lockfile-doctor
Skill0 starsChanged 5 months agoMITView on GitHub
Diagnose package-manager and lockfile drift that causes 'works on my machine' deploy failures. Use whenever an install behaves differently in CI than locally, the user mentions lockfile conflicts, npm/pnpm/yarn confusion, 'npm ci failed', non-reproducible builds, or when auditing any Node project before deploy. Runs fully offline — no API keys, no network, no credentials.
In this repository9 other files it gives its agents.
- bundle-weightSkill
- ci-workflow-doctorSkill
- cors-auditorSkill
- deploy-log-doctorSkill
- dns-cutoverSkill
- env-driftSkill
- migration-reversibilitySkill
- rollback-readinessSkill
- secret-preflightSkill
The file
We split this skill into the rules it gives an agent
2 rules. About 0 are common, 1 is distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 18
When MULTIPLE_LOCKFILES fires, help the user pick ONE manager (whichever the team actually uses), delete the other lockfiles, and gitignore …
- Distinctive: line 22
All paths below are relative to this skill's directory (lockfile-doctor/).
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
lockfile-doctor
Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.
python3 scripts/lockfile_doctor.py <project_root> [--json]Checks: multiple coexisting lockfiles (platform picks one, devs use another), missing lockfile entirely, packageManager field disagreeing with the committed lockfile, missing engines.node, and fragile dependency specs — git branches, file: paths that won't exist on the build machine, and */latest wildcards.
The mental model to give the user: a deploy is reproducible only if the same package manager, same Node version, and same lockfile produce the same node_modules everywhere. Each finding is one of those three legs broken.
When MULTIPLE_LOCKFILES fires, help the user pick ONE manager (whichever the team actually uses), delete the other lockfiles, and gitignore them so they don't return.
Exit codes: 0 clean, 1 findings.
All paths below are relative to this skill's directory (lockfile-doctor/).
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.