@geonosis/doctor 2.5.0 → 2.5.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @geonosis/doctor
 
+## 2.5.2
+
+### Patch Changes
+
+- @geonosis/lint-parity@2.5.2
+
+## 2.5.1
+
+### Patch Changes
+
+- 7f24da6: The doctor's resolution is bounded to the root it was handed (#373, #386): `resolveFrom` used to
+  walk `node_modules` upward with no stop, so a tree nested under a directory that carries this kit's
+  own `node_modules` (the smoke's run copy, a monorepo of repos, a CI runner's shared cache dir) read
+  an ancestor's copy of `@geonosis/<x>` as installed here, at whatever version the ancestor has. The
+  walk now stops at the root; a hit above it is reported by the `loaded` and `group` checks as "not
+  installed here — found above the root at `<path>`, which this tree cannot see when deployed" — a
+  named FAIL rather than a silently wrong version.
+- @geonosis/lint-parity@2.5.1
+
 ## 2.5.0
 
 ### Patch Changes

package/bin/geonosis-doctor.mjs

@@ -9,11 +9,19 @@ import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const here = dirname(fileURLToPath(import.meta.url))
-const newest = (dir) =>
+// tsup never reads a test file, so one counting as source made every bin refuse a build that had
+// not gone stale (#399).
+const NOT_SOURCE = (name) =>
+  name.endsWith('.test.ts') ||
+  name.endsWith('.test.tsx') ||
+  name === '__tests__' ||
+  name === '__fixtures__'
+const newest = (dir, skip) =>
   existsSync(dir)
     ? readdirSync(dir, { withFileTypes: true }).reduce((most, entry) => {
+        if (skip !== undefined && skip(entry.name)) return most
         const at = join(dir, entry.name)
-        return Math.max(most, entry.isDirectory() ? newest(at) : statSync(at).mtimeMs)
+        return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
       }, 0)
     : 0
 const src = join(here, '..', 'src')
@@ -30,7 +38,7 @@ if (existsSync(src)) {
     )
     process.exit(2)
   }
-  if (newest(src) > built) {
+  if (newest(src, NOT_SOURCE) > built) {
     process.stderr.write(
       'geonosis-doctor: dist is older than src — run pnpm build before trusting this bin.\n',
     )

package/dist/{chunk-GXW7SYO2.js → chunk-EZB5BG4L.js}

@@ -4,7 +4,13 @@ import { join, relative as relativeTo, sep } from "path";
 var CONFIG_FILE = ".oxlintrc.json";
 var MANIFEST_FILE = "package.json";
 var RATCHET_FILE = "geonosis.ratchet.json";
-var NEVER_WALKED = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
+var NEVER_WALKED = /* @__PURE__ */ new Set([
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "storybook-static"
+]);
 var skipped = (name) => name.startsWith(".") || NEVER_WALKED.has(name);
 var relativePath = (root, path) => relativeTo(root, path).split(sep).join("/");
 var walk = (dir, onFile) => {
@@ -73,10 +79,11 @@ var discoverWorkspaces = (root) => {
   return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
 };
 var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
-var testFilesUnder = (dir) => {
+var testFilesUnder = (dir) => filesUnder(dir, (name) => TEST_FILE.test(name));
+var filesUnder = (dir, match) => {
   const found = [];
   walk(dir, (path, name) => {
-    if (TEST_FILE.test(name)) found.push(path);
+    if (match(name)) found.push(path);
   });
   return found;
 };
@@ -94,6 +101,33 @@ var readRatchet = (root) => {
   };
 };
 
+// src/types.ts
+var CHECKS = [
+  "loaded",
+  "group",
+  "exercised",
+  "baseline",
+  "runner",
+  "envelope",
+  "drift",
+  "observability",
+  "deployed",
+  "rails",
+  "exams"
+];
+var findingMaker = (check) => (subject, verdict, message) => ({
+  check,
+  message,
+  subject,
+  verdict
+});
+var DoctorError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DoctorError";
+  }
+};
+
 // src/baseline.ts
 import { spawnSync } from "child_process";
 var DEFAULT_REF = "origin/main";
@@ -117,12 +151,7 @@ var numbersAt = (root, ref, path) => {
   }
   return numbers;
 };
-var finding = (subject, verdict, message) => ({
-  check: "baseline",
-  message,
-  subject,
-  verdict
-});
+var finding = findingMaker("baseline");
 var checkBaseline = ({ ref, root }) => {
   const ratchet = readRatchet(root);
   if (ratchet === void 0) {
@@ -172,12 +201,8 @@ var DEPLOYED_FILE = ".geonosis/deployed.json";
 var NOT_WRITTEN = "no .geonosis/deployed.json \u2014 it is written by the pipeline after promote, and its absence is not a pass";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
-var finding2 = (verdict, subject, message) => ({
-  check: "deployed",
-  message,
-  subject,
-  verdict
-});
+var make = findingMaker("deployed");
+var finding2 = (verdict, subject, message) => make(subject, verdict, message);
 var parseJsonc = (source) => {
   let out = "";
   for (let index = 0; index < source.length; index += 1) {
@@ -339,27 +364,6 @@ var repoCorpusOf = (root) => {
   }
 };
 
