also looking at this

fix(cli): let packages.strategy reach its flags, and sync CLAUDE.md's embedded README

#1441

Merged glennmichael123 wants to merge fix/strategy-flag-default into main

4 files +182 -64

CLAUDE.mdmodified+164-58

Changes to CLAUDE.md
		@@ -776,61 +776,82 @@ dist/
776	776
777	777	Purpose: Documentation for the buddy package
778	778
779		> The fastest, most intelligent dependency management bot for modern JavaScript and TypeScript projects (and PHP).
	779	Sync: manual — nothing regenerates this section. When README.md changes, copy its body (from the tagline blockquote through the licence, without the badge link definitions) back in here; `bun run check:docs` validates both files.
780	780
781		Buddy is a lightning-fast alternative to Dependabot and Renovate, purpose-built for modern JavaScript, TypeScript, and PHP ecosystems. It intelligently scans your projects, detects outdated & deprecated dependencies across multiple package managers, and creates beautifully formatted pull requests with comprehensive changelogs and metadata.
	781	> AI code review and dependency updates, in one teammate that runs on your CI with your keys.
	782
	783	Buddy does two jobs that usually take two bots and two subscriptions.
	784
	785	It reviews code — pull requests and your local working tree — posting inline findings anchored to the lines you changed, answering `@buddy` questions in the thread, gating merges with real check runs, and repairing failing CI when the fix is unambiguous. An alternative to CodeRabbit and friends, except it runs as a step in your own workflow, against a provider you choose, with no third-party app installed on your repository.
	786
	787	It also manages dependencies — scanning across npm, Bun, yarn, pnpm, Composer, Docker, GitHub Actions, pkgx, Launchpad, Go, Rust, Python, Ruby and Zig, grouping related packages, fetching real changelogs, and keeping a pinned dashboard issue. An alternative to Dependabot and Renovate, and it will migrate your existing config from either.
	788
	789	Neither half requires the other. Run the reviewer with no dependency workflows, run the updater with no API key, or run both.
782	790
783	791	![Buddy Pull Request Example](.github/art/screenshot.png)
784	792
785	793	## Features
786	794
	795	### 🔍 AI Code Review
	796
	797	- Inline Findings: _Anchored to changed lines, describing the failure rather than a style preference_
	798	- Incremental by Default: _A second push gets new findings, not the ones you already read_
	799	- Conversational: _`@buddy review`, `full-review`, `summary`, `pause`, `resume`, `rebase`, `remember` — or just ask a question_
	800	- Local Review: _`buddy review` reads your working tree, so problems are found before the PR exists_
	801	- Works Without a Key: _`--light` runs secret scanning, actionlint, shellcheck, hadolint, markdownlint and syntax checks with no model and no network_
	802	- Merge Gates: _Title format, description quality, linked issue and dependency policy published as a check run_
	803	- CI Repair: _`buddy fix-ci` classifies a failing run and opens the fix when it is clear_
	804	- Pipeable: _`--format json`, `github` annotations, or `agent` to hand findings straight to a coding agent_
	805	- Your Provider: _Anthropic, OpenAI, Google, OpenRouter, or any OpenAI-compatible endpoint_
	806
787	807	### 🚀 Performance & Speed
788	808
789		- Lightning Fast Execution: Built with Bun for maximum performance
790		- Intelligent Scanning: Uses `bun outdated` and GitHub releases API for accurate, real-time dependency detection
791		- Optimized CI/CD: Minimal resource usage with smart caching
	809	- Lightning Fast Execution: _Built with Bun for maximum performance_
	810	- Intelligent Scanning: _Uses `bun outdated` and GitHub releases API for accurate, real-time dependency detection_
