code-foundry 0.26.0 → 0.27.1

package/.github/workflows/security.yml

@@ -44,6 +44,7 @@ jobs:
       rust: ${{ steps.profile.outputs.rust }}
       python: ${{ steps.profile.outputs.python }}
       python_requirements: ${{ steps.profile.outputs.python_requirements }}
+      dependency_review: ${{ steps.profile.outputs.dependency_review }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -83,15 +84,18 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: profile
-        run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
+        env:
+          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
+          REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
+        run: node .code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
 
   dependency-audit-javascript:
     name: Dependency Audit (JavaScript)
@@ -124,15 +128,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -141,7 +145,7 @@ jobs:
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/security.sh audit javascript
+        run: node .code-foundry/src/runtime.mjs security audit javascript
 
   dependency-audit-rust:
     name: Dependency Audit (Rust)
@@ -168,15 +172,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
       - name: Check Rust
         id: system-rust
         if: steps.applicability.outputs.applicable == 'true'
@@ -204,7 +208,7 @@ jobs:
           tool: cargo-audit
       - name: Audit dependencies
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/security.sh audit rust
+        run: node .code-foundry/src/runtime.mjs security audit rust
 
   dependency-audit-python:
     name: Dependency Audit (Python) / ${{ matrix.requirement }}
@@ -248,19 +252,19 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Setup
         uses: ./.github/actions/setup
         with:
           mise-scope: python
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
-        run: bash .github/scripts/security.sh audit python
+        run: node .code-foundry/src/runtime.mjs security audit python
 
   dependency-audit-python-gate:
     name: Dependency Audit (Python)
@@ -285,7 +289,8 @@ jobs:
 
   dependency-review:
     name: Dependency Review
-    if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
+    needs: profile
+    if: ${{ github.event_name == 'pull_request' && needs.profile.outputs.dependency_review == 'true' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     steps:

package/.github/workflows/security_self-ci.yml

@@ -16,6 +16,6 @@ jobs:
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-slim
     secrets: inherit

package/.github/workflows/test.yml

@@ -61,15 +61,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile unit >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile unit >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -87,7 +87,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh unit
+        run: node .code-foundry/src/runtime.mjs ci unit
       - name: Upload coverage
         if: >-
           always() &&
@@ -122,15 +122,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile integration >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -148,7 +148,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh integration
+        run: node .code-foundry/src/runtime.mjs ci integration
 
   e2e:
     name: E2E
@@ -167,15 +167,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile e2e >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile e2e >> "$GITHUB_OUTPUT"
       - name: Cache browser binaries
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
         uses: ./.github/actions/cache
@@ -205,7 +205,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh e2e
+        run: node .code-foundry/src/runtime.mjs ci e2e
 
   smoke:
     name: Smoke
@@ -224,15 +224,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh task_profile smoke >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci task_profile smoke >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -250,4 +250,4 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh smoke
+        run: node .code-foundry/src/runtime.mjs ci smoke

package/.github/workflows/test_self-ci.yml

@@ -16,7 +16,7 @@ jobs:
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-latest
       unit-runner: ubuntu-slim
     secrets: inherit

package/AGENTS.md

@@ -7,7 +7,8 @@ They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.
 ## Mission
 
 - Keep formatting, linting, type checking, builds, tests, and coverage reproducible locally and in CI.
-- Prefer the versions pinned in `.mise.toml`.
+- Prefer the repository's configured toolchain; `toolchain: auto` uses native
+  tools unless an existing `.mise.toml` is present.
 - Do not commit secrets, generated credentials, local environment files, or machine-specific paths.
 - Add tests for behavior changes and keep coverage thresholds explicit in the project configuration.
 - Make the smallest complete, well-tested change that solves the requested problem without disturbing unrelated work.
@@ -72,7 +73,9 @@ For normal feature work, branch from `staging` and target pull requests at `stag
 
