polyrepo-cli 1.0.0 → 1.0.2

package/src/index.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { Command } from 'commander'
 import pc from 'picocolors'
 import { listCommand } from './commands/list.js'
@@ -14,6 +17,12 @@ import { outdatedCommand } from './commands/outdated.js'
 import { prsCommand } from './commands/prs.js'
 import { cloneCommand } from './commands/clone.js'
 
+// Read once from package.json rather than a literal string here — the two
+// silently drifted apart before (this file said 1.0.0 while package.json
+// had already moved to 1.0.1).
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const { version: CLI_VERSION } = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'))
+
 const program = new Command()
 
 const PACKAGES_OPTION = [
@@ -85,9 +94,9 @@ function wrapText(text, width) {
 program
   .name('polyrepo')
   .description(
-    'Manage local npm package repos: pick which directories to scan (setup), clone missing ones from GitHub (clone), see their state (list), outdated dependencies (outdated), or open PRs (prs), run a health check (doctor), keep them on an up-to-date master (switch-master), release a version through a PR (bump), publish to npm (publish), tag an already-current version (tag), create GitHub Releases (release), or run any command across every repo (exec).',
+    'Manage local npm package repos: pick which directories to scan (setup), clone missing ones from GitHub (clone), see their state (list), outdated dependencies (outdated), or open PRs (prs), run a health check (doctor), keep them on an up-to-date default branch (switch-master), release a version through a PR (bump), publish to npm (publish), tag an already-current version (tag), create GitHub Releases (release), or run any command across every repo (exec).',
   )
-  .version('1.0.0')
+  .version(CLI_VERSION)
   .option(
     '--config <path>',
     'Path to a polyrepo.config.json listing roots/packages to scan (default: polyrepo.config.json next to this CLI).',
@@ -115,7 +124,7 @@ Examples:
   $ polyrepo list                               Show version + branch for every package
   $ polyrepo outdated                           Show outdated dependencies across every package
   $ polyrepo prs                                List open pull requests across every package
-  $ polyrepo switch-master                      Update selected repos to the latest master
+  $ polyrepo switch-master                      Update selected repos to their latest default branch
   $ polyrepo bump --dry-run                     Preview a version bump, nothing is pushed
   $ polyrepo bump --minor --packages a,b --yes  Bump specific packages' minor version, non-interactively
   $ polyrepo publish                            Publish packages that are ahead of the registry
@@ -285,41 +294,101 @@ Examples:
 
 program
   .command('doctor')
-  .description('Check environment (node/git/gh/npm, auth), config, and cross-package dependency drift.')
+  .description('Check environment, config, branch health, and dependency drift — with a few safe self-repairs.')
+  .option(
+    '--clean-branches',
+    'After scanning, show a checkbox of local bump branches whose PR is already merged, and delete the ones you pick.',
+  )
   .addHelpText(
     'after',
     `
-Read-only. Three sections: Environment (is Node.js new enough, are git/gh/npm
-on PATH and authenticated), Config (does polyrepo.config.json resolve to any
-packages, which repos are dirty or off master), and Cross-package
-dependencies (does any local package's dependencies/devDependencies/
-peerDependencies range no longer match another local package's current
-version — e.g. after a \`bump\` that package's own package.json wasn't
-updated for). Run this first if any other command is behaving strangely.
+Seven sections. Most are read-only diagnosis; three include a small,
+non-destructive self-repair:
+
+  Environment           Node.js version, git/gh/npm on PATH and authenticated.
+  Config                how many packages the config resolves to; which are
+                        dirty, in a detached HEAD state, or off their
+                        default branch.
+  Remote sync           compares each repo's locally cached default-branch
+                        name against what GitHub reports right now — git
+                        never refreshes that cache on its own, so a rename
+                        on GitHub would otherwise go unnoticed by every
+                        other command forever; drifted ones are fixed with
+                        \`git remote set-head origin --auto\`. Also runs
+                        \`git remote prune origin\` on every repo, dropping
+                        local refs for branches already deleted on GitHub.
+                        Both are pointer-only fixes — no file, branch, or
+                        commit is ever touched.
+  Branch sync           fetches and compares each repo's local default
+                        branch against origin: diverged (needs manual
+                        resolution), behind only (safe to fast-forward with
+                        \`switch-master\`), or ahead only (unpushed local
+                        commits) — surfaced before a command trips over it.
+  Branch protection     whether each repo's default branch actually has
+                        GitHub branch protection enabled. Report-only —
+                        enabling protection is a policy choice, not
+                        something to set on your behalf.
+  Stale bump branches   \`bump\` merges through a PR with the branch left on
+                        origin (see \`bump\` above), so a local copy sticks
+                        around too. Reports how many have an already-merged
+                        PR; \`--clean-branches\` turns that into a checkbox
+                        to delete the local ones you pick (\`git branch -d\`
+                        — never the branch on origin, and refuses instead
+                        of forcing if a branch isn't actually fully merged
+                        locally).
+  Cross-package deps    does any local package's dependency range no longer
+                        match another local package's current version.
+
+Run this first if any other command is behaving strangely, and any time
+you rename a branch on GitHub or want to check for accumulated cruft.
 
