fg-devkit 1.12.13 → 1.14.2

package/README.md

@@ -102,7 +102,7 @@ Check vulnerabilities for all policy packages together (including transitive dep
 pnpm exec fgd policy-vulns
 ```
 
-Check vulnerabilities for all dependencies in the current repo:
+Check vulnerabilities for all dependencies in the current repo (and nested packages with their own `pnpm-lock.yaml`):
 
 ```bash
 pnpm exec fgd repo-vulns
@@ -126,19 +126,28 @@ If npm audit is rate-limited (429), slow the scan down:
 pnpm exec fgd fleet-vulns --delay-ms=8000
 ```
 
-Upgrade policy versions interactively:
+Upgrade policy versions interactively and auto-commit
+(`dep(package): bump to version`, or `dep(): bump N packages` with a body listing each bump):
 
 ```bash
 pnpm exec fgd policy-upgrade
 ```
 
-Upgrade one package.json dependency and auto-commit (`dep(package): bump to version`):
+Sync dependency policy, run pnpm install, and auto-commit (`chore(repo): sync dependency policy`):
+
+```bash
+pnpm exec fgd sync-deps-commit
+```
+
+Upgrade one or more package.json dependencies and auto-commit
+(`dep(package): bump to version`, or `dep(): bump N packages` with a body listing each bump):
 
 ```bash
 pnpm exec fgd policy-upgrade-commit
 ```
 
-Fix one vulnerability override interactively and auto-commit (`vuln(package): override version`):
+Fix one or more vulnerability overrides interactively and auto-commit
+(`vuln(package): override version`, or `vuln(): override N packages` with a body listing each change):
 
 ```bash
 pnpm exec fgd audit-override-commit

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@11.20.0",
+    "packageManager": "pnpm@11.21.0",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",
@@ -10,16 +10,17 @@
   },
   "managedDependencies": {
     "dependencies": {
+      "@e965/xlsx": "0.20.3",
       "@element-plus/icons-vue": "2.3.2",
       "@lexical/html": "0.49.0",
       "@lexical/list": "0.49.0",
       "@lexical/rich-text": "0.49.0",
+      "@lexical/link": "0.49.0",
       "@piwikpro/vue-piwik-pro": "1.7.1",
-      "@sentry/browser": "10.69.0",
+      "@sentry/browser": "10.70.0",
       "@sentry/tracing": "7.120.4",
-      "@sentry/vue": "10.69.0",
-      "@sentry/wasm": "10.69.0",
-      "@tailwindcss/postcss": "4.3.3",
+      "@sentry/vue": "10.70.0",
+      "@sentry/wasm": "10.70.0",
       "@tanstack/vue-query": "5.101.4",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
@@ -31,7 +32,7 @@
       "chart.js": "4.5.1",
       "content-disposition-header": "0.6.0",
       "date-fns": "4.4.0",
-      "element-plus": "2.14.3",
+      "element-plus": "2.14.4",
       "fds-vue-core": "8.4.3",
       "imask": "7.6.1",
       "leaflet": "1.9.4",
@@ -60,11 +61,11 @@
       "@eslint/js": "9.39.1",
       "@intlify/unplugin-vue-i18n": "11.2.4",
       "@playwright/test": "1.62.1",
-      "@storybook/addon-a11y": "10.5.6",
-      "@storybook/addon-docs": "10.5.6",
-      "@storybook/addon-vitest": "10.5.6",
-      "@storybook/vue3": "10.5.6",
-      "@storybook/vue3-vite": "10.5.6",
+      "@storybook/addon-a11y": "10.5.7",
+      "@storybook/addon-docs": "10.5.7",
+      "@storybook/addon-vitest": "10.5.7",
+      "@storybook/vue3": "10.5.7",
+      "@storybook/vue3-vite": "10.5.7",
       "@tanstack/vue-query-devtools": "6.1.38",
       "@tsconfig/node22": "22.0.5",
       "@types/lodash-es": "4.17.12",
@@ -76,13 +77,12 @@
       "@vue/test-utils": "2.4.11",
       "arg": "5.0.2",
       "babel-eslint": "10.1.0",
-      "eslint-plugin-storybook": "10.5.6",
+      "eslint-plugin-storybook": "10.5.7",
       "globals": "15.11.0",
       "jsdom": "26.1.0",
-      "postcss": "8.5.26",
       "sass": "1.102.0",
-      "storybook": "10.5.6",
-      "tsx": "4.23.9",
+      "storybook": "10.5.7",
+      "tsx": "4.23.12",
       "vega": "6.3.1",
       "vite-plugin-dts": "4.5.4",
       "vite-plugin-vue-devtools": "8.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.12.13",
+  "version": "1.14.2",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -56,6 +56,7 @@
     "./scripts/audit-override-commit.mjs": "./scripts/audit-override-commit.mjs",
     "./scripts/check-dependency-policy.mjs": "./scripts/check-dependency-policy.mjs",
     "./scripts/sync-dependency-policy.mjs": "./scripts/sync-dependency-policy.mjs",
+    "./scripts/sync-dependency-policy-commit.mjs": "./scripts/sync-dependency-policy-commit.mjs",
     "./scripts/resolve-dependency-policy-path.mjs": "./scripts/resolve-dependency-policy-path.mjs",
     "./scripts/refresh-dependency-policy-from-repos.mjs": "./scripts/refresh-dependency-policy-from-repos.mjs",
     "./scripts/sync-scaffold-vue-deps.mjs": "./scripts/sync-scaffold-vue-deps.mjs",
@@ -106,13 +107,13 @@
     "@inquirer/input": "5.1.2",
     "@inquirer/select": "5.2.1",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
-    "@typescript-eslint/eslint-plugin": "8.66.0",
-    "@typescript-eslint/parser": "8.66.0",
-    "@vitest/eslint-plugin": "1.6.26",
+    "@typescript-eslint/eslint-plugin": "8.67.0",
+    "@typescript-eslint/parser": "8.67.0",
+    "@vitest/eslint-plugin": "1.6.27",
     "@vue/eslint-config-prettier": "10.2.0",
     "@vue/eslint-config-typescript": "14.9.0",
     "@vue/tsconfig": "0.9.1",
-    "eslint": "10.8.0",
+    "eslint": "10.8.1",
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-vue": "10.10.0",
     "fallow": "2.101.0",
@@ -120,13 +121,19 @@
     "lefthook": "2.1.10",
     "npm-check-updates": "22.2.7",
     "prettier": "3.9.6",
-    "tsx": "4.23.9",
+    "tsx": "4.23.12",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.1",
     "vue-tsc": "3.3.9"
   },
   "devDependencies": {
-    "cz-git": "1.13.1",
-    "czg": "1.13.1"
+    "cz-git": "1.13.2",
+    "czg": "1.13.2"
+  },
+  "scripts": {
+    "maintainer-ui": "pnpm --dir electron/maintainer-ui start",
+    "maintainer-ui:install": "pnpm --dir electron/maintainer-ui install",
+    "fgd-ui": "pnpm --dir electron/maintainer-ui start",
+    "fgd-ui:install": "pnpm --dir electron/maintainer-ui install"
   }
 }

