code-foundry 1.47.1 → 1.48.0

package/.github/CONTRIBUTING.md

@@ -115,17 +115,23 @@ If the worktree is dirty, stop and understand the existing changes before switch
 
 ## Local validation
 
-The repository runtime detects supported tools and skips checks that do not apply:
+Use the commands declared in this repository's manifests and documentation, or
+invoke the installed Code Foundry CLI. The shared runtime detects supported tools
+and skips checks that do not apply:
 
 ```sh
 npx code-foundry doctor
-npm run format:check   # or the package manager's equivalent
-npm run lint
-npm run type-check
-npm test
-Security and dependency audits run through the GitHub Security workflow.
+npx code-foundry plan --tier fast
+npx code-foundry check --tier fast
+npx code-foundry check --tier audit
 ```
 
+`doctor` diagnoses setup; `plan` discovers tasks without running them. `check`
+runs the selected tier: `fast` includes CI tasks, unit tests and performance,
+while `audit` adds integration, E2E and smoke.
+
+Security and dependency audits run through the GitHub Security workflow.
+
 Run the checks relevant to the change. For a release or security-sensitive change, run the complete set. Record the commands and results in the pull request.
 
 <!-- /code-foundry-managed: local-validation -->

package/.github/actions/setup/action.yml

@@ -54,6 +54,10 @@ inputs:
     description: Cache local Turborepo artifacts; auto skips duplicate archives when TURBO_TOKEN enables remote caching.
     required: false
     default: auto
+  cache-vite-plus:
+    description: Cache the local Vite+ task cache (node_modules/.vite/task-cache); only applies when code-foundry.yml sets monorepo_tool to vite-plus. Use true/false to override.
+    required: false
+    default: auto
   task:
     description: Optional CI task used to scope test dependency installation.
     required: false
@@ -122,11 +126,11 @@ runs:
         NODE
         }
 
-        script_uses_turbo() {
+        script_uses_runner() {
           [ -f package.json ] || return 1
-          REPO_FOUNDRY_TURBO_TASK="$REPO_FOUNDRY_TASK" node <<'NODE'
+          REPO_FOUNDRY_RUNNER="$1" REPO_FOUNDRY_RUNNER_TASK="$REPO_FOUNDRY_TASK" node <<'NODE'
         const fs = require('node:fs');
-        const task = process.env.REPO_FOUNDRY_TURBO_TASK || '';
+        const task = process.env.REPO_FOUNDRY_RUNNER_TASK || '';
         const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
         const scripts = packageJson.scripts || {};
         const candidates = {
@@ -141,8 +145,11 @@ runs:
           performance: ['performance:check', 'perf:check'],
         }[task] || [];
         const selected = candidates.find((name) => scripts[name]);
-        const usesTurbo = Boolean(selected && /\bturbo(?:\s|$)/.test(scripts[selected]));
-        process.exit(usesTurbo ? 0 : 1);
+        const pattern = process.env.REPO_FOUNDRY_RUNNER === 'vite-plus'
+          ? /(?:^|[\s;&|(])(?:vp\s+(?:-C\s+\S+\s+)?run|vpr)(?:\s|$)/
+          : /\bturbo(?:\s|$)/;
+        const usesRunner = Boolean(selected && pattern.test(scripts[selected]));
+        process.exit(usesRunner ? 0 : 1);
         NODE
         }
 
@@ -298,8 +305,18 @@ runs:
           echo 'rust=false' >> "$GITHUB_OUTPUT"
         fi
 
+        # Vite+ is strictly opt-in: only an explicit monorepo_tool: vite-plus
+        # selects it. Every other value, or none, keeps the Turbo behavior.
+        vite_plus=false
+        if [ -f .github/code-foundry.yml ] &&
+          grep -Eq "^monorepo_tool:\s*[\"']?vite-plus[\"']?\s*(#.*)?$" .github/code-foundry.yml; then
+          vite_plus=true
+        fi
+        printf 'vite_plus=%s\n' "$vite_plus" >> "$GITHUB_OUTPUT"
+
         turbo=false
-        if [ -f turbo.json ] || [ -f turbo.jsonc ] || has_tracked_regex '(^|/)turbo\.jsonc?$'; then
+        if [ "$vite_plus" != true ] &&
+          { [ -f turbo.json ] || [ -f turbo.jsonc ] || has_tracked_regex '(^|/)turbo\.jsonc?$'; }; then
           turbo=true
           echo 'turbo=true' >> "$GITHUB_OUTPUT"
         else
@@ -342,11 +359,18 @@ runs:
         printf 'eslint_fallback=%s\n' "$eslint_fallback" >> "$GITHUB_OUTPUT"
 
         turbo_task=false
-        if [ -z "$REPO_FOUNDRY_TASK" ] || script_uses_turbo; then
+        if [ -z "$REPO_FOUNDRY_TASK" ] || script_uses_runner turbo; then
           turbo_task=true
         fi
         printf 'turbo_task=%s\n' "$turbo_task" >> "$GITHUB_OUTPUT"
 