 Examples:
   $ polyrepo doctor
+  $ polyrepo doctor --clean-branches
 `,
   )
-  .action(() => doctorCommand({ configPath: program.opts().config }))
+  .action((opts) =>
+    doctorCommand({
+      configPath: program.opts().config,
+      cleanBranches: Boolean(opts.cleanBranches),
+    }),
+  )
 
 program
   .command('switch-master')
   .alias('sm')
-  .description('Pick repos and switch each to an up-to-date master.')
+  .description('Pick repos and switch each to its up-to-date default branch.')
   .option(...PACKAGES_OPTION)
   .option(...YES_OPTION)
+  .option(
+    '--force',
+    "Discard uncommitted changes and any local-only commits on a repo's default branch, hard-resetting it to match origin.",
+  )
   .addHelpText(
     'after',
     `
-For each selected repo: fetch, checkout master, fast-forward-only merge.
-A repo with uncommitted changes is skipped with a warning, never touched.
-If local master has diverged from origin (fast-forward impossible), that
-repo is reported and left alone for you to resolve by hand.
+Each repo's default branch is detected per repo (from origin — GitHub
+defaults new repos to "main", but plenty of people rename it, "master"
+included, so this never assumes one name for every repo). For each
+selected repo: fetch, checkout its default branch, fast-forward-only
+merge. A repo with uncommitted changes is skipped with a warning, never
+touched. If the local default branch has diverged from origin
+(fast-forward impossible), that repo is reported and left alone for you
+to resolve by hand.
+
+--force changes this: dirty repos are no longer skipped, and every
+selected repo gets \`git checkout -f <default branch>\` + \`git reset --hard
+origin/<default branch>\` instead of the safe fast-forward-only merge —
+uncommitted changes to tracked files and any local-only commits on that
+branch are permanently discarded (untracked files are left alone, this
+isn't \`git clean\`). The proceed confirmation says how many selected
+repos are dirty and defaults to "No" when --force would actually discard
+something.
 
 Examples:
   $ polyrepo switch-master
   $ polyrepo sm --packages vue-toast-kit,os-detect --yes
+  $ polyrepo sm --packages vue-toast-kit --force   Discard its local changes and hard-reset to origin
 `,
   )
   .action((opts) =>
@@ -327,12 +396,13 @@ Examples:
       configPath: program.opts().config,
       packages: opts.packages ? opts.packages.split(',') : undefined,
       yes: Boolean(opts.yes),
+      force: Boolean(opts.force),
     }),
   )
 