 ## Toolchain and dependencies
 
-- Use the versions pinned in `.mise.toml`; run `mise install` when needed.
+- Follow `toolchain: auto` in `.github/code-foundry.yml`; use native tools by
+  default and reuse mise only when the repository already has `.mise.toml`.
+- If `toolchain: mise` is selected, run `mise install` before validation.
 - Use the package manager indicated by the existing lockfile:
   - `bun.lock` or `bun.lockb` → Bun
   - `pnpm-lock.yaml` → pnpm
@@ -88,14 +91,14 @@ For normal feature work, branch from `staging` and target pull requests at `stag
 Use the shared scripts when present. They detect supported tools and skip inapplicable checks:
 
 ```sh
-bash .github/scripts/ci.sh format
-bash .github/scripts/ci.sh lint
-bash .github/scripts/ci.sh type_check
-bash .github/scripts/ci.sh build
-bash .github/scripts/ci.sh unit
-bash .github/scripts/ci.sh integration
-bash .github/scripts/ci.sh e2e
-bash .github/scripts/ci.sh smoke
+node src/runtime.mjs ci format
+node src/runtime.mjs ci lint
+node src/runtime.mjs ci type_check
+node src/runtime.mjs ci build
+node src/runtime.mjs ci unit
+node src/runtime.mjs ci integration
+node src/runtime.mjs ci e2e
+node src/runtime.mjs ci smoke
 Security and dependency audits run through the GitHub Security workflow.
 ```
 

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [0.27.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.0...v0.27.1) (2026-07-28)
+
+
+### Bug Fixes
+
+* **ci:** cover framework and native test prerequisites ([53b8209](https://github.com/0xPlayerOne/code-foundry/commit/53b8209104cf52972e867eba65fed46d0b8f57bb))
+* **ci:** install project format and Python tooling ([13fb972](https://github.com/0xPlayerOne/code-foundry/commit/13fb972e774e26c2d5794421a17c4ac685a28b0c))
+
+## [0.27.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.26.0...v0.27.0) (2026-07-28)
+
+
+### Features
+
+* add typed javascript cli checks ([2d9464b](https://github.com/0xPlayerOne/code-foundry/commit/2d9464bcbef8aa51607cdf52a6a60e3fc1bdb054))
+* make mise an optional toolchain ([e62f023](https://github.com/0xPlayerOne/code-foundry/commit/e62f0238f4ddc2d1b0f89e0f2b23bca3679b934e))
+* make paid github security checks opt-in ([bbfe899](https://github.com/0xPlayerOne/code-foundry/commit/bbfe8993d88a8415129ce29bfa5d2181807232ba))
+* skip irrelevant language configuration ([39a0003](https://github.com/0xPlayerOne/code-foundry/commit/39a00037ba92152926e7a89759f3255d86a4f26e))
+* standardize optional github security policies ([2cf6bc3](https://github.com/0xPlayerOne/code-foundry/commit/2cf6bc3af161ed8757a03447aab16f3e7ea310d7))
+
+
+### Bug Fixes
+
+* include runtime libraries in every workflow job ([ce94cd9](https://github.com/0xPlayerOne/code-foundry/commit/ce94cd96a32eff54048712e1bf4b2d34a868ba2e))
+* include runtime libraries in workflow checkout ([4b2c252](https://github.com/0xPlayerOne/code-foundry/commit/4b2c2527c37c82b498c2b3457df5dd52ef7c694f))
+* migrate stale managed docs during sync ([380bab1](https://github.com/0xPlayerOne/code-foundry/commit/380bab1334c9125f97bf333cc29c796e1a16d57d))
+* preserve authored notice files ([342e666](https://github.com/0xPlayerOne/code-foundry/commit/342e666f4e218e094180f10ecdc5a24b85a27b28))
+* preserve repository notice attribution ([7d43911](https://github.com/0xPlayerOne/code-foundry/commit/7d439117ec89882d8d06895528d94ed717ade471))
+* use pinned bun lockfile format ([0f75faf](https://github.com/0xPlayerOne/code-foundry/commit/0f75faf2c7614cc7055cbb4f26a01b3cf1639f85))
+
 ## [0.26.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.25.0...v0.26.0) (2026-07-28)
 
 

package/README.md

@@ -19,7 +19,7 @@ npx code-foundry init
 ```
 
 Initialization is repository-aware. It detects supported languages, package
-manager, profile, release strategy, and required mise tools, then writes the
+manager, profile, release strategy, and toolchain preference, then writes the
 resolved choices to `.github/code-foundry.yml`.
 