+        vite_plus_task=false
+        if [ "$vite_plus" = true ] &&
+          { [ -z "$REPO_FOUNDRY_TASK" ] || script_uses_runner vite-plus; }; then
+          vite_plus_task=true
+        fi
+        printf 'vite_plus_task=%s\n' "$vite_plus_task" >> "$GITHUB_OUTPUT"
+
         build=false
         if has_tracked_regex '(^|/)(next\.config\.[^/]*|vite\.config\.[^/]*|tsconfig[^/]*\.json)$'; then
           build=true
@@ -630,6 +654,7 @@ runs:
         path: |
           **/.next/cache
           **/node_modules/.vite
+          !**/node_modules/.vite/task-cache
           **/*.tsbuildinfo
         key: ${{ runner.os }}-javascript-build-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/next.config.*', '**/vite.config.*', '**/tsconfig*.json', '.mise.toml', 'mise.lock') }}
         # Keep primary saves isolated so parallel jobs cannot race. A cache
@@ -888,3 +913,76 @@ runs:
           ~/.cache/yarn
           ~/.local/share/pnpm/store
         key: ${{ runner.os }}-javascript-${{ hashFiles('**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json') }}
+    # Restored last: Install can replace node_modules, and the node_modules
+    # archives above must not contain task output.
+    - name: Detect Vite+ toolchain
+      id: vite-plus-toolchain
+      if: >-
+        inputs.install == 'true' &&
+        inputs.install-javascript == 'true' &&
+        inputs.cache-vite-plus != 'false' &&
+        steps.profile.outputs.vite_plus == 'true' &&
+        steps.profile.outputs.vite_plus_task == 'true' &&
+        hashFiles('**/package.json') != ''
+      shell: bash
+      env:
+        REPO_FOUNDRY_RUNNER_OS: ${{ runner.os }}
+        REPO_FOUNDRY_RUNNER_ARCH: ${{ runner.arch }}
+      run: |
+        node --input-type=module <<'NODE'
+        import { appendFileSync, readFileSync } from 'node:fs'
+        import { execFileSync } from 'node:child_process'
+        import { createRequire } from 'node:module'
+        import { resolve } from 'node:path'
+        const clean = (value) => String(value).replace(/[^A-Za-z0-9._-]/g, '_')
+        const tryVersion = (command) => {
+          try {
+            return execFileSync(command, ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+          } catch {
+            return 'none'
+          }
+        }
+        let vitePlus = 'unknown'
+        try {
+          vitePlus = createRequire(resolve('package.json'))('vite-plus/package.json').version
+        } catch {
+          try {
+            vitePlus = JSON.parse(readFileSync('node_modules/vite-plus/package.json', 'utf8')).version
+          } catch {
+            // Not installed at the root; the namespace stays distinct.
+          }
+        }
+        // Vite Task does not fingerprint the Node or Bun binary, so partition
+        // by OS, architecture, and exact runtime and Vite+ versions.
+        const namespace = [
+          'vite-plus-v1',
+          process.env.REPO_FOUNDRY_RUNNER_OS,
+          process.env.REPO_FOUNDRY_RUNNER_ARCH,
+          `node${process.version}`,
+          `bun${tryVersion('bun')}`,
+          `vp${vitePlus}`,
+        ].map(clean).join('-')
+        // VITE_CACHE_PATH relocates the cache; it must be absolute.
+        const custom = process.env.VITE_CACHE_PATH
+        const paths = custom
+          ? [resolve(custom)]
+          : ['node_modules/.vite/task-cache', '**/node_modules/.vite/task-cache']
+        // Without a resolvable version the namespace cannot isolate releases.
+        appendFileSync(process.env.GITHUB_OUTPUT, `cacheable=${vitePlus !== 'unknown'}\n`)
+        appendFileSync(process.env.GITHUB_OUTPUT, `namespace=${namespace}\n`)
+        appendFileSync(process.env.GITHUB_OUTPUT, `cache_paths<<CACHE_PATHS_EOF\n${paths.join('\n')}\nCACHE_PATHS_EOF\n`)
+        console.log(`Vite+ cache namespace: ${namespace}`)
+        NODE
+    - name: Cache Vite+ tasks
+      if: steps.vite-plus-toolchain.outputs.cacheable == 'true'
+      uses: ./.github/actions/cache
+      with:
+        save: ${{ inputs.cache-save }}
+        path: ${{ steps.vite-plus-toolchain.outputs.cache_paths }}
+        # The run/attempt suffix saves a refreshed entry on every push; restore
+        # keys never leave the compatibility namespace.
+        key: ${{ steps.vite-plus-toolchain.outputs.namespace }}-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '.mise.toml', 'mise.lock') }}-${{ hashFiles('**/vite.config.*') }}-${{ github.run_id }}-${{ github.run_attempt }}
+        restore-keys: |
+          ${{ steps.vite-plus-toolchain.outputs.namespace }}-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '.mise.toml', 'mise.lock') }}-
+          ${{ steps.vite-plus-toolchain.outputs.namespace }}-${{ github.workflow }}-${{ github.job }}-
+          ${{ steps.vite-plus-toolchain.outputs.namespace }}-

package/.github/workflows/ci.yml

@@ -183,6 +183,9 @@ jobs:
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      contents: read
+      issues: read
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -226,6 +229,8 @@ jobs:
       - name: Type-Check
         id: execute
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-

package/.github/workflows/cloudflare-delivery.yml

@@ -243,7 +243,14 @@ jobs:
             isAbsolute(workspaceRelative) ||
             workspaceRelative === '..' ||
             workspaceRelative.startsWith(`..${sep}`)
-          if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
+          // Vite+ repositories are not served by this Turbo-only check.
+          const config = resolve(workspace, '.github/code-foundry.yml')
+          const optedIntoVitePlus =
+            existsSync(config) &&
+            /^monorepo_tool:\s*["']?vite-plus["']?\s*(?:#.*)?$/m.test(readFileSync(config, 'utf8'))
+          if (optedIntoVitePlus) {
+            conservative('monorepo_tool is vite-plus')
+          } else if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
             conservative('Turbo config not found')
           } else if (outsideWorkspace) {
             conservative('working-directory is outside the workspace')

package/.github/workflows/cloudflare-deploy.yml

@@ -171,7 +171,14 @@ jobs:
             isAbsolute(workspaceRelative) ||
             workspaceRelative === '..' ||
             workspaceRelative.startsWith(`..${sep}`)
-          if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
+          // Vite+ repositories are not served by this Turbo-only check.
+          const config = resolve(workspace, '.github/code-foundry.yml')
+          const optedIntoVitePlus =
+            existsSync(config) &&
+            /^monorepo_tool:\s*["']?vite-plus["']?\s*(?:#.*)?$/m.test(readFileSync(config, 'utf8'))
+          if (optedIntoVitePlus) {
+            conservative('monorepo_tool is vite-plus')
+          } else if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
             conservative('Turbo config not found')
           } else if (outsideWorkspace) {
             conservative('working-directory is outside the workspace')

package/.github/workflows/validation-billing.yml

@@ -533,6 +533,9 @@ jobs:
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      contents: read
+      issues: read
     runs-on: ${{ inputs.ci-runner }}
     timeout-minutes: 30
     steps:
@@ -576,6 +579,8 @@ jobs:
       - name: Type-Check
         id: execute
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-

package/.github/workflows/validation-no-codeql.yml

@@ -104,6 +104,12 @@ jobs:
   ci:
     name: CI
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    # Forward issue-read only to the CI workflow that runs Type-Check.
+    permissions:
+      actions: read
+      contents: read
+      issues: read
+      packages: read
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

package/.github/workflows/validation.yml

@@ -104,6 +104,12 @@ jobs:
   ci:
     name: CI
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    # Type-Check reads the issue-backed requirements ledger with github.token.
+    permissions:
+      actions: read
+      contents: read
+      issues: read
+      packages: read
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

package/.github/workflows/validation_audit_self-ci.yml

@@ -22,6 +22,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: 0xPlayerOne/code-foundry/.github/workflows/validation.yml@main

package/.github/workflows/validation_self-ci.yml

@@ -78,6 +78,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: ./.github/workflows/validation.yml

package/.gitignore

@@ -83,3 +83,4 @@ mise.local.lock
 # committed pre-commit gate is tracked.
 .githooks/*
 !.githooks/pre-commit
+.fleet-wt/

package/AGENTS.md

@@ -4,7 +4,7 @@
 
 These instructions are the repository-level operating contract for coding agents, including Hermes, OpenCode, and other automation.
 
