rvlib-shipkit 2.7.0 → 2.9.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 2.9.0
+
+- **`sk fleet --update` commits and pushes each bump.** Every repo the update moved gets one commit of package.json and its lock alone, by pathspec, through the repo's own hooks: `chore(deps): rvlib-shipkit <range>`, then the plain push of `sk fleet push`. A repo whose manifest held changes before the update, whose package.json moved more than the bump, mid-merge, mid-rebase, on a detached HEAD or nested in another repo is skipped, its bump left in the tree and the command to run printed. A refused hook, a failed push or a branch behind its upstream is a FAIL line, and the command exits 1. `--no-commit` leaves every bump in its tree, as before.
+- **`sk fleet --update` moves a published package's devDependencies.** A repo that declares `release.npm` was only told its bump (« published to npm, never updated by a check »), so comfy-ts stayed behind on every release. Under the fleet, SK005 now moves its devDependencies; a `dependencies` entry stays named, and a plain gate still never writes either.
+- **The review card: a rectangle's note opens beside it, every image starts full, every text box grows.** A rectangle drawn on an image opens its note box right there, under it (over it when it sits low), numbered and focused, to type in at once, Enter or Escape closes it, a click on the rectangle opens it again, ✕ deletes it; the answer column still lists every note. Each image, pair and clip of a choice or a group shows full under its row from the start (⤢ folds one); a sound stays a row. Every text box of the page (the overall word, a view's or a tile's word, a note, the reply, a trailer note) grows with its text, no inner scrollbar and no drag handle: `AutoText` (`hub-app/auto-text.tsx`), which the atelier's prompt now uses too. On a phone the card pane holds the answer under the views (no third « answer » pane), a field's text is 16 px so the page no longer zooms into it, and the views' labels take the whole width. Another card opens at its top. A draft card's history cycles in place over its live frame again (a slider), and its files carry the frame, so a new frame shows. A clip's sound button and volume sit on one line with its time (a sound view's class had taken the same name).
+
+## 2.8.0
+
+- **A brand's `icon` draws the favicon family at each size.** `icon: canvas(draw)` in `.shipkit/identity/brand.ts` draws `favicon.png` (512), `favicon-32.png`, `favicon-16.png` and `apple-touch-icon.png` (180, flattened on `palette.bg`), each at its own size, `asset.id` naming the file, so a 16 px tab reads a shape made for it, never a shrunk logo. Without one the favicon is the logo master resized, as before.
+- **comfy-ts is an optional peer, no longer a dependency.** A repo that never declares comfy no longer installs it (npm and bun both skip an optional peer). The toolkit names comfy-ts in no import, a type import included, so importing it, `sk ci`, `sk serve`, the hub and `sk assets identity` never load it. It is loaded at the first workflow load, from the repo's copy. A repo with comfy kinds or `.cflow.ts` modules installs it itself: `bun add -d comfy-ts`. Without it, a workflow load fails loud with that line, and `sk sound` fails loud when no `comfy-ts` is on PATH. `LoadedWorkflow.wf` is typed by the toolkit's own `CflowWorkflow`, the slice of comfy-ts it drives, held to comfy-ts's types by a test.
+- **`og.png` is written small.** The identity writer encodes the og card as a 256 colour palette png at maximum compression: invisible at preview size, and a photo card drops about 3x (pkm-multi's banner card: 970 KB → 280 KB), under the size where some chat apps stop showing a preview. The file name and format stay `og.png`.
+
 ## 2.7.0
 
 - **What waits on the owner is a pill on every repo's row of the project list.** Beside the open asks badge, a pill in the review hue counts the cards that wait on the owner's verdict or answer; zero draws none, and folded it rides the icon's top left corner. A click opens that repo's review page on its first waiting card, the list on the owner's move. One count, `waitingCards` (`collections/review.ts`), read by the tree's review row, `sk needs`, the review page and the list; `/api/projects.json` reads it on every request, so a new card shows within one poll and a verdict at once. Below 768 px the list is always the rail, so the pills show on a phone.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "2.7.0",
+    "version": "2.9.0",
     "funding": "https://github.com/sponsors/rvion",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",
@@ -25,7 +25,8 @@
         "@types/bun": "^1.3.14",
         "@types/react": "^19.2.17",
         "@types/react-dom": "^19.2.3",
-        "@types/sanitize-html": "^2.16.1"
+        "@types/sanitize-html": "^2.16.1",
+        "comfy-ts": "^2.9.0"
     },
     "overrides": {
         "mobx": "^7.0.0",
@@ -38,7 +39,6 @@
         "@floating-ui/react": "^0.27.20",
         "@napi-rs/canvas": "^1.1.0",
         "clipanion": "^4.0.0-rc.4",
-        "comfy-ts": "^2.9.0",
         "ink": "^7.1.1",
         "marked": "^18.0.7",
         "mobx": "^7.0.0",
@@ -48,5 +48,13 @@
         "react-resizable-panels": "^4.13.3",
         "sanitize-html": "^2.17.6",
         "sharp": "^0.35.3"
+    },
+    "peerDependencies": {
+        "comfy-ts": "^2.9.0"
+    },
+    "peerDependenciesMeta": {
+        "comfy-ts": {
+            "optional": true
+        }
     }
 }