 ```bash
@@ -39,7 +39,7 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
   and Release.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and
   linting.
-- `.mise.toml`, optional `mise.lock`, repository profile configuration, and
+- An optional `.mise.toml`/`mise.lock`, repository profile configuration, and
   standard GitHub forms and policy files.
 - AGENTS instructions, CODEOWNERS, license/notice files, and reusable release
   configuration.
@@ -60,7 +60,9 @@ New repositories default to GPL-3.0-or-later. Existing projects preserve an
 authored license unless a replacement is explicitly selected. Our maintained
 repositories explicitly select AGPL-3.0-or-later. Authored
 documentation, application files, custom workflows, and existing `.mise.toml`
-files are preserved by default.
+files are preserved by default. `toolchain: auto` uses an existing mise setup
+when present and otherwise uses native language tooling; choose `native` or
+`mise` explicitly when a repository needs a fixed policy.
 
 ## Workflow model
 
@@ -76,13 +78,21 @@ test runner. Rust uses `rustfmt`, Clippy with warnings as errors, and native
 Cargo tests. Python uses Ruff, uv/pip-compatible setup, and native Python
 tests. Solidity projects retain their native toolchain and test runner.
 
-CodeQL remains separate from CI and Security. Dependency Review is isolated in
-Security and is skipped where GitHub does not support it, while JavaScript,
-Python, and Rust audits remain available without GitHub Advanced Security.
+CodeQL remains separate from CI and Security. With the default `codeql: auto`
+and `dependency_review: auto` policies, public repositories use the free GitHub
+security checks while private repositories skip them unless explicitly opted
+in and supported by GitHub Advanced Security. JavaScript, Python, and Rust
+audits remain available without Advanced Security. Code Foundry does not enable
+GitHub Code Quality or other paid GitHub features.
 
 See [Workflow and CI conventions](docs/WORKFLOWS.md) for triggers, required
 checks, runners, coverage, caching, and custom workflow extensions.
 
+The default contribution policy uses the `staging-release` workflow with
+rebase merges. Repositories can set `merge_strategy: squash` or
+`merge_strategy: merge` in `.github/code-foundry.yml` when their governance
+requires another merge convention.
+
 ## Releases and publishing
 
 The standard flow promotes `staging` into `main`, lets Release Please open a

package/docs/CONFIGURATION.md

@@ -9,6 +9,10 @@ npx code-foundry init
 Initialization detects the repository and writes a fully resolved configuration.
 Edit that file directly, then run `npx code-foundry sync`.
 