-They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.md` files and project documentation take precedence for their directory.
+They complement `.github/CONTRIBUTING.md`. More specific instructions in nested `AGENTS.md` files and project documentation take precedence for their directory.
 
 <!-- /code-foundry-managed: config-aware-policy -->
 
@@ -183,7 +183,22 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 
 ## Validation
 
-Use the shared scripts when present. They detect supported tools and skip inapplicable checks:
+From a consumer repository, use its documented package scripts or the installed
+Code Foundry CLI:
+
+```sh
+npx code-foundry plan --tier fast
+npx code-foundry check --tier fast
+npx code-foundry check --tier audit
+```
+
+`plan` discovers tasks without running them. `check` invokes the shared runtime;
+`fast` includes CI tasks, unit tests and performance, while `audit` adds
+integration, E2E and smoke.
+
+From a Code Foundry source checkout only, the shared runtime is also available.
+The paths below are relative to that checkout, not a consumer repository. The
+runtime detects supported tools and skips inapplicable checks:
 
 ```sh
 node src/runtime.mjs ci format
@@ -196,9 +211,10 @@ node src/runtime.mjs ci e2e
 node src/runtime.mjs ci smoke
 node src/runtime.mjs ci eval
 node src/runtime.mjs ci performance
-Security and dependency audits run through the GitHub Security workflow.
 ```
 
+Security and dependency audits run through the GitHub Security workflow.
+
 Run focused tests first, then the complete applicable set for release, security, workflow, dependency, and configuration changes.
 
 At minimum:

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [1.48.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.5...v1.48.0) (2026-10-16)
+
+
+### Features
+
+* add opt-in Vite+ task runner support ([#763](https://github.com/0xPlayerOne/code-foundry/issues/763)) ([f7970cd](https://github.com/0xPlayerOne/code-foundry/commit/f7970cdf1c1880aaee159d2de79ba043f93711a7))
+
+## [1.47.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.4...v1.47.5) (2026-10-15)
+
+
+### Bug Fixes
+
+* validation-issue-read-v1471 ([#759](https://github.com/0xPlayerOne/code-foundry/issues/759)) ([7119b3e](https://github.com/0xPlayerOne/code-foundry/commit/7119b3e2baebfbfdd47d32428cbf5df2f2079afa))
+
+## [1.47.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.3...v1.47.4) (2026-10-15)
+
+
+### Documentation
+
+* fix generated agent contribution and validation references ([#760](https://github.com/0xPlayerOne/code-foundry/issues/760)) ([c3564c9](https://github.com/0xPlayerOne/code-foundry/commit/c3564c92cb168449317afe2e40359144bf7a0c71))
+
+## [1.47.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.2...v1.47.3) (2026-10-09)
+
+
+### Maintenance
+
+* **fleet:** point the manifest at the rollout worktrees and filter adea's actionlint ([#757](https://github.com/0xPlayerOne/code-foundry/issues/757)) ([55bae8b](https://github.com/0xPlayerOne/code-foundry/commit/55bae8bf99a022bfa03294972d89a3cca20a6203))
+
+## [1.47.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.1...v1.47.2) (2026-10-08)
+
+
+### Bug Fixes
+
+* **qualification:** exclude pending parallel syntax by content, not filename ([#755](https://github.com/0xPlayerOne/code-foundry/issues/755)) ([1f7cae8](https://github.com/0xPlayerOne/code-foundry/commit/1f7cae8167002061850e56e3dc0fa800a69d7be9))
+
 ## [1.47.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.0...v1.47.1) (2026-10-08)
 
 
@@ -105,44 +140,9 @@
 
 * **release:** make the REST fallback draft-aware and idempotent ([#725](https://github.com/0xPlayerOne/code-foundry/issues/725)) ([c29da6e](https://github.com/0xPlayerOne/code-foundry/commit/c29da6efb919d68a568c2328eea2c2f7654334fe))
 
-## [1.44.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.7...v1.44.8) (2026-10-06)
-
-
-### Bug Fixes
-
-* **release:** query the version-PR branch directly in the REST fallback ([#722](https://github.com/0xPlayerOne/code-foundry/issues/722)) ([b38f394](https://github.com/0xPlayerOne/code-foundry/commit/b38f394c0ca6438117fdd2f45bd106b0b145a0f9))
-
-## [1.44.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.6...v1.44.7) (2026-10-05)
-
-
-### Bug Fixes
-
-* **release:** complete rejected release-please runs over REST ([#720](https://github.com/0xPlayerOne/code-foundry/issues/720)) ([14e88b5](https://github.com/0xPlayerOne/code-foundry/commit/14e88b5561803fc8d5d3a77b67b99e1be90bc4af))
-
-## [1.44.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.5...v1.44.6) (2026-10-05)
-
-
-### Bug Fixes
-
-* **config:** pin the lint-bearing CI lane to a standard runner by default ([#718](https://github.com/0xPlayerOne/code-foundry/issues/718)) ([fc0ed14](https://github.com/0xPlayerOne/code-foundry/commit/fc0ed14434151fb11eef7c0d4c324c7a370d5058))
-
-## [1.44.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.4...v1.44.5) (2026-10-05)
-
-
-### Bug Fixes
-
-* **release:** probe the tag-creation write before trusting the automation token ([#716](https://github.com/0xPlayerOne/code-foundry/issues/716)) ([fabaddc](https://github.com/0xPlayerOne/code-foundry/commit/fabaddcb05d5dc701248b693f91be6ee433f8d39))
-
-## [1.44.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.3...v1.44.4) (2026-10-03)
-
-
-### Bug Fixes
-
-* **ci:** declare the e2e shard inputs on the no-codeql orchestrator ([#714](https://github.com/0xPlayerOne/code-foundry/issues/714)) ([7500208](https://github.com/0xPlayerOne/code-foundry/commit/7500208f3b25dfe55c41ea45b382e021cf804012))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 243 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 248 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CACHING.md

@@ -22,6 +22,79 @@ Non-Turborepo repositories do not need either setting. Deployment to Vercel is
 not required. Custom workflows can pass these values to Turbo directly when
 the repository's task graph benefits from remote reuse.
 
