lintlane 2.5.0 → 4.0.0

package/bin/cli.mjs

@@ -1,68 +1,31 @@
-#!/usr/bin/env bun
+#!/usr/bin/env node
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { $ } from "bun";
-
-const KIT_DIR = join(import.meta.dir, "..");
-const KIT_PKG = await Bun.file(join(KIT_DIR, "package.json")).json();
+import { resolveChecks } from "./checks.mjs";
+import { binPath, resolveBiome, runInherit, runProcess } from "./proc.mjs";
+import {
+  COMMITIZEN_PATH,
+  classifyHook,
+  detectPackageManager,
+  detectPreset,
+  hasCommitlintConfig,
+  hasLintStagedConfig,
+  installCommand,
+  LINT_STAGED_CONFIG,
+  PRESET_PATHS,
+  renderWorkflow,
+  runnerCommand,
+} from "./project.mjs";
+
+const KIT_DIR = join(dirname(fileURLToPath(import.meta.url)), "..");
+const readJson = async (path) => JSON.parse(await readFile(path, "utf8"));
+const KIT_PKG = await readJson(join(KIT_DIR, "package.json"));
 const KIT_NAME = KIT_PKG.name;
 const KIT_VERSION = KIT_PKG.version;
-
-const PRESET_PATHS = {
-  base: "biome",
-  strict: "biome/strict",
-  next: "biome/next",
-};
-
-const PACKAGE_MANAGERS = {
-  bun: {
-    lockfile: "bun.lock",
-    install: (pkgs) => ["bun", "add", "--dev", "--exact", ...pkgs],
-    runCheckCi: "bunx biome ci --reporter=github .",
-    setupSteps: [
-      "      - uses: oven-sh/setup-bun@v2",
-      "      - run: bun install --frozen-lockfile",
-    ],
-  },
-  npm: {
-    lockfile: "package-lock.json",
-    install: (pkgs) => ["npm", "install", "--save-dev", "--save-exact", ...pkgs],
-    runCheckCi: "npx biome ci --reporter=github .",
-    setupSteps: [
-      "      - uses: actions/setup-node@v4",
-      "        with:",
-      "          node-version: 20",
-      "          cache: npm",
-      "      - run: npm ci",
-    ],
-  },
-  pnpm: {
-    lockfile: "pnpm-lock.yaml",
-    install: (pkgs) => ["pnpm", "add", "--save-dev", "--save-exact", ...pkgs],
-    runCheckCi: "pnpm exec biome ci --reporter=github .",
-    setupSteps: [
-      "      - uses: pnpm/action-setup@v4",
-      "      - uses: actions/setup-node@v4",
-      "        with:",
-      "          node-version: 20",
-      "          cache: pnpm",
-      "      - run: pnpm install --frozen-lockfile",
-    ],
-  },
-  yarn: {
-    lockfile: "yarn.lock",
-    install: (pkgs) => ["yarn", "add", "--dev", "--exact", ...pkgs],
-    runCheckCi: "yarn biome ci --reporter=github .",
-    setupSteps: [
-      "      - uses: actions/setup-node@v4",
-      "        with:",
-      "          node-version: 20",
-      "          cache: yarn",
-      "      - run: yarn install --frozen-lockfile",
-    ],
-  },
-};
+const RUNNER = runnerCommand();
 
 const BIOME_SUBCOMMANDS = {
   check: (paths) => ["check", ...paths],
@@ -70,29 +33,21 @@ const BIOME_SUBCOMMANDS = {
   ci: (paths) => ["ci", "--reporter=github", ...paths],
 };
 
-// Checked in order; the first match wins. Only "next" has its own Biome
-// lint domain — the others are still React under the hood, so they map to
-// the "base" preset, but we name what we found instead of guessing silently.
-const FRAMEWORK_DETECTORS = [
-  { label: "Next.js", preset: "next", deps: ["next"] },
-  { label: "TanStack Start", preset: "base", deps: ["@tanstack/react-start", "@tanstack/start"] },
-  { label: "React Router (framework mode)", preset: "base", deps: ["@react-router/dev"] },
-  { label: "Remix", preset: "base", deps: ["@remix-run/react", "@remix-run/node"] },
-  { label: "React", preset: "base", deps: ["react"] },
-];
-
-const HELP = `Usage: bunx ${KIT_NAME} <command> [options]
+const HELP = `Usage: ${RUNNER} ${KIT_NAME} <command> [options]
 
