reposets 0.2.1 → 0.4.0

package/README.md

@@ -4,7 +4,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![TypeScript](https://img.shields.io/badge/TypeScript-6.0-blue.svg)](https://www.typescriptlang.org/)
 
-Declarative GitHub repository management. Define your repo settings, secrets, variables, rulesets, and deployment environments in a TOML config file, then apply them across all your repositories with a single command.
+Declarative GitHub repository management. Define your repo settings, secrets, variables, rulesets, deployment environments, advanced security toggles, and CodeQL default setup in a TOML config file, then apply them across all your repositories with a single command.
 
 ## Why reposets
 
@@ -17,7 +17,8 @@ Managing repository settings by hand doesn't scale. When you have dozens of repo
 - **Multi-scope secret and variable management** — Assign the same secret group to Actions, Dependabot, Codespaces, and deployment environments with scoped targeting.
 - **Ruleset shorthand syntax** — Define branch and tag rulesets with compact inline syntax for pull request rules, status checks, and boolean flags instead of verbose API payloads.
 - **Deployment environment management** — Configure wait timers, reviewers, and branch policies for deployment environments alongside your other settings.
-- **Group-based targeting** — Organize repos into groups that share settings, secrets, variables, rulesets, and environments. Change the group config, sync once, and every repo updates.
+- **Advanced security and CodeQL** — Toggle secret scanning, push protection, vulnerability alerts, automated security fixes, private vulnerability reporting, and CodeQL default setup. License- and ownership-aware: GHAS-licensed fields warn instead of failing on private repos without a license, and org-only fields are silently skipped on personal accounts.
+- **Group-based targeting** — Organize repos into groups that share settings, secrets, variables, rulesets, environments, security toggles, and code scanning configuration. Change the group config, sync once, and every repo updates.
 - **Cleanup policies** — Automatically remove undeclared resources per scope with optional preserve lists, so your repos converge to the declared state.
 - **Dry-run and validation** — Preview changes before applying, validate config locally without touching the GitHub API, and catch typos with built-in diagnostics.
 
@@ -93,7 +94,7 @@ All commands accept `--log-level silent|info|verbose|debug`.
 
 reposets uses two TOML files:
 
-- `reposets.config.toml` — defines settings, secrets, variables, rulesets, environments, and groups
+- `reposets.config.toml` — defines settings, secrets, variables, rulesets, environments, security, code_scanning, and groups
 - `reposets.credentials.toml` — stores GitHub tokens and optional resolve sections for named values
 
 Config lookup order (first match wins):
@@ -112,8 +113,14 @@ reposets requires a fine-grained personal access token with:
 - Repository > Secrets (Read and write)
 - Repository > Variables (Read and write)
 - Repository > Environments (Read and write)
+- Repository > Code scanning alerts (Read and write) — for `[code_scanning.*]`
+- Repository > Dependabot alerts (Read and write) — for `[security.*]`
+- Repository > Secret scanning alerts (Read and write) — for `security_and_analysis`
+- Organization > Members (Read) — for `delegated_bypass_reviewers` team slugs on org-owned repos
 - Account > GPG keys (Read and write)
 
+The four security-related scopes are only required if you use the corresponding config sections.
+
 ## Documentation
 
 Full reference guides are available in the [`docs/`](https://github.com/spencerbeggs/reposets/tree/main/docs) folder:
@@ -124,6 +131,7 @@ Full reference guides are available in the [`docs/`](https://github.com/spencerb
 - [Secrets and Variables](https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md) - resource groups, three kinds (file/value/resolved), and scoping
 - [Rulesets](https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md) - branch and tag ruleset configuration
 - [Environments](https://github.com/spencerbeggs/reposets/blob/main/docs/environments.md) - deployment environment setup
+- [Advanced Security](https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md#security-and-analysis-nested-block) - secret scanning, vulnerability alerts, automated security fixes, private vulnerability reporting, and CodeQL default setup
 - [Cleanup](https://github.com/spencerbeggs/reposets/blob/main/docs/cleanup.md) - automatic cleanup of undeclared resources
 - [Token Permissions](https://github.com/spencerbeggs/reposets/blob/main/docs/token-permissions.md) - GitHub PAT setup guide
 