+## Vite+ local task cache (opt-in)
+
+Repositories that run their workspace tasks with Vite+ (`vp run`, `vpr`) can
+opt in with `monorepo_tool: vite-plus` in `.github/code-foundry.yml`. Turbo
+stays the default for every repository that does not set it.
+
+When opted in, the setup action:
+
+- stops treating a `turbo.json` as the active runner, so no Turborepo cache or
+  remote-cache step runs;
+- restores `node_modules/.vite/task-cache` as its last step, after Install and
+  after every step that archives `node_modules` (Install can replace it);
+- saves it push-only like every other cache, so pull requests and scheduled
+  runs cannot poison it;
+- keeps it out of the generic JavaScript build-state archive.
+
+Keys are `<namespace>-<workflow>-<job>-<lockfiles>-<vite.config>-<run id>-<attempt>`,
+so every push saves a refreshed entry (more storage than a fixed key). Restore
+keys fall back by lockfiles, job, then any job, but never leave the namespace
+`vite-plus-v1-<OS>-<arch>-node<version>-bun<version>-vp<version>`, because Vite
+Task does not fingerprint the Node or Bun binary. If the `vite-plus` version
+cannot be resolved, nothing is restored or saved.
+
+If `VITE_CACHE_PATH` (absolute) is set, Vite+ writes its cache there and the
+setup action caches that directory instead.
+
+Vite+ has no remote cache and this repository does not configure one.
+
+Known limits (not parity with Turbo):
+
+- Vite Task keeps one cache entry per task, so alternating between states
+  (A, B, A) re-runs the task instead of hitting the cache.
+- `package.json` scripts are not cached unless the consumer sets
+  `run.cache.scripts: true` in its root `vite.config.ts` or passes `--cache` to
+  `vp run`. Code Foundry does not change consumer config. Commands that read no
+  files, such as a bare `echo`, are never cached.
+- Tasks reading files that only Bun loads may need explicit input globs in the
+  consumer's Vite+ config (untested here).
+- `cloudflare-deploy.yml` and `cloudflare-delivery.yml` keep a Turbo-only
+  affected check. With `monorepo_tool: vite-plus` they skip it and deploy
+  conservatively, even with a leftover `turbo.json`.
+
+### Affected packages
+
+`npx code-foundry affected --base <ref> --head <ref>` prints the affected
+packages as JSON (`tool`, `packages`, `removedPackages`, `all`, `conservative`,
+`reason`, `filterArgs`). Both refs must be present in the clone (use a
+non-shallow checkout or fetch the base commit).
+
+- Turbo repositories use `turbo query affected --packages`; this module does
+  not parse their workspace.
+- Vite+ repositories compute the set from `git diff base...head` and the
+  workspace graphs read from the committed trees at both refs, because Vite+
+  has no equivalent query. Each changed file marks the package that owns it;
+  dependents are added transitively over the union of both graphs' edges, so
+  deleted, renamed, moved, and re-wired packages still select their dependents.
+  `removedPackages` lists selected packages that no longer exist at the head.
+- Any changed file that no workspace package owns selects every package
+  (`all: true`): lockfiles, root manifest, config, scripts, docs, templates. A
+  build may read any of them. Only `affected_ignore` in `.github/code-foundry.yml`
+  (comma-separated globs, for example `README.md, docs/**`) skips unowned files.
+- Anything the module cannot evaluate faithfully makes the result
+  conservative (`all: true`, `conservative: true`): no runner, a git or Turbo
+  failure, a malformed or unnamed workspace manifest at either ref, duplicate
+  package names, or workspace syntax it does not support (brace, bracket, or
+  extglob patterns). Supported syntax is `package.json` `workspaces` (array or
+  `{ packages }`) and pnpm `packages:` as a block or flow list, with `*`, `**`,
+  `?`, and `!` exclusions.
+- `--tool turbo|vite-plus` overrides `monorepo_tool` for one invocation.
+- For Vite+, `filterArgs` is ready to append to `vp run`. When `all` is true
+  run with `-r` instead, and when `packages` is empty skip the run: an empty
+  filter list would otherwise select every package.
+
 ## Runner selection
 
 Lightweight detection, orchestration, audits, and release metadata jobs can use

package/docs/CONFIGURATION.md

@@ -289,6 +289,15 @@ behavior:
   `TURBO_TEAM`.
 - `TURBO_TOKEN` and `TURBO_TEAM` provide the Turborepo remote-cache
   credentials.
+- `monorepo_tool: auto`, `turbo`, or `vite-plus` selects the workspace task
+  runner. `auto` (the default) is Turbo when a `turbo.json` or `turbo.jsonc`
+  exists and no runner otherwise, exactly as before Vite+ support. Vite+ is
+  opt-in: only `monorepo_tool: vite-plus` selects it, and it then takes
+  precedence over a turbo config. `doctor` warns when the selected runner has
+  no matching evidence in the repository.
+- `cache-vite-plus: auto`, `true`, or `false` is an input of the setup action
+  (not a config key). It controls the local Vite+ task cache only when
+  `monorepo_tool: vite-plus` is set.
 
 Use these controls only after measuring a repeatable benefit. See [Caching and
 remote caching](CACHING.md).

package/docs/README.md

@@ -33,7 +33,7 @@ details before copying any guide elsewhere.
 - [Declarative fleet rollouts](fleet-rollouts.md) — inventory, canaries, staged upgrades, and recovery.
 - [Fleet release eligibility](fleet-release-eligibility.md) — require verified release evidence before upgrades.
 - [Verified Cloudflare delivery](cloudflare-delivery.md) — build, verify, canary, and promote Worker versions.
-- [Caching and remote caching](CACHING.md) — configure package, build, and Turborepo caching.
+- [Caching and remote caching](CACHING.md) — configure package, build, Turborepo, and opt-in Vite+ caching.
 
 ## Repository-specific documentation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.47.1",
+  "version": "1.48.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
-/** @typedef {{ target: string, root: string, source: string, dryRun: boolean, force: boolean, github: boolean, createPr: boolean, exclude: string[], base: string, head: string, tag: string, workflow: string, mode: string, version: string, versionExplicit: boolean, repository: string, expectedSha: string, assets: string[], rootProvided: boolean, releaseSubcommand?: string, fleetSubcommand?: string, integritySubcommand?: 'settings'|'release'|'manifest', ciSubcommand?: 'pause'|'resume'|'status' }} Options */
+/** @typedef {{ target: string, root: string, source: string, dryRun: boolean, force: boolean, github: boolean, createPr: boolean, exclude: string[], base: string, head: string, tag: string, workflow: string, mode: string, version: string, versionExplicit: boolean, repository: string, expectedSha: string, assets: string[], rootProvided: boolean, tool: string, headProvided: boolean, releaseSubcommand?: string, fleetSubcommand?: string, integritySubcommand?: 'settings'|'release'|'manifest', ciSubcommand?: 'pause'|'resume'|'status' }} Options */
 /** @typedef {{ command: string, options: Options }} ParsedArgs */
 