 Commands:
   init [options]   Set up Biome, scripts, hooks, and CI in the current project
   check [paths]     Run biome check (defaults to .)
   check:fix [paths] Run biome check --write (defaults to .)
   ci [paths]        Run biome ci --reporter=github (defaults to .)
-  commit [options]  Guided commit (alias: c): asks step by step, then commits as a
-                    Conventional Commit. Flags: --dry-run, --retry, --no-retry,
-                    --write-message-to-file <f>, -l <n>; git flags go after --
-  check-commit      Validate commit messages (--message, --commit-msg-file,
-                    --rev-range, -d, --allow-abort, --allowed-prefixes, -l)
+  run [checks]      Run the project's checks (Biome, typecheck, build, tests) in
+                    order, the same list CI and the dashboard use. Flags:
+                    --keep-going (don't stop at the first failure), --list
+  doctor [--json]   Diagnose the setup: tools, hooks, configs, CI. Read-only
+  commit [options]  Guided Conventional Commit (alias: c), run by Commitizen;
+                    git flags go after --
+  check-commit      Validate commit messages with commitlint (--message,
+                    --commit-msg-file, --rev-range, -d)
   ui [options]      Open the local dashboard: run checks, review errors and
                     proposed fixes as a diff, apply fixes per file
 
@@ -105,6 +60,7 @@ init options:
   --no-hooks                   Skip husky + pre-commit hook setup
   --no-commit-lint             Skip the commit-message hooks (commit-msg, prepare-commit-msg, pre-push)
   --no-ci                      Skip the GitHub Actions workflow
+  --dry-run                    Show everything init would do; change nothing
   --skip-install                Print install commands instead of running them
   -h, --help                   Show this help
 
@@ -116,13 +72,14 @@ auto-selected — pass --preset strict explicitly when you want it.
 
 check / check:fix / ci run the Biome binary already installed in this
 project's node_modules — you never need to call biome yourself. The
-package manager (bun, npm, pnpm, or yarn) used by \`init\` is detected
-from the "packageManager" field in package.json or from whichever
-lockfile is present. Bun is used as the fallback when neither is found.
-
-After \`init\` the command is installed in your project, so these run the
-local copy: \`bunx lintlane check\`, \`bunx lintlane check:fix\`,
-\`bunx lintlane ci\`, \`bunx lintlane commit\`, \`bunx lintlane ui\`.
+package manager (npm, pnpm, yarn, or bun) used by \`init\` is detected from
+the "packageManager" field in package.json, then from whichever lockfile is
+present, then from the tool you launched lintlane with (npx, pnpm dlx, yarn
+dlx, bunx). npm is used when none of those apply.
+
+After \`init\` the \`lintlane\` command is installed in your project, for
+example: \`npx lintlane check\`, \`pnpm exec lintlane check\`,
+\`yarn lintlane check\`, \`bunx lintlane check\`.
 `;
 
 function fail(message) {
@@ -138,32 +95,9 @@ function warn(message) {
   console.log(`! ${message}`);
 }
 