-// src/types.ts
-var CHECKS = [
-  "loaded",
-  "group",
-  "exercised",
-  "baseline",
-  "runner",
-  "envelope",
-  "drift",
-  "observability",
-  "deployed",
-  "rails",
-  "exams"
-];
-var DoctorError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "DoctorError";
-  }
-};
-
 // src/resolve.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync } from "fs";
 import { createRequire } from "module";
@@ -369,22 +373,51 @@ var packageNameOf = (specifier) => {
   const parts2 = specifier.split("/");
   return specifier.startsWith("@") ? parts2.slice(0, 2).join("/") : parts2[0] ?? specifier;
 };
-var resolveFrom = (dir, specifier) => {
+var AboveRootError = class extends DoctorError {
+  foundAt;
+  constructor(message, foundAt) {
+    super(message);
+    this.name = "AboveRootError";
+    this.foundAt = foundAt;
+  }
+};
+var aboveRootMessage = (specifier, foundAt) => `${specifier} is not installed here \u2014 found above the root at ${foundAt}, which this tree cannot see when deployed`;
+var aboveRoot = (root, name) => {
+  let at = dirname(root);
+  for (; ; ) {
+    const dir = join4(at, "node_modules", name);
+    if (existsSync3(join4(dir, "package.json"))) return dir;
+    const parent = dirname(at);
+    if (parent === at) return void 0;
+    at = parent;
+  }
+};
+var resolveFrom = (dir, specifier, root) => {
   if (specifier.startsWith(".") || specifier.startsWith("/")) {
     return createRequire(join4(dir, "noop.js")).resolve(specifier);
   }
   const name = packageNameOf(specifier);
   let at = dir;
+  let reachedRoot = false;
   for (; ; ) {
     if (existsSync3(join4(at, "node_modules", name, "package.json"))) {
       return createRequire(join4(at, "noop.js")).resolve(specifier);
     }
+    if (at === root) {
+      reachedRoot = true;
+      break;
+    }
     const parent = dirname(at);
     if (parent === at) break;
     at = parent;
   }
+  if (reachedRoot) {
+    const foundAt = aboveRoot(root, name);
+    if (foundAt !== void 0)
+      throw new AboveRootError(aboveRootMessage(specifier, foundAt), foundAt);
+  }
   throw new DoctorError(
-    `${specifier} does not resolve from ${dir} \u2014 no node_modules on the way up carries ${name}`
+    `${specifier} does not resolve from ${dir} \u2014 no node_modules on the way up to ${root} carries ${name}`
   );
 };
 var packageDirOf = (entry, name) => {
@@ -460,7 +493,7 @@ var presumptionsOf = async (entry) => {
     )
   };
 };
-var corpusOfPlugin = (from, specifier) => join4(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
+var corpusOfPlugin = (from, specifier, root) => join4(packageDirOf(resolveFrom(from, specifier, root), specifier), "corpus");
 var real = (path) => {
   try {
     return realpathSync(path);
@@ -558,12 +591,12 @@ var declaredGroupsOf = (root) => {
   });
 };
 var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
-var versionOf = (dir, name) => {
+var versionOf = (dir, name, root) => {
   let entry;
   try {
-    entry = resolveFrom(dir, name);
-  } catch {
-    return { kind: "absent" };
+    entry = resolveFrom(dir, name, root);
+  } catch (error) {
+    return error instanceof AboveRootError ? { foundAt: error.foundAt, kind: "aboveRoot" } : { kind: "absent" };
   }
   try {
     const manifest = JSON.parse(
@@ -574,12 +607,7 @@ var versionOf = (dir, name) => {
     return { kind: "unreadable", why: String(error.message).split("\n")[0] ?? "" };
   }
 };
-var finding3 = (subject, verdict, message) => ({
-  check: "group",
-  message,
-  subject,
-  verdict
-});
+var finding3 = findingMaker("group");
 var said = (versions) => [...versions.entries()].map(([version, from]) => `${version} (${from.join(", ")})`).join("; ");
 var repoWide = (name, found) => {
   const versions = /* @__PURE__ */ new Map();
@@ -601,10 +629,10 @@ var perWorkspace = (group, at, found) => {
   );
 };
 var DOORS = ["@geonosis/cli", "geonosis"];
-var manifestOf = (dir, name) => {
+var manifestOf = (root, name) => {
   try {
     return JSON.parse(
-      readFileSync6(join6(packageDirOf(resolveFrom(dir, name), name), "package.json"), "utf8")
+      readFileSync6(join6(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
     );
   } catch {
     return void 0;
@@ -692,7 +720,7 @@ var checkGroup = ({
       const at = labelOf(workspace);
       const here = [];
       for (const name of group.packages) {
-        const reading = versionOf(workspace.dir, name);
+        const reading = versionOf(workspace.dir, name, root);
