feat: configurable external checks via -- passthrough and verifyx eject

[robdmoore]

What & why

skott (and other external tools) sometimes need their invocation tweaked, but every external check was hard-wired to a single command with no way to adjust it short of dropping the built-in entirely. This adds two escape hatches so you can configure an external tool without losing the verifyx wrapper's benefits.

Changes

1. -- passthrough to the underlying tool

Anything after -- on an external check is forwarded verbatim to the tool:

verifyx circular-deps -- src/*.ts   # → skott … src/*.ts
verifyx lint -- --quiet             # → oxlint … --quiet

Args are appended unquoted so shell globs still expand. Works for every external check, not just skott. verifyx init now scaffolds verify:circular-deps as verifyx circular-deps -- src/*.ts, so skott's required target is visible and editable in package.json.

2. verifyx eject <check>

Replaces the CLI wrapper script with the raw tool command so you can own the invocation:

verifyx eject circular-deps   # verify:circular-deps → skott --displayMode=raw --showCircularDependencies --exitCodeOnCircularDependencies=1
verifyx eject lint            # verify:lint → oxlint .   AND   verify:lint:fix → oxlint --fix .

Fixable checks (lint, format) get both the base and :fix scripts — the fix-locally/check-in-CI pairing verifyx already understands. Ejecting overwrites verify:<name> (that's the point) and leaves other scripts untouched. Native checks refuse to eject (they run in-process and have no shell command to hand over).

Implementation notes

• RunDefaultOptions.extraArgs, Check.eject, and the appendArgs helper (external.ts)
• scaffoldArgs on the external check spec; scaffoldArgs: 'src/*.ts' on circular-deps
• setScripts (overwriting) in packageScripts.ts; new eject command + applyEject/ejectScripts programmatic API
• README updated (passthrough note, verifyx eject section, API exports)

Design decision worth a look

src/*.ts lives only in the scaffolded script, matching the request literally: verifyx eject circular-deps yields bare skott … (no target), and verifyx all's built-in circular-deps also runs skott target-less (unchanged). If we'd rather bake the target in everywhere, it's a one-line change.

Testing

• New src/scaffold/eject.test.ts; extended external.test.ts and registry.test.ts
• Manually verified passthrough (globs expand, failure hint shows the full command) and eject (writes correct scripts, overwrites wrapper, rejects native)
• npm run verify green

🤖 Generated with Claude Code