-function detectPackageManager(cwd, pkg) {
-  const declared = pkg.packageManager?.split("@")[0];
-  if (declared && declared in PACKAGE_MANAGERS) return declared;
-  for (const [name, pm] of Object.entries(PACKAGE_MANAGERS)) {
-    if (existsSync(join(cwd, pm.lockfile))) return name;
-  }
-  return "bun";
-}
-
-function detectPreset(pkg) {
-  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  for (const detector of FRAMEWORK_DETECTORS) {
-    if (detector.deps.some((dep) => dep in deps)) {
-      return { preset: detector.preset, label: detector.label };
-    }
-  }
-  return { preset: "base", label: null };
-}
-
-function binPath(cwd, name) {
-  return join(cwd, "node_modules", ".bin", name);
-}
-
 // Everything after a bare "--" belongs to the subcommand (e.g. `commit -- -a -S`
 // hands "-a -S" to git commit), so it never reaches our own option parsing.
-const rawArgs = Bun.argv.slice(2);
+const rawArgs = process.argv.slice(2);
 const doubleDash = rawArgs.indexOf("--");
 const ownArgs = doubleDash < 0 ? rawArgs : rawArgs.slice(0, doubleDash);
 const passthroughArgs = doubleDash < 0 ? [] : rawArgs.slice(doubleDash + 1);
@@ -176,6 +110,10 @@ const { values, positionals } = parseArgs({
     "no-ci": { type: "boolean", default: false },
     "no-commit-lint": { type: "boolean", default: false },
     "skip-install": { type: "boolean", default: false },
+    "dry-run": { type: "boolean", default: false },
+    json: { type: "boolean", default: false },
+    "keep-going": { type: "boolean", default: false },
+    list: { type: "boolean", default: false },
     port: { type: "string" },
     "no-open": { type: "boolean", default: false },
     help: { type: "boolean", short: "h", default: false },
@@ -195,18 +133,13 @@ if (values.help && !["commit", "c", "check-commit"].includes(command)) {
 }
 
 if (command in BIOME_SUBCOMMANDS) {
-  const biome = binPath(cwd, "biome");
-  if (!existsSync(biome)) {
-    fail(`Biome isn't installed in this project. Run: bunx ${KIT_NAME} init`);
+  const biome = resolveBiome(cwd);
+  if (!biome) {
+    fail(`Biome isn't installed in this project. Run: ${RUNNER} ${KIT_NAME} init`);
   }
   const extraPaths = positionals.slice(1);
   const biomeArgs = BIOME_SUBCOMMANDS[command](extraPaths.length ? extraPaths : ["."]);
-  try {
-    await $`${biome} ${biomeArgs}`.cwd(cwd);
-  } catch (error) {
-    process.exit(error.exitCode ?? 1);
-  }
-  process.exit(0);
+  process.exit(await runInherit(biome[0], [...biome.slice(1), ...biomeArgs], { cwd }));
 }
 
 if (command === "commit" || command === "c") {
@@ -219,29 +152,98 @@ if (command === "check-commit") {
   process.exit(await main(commandArgs, cwd));
 }
 