         if (reading.kind === "read") here.push({ at, name, version: reading.version });
         if (reading.kind === "unreadable") {
           findings.push(
@@ -703,6 +731,15 @@ var checkGroup = ({
             )
           );
         }
+        if (reading.kind === "aboveRoot") {
+          findings.push(
+            finding3(
+              `${at} \u2192 ${name}`,
+              "FAIL",
+              `${name} is not installed here \u2014 found above the root at ${reading.foundAt}, which this tree cannot see when deployed`
+            )
+          );
+        }
       }
       const split2 = here.length > 0 ? perWorkspace(group, at, here) : void 0;
       if (split2 !== void 0) findings.push(split2);
@@ -816,33 +853,7 @@ var GEONOSIS = "geonosis.json";
 var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
-var finding4 = (subject, verdict, message) => ({
-  check: "drift",
-  message,
-  subject,
-  verdict
-});
-var NEVER_WALKED2 = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
-var filesUnder = (dir, match) => {
-  const found = [];
-  const walk2 = (at) => {
-    let entries;
-    try {
-      entries = readdirSync3(at, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join7(at, entry.name));
-        continue;
-      }
-      if (entry.isFile() && match(entry.name)) found.push(join7(at, entry.name));
-    }
-  };
-  walk2(dir);
-  return found;
-};
+var finding4 = findingMaker("drift");
 var ci = (root) => {
   const dir = join7(root, WORKFLOWS);
   if (!existsSync6(dir)) {
@@ -1194,7 +1205,7 @@ var sourceDirsIn = (dir) => {
     return [];
   }
   return entries.filter(
-    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name) && filesUnder(join7(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
+    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED.has(entry.name) && filesUnder(join7(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
   ).map((entry) => entry.name);
 };
 var lintScopes = (root, workspaces) => {
@@ -1299,7 +1310,10 @@ var doorBringing = (root, name, declared) => DOORS.filter((door) => declared.has
 var dependenciesOf = (root, name) => {
   try {
     return JSON.parse(
-      readFileSync7(join7(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+      readFileSync7(
+        join7(packageDirOf(resolveFrom(root, name, root), name), "package.json"),
+        "utf8"
+      )
     ).dependencies ?? {};
   } catch {
     return {};
@@ -1307,7 +1321,7 @@ var dependenciesOf = (root, name) => {
 };
 var resolves = (root, name) => {
   try {
-    resolveFrom(root, name);
+    resolveFrom(root, name, root);
     return true;
   } catch {
     return false;
@@ -1563,16 +1577,15 @@ import {
 import { tmpdir } from "os";
 import { dirname as dirname2, join as join8, resolve } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
+
+// src/rule-level.ts
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
+
+// src/exercised.ts
 var enabledRulesOf = (rules, plugin) => Object.keys(rules).filter((id) => id.startsWith(`${plugin}/`) && !OFF.has(severityOf(rules[id]))).toSorted();
 var passes = (findings) => !findings.some((one) => one.verdict === "FAIL" || one.verdict === "UNJUDGED");
-var finding5 = (subject, verdict, message) => ({
-  check: "exercised",
-  message,
-  subject,
-  verdict
-});
+var finding5 = findingMaker("exercised");
 var LIMIT = 800;
 var refusal = (error) => {
   const said2 = String(error.message).trim();
@@ -1667,6 +1680,7 @@ var throughProbes = ({
   corpus,
   oxlint,
   probes,
+  root,
   silent
 }) => {
   const refused = /* @__PURE__ */ new Map();
@@ -1725,7 +1739,7 @@ var throughProbes = ({
     const probeConfig = JSON.parse(readFileSync8(config.path, "utf8"));
     const configDir = dirname2(config.path);
     probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
-      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec), spec)
+      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec, root), spec)
     );
     const at = join8(here, ".oxlintrc-geonosis-probe.json");
     writeFileSync(at, JSON.stringify(probeConfig, null, 2));
@@ -1822,7 +1836,7 @@ var checkExercised = async ({
   let probed = { fired: /* @__PURE__ */ new Set(), refused: /* @__PURE__ */ new Map() };
   if (declared.length > 0) {
     try {
-      probed = throughProbes({ config, corpus, oxlint, probes, silent: declared });
+      probed = throughProbes({ config, corpus, oxlint, probes, root, silent: declared });
     } catch (error) {
       return said2("FAIL", `the declared probes could not be run \u2014 ${refusal(error)}`);