package/bin/reposets.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { Command, Options } from "@effect/cli";
 import { NodeContext, NodeRuntime } from "@effect/platform-node";
-import { Console, Effect, Layer } from "effect";
+import { Effect, Layer, LogLevel, Logger, Option } from "effect";
 import { AppDirs } from "xdg-effect";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { parse } from "smol-toml";
-import { CredentialResolverLive, ReposetsCredentialsFile, SyncEngineLive, SyncLoggerLive, OnePasswordClientLive, GitHubClientLive, loadConfigWithDir, SyncEngine, ConfigFilesLive, ReposetsConfigFile } from "../500.js";
+import { dirname, join } from "node:path";
+import { CredentialResolverLive, SyncEngineLive, ReposetsCredentialsFile, SyncLoggerLive, OnePasswordClientLive, GitHubClientLive, SyncEngine, makeConfigFilesLive, ReposetsConfigFile } from "../500.js";
 const EMPTY_CREDENTIALS = {
     profiles: {}
 };
@@ -26,11 +26,11 @@ const createCommand = Command.make("create", {
         yield* appDirs.ensureConfig;
         const credentialsFile = yield* ReposetsCredentialsFile;
         const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (creds.profiles[profile]) return void (yield* Console.error(`Profile '${profile}' already exists. Delete it first.`));
+        if (creds.profiles[profile]) return void (yield* Effect.logError(`Profile '${profile}' already exists. Delete it first.`));
         const newProfile = {};
         if ("Some" === githubToken._tag) newProfile.github_token = githubToken.value;
         if ("Some" === opToken._tag) newProfile.op_service_account_token = opToken.value;
-        if (!newProfile.github_token && !newProfile.op_service_account_token) return void (yield* Console.error("Provide at least --github-token or --op-token."));
+        if (!newProfile.github_token && !newProfile.op_service_account_token) return void (yield* Effect.logError("Provide at least --github-token or --op-token."));
         yield* credentialsFile.update((current)=>({
                 profiles: {
                     ...current.profiles,
@@ -40,19 +40,19 @@ const createCommand = Command.make("create", {
                     }
                 }
             }), EMPTY_CREDENTIALS);
-        yield* Console.log(`Created profile '${profile}'.`);
-    })).pipe(Command.withDescription("Add a credential profile"));
+        yield* Effect.log(`Created profile '${profile}'.`);
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Add a credential profile"));
 const listCredsCommand = Command.make("list", {}, ()=>Effect.gen(function*() {
         const credentialsFile = yield* ReposetsCredentialsFile;
         const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (0 === Object.keys(creds.profiles).length) return void (yield* Console.log("No credential profiles configured."));
+        if (0 === Object.keys(creds.profiles).length) return void (yield* Effect.log("No credential profiles configured."));
         for (const [name, profile] of Object.entries(creds.profiles)){
-            yield* Console.log(`[${name}]`);
-            if (profile.github_token) yield* Console.log(`  github_token: ${redactToken(profile.github_token)}`);
-            if (profile.op_service_account_token) yield* Console.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
-            yield* Console.log("");
+            yield* Effect.log(`[${name}]`);
+            if (profile.github_token) yield* Effect.log(`  github_token: ${redactToken(profile.github_token)}`);
+            if (profile.op_service_account_token) yield* Effect.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
+            yield* Effect.log("");
         }
-    })).pipe(Command.withDescription("List profiles (tokens redacted)"));
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("List profiles (tokens redacted)"));
 const deleteCommand = Command.make("delete", {
     profile: profileOption
 }, ({ profile })=>Effect.gen(function*() {
@@ -60,13 +60,13 @@ const deleteCommand = Command.make("delete", {
         yield* appDirs.ensureConfig;
         const credentialsFile = yield* ReposetsCredentialsFile;
         const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (!creds.profiles[profile]) return void (yield* Console.error(`Profile '${profile}' not found.`));
+        if (!creds.profiles[profile]) return void (yield* Effect.logError(`Profile '${profile}' not found.`));
         const { [profile]: _, ...remainingProfiles } = creds.profiles;
         yield* credentialsFile.save({
             profiles: remainingProfiles
         });
-        yield* Console.log(`Deleted profile '${profile}'.`);
-    })).pipe(Command.withDescription("Remove a profile"));
+        yield* Effect.log(`Deleted profile '${profile}'.`);
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Remove a profile"));
 const credentialsCommand = Command.make("credentials").pipe(Command.withDescription("Manage credential profiles"), Command.withSubcommands([
     createCommand,
     listCredsCommand,
@@ -81,6 +81,8 @@ const KNOWN_CONFIG_KEYS = new Set([
     "variables",
     "rulesets",
     "environments",
+    "security",
+    "code_scanning",
     "groups"
 ]);
 const KNOWN_GROUP_KEYS = new Set([
@@ -92,6 +94,8 @@ const KNOWN_GROUP_KEYS = new Set([
     "variables",
     "rulesets",
     "environments",
+    "security",
+    "code_scanning",
     "cleanup"
 ]);
 const KNOWN_CLEANUP_KEYS = new Set([
@@ -138,23 +142,24 @@ const doctorCommand = Command.make("doctor", {
     config: configOption
 }, ({ config })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
-        const discoverResult = yield* Effect.either(loadConfigWithDir(configFile, config));
-        if ("Left" === discoverResult._tag) return void (yield* Console.error("No config found. Run 'reposets init' to create one."));
-        const { configDir } = discoverResult.right;
-        const configPath = join(configDir, "reposets.config.toml");