package/scaffold/vue/package.json

@@ -15,7 +15,6 @@
     "poeditor:upload": "pnpm exec fg-devkit poeditor-upload"
   },
   "dependencies": {
-    "@tailwindcss/postcss": "4.3.3",
     "@tailwindcss/vite": "4.3.3",
     "@tanstack/vue-query": "5.101.4",
     "axios": "1.19.0",
@@ -34,12 +33,12 @@
     "@tanstack/vue-query-devtools": "6.1.38",
     "@types/node": "22.16.5",
     "@vitejs/plugin-vue": "6.0.8",
-    "fg-devkit": "1.12.13",
+    "fg-devkit": "1.14.2",
     "tailwindcss": "4.3.3",
-    "tsx": "4.23.9",
+    "tsx": "4.23.12",
     "vite": "7.3.5"
   },
-  "packageManager": "pnpm@11.20.0",
+  "packageManager": "pnpm@11.21.0",
   "engines": {
     "node": ">=22.13.0"
   }

package/scripts/audit-override-commit.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Fix one vulnerability via `pnpm audit --fix override -i`, install, then auto-commit.
+ * Fix one or more vulnerabilities via `pnpm audit --fix override -i`, install, then auto-commit.
  *
  * Usage:
  *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
@@ -150,14 +150,11 @@ function main() {
     console.log('[audit-override-commit] No override changes detected.')
     process.exit(0)
   }
-  if (changed.length > 1) {
-    console.log('[audit-override-commit] Multiple override changes detected:')
-    for (const item of changed) {
-      const fromLabel = item.from ?? '(missing)'
-      console.log(`  - ${item.name}: ${fromLabel} -> ${item.to}`)
-    }
-    console.log('[audit-override-commit] Auto-commit supports exactly one override change. Commit manually.')
-    process.exit(1)
+
+  console.log('[audit-override-commit] Override changes detected:')
+  for (const item of changed) {
+    const fromLabel = item.from ?? '(missing)'
+    console.log(`  - ${item.name}: ${fromLabel} -> ${item.to}`)
   }
 
   const installExitCode = runPnpm(['install'])
@@ -165,16 +162,30 @@ function main() {
     process.exit(installExitCode)
   }
 
-  const [only] = changed
   const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
   if (stageExitCode !== 0) {
     process.exit(stageExitCode)
   }
 