 const usage = `code-foundry — initialize and maintain agent-ready repositories
@@ -18,6 +18,7 @@ Usage:
   npx code-foundry doctor [--target PATH]
   npx code-foundry plan [--target PATH] [--tier fast|audit] [--changed] [--base REF] [--json]
   npx code-foundry check [--target PATH] [--tier fast|audit] [--changed] [--base REF] [--timeout SECONDS] [--json]
+  npx code-foundry affected [--target PATH] [--base REF] [--head REF] [--tool auto|turbo|vite-plus]
   npx code-foundry ci pause|resume|status [--target PATH]
   npx code-foundry release reconcile [--github] [--base BRANCH] [--head BRANCH]
   npx code-foundry release hook --tag TAG --workflow WORKFLOW
@@ -37,7 +38,8 @@ Options:
   --force         Replace protected standard documents
   --github        Apply a verified fast-forward through GitHub
   --base BRANCH   Release source branch (default: main)
-  --head BRANCH   Branch to reconcile (default: staging)
+  --head BRANCH   Branch to reconcile (default: staging; HEAD for affected)
+  --tool TOOL     Task runner for affected: auto, turbo, or vite-plus (default: auto)
   --tag TAG       Published release tag for a post-release hook
   --workflow FILE  Workflow to dispatch for a post-release hook
   --mode MODE     auto, workflow-dispatch, release-event, or disabled
@@ -78,6 +80,8 @@ function parseArgs(argv) {
     tag: '',
     workflow: '',
     mode: 'auto',
+    tool: 'auto',
+    headProvided: false,
     version: `v${readPackageVersion(packageRoot)}`,
     versionExplicit: false,
     repository: '',
@@ -128,8 +132,15 @@ function parseArgs(argv) {
     else if (arg === '--force') options.force = true
     else if (arg === '--github') options.github = true
     else if (arg === '--base') options.base = argv.shift() ?? fail('--base requires a branch')
-    else if (arg === '--head') options.head = argv.shift() ?? fail('--head requires a branch')
-    else if (arg === '--tag') options.tag = argv.shift() ?? fail('--tag requires a tag')
+    else if (arg === '--head') {
+      options.head = argv.shift() ?? fail('--head requires a branch')
+      options.headProvided = true
+    } else if (arg === '--tool') {
+      if (command !== 'affected') fail('--tool is only supported by the affected command')
+      options.tool = argv.shift() ?? fail('--tool requires auto, turbo, or vite-plus')
+      if (!['auto', 'turbo', 'vite-plus'].includes(options.tool))
+        fail(`unsupported --tool: ${options.tool}; use auto, turbo, or vite-plus`)
+    } else if (arg === '--tag') options.tag = argv.shift() ?? fail('--tag requires a tag')
     else if (arg === '--repo') {
       if (command !== 'release-integrity')
         fail('--repo is only supported by release-integrity commands')
@@ -204,6 +215,18 @@ async function main() {
       console.error(`code-foundry: ${error instanceof Error ? error.message : String(error)}`)
       process.exitCode = 1
     }
+  } else if (command === 'affected') {
+    try {
+      const { affectedPackages } = await import('./lib/task-filters.mjs')
+      const result = affectedPackages(target, {
+        base: options.base,
+        head: options.headProvided ? options.head : 'HEAD',
+        tool: options.tool,
+      })
+      console.log(JSON.stringify(result, null, 2))
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
   } else if (command === 'release') {
     try {
       const {

package/src/commands/doctor.mjs

@@ -4,7 +4,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { join, resolve, isAbsolute } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
-import { recommendRunners, resolveProfile } from '../lib/profile.mjs'
+import { recommendRunners, resolveMonorepoTool, resolveProfile } from '../lib/profile.mjs'
 import { packageManagerForLockfile } from '../lib/lockfiles.mjs'
 import { doctorGithub } from '../lib/github-doctor.mjs'
 import { isGeneratedEventCaller } from './sync.mjs'
@@ -38,6 +38,10 @@ export function doctor(root, options = {}) {
         : 'Toolchain: native (mise not configured).'
     )
   }
+  const monorepoTool = resolveMonorepoTool(target, config)
+  for (const message of monorepoTool.warnings) warn(message)
+  if (monorepoTool.tool === 'vite-plus')
+    console.log(`Task runner: vite-plus (${monorepoTool.reason}).`)
   const hooks = git(target, ['config', '--get', 'core.hooksPath'])
   if (hooks !== '.githooks') warn('Git hooks are not enabled; run `npx code-foundry init`')
   // A correctly enabled hook that enforces nothing is the failure this check

package/src/commands/sync.mjs

@@ -2168,6 +2168,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     coverage_metrics: 'lines',
     coverage_report: '',
     turbo_remote: 'auto',
+    monorepo_tool: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node',
     npm_publish: 'false',
     post_release: 'false',

package/src/lib/consumer-qualification.mjs

@@ -157,17 +157,16 @@ function lintContracts(consumer, candidate, destination, actionlint, version) {
     paths.push(target)
   }
   // Check all candidate callees as well as rendered callers, without executing them.
-  // actionlint v1.7.12 (still the latest release as of 2026-10-07) predates
+  // actionlint v1.7.12 (still the latest release as of 2026-10-08) predates
   // the June 2026 step parallelism keywords (background/wait/wait-all/
   // cancel/parallel), so files using them are excluded from this pass until
   // actionlint ships support — GitHub's own loader accepts the syntax, which
   // is verified by live runs and pinned in test/billing-lanes.test.mjs.
-  // Restore the removal of this exclusion when rhysd/actionlint releases
-  // post-parallel support.
-  const actionlintPendingParallelSyntax = new Set(['validation-billing.yml'])
-  const workflows = readdirSync(join(destination, '.github/workflows')).filter(
-    (name) => /\.ya?ml$/.test(name) && !actionlintPendingParallelSyntax.has(name)
-  )
+  // The exclusion is content-based so repository-owned workflows adopting the
+  // keywords (adea's desktop-shell, for one) stay covered without list
+  // maintenance. Restore the removal of this exclusion when
+  // rhysd/actionlint releases post-parallel support.
+  const workflows = actionlintEligibleWorkflows(join(destination, '.github/workflows'))
   run(
     actionlint,
     [
@@ -180,6 +179,15 @@ function lintContracts(consumer, candidate, destination, actionlint, version) {
   return paths.length
 }
 