package/src/assets/gen/comfyts-gen.ts

@@ -4,16 +4,40 @@
 // must disconnectAll() in a finally, or the host websocket keeps bun alive.
 // Workflows are discriminated by duck-typing, never instanceof: a consumer's
 // .cflow.ts may hold a second copy of comfy-ts in its module graph.
+// comfy-ts is an optional peer: this file is the one place that loads it, at
+// the first workflow load, and never names it in an import, so a repo without
+// it imports and typechecks the toolkit (tests/comfy-optional.test.ts).
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'fs'
 import { basename, join } from 'path'
 import { pathToFileURL } from 'url'
-import { ComfyTS, type AnyVar, type ComfyExecution, type DefinedWorkflow, type MediaImage } from 'comfy-ts'
+
+// the slice of comfy-ts the toolkit drives, held to comfy-ts's own types by
+// tests/comfy-optional.test.ts
+export type CflowVar = { readonly kind: string; parse(raw: string): boolean; loadJSON(value: unknown): unknown; reset(): unknown }
+export type CflowImage = { readonly ComfyNode: { class_type?: string } | null | undefined; readonly metadata: { type?: string }; readonly buffer: Uint8Array }
+export type CflowExecution = { readonly status: string | null | undefined; data: { error?: unknown }; images: CflowImage[]; imageErrors: unknown[] }
+export type CflowHost = {
+    data: { id: string }
+    schema: { readonly size: number }
+    getServerHostHTTP(): string
+    disconnect(): void
+    interrupt(): Promise<void>
+}
+export type CflowWorkflow = {
+    spec: { id?: string }
+    readonly vars: { [key: string]: CflowVar }
+    host: CflowHost
+    entries(): [string, CflowVar][]
+    build(): Promise<{ problems: { title: string }[]; readonly size: number }>
+    run(settings?: { onProgress?: (p: { percent: number; nodeName: string | null }) => void }): Promise<CflowExecution>
+}
+type ComfyTsModule = { ComfyTS?: { create(o: { rootPath: string }): unknown } }
 
 export type GenProgress = { value: number; max: number; node: string | null }
 export type OnProgress = (p: GenProgress) => void
 
 /** root: the repo the workflow belongs to, which holds its drafts */
-export type LoadedWorkflow = { id: string; root: string; file: string; wf: DefinedWorkflow }
+export type LoadedWorkflow = { id: string; root: string; file: string; wf: CflowWorkflow }
 export type ComfyTsRuntime = { workflows: Map<string, LoadedWorkflow>; heal?: string }
 
 // function declaration, not const — TS only narrows on never-calls to
@@ -22,35 +46,39 @@ function fail(msg: string): never { throw new Error(msg) }
 
 // same duck predicate the comfy-ts TUI and serve bind to: a module valid
 // for shipkit is valid for `bunx comfy-ts tui` and vice versa
-function findDefinedWorkflow(mod: Record<string, unknown>): DefinedWorkflow | null {
-    const isDefined = (x: unknown): x is DefinedWorkflow =>
+function findDefinedWorkflow(mod: Record<string, unknown>): CflowWorkflow | null {
+    const isDefined = (x: unknown): x is CflowWorkflow =>
         typeof x === 'object' && x != null && 'spec' in x &&
-        typeof (x as DefinedWorkflow).run === 'function' &&
-        typeof (x as DefinedWorkflow).entries === 'function'
+        typeof (x as CflowWorkflow).run === 'function' &&
+        typeof (x as CflowWorkflow).entries === 'function'
     return [mod.default, ...Object.values(mod)].find(isDefined) ?? null
 }
 
-const varsOf = (wf: DefinedWorkflow): Record<string, AnyVar> => wf.vars as Record<string, AnyVar>
-
 /** true when the image belongs in a roll. Preview-family nodes (PreviewImage,
  *  PreviewBridge, …) emit raw temp images that comfy-ts downloads like any
  *  output, in completion order, and MediaImage drops the server-side
  *  'temp' marker, so the producing node's class_type is the only signal left.
  *  no node json (SaveImageWebsocket frames) = deliberate output, kept. */
-export const isRollImage = (img: Pick<MediaImage, 'ComfyNode'>): boolean =>
+export const isRollImage = (img: Pick<CflowImage, 'ComfyNode'>): boolean =>
     !/preview/i.test(img.ComfyNode?.class_type ?? '')
 