-  const commitMessage = `vuln(${only.name}): override ${only.to}`
-  console.log(`[audit-override-commit] Staged override for ${only.name} -> ${only.to}`)
-  console.log(`[audit-override-commit] Auto-committing: ${commitMessage}`)
-  process.exit(runGit(['commit', '-m', commitMessage]))
+  const { subject, body } = buildCommitMessage(changed)
+  console.log(`[audit-override-commit] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  process.exit(runGit(commitArgs))
+}
+
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `vuln(${only.name}): override ${only.to}`, body: '' }
+  }
+
+  const body = changed
+    .map((item) => `- ${item.name}: ${item.from ?? '(missing)'} -> ${item.to}`)
+    .join('\n')
+  return { subject: `vuln(): override ${changed.length} packages`, body }
 }
 
 main()

package/scripts/fg-devkit.mjs

@@ -5,6 +5,7 @@
  * Non-interactive (for scripts and automation):
  *   pnpm exec fg-devkit check-deps [policy-file]
  *   pnpm exec fg-devkit sync-deps [policy-file]
+ *   pnpm exec fg-devkit sync-deps-commit [policy-file]
  *   pnpm exec fg-devkit policy-outdated [policy-file]
  *   pnpm exec fg-devkit policy-vulns [policy-file]
  *   pnpm exec fg-devkit repo-vulns
@@ -458,6 +459,7 @@ function runSyncConfigTarget(target) {
 const DIRECT_COMMANDS = {
   'check-deps': 'check-dependency-policy.mjs',
   'sync-deps': 'sync-dependency-policy.mjs',
+  'sync-deps-commit': 'sync-dependency-policy-commit.mjs',
   'policy-outdated': 'policy-outdated.mjs',
   'policy-vulns': 'policy-vulns.mjs',
   'repo-vulns': 'repo-vulns.mjs',
@@ -498,9 +500,10 @@ function printHelp() {
 Commands:
   check-deps [policy-file]        Validate package.json + pins + toolchain against policy
   sync-deps [policy-file]         Align declared versions, packageManager, and Node toolchain to policy
+  sync-deps-commit [policy-file]  Sync dependency policy, pnpm install, then auto-commit
   policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
   policy-vulns [policy-file]      Check all policy packages together (including transitives) via pnpm audit
-  repo-vulns                      Check all repo dependencies for vulnerabilities via pnpm audit
+  repo-vulns                      Check repo + nested lockfile packages via pnpm audit
   fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
                                  Run pnpm audit across Vue repos (full output + combined summary)
   fleet-bump-fg-devkit [projects-root] [--dry-run]
@@ -532,11 +535,11 @@ Commands:
                                  Maintainer: discard tracked git changes in chosen repositories
                                  Options: --dry-run, --fg-devkit-only, --pick, --all, --only=a,b
   policy-upgrade [policy-file] [ncu-args...]
-                                 Upgrade policy packages via npm-check-updates (default interactive)
+                                 Upgrade policy packages via ncu (interactive) and auto-commit
   policy-upgrade-commit [ncu-args...]
-                                 Upgrade one consumer package.json package and auto-commit
+                                 Upgrade one or more consumer package.json packages and auto-commit
   audit-override-commit [pnpm-audit-args...]
-                                 Fix one vulnerability override via pnpm audit and auto-commit
+                                 Fix one or more vulnerability overrides via pnpm audit and auto-commit
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -781,9 +784,9 @@ async function runInteractiveMenu() {
         message: 'Dependecy policy',
         choices: [
           { name: 'Check', value: 'check' },
-          { name: 'Sync', value: 'sync' },
-          { name: 'Upgrade one package.json package and auto-commit', value: 'upgrade-commit' },
-          { name: 'Fix one vulnerability override and auto-commit', value: 'audit-override-commit' },
+          { name: 'Sync and auto-commit', value: 'sync-commit' },
+          { name: 'Upgrade package.json packages and auto-commit', value: 'upgrade-commit' },
+          { name: 'Fix vulnerability overrides and auto-commit', value: 'audit-override-commit' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'check',
@@ -791,7 +794,9 @@ async function runInteractiveMenu() {
       })
       if (choice === 'cancel') continue
       if (choice === 'check') return runSelectedAction(() => runNode('check-dependency-policy.mjs'))
-      if (choice === 'sync') return runSelectedAction(() => runNode('sync-dependency-policy.mjs'))
+      if (choice === 'sync-commit') {
+        return runSelectedAction(() => runNode('sync-dependency-policy-commit.mjs'))
+      }
       if (choice === 'audit-override-commit') {
         return runSelectedAction(() => runNode('audit-override-commit.mjs'))
       }
@@ -852,7 +857,7 @@ async function runInteractiveMenu() {
         message: 'Maintainer',
         choices: [
           { name: 'Show outdated dependency policy packages', value: 'm1' },
-          { name: 'Upgrade dependency policy (interactive)', value: 'm2' },
+          { name: 'Upgrade dependency policy (interactive) and auto-commit', value: 'm2' },
           { name: 'Refresh dependency policy from repos (and scaffold/vue package.json)', value: 'm3' },
           { name: 'Check policy vulnerabilities (audit)', value: 'm4' },
           { name: 'Check fg-devkit repo vulnerabilities', value: 'm5' },