	811	- Optimized CI/CD: _Minimal resource usage with smart caching_
792	812
793	813	### 📦 Universal Package Support
794	814
795		- Multi-Package Manager: Full support for Bun, npm, yarn, pnpm, Composer, pkgx & Launchpad
796		- GitHub Actions: Automatically updates workflow dependencies (`actions/checkout@v4`, etc.)
797		- Docker Images: Detects and updates Dockerfile base images and versions
798		- Lock File Awareness: Respects and updates all lock file formats
	815	- Multi-Package Manager: _Full support for Bun, npm, yarn, pnpm, Composer, Zig, pkgx & Launchpad_
	816	- GitHub Actions: _Automatically updates workflow dependencies (`actions/checkout@v4`, etc.)_
	817	- Docker Images: _Detects and updates Dockerfile base images and versions_
	818	- Zig Dependencies: _Manages build.zig.zon dependencies with URL and hash tracking_
	819	- Lock File Awareness: _Respects and updates all lock file formats_
799	820
800	821	### 🎯 Smart Dependency Management
801	822
802		- Configurable Update Strategies: Choose from major, minor, patch, or all updates
803		- Flexible Package Grouping: Group related packages for cleaner, focused PRs
804		- Intelligent Conflict Detection: Prevents breaking changes with smart dependency analysis
805		- Security-First Updates: Prioritizes security patches and vulnerability fixes
	823	- Configurable Update Strategies: _Choose from major, minor, patch, or all updates_
	824	- Flexible Package Grouping: _Group related packages for cleaner, focused PRs_
	825	- Intelligent Conflict Detection: _Prevents breaking changes with smart dependency analysis_
	826	- Security-First Updates: _Checks every dependency against the [OSV.dev](https://osv.dev) advisory database, and creates vulnerability fixes as their own PR ahead of routine updates_
806	827
807	828	### 📊 Rich Dashboard & Monitoring
808	829
809		- Dependency Dashboard: Centralized GitHub issue with complete dependency overview
810		- Interactive Rebase: One-click PR updates via checkbox interface
811		- Real-time Status Tracking: Live monitoring of all open PRs and pending updates
812		- Comprehensive Reporting: Detailed update summaries with confidence metrics
	830	- Dependency Dashboard: _Centralized GitHub issue with complete dependency overview_
	831	- Interactive Rebase: _One-click PR updates via checkbox interface_
	832	- Real-time Status Tracking: _Live monitoring of all open PRs and pending updates_
	833	- Comprehensive Reporting: _Detailed update summaries with confidence metrics_
813	834
814	835	### 🎨 Beautiful Pull Requests
815	836
816		- Multi-Format Tables: Separate sections for npm, PHP/Composer, pkgx/Launchpad, and GitHub Actions
817		- Rich Metadata: Confidence badges, adoption metrics, age indicators, and download stats
818		- Detailed Changelogs: Automatic release notes and breaking change detection
819		- Professional Formatting: Clean, readable PR descriptions with proper categorization
	837	- Multi-Format Tables: _Separate sections for npm, PHP/Composer, Zig, pkgx/Launchpad, and GitHub Actions_
	838	- Rich Metadata: _Confidence badges, adoption metrics, age indicators, and download stats_
	839	- Detailed Changelogs: _Automatic release notes and breaking change detection_
	840	- Professional Formatting: _Clean, readable PR descriptions with proper categorization_
820	841
821	842	### ⚙️ Developer Experience
822	843
823		- Zero Configuration: Works immediately with intelligent defaults
824		- Interactive Setup: Renovate-like guided configuration with validation
825		- Migration Tools: Seamless import from existing Renovate and Dependabot setups
826		- TypeScript Config: Full type safety with `buddy.config.ts`
	844	- Zero Configuration: _Works immediately with intelligent defaults_