-/** the ComfyTS class of the comfy-ts a bare import from `dir` reaches,
- *  shipkit's own when the repo carries none */
-async function comfyTsOf(dir: string): Promise<typeof ComfyTS> {
-    let path: string
-    try {
-        path = Bun.resolveSync('comfy-ts', dir)
-    } catch {
-        return ComfyTS
+const COMFY_TS = 'comfy-ts'
+const INSTALL_COMFY_TS = 'Install it in this repo: bun add -d comfy-ts'
+
+/** the ComfyTS class of the comfy-ts a bare import from `dir` reaches, else
+ *  the toolkit's own; loud when neither is installed */
+async function comfyTsOf(dir: string): Promise<NonNullable<ComfyTsModule['ComfyTS']>> {
+    for (const from of [dir, import.meta.dir]) {
+        let path: string
+        try {
+            path = Bun.resolveSync(COMFY_TS, from)
+        } catch {
+            continue
+        }
+        const mod = (await import(path)) as ComfyTsModule
+        if (typeof mod.ComfyTS?.create === 'function') return mod.ComfyTS
     }
-    const mod = (await import(path)) as { ComfyTS?: typeof ComfyTS }
-    return typeof mod.ComfyTS?.create === 'function' ? mod.ComfyTS : ComfyTS
+    fail(`comfy-ts is not installed, and ${dir}/ holds comfy-ts workflow modules. ${INSTALL_COMFY_TS}`)
 }
 
 /** dir = the flat folder holding the <id>.cflow.ts workflow modules.
@@ -74,7 +102,10 @@ export async function loadCflowWorkflows(root: string, dir: string): Promise<Map
     for (const f of readdirSync(dir).filter((x) => x.endsWith('.cflow.ts')).sort()) {
         const file = join(dir, f)
         const id = basename(f, '.cflow.ts')
-        const mod = (await import(pathToFileURL(file).href)) as Record<string, unknown>
+        const mod = (await import(pathToFileURL(file).href).catch((e: Error) => {
+            if (/Cannot find (package|module) 'comfy-ts'/.test(e.message)) fail(`${file} imports comfy-ts, which this repo does not install. ${INSTALL_COMFY_TS}`)
+            throw e
+        })) as Record<string, unknown>
         const wf = findDefinedWorkflow(mod)
         if (wf == null) fail(`${file}: exports no DefinedWorkflow — export default host.defineWorkflow({...})`)
         // the file name IS the id: it is also the comfy-ts draft folder key,
@@ -96,7 +127,7 @@ export function workflowFor(workflows: Map<string, LoadedWorkflow>, ref: { workf
         : workflows.size === 1
           ? [...workflows.values()][0]!
           : fail(`asset '${ref.assetId ?? '?'}' names no workflow and ${workflows.size} are loaded (${[...workflows.keys()].join(', ')}) — set workflow on the kind`)
-    const vars = varsOf(lw.wf)
+    const vars = lw.wf.vars
     if (vars.prompt?.kind !== 'prompt' || vars.seed?.kind !== 'seed')
         fail(`kind '${ref.kind ?? '?'}' drives workflow '${lw.id}', which must declare vars.prompt (v.prompt) and vars.seed (v.seed) — the atelier writes both`)
     return lw
@@ -105,8 +136,8 @@ export function workflowFor(workflows: Map<string, LoadedWorkflow>, ref: { workf
 /** Apply a name→value record onto a workflow's vars: strings go through
  *  parse (validated), everything else through loadJSON (the drafts setter).
  *  Unknown names throw listing what the workflow has. */
-export function applyVarValues(wf: DefinedWorkflow, vars: Record<string, unknown>, source: string): void {
-    const defs = varsOf(wf)
+export function applyVarValues(wf: CflowWorkflow, vars: Record<string, unknown>, source: string): void {
+    const defs = wf.vars
     for (const [name, value] of Object.entries(vars)) {
         const varDef = defs[name]
         if (varDef == null) fail(`${source}: unknown var '${name}' on workflow '${wf.spec.id ?? '?'}' (has: ${wf.entries().map(([n, d]) => `${n}:${d.kind}`).join(', ')})`)
@@ -167,7 +198,7 @@ export async function generateComfyTs(
     // names no kind. It is what the tune button edits
     const draftId = args.draftId ?? args.assetId
     ensureAssetDraft(lw, draftId, args.prompt)
-    const defs = varsOf(lw.wf)
+    const defs = lw.wf.vars
     // modules are import-cached: a previous asset's values must not leak
     for (const [, varDef] of lw.wf.entries()) varDef.reset()
     if (args.vars != null) applyVarValues(lw.wf, args.vars, `asset '${args.assetId}' kit vars`)
@@ -192,7 +223,7 @@ export async function generateComfyTs(
     defs.seed!.parse(`= ${args.seed}`)
     mkdirSync(args.destDir, { recursive: true })
     const healHint = rt.heal != null ? ` — is the backend up? (${rt.heal})` : ''
-    let execution: ComfyExecution
+    let execution: CflowExecution
     try {
         execution = await lw.wf.run({
             onProgress: args.onProgress == null ? undefined : (p) => args.onProgress!({ value: Math.round(p.percent), max: 100, node: p.nodeName }),