package/scripts/fleet-bump-fg-devkit.mjs

@@ -3,47 +3,86 @@
  * Bumps fg-devkit to latest in Vue repositories, syncs dependency policy, and runs pnpm install.
  *
  * Usage:
- *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [--dry-run]
+ *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [options]
+ *
+ * Options:
+ *   --dry-run         Print planned bumps without changing files or installing
+ *   --all             Run on all matching Vue repos (default when not picking)
+ *   --fg-devkit-only  No-op for this command (fg-devkit is not a consumer of itself)
+ *   --pick            Interactive checkbox (TTY); prefer --only= from automation/UI
+ *   --only=a,b        Run only on matching repos (basename or path under projects root)
  */
 
+import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
 import { collectFleetVueRepos } from './fleet-vue-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
-const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
-const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
+const fgDevkitOnly = cliArgs.includes('--fg-devkit-only')
+const { pick, all, only, filteredArgs: positionalArgs } = parseFleetSelectionFlags(cliArgs)
+const projectsRootArg = positionalArgs.find((a) => !a.startsWith('-'))
+const projectsRoot = projectsRootArg
+  ? path.resolve(process.cwd(), projectsRootArg)
+  : path.resolve(scriptDir, '../..')
+
+const LOG_PREFIX = '[fleet-bump-fg-devkit]'
+
+if (fgDevkitOnly) {
+  console.log(
+    `${LOG_PREFIX} Nothing to do for fg-devkit only — bump targets Vue consumer repos that depend on fg-devkit.`,
+  )
+  process.exit(0)
+}
+
+if (!fs.existsSync(projectsRoot)) {
+  console.error(`${LOG_PREFIX} projects root not found: ${projectsRoot}`)
+  process.exit(1)
+}
+
+const allRepos = collectFleetVueRepos(projectsRoot)
+if (allRepos.length === 0) {
+  console.log(`${LOG_PREFIX} No Vue repositories with fg-devkit found under ${projectsRoot}`)
+  process.exit(0)
+}
+
+const uniqueRepos = await resolveFleetRepos(allRepos, projectsRoot, {
+  pick,
+  only,
+  all: all || (!pick && !only),
+  message: 'Select Vue repositories to bump fg-devkit',
+})
 
-const uniqueRepos = collectFleetVueRepos(projectsRoot)
 if (uniqueRepos.length === 0) {
-  console.log(`[fleet-bump-fg-devkit] No Vue repositories with fg-devkit found under ${projectsRoot}`)
+  console.log(`${LOG_PREFIX} No repositories selected.`)
   process.exit(0)
 }
 
-console.log(`[fleet-bump-fg-devkit] projectsRoot=${projectsRoot}`)
-console.log(`[fleet-bump-fg-devkit] repositories=${uniqueRepos.length}`)
+console.log(`${LOG_PREFIX} projectsRoot=${projectsRoot}`)
+console.log(`${LOG_PREFIX} repositories=${uniqueRepos.length}`)
 
 let failures = 0
 let updated = 0
 
 for (const repoDir of uniqueRepos) {
-  const repoName = path.basename(repoDir)
+  const repoName = path.relative(projectsRoot, repoDir).split(path.sep).join('/') || path.basename(repoDir)
   const bumpArgs = ['up', 'fg-devkit@latest']
   const syncDepsArgs = ['exec', 'fg-devkit', 'sync-deps']
   const installArgs = ['install']
 
   if (dryRun) {
-    console.log(`[fleet-bump-fg-devkit] DRY RUN ${repoName}: pnpm ${bumpArgs.join(' ')}`)
-    console.log(`[fleet-bump-fg-devkit] DRY RUN ${repoName}: pnpm ${syncDepsArgs.join(' ')}`)
-    console.log(`[fleet-bump-fg-devkit] DRY RUN ${repoName}: pnpm ${installArgs.join(' ')}`)
+    console.log(`${LOG_PREFIX} DRY RUN ${repoName}: pnpm ${bumpArgs.join(' ')}`)
+    console.log(`${LOG_PREFIX} DRY RUN ${repoName}: pnpm ${syncDepsArgs.join(' ')}`)
+    console.log(`${LOG_PREFIX} DRY RUN ${repoName}: pnpm ${installArgs.join(' ')}`)
     continue
   }
 
-  console.log(`\n[fleet-bump-fg-devkit] Updating ${repoName}`)
+  console.log(`\n${LOG_PREFIX} Updating ${repoName}`)
   const bump = spawnSync('pnpm', bumpArgs, {
     cwd: repoDir,
     stdio: 'inherit',
@@ -56,14 +95,14 @@ for (const repoDir of uniqueRepos) {
 
   if (bump.error) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: ${bump.error.message}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: ${bump.error.message}`)
     continue
   }
 
   const bumpStatus = bump.status ?? 1
   if (bumpStatus !== 0) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: pnpm up exited with code ${bumpStatus}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: pnpm up exited with code ${bumpStatus}`)
     continue
   }
 