+        const discoverResult = yield* Effect.either(configFile.discover);
+        if ("Left" === discoverResult._tag) return void (yield* Effect.logError("No config found. Run 'reposets init' to create one."));
+        const sources = discoverResult.right;
+        if (0 === sources.length) return void (yield* Effect.logError("No config found. Run 'reposets init' to create one."));
+        const configPath = sources[0].path;
         let raw;
         try {
             const configToml = readFileSync(configPath, "utf-8");
             raw = parse(configToml);
         } catch (err) {
-            yield* Console.error(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
+            yield* Effect.logError(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
             return;
         }
         let warnings = 0;
         for (const key of Object.keys(raw))if (!KNOWN_CONFIG_KEYS.has(key)) {
             const suggestion = findClosestMatch(key, KNOWN_CONFIG_KEYS);
             const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-            yield* Console.log(`Warning: unknown top-level key '${key}'${hint}`);
+            yield* Effect.log(`Warning: unknown top-level key '${key}'${hint}`);
             warnings++;
         }
         const groups = raw.groups;
@@ -163,7 +168,7 @@ const doctorCommand = Command.make("doctor", {
                 for (const key of Object.keys(group))if (!KNOWN_GROUP_KEYS.has(key)) {
                     const suggestion = findClosestMatch(key, KNOWN_GROUP_KEYS);
                     const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Console.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
+                    yield* Effect.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
                     warnings++;
                 }
             }
@@ -177,7 +182,7 @@ const doctorCommand = Command.make("doctor", {
             for (const key of Object.keys(cleanupObj))if (!KNOWN_CLEANUP_KEYS.has(key)) {
                 const suggestion = findClosestMatch(key, KNOWN_CLEANUP_KEYS);
                 const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                yield* Console.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
+                yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
                 warnings++;
             }
             const secrets = cleanupObj.secrets;
@@ -185,7 +190,7 @@ const doctorCommand = Command.make("doctor", {
                 for (const key of Object.keys(secrets))if (!KNOWN_CLEANUP_SECRETS_KEYS.has(key)) {
                     const suggestion = findClosestMatch(key, KNOWN_CLEANUP_SECRETS_KEYS);
                     const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Console.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
+                    yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
                     warnings++;
                 }
             }
@@ -194,21 +199,25 @@ const doctorCommand = Command.make("doctor", {
                 for (const key of Object.keys(variables))if (!KNOWN_CLEANUP_VARIABLES_KEYS.has(key)) {
                     const suggestion = findClosestMatch(key, KNOWN_CLEANUP_VARIABLES_KEYS);
                     const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Console.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
+                    yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
                     warnings++;
                 }
             }
         }
-        yield* Console.log("Schema validation: passed");
-        yield* Console.log("\nRequired fine-grained token permissions:");
-        yield* Console.log("  Repository permissions > Administration (Read and write) -- settings sync");
-        yield* Console.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
-        yield* Console.log("  Repository permissions > Variables (Read and write) -- Actions variables");
-        yield* Console.log("  Repository permissions > Environments (Read and write) -- environment sync");
-        yield* Console.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
-        if (0 === warnings) yield* Console.log("\nNo unknown keys detected.");
-        else yield* Console.log(`\n${warnings} warning(s) found.`);
-    })).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
+        yield* Effect.log("Schema validation: passed");
+        yield* Effect.log("\nRequired fine-grained token permissions:");
+        yield* Effect.log("  Repository permissions > Administration (Read and write) -- settings sync");
+        yield* Effect.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
+        yield* Effect.log("  Repository permissions > Variables (Read and write) -- Actions variables");
+        yield* Effect.log("  Repository permissions > Environments (Read and write) -- environment sync");
+        yield* Effect.log("  Repository permissions > Code scanning alerts (Read and write) -- code_scanning sync");
+        yield* Effect.log("  Repository permissions > Dependabot alerts (Read and write) -- security feature sync");
+        yield* Effect.log("  Repository permissions > Secret scanning alerts (Read and write) -- secret scanning delegation");
+        yield* Effect.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
+        yield* Effect.log("  Organization permissions > Members (Read) -- resolve team slugs (org-level only)");
+        if (0 === warnings) yield* Effect.log("\nNo unknown keys detected.");
+        else yield* Effect.log(`\n${warnings} warning(s) found.`);
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
 const projectOption = Options.boolean("project").pipe(Options.withDescription("Create config in current directory instead of XDG/home location"), Options.withDefault(false));
 const CONFIG_TEMPLATE = `# reposets configuration
 # See: https://github.com/spencerbeggs/reposets
@@ -255,6 +264,35 @@ const CONFIG_TEMPLATE = `# reposets configuration
 # [[rulesets.default-branch.rules]]
 # type = "deletion"
 