package/src/assets/kits/identity-kit.ts

@@ -1,6 +1,7 @@
 // kits/identity — favicon / logo / OG as asset kinds. One render path
 // (renderIdentityFromMark: mark png → logo master 1024², favicon 512², og
-// card), two ways to get the mark:
+// card; a brand's `icon` draws the favicon family at each size instead), two
+// ways to get the mark:
 // - canvas mark: deterministic, instant — `shipkit assets identity` draws it
 //   headlessly and renders the set.
 // - comfy mark: roll-and-pick in the studio; the kind carries a BUILT-IN ship
@@ -28,6 +29,12 @@ export type Brand = {
     /** comfy marks: the FULL generation prompt for identity-logo rolls
      *  (style included — the studio shows/edits exactly this) */
     markPrompt?: string
+    /** the small mark, when the logo does not read at 16 px: favicon.png,
+     *  favicon-32.png, favicon-16.png and apple-touch-icon.png (180², flattened
+     *  on palette.bg) are each drawn at their own size; `asset.id` names the
+     *  file (apple-touch-icon fills its square: iOS rounds it). Absent, the
+     *  favicon is the logo master resized */
+    icon?: CanvasGen
     /** og layout hook — replaces the WHOLE default card (bg + mark left +
      *  name/tagline right); the hook owns compositing the mark if it wants one */
     drawOg?: (ctx: SKRSContext2D, brand: Brand, size: { w: number; h: number }) => void
@@ -42,6 +49,8 @@ export const FAVICON_SIZE = 512
 export const OG_W = 1200
 export const OG_H = 630
 export const LOGO_SIZE = 1024
+/** what a brand's `icon` draws, each at its own size */
+export const ICON_FILES = [['favicon', FAVICON_SIZE], ['favicon-32', 32], ['favicon-16', 16], ['apple-touch-icon', 180]] as const
 
 /** the one next step when a comfy mark has no picked roll yet */
 export const NO_PICK_FIX = 'roll + pick in the studio: bun run hub → /assets/#identity-logo'
@@ -110,13 +119,23 @@ export async function renderIdentityFromMark(brand: Brand, root: string, markPng
         .resize(LOGO_SIZE, LOGO_SIZE, { fit: 'contain', background: { r: 0, g: 0, b: 0, alpha: 0 } })
         .png().toBuffer()
     await write('logo.png', logoPng)
-    // favicon = logo master resized to 512² (browsers derive the rest)
-    await write('favicon.png', await sharp(logoPng).resize(FAVICON_SIZE, FAVICON_SIZE).png().toBuffer())
+    if (brand.icon != null) {
+        for (const [id, px] of ICON_FILES) {
+            const c = createCanvas(px, px)
+            await brand.icon.draw(c.getContext('2d'), { id, prompt: '' })
+            const png = sharp(c.toBuffer('image/png'))
+            await write(`${id}.png`, await (id === 'apple-touch-icon' ? png.flatten({ background: brand.palette.bg }) : png).png().toBuffer())
+        }
+    } else {
+        // favicon = logo master resized to 512² (browsers derive the rest)
+        await write('favicon.png', await sharp(logoPng).resize(FAVICON_SIZE, FAVICON_SIZE).png().toBuffer())
+    }
     const og = createCanvas(OG_W, OG_H)
     const ctx = og.getContext('2d')
     if (brand.drawOg != null) brand.drawOg(ctx, brand, { w: OG_W, h: OG_H })
     else defaultOg(ctx, brand, { w: OG_W, h: OG_H }, await loadImage(logoPng))
-    await write('og.png', og.toBuffer('image/png'))
+    // a link preview is small: a 256 colour palette is invisible there and cuts a photo card about 3x (some chat apps drop a preview past ~300 KB)
+    await write('og.png', await sharp(og.toBuffer('image/png')).png({ palette: true, quality: 90, effort: 10, compressionLevel: 9 }).toBuffer())
     return out
 }
 