@@ -79,14 +118,14 @@ for (const repoDir of uniqueRepos) {
 
   if (syncDeps.error) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: ${syncDeps.error.message}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: ${syncDeps.error.message}`)
     continue
   }
 
   const syncDepsStatus = syncDeps.status ?? 1
   if (syncDepsStatus !== 0) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: sync-deps exited with code ${syncDepsStatus}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: sync-deps exited with code ${syncDepsStatus}`)
     continue
   }
 
@@ -102,20 +141,20 @@ for (const repoDir of uniqueRepos) {
 
   if (install.error) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: ${install.error.message}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: ${install.error.message}`)
     continue
   }
 
   const status = install.status ?? 1
   if (status !== 0) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: pnpm install exited with code ${status}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: pnpm install exited with code ${status}`)
     continue
   }
 
   updated += 1
-  console.log(`[fleet-bump-fg-devkit] OK ${repoName}`)
+  console.log(`${LOG_PREFIX} OK ${repoName}`)
 }
 
-console.log(`\n[fleet-bump-fg-devkit] Done: updated=${updated}, failed=${failures}`)
+console.log(`\n${LOG_PREFIX} Done: updated=${updated}, failed=${failures}`)
 process.exit(failures > 0 ? 1 : 0)

package/scripts/fleet-vulns.mjs

@@ -4,7 +4,7 @@
  * pnpm audit output and a combined summary.
  *
  * Usage:
- *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+ *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>] [--dry-run] [--only=a,b]
  */
 
 import fs from 'node:fs'
@@ -12,10 +12,13 @@ import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { isFgDevkitRepoDir } from './fleet-project-repos.mjs'
+import { filterReposByOnly, parseFleetOnlyArg } from './fleet-repo-picker.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const summaryOnly = cliArgs.includes('--summary-only')
+const dryRun = cliArgs.includes('--dry-run')
+const only = parseFleetOnlyArg(cliArgs)
 const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
 const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
 const delayArg = cliArgs.find((a) => a.startsWith('--delay-ms='))
@@ -63,7 +66,16 @@ for (const packageJsonPath of packageJsonFiles) {
   }
 }
 
-const uniqueRepos = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+const uniqueReposAll = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+let uniqueRepos = uniqueReposAll
+if (only?.length) {
+  uniqueRepos = filterReposByOnly(uniqueReposAll, projectsRoot, only)
+  if (uniqueRepos.length === 0) {
+    console.error(`[fleet-vulns] No repositories matched --only=${only.join(',')}`)
+    process.exit(1)
+  }
+}
+
 if (uniqueRepos.length === 0) {
   console.log(`[fleet-vulns] No pnpm repositories found under ${projectsRoot}`)
   process.exit(0)
@@ -72,6 +84,16 @@ if (uniqueRepos.length === 0) {
 console.log(`[fleet-vulns] projectsRoot=${projectsRoot}`)
 console.log(`[fleet-vulns] repositories=${uniqueRepos.length}`)
 
+if (dryRun) {
+  console.log('[fleet-vulns] DRY RUN — would audit:')
+  for (const repoDir of uniqueRepos) {
+    const rel = path.relative(projectsRoot, repoDir).split(path.sep).join('/') || path.basename(repoDir)
+    const hasLock = fs.existsSync(path.join(repoDir, 'pnpm-lock.yaml'))
+    console.log(`  - ${rel}${hasLock ? '' : ' (missing pnpm-lock.yaml → skip)'}`)
+  }
+  process.exit(0)
+}
+
 const results = []
 let hasFailures = false
 let hasVulnerabilities = false

package/scripts/policy-upgrade-commit.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Upgrade one package in the consumer package.json, then auto-commit.
+ * Upgrade one or more packages in the consumer package.json, then auto-commit.
  *
  * Usage:
  *   pnpm exec fg-devkit policy-upgrade-commit [ncu-args...]
@@ -87,6 +87,21 @@ function collectPackageVersionChanges(beforePackage, afterPackage) {
   return changed
 }
 
+/** ncu can upgrade package.json `packageManager` (e.g. pnpm@x.y.z); treat as one bump. */
+function collectPackageManagerChange(beforePackage, afterPackage) {
+  const before = beforePackage.packageManager
+  const after = afterPackage.packageManager
+  if (after === undefined || after === before) {
+    return null
+  }
+  const match = typeof after === 'string' ? after.match(/^pnpm@(.+)$/i) : null
+  return {
+    name: 'pnpm',
+    from: before ?? '(missing)',
+    to: match ? match[1] : after,
+  }
+}
+
 function main() {
   if (!fs.existsSync(packageJsonPath)) {
     console.error(`[policy-upgrade-commit] package.json not found at ${packageJsonPath}`)
@@ -115,29 +130,43 @@ function main() {
   }
 