	845	- Interactive Setup: _Renovate-like guided configuration with validation_
	846	- Migration Tools: _Seamless import from existing Renovate and Dependabot setups_
	847	- TypeScript Config: _Full type safety with `buddy.config.ts`_
827	848
828	849	### 🔌 Extensible Integration
829	850
830		- Plugin Ecosystem: Built-in Slack, Discord, and Jira integrations
831		- Custom Hooks: Extensible system for organization-specific workflows
832		- CI/CD Ready: Pre-built GitHub Actions workflows for all use cases
833		- API Access: Programmatic control for advanced automation
	851	- Plugin Ecosystem: _Built-in Slack, Discord, and Jira integrations_
	852	- Custom Hooks: _Extensible system for organization-specific workflows_
	853	- CI/CD Ready: _Pre-built GitHub Actions workflows for all use cases_
	854	- API Access: _Programmatic control for advanced automation_
834	855
835	856	## Quick Start
836	857
		@@ -963,9 +984,9 @@ Choose from several carefully crafted presets with smart recommendations:
963	984	�� Step 8: Workflow Generation & Validation
964	985
965	986	- Generates two GitHub Actions workflows:
966		- `buddy.yml` - Unified workflow: rebase checks, scheduled updates and the dashboard
967		- `buddy-security.yml` - Security audit, kept separate so it triggers on its own path filters
968		- Removes the stale `buddy-check.yml`, `buddy-update.yml`, `buddy-dashboard.yml` and `gh-audit.yml` if an earlier version left them behind
	987	- `buddy.yml` - Unified workflow (rebase checks, dependency updates, dashboard management)
	988	- `buddy-security.yml` - Security audit, kept separate so it can trigger on its own path filters
	989	- Removes stale `buddy-check.yml`, `buddy-update.yml` and `buddy-dashboard.yml` files from earlier versions
969	990	- YAML validation - Ensures generated workflows are syntactically correct
970	991	- Security best practices - Validates token usage and permissions
971	992	- Workflow testing - Verifies generated workflows meet requirements
		@@ -1002,7 +1023,7 @@ buddy scan --verbose
1002	1023	buddy scan --packages "react,typescript,@types/node"
1003	1024
1004	1025	# Check packages with glob patterns
1005		buddy scan --pattern "@types/*"
	1026	buddy scan --pattern "@types/_"
1006	1027
1007	1028	# Apply different update strategies
1008	1029	buddy scan --strategy minor
		@@ -1221,11 +1242,11 @@ hooks run, and the plugin file chooses the URL.
1221	1242
1222	1243	\| Event \| Description \| Context \|
1223	1244	\|-------\|-------------\|---------\|
1224		\| `pre*setup` \| Before setup begins \| Initial configuration \|
1225		\| `post*setup` \| After setup completes \| Full setup context \|
1226		\| `step*complete` \| After each setup step \| Step-specific progress \|
1227		\| `validation*error` \| When validation fails \| Error details and recovery \|
1228		\| `setup*complete` \| Final setup completion \| Complete project context \|
	1245	\| `pre_setup` \| Before setup begins \| Initial configuration \|
	1246	\| `post_setup` \| After setup completes \| Full setup context \|
	1247	\| `step_complete` \| After each setup step \| Step-specific progress \|
	1248	\| `validation_error` \| When validation fails \| Error details and recovery \|
	1249	\| `setup_complete` \| Final setup completion \| Complete project context \|
1229	1250
1230	1251	### Programmatic Usage
1231	1252
		@@ -1337,6 +1358,7 @@ For the rebase functionality to update GitHub Actions workflow files, you need p
1337	1358	- ✅ package.json - npm/yarn/pnpm dependencies
1338	1359	- ✅ Lock files - package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb
1339	1360	- ✅ Dependency files - deps.yaml, dependencies.yaml, pkgx.yaml
	1361	- ✅ Zig manifests - build.zig.zon with URL and hash updates
1340	1362	- ✅ GitHub Actions - workflow files (with proper permissions)
