[Jordan Harband (ljharb)]

Follow-up to #231, which removed the fleet pack. This PR adds four changes main doesn't have yet. Each commit can be reviewed on its own.

Changes

1. Fix the npm version in the release workflows (fix(ci))

devEngines requires npm >=12.2.0 with onFail: error. Node 26.12.1 bundles npm 11.20.0, which errors with EBADDEVENGINES when run in the checkout. I reproduced that error with npm view and npm pack. npm publish makes the same check, so:

• publish-npm.yml would fail at its final step. It now installs npm@12.2.0 next to pnpm.
• release-github.yml would fail at npm view. It now runs npm view outside the checkout.

2. Git hooks and a tracked-file content scan (feat(repo))

pnpm install points core.hooksPath at .git-hooks/. The prepare script skips this in CI.

• pre-commit scans the staged copy of each file for secrets, personal home paths and private repository names. It fails if it can't read a staged file.
• commit-msg requires a Conventional Commit subject and rejects AI attribution lines.
• pre-push runs pnpm run repo:type.

pnpm run check now also runs the manifest version check and pnpm run repo:scan. CI's check job runs pnpm run check instead of pnpm run repo:check, so the scan gates pull requests. test/repo/unit/repo-scan.test.mts covers the scanner and the pre-commit hook, including a secret that is staged and then edited or deleted on disk.

3. Drop unused dev dependencies (build(deps))

This removes 33 dev dependencies that no script, test, config or workflow uses. Removing them leaves the brace-expansion and minimatch patches unused, and pnpm rejects unused patches, so those are removed too.

4. Update stale config comments (chore(repo))

.editorconfig and .npmrc had comments pointing at deleted fleet files and generators. Only comments change; the settings are identical.

Testing

On a fresh copy of the branch with Node 26.12.1 and pnpm 12.14.0:

• pnpm install --frozen-lockfile passed and set core.hooksPath.
• pnpm run check passed, including the scan of 173 tracked files.
• pnpm test passed: 60 files, 537 tests.
• zizmor 1.30.1 reported no findings.
• actionlint reported only the ubuntu-26.04 runner-label warning that main also has.
• I tried each hook. They rejected a non-conventional subject, an AI attribution trailer, and a token that was staged and then removed from disk. A clean commit went through.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b853f0f. Configure here.}