@ivuorinen/base-configs 2.0.31 → 3.0.1

package/CLAUDE.md

@@ -0,0 +1,121 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Commands
+
+Node is managed via **mise**, which reads `.nvmrc` automatically. No manual activation needed in an interactive shell. For scripts:
+
+```sh
+mise exec -- yarn <command>
+```
+
+| Task | Command |
+|------|---------|
+| Fix all (prettier → eslint → markdownlint) | `yarn fix` |
+| ESLint autofix | `yarn eslint:fix` |
+| ESLint report only | `yarn eslint:report` |
+| Prettier autofix | `yarn prettier:fix` |
+| Prettier report only | `yarn prettier:report` |
+| Markdownlint autofix | `yarn markdownlint:fix` |
+| Markdownlint report only | `yarn markdownlint:report` |
+| Validate last commit message | `yarn commitlint` |
+
+There is no build step and no test suite — this is a configuration distribution package.
+
+## Architecture
+
+`@ivuorinen/base-configs` is a **meta-package**: it has no source code of its own. Its sole purpose is to declare the 7 individual config packages as `dependencies` so consumers can install one package and get all configs:
+
+| Config | Package |
+|--------|---------|
+| Browserslist | `@ivuorinen/browserslist-config` |
+| CommitLint | `@ivuorinen/commitlint-config` |
+| ESLint | `@ivuorinen/eslint-config` |
+| Markdownlint | `@ivuorinen/markdownlint-config` |
+| Prettier | `@ivuorinen/prettier-config` |
+| Semantic Release | `@ivuorinen/semantic-release-config` |
+| Stylelint | `@ivuorinen/stylelint-config` |
+
+Each config package is versioned and published independently to npm. This repo only bumps their version ranges.
+
+- **Package manager**: Yarn 4 (Berry) with `node-modules` linker (no PnP) — always use `yarn` for repo development; consumers may install via `npm` as shown in the README
+- **Module system**: ES Modules (`"type": "module"`)
+- **Node requirement**: `>=20` (active version read from `.nvmrc` by mise)
+
+## Release Process
+
+Releases are fully automated via **semantic-release** triggered on push to `main`. Commit messages must follow Conventional Commits (enforced by commitlint via a simple-git-hooks `commit-msg` hook). Never manually bump versions or publish.
+
+## EditorConfig Rules
+
+`.editorconfig` is authoritative — all generated code must follow it:
+- Charset: UTF-8, line endings: LF
+- Indent: 2 spaces (all file types)
+- Max line length: 120 (disabled for Markdown)
+- Trim trailing whitespace (except Markdown)
+
+---
+
+## context-mode — MANDATORY routing rules
+
+You have context-mode MCP tools available. These rules are NOT optional — they protect your context window from flooding. A single unrouted command can dump 56 KB into context and waste the entire session.
+
+### BLOCKED commands — do NOT attempt these
+
+#### curl / wget — BLOCKED
+Any Bash command containing `curl` or `wget` is intercepted and replaced with an error message. Do NOT retry.
+Instead use:
+- `ctx_fetch_and_index(url, source)` to fetch and index web pages
+- `ctx_execute(language: "javascript", code: "const r = await fetch(...)")` to run HTTP calls in sandbox
+
+#### Inline HTTP — BLOCKED
+Any Bash command containing `fetch('http`, `requests.get(`, `requests.post(`, `http.get(`, or `http.request(` is intercepted and replaced with an error message. Do NOT retry with Bash.
+Instead use:
+- `ctx_execute(language, code)` to run HTTP calls in sandbox — only stdout enters context
+
+#### WebFetch — BLOCKED
+WebFetch calls are denied entirely. The URL is extracted and you are told to use `ctx_fetch_and_index` instead.
+Instead use:
+- `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` to query the indexed content
+
+### REDIRECTED tools — use sandbox equivalents
+
+#### Bash (>20 lines output)
+Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `yarn install`, `pip install`, and other short-output commands.
+For everything else, use:
+- `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
+- `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context
+
+#### Read (for analysis)
+If you are reading a file to **Edit** it → Read is correct (Edit needs content in context).
+If you are reading to **analyze, explore, or summarize** → use `ctx_execute_file(path, language, code)` instead. Only your printed summary enters context. The raw file content stays in the sandbox.
+
+#### Grep (large results)
+Grep results can flood context. Use `ctx_execute(language: "shell", code: "grep ...")` to run searches in sandbox. Only your printed summary enters context.
+
+### Tool selection hierarchy
+
+1. **GATHER**: `ctx_batch_execute(commands, queries)` — Primary tool. Runs all commands, auto-indexes output, returns search results. ONE call replaces 30+ individual calls.
+2. **FOLLOW-UP**: `ctx_search(queries: ["q1", "q2", ...])` — Query indexed content. Pass ALL questions as array in ONE call.
+3. **PROCESSING**: `ctx_execute(language, code)` | `ctx_execute_file(path, language, code)` — Sandbox execution. Only stdout enters context.
+4. **WEB**: `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` — Fetch, chunk, index, query. Raw HTML never enters context.
+5. **INDEX**: `ctx_index(content, source)` — Store content in FTS5 knowledge base for later search.
+
+### Subagent routing
+
+When spawning subagents (Agent/Task tool), the routing block is automatically injected into their prompt. Bash-type subagents are upgraded to general-purpose so they have access to MCP tools. You do NOT need to manually instruct subagents about context-mode.
+
+### Output constraints
+
+- Keep responses under 500 words.
+- Write artifacts (code, configs, PRDs) to FILES — never return them as inline text. Return only: file path + 1-line description.
+- When indexing content, use descriptive source labels so others can `ctx_search(source: "label")` later.
+
+### ctx commands
+
+| Command | Action |
+|---------|--------|
+| `ctx stats` | Call the `ctx_stats` MCP tool and display the full output verbatim |
+| `ctx doctor` | Call the `ctx_doctor` MCP tool, run the returned shell command, display as checklist |
+| `ctx upgrade` | Call the `ctx_upgrade` MCP tool, run the returned shell command, display as checklist |