+# --- Advanced security ---
+# Nested inside a settings group (folded into the same PATCH /repos call).
+# Some fields are GHAS-licensed and only work on public repos or
+# private repos with a GHAS subscription. Org-only fields are silently
+# skipped on personal accounts.
+#
+# [settings.defaults.security_and_analysis]
+# secret_scanning = "enabled"
+# secret_scanning_push_protection = "enabled"
+# dependabot_security_updates = "enabled"
+
+# --- Security feature toggles ---
+# Dedicated PUT/DELETE endpoints; omit a key to leave it untouched.
+#
+# [security.oss-defaults]
+# vulnerability_alerts = true
+# automated_security_fixes = true
+# private_vulnerability_reporting = true
+
+# --- CodeQL default setup ---
+# Applies via PATCH /repos/{o}/{r}/code-scanning/default-setup.
+# Languages not detected in the repo are skipped with a warning.
+#
+# [code_scanning.oss-defaults]
+# state = "configured"
+# languages = ["javascript-typescript", "python"]
+# query_suite = "extended"
+# threat_model = "remote"
+
 # --- Cleanup defaults ---
 # [cleanup]
 # secrets = false
@@ -268,6 +306,8 @@ const CONFIG_TEMPLATE = `# reposets configuration
 # secrets = { actions = ["from-files", "from-creds"] }
 # variables = { actions = ["turbo", "bot"] }
 # rulesets = ["default-branch"]
+# security = ["oss-defaults"]
+# code_scanning = ["oss-defaults"]
 `;
 const CREDENTIALS_TEMPLATE = `# reposets credentials (keep this file private)
 # See: https://github.com/spencerbeggs/reposets
@@ -289,15 +329,15 @@ const initCommand = Command.make("init", {
         });
         const configPath = join(targetDir, CONFIG_FILE);
         const credsPath = join(targetDir, CREDENTIALS_FILE);
-        if (existsSync(configPath)) yield* Console.log(`Config already exists: ${configPath}`);
+        if (existsSync(configPath)) yield* Effect.log(`Config already exists: ${configPath}`);
         else {
             writeFileSync(configPath, CONFIG_TEMPLATE);
-            yield* Console.log(`Created: ${configPath}`);
+            yield* Effect.log(`Created: ${configPath}`);
         }
-        if (existsSync(credsPath)) yield* Console.log(`Credentials already exists: ${credsPath}`);
+        if (existsSync(credsPath)) yield* Effect.log(`Credentials already exists: ${credsPath}`);
         else {
             writeFileSync(credsPath, CREDENTIALS_TEMPLATE);
-            yield* Console.log(`Created: ${credsPath}`);
+            yield* Effect.log(`Created: ${credsPath}`);
         }
         if (project) {
             const gitignorePath = join(targetDir, ".gitignore");
@@ -305,35 +345,37 @@ const initCommand = Command.make("init", {
                 const content = readFileSync(gitignorePath, "utf-8");
                 if (!content.includes(CREDENTIALS_FILE)) {
                     appendFileSync(gitignorePath, `\n${CREDENTIALS_FILE}\n`);
-                    yield* Console.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
+                    yield* Effect.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
                 }
             } else {
                 writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-                yield* Console.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
+                yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
             }
         } else {
             const gitignorePath = join(targetDir, ".gitignore");
             if (!existsSync(gitignorePath)) {
                 writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-                yield* Console.log(`Created .gitignore in ${targetDir}`);
+                yield* Effect.log(`Created .gitignore in ${targetDir}`);
             }
         }
-        yield* Console.log("\nDone! Edit your config and credentials files to get started.");
-    })).pipe(Command.withDescription("Scaffold config files"));
+        yield* Effect.log("\nDone! Edit your config and credentials files to get started.");
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Scaffold config files"));
 const list_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
 const listCommand = Command.make("list", {
     config: list_configOption
