tony Update packages
Bring the repositories in scope up to date — one researched commit per toolchain pin and per named package, a bulk refresh for the rest, and each follow-up as its own commit.
Use the package-updater-updating-packages skill for the
phase structure. It reads the same references this command does, so
the sweep and the single-package path cannot drift:
references/repo-scope.md,
references/ecosystems.md,
references/commit-conventions.md,
references/upstream-links.md, and
references/follow-ups.md.
For one named package, use the package-updater-update-package skill. For
.tool-versions, .nvmrc, packageManager or engines, use
the package-updater-update-toolchain skill.
User arguments: $ARGUMENTS
Context
Repository — run this command and read the output:
git remote get-url origin 2>/dev/null || echo "(not a git repository)"
Default branch — run this command and read the output:
git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null || echo "(unknown)"
Manifests, lockfiles and toolchain pins here — run this command and read the output:
out=$(git ls-files -- 'pyproject.toml' '**/pyproject.toml' 'uv.lock' '**/uv.lock' 'poetry.lock' 'requirements*.txt' 'package.json' '**/package.json' 'pnpm-lock.yaml' 'package-lock.json' 'yarn.lock' 'Cargo.toml' 'Cargo.lock' 'go.mod' '.tool-versions' '.nvmrc' '.python-version' 'mise.toml' '.mise.toml' 2>/dev/null | grep -v node_modules | head -40); if [ -n "$out" ]; then echo "$out"; else echo "(none found)"; fi
Toolchain pins on this branch — run this command and read the output:
out=$(for f in .tool-versions .nvmrc .python-version; do [ -f "$f" ] && { echo "--- $f"; cat "$f"; }; done 2>/dev/null); if [ -n "$out" ]; then echo "$out"; else echo "(no toolchain pin files)"; fi
Package manager and engines — run this command and read the output:
out=$(grep -hE '"(packageManager|node|npm|pnpm)"[[:space:]]*:' package.json 2>/dev/null); if [ -n "$out" ]; then echo "$out"; else echo "(none declared)"; fi
Cooldown configuration that can hide a fresh release — run this command and read the output:
out=$({ grep -hi 'minimumReleaseAge\|min-release-age' pnpm-workspace.yaml .npmrc; grep -hi 'exclude-newer' uv.toml pyproject.toml "${UV_CONFIG_FILE:-$HOME/.config/uv/uv.toml}"; } 2>/dev/null); if [ -n "$out" ]; then echo "$out"; else echo "(no cooldown configured)"; fi
Project quality checks — run this command and read the output:
out=$({ grep -hiE '^(test|lint|format|check|type-?check)[[:space:]]*:' justfile Justfile Makefile; grep -A12 '"scripts"' package.json; } 2>/dev/null | head -26); if [ -n "$out" ]; then echo "$out"; else echo "(read AGENTS.md/CLAUDE.md or CI for the real commands)"; fi
Procedure
Follow the skill's phases. This command supplies the scope and the fan-out.
1. Scope
Default scope is the current repository. --root walks a directory for
git repositories; --repo names individual ones; --owner keeps only
those whose remote belongs to the given accounts or organisations.
Follow the repo-scope reference for every repository a --root sweep
turns up. Skip worktrees and duplicate clones, ask the forge for
isFork and viewerPermission, and treat a fork as out of scope no
matter who owns it. Where the signals disagree — or trunk's recent
commits are all from bots and coding agents — stop and ask the user
rather than guessing. Say plainly what was excluded and under which
rule, and list what you asked about separately.
2. Inventory and discover
Run the skill's inventory and discovery phases across the whole scope before touching anything. Detect ecosystems by files present, read pins from the default branch, and check for a cooldown before calling anything current.
Sort what you find into the four commit tracks now. A move sorted wrong here produces a commit that cannot be reverted independently later.
3. Research, one chain per distinct move
Group by upgrade chain rather than by repository — twenty repositories taking the same uv release share one piece of research. Dispatch a subagent per chain where the host supports it. Verify every release URL before it reaches a commit body, and intersect each finding with the repository it lands in.
The bulk refresh needs no research and carries no claims.
4. Orchestration plan
Present the plan the skill defines and wait for approval. With
--audit-only, stop here and report; nothing is written.
5. Land and push
Work through repositories one at a time in the skill's commit order, pushing as each completes so an interrupted run resumes cleanly. Repositories parked on a feature branch get a throwaway worktree based on the remote default branch.
Commits land on the default branch by default. --branch <name> works
on a branch instead; --pr opens a pull request from it; --no-push
commits locally and stops.
With --issue, the audit is filed before the work starts: create the
issue or Linear card listing what is outstanding, derive the branch name
from it, then work on that branch. Linear supplies its own branch name —
use it verbatim. The pull request references the issue; the commits do
not.
6. Verify and report
Run the project's own quality checks per repository, per the skill's verification phase. Attribute failures against the default branch before blaming a bump.
Rules
- Toolchain, package manager, named bumps, bulk refresh and follow-ups are five separate commits. Never bundle across tracks.
- One tool per commit in
.tool-versions, even when one edit moves several. - The bulk refresh body is empty.
- No version is written before it is confirmed to exist, and no URL before it is confirmed to resolve.
- A bump left knowingly red says so in its body and its follow-up lands in the same run.
- A fleet-wide claim is verified per repository before entering that repository's history.
- Report unrelated breakage; fix it only when a bump caused it.
- GitHub Actions, ruff floors and Terraform belong to sibling plugins — report them, do not do them.
- Forks and repositories you cannot push to are out of scope.
Output
Open with a one-line hero (✓ N commits across M repos or
⚠ Audit only: N packages outdated), then exactly these sections:
## Audit— per repository, the ecosystems found and what is outdated in each, separated into what moves in-range and what needs a manifest edit. Note what was excluded as fork, unowned, or already current.## Gated— releases the cooldown currently hides, with the date each becomes visible. Omit when no cooldown is configured.## Moves— one entry per distinct chain: what changed upstream, verified links, and which repositories it reaches.## Commits— per repository, the commits made in landing order and whether they were pushed.## Follow-ups— config, snapshot and migration commits, and any bump that was red until its follow-up landed.## Verification— the quality checks run per repository and their real results, with any pre-existing failure named as pre-existing.## Handoff— stale GitHub Actions, ruff floors and Terraform versions found, each with the sibling command that handles it.## Holds— everyrejectentry across the tree with its recorded condition, which conditions are now met, and which holds have no recoverable reason. Omit when nothing is held.## Drift— pins disagreeing across a workspace, and holds applied unevenly across workspace members.
End with an ask-user-choice panel offering next steps — for example:
run the sibling command for the handoff items, drop a cooldown exemption
whose block has lapsed, take a gated release once it ages out, or stop
here. Skip the panel only in plan mode.
Portability notes
ask-user-choice— present the listed options and wait for the user to pick one. Hosts with a structured multiple-choice tool (Claude Code'sAskUserQuestion) should use it; otherwise print a numbered list and wait for a numbered reply. Never proceed on an assumed answer.$ARGUMENTS— the text the user passed when invoking this skill. If your host does not substitute it, read it as the user's request in the current turn, and ask when there is none.- Bundled files — every relative path in this skill points at a file shipped inside this skill directory. Read them from here, not from the host's plugin tree.