+The default `toolchain: auto` reuses an existing `.mise.toml`; otherwise it
+selects native setup for the detected languages. Use `toolchain: native` to
+prohibit mise or `toolchain: mise` to require it.
+
 ## Configuration flow
 
 ```text
@@ -17,7 +21,7 @@ repository manifests and source
             v
   .github/code-foundry.yml
             |
-            +--> mise and environment setup
+            +--> native or mise toolchain setup
             +--> standard workflow callers
             +--> runtime repository and version
             +--> release, license, cache, and coverage policy
@@ -30,13 +34,18 @@ repository manifests and source
 | `profile` | `auto`, `application`, `monorepo`, `minimal` | Repository shape |
 | `languages` | detected list | TypeScript, Rust, Python, Solidity |
 | `package_manager` | `bun`, `pnpm`, `yarn`, `npm`, `none` | JavaScript setup |
+| `toolchain` | `auto`, `native`, `mise` | Environment setup policy; defaults to `auto` |
 | `features` | `all` or a list | Standard workflow callers |
+| `codeql` | `auto`, `true`, `false` | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled |
+| `dependency_review` | `auto`, `true`, `false` | Dependency Review policy; public repositories default to enabled, non-public repositories default to disabled |
 | `prune_standard` | `true` or `false` | Remove disabled standard callers |
 | `runtime_repository` | `OWNER/REPO` | Reusable workflow source |
 | `runtime_ref` | tag or branch | Reusable workflow version |
 | `release_type` | `node`, `python`, `rust`, `simple`, `none` | Release strategy |
 | `npm_publish` | `true` or `false` | Opt into npm publication |
 | `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
+| `git_workflow` | `staging-release` | Branch/release model; the standard model promotes `staging` into `main` |
+| `merge_strategy` | `rebase`, `squash`, `merge` | Preferred merge method for contribution and release PRs; defaults to `rebase` |
 | `runner` fields | GitHub runner names | Per-workflow runner policy |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,

package/docs/INITIALIZATION.md

@@ -11,7 +11,7 @@ npx code-foundry doctor
 ```
 
 `init` detects supported languages, package manager, repository profile,
-release strategy, mise tools, and standard features. It writes the resolved
+release strategy, toolchain preference, and standard features. It writes the resolved
 choices to `.github/code-foundry.yml`, initializes the local environment, and
 renders the standard baseline.
 
@@ -40,7 +40,8 @@ Sync updates standard Code Foundry files only. It preserves application code,
 authored documentation, existing `.mise.toml` selections, and custom workflows
 such as deployment, search, Slither, or monitoring workflows.
 
-The environment bootstrap installs or reuses mise-managed tools and enables
-the repository hooks. Use `npx code-foundry doctor` when local setup needs to
-be checked; the CLI supplies the implementation without adding maintenance
-scripts to the consumer repository.
+The environment bootstrap enables repository hooks and uses mise only when an
+existing `.mise.toml` is present or `toolchain: mise` is selected. Otherwise it
+uses the repository's native tools. Use `npx code-foundry doctor` when local
+setup needs to be checked; the CLI supplies the implementation without adding
+maintenance scripts to the consumer repository.

package/docs/RELEASES.md

@@ -12,6 +12,11 @@ Keep commits Conventional Commit-shaped (`feat:`, `fix:`, `docs:`, `ci:`,
 `chore:`, and so on). Release Please uses them to select patch/minor/major
 versions and generate grouped changelog notes.
 
+The default `merge_strategy` is `rebase`, matching the repository's linear
+history policy. Set it to `squash` or `merge` in `.github/code-foundry.yml` when
+that repository intentionally uses a different merge convention. The current
+supported `git_workflow` is `staging-release`.
+
 The release workflow opens or updates a versioned PR after changes reach
 `main`. Merging that PR updates the changelog, creates the Git tag and GitHub
 Release, and triggers any configured package publication.

package/docs/WORKFLOWS.md

@@ -46,11 +46,18 @@ ambiguous for mixed-language repositories.
 
 ## Security behavior
 
-CodeQL is a separate workflow using GitHub's official actions. Dependency
-Review is skipped where GitHub does not support it, while JavaScript, Python,
-and Rust audits remain available without Advanced Security. If GitHub default
-setup is enabled, disable its generated CodeQL workflow to avoid duplicate
-analysis.
+CodeQL is a separate workflow using GitHub's official actions. The default
+`codeql: auto` policy enables it for public repositories and skips it for
+private repositories unless explicitly enabled and Advanced Security is
+available. Dependency Review follows the same policy through
+`dependency_review: auto`; JavaScript, Python, and Rust audits remain
+available without Advanced Security. If GitHub default setup is enabled,
+disable its generated CodeQL workflow to avoid duplicate analysis.
+
+Code Foundry does not enable GitHub Code Quality or any paid GitHub feature.
+The repository's format and lint jobs are ordinary CI checks. Set `codeql:
+false` or `dependency_review: false` when a public repository also needs those
+checks disabled.
 