 }, ({ config })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
-        const { config: parsedConfig } = yield* loadConfigWithDir(configFile, config);
+        const sources = yield* configFile.discover;
+        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
+        const parsedConfig = sources[0].value;
         const defaultOwner = parsedConfig.owner ?? "(not set)";
-        yield* Console.log(`Default owner: ${defaultOwner}\n`);
+        yield* Effect.log(`Default owner: ${defaultOwner}\n`);
         for (const [groupName, group] of Object.entries(parsedConfig.groups)){
             const owner = group.owner ?? parsedConfig.owner ?? "(not set)";
-            yield* Console.log(`[${groupName}] (owner: ${owner})`);
-            for (const repo of group.repos)yield* Console.log(`  - ${owner}/${repo}`);
-            if (group.settings?.length) yield* Console.log(`  settings: ${group.settings.join(", ")}`);
-            if (group.environments?.length) yield* Console.log(`  environments: ${group.environments.join(", ")}`);
+            yield* Effect.log(`[${groupName}] (owner: ${owner})`);
+            for (const repo of group.repos)yield* Effect.log(`  - ${owner}/${repo}`);
+            if (group.settings?.length) yield* Effect.log(`  settings: ${group.settings.join(", ")}`);
+            if (group.environments?.length) yield* Effect.log(`  environments: ${group.environments.join(", ")}`);
             if (group.secrets) {
                 const parts = [];
                 if (group.secrets.actions?.length) parts.push(`actions:[${group.secrets.actions.join(",")}]`);
@@ -342,7 +384,7 @@ const listCommand = Command.make("list", {
                 if (group.secrets.environments) {
                     for (const [envName, envGroups] of Object.entries(group.secrets.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
                 }
-                if (parts.length) yield* Console.log(`  secrets: ${parts.join(", ")}`);
+                if (parts.length) yield* Effect.log(`  secrets: ${parts.join(", ")}`);
             }
             if (group.variables) {
                 const parts = [];
@@ -350,13 +392,15 @@ const listCommand = Command.make("list", {
                 if (group.variables.environments) {
                     for (const [envName, envGroups] of Object.entries(group.variables.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
                 }
-                if (parts.length) yield* Console.log(`  variables: ${parts.join(", ")}`);
+                if (parts.length) yield* Effect.log(`  variables: ${parts.join(", ")}`);
             }
-            if (group.rulesets?.length) yield* Console.log(`  rulesets: ${group.rulesets.join(", ")}`);
-            if (group.credentials) yield* Console.log(`  credentials: ${group.credentials}`);
-            yield* Console.log("");
+            if (group.rulesets?.length) yield* Effect.log(`  rulesets: ${group.rulesets.join(", ")}`);
+            if (group.security?.length) yield* Effect.log(`  security: ${group.security.join(", ")}`);
+            if (group.code_scanning?.length) yield* Effect.log(`  code_scanning: ${group.code_scanning.join(", ")}`);
+            if (group.credentials) yield* Effect.log(`  credentials: ${group.credentials}`);
+            yield* Effect.log("");
         }
-    })).pipe(Command.withDescription("Show config summary"));
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Show config summary"));
 const sync_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
 const groupOption = Options.text("group").pipe(Options.withDescription("Sync only a specific repo group"), Options.optional);
 const repoOption = Options.text("repo").pipe(Options.withDescription("Sync only a specific repo"), Options.optional);
@@ -377,7 +421,10 @@ const syncCommand = Command.make("sync", {
     logLevel: logLevelOption
 }, ({ config, group, repo, dryRun, noCleanup, logLevel: logLevelFlag })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
-        const { config: parsedConfig, configDir } = yield* loadConfigWithDir(configFile, config);
+        const sources = yield* configFile.discover;