 program
   .command('bump')
-  .description('Pick packages, bump their version (patch by default), PR, merge to master, and tag.')
+  .description('Pick packages, bump their version (patch by default), PR, merge to the default branch, and tag.')
   .option('--dry-run', 'Print every step without pushing, opening, merging, or tagging anything for real.')
   .option('--minor', 'Bump the minor version instead of patch (e.g. 1.2.9 → 1.3.0).')
   .option('--major', 'Bump the major version instead of patch (e.g. 1.2.9 → 2.0.0).')
@@ -421,9 +491,10 @@ program
     `
 For a package whose version was bumped some other way (not through
 \`polyrepo bump\`, or before it started tagging) — puts the \`v<version>\` tag on
-master's current tip, no version change and no PR, so \`polyrepo release\` has
-something to work from. Re-syncs master first for each package, same as
-\`bump\` does. Already-tagged packages are shown but unchecked by default
+its default branch's current tip, no version change and no PR, so
+\`polyrepo release\` has something to work from. Re-syncs the default branch
+first for each package, same as \`bump\` does. Already-tagged packages are
+shown but unchecked by default
 (picking one anyway just confirms the tag is there, harmless). After
 tagging, asks whether to create a GitHub Release right away for whatever
 was just tagged (same as running \`polyrepo release\` for exactly those

package/src/masterSync.js

@@ -1,18 +1,35 @@
-import { MASTER_BRANCH } from './config.js'
 import { git } from './exec.js'
 
-// fetch → checkout master → fast-forward-only merge. Always run for real
-// (never skipped under --dry-run) since it's read-only/reversible and
-// downstream logic needs an accurate picture of where master actually is.
-export function syncMaster(repo) {
+// fetch → checkout the repo's default branch → fast-forward-only merge.
+// Always run for real (never skipped under --dry-run) since it's
+// read-only/reversible and downstream logic needs an accurate picture of
+// where the default branch actually is. Uses `repo.defaultBranch`
+// (detected per repo — see repos.js's detectDefaultBranchAsync) rather
+// than assuming "master", since that isn't universal.
+//
+// `force: true` (only `switch-master --force` sets this) trades the safe
+// fast-forward-only merge for `checkout -f` + `reset --hard` — it discards
+// any uncommitted changes to tracked files and any local commits the
+// default branch has that origin doesn't, unconditionally. Untracked
+// files are left alone (this isn't `git clean`). Callers that don't pass
+// it keep the original safe behavior — bump/tag rely on that, they never
+// force.
+export function syncMaster(repo, { force = false } = {}) {
+  const branch = repo.defaultBranch
   if (!git(repo.path, ['fetch', 'origin']).ok) {
     return { ok: false, message: 'git fetch origin failed.' }
   }
-  if (!git(repo.path, ['checkout', MASTER_BRANCH]).ok) {
-    return { ok: false, message: `git checkout ${MASTER_BRANCH} failed.` }
+  if (!git(repo.path, ['checkout', ...(force ? ['-f'] : []), branch]).ok) {
+    return { ok: false, message: `git checkout ${branch} failed.` }
   }
-  if (!git(repo.path, ['merge', '--ff-only', `origin/${MASTER_BRANCH}`]).ok) {
-    return { ok: false, message: `Local ${MASTER_BRANCH} has diverged from origin — resolve manually.` }
+  if (force) {
+    if (!git(repo.path, ['reset', '--hard', `origin/${branch}`]).ok) {
+      return { ok: false, message: `git reset --hard origin/${branch} failed.` }
+    }
+    return { ok: true }
+  }
+  if (!git(repo.path, ['merge', '--ff-only', `origin/${branch}`]).ok) {
+    return { ok: false, message: `Local ${branch} has diverged from origin — resolve manually.` }
   }
   return { ok: true }
 }

