fix: review cleanups — detector skips, upstream's fence, update's backup notice, one subtree helper, CHANGELOG catch-up

[PrzemekGalarowicz]

What this changes

Plan F, the last of the review follow-ups (.dev/features/review-cleanups/):

• F22 — detection. target/, vendor/, venv/ and .venv/ are now skipped only where they belong to another ecosystem:

  • target/ beside a Cargo.toml, pom.xml or build.sbt;
  • vendor/ beside a go.mod, composer.json or Gemfile;
  • venv/ or .venv/ holding a pyvenv.cfg.

  A Next.js route at app/target/route.ts detects as backend again (the base gave [ssr]). A marked tree still costs zero walk budget.

• F23 — frontmatter fence. The fence now follows upstream's own rule, ported from its validator: the file starts with --- and the block runs to the first line that starts with ---. A differential test runs every fence shape through the validator's own function.

• F21 — update --force backup notice. The notice now prints after the spinner stops. Before, it was glued to the spinner frame, and in a narrow terminal the spinner's stop erased it. An abort now repeats only the part-way warning and the backup pointer on stderr.

• capabilitySubtree in lib/layout.ts replaces six copies of the role → subtree ternary. No behavior change.

• Raw invisible characters. Three in the tests are now escapes. A new tests/source-hygiene.test.ts keeps src/ and tests/ free of them.

• F26 — CHANGELOG. PHARN-01..18 are backfilled. Each is merged with the later entries into one net-since-0.5.0 entry per change. CLAUDE.md and the docs are updated to match.

Type of change

• feat — new stack option, wizard step, or command capability
• fix — bug fix
• docs — docs-only change
• chore / refactor — tooling or internal restructure, no behavior change

Area(s) touched

lib/detect-archetype | lib/capability-index | commands/update | lib/layout (+ 5 callers) | tests | docs | CHANGELOG | CLAUDE.md

Checklist

• Read the existing file(s) before editing; followed the ESM .js-extension import convention.
• Updated the matching tests/*.test.ts. On the base 8b53ba9, 16 of the new cases fail, each for the reason the plan names; the guard cases pass there too.
• Updated the relevant docs/ page (docs/commands/init.md, docs/troubleshooting.md).
• Preserved the security invariants. The fence change only widens the parser to upstream's rule. The enums, the field reader and the duplicate-key refusal are unchanged.

Quality gates

• npm run check passes locally (1649 tests). I ran it as root with the DAC-override capabilities dropped (CI-equivalent).
• npm run build succeeds.
• npm run test:coverage passes (97.63 / 93.04 / 98.33 / 98.46).

Notes for the reviewer

• The CHANGELOG [Unreleased] section is restructured, not appended to. Entries added by fix(init): a re-run init keeps what update would keep, and re-checks the config under its lock #216, fix(proxy): the proxy notice follows Node's measured rules; tests stop reading the host's proxy env #221, fix(hooks): the HOOKS check reads what Claude Code reads and prints what can be pasted back #222 and fix(init): a re-install backs up only what update would keep; refusals come before the backup #223 are now merged with the PHARN commits they extend. Two entries that described only unreleased intermediate states were dropped. Every other fact was kept.
• One named difference from upstream remains. A CRLF frontmatter block parses here but not in upstream's validator. That direction is lenient, it is pinned by a test, and aligning it would mean changing readField.
• The differential test runs code from the repo. It uses new Function on the parseFrontmatter body taken from this repo's .dev/floor/validate.mjs, not on anything fetched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0199owRmYfskqYQVQrVP679o

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d93c8cf8-6277-4c55-9565-89692d0535aa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}