+        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
+        const parsedConfig = sources[0].value;
+        const configDir = dirname(sources[0].path);
         const credentialsFile = yield* ReposetsCredentialsFile;
         const credentials = yield* credentialsFile.loadOrDefault({
             profiles: {}
@@ -385,7 +432,7 @@ const syncCommand = Command.make("sync", {
         const profileNames = Object.keys(credentials.profiles);
         const defaultProfile = 1 === profileNames.length ? profileNames[0] : void 0;
         const token = defaultProfile ? credentials.profiles[defaultProfile]?.github_token : void 0;
-        if (!token) return void (yield* Console.error("No GitHub token found. Run 'reposets credentials create' first."));
+        if (!token) return void (yield* Effect.logError("No GitHub token found. Run 'reposets credentials create' first."));
         const logLevel = "Some" === logLevelFlag._tag ? logLevelFlag.value : parsedConfig.log_level;
         const githubLayer = GitHubClientLive(token);
         const opLayer = OnePasswordClientLive;
@@ -397,7 +444,7 @@ const syncCommand = Command.make("sync", {
         const engineLayer = Layer.provideMerge(SyncEngineLive, Layer.merge(Layer.merge(githubLayer, resolverLayer), loggerLayer));
         const groupFilter = "Some" === group._tag ? group.value : void 0;
         const repoFilter = "Some" === repo._tag ? repo.value : void 0;
-        if (dryRun && "silent" !== logLevel) yield* Console.log("DRY RUN \u2014 no changes will be made\n");
+        if (dryRun && "silent" !== logLevel) yield* Effect.log("DRY RUN \u2014 no changes will be made\n");
         yield* Effect.provide(Effect.gen(function*() {
             const engine = yield* SyncEngine;
             yield* engine.syncAll(parsedConfig, credentials, {
@@ -408,82 +455,51 @@ const syncCommand = Command.make("sync", {
                 configDir
             });
         }), engineLayer);
-    })).pipe(Command.withDescription("Sync repos with GitHub"));
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Sync repos with GitHub"));
 const validate_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
 const validateCommand = Command.make("validate", {
     config: validate_configOption
 }, ({ config })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
         let hasErrors = false;
-        const configResult = yield* Effect.either(loadConfigWithDir(configFile, config));
-        if ("Left" === configResult._tag) return void (yield* Console.error(`Config validation failed: ${configResult.left.message}`));
-        yield* Console.log("Config schema: valid");
-        const { config: parsedConfig, configDir } = configResult.right;
-        for (const [groupName, group] of Object.entries(parsedConfig.groups)){
-            for (const ref of group.settings ?? [])if (!parsedConfig.settings?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown settings group '${ref}'`);
-                hasErrors = true;
-            }
-            const allSecretRefs = [
-                ...group.secrets?.actions ?? [],
-                ...group.secrets?.dependabot ?? [],
-                ...group.secrets?.codespaces ?? []
-            ];
-            for (const ref of allSecretRefs)if (!parsedConfig.secrets?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown secrets group '${ref}'`);
-                hasErrors = true;
-            }
-            for (const ref of group.variables?.actions ?? [])if (!parsedConfig.variables?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown variables group '${ref}'`);
-                hasErrors = true;
-            }
-            for (const ref of group.rulesets ?? [])if (!parsedConfig.rulesets?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown ruleset '${ref}'`);
-                hasErrors = true;
-            }
-            for (const ref of group.environments ?? [])if (!parsedConfig.environments?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown environment '${ref}'`);
-                hasErrors = true;
-            }
-            if (group.secrets?.environments) {
-                for (const [envName, groupRefs] of Object.entries(group.secrets.environments))for (const ref of groupRefs)if (!parsedConfig.secrets?.[ref]) {