package/src/checks/SK005-rvlib-versions.check.ts

@@ -40,7 +40,8 @@
 //             exists for: package.json moves, package-lock.json does not, and
 //             the `npm ci` a deploy runs refuses that pair
 //   registry unreachable → loud skip, never red (offline is not a defect)
-// Committing the bump stays with the working agent — shipkit never commits.
+// Committing the bump stays with the working agent: a check never commits
+// (`sk fleet --update` commits the bump it asked for, fleet/commit-bump.ts).
 // Clean passes cache 24h (rule ttl), so the registry is fetched at most
 // daily per repo; skip/WARN/FAIL runs are never cached. The key carries the
 // INSTALLED versions, so a manual `bun add -d rvlib-x@N` busts it: keyed on
@@ -51,7 +52,7 @@
 import { existsSync, readFileSync } from 'fs'
 import { basename, join } from 'path'
 import type { CheckCtx } from '../core/check-ctx.ts'
-import { allowMajor, breakingAdvice, isBreaking, isLinkedInstall, pinFloor } from '../core/update-policy.ts'
+import { allowMajor, breakingAdvice, fleetAsked, isBreaking, isLinkedInstall, pinFloor } from '../core/update-policy.ts'
 import { isRunningCopy, rememberLatest } from '../core/self-update.ts'
 import { rootPublishesNpm } from '../core/repo-facts.ts'
 import { mutateLease, withMutateLease } from '../core/locked-write.ts'
@@ -153,23 +154,28 @@ export const rvlibVersions = check({
         }
         if (stale.length === 0) return
 
-        const drift = stale.map((s) => `${s.name}${s.linked ? ' pin' : ''} ${s.installed} → ${s.latest}`).join(', ')
-        const names = stale.map((s) => s.name)
+        const driftOf = (xs: typeof stale): string => xs.map((s) => `${s.name}${s.linked ? ' pin' : ''} ${s.installed} → ${s.latest}`).join(', ')
         if (isRefusal(pm)) {
-            c.warn(`newer rvlib live: ${drift}, not updating: ${pm.refused}`)
+            c.warn(`newer rvlib live: ${driftOf(stale)}, not updating: ${pm.refused}`)
             return
         }
-        const cmd = pm.update(names)
         if (process.env['SHIPKIT_FROZEN'] === '1') {
-            c.warn(`newer rvlib live: ${drift} (frozen — apply with: ${cmd.join(' ')})`)
+            c.warn(`newer rvlib live: ${driftOf(stale)} (frozen — apply with: ${pm.update(stale.map((s) => s.name)).join(' ')})`)
             return
         }
         // a package published to npm: its package.json is its public
         // contract, so the bump is a release decision, named and never made
+        // by a check. `sk fleet --update` is the operator naming it, and a
+        // devDependency is read by no one who installs the package: it moves
+        let moving = stale
         if (rootPublishesNpm(c.config)) {
-            c.warn(`newer rvlib live: ${drift} (published to npm, never updated by a check — apply with: ${cmd.join(' ')})`)
-            return
+            const held = fleetAsked() ? stale.filter((s) => pkg.dependencies?.[s.name] != null) : stale
+            if (held.length > 0) c.warn(`newer rvlib live: ${driftOf(held)} (published to npm, never updated by a check${fleetAsked() ? ' nor the fleet: a dependency its installers get' : ''} — apply with: ${pm.update(held.map((s) => s.name)).join(' ')})`)
+            moving = stale.filter((s) => !held.includes(s))
+            if (moving.length === 0) return
         }
+        const drift = driftOf(moving)
+        const cmd = pm.update(moving.map((s) => s.name))
         const dirty = await c.exec(['git', 'status', '--porcelain', '--', ...manifest], { cwd: c.root })
         if (dirty.code !== 0 || dirty.out.trim() !== '') {
             c.warn(`newer rvlib live: ${drift} — self-update deferred (${dirty.code !== 0 ? `git says: ${dirty.out.trim().split('\n')[0] ?? `exit ${dirty.code}`}` : 'package.json/lockfile dirty'}); commit first, then re-run check`)
@@ -188,7 +194,7 @@ export const rvlibVersions = check({
             const up = await c.exec(cmd, { cwd: c.root, timeoutMs: 120_000 })
             // the update may swap a link for the tarball: put every link back,
             // whatever the update did, inside the same lease
-            for (const s of stale) if (s.linked) await c.exec(['bun', 'link', s.name], { cwd: c.root, timeoutMs: 60_000 })
+            for (const s of moving) if (s.linked) await c.exec(['bun', 'link', s.name], { cwd: c.root, timeoutMs: 60_000 })
             return up
         })
         if (!leased.ok) {
@@ -212,7 +218,7 @@ export const rvlibVersions = check({
             else c.warn(`self-update failed (${why}) and nothing was written — the registry or the network, not this repo. Retry with: ${cmd.join(' ')}: ${tail}`)
             return
         }
-        for (const s of stale) {
+        for (const s of moving) {
             if (s.linked) {
                 const now = pinFloor(readPin(c.root, s.name) ?? '')
                 if (!isLinkedInstall(c.root, s.name)) c.fail(`${s.name} pin ${s.installed} → ${now ?? 'unreadable'} but node_modules/${s.name} is no longer linked to its source — run: bun link ${s.name}`)