+/** @param {string} workflowsDirectory */
+export function actionlintEligibleWorkflows(workflowsDirectory) {
+  const pendingParallelSyntax = /^[ \t]*(?:-[ \t]+)?(?:background|wait|wait-all|cancel|parallel):/m
+  return readdirSync(workflowsDirectory).filter((name) => {
+    if (!/\.ya?ml$/.test(name)) return false
+    return !pendingParallelSyntax.test(readFileSync(join(workflowsDirectory, name), 'utf8'))
+  })
+}
+
 /** @param {{ packageFile: string, sourceSha: string, reportPath: string, actionlint?: string }} options */
 export function qualifyCandidate(options) {
   if (!/^[a-f0-9]{40}$/.test(options.sourceSha))

package/src/lib/merge-queue.mjs

@@ -110,6 +110,7 @@ on:
 permissions:
   actions: read
   contents: read
+  issues: read
   packages: read
   security-events: write
 

package/src/lib/profile.mjs

@@ -160,3 +160,123 @@ function detectReleaseType(root) {
 }
 
 export { includesValue }
+
+/**
+ * Workspace task runner. `auto` (default) is Turbo when a turbo config exists,
+ * else none; Vite+ needs an explicit `monorepo_tool: vite-plus`.
+ */
+export const MONOREPO_TOOLS = ['auto', 'turbo', 'vite-plus']
+
+/** @typedef {'turbo'|'vite-plus'|'none'} ResolvedTool */
+/** @typedef {{ configured: string, tool: ResolvedTool, reason: string, warnings: string[] }} ToolResolution */
+
+/** @param {string} root @returns {Record<string, any> | null} */
+function readPackageJson(root) {
+  try {
+    return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+/** @param {string} root */
+export function hasTurboConfig(root) {
+  return existsSync(join(root, 'turbo.json')) || existsSync(join(root, 'turbo.jsonc'))
+}
+
+/**
+ * Whether a shell command invokes the Vite+ task runner. `vp run ...` and the
+ * `vpr` shorthand populate the task cache; plain `vp build` or `vp test` do
+ * not, so they are intentionally not matched.
+ * @param {string} command
+ */
+export function commandUsesVitePlus(command) {
+  return /(?:^|[\s;&|(])(?:vp\s+(?:-C\s+\S+\s+)?run|vpr)(?:\s|$)/.test(command)
+}
+
+/** @param {string} command */
+export function commandUsesTurbo(command) {
+  return /\bturbo(?:\s|$)/.test(command)
+}
+
+/**
+ * Evidence that a repository declares Vite+: the `vite-plus` package in any
+ * dependency table or a script that runs `vp run` / `vpr`.
+ * @param {string} root
+ * @returns {{ declared: boolean, via: string[] }}
+ */
+export function detectVitePlus(root) {
+  const packageJson = readPackageJson(root)
+  /** @type {string[]} */
+  const via = []
+  if (!packageJson) return { declared: false, via }
+  for (const table of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+    if (
+      packageJson[table] &&
+      typeof packageJson[table] === 'object' &&
+      packageJson[table]['vite-plus']
+    )
+      via.push(`${table}.vite-plus`)
+  }
+  const scripts =
+    packageJson.scripts && typeof packageJson.scripts === 'object' ? packageJson.scripts : {}
+  for (const [name, command] of Object.entries(scripts)) {
+    if (typeof command === 'string' && commandUsesVitePlus(command)) via.push(`scripts.${name}`)
+  }
+  return { declared: via.length > 0, via }
+}
+
+/**
+ * Resolve which task runner a repository uses. Never throws: invalid or
+ * unsatisfied configuration falls back to the legacy behavior and is reported
+ * in `warnings` so doctor can surface it.
+ * @param {string} root
+ * @param {Record<string, string>} [config] Defaults to .github/code-foundry.yml.
+ * @returns {ToolResolution}
+ */
+export function resolveMonorepoTool(
+  root,
+  config = readConfig(join(root, '.github/code-foundry.yml'))
+) {
+  /** @type {string[]} */
+  const warnings = []
+  let selected = (config.monorepo_tool ?? '').trim() || 'auto'
+  if (!MONOREPO_TOOLS.includes(selected)) {
+    warnings.push(
+      `unsupported monorepo_tool: ${selected}; use auto, turbo, or vite-plus. Falling back to auto.`
+    )
+    selected = 'auto'
+  }
+  const turbo = hasTurboConfig(root)
+
+  if (selected === 'vite-plus') {
+    const evidence = detectVitePlus(root)
+    if (!evidence.declared)
+      warnings.push(
+        'monorepo_tool: vite-plus but neither a vite-plus dependency nor a `vp run` script was found in package.json.'
+      )
+    return {
+      configured: selected,
+      tool: 'vite-plus',
+      reason: turbo
+        ? 'monorepo_tool: vite-plus (turbo config present but ignored)'
+        : 'monorepo_tool: vite-plus',
+      warnings,
+    }
+  }
+  if (selected === 'turbo') {
+    if (!turbo) warnings.push('monorepo_tool: turbo but no turbo.json or turbo.jsonc was found.')
+    return {
+      configured: selected,
+      tool: turbo ? 'turbo' : 'none',
+      reason: 'monorepo_tool: turbo',
+      warnings,
+    }
+  }
+  return {
+    configured: selected,
+    tool: turbo ? 'turbo' : 'none',
+    reason: turbo ? 'turbo config detected' : 'no task runner configured',
+    warnings,
+  }
+}

package/src/lib/task-filters.mjs

@@ -1,6 +1,10 @@
 // @ts-check
 
 import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { listValue, readConfig } from './config.mjs'
+import { resolveMonorepoTool } from './profile.mjs'
 