   const changed = collectPackageVersionChanges(beforePackage, afterPackage)
+  const packageManagerChange = collectPackageManagerChange(beforePackage, afterPackage)
+  if (packageManagerChange) {
+    changed.push(packageManagerChange)
+  }
+
   if (changed.length === 0) {
     console.log('[policy-upgrade-commit] No package version changes detected in package.json.')
     process.exit(0)
   }
-  if (changed.length > 1) {
-    console.log('[policy-upgrade-commit] Multiple package changes detected in package.json:')
-    for (const item of changed) {
-      console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
-    }
-    console.log('[policy-upgrade-commit] Auto-commit supports exactly one changed package. Commit manually.')
-    process.exit(1)
+
+  console.log('[policy-upgrade-commit] Package version changes detected in package.json:')
+  for (const item of changed) {
+    console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
   }
 
-  const [only] = changed
   const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
   if (stageExitCode !== 0) {
     process.exit(stageExitCode)
   }
 
-  const commitMessage = `dep(${only.name}): bump to ${only.to}`
-  console.log(`[policy-upgrade-commit] Staged changes for ${only.name} -> ${only.to}`)
-  console.log(`[policy-upgrade-commit] Auto-committing: ${commitMessage}`)
-  process.exit(runGit(['commit', '-m', commitMessage]))
+  const { subject, body } = buildCommitMessage(changed)
+  console.log(`[policy-upgrade-commit] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  process.exit(runGit(commitArgs))
+}
+
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `dep(${only.name}): bump to ${only.to}`, body: '' }
+  }
+
+  const body = changed.map((item) => `- ${item.name}: ${item.from} -> ${item.to}`).join('\n')
+  return { subject: `dep(): bump ${changed.length} packages`, body }
 }
 
 main()

package/scripts/policy-upgrade.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /**
- * Upgrades dependency policy package versions through npm-check-updates.
- * It projects the policy into a temporary package.json, runs ncu, then writes
- * selected versions back to the policy file.
+ * Upgrades dependency policy package versions through npm-check-updates, then auto-commits.
+ * It projects the policy into a temporary package.json, runs ncu, writes selected versions
+ * back to the policy file, syncs scaffold, and commits.
  *
  * Usage:
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
@@ -22,6 +22,7 @@ import { syncScaffoldVueDepsFromPolicy } from './sync-scaffold-vue-deps.mjs'
 
 const require = createRequire(import.meta.url)
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(`Usage:
@@ -42,7 +43,60 @@ function readJson(p) {
   return JSON.parse(fs.readFileSync(p, 'utf8'))
 }
 
+function collectPolicyVersions(policy) {
+  return {
+    ...(policy.managedDependencies?.dependencies ?? {}),
+    ...(policy.managedDependencies?.devDependencies ?? {}),
+    ...(policy.managedAnywhere ?? {}),
+  }
+}
+
+function collectVersionChanges(before, after) {
+  const changed = []
+  for (const [name, newVersion] of Object.entries(after)) {
+    const previousVersion = before[name]
+    if (previousVersion !== undefined && previousVersion !== newVersion) {
+      changed.push({ name, from: previousVersion, to: newVersion })
+    }
+  }
+  return changed
+}
+
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `dep(${only.name}): bump to ${only.to}`, body: '' }
+  }
+
+  const body = changed.map((item) => `- ${item.name}: ${item.from} -> ${item.to}`).join('\n')
+  return { subject: `dep(): bump ${changed.length} packages`, body }
+}
+
+function runGit(args) {
+  const result = spawnSync('git', args, {
+    stdio: 'inherit',
+    cwd: fgDevkitRoot,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[policy-upgrade]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function stageExistingFiles(files) {
+  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(fgDevkitRoot, filePath)))
+  if (existingFiles.length === 0) return 0
+  return runGit(['add', '--', ...existingFiles])
+}
+
+function toRepoRelative(absolutePath) {
+  return path.relative(fgDevkitRoot, absolutePath)
+}
+
 const policy = readJson(policyPath)
+const beforeVersions = collectPolicyVersions(policy)
 
 const depNames = new Set(Object.keys(policy.managedDependencies?.dependencies ?? {}))
 const devNames = new Set(Object.keys(policy.managedDependencies?.devDependencies ?? {}))
@@ -115,6 +169,34 @@ for (const [name, version] of Object.entries(updatedDevDeps)) {
 }
 