package/src/cli/cmd_Fleet.ts

@@ -1,7 +1,8 @@
 // shipkit fleet — every repo on this disk that installs the toolkit, and how
 // far behind each one is. Reports by default. `--update` hands the work to
 // each repo's OWN shipkit, so rule SK005 performs the update with the lease,
-// the dirty-tree guard and the frozen guard it already owns.
+// the dirty-tree guard and the frozen guard it already owns, then commits and
+// pushes each repo's bump unless `--no-commit`.
 import { Command, Option } from 'clipanion'
 import { join } from 'path'
 import { npmLatest, resolveLatest, scanFleet, type FleetRepo } from '../fleet/scan-fleet.ts'
@@ -17,7 +18,8 @@ export class FleetCommand extends Command {
         examples: [
             ['what is stale out there', 'sk fleet'],
             ['filesystem only, no registry', 'sk fleet --offline'],
-            ['bring every behind repo up, through its own gate', 'sk fleet --update'],
+            ['bring every behind repo up through its own gate, commit and push each bump', 'sk fleet --update'],
+            ['update, leave the bumps in the trees', 'sk fleet --update --no-commit'],
             ['one repo only', 'sk fleet --update --only my-app'],
             ['machine-readable', 'sk fleet --json'],
         ],
@@ -25,6 +27,7 @@ export class FleetCommand extends Command {
 
     root = Option.String('--root', { required: false, description: 'directory holding the repos (default: the parent of this repo)' })
     update = Option.Boolean('--update', false, { description: "run each behind repo's own `shipkit check`, which is where rule SK005 performs the guarded update" })
+    noCommit = Option.Boolean('--no-commit', false, { description: 'with --update: leave each bump in its tree. By default each moved repo commits package.json and its lock alone, by pathspec, as `chore(deps): <dep> <range>`, then pushes; a repo whose manifest was dirty before, whose package.json moved more than the bump, mid-merge, mid-rebase, on a detached HEAD or nested in another repo is skipped with the command to run' })
     only = Option.Array('--only', { description: 'limit to these repo directory names (repeatable)' })
     offline = Option.Boolean('--offline', false, { description: 'skip the registry: report what is installed, never what is current' })
     major = Option.Boolean('--major', false, { description: 'let --update cross a breaking boundary too. Default off: a major (or a 0.x minor, as npm caret reads it) is a porting job, not a bump, and no automatic update path takes one' })
@@ -58,11 +61,11 @@ export class FleetCommand extends Command {
             return 0
         }
         if (!this.update) {
-            w(`WARN ${behind.length}/${repos.length} repo(s) behind — rerun with --update, which runs each repo's own gate so SK005 does the write`)
+            w(`WARN ${behind.length}/${repos.length} repo(s) behind — rerun with --update, which runs each repo's own gate so SK005 does the write, then commits and pushes each bump`)
             return 0
         }
-        await updateFleet(behind, { major: this.major, print: w })
-        return 0
+        const res = await updateFleet(behind, { major: this.major, commit: !this.noCommit, print: w })
+        return res.failed > 0 ? 1 : 0
     }
 
     private row(r: FleetRepo): string {

package/src/core/update-policy.ts

@@ -10,6 +10,12 @@ export const ALLOW_MAJOR_ENV = 'SHIPKIT_ALLOW_MAJOR'
 
 export const allowMajor = (): boolean => process.env[ALLOW_MAJOR_ENV] === '1'
 
+/** set by `shipkit fleet --update` on every repo run it spawns: the operator
+ *  named the bump, so a published package's devDependencies may move */
+export const FLEET_UPDATE_ENV = 'SHIPKIT_FLEET_UPDATE'
+
+export const fleetAsked = (): boolean => process.env[FLEET_UPDATE_ENV] === '1'
+
 /** a jump across the boundary npm's caret draws: a changed major, or on a
  *  `0.x` package a changed minor (`^0.2.0` means `<0.3.0`). A porting job
  *  rather than a bump, so no automatic path takes it. */