+if (command === "doctor") {
+  const { formatReport, runDoctor } = await import("./doctor.mjs");
+  const report = await runDoctor({ cwd, kitDir: KIT_DIR });
+  console.log(values.json ? JSON.stringify(report, null, 2) : formatReport(report));
+  process.exit(report.ok ? 0 : 1);
+}
+
+if (command === "hook") {
+  const { runHook } = await import("./hook.mjs");
+  const at = rawArgs.indexOf("hook");
+  const [name, ...hookArgs] = rawArgs.slice(at + 1);
+  process.exit(await runHook(name, hookArgs, cwd));
+}
+
+if (command === "run") {
+  const biome = resolveBiome(cwd);
+  if (!biome) fail(`Biome isn't installed in this project. Run: ${RUNNER} ${KIT_NAME} init`);
+  const pkg = existsSync(join(cwd, "package.json"))
+    ? await readJson(join(cwd, "package.json"))
+    : {};
+  const { steps, problems } = resolveChecks({
+    cwd,
+    biome,
+    pmName: detectPackageManager(cwd, pkg).name,
+    pkg,
+  });
+  for (const problem of problems) warn(problem);
+  if (values.list) {
+    for (const step of steps) {
+      console.log(`${step.id.padEnd(10)} ${step.defaultOn ? "on " : "off"}  ${step.display}`);
+    }
+    process.exit(0);
+  }
+  const wanted = positionals.slice(1);
+  const unknown = wanted.filter((id) => !steps.some((step) => step.id === id));
+  if (unknown.length)
+    fail(`Unknown check: ${unknown.join(", ")}. Available: ${steps.map((st) => st.id).join(", ")}`);
+  const chosen = wanted.length
+    ? steps.filter((step) => wanted.includes(step.id))
+    : steps.filter((step) => step.defaultOn);
+  if (chosen.length === 0) fail("No checks to run.");
+  const { runCiSteps } = await import("./checks.mjs");
+  const results = [];
+  const byId = new Map(steps.map((step) => [step.id, step]));
+  await runCiSteps({
+    cwd,
+    steps: chosen,
+    stopOnFail: !values["keep-going"],
+    send: (event) => {
+      if (event.type === "start")
+        console.log(`▶ ${byId.get(event.id).label}  (${byId.get(event.id).display})`);
+      else if (event.type === "log") process.stdout.write(event.text);
+      else if (event.type === "end") {
+        results.push(event);
+        console.log(
+          `${event.code === 0 ? "✔" : "✘"} ${byId.get(event.id).label} (${(event.ms / 1000).toFixed(1)}s)`,
+        );
+      } else if (event.type === "skip") console.log(`- skipped ${byId.get(event.id).label}`);
+    },
+  });
+  process.exit(
+    results.every((result) => result.code === 0) && results.length === chosen.length ? 0 : 1,
+  );
+}
+
 if (command === "ui") {
-  const biome = binPath(cwd, "biome");
-  if (!existsSync(biome)) {
-    fail(`Biome isn't installed in this project. Run: bunx ${KIT_NAME} init`);
+  const biome = resolveBiome(cwd);
+  if (!biome) {
+    fail(`Biome isn't installed in this project. Run: ${RUNNER} ${KIT_NAME} init`);
   }
   const { startUi } = await import("./ui-server.mjs");
   const uiPkgPath = join(cwd, "package.json");
-  const uiPkg = existsSync(uiPkgPath) ? await Bun.file(uiPkgPath).json() : {};
-  await startUi({
-    cwd,
-    biome,
-    pkg: uiPkg,
-    pmName: detectPackageManager(cwd, uiPkg),
-    kitDir: KIT_DIR,
-    port: values.port === undefined ? 4321 : Number(values.port),
-    open: !values["no-open"],
-  });
+  const uiPkg = existsSync(uiPkgPath) ? await readJson(uiPkgPath) : {};
+  try {
+    await startUi({
+      cwd,
+      biome,
+      pkg: uiPkg,
+      pmName: detectPackageManager(cwd, uiPkg).name,
+      kitDir: KIT_DIR,
+      port: values.port === undefined ? 4321 : Number(values.port),
+      open: !values["no-open"],
+    });
+  } catch (error) {
+    fail(error.message);
+  }
   await new Promise(() => {});
 }
 
 if (command !== "init") {
   fail(
-    `Unknown command "${command}". Usage: bunx ${KIT_NAME} <init|check|check:fix|ci|commit|check-commit|ui> [options]`,
+    `Unknown command "${command}". Usage: ${RUNNER} ${KIT_NAME} <init|check|check:fix|ci|run|doctor|commit|check-commit|ui> [options]`,
   );
 }
 
@@ -256,10 +258,9 @@ if (!existsSync(pkgPath)) {
   fail("No package.json found in the current directory.");
 }
 
-const pkg = await Bun.file(pkgPath).json();
-const pmName = detectPackageManager(cwd, pkg);
-const pm = PACKAGE_MANAGERS[pmName];
-ok(`Detected package manager: ${pmName}`);
+let pkg = await readJson(pkgPath);
+const { name: pmName, source: pmSource } = detectPackageManager(cwd, pkg);
+ok(`Detected package manager: ${pmName} (${pmSource})`);
 
 let preset = values.preset;
 if (preset === undefined) {
@@ -272,20 +273,53 @@ if (preset === undefined) {
   }
 }
 
-const devPackages = ["@biomejs/biome", `${KIT_NAME}@${KIT_VERSION}`];
-if (!values["no-hooks"]) devPackages.push("husky");
-const installArgv = pm.install(devPackages);
-const installCmd = installArgv.join(" ");
+const dryRun = values["dry-run"];
+if (dryRun) console.log("Dry run: nothing will be changed.\n");
+
+// Every change goes through act(): in a dry run it only says what it would do.
+async function act(message, fn) {
+  if (dryRun) {
+    console.log(`+ would ${message}`);
+    return;
+  }
+  await fn();
+  ok(message[0].toUpperCase() + message.slice(1));
+}
 
