing `.mise.toml` is present.
 - Do not commit secrets, generated credentials, local environment files, or machine-specific paths.
 - Add tests for behavior changes and keep coverage thresholds explicit in the project configuration.
 - Make the smallest complete, well-tested change that solves the requested problem without disturbing unrelated work.
@@ -72,7 +73,9 @@ For normal feature work, branch from `staging` and target pull requests at `stag
 
 ## Toolchain and dependencies
 
-- Use the versions pinned in `.mise.toml`; run `mise install` when needed.
+- Follow `toolchain: auto` in `.github/code-foundry.yml`; use native tools by
+  default and reuse mise only when the repository already has `.mise.toml`.
+- If `toolchain: mise` is selected, run `mise install` before validation.
 - Use the package manager indicated by the existing lockfile:
   - `bun.lock` or `bun.lockb` → Bun
   - `pnpm-lock.yaml` → pnpm
@@ -88,14 +91,14 @@ For normal feature work, branch from `staging` and target pull requests at `stag
 Use the shared scripts when present. They detect supported tools and skip inapplicable checks:
 
 ```sh
-bash .github/scripts/ci.sh format
-bash .github/scripts/ci.sh lint
-bash .github/scripts/ci.sh type_check
-bash .github/scripts/ci.sh build
-bash .github/scripts/ci.sh unit
-bash .github/scripts/ci.sh integration
-bash .github/scripts/ci.sh e2e
-bash .github/scripts/ci.sh smoke
+node src/runtime.mjs ci format
+node src/runtime.mjs ci lint
+node src/runtime.mjs ci type_check
+node src/runtime.mjs ci build
+node src/runtime.mjs ci unit
+node src/runtime.mjs ci integration
+node src/runtime.mjs ci e2e
+node src/runtime.mjs ci smoke
 Security and dependency audits run through the GitHub Security workflow.
 ```
 

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.27.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.26.0...v0.27.0) (2026-07-28)
+
+
+### Features
+
+* add typed javascript cli checks ([2d9464b](https://github.com/0xPlayerOne/code-foundry/commit/2d9464bcbef8aa51607cdf52a6a60e3fc1bdb054))
+* make mise an optional toolchain ([e62f023](https://github.com/0xPlayerOne/code-foundry/commit/e62f0238f4ddc2d1b0f89e0f2b23bca3679b934e))
+* make paid github security checks opt-in ([bbfe899](https://github.com/0xPlayerOne/code-foundry/commit/bbfe8993d88a8415129ce29bfa5d2181807232ba))
+* skip irrelevant language configuration ([39a0003](https://github.com/0xPlayerOne/code-foundry/commit/39a00037ba92152926e7a89759f3255d86a4f26e))
+* standardize optional github security policies ([2cf6bc3](https://github.com/0xPlayerOne/code-foundry/commit/2cf6bc3af161ed8757a03447aab16f3e7ea310d7))
+
+
+### Bug Fixes
+
+* include runtime libraries in every workflow job ([ce94cd9](https://github.com/0xPlayerOne/code-foundry/commit/ce94cd96a32eff54048712e1bf4b2d34a868ba2e))
+* include runtime libraries in workflow checkout ([4b2c252](https://github.com/0xPlayerOne/code-foundry/commit/4b2c2527c37c82b498c2b3457df5dd52ef7c694f))
+* migrate stale managed docs during sync ([380bab1](https://github.com/0xPlayerOne/code-foundry/commit/380bab1334c9125f97bf333cc29c796e1a16d57d))
+* preserve authored notice files ([342e666](https://github.com/0xPlayerOne/code-foundry/commit/342e666f4e218e094180f10ecdc5a24b85a27b28))
+* preserve repository notice attribution ([7d43911](https://github.com/0xPlayerOne/code-foundry/commit/7d439117ec89882d8d06895528d94ed717ade471))
+* use pinned bun lockfile format ([0f75faf](https://github.com/0xPlayerOne/code-foundry/commit/0f75faf2c7614cc7055cbb4f26a01b3cf1639f85))
+
+## [0.26.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.25.0...v0.26.0) (2026-07-28)
+
+
+### Features
+
+* default new repositories to gplv3 ([e200135](https://github.com/0xPlayerOne/code-foundry/commit/e200135939779693eb73a64aaf3587eccdc36ffc))
+
 ## [0.25.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.24.1...v0.25.0) (2026-07-28)
 