package/src/fleet/commit-bump.ts

@@ -0,0 +1,123 @@
+// the commit `fleet --update` makes once a repo moved: package.json and its lock
+// only, by pathspec (never a private index, never `add -A`, never a stash or a
+// branch switch), then the plain push of `sk fleet push`. It commits nothing
+// that is not the bump: a manifest dirty before the update, a package.json diff
+// beyond the moved deps, a merge or rebase under way and a detached HEAD each
+// skip, the files left updated and the line saying what to run.
+import { existsSync, readFileSync } from 'fs'
+import { isAbsolute, join } from 'path'
+import { detectPackageManager, isRefusal, LOCK_FILES } from '../core/package-manager.ts'
+import { git, pushRepo } from './push-fleet.ts'
+
+export type BumpResult = { status: 'pushed' | 'skip' | 'fail' | 'none'; line: string }
+
+type Change = { path: string; tracked: boolean }
+
+/** what the repo held before the update: its manifest (package.json and the
+ *  locks of the manager it installs with) and which of those files were
+ *  already changed, someone else's work. Null outside a git repo */
+export type Baseline = { manifest: string[]; dirty: Change[] } | null
+
+async function changes(dir: string, manifest: string[]): Promise<Change[] | null> {
+    const r = await git(dir, ['status', '--porcelain', '--', ...manifest])
+    if (r.code !== 0) return null
+    return r.out.split('\n').filter((l) => l !== '').map((l) => ({ path: l.slice(3), tracked: !l.startsWith('??') }))
+}
+
+export async function bumpBaseline(dir: string): Promise<Baseline> {
+    const pm = detectPackageManager(dir)
+    const manifest = ['package.json', ...(isRefusal(pm) ? LOCK_FILES : pm.locks)]
+    const dirty = await changes(dir, manifest)
+    return dirty == null ? null : { manifest, dirty }
+}
+
+const OPERATIONS: Array<[string, string]> = [['MERGE_HEAD', 'a merge'], ['rebase-merge', 'a rebase'], ['rebase-apply', 'a rebase'], ['CHERRY_PICK_HEAD', 'a cherry-pick'], ['REVERT_HEAD', 'a revert']]
+
+/** why this repo takes no commit of ours right now, or null. One git call:
+ *  the dir's place in its work tree (a nested repo is a folder of another
+ *  repo's history, never committed on), the ref HEAD names (`HEAD` itself
+ *  when detached), then where each operation in progress leaves its state */
+async function headRefusal(dir: string): Promise<string | null> {
+    const r = await git(dir, ['rev-parse', '--show-prefix', '--symbolic-full-name', 'HEAD', ...OPERATIONS.flatMap(([p]) => ['--git-path', p])])
+    if (r.code !== 0) return `git rev-parse failed: ${r.err.trim().split('\n')[0]}`
+    const [prefix, ref, ...paths] = r.out.split('\n').map((l) => l.trim())
+    if (prefix != null && prefix !== '') return `it is the folder ${prefix} of a larger repo, whose history is not its own`
+    for (const [i, [, label]] of OPERATIONS.entries()) {
+        const p = paths[i]
+        if (p != null && p !== '' && existsSync(isAbsolute(p) ? p : join(dir, p))) return `${label} is under way`
+    }
+    return ref === 'HEAD' ? 'HEAD is detached' : null
+}
+
+/** a value with its object keys sorted, so key order is never a change */
+const canonical = (v: unknown): unknown =>
+    Array.isArray(v) ? v.map(canonical) : v != null && typeof v === 'object' ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, canonical((v as Record<string, unknown>)[k])])) : v
+
+const DEP_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+
+/** every field of package.json the update changed besides the moved deps,
+ *  as `devDependencies.left-pad` or `scripts` */
+export function extraChanges(before: Record<string, unknown>, after: Record<string, unknown>, moved: string[]): string[] {
+    const out: string[] = []
+    for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+        const [b, a] = [before[key], after[key]]
+        if (DEP_FIELDS.includes(key) && (b == null || typeof b === 'object') && (a == null || typeof a === 'object')) {
+            const [bs, as] = [(b ?? {}) as Record<string, unknown>, (a ?? {}) as Record<string, unknown>]
+            for (const dep of new Set([...Object.keys(bs), ...Object.keys(as)])) {
+                if (moved.includes(dep) && (key === 'dependencies' || key === 'devDependencies')) continue
+                if (bs[dep] !== as[dep]) out.push(`${key}.${dep}`)
+            }
+            continue
+        }
+        if (JSON.stringify(canonical(b)) !== JSON.stringify(canonical(a))) out.push(key)
+    }
+    return out
+}
+
+const lastLine = (text: string): string | null => text.split('\n').map((l) => l.trim()).filter((l) => l !== '' && !l.startsWith('hint:')).at(-1) ?? null
+
+/** commit and push the bump of `moved` in `dir`, against the baseline read
+ *  before the update ran */
+export async function commitBump(repo: { name: string; dir: string }, moved: string[], base: Baseline): Promise<BumpResult> {
+    const { name, dir } = repo
+    const skip = (why: string, then: string): BumpResult => ({ status: 'skip', line: `skip: ${name}: ${why}, so the bump is not committed. It stays in the tree: cd ${dir} && ${then}` })
+    if (base == null) return skip('git status failed before the update', 'git status')
+    if (base.dirty.length > 0) {
+        const held = base.dirty.map((c) => c.path)
+        return skip(`${held.join(', ')} held changes before the update`, `git diff -- ${held.join(' ')}, then commit the bump with them by hand`)
+    }
+    const refused = await headRefusal(dir)
+    if (refused != null) return skip(refused, 'commit the bump by hand once it can take one')
+    const after = await changes(dir, base.manifest)
+    if (after == null) return { status: 'fail', line: `FAIL: ${name}: git status failed after the update: cd ${dir} && git status` }
+    const paths = after.filter((c) => c.tracked).map((c) => c.path).sort((a, b) => Number(b === 'package.json') - Number(a === 'package.json'))
+    if (paths.length === 0) return { status: 'none', line: `ok: ${name}: package.json and its lock unchanged, nothing to commit` }
+
+    const head = await git(dir, ['show', 'HEAD:./package.json'])
+    let was: Record<string, unknown>
+    let now: Record<string, unknown>
+    try {
+        was = JSON.parse(head.out) as Record<string, unknown>
+        now = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as Record<string, unknown>
+    } catch {
+        return skip('package.json is unreadable in HEAD or on disk', 'git diff -- package.json')
+    }
+    const extra = extraChanges(was, now, moved)
+    if (extra.length > 0) return skip(`the update changed ${extra.join(', ')} in package.json too`, 'git diff -- package.json')
+
+    const deps = now as { dependencies?: Record<string, string>; devDependencies?: Record<string, string> }
+    const message = `chore(deps): ${[...moved].sort().map((d) => `${d} ${deps.dependencies?.[d] ?? deps.devDependencies?.[d] ?? '?'}`).join(', ')}`
+    const by = `git commit -m '${message}' -- ${paths.join(' ')}`
+
+    // its first line names the commit: `[main 1a2b3c4] chore(deps): …`
+    const done = await git(dir, ['commit', '-m', message, '--', ...paths], 120_000)
+    if (done.code !== 0) return { status: 'fail', line: `FAIL: ${name}: the commit was refused: ${lastLine(`${done.out}\n${done.err}`) ?? `git commit exited ${done.code}`}. The bump stays in the tree: cd ${dir} && ${by}` }
+    const sha = done.out.match(/^\[\S+ ([0-9a-f]+)\]/m)?.[1] ?? 'HEAD'
+    const push = await pushRepo({ name, path: dir })
+    const committed = `committed ${sha} ${message}`
+    if (push.ok && push.action !== 'none') return { status: 'pushed', line: `ok: ${name}: ${committed}, pushed (${push.branch})` }
+    // never a force: a branch behind its upstream waits for a pull, and the
+    // operator is told as loudly as a failed push
+    if (push.action === 'skip') return { status: 'fail', line: `FAIL: ${name}: ${committed}, not pushed: ${push.why}` }
+    return { status: 'fail', line: `FAIL: ${name}: ${committed}, the push failed: ${push.line.replace(/^FAIL: [^:]+: /, '')}. Run: cd ${dir} && git push` }
+}