1341	1363	- ✅ PR content - Updated title, body, and metadata
1342	1364
		@@ -1352,9 +1374,9 @@ buddy dashboard --title "My Dependencies"
1352	1374
1353	1375	### Automated Dashboard Updates
1354	1376
1355		Buddy includes a pre-built GitHub workflow (`.github/workflows/buddy.yml`) that automatically updates your dependency dashboard:
	1377	The unified workflow (`.github/workflows/buddy.yml`) automatically updates your dependency dashboard:
1356	1378
1357		- �� Scheduled: Every 2 hours, 15 minutes after the dependency update run (cron `15 /2 * *`)
	1379	- �� Scheduled: On the schedule your preset sets — often the same tick as the dependency update run
1358	1380	- ��️ Manual: Trigger from Actions tab with custom options
1359	1381	- �� Auto-Pin: Keeps dashboard pinned by default
1360	1382	- �� Dry-Run: Preview mode available
		@@ -1419,6 +1441,7 @@ Buddy automatically detects and updates the following dependency file formats:
1419	1441	- package.json - Traditional npm dependencies
1420	1442	- composer.json - PHP dependencies from Packagist
1421	1443	- composer.lock - PHP lock file with exact versions
	1444	- build.zig.zon - Zig package manager dependencies with URL and hash tracking
1422	1445	- deps.yaml/deps.yml - Launchpad/pkgx dependency declarations
1423	1446	- dependencies.yaml/dependencies.yml - Alternative dependency file format
1424	1447	- pkgx.yaml/pkgx.yml - pkgx-specific dependency files
		@@ -1429,11 +1452,19 @@ Buddy automatically detects and updates the following dependency file formats:
1429	1452	- *.github/workflows/.yml** - GitHub Actions workflow files
1430	1453	- *.github/workflows/.yaml** - Alternative YAML extension
1431	1454
	1455	#### Container Images
	1456
	1457	Detected anywhere in the tree, in all three naming conventions:
	1458
	1459	- `Dockerfile`, `Dockerfile.<suffix>` - e.g. `Dockerfile.prod`
	1460	- `<prefix>.dockerfile` - e.g. `docker/api.dockerfile`, common in monorepos
	1461	- `Containerfile`, `<prefix>.containerfile` - the OCI/Podman spelling
	1462
1432	1463	All dependency files are parsed using the `ts-pantry` library to ensure compatibility with the pkgx registry ecosystem while maintaining support for tools like Launchpad that reuse the same registry format. GitHub Actions are detected by parsing `uses:` statements in workflow files and checking for updates via the GitHub releases API.
1433	1464
1434	1465	### Pull Request Format
1435	1466
1436		Buddy generates comprehensive pull requests with three separate dependency tables:
	1467	Buddy generates comprehensive pull requests with separate dependency tables for each ecosystem:
1437	1468
1438	1469	#### 1. npm Dependencies
1439	1470
		@@ -1456,7 +1487,17 @@ Focused table for PHP packages from Packagist:
1456	1487	\| phpunit/phpunit \| ^10.0.0 → ^10.3.0 \| composer.json \| ✅ Available \|
1457	1488	```
1458	1489
1459		#### 3. Launchpad/pkgx Dependencies
	1490	#### 3. Zig Dependencies
	1491
	1492	Focused table for Zig packages with repository links and update types:
	1493
	1494	```
	1495	\| Package \| Change \| Type \| File \|
	1496	\|---------\|--------\|------\|------\|
	1497	\| httpz \| 0.5.0 → 0.6.0 \| �� minor \| build.zig.zon \|
	1498	```
	1499
	1500	#### 4. Launchpad/pkgx Dependencies
1460	1501
1461	1502	Simplified table focusing on package updates and file locations:
1462	1503
		@@ -1466,7 +1507,7 @@ Simplified table focusing on package updates and file locations:
1466	1507	\| bun.com \| ^1.2.16 → ^1.2.19 \| deps.yaml \| ✅ Available \|
1467	1508	```
1468	1509
1469		#### 4. GitHub Actions
	1510	#### 5. GitHub Actions
1470	1511
1471	1512	Workflow automation updates with direct links to repositories:
1472	1513
		@@ -1483,8 +1524,8 @@ Each table is followed by detailed release notes, changelogs, and package statis