 

package/README.md

@@ -19,7 +19,7 @@ npx code-foundry init
 ```
 
 Initialization is repository-aware. It detects supported languages, package
-manager, profile, release strategy, and required mise tools, then writes the
+manager, profile, release strategy, and toolchain preference, then writes the
 resolved choices to `.github/code-foundry.yml`.
 
 ```bash
@@ -39,7 +39,7 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
   and Release.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and
   linting.
-- `.mise.toml`, optional `mise.lock`, repository profile configuration, and
+- An optional `.mise.toml`/`mise.lock`, repository profile configuration, and
   standard GitHub forms and policy files.
 - AGENTS instructions, CODEOWNERS, license/notice files, and reusable release
   configuration.
@@ -56,10 +56,13 @@ The generated configuration is the one place to control the baseline. See
 guide and [Initialization and synchronization](docs/INITIALIZATION.md) for
 the two-command workflow.
 
-New repositories default to AGPL-3.0-or-later. Synchronization preserves an
-existing license unless a replacement is explicitly selected. Authored
+New repositories default to GPL-3.0-or-later. Existing projects preserve an
+authored license unless a replacement is explicitly selected. Our maintained
+repositories explicitly select AGPL-3.0-or-later. Authored
 documentation, application files, custom workflows, and existing `.mise.toml`
-files are preserved by default.
+files are preserved by default. `toolchain: auto` uses an existing mise setup
+when present and otherwise uses native language tooling; choose `native` or
+`mise` explicitly when a repository needs a fixed policy.
 
 ## Workflow model
 
@@ -75,13 +78,21 @@ test runner. Rust uses `rustfmt`, Clippy with warnings as errors, and native
 Cargo tests. Python uses Ruff, uv/pip-compatible setup, and native Python
 tests. Solidity projects retain their native toolchain and test runner.
 
-CodeQL remains separate from CI and Security. Dependency Review is isolated in
-Security and is skipped where GitHub does not support it, while JavaScript,
-Python, and Rust audits remain available without GitHub Advanced Security.
+CodeQL remains separate from CI and Security. With the default `codeql: auto`
+and `dependency_review: auto` policies, public repositories use the free GitHub
+security checks while private repositories skip them unless explicitly opted
+in and supported by GitHub Advanced Security. JavaScript, Python, and Rust
+audits remain available without Advanced Security. Code Foundry does not enable
+GitHub Code Quality or other paid GitHub features.
 
 See [Workflow and CI conventions](docs/WORKFLOWS.md) for triggers, required
 checks, runners, coverage, caching, and custom workflow extensions.
 
+The default contribution policy uses the `staging-release` workflow with
+rebase merges. Repositories can set `merge_strategy: squash` or
+`merge_strategy: merge` in `.github/code-foundry.yml` when their governance
+requires another merge convention.
+
 ## Releases and publishing
 
 The standard flow promotes `staging` into `main`, lets Release Please open a

package/docs/CONFIGURATION.md

@@ -9,6 +9,10 @@ npx code-foundry init
 Initialization detects the repository and writes a fully resolved configuration.
 Edit that file directly, then run `npx code-foundry sync`.
 