-if (values["skip-install"]) {
-  warn(`Skipped install. Run: ${installCmd}`);
+// LINTLANE_INSTALL_SPEC lets you install lintlane from somewhere other than the
+// registry (a tarball from `npm pack`, a local folder) when testing a build.
+const kitSpec = process.env.LINTLANE_INSTALL_SPEC || `${KIT_NAME}@${KIT_VERSION}`;
+const declared = { ...pkg.dependencies, ...pkg.devDependencies };
+// Only install what's missing, so an existing Biome or husky version is never bumped.
+const devPackages = [];
+if (!("@biomejs/biome" in declared)) devPackages.push("@biomejs/biome");
+if (process.env.LINTLANE_INSTALL_SPEC || declared[KIT_NAME] !== KIT_VERSION)
+  devPackages.push(kitSpec);
+if (!values["no-hooks"] && !("husky" in declared)) devPackages.push("husky");
+
+if (devPackages.length === 0) {
+  ok("Dependencies already installed");
+} else if (values["skip-install"] || dryRun) {
+  const argv = installCommand(pmName, devPackages).join(" ");
+  if (dryRun) console.log(`+ would run: ${argv}`);
+  else warn(`Skipped install. Run: ${argv}`);
 } else {
-  try {
-    await $`${installArgv}`.cwd(cwd).quiet();
-    ok(`Installed ${devPackages.join(", ")}`);
-  } catch (error) {
-    fail(`Install failed: ${error.message}`);
+  const installArgv = installCommand(pmName, devPackages);
+  const install = await runProcess(installArgv[0], installArgv.slice(1), { cwd });
+  if (install.code !== 0) {
+    const reason =
+      install.error?.code === "ENOENT"
+        ? `"${installArgv[0]}" was not found. Install it, or run again with --skip-install and install the packages yourself:\n  ${installArgv.join(" ")}`
+        : (install.stderr.toString().trim() || install.stdout.toString().trim())
+            .split("\n")
+            .slice(-8)
+            .join("\n");
+    fail(`Install failed (${installArgv.join(" ")}):\n${reason}`);
   }
+  ok(`Installed ${devPackages.join(", ")}`);
+  // The install just rewrote package.json (devDependencies). Re-read it, or the
+  // scripts we add below would be written over a stale copy and erase those entries.
+  pkg = await readJson(pkgPath);
 }
 
 const biomeJsonPath = join(cwd, "biome.json");
@@ -293,7 +327,7 @@ const biomeJsoncPath = join(cwd, "biome.jsonc");
 const extendsSpecifier = `${KIT_NAME}/${PRESET_PATHS[preset]}`;
 
 if (existsSync(biomeJsonPath) || existsSync(biomeJsoncPath)) {
-  warn(`biome.json already exists — add this to its "extends": "${extendsSpecifier}"`);
+  warn(`biome.json already exists — make sure its "extends" includes "${extendsSpecifier}"`);
 } else {
   const config = {
     $schema: "./node_modules/@biomejs/biome/configuration_schema.json",
@@ -302,45 +336,86 @@ if (existsSync(biomeJsonPath) || existsSync(biomeJsoncPath)) {
   if (preset === "next") {
     config.files = { includes: ["**", "!**/.next", "!**/out", "!**/next-env.d.ts"] };
   }
-  await Bun.write(biomeJsonPath, `${JSON.stringify(config, null, 2)}\n`);
-  ok(`Wrote biome.json (extends ${extendsSpecifier})`);
+  await act(`write biome.json (extends ${extendsSpecifier})`, () =>
+    writeFile(biomeJsonPath, `${JSON.stringify(config, null, 2)}\n`),
+  );
 }
 
+// package.json: scripts, lint-staged, Commitizen. Only ever adds what's missing.
 pkg.scripts ??= {};
-let pkgChanged = false;
+const pkgEdits = [];
+const addScript = (name, value) => {
+  if (!pkg.scripts[name]) {
+    pkgEdits.push(() => {
+      pkg.scripts[name] = value;
+    });
+    return `add script "${name}"`;
+  }
+  warn(`Script "${name}" already exists — left untouched`);
+  return null;
+};
+const pending = [
+  addScript("check", "biome check ."),
+  addScript("check:fix", "biome check --write ."),
+];
 