package/src/repos.js

@@ -16,6 +16,44 @@ function toEntry(dirPath) {
   }
 }
 
+// GitHub itself defaults a new repo to "main", and plenty of people rename
+// it back to "master" (or something else) — there's no one right answer,
+// so this is only the last resort once nothing else could tell us.
+const FALLBACK_DEFAULT_BRANCH = 'main'
+
+async function readCachedOriginHead(repo) {
+  const result = await gitAsync(repo.path, ['symbolic-ref', 'refs/remotes/origin/HEAD'])
+  if (!result.ok || !result.stdout) return null
+  const match = result.stdout.match(/^refs\/remotes\/origin\/(.+)$/)
+  return match ? match[1] : null
+}
+
+// Detected once per repo (cached alongside branch/clean below) rather than
+// assumed — a mixed folder of repos can easily have some on "master" and
+// some on "main". In order:
+//   1. the locally cached origin/HEAD ref — set by `git clone` (or a prior
+//      `git remote set-head`), no network needed, the common case;
+//   2. otherwise ask origin directly, read-only (`git ls-remote --symref`
+//      doesn't write any local ref, unlike `git remote set-head --auto`);
+//   3. offline or no working origin — guess from whichever of
+//      master/main actually exists as a local branch;
+//   4. still nothing to go on — GitHub's own default, "main".
+export async function detectDefaultBranchAsync(repo) {
+  const cached = await readCachedOriginHead(repo)
+  if (cached) return cached
+
+  const remoteHead = await gitAsync(repo.path, ['ls-remote', '--symref', 'origin', 'HEAD'])
+  const remoteMatch = remoteHead.ok && remoteHead.stdout.match(/^ref:\s*refs\/heads\/(\S+)\s+HEAD/m)
+  if (remoteMatch) return remoteMatch[1]
+
+  for (const candidate of ['master', 'main']) {
+    const exists = await gitAsync(repo.path, ['show-ref', '--verify', '--quiet', `refs/heads/${candidate}`])
+    if (exists.ok) return candidate
+  }
+
+  return FALLBACK_DEFAULT_BRANCH
+}
+
 // `config.roots` — folders whose direct subdirectories are packages (the
 // original C:\work\NPM-style layout). `config.packages` — individual
 // package folders given directly, for a one-off repo that doesn't live
@@ -76,18 +114,19 @@ export function readPackageJson(repo) {
 }
 
 // Full snapshot used everywhere a package list is shown: name, version,
-// current branch, and whether the working tree has uncommitted changes.
-// The two git calls per repo run concurrently across repos (see pMap)
-// instead of one repo waiting on the last.
+// current branch, its default branch, and whether the working tree has
+// uncommitted changes. The git calls per repo run concurrently across
+// repos (see pMap) instead of one repo waiting on the last.
 export async function inspectRepoAsync(repo) {
   const pkg = readPackageJson(repo)
-  const [branchResult, statusResult] = await Promise.all([
+  const [branchResult, statusResult, defaultBranch] = await Promise.all([
     gitAsync(repo.path, ['branch', '--show-current']),
     gitAsync(repo.path, ['status', '--porcelain']),
+    detectDefaultBranchAsync(repo),
   ])
   const branch = branchResult.ok ? branchResult.stdout || null : null
   const clean = statusResult.ok && statusResult.stdout === ''
-  return { ...repo, ...pkg, branch, clean }
+  return { ...repo, ...pkg, branch, clean, defaultBranch }
 }
 
 export function inspectRepos(repos, concurrency) {

package/test/config.test.js

@@ -0,0 +1,22 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { bumpBranchName, isBumpBranchName } from '../src/config.js'
+
+test('isBumpBranchName recognizes what bumpBranchName produces', () => {
+  assert.equal(isBumpBranchName(bumpBranchName('1.2.10')), true)
+  assert.equal(isBumpBranchName(bumpBranchName('0.0.1')), true)
+  assert.equal(isBumpBranchName(bumpBranchName('10.20.30')), true)
+})
+
+test('isBumpBranchName recognizes a pre-release/build suffix', () => {
+  assert.equal(isBumpBranchName('1.2.10-beta.1-version-bump'), true)
+  assert.equal(isBumpBranchName('1.2.10+build.5-version-bump'), true)
+})
+
+test('isBumpBranchName rejects unrelated branch names', () => {
+  assert.equal(isBumpBranchName('main'), false)
+  assert.equal(isBumpBranchName('feature/add-thing'), false)
+  assert.equal(isBumpBranchName('1.2.10-version-bump-extra'), false)
+  assert.equal(isBumpBranchName('version-bump'), false)
+  assert.equal(isBumpBranchName('v1.2.10-version-bump'), false)
+})