 ## Branch protection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",
@@ -42,12 +42,16 @@
     "build": "node --check src/cli.mjs",
     "format:check": "node --check src/cli.mjs",
     "lint": "node --check src/cli.mjs",
-    "test": "node --check src/cli.mjs",
-    "type-check": "node --check src/cli.mjs",
+    "test": "node --test",
+    "type-check": "tsc --project jsconfig.json",
     "pack:check": "npm pack --dry-run",
     "prepublishOnly": "npm test && npm run pack:check"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.8.3"
   }
 }

package/src/cli.mjs

@@ -1,12 +1,16 @@
 #!/usr/bin/env node
+// @ts-check
 
-import { existsSync } from 'node:fs'
 import { resolve } from 'node:path'
-import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
+import { doctor } from './commands/doctor.mjs'
+import { syncRepository } from './commands/sync.mjs'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
+/** @typedef {{ target: string, dryRun: boolean, force: boolean }} Options */
+/** @typedef {{ command: string, options: Options }} ParsedArgs */
+
 const usage = `code-foundry — initialize and maintain agent-ready repositories
 
 Usage:
@@ -25,13 +29,17 @@ Options:
   -h, --help      Show this help
 `
 
+/** @param {string} message @returns {never} */
 function fail(message) {
   console.error(`code-foundry: ${message}`)
   process.exit(2)
 }
 
+/** @param {string[]} argv @returns {ParsedArgs} */
 function parseArgs(argv) {
-  const command = argv[0] && !argv[0].startsWith('-') ? argv.shift() : 'init'
+  const first = argv[0]
+  const hasCommand = Boolean(first && !first.startsWith('-'))
+  const command = hasCommand ? /** @type {string} */ (argv.shift()) : 'init'
   const options = { target: process.cwd(), dryRun: false, force: false }
 
   while (argv.length) {
@@ -52,34 +60,30 @@ function parseArgs(argv) {
   return { command, options }
 }
 
-function run(script, args, target) {
-  const scriptPath = resolve(packageRoot, '.github/scripts', script)
-  if (!existsSync(scriptPath)) fail(`package is missing ${script}`)
-  const result = spawnSync('bash', [scriptPath, ...args], {
-    cwd: target,
-    stdio: 'inherit',
-    env: process.env,
-  })
-  if (result.error) fail(result.error.message)
-  if (result.status !== 0) process.exit(result.status ?? 1)
-}
-
 function main() {
   const { command, options } = parseArgs(process.argv.slice(2))
   const target = resolve(options.target)
-  const common = ['--source', packageRoot, '--ref', 'main']
-  if (options.dryRun) common.push('--check')
-  else common.push('--apply')
-  if (options.force) common.push('--force')
 
   if (command === 'init') {
-    const initArgs = ['--source', packageRoot, '--ref', 'main']
-    if (options.dryRun) initArgs.push('--dry-run')
-    if (options.force) initArgs.push('--force')
-    run('init-repo.sh', initArgs, target)
+    try {
+      syncRepository({ target, source: packageRoot, dryRun: options.dryRun, force: options.force, init: true })
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
+  } else if (command === 'sync') {
+    try {
+      syncRepository({ target, source: packageRoot, dryRun: options.dryRun, force: options.force })
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
+  } else if (command === 'doctor') {
+    try {
+      doctor(target)
+    } catch (error) {
+      console.error(`code-foundry: ${error instanceof Error ? error.message : String(error)}`)
+      process.exitCode = 1
+    }
   }
-  else if (command === 'sync') run('sync-template.sh', common, target)
-  else if (command === 'doctor') run('doctor.sh', [], target)
   else fail(`unknown command: ${command}`)
 }