     }
@@ -1863,12 +1877,8 @@ var THIS_TOOL = "doctor";
 var OWN = `${THIS_TOOL}.json`;
 var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one (this run\u2019s own doctor.json is not one of them: it is written after these checks, and balanced at write time)";
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var finding6 = (verdict, subject, message) => ({
-  check: "envelope",
-  message,
-  subject,
-  verdict
-});
+var make2 = findingMaker("envelope");
+var finding6 = (verdict, subject, message) => make2(subject, verdict, message);
 var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
 var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
 var judge = (subject, name, parsed) => {
@@ -1939,12 +1949,7 @@ import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { dirname as dirname3, join as join10 } from "path";
 var SCOPE = "@geonosis/";
 var EXAM = /(?:^|[^$\w])([$\w]*Conformance)\b/g;
-var finding7 = (subject, verdict, message) => ({
-  check: "exams",
-  message,
-  subject,
-  verdict
-});
+var finding7 = findingMaker("exams");
 var declaredBy = (workspaces) => {
   const found = /* @__PURE__ */ new Map();
   const provided = new Set(
@@ -1984,18 +1989,19 @@ var declarationsOf = (dir) => {
     }
   }).join("\n");
 };
-var installedAt = (from, name) => {
+var installedAt = (from, name, root) => {
   let at = from;
   for (; ; ) {
     const dir = join10(at, "node_modules", name);
     if (existsSync9(join10(dir, "package.json"))) return dir;
+    if (at === root) return void 0;
     const up = dirname3(at);
     if (up === at) return void 0;
     at = up;
   }
 };
-var examsShippedBy = (from, name) => {
-  const dir = installedAt(from, name);
+var examsShippedBy = (from, name, root) => {
+  const dir = installedAt(from, name, root);
   if (dir === void 0) return [];
   return [...new Set([...declarationsOf(dir).matchAll(EXAM)].map((one) => one[1]))];
 };
@@ -2006,7 +2012,7 @@ var checkExams = ({
   const tests = testFilesUnder(root).map((path) => ({ path, source: readFileSync10(path, "utf8") }));
   const found = [];
   for (const { from, name } of declaredBy(workspaces)) {
-    const exams = examsShippedBy(from, name);
+    const exams = examsShippedBy(from, name, root);
     if (exams.length === 0) continue;
     for (const exam of exams) {
       const importing = tests.find((one) => one.source.includes(name) && one.source.includes(exam));
@@ -2162,12 +2168,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding8 = (subject, verdict, message) => ({
-  check: "loaded",
-  message,
-  subject,
-  verdict
-});
+var finding8 = findingMaker("loaded");
 var firstLine = (error) => String(error.message).split("\n")[0] ?? "";
 var versionAt = async (entry, specifier, root) => ({
   at: relativeToRoot(root, packageDirOf(entry, specifier)),
@@ -2182,9 +2183,9 @@ var oneConfig = async ({
   const said2 = (verdict, message) => finding8(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
-    loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
+    loaded = await versionAt(resolveFrom(config.dir, specifier, root), specifier, root);
   } catch (error) {
-    return said2(
+    return error instanceof AboveRootError ? said2("FAIL", error.message) : said2(
       "FAIL",
       `could not resolve it from this config's directory, and oxlint resolves it from exactly there \u2014 ${firstLine(error)}`
     );
@@ -2218,7 +2219,7 @@ var copiesOf = async ({
   for (const workspace of workspaces) {
     let entry;
     try {
-      entry = resolveFrom(workspace.dir, specifier);
+      entry = resolveFrom(workspace.dir, specifier, root);
     } catch {
       continue;
     }
@@ -2244,7 +2245,7 @@ var shipperOf = (root, bin) => {
   const name = bin === "geonosis" ? "@geonosis/cli" : `@geonosis/${bin.replace(/^geonosis-/, "")}`;
   try {
     const manifest = JSON.parse(
-      readFileSync12(join12(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+      readFileSync12(join12(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
     );
     const declared = manifest.bin;
     return typeof declared === "object" && !Object.hasOwn(declared, bin) ? "" : name;
@@ -2342,7 +2343,7 @@ var checkLoaded = async ({
 var trainVersion = async (root, specifiers) => {
   for (const specifier of specifiers.toSorted()) {
     try {
-      return await pluginVersionOf(resolveFrom(root, specifier));
+      return await pluginVersionOf(resolveFrom(root, specifier, root));
     } catch {