 /**
  * Tasks that support `filter_<task>` path filters in code-foundry.yml. A
@@ -151,3 +155,379 @@ export function taskAffected(task, filters, paths) {
   const matchers = globs.map(globToRegExp)
   return paths.some((path) => matchers.some((matcher) => matcher.test(path)))
 }
+
+/**
+ * @typedef {{ name: string, dir: string, dependencies: string[] }} WorkspacePackage
+ * `dir` is repo-relative with forward slashes; the workspace root is ''.
+ */
+/** @typedef {{ label: string, files: string[], read: (path: string) => string }} WorkspaceSource */
+/**
+ * @typedef {{
+ *   tool: 'turbo'|'vite-plus'|'none',
+ *   base: string,
+ *   head: string,
+ *   all: boolean,
+ *   conservative: boolean,
+ *   reason: string,
+ *   mergeBase?: string,
+ *   changedFiles: number,
+ *   packages: string[],
+ *   removedPackages: string[],
+ *   filterArgs: string[],
+ * }} AffectedResult
+ */
+
+const SAFE_REF = /^[A-Za-z0-9._/~^@{}-]+$/
+const SAFE_PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/i
+/** Workspace glob syntax this module cannot evaluate faithfully. */
+const UNSUPPORTED_GLOB = /[{}[\]()+@\\]|^!!|\*\*[^/]|[^/]\*\*/
+
+/** @param {string} ref @param {string} label */
+function assertRef(ref, label) {
+  if (!ref || ref.startsWith('-') || !SAFE_REF.test(ref))
+    throw new Error(`invalid ${label} ref: ${ref}`)
+}
+
+/** @param {string} root @param {string[]} args */
+const git = (root, args) =>
+  execFileSync('git', args, {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 256 * 1024 * 1024,
+  })
+
+/**
+ * Workspace files as of a git ref (committed objects, not the working tree).
+ * @param {string} root
+ * @param {string} ref
+ * @returns {WorkspaceSource}
+ */
+export function gitWorkspaceSource(root, ref) {
+  assertRef(ref, 'workspace')
+  const files = git(root, ['ls-tree', '-r', '-z', '--name-only', ref]).split('\0').filter(Boolean)
+  return { label: ref, files, read: (path) => git(root, ['show', `${ref}:${path}`]) }
+}
+
+/**
+ * Workspace globs from package.json `workspaces` and pnpm-workspace.yaml.
+ * Throws on syntax it cannot evaluate so callers fail closed.
+ * @param {WorkspaceSource} source
+ * @returns {string[]}
+ */
+export function workspaceGlobs(source) {
+  /** @type {string[]} */
+  const globs = []
+  if (source.files.includes('package.json')) {
+    let manifest
+    try {
+      manifest = JSON.parse(source.read('package.json'))
+    } catch {
+      throw new Error(`malformed package.json at ${source.label}`)
+    }
+    const workspaces = manifest.workspaces
+    const list = Array.isArray(workspaces) ? workspaces : workspaces?.packages
+    if (workspaces !== undefined && !Array.isArray(list))
+      throw new Error('unsupported workspaces declaration in package.json')
+    if (Array.isArray(list)) {
+      for (const item of list) {
+        if (typeof item !== 'string') throw new Error('non-string workspace glob in package.json')
+        globs.push(item)
+      }
+    }
+  }
+  if (source.files.includes('pnpm-workspace.yaml')) {
+    let inPackages = false
+    for (const line of source.read('pnpm-workspace.yaml').split(/\r?\n/)) {
+      if (/^packages:\s*$/.test(line)) inPackages = true
+      else if (/^packages:\s*\S/.test(line)) {
+        // Flow style: packages: ['apps/*', 'packages/*']
+        const flow = line.match(/^packages:\s*\[(.*)\]\s*(?:#.*)?$/)
+        if (!flow) throw new Error('unsupported packages declaration in pnpm-workspace.yaml')
+        for (const part of flow[1].split(',')) {
+          const entry = part.trim()
+          if (!entry) continue
+          const item = entry.match(/^(['"]?)([^'"]+)\1$/)
+          if (!item) throw new Error(`unsupported pnpm-workspace.yaml entry: ${entry}`)
+          globs.push(item[2])
+        }
+      } else if (/^\S/.test(line)) inPackages = false
+      else if (inPackages) {
+        if (/^\s*(?:#.*)?$/.test(line)) continue
+        const item = line.match(/^\s*-\s*(['"]?)([^'"#]+?)\1\s*(?:#.*)?$/)
+        if (!item) throw new Error(`unsupported pnpm-workspace.yaml entry: ${line.trim()}`)
+        globs.push(item[2])
+      }
+    }
+  }
+  for (const glob of globs) {
+    const body = glob.startsWith('!') ? glob.slice(1) : glob
+    if (!body || UNSUPPORTED_GLOB.test(body)) throw new Error(`unsupported workspace glob: ${glob}`)
+  }
+  return globs
+}
+
+/**
+ * Workspace packages including the root. Throws when a member cannot be read or named.
+ * @param {WorkspaceSource} source
+ * @returns {WorkspacePackage[]}
+ */
+export function listWorkspacePackages(source) {
+  const globs = workspaceGlobs(source)
+  const includes = globs.filter((glob) => !glob.startsWith('!')).map(globToRegExp)
+  const excludes = globs
+    .filter((glob) => glob.startsWith('!'))
+    .map((glob) => globToRegExp(glob.slice(1)))
+  const directories = source.files
+    .filter((file) => file.endsWith('/package.json') && !file.split('/').includes('node_modules'))
+    .map((file) => file.slice(0, -'/package.json'.length))
+    .filter((dir) => includes.some((re) => re.test(dir)) && !excludes.some((re) => re.test(dir)))
+
+  /** @type {Array<{ name: string, dir: string, manifest: Record<string, any> }>} */
+  const manifests = []
+  /** @param {string} dir @param {boolean} isRoot */
+  const load = (dir, isRoot) => {
+    const path = dir ? `${dir}/package.json` : 'package.json'
+    let manifest
+    try {
+      manifest = JSON.parse(source.read(path))
+    } catch {
+      throw new Error(`malformed manifest ${path} at ${source.label}`)
+    }
+    if (typeof manifest.name === 'string' && manifest.name) {
+      manifests.push({ name: manifest.name, dir, manifest })
+    } else if (isRoot) {
+      manifests.push({ name: '//', dir, manifest })
+    } else {
+      throw new Error(`workspace package ${path} has no name`)
+    }
+  }
+  if (source.files.includes('package.json')) load('', true)
+  for (const dir of directories) load(dir, false)
+
+  const seen = new Set()
+  for (const item of manifests) {
+    if (seen.has(item.name)) throw new Error(`duplicate workspace package name: ${item.name}`)
+    seen.add(item.name)
+  }
+  return manifests.map(({ name, dir, manifest }) => ({
+    name,
+    dir,
+    dependencies: [
+      ...new Set(
+        ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'].flatMap(
+          (table) =>
+            Object.keys(manifest[table] ?? {}).filter((dep) => seen.has(dep) && dep !== name)
+        )
+      ),
+    ],
+  }))
+}
+
+/**
+ * Changed files to affected packages across base and head graphs, so deleted,
+ * renamed, and re-wired packages keep their dependents. An unowned file selects
+ * every package unless `ignore` globs (`affected_ignore`) say otherwise.
+ * @param {WorkspacePackage[][]} graphs Head graph first.
+ * @param {string[]} changedFiles Repo-relative, forward slashes.
+ * @param {string[]} [ignore] Repo-relative globs of unowned files to skip.
+ * @returns {{ all: boolean, packages: string[], reason: string }}
+ */
+export function affectedFromChangedFiles(graphs, changedFiles, ignore = []) {
+  const ignored = ignore.map(globToRegExp)
+  const everything = [...new Set(graphs.flat().map((item) => item.name))].toSorted()