-if (!pkg.scripts.check) {
-  pkg.scripts.check = "biome check .";
-  pkgChanged = true;
-  ok('Added script "check"');
-} else {
-  warn('Script "check" already exists — left untouched');
-}
+if (!values["no-hooks"]) {
+  if (!pkg.scripts.prepare) pending.push(addScript("prepare", "husky"));
+  else if (!pkg.scripts.prepare.includes("husky")) {
+    pkgEdits.push(() => {
+      pkg.scripts.prepare = `${pkg.scripts.prepare} && husky`;
+    });
+    pending.push('append husky to the existing "prepare" script');
+  } else {
+    warn('Script "prepare" already runs husky — left untouched');
+  }
 
-if (!pkg.scripts["check:fix"]) {
-  pkg.scripts["check:fix"] = "biome check --write .";
-  pkgChanged = true;
-  ok('Added script "check:fix"');
-} else {
-  warn('Script "check:fix" already exists — left untouched');
+  if (hasLintStagedConfig(cwd, pkg)) {
+    warn("lint-staged is already configured — left untouched");
+  } else {
+    pkgEdits.push(() => {
+      pkg["lint-staged"] = LINT_STAGED_CONFIG;
+    });
+    pending.push('add "lint-staged" config (Biome on staged files)');
+  }
 }
 
-if (!values["no-hooks"]) {
-  if (!pkg.scripts.prepare) {
-    pkg.scripts.prepare = "husky";
-    pkgChanged = true;
-    ok('Added script "prepare"');
-  } else if (!pkg.scripts.prepare.includes("husky")) {
-    pkg.scripts.prepare = `${pkg.scripts.prepare} && husky`;
-    pkgChanged = true;
-    ok('Appended husky to existing "prepare" script');
+if (!values["no-commit-lint"]) {
+  if (pkg.config?.commitizen?.path) {
+    warn("Commitizen is already configured — left untouched");
   } else {
-    warn('Script "prepare" already runs husky — left untouched');
+    pkgEdits.push(() => {
+      pkg.config = {
+        ...pkg.config,
+        commitizen: { ...pkg.config?.commitizen, path: COMMITIZEN_PATH },
+      };
+    });
+    pending.push('add "config.commitizen" (guided commits)');
   }
 }
 
-if (pkgChanged) {
-  await Bun.write(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+for (const message of pending.filter(Boolean)) {
+  if (dryRun) console.log(`+ would ${message} in package.json`);
+}
+if (pkgEdits.length > 0 && !dryRun) {
+  for (const edit of pkgEdits) edit();
+  await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+  for (const message of pending.filter(Boolean))
+    ok(`${message[0].toUpperCase()}${message.slice(1)}`);
+}
+
+// commitlint config
+if (!values["no-commit-lint"]) {
+  if (hasCommitlintConfig(cwd, pkg)) {
+    warn("commitlint is already configured — left untouched");
+  } else {
+    await act("write commitlint.config.mjs", () =>
+      writeFile(
+        join(cwd, "commitlint.config.mjs"),
+        'export { default } from "lintlane/commitlint";\n',
+      ),
+    );
+  }
 }
 