+The default `toolchain: auto` reuses an existing `.mise.toml`; otherwise it
+selects native setup for the detected languages. Use `toolchain: native` to
+prohibit mise or `toolchain: mise` to require it.
+
 ## Configuration flow
 
 ```text
@@ -17,7 +21,7 @@ repository manifests and source
             v
   .github/code-foundry.yml
             |
-            +--> mise and environment setup
+            +--> native or mise toolchain setup
             +--> standard workflow callers
             +--> runtime repository and version
             +--> release, license, cache, and coverage policy
@@ -30,13 +34,18 @@ repository manifests and source
 | `profile` | `auto`, `application`, `monorepo`, `minimal` | Repository shape |
 | `languages` | detected list | TypeScript, Rust, Python, Solidity |
 | `package_manager` | `bun`, `pnpm`, `yarn`, `npm`, `none` | JavaScript setup |
+| `toolchain` | `auto`, `native`, `mise` | Environment setup policy; defaults to `auto` |
 | `features` | `all` or a list | Standard workflow callers |
+| `codeql` | `auto`, `true`, `false` | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled |
+| `dependency_review` | `auto`, `true`, `false` | Dependency Review policy; public repositories default to enabled, non-public repositories default to disabled |
 | `prune_standard` | `true` or `false` | Remove disabled standard callers |
 | `runtime_repository` | `OWNER/REPO` | Reusable workflow source |
 | `runtime_ref` | tag or branch | Reusable workflow version |
 | `release_type` | `node`, `python`, `rust`, `simple`, `none` | Release strategy |
 | `npm_publish` | `true` or `false` | Opt into npm publication |
-| `license` | license name, `preserve`, `none` | License policy |
+| `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
+| `git_workflow` | `staging-release` | Branch/release model; the standard model promotes `staging` into `main` |
+| `merge_strategy` | `rebase`, `squash`, `merge` | Preferred merge method for contribution and release PRs; defaults to `rebase` |
 | `runner` fields | GitHub runner names | Per-workflow runner policy |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,

package/docs/INITIALIZATION.md

@@ -11,7 +11,7 @@ npx code-foundry doctor
 ```
 
 `init` detects supported languages, package manager, repository profile,
-release strategy, mise tools, and standard features. It writes the resolved
+release strategy, toolchain preference, and standard features. It writes the resolved
 choices to `.github/code-foundry.yml`, initializes the local environment, and
 renders the standard baseline.
 
@@ -25,6 +25,9 @@ manifests, lockfiles, source extensions, workspace metadata, and existing
 project scripts. The generated values are explicit, so later syncs are stable
 until a maintainer changes the file.
 
+New repositories receive the GNU GPLv3. Existing repositories with an authored
+`LICENSE` keep that license unless the generated configuration is changed.
+
 ## Runtime selection
 
 Workflow callers use `runtime_repository` and `runtime_ref` from
@@ -37,7 +40,8 @@ Sync updates standard Code Foundry files only. It preserves application code,
 authored documentation, existing `.mise.toml` selections, and custom workflows
 such as deployment, search, Slither, or monitoring workflows.
 
-The environment bootstrap installs or reuses mise-managed tools and enables
-the repository hooks. Use `npx code-foundry doctor` when local setup needs to
-be checked; the CLI supplies the implementation without adding maintenance
-scripts to the consumer repository.
+The environment bootstrap enables repository hooks and uses mise only when an
+existing `.mise.toml` is present or `toolchain: mise` is selected. Otherwise it
+uses the repository's native tools. Use `npx code-foundry doctor` when local
+setup needs to be checked; the CLI supplies the implementation without adding
+maintenance scripts to the consumer repository.

package/docs/RELEASES.md

@@ -12,6 +12,11 @@ Keep commits Conventional Commit-shaped (`feat:`, `fix:`, `docs:`, `ci:`,
 `chore:`, and so on). Release Please uses them to select patch/minor/major
 versions and generate grouped changelog notes.
 
+The default `merge_strategy` is `rebase`, matching the repository's linear
+history policy. Set it to `squash` or `merge` in `.github/code-foundry.yml` when
+that repository intentionally uses a different merge convention. The current
+supported `git_workflow` is `staging-release`.
+
 The release workflow opens or updates a versioned PR after changes reach
 `main`. Merging that PR updates the changelog, creates the Git tag and GitHub
 Release, and triggers any configured package publication.

package/docs/WORKFLOWS.md

@@ -46,11 +46,18 @@ ambiguous for mixed-language repositories.
 