 fs.writeFileSync(policyPath, `${JSON.stringify(policy, null, 2)}\n`, 'utf8')
-const fgDevkitRoot = path.resolve(scriptDir, '..')
 syncScaffoldVueDepsFromPolicy({ fgDevkitRoot, policyPath })
-console.log('[policy-upgrade] Updated dependency policy from selected ncu changes.')
+
+const afterPolicy = readJson(policyPath)
+const changed = collectVersionChanges(beforeVersions, collectPolicyVersions(afterPolicy))
+
+if (changed.length === 0) {
+  console.log('[policy-upgrade] No package version changes detected in dependency policy.')
+  process.exit(0)
+}
+
+console.log('[policy-upgrade] Package version changes detected in dependency policy:')
+for (const item of changed) {
+  console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
+}
+
+const stageExitCode = stageExistingFiles([
+  toRepoRelative(policyPath),
+  'scaffold/vue/package.json',
+  'scaffold/vue/Dockerfile.local',
+])
+if (stageExitCode !== 0) {
+  process.exit(stageExitCode)
+}
+
+const { subject, body } = buildCommitMessage(changed)
+console.log(`[policy-upgrade] Auto-committing: ${subject}`)
+if (body) {
+  console.log(body)
+}
+const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+process.exit(runGit(commitArgs))

package/scripts/repo-vulns.mjs

@@ -1,26 +1,83 @@
 #!/usr/bin/env node
 /**
  * Checks vulnerabilities for the full dependency graph in the current repository
- * by running `pnpm audit` in the working directory.
+ * by running `pnpm audit` in the working directory and any nested packages that
+ * have their own pnpm-lock.yaml (e.g. electron/maintainer-ui in fg-devkit).
  *
  * Usage:
  *   pnpm exec fg-devkit repo-vulns
  */
 
+import fs from 'node:fs'
+import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 
-console.log(`[repo-vulns] cwd=${process.cwd()}`)
-const audit = spawnSync('pnpm', ['audit'], {
-  cwd: process.cwd(),
-  stdio: 'inherit',
-  env: process.env,
-})
-if (audit.error) {
-  console.error('[repo-vulns]', audit.error.message)
-  process.exit(1)
+const root = process.cwd()
+
+const SKIP_DIR_NAMES = new Set([
+  'node_modules',
+  '.git',
+  '.next',
+  'dist',
+  'build',
+  'coverage',
+  'storybook-static',
+])
+
+/**
+ * @param {string} dir
+ * @param {string[]} [acc]
+ * @returns {string[]}
+ */
+function findNestedLockfileDirs(dir, acc = []) {
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!item.isDirectory()) continue
+    if (SKIP_DIR_NAMES.has(item.name) || item.name.startsWith('.')) continue
+    const child = path.join(dir, item.name)
+    if (
+      fs.existsSync(path.join(child, 'pnpm-lock.yaml')) &&
+      fs.existsSync(path.join(child, 'package.json'))
+    ) {
+      acc.push(child)
+    }
+    findNestedLockfileDirs(child, acc)
+  }
+  return acc
 }
-// pnpm audit returns exit code 1 when vulnerabilities are found.
-if ((audit.status ?? 1) === 1) {
-  process.exit(0)
+
+/**
+ * @param {string} dir
+ * @param {string} label
+ * @returns {number}
+ */
+function auditDir(dir, label) {
+  console.log(`\n[repo-vulns] Auditing ${label}`)
+  console.log(`[repo-vulns] cwd=${dir}`)
+  const audit = spawnSync('pnpm', ['audit'], {
+    cwd: dir,
+    stdio: 'inherit',
+    env: process.env,
+  })
+  if (audit.error) {
+    console.error('[repo-vulns]', audit.error.message)
+    return 1
+  }
+  return audit.status ?? 1
 }
-process.exit(audit.status ?? 1)
+
+const nested = findNestedLockfileDirs(root).sort((a, b) => a.localeCompare(b))
+const targets = [root, ...nested]
+
+console.log(`[repo-vulns] packages=${targets.length}`)
+
+let worstFailure = 0
+
+for (const dir of targets) {
+  const label = dir === root ? '.' : path.relative(root, dir).split(path.sep).join('/')
+  const code = auditDir(dir, label)
+  // pnpm audit returns exit code 1 when vulnerabilities are found — treat as ok.
+  if (code === 0 || code === 1) continue
+  worstFailure = code || 1
+}
+
+process.exit(worstFailure)

package/scripts/resolve-dependency-policy-path.mjs

@@ -2,7 +2,7 @@
  * Resolves which dependency policy JSON file check/sync scripts should load.
  *
  * Used by check-dependency-policy.mjs and sync-dependency-policy.mjs so both tools share one rule:
- * optional argv[2] override, otherwise the packaged default next to this package.
+ * optional argv[2] override (ignored when it looks like a CLI flag), otherwise the packaged default.
  */
 
 import fs from 'node:fs'
@@ -17,8 +17,10 @@ const DEFAULT_POLICY = 'dependency-policy.vue-workspace.json'
  * - Relative path: if it exists under cwd, use it; else fg-devkit/configs/<arg>
  */
 export function resolveDependencyPolicyPath(scriptDir, cwd, argv) {
+  // Optional policy path is argv[2] only when it is not an option flag
+  // (e.g. `policy-upgrade --interactive` must use the default policy file).
   const arg = argv[2]
-  if (!arg) {
+  if (!arg || arg.startsWith('-')) {
     return path.resolve(scriptDir, '../configs', DEFAULT_POLICY)
   }
   if (path.isAbsolute(arg)) {