1483	1524
1484	1525	- `all`: Update all dependencies regardless of semver impact
1485	1526	- `major`: Only major version updates
1486		- `minor`: Major and minor updates (no patch-only)
1487		- `patch`: All updates (major, minor, and patch)
	1527	- `minor`: Minor and patch updates (no majors)
	1528	- `patch`: Only patch updates
1488	1529
1489	1530	## Auto-Merge Configuration
1490	1531
		@@ -1504,20 +1545,20 @@ const config: BuddyConfig = {
1504	1545
1505	1546	### Auto-Merge Strategies
1506	1547
1507		- `squash`: Squash commits and merge (recommended for clean history)
1508		- `merge`: Create a merge commit (preserves individual commits)
1509		- `rebase`: Rebase and merge (linear history without merge commits)
	1548	- `squash`: Squash commits and merge _(recommended for clean history)_
	1549	- `merge`: Create a merge commit _(preserves individual commits)_
	1550	- `rebase`: Rebase and merge _(linear history without merge commits)_
1510	1551
1511	1552	### Auto-Merge Conditions
1512	1553
1513		- `patch-only`: Only auto-merge patch version updates (safest)
1514		- No conditions: Auto-merge all updates (use with caution)
	1554	- `patch-only`: Only auto-merge patch version updates _(safest)_
	1555	- No conditions: Auto-merge all updates _(use with caution)_
1515	1556
1516	1557	### Workflow-Specific Auto-Merge
1517	1558
1518	1559	Each preset configures auto-merge appropriately:
1519	1560
1520		- High Frequency Updates: Auto-merge patch updates only (6AM, 12PM, 6PM), manual review for minor updates (12AM)
	1561	- High Frequency Updates: Auto-merge patch updates only _(6AM, 12PM, 6PM)_, manual review for minor updates _(12AM)_
1521	1562	- Security Focused: Auto-merge security patches every 6 hours
1522	1563	- Standard Project: Auto-merge daily patches, manual review for weekly/monthly updates
1523	1564	- Development/Testing: No auto-merge, dry-run by default, enhanced testing features.
		@@ -1637,6 +1678,9 @@ This PR was generated by [Buddy](https://github.com/stacksjs/buddy).
1637	1678	\| Package Grouping \| �� Intelligent + flexible \| �� Basic grouping \| �� Advanced but complex \|
1638	1679	\| Dashboard \| �� Rich interactive dashboard \| ❌ No dashboard \| �� Basic dashboard \|
1639	1680	\| Migration Tools \| �� Automated import \| ❌ Manual migration \| ❌ Manual migration \|
	1681	\| Vulnerability Alerts \| ✅ OSV.dev, prioritized PRs + dashboard \| ✅ GitHub Advisory \| ✅ OSV / GitHub Advisory \|
	1682	\| Private Registries \| ✅ Config or `.npmrc`, per-scope \| ✅ Supported \| ✅ Supported \|
	1683	\| GitHub Enterprise \| ✅ Zero-config on GHES runners \| ✅ Supported \| ✅ Supported \|
1640	1684	\| Self-hosting \| ✅ Full control \| ❌ GitHub-only \| ✅ Complex setup \|
1641	1685	\| Plugin System \| �� Extensible ecosystem \| ❌ Limited \| �� Advanced but complex \|
1642	1686
		@@ -1652,15 +1696,15 @@ name: Buddy Update
1652	1696	on:
1653	1697	schedule:
1654	1698
1655		- cron: '0 /2 * *' # Every 2 hours
	1699	- cron: '0 _/2 _ _ _' # Every 2 hours
1656	1700
1657		workflow*dispatch:
	1701	workflow_dispatch:
1658	1702	inputs:
1659	1703	strategy:
1660	1704	description: Update strategy
1661	1705	required: false
1662	1706	default: patch
1663		dry*run:
	1707	dry_run:
1664	1708	description: Dry run (preview only)
1665	1709	required: false
1666	1710	default: true
		@@ -1678,7 +1722,7 @@ jobs:
1678	1722	env:
1679	1723	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1680	1724
1681		- if: ${{ github.event.inputs.dry*run != 'true' }}
	1725	- if: ${{ github.event.inputs.dry_run != 'true' }}
1682	1726
1683	1727	run: bunx @buddysh/buddy update --strategy ${{ github.event.inputs.strategy \|\| 'patch' }} --verbose
1684	1728	env:
		@@ -1704,12 +1748,12 @@ buddy generate-workflows
1704	1748