 ## Security behavior
 
-CodeQL is a separate workflow using GitHub's official actions. Dependency
-Review is skipped where GitHub does not support it, while JavaScript, Python,
-and Rust audits remain available without Advanced Security. If GitHub default
-setup is enabled, disable its generated CodeQL workflow to avoid duplicate
-analysis.
+CodeQL is a separate workflow using GitHub's official actions. The default
+`codeql: auto` policy enables it for public repositories and skips it for
+private repositories unless explicitly enabled and Advanced Security is
+available. Dependency Review follows the same policy through
+`dependency_review: auto`; JavaScript, Python, and Rust audits remain
+available without Advanced Security. If GitHub default setup is enabled,
+disable its generated CodeQL workflow to avoid duplicate analysis.
+
+Code Foundry does not enable GitHub Code Quality or any paid GitHub feature.
+The repository's format and lint jobs are ordinary CI checks. Set `codeql:
+false` or `dependency_review: false` when a public repository also needs those
+checks disabled.
 
 ## Branch protection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",
@@ -42,12 +42,16 @@
     "build": "node --check src/cli.mjs",
     "format:check": "node --check src/cli.mjs",
     "lint": "node --check src/cli.mjs",
-    "test": "node --check src/cli.mjs",
-    "type-check": "node --check src/cli.mjs",
+    "test": "node --test",
+    "type-check": "tsc --project jsconfig.json",
     "pack:check": "npm pack --dry-run",
     "prepublishOnly": "npm test && npm run pack:check"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.8.3"
   }
 }

package/src/cli.mjs

@@ -1,12 +1,16 @@
 #!/usr/bin/env node
+// @ts-check
 
-import { existsSync } from 'node:fs'
 import { resolve } from 'node:path'
-import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
+import { doctor } from './commands/doctor.mjs'
+import { syncRepository } from './commands/sync.mjs'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
+/** @typedef {{ target: string, dryRun: boolean, force: boolean }} Options */
+/** @typedef {{ command: string, options: Options }} ParsedArgs */
+
 const usage = `code-foundry — initialize and maintain agent-ready repositories
 
 Usage:
@@ -25,13 +29,17 @@ Options:
   -h, --help      Show this help
 `
 
+/** @param {string} message @returns {never} */
 function fail(message) {
   console.error(`code-foundry: ${message}`)
   process.exit(2)
 }
 
+/** @param {string[]} argv @returns {ParsedArgs} */
 function parseArgs(argv) {
-  const command = argv[0] && !argv[0].startsWith('-') ? argv.shift() : 'init'
+  const first = argv[0]
+  const hasCommand = Boolean(first && !first.startsWith('-'))
+  const command = hasCommand ? /** @type {string} */ (argv.shift()) : 'init'
   const options = { target: process.cwd(), dryRun: false, force: false }
 
   while (argv.length) {
@@ -52,34 +60,30 @@ function parseArgs(argv) {
   return { command, options }
 }
 
-function run(script, args, target) {
-  const scriptPath = resolve(packageRoot, '.github/scripts', script)
-  if (!existsSync(scriptPath)) fail(`package is missing ${script}`)
-  const result = spawnSync('bash', [scriptPath, ...args], {
-    cwd: target,
-    stdio: 'inherit',
-    env: process.env,
-  })
-  if (result.error) fail(result.error.message)
-  if (result.status !== 0) process.exit(result.status ?? 1)
-}
-
 function main() {
   const { command, options } = parseArgs(process.argv.slice(2))
   const target = resolve(options.target)
-  const common = ['--source', packageRoot, '--ref', 'main']
-  if (options.dryRun) common.push('--check')
-  else common.push('--apply')
-  if (options.force) common.push('--force')
 
   if (command === 'init') {
-    const initArgs = ['--source', packageRoot, '--ref', 'main']
-    if (options.dryRun) initArgs.push('--dry-run')
-    if (options.force) initArgs.push('--force')
-    run('init-repo.sh', initArgs, target)
+    try {
+      syncRepository({ target, source: packageRoot, dryRun: options.dryRun, force: options.force, init: true })
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
+  } else if (command === 'sync') {
+    try {
+      syncRepository({ target, source: packageRoot, dryRun: options.dryRun, force: options.force })
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
+  } else if (command === 'doctor') {
+    try {
+      doctor(target)
+    } catch (error) {
+      console.error(`code-foundry: ${error instanceof Error ? error.message : String(error)}`)
+      process.exitCode = 1
+    }
   }
-  else if (command === 'sync') run('sync-template.sh', common, target)
-  else if (command === 'doctor') run('doctor.sh', [], target)
   else fail(`unknown command: ${command}`)
 }
 