package/scripts/sync-dependency-policy-commit.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+/**
+ * Sync dependency policy into the consumer repo, run pnpm install, then auto-commit.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit sync-deps-commit [policy-file]
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const cwd = process.cwd()
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const syncScriptPath = path.join(scriptDir, 'sync-dependency-policy.mjs')
+const commitMessage = 'chore(repo): sync dependency policy'
+
+function runSync(args) {
+  const result = spawnSync(process.execPath, [syncScriptPath, ...args], {
+    encoding: 'utf8',
+    cwd,
+    env: process.env,
+  })
+  if (result.stdout) process.stdout.write(result.stdout)
+  if (result.stderr) process.stderr.write(result.stderr)
+  if (result.error) {
+    console.error('[sync-deps-commit]', result.error.message)
+    return { status: 1, stdout: '' }
+  }
+  return { status: result.status ?? 1, stdout: result.stdout ?? '' }
+}
+
+function runPnpm(args) {
+  const result = spawnSync('pnpm', args, {
+    stdio: 'inherit',
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[sync-deps-commit]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function runGit(args, options = {}) {
+  const result = spawnSync('git', args, {
+    stdio: options.capture ? 'pipe' : 'inherit',
+    encoding: options.capture ? 'utf8' : undefined,
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[sync-deps-commit]', result.error.message)
+    return { status: 1, stdout: '' }
+  }
+  return { status: result.status ?? 1, stdout: result.stdout ?? '' }
+}
+
+function listTrackedFiles() {
+  const result = runGit(['ls-files', '-z'], { capture: true })
+  if (result.status !== 0) return []
+  return result.stdout.split('\0').filter(Boolean)
+}
+
+function isSyncRelatedPath(filePath) {
+  const base = path.basename(filePath)
+  if (
+    base === 'package.json' ||
+    base === 'pnpm-lock.yaml' ||
+    base === 'pnpm-workspace.yaml' ||
+    base === '.nvmrc' ||
+    base === '.node-version' ||
+    base === 'Dockerfile' ||
+    base === 'Dockerfile.local' ||
+    base === 'Jenkinsfile'
+  ) {
+    return true
+  }
+  if (filePath.includes(`${path.sep}.github${path.sep}workflows${path.sep}`) || filePath.startsWith('.github/workflows/')) {
+    return /\.(ya?ml)$/i.test(base)
+  }
+  return base.endsWith('.sh')
+}
+
+function fileDiffersFromHead(filePath) {
+  const absolutePath = path.join(cwd, filePath)
+  if (!fs.existsSync(absolutePath)) return false
+
+  const tracked = runGit(['ls-files', '--error-unmatch', '--', filePath], { capture: true })
+  if (tracked.status !== 0) {
+    return true
+  }
+
+  const diff = runGit(['diff', '--quiet', 'HEAD', '--', filePath], { capture: true })
+  return diff.status !== 0
+}
+
+function stageExistingFiles(files) {
+  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(cwd, filePath)))
+  if (existingFiles.length === 0) return 0
+  return runGit(['add', '--', ...existingFiles]).status
+}
+
+function main() {
+  const syncResult = runSync(process.argv.slice(2))
+  if (syncResult.status !== 0) {
+    process.exit(syncResult.status)
+  }
+
+  if (syncResult.stdout.includes('already match dependency policy')) {
+    console.log('[sync-deps-commit] Nothing to install or commit.')
+    process.exit(0)
+  }
+
+  const installExitCode = runPnpm(['install'])
+  if (installExitCode !== 0) {
+    process.exit(installExitCode)
+  }
+
+  const candidateFiles = new Set([
+    'package.json',
+    'pnpm-lock.yaml',
+    'pnpm-workspace.yaml',
+    '.nvmrc',
+    '.node-version',
+    'Dockerfile',
+    'Dockerfile.local',
+    'Jenkinsfile',
+  ])
+  for (const filePath of listTrackedFiles()) {
+    if (isSyncRelatedPath(filePath)) {
+      candidateFiles.add(filePath)
+    }
+  }
+
+  const filesToStage = [...candidateFiles].filter((filePath) => fileDiffersFromHead(filePath))
+  if (filesToStage.length === 0) {
+    console.log('[sync-deps-commit] No sync-related changes to commit.')
+    process.exit(0)
+  }
+
+  const stageExitCode = stageExistingFiles(filesToStage)
+  if (stageExitCode !== 0) {
+    process.exit(stageExitCode)
+  }
+
+  console.log(`[sync-deps-commit] Staged ${filesToStage.length} file(s)`)
+  console.log(`[sync-deps-commit] Auto-committing: ${commitMessage}`)
+  process.exit(runGit(['commit', '-m', commitMessage]).status)
+}
+
+main()