package/README.md

@@ -4,11 +4,20 @@
 
 This is a meta package for all my base configs.
 
-You can find all the individual configs in the `packages` folder.
-
 The main reason for this package is to make it easier to use these configs in other projects, and to update them all at once. No more pull requests to update all the configs one at a time!
 
-## Installation
+> A collection of base configs for code quality and linting tools. Heavily based on `@demartini/base-configs`
+
+## Table of Contents <!-- omit in toc -->
+
+- [Usage](#usage)
+- [Available Configurations](#available-configurations)
+- [Badge](#badge)
+- [Contributing](#contributing)
+- [Changelog](#changelog)
+- [License](#license)
+
+## Usage
 
 ```bash
 # npm
@@ -18,18 +27,83 @@ npm install @ivuorinen/base-configs --save-dev
 yarn add @ivuorinen/base-configs --dev
 ```
 
+## Available Configurations
+
+| Tool                                      | Package                                               | GitHub                                      | Version                                                                               |
+| ----------------------------------------- | ----------------------------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------- |
+| [Browserslist][browserslist-link]         | [@ivuorinen/browserslist-config][pkg-browserslist]    | [GitHub][gh-browserslist]                   | [![@ivuorinen/browserslist-config][browserslist-badge]][browserslist-npm]             |
+| [CommitLint][commitlint-link]             | [@ivuorinen/commitlint-config][pkg-commitlint]        | [GitHub][gh-commitlint]                     | [![@ivuorinen/commitlint-config][commitlint-badge]][commitlint-npm]                   |
+| [ESLint][eslint-link]                     | [@ivuorinen/eslint-config][pkg-eslint]                | [GitHub][gh-eslint]                         | [![@ivuorinen/eslint-config][eslint-badge]][eslint-npm]                               |
+| [MarkdownLint][markdownlint-link]         | [@ivuorinen/markdownlint-config][pkg-markdownlint]    | [GitHub][gh-markdownlint]                   | [![@ivuorinen/markdownlint-config][markdownlint-badge]][markdownlint-npm]             |
+| [Prettier][prettier-link]                 | [@ivuorinen/prettier-config][pkg-prettier]            | [GitHub][gh-prettier]                       | [![@ivuorinen/prettier-config][prettier-badge]][prettier-npm]                         |
+| [semantic-release][semantic-release-link] | [@ivuorinen/semantic-release-config][pkg-src]         | [GitHub][gh-semantic-release]               | [![@ivuorinen/semantic-release-config][semantic-release-badge]][semantic-release-npm] |
+| [stylelint][stylelint-link]               | [@ivuorinen/stylelint-config][pkg-stylelint]          | [GitHub][gh-stylelint]                      | [![@ivuorinen/stylelint-config][stylelint-badge]][stylelint-npm]                      |
+
+[pkg-browserslist]: https://www.npmjs.com/package/@ivuorinen/browserslist-config
+[pkg-commitlint]: https://www.npmjs.com/package/@ivuorinen/commitlint-config
+[pkg-eslint]: https://www.npmjs.com/package/@ivuorinen/eslint-config
+[pkg-markdownlint]: https://www.npmjs.com/package/@ivuorinen/markdownlint-config
+[pkg-prettier]: https://www.npmjs.com/package/@ivuorinen/prettier-config
+[pkg-src]: https://www.npmjs.com/package/@ivuorinen/semantic-release-config
+[pkg-stylelint]: https://www.npmjs.com/package/@ivuorinen/stylelint-config
+[gh-browserslist]: https://github.com/ivuorinen/base-configs-browserslist
+[gh-commitlint]: https://github.com/ivuorinen/base-configs-commitlint
+[gh-eslint]: https://github.com/ivuorinen/base-configs-eslint
+[gh-markdownlint]: https://github.com/ivuorinen/base-configs-markdownlint
+[gh-prettier]: https://github.com/ivuorinen/base-configs-prettier
+[gh-semantic-release]: https://github.com/ivuorinen/base-configs-semantic-release
+[gh-stylelint]: https://github.com/ivuorinen/base-configs-stylelint
+
+## Badge
+
+Show the world that you are using ivuorinen's code style in your project by including the badge in your readme.
+
+[![ivuorinen's Code Style](https://img.shields.io/badge/code_style-ivuorinen%E2%80%99s-663399.svg?labelColor=292a44&style=flat-square)](https://github.com/ivuorinen/base-configs)
+
+```md
+[![ivuorinen's Code Style](https://img.shields.io/badge/code_style-ivuorinen%E2%80%99s-663399.svg?labelColor=292a44&style=flat-square)](https://github.com/ivuorinen/base-configs)
+```
+
+## Contributing
+
+If you are interested in helping contribute, please take a look at our [contribution guidelines][contributing-link] and open an [issue][issue-link] or [pull request][pull-request-link].
+
 ## Changelog
 