1705	1749	The updated workflow system automatically:
1706	1750
1707		- Every 2 hours: All configured strategies with dry-run by default
	1751	- On your preset's schedule: All configured strategies with dry-run by default
1708	1752	- Manual trigger: Any strategy with configurable dry-run option
1709	1753	- Enhanced testing: Comprehensive validation and summaries
1710	1754	- Failure handling: Auto-creates GitHub issues
1711	1755	- Smart summaries: Rich GitHub Actions summaries
1712		- Flexible scheduling: Consistent 2-hour intervals for all presets
	1756	- Flexible scheduling: Each preset sets its own update and dashboard cadence
1713	1757
1714	1758	### GitHub Actions Permissions Setup
1715	1759
		@@ -1751,7 +1795,69 @@ This indicates the permissions above need to be enabled. Both GitHub CLI and RES
1751	1795
1752	1796	For more details, see the [GitHub documentation on managing GitHub Actions settings](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests).
1753	1797
1754		---
	1798	## Testing
	1799
	1800	```bash
	1801	bun test
	1802	```
	1803
	1804	## Build From Source
	1805
	1806	```bash
	1807	bun install # not optional — see the note below
	1808	bun run build
	1809	```
	1810
	1811	> [!NOTE]
	1812	> `bun install` is a hard prerequisite for every dev command. On a fresh clone without `node_modules`, `bun test` fails with over a hundred phantom errors (`Cannot find package 'ts-pantry'` and friends) that look like real bugs and are not.
	1813	>
	1814	> Git hooks (staged lint on `pre-commit`, gitlint on `commit-msg`) are declared in `package.json` but are not installed automatically — run `bunx bun-git-hooks` once after cloning to activate them.
	1815
	1816	## Changelog
	1817
	1818	Please see our [releases](https://github.com/stacksjs/buddy/releases) page for more information on what has changed recently.
	1819
	1820	## Contributing
	1821
	1822	Please see the [Contributing Guide](https://github.com/stacksjs/contributing) for details.
	1823
	1824	## Community
	1825
	1826	For help, discussion about best practices, or any other conversation that would benefit from being searchable:
	1827
	1828	[Discussions on GitHub](https://github.com/stacksjs/buddy/discussions)
	1829
	1830	For casual chit-chat with others using this package:
	1831
	1832	[Join the Stacks Discord Server](https://stacksjs.com/discord)
	1833
	1834	## Postcardware
	1835
	1836	“Software that is free, but hopes for a postcard.” We love receiving postcards from around the world showing where Stacks is being used! We showcase them on our website too.
	1837
	1838	Our address: Stacks.js, 12665 Village Ln #2306, Playa Vista, CA 90094, United States ��
	1839
	1840	## Sponsors
	1841
	1842	We would like to extend our thanks to the following sponsors for funding Stacks development. If you are interested in becoming a sponsor, please reach out to us.
	1843
	1844	- [JetBrains](https://www.jetbrains.com/)
	1845	- [The Solana Foundation](https://solana.com/)
	1846
	1847	## Credits
	1848
	1849	- [Renovatebot](https://renovatebot.com/)
	1850	- [Dependabot](https://dependabot.com/)
	1851	- [Chris Breuer](https://github.com/chrisbbreuer)
	1852	- [All Contributors](../../contributors)
	1853
	1854	And a special thanks to [Dan Scanlon](https://twitter.com/danscan) for donating the `stacks` name on npm ✨
	1855
	1856	## License
	1857
	1858	The MIT License (MIT). Please see [LICENSE](LICENSE.md) for more information.
	1859
	1860	Made with ��
1755	1861
1756	1862	## Linting
1757	1863

Files

Review one file at a time

CLAUDE.md +164 -58
bin/cli.ts +4 -4
docs/cli/update.md +2 -2
test/cli-surface.test.ts +12 -0

Merge

This pull request was merged.

Reviews

Nobody has reviewed this yet.

0 of 0 required approvals.

Checks

No checks are required on this branch.

Conversations

0 unresolved of 0.