package/src/fleet/push-fleet.ts

@@ -15,9 +15,12 @@ export type PushResult = PushPlan & { ok: boolean; line: string }
 const PARALLEL = 4
 const PUSH_MS = 60_000
 
-async function git(cwd: string, args: string[], ms = 15_000): Promise<{ code: number; out: string; err: string }> {
-    // a push that would ask for a password fails instead of hanging the page
-    const p = Bun.spawn(['git', ...args], { cwd, stdout: 'pipe', stderr: 'pipe', env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } })
+/** git in another repo: a push that would ask for a password fails instead of
+ *  hanging, and a GIT_DIR or GIT_INDEX_FILE this process inherited (a hook) is
+ *  never carried into it */
+export async function git(cwd: string, args: string[], ms = 15_000): Promise<{ code: number; out: string; err: string }> {
+    const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => k !== 'GIT_DIR' && k !== 'GIT_INDEX_FILE' && k !== 'GIT_WORK_TREE'))
+    const p = Bun.spawn(['git', ...args], { cwd, stdout: 'pipe', stderr: 'pipe', env: { ...env, GIT_TERMINAL_PROMPT: '0' } })
     const timer = setTimeout(() => p.kill(), ms)
     const [out, err, code] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text(), p.exited])
     clearTimeout(timer)
@@ -63,6 +66,9 @@ async function pushOne(p: PushPlan): Promise<PushResult> {
     return { ...p, ok: false, line: `FAIL: ${p.name}: git ${args.join(' ')}: ${why}` }
 }
 
+/** one repo planned and pushed: what `fleet --update` runs after its commit */
+export const pushRepo = async (repo: { name: string; path: string }): Promise<PushResult> => pushOne(await pushPlan(repo))
+
 /** every repo planned, the ones that need it pushed, a few at a time; `dry`
  *  plans only. Results come back in the repos' order */
 export async function pushFleet(repos: { name: string; path: string }[], o: { dry?: boolean } = {}): Promise<PushResult[]> {