 if (!values["no-hooks"]) {
@@ -355,15 +430,34 @@ if (!values["no-hooks"]) {
 
     for (const hook of hooks) {
       const hookPath = join(huskyDir, hook);
-      if (existsSync(hookPath)) {
-        warn(`.husky/${hook} already exists — left untouched`);
+      const template = await readFile(join(KIT_DIR, "templates", hook), "utf8");
+      const writeHook = async () => {
+        await mkdir(huskyDir, { recursive: true });
+        await writeFile(hookPath, template);
+        await chmod(hookPath, 0o755);
+        wroteHook = true;
+      };
+      if (!existsSync(hookPath)) {
+        await act(`write .husky/${hook}`, writeHook);
         continue;
       }
-      await $`mkdir -p ${huskyDir}`.quiet();
-      await Bun.write(hookPath, await Bun.file(join(KIT_DIR, "templates", hook)).text());
-      await $`chmod 755 ${hookPath}`.quiet();
-      ok(`Wrote .husky/${hook}`);
-      wroteHook = true;
+      const state = classifyHook(hook, await readFile(hookPath, "utf8"), template);
+      if (state === "current") {
+        ok(`.husky/${hook} is up to date`);
+      } else if (state === "legacy") {
+        // Untouched hook from an older lintlane; the files it called are gone.
+        await act(`upgrade .husky/${hook} (the old one is from an earlier lintlane)`, writeHook);
+      } else if (state === "stale" || state === "unsafe") {
+        warn(
+          `.husky/${hook} was edited and still calls files lintlane no longer ships` +
+            (state === "unsafe"
+              ? " (and `git update-index --again` can stage changes you didn't stage)"
+              : "") +
+            `. Replace its contents with node_modules/lintlane/templates/${hook}.`,
+        );
+      } else {
+        warn(`.husky/${hook} already exists — left untouched`);
+      }
     }
 
     if (wroteHook) {
@@ -372,16 +466,15 @@ if (!values["no-hooks"]) {
       } else {
         const husky = binPath(cwd, "husky");
         if (existsSync(husky)) {
-          try {
-            await $`${husky}`.cwd(cwd).quiet();
-            ok("Ran husky");
-          } catch (error) {
-            warn(`husky failed: ${error.message}`);
-          }
+          const ran = await runProcess(husky, [], { cwd });
+          if (ran.code === 0) ok("Ran husky");
+          else warn(`husky failed: ${(ran.stderr.toString() || ran.error?.message || "").trim()}`);
         } else {
           warn(`husky binary not found at ${husky} — run it manually once installed`);
         }
       }
+    } else if (dryRun) {
+      console.log("+ would run husky to point git at .husky");
     }
   }
 }
@@ -390,39 +483,25 @@ if (!values["no-ci"]) {
   const workflowsDir = join(cwd, ".github", "workflows");
   const ciPath = join(workflowsDir, "biome.yml");
   if (existsSync(ciPath)) {
-    warn(".github/workflows/biome.yml already exists — left untouched");
+    warn(
+      ".github/workflows/biome.yml already exists — left untouched (run `lintlane doctor` to compare it with your checks)",
+    );
   } else {
-    // Catches commits that skipped the local hooks (--no-verify, GUI clients, fresh clones).
     const withCommitCheck = !values["no-commit-lint"] && !values["no-hooks"];
-    const commitCheckCheckout = withCommitCheck ? "\n        with:\n          fetch-depth: 0" : "";
-    const commitCheckStep = withCommitCheck
-      ? [
-          "",
-          "      - name: Check commit messages",
-          "        if: github.event_name == 'pull_request'",
-          "        run: node node_modules/lintlane/bin/check-commit.mjs --rev-range origin/${{ github.base_ref }}..HEAD",
-        ].join("\n")
-      : "";
-    const workflow = `name: Biome
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  biome:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4${commitCheckCheckout}
-${pm.setupSteps.join("\n")}${commitCheckStep}
-      - run: ${pm.runCheckCi}
-`;
-    await $`mkdir -p ${workflowsDir}`.quiet();
-    await Bun.write(ciPath, workflow);
-    ok("Wrote .github/workflows/biome.yml");
+    const biomeArgv = resolveBiome(cwd) ?? ["biome"];
+    const { steps: checks } = resolveChecks({ cwd, biome: biomeArgv, pmName, pkg });
+    await act("write .github/workflows/biome.yml", async () => {
+      await mkdir(workflowsDir, { recursive: true });
+      await writeFile(
+        ciPath,
+        renderWorkflow({ pmName, kitName: KIT_NAME, withCommitCheck, checks }),
+      );
+    });
   }
 }
 
-console.log(`\nRun: ${pmName} run check:fix`);
+console.log(
+  dryRun
+    ? "\nDry run finished. Run again without --dry-run to apply."
+    : `\nRun: ${pmName} run check:fix   (and \`${RUNNER} ${KIT_NAME} doctor\` to verify the setup)`,
+);