       continue;
     }
@@ -2357,12 +2358,8 @@ var GEONOSIS_FILE2 = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding9 = (verdict, subject, message) => ({
-  check: "observability",
-  message,
-  subject,
-  verdict
-});
+var make3 = findingMaker("observability");
+var finding9 = (verdict, subject, message) => make3(subject, verdict, message);
 var readGeonosis2 = (root) => {
   let text;
   try {
@@ -2537,12 +2534,7 @@ var wrapperNamedBy = (script, dir) => {
 var asCommand = (source) => source.replaceAll(/['"`,[\]()]/gu, " ");
 var ASKS_FOR_A_REPORT = /--outputFile|--reporter[= ]\S*json/i;
 var PARSES_A_REPORT = /JSON\.parse|numFailedTests/;
-var finding10 = (subject, verdict, message) => ({
-  check: "runner",
-  message,
-  subject,
-  verdict
-});
+var finding10 = findingMaker("runner");
 var stringOf = (value) => typeof value === "string" ? value : "";
 var namesOf = (workspace) => [workspace.relative, stringOf(workspace.manifest.name)].filter((one) => one !== "");
 var covers = (command, workspace, workspaces) => {
@@ -2735,9 +2727,7 @@ var checkEngines = async ({
 // src/path-grants.ts
 import { readdirSync as readdirSync6 } from "fs";
 import { join as join15 } from "path";
-var OFF2 = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
-var severityOf2 = (level) => Array.isArray(level) ? level[0] : level;
-var NEVER_WALKED3 = /* @__PURE__ */ new Set([".git", "coverage", "dist", "node_modules"]);
+var NEVER_WALKED2 = /* @__PURE__ */ new Set([".git", "coverage", "dist", "node_modules"]);
 var LINTABLE2 = /\.[cm]?[jt]sx?$/;
 var filesUnder2 = (root, at = "") => {
   let entries;
@@ -2749,7 +2739,7 @@ var filesUnder2 = (root, at = "") => {
   return entries.flatMap((entry) => {
     const here = at === "" ? entry.name : `${at}/${entry.name}`;
     if (entry.isDirectory()) {
-      return NEVER_WALKED3.has(entry.name) ? [] : filesUnder2(root, here);
+      return NEVER_WALKED2.has(entry.name) ? [] : filesUnder2(root, here);
     }
     return LINTABLE2.test(entry.name) ? [here] : [];
   });
@@ -2779,7 +2769,7 @@ var checkPathGrants = ({
   const found = [];
   for (const [id, grant] of declared) {
     for (const layer of layersOf(config, id)) {
-      if (OFF2.has(severityOf2(layer.level))) continue;
+      if (OFF.has(severityOf(layer.level))) continue;
       const options = bagOf(layer.level);
       const patterns = stringsOf2(options[grant.paths]);
       if (patterns.length === 0) continue;
@@ -2805,12 +2795,7 @@ var PROJECT = ".claude/settings.json";
 var LOCAL = ".claude/settings.local.json";
 var RUN_RECORD = ".geonosis/rails-run.json";
 var managedSettingsPath = (platform = process.platform) => platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
-var finding11 = (subject, verdict, message) => ({
-  check: "rails",
-  message,
-  subject,
-  verdict
-});
+var finding11 = findingMaker("rails");
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var networkIn = (parsed) => {
   if (!isRecord3(parsed)) return void 0;
@@ -3009,8 +2994,8 @@ var exercisedOf = ({
       let corpus;
       let entry;
       try {
-        corpus = corpusOfPlugin(config.dir, specifier);
-        entry = resolveFrom(config.dir, specifier);
+        corpus = corpusOfPlugin(config.dir, specifier, root);
+        entry = resolveFrom(config.dir, specifier, root);
       } catch (error) {
         return [
           {
@@ -3040,13 +3025,13 @@ var exercisedOf = ({
     })
   )
 );
-var requiredOptionsOf = async (configs) => {
+var requiredOptionsOf = async (configs, root) => {
   const found = await Promise.all(
     configs.flatMap(
       (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE2)).map(async (specifier) => {
         let entry;
         try {
-          entry = resolveFrom(config.dir, specifier);
+          entry = resolveFrom(config.dir, specifier, root);
         } catch {
           return [];
         }
@@ -3098,7 +3083,7 @@ var runDoctor = async ({
       "loaded",
       async () => [
         ...await checkLoaded({ configs, home, root, workspaces }),
-        ...await requiredOptionsOf(configs)
+        ...await requiredOptionsOf(configs, root)
       ]
     ],
     [
@@ -3200,6 +3185,8 @@ export {
   discoverConfigs,
   discoverWorkspaces,
   readRatchet,
+  CHECKS,
+  DoctorError,
   defaultRef,
   checkBaseline,
   DEPLOYED_FILE,
@@ -3207,8 +3194,6 @@ export {
   checkDeployed,
   GEONOSIS_FILE,
   repoCorpusOf,
-  CHECKS,
-  DoctorError,
   resolveFrom,
   packageDirOf,
   pluginVersionOf,