-                    yield* Console.error(`Group '${groupName}': secrets.environments.${envName} references unknown secrets group '${ref}'`);
-                    hasErrors = true;
-                }
-            }
-            if (group.variables?.environments) {
-                for (const [envName, groupRefs] of Object.entries(group.variables.environments))for (const ref of groupRefs)if (!parsedConfig.variables?.[ref]) {
-                    yield* Console.error(`Group '${groupName}': variables.environments.${envName} references unknown variables group '${ref}'`);
-                    hasErrors = true;
-                }
-            }
-        }
+        const configResult = yield* Effect.either(configFile.discover);
+        if ("Left" === configResult._tag) return void (yield* Effect.logError(`Config validation failed: ${configResult.left.message}`));
+        const sources = configResult.right;
+        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
+        yield* Effect.log("Config schema: valid");
+        const parsedConfig = sources[0].value;
+        const configDir = dirname(sources[0].path);
         for (const [groupName, group] of Object.entries(parsedConfig.secrets))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
             const fullPath = join(configDir, filePath);
             if (!existsSync(fullPath)) {
-                yield* Console.error(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+                yield* Effect.logError(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
                 hasErrors = true;
             }
         }
         for (const [groupName, group] of Object.entries(parsedConfig.variables))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
             const fullPath = join(configDir, filePath);
             if (!existsSync(fullPath)) {
-                yield* Console.error(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+                yield* Effect.logError(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
                 hasErrors = true;
             }
         }
         const credentialsFile = yield* ReposetsCredentialsFile;
         const credsResult = yield* Effect.either(credentialsFile.load);
-        if ("Left" === credsResult._tag) yield* Console.log("Credentials file: not found (optional)");
+        if ("Left" === credsResult._tag) yield* Effect.log("Credentials file: not found (optional)");
         else {
-            yield* Console.log("Credentials schema: valid");
+            yield* Effect.log("Credentials schema: valid");
             for (const [groupName, group] of Object.entries(parsedConfig.groups))if (group.credentials && !credsResult.right.profiles[group.credentials]) {
-                yield* Console.error(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
+                yield* Effect.logError(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
                 hasErrors = true;
             }
         }
-        if (!hasErrors) yield* Console.log("\nAll checks passed.");
-    })).pipe(Command.withDescription("Validate config without API calls"));
+        if (!hasErrors) yield* Effect.log("\nAll checks passed.");
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Validate config without API calls"));
+const CliLogger = Logger.replace(Logger.defaultLogger, Logger.make(({ logLevel, message })=>{
+    const text = "string" == typeof message ? message : String(message);
+    if (LogLevel.greaterThanEqual(logLevel, LogLevel.Error)) globalThis.console.error(text);
+    else globalThis.console.log(text);
+}));
 const rootCommand = Command.make("reposets").pipe(Command.withSubcommands([
     syncCommand,
     listCommand,
@@ -496,5 +512,5 @@ const cli = Command.run(rootCommand, {
     name: "reposets",
     version: "0.0.0"
 });
-const program = Effect.suspend(()=>cli(process.argv)).pipe(Effect.provide(ConfigFilesLive), Effect.provide(NodeContext.layer));
+const program = Effect.suspend(()=>cli(process.argv)).pipe(Effect.provide(NodeContext.layer), Effect.provide(CliLogger));
 NodeRuntime.runMain(program);