+  const direct = new Set()
+  for (const file of changedFiles) {
+    const owners = new Set()
+    for (const graph of graphs) {
+      const owner = graph
+        .filter((item) => item.dir !== '' && file.startsWith(`${item.dir}/`))
+        .toSorted((a, b) => b.dir.length - a.dir.length)[0]
+      if (owner) owners.add(owner.name)
+    }
+    if (owners.size > 0) {
+      for (const name of owners) direct.add(name)
+    } else if (!ignored.some((re) => re.test(file))) {
+      return { all: true, packages: everything, reason: `shared or unowned file changed: ${file}` }
+    }
+  }
+
+  const dependents = new Map()
+  for (const item of graphs.flat())
+    for (const dep of item.dependencies) {
+      if (!dependents.has(dep)) dependents.set(dep, new Set())
+      dependents.get(dep).add(item.name)
+    }
+  const affected = new Set(direct)
+  const queue = [...direct]
+  while (queue.length) {
+    for (const next of dependents.get(queue.pop()) ?? []) {
+      if (!affected.has(next)) {
+        affected.add(next)
+        queue.push(next)
+      }
+    }
+  }
+  return { all: false, packages: [...affected].toSorted(), reason: 'git diff and workspace graphs' }
+}
+
+/**
+ * `vp run` arguments selecting the given packages (the root is `-w`).
+ * @param {WorkspacePackage[]} packages
+ * @param {string[]} names
+ */
+export function vitePlusFilterArgs(packages, names) {
+  /** @type {string[]} */
+  const args = []
+  for (const name of names) {
+    const item = packages.find((candidate) => candidate.name === name)
+    if (item?.dir === '') args.push('-w')
+    else if (SAFE_PACKAGE_NAME.test(name)) args.push('--filter', name)
+    else throw new Error(`unsafe package name for --filter: ${name}`)
+  }
+  return args
+}
+
+/**
+ * @param {string} root @param {string} base @param {string} head
+ * @returns {string[]}
+ */
+function gitChangedFiles(root, base, head) {
+  assertRef(base, 'base')
+  assertRef(head, 'head')
+  const output = git(root, ['diff', '--name-only', '--no-renames', '-z', `${base}...${head}`, '--'])
+  return output.split('\0').filter(Boolean)
+}
+
+/**
+ * @param {string} root @param {string} base @param {string} head
+ * @param {(command: string, args: string[], cwd: string) => string} run
+ * @returns {string[]} affected package names
+ */
+function turboAffected(root, base, head, run) {
+  assertRef(base, 'base')
+  assertRef(head, 'head')
+  const local = join(root, 'node_modules/.bin/turbo')
+  const output = run(
+    existsSync(local) ? local : 'turbo',
+    ['query', 'affected', '--packages', `--base=${base}`, `--head=${head}`, '--no-update-notifier'],
+    root
+  )
+  const result = JSON.parse(output)
+  const items = result?.data?.affectedPackages?.items ?? result?.data?.affectedTasks?.items
+  if (!Array.isArray(items)) throw new Error('Turbo affected query returned no package/task items')
+  return [
+    ...new Set(
+      items
+        .map(
+          (/** @type {any} */ item) =>
+            item?.name ?? item?.package?.name ?? String(item?.fullName ?? '').split('#')[0]
+        )
+        .filter(Boolean)
+    ),
+  ].toSorted()
+}
+
+/** @type {(command: string, args: string[], cwd: string) => string} */
+const defaultRun = (command, args, cwd) =>
+  execFileSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+  })
+
+/** @param {unknown} error */
+const describe = (error) => (error instanceof Error ? error.message.split('\n')[0] : String(error))
+
+/**
+ * Packages affected between two refs. Turbo uses `turbo query affected`; Vite+
+ * has no such query, so git and the workspace graphs at both refs decide.
+ * Anything unprovable is conservative (`all: true`).
+ * @param {string} root
+ * @param {{ base: string, head: string, tool?: string, run?: (command: string, args: string[], cwd: string) => string }} options
+ * @returns {AffectedResult}
+ */
+export function affectedPackages(root, options) {
+  const config = readConfig(join(root, '.github/code-foundry.yml'))
+  const requested = options.tool && options.tool !== 'auto' ? options.tool : undefined
+  const resolution = resolveMonorepoTool(
+    root,
+    requested ? { ...config, monorepo_tool: requested } : config
+  )
+  const { base, head } = options
+
+  /** @param {Partial<AffectedResult> & { reason: string }} partial @returns {AffectedResult} */
+  const result = (partial) => ({
+    tool: resolution.tool,
+    base,
+    head,
+    all: false,
+    conservative: false,
+    changedFiles: 0,
+    packages: [],
+    removedPackages: [],
+    filterArgs: [],
+    ...partial,
+  })
+  /** @param {string} reason @param {string[]} [names] */
+  const conservative = (reason, names = []) =>
+    result({ all: true, conservative: true, reason, packages: names })
+
+  if (resolution.tool === 'none')
+    return conservative(
+      `no task runner configured (${resolution.reason}); treating all packages as affected`
+    )
+
+  if (resolution.tool === 'turbo') {
+    // Turbo owns its own graph; this module's workspace parsing is never a
+    // prerequisite for the Turbo path.
+    try {
+      return result({
+        reason: 'turbo query affected',
+        packages: turboAffected(root, base, head, options.run ?? defaultRun),
+      })
+    } catch (error) {
+      return conservative(
+        `affected selection failed (${describe(error)}); treating all packages as affected`
+      )
+    }
+  }
+
+  /** @type {string[]} */
+  let headNames = []
+  try {
+    assertRef(base, 'base')
+    assertRef(head, 'head')
+    const headPackages = listWorkspacePackages(gitWorkspaceSource(root, head))
+    headNames = headPackages.map((item) => item.name).toSorted()
+    // One merge-base serves both the historical graph and the diff, so
+    // divergent branches are compared against their real common ancestor.
+    const mergeBase = git(root, ['merge-base', base, head]).trim()
+    const basePackages = listWorkspacePackages(gitWorkspaceSource(root, mergeBase))
+    const files = gitChangedFiles(root, mergeBase, head)
+    const selection = affectedFromChangedFiles(
+      [headPackages, basePackages],
+      files,
+      listValue(config.affected_ignore ?? '')
+    )
+    const existing = selection.packages.filter((name) => headNames.includes(name))
+    const removed = selection.packages.filter((name) => !headNames.includes(name))
+    return result({
+      mergeBase,
+      reason: selection.reason,
+      changedFiles: files.length,
+      all: selection.all,
+      packages: selection.all ? headNames : existing,
+      removedPackages: selection.all ? [] : removed,
+      // An empty selection must stay empty: callers skip the run instead of
+      // passing no filters, which would run every package.
+      filterArgs: selection.all ? [] : vitePlusFilterArgs(headPackages, existing),
+    })
+  } catch (error) {
+    return conservative(
+      `affected selection failed (${describe(error)}); treating all packages as affected`,
+      headNames
+    )
+  }
+}

package/src/templates/workflows/validation-audit.yml

@@ -22,6 +22,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: ./.github/workflows/validation.yml