package/dist/doctor-cli.js

@@ -4,7 +4,7 @@ import {
   formatDoctor,
   formatJson,
   runDoctor
-} from "./chunk-GXW7SYO2.js";
+} from "./chunk-EZB5BG4L.js";
 
 // src/doctor-cli.ts
 import { fstatSync, statSync } from "fs";

package/dist/index.d.ts

@@ -378,7 +378,12 @@ declare const repoCorpusOf: (root: string) => string | undefined;
 declare const formatDoctor: ({ counts, findings, ok, root }: DoctorReport) => string;
 declare const formatJson: (report: DoctorReport) => string;
 
-declare const resolveFrom: (dir: string, specifier: string) => string;
+/**
+ * `root` is the directory the doctor was HANDED — the boundary a deployed tree actually has. A
+ * package on the way up from `dir` but past `root` is not this tree's to see; #373/#386 measured
+ * the kit's own workspace two directories above a consumer's checkout read exactly that way.
+ */
+declare const resolveFrom: (dir: string, specifier: string, root: string) => string;
 /** The package a resolved entry point belongs to: up until a manifest claims the name. */
 declare const packageDirOf: (entry: string, name: string) => string;
 /**
@@ -388,7 +393,7 @@ declare const packageDirOf: (entry: string, name: string) => string;
  */
 declare const pluginVersionOf: (entry: string) => Promise<string>;
 /** Where a plugin keeps the corpus it is evidence by, if it ships one at all. */
-declare const corpusOfPlugin: (from: string, specifier: string) => string;
+declare const corpusOfPlugin: (from: string, specifier: string, root: string) => string;
 /**
  * A resolved path, said relative to the root. Both sides are realpath'd first: a resolver returns
  * the real path, and on macOS a temp root under `/var/folders` is a symlink to `/private/var`, so

package/dist/index.js

@@ -48,7 +48,7 @@ import {
   resolveFrom,
   runDoctor,
   satisfies
-} from "./chunk-GXW7SYO2.js";
+} from "./chunk-EZB5BG4L.js";
 export {
   CHECKS,
   COMPOSITION_ROOT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/doctor",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "types": "./dist/index.d.ts",
   "description": "The adoption doctor — declared ≠ loaded, enabled ≠ exercised, a baseline that grew, a runner whose exit code is the only verdict.",
   "keywords": [
@@ -36,10 +36,10 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/lint-parity": "2.5.0"
+    "@geonosis/lint-parity": "2.5.2"
   },
   "devDependencies": {
-    "@geonosis/ratchet": "2.5.0"
+    "@geonosis/ratchet": "2.5.2"
   },
   "peerDependencies": {
     "oxlint": ">=1.77"