package/src/commands/doctor.mjs

@@ -0,0 +1,70 @@
+// @ts-check
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { includesValue, readConfig } from '../lib/config.mjs'
+import { resolveProfile } from '../lib/profile.mjs'
+
+/** @param {string} root */
+export function doctor(root) {
+  const target = resolve(root)
+  const config = readConfig(join(target, '.github/code-foundry.yml'))
+  const profile = resolveProfile(target)
+  let errors = 0
+  /** @param {string} message */
+  const error = (message) => { console.error(`ERROR: ${message}`); errors += 1 }
+  /** @param {string} message */
+  const warn = (message) => console.warn(`WARN: ${message}`)
+
+  const toolchain = config.toolchain ?? 'auto'
+  if (!['auto', 'native', 'mise'].includes(toolchain)) error(`unsupported toolchain: ${toolchain}`)
+  if (toolchain === 'mise' && !existsSync(join(target, '.mise.toml'))) error('.mise.toml is required when toolchain: mise')
+  if (toolchain === 'auto') {
+    console.log(existsSync(join(target, '.mise.toml'))
+      ? 'Toolchain: mise (detected from existing .mise.toml).'
+      : 'Toolchain: native (mise not configured).')
+  }
+  const hooks = git(target, ['config', '--get', 'core.hooksPath'])
+  if (hooks !== '.githooks') warn('Git hooks are not enabled; run `npx code-foundry init`')
+
+  const packageFile = join(target, 'package.json')
+  if (existsSync(packageFile)) {
+    let packageJson
+    try { packageJson = JSON.parse(readFileSync(packageFile, 'utf8')) }
+    catch { error('package.json is not valid JSON'); packageJson = {} }
+    const lockfiles = ['bun.lock', 'bun.lockb', 'pnpm-lock.yaml', 'yarn.lock', 'package-lock.json'].filter((file) => existsSync(join(target, file)))
+    const groups = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+    if (!lockfiles.length && groups.some((key) => Object.keys(packageJson[key] ?? {}).length)) error('package.json exists but no supported lockfile was found')
+    if (lockfiles.length > 1) error('multiple JavaScript lockfiles found; keep one package manager')
+    if (packageJson.packageManager && lockfiles.length) {
+      const declared = String(packageJson.packageManager).split('@')[0]
+      const actual = lockfiles[0]?.startsWith('bun') ? 'bun' : lockfiles[0]?.split('-')[0].replace('.yaml', '')
+      if (actual && declared !== actual) error(`packageManager (${declared}) does not match ${actual} lockfile`)
+    }
+  }
+
+  if (profile.languages.split(',').includes('rust') && !commandExists('cargo')) error('Cargo is required for this repository')
+  if (profile.languages.split(',').includes('rust')) {
+    const metadata = spawnSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], { cwd: target, stdio: 'ignore' })
+    if (metadata.status !== 0) error('cargo metadata failed')
+  }
+  if (profile.languages.split(',').includes('python') && !commandExists('python') && !existsSync(join(target, '.venv/bin/python'))) error('Python is required for this repository')
+
+  for (const workflow of ['ci', 'codeql', 'security', 'test', 'draft-pr', 'release-pr', 'release']) {
+    if (includesValue(config.features ?? 'all', workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)
+  }
+  console.log('Remote CI, Test, Security, CodeQL, and release runtimes are loaded by reusable workflow wrappers.')
+  if (errors) throw new Error(`Repository doctor found ${errors} error(s).`)
+  console.log('Repository doctor passed.')
+}
+
+/** @param {string} root @param {string[]} args */
+function git(root, args) {
+  return spawnSync('git', args, { cwd: root, encoding: 'utf8' }).stdout?.trim() ?? ''
+}
+
+/** @param {string} command */
+function commandExists(command) {
+  return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
+}