 See [CHANGELOG][changelog-link] for a human-readable history of changes.
 
 ## License
 
-MIT License. See [LICENSE][license-link] for more info.
+Distributed under the MIT License. See [LICENSE][license-link] for more information.
 
-[changelog-link]: ./CHANGELOG.md
+[changelog-link]: https://github.com/ivuorinen/base-configs/releases
+[contributing-link]: https://github.com/ivuorinen/.github/blob/main/CONTRIBUTING.md
+[issue-link]: https://github.com/ivuorinen/base-configs/issues
 [license-badge]: https://img.shields.io/github/license/ivuorinen/base-configs?style=flat-square&labelColor=292a44&color=663399
 [license-link]: ./LICENSE
-[npm-badge]: https://img.shields.io/npm/v/@ivuorinen/base-configs?style=flat-square&labelColor=292a44&color=663399
-[npm-link]: https://www.npmjs.com/package/@ivuorinen/base-configs
+[pull-request-link]: https://github.com/ivuorinen/base-configs/pulls
 [style-badge]: https://img.shields.io/badge/code_style-ivuorinen%E2%80%99s-663399.svg?labelColor=292a44&style=flat-square
 [style-link]: https://github.com/ivuorinen/base-configs
+[browserslist-badge]: https://img.shields.io/npm/v/@ivuorinen/browserslist-config?style=flat-square&labelColor=292a44&color=663399
+[browserslist-link]: https://github.com/browserslist/browserslist
+[browserslist-npm]: https://www.npmjs.com/package/@ivuorinen/browserslist-config
+[commitlint-badge]: https://img.shields.io/npm/v/@ivuorinen/commitlint-config?style=flat-square&labelColor=292a44&color=663399
+[commitlint-link]: https://github.com/conventional-changelog/commitlint
+[commitlint-npm]: https://www.npmjs.com/package/@ivuorinen/commitlint-config
+[eslint-badge]: https://img.shields.io/npm/v/@ivuorinen/eslint-config?style=flat-square&labelColor=292a44&color=663399
+[eslint-link]: https://github.com/eslint/eslint
+[eslint-npm]: https://www.npmjs.com/package/@ivuorinen/eslint-config
+[markdownlint-badge]: https://img.shields.io/npm/v/@ivuorinen/markdownlint-config?style=flat-square&labelColor=292a44&color=663399
+[markdownlint-link]: https://github.com/DavidAnson/markdownlint
+[markdownlint-npm]: https://www.npmjs.com/package/@ivuorinen/markdownlint-config
+[prettier-badge]: https://img.shields.io/npm/v/@ivuorinen/prettier-config?style=flat-square&labelColor=292a44&color=663399
+[prettier-link]: https://github.com/prettier/prettier
+[prettier-npm]: https://www.npmjs.com/package/@ivuorinen/prettier-config
+[semantic-release-badge]: https://img.shields.io/npm/v/@ivuorinen/semantic-release-config?style=flat-square&labelColor=292a44&color=663399
+[semantic-release-link]: https://github.com/semantic-release/semantic-release
+[semantic-release-npm]: https://www.npmjs.com/package/@ivuorinen/semantic-release-config
+[stylelint-badge]: https://img.shields.io/npm/v/@ivuorinen/stylelint-config?style=flat-square&labelColor=292a44&color=663399
+[stylelint-link]: https://github.com/stylelint/stylelint
+[stylelint-npm]: https://www.npmjs.com/package/@ivuorinen/stylelint-config
+[npm-badge]: https://img.shields.io/npm/v/@ivuorinen/base-configs?style=flat-square&labelColor=292a44&color=663399
+[npm-link]: https://www.npmjs.com/package/@ivuorinen/base-configs

package/docs/audit/nitpicker-findings.md

@@ -0,0 +1,48 @@
+# Nitpicker Findings
+
+- Generated: 2026-06-25
+- Last validated: 2026-06-25
+- Scope: all uncommitted changes (changed-files mode) on branch `chore/upgrades`
+
+## Summary
+
+- Total: 1 | Open: 1 | Fixed: 0 | Invalid: 0
+
+Reviewed changes:
+
+- Prettier YAML reformats: `codeql.yml`, `stale.yml`, `sync-labels.yml`, `.yarnrc.yml`
+- `js-yaml` resolution added to `package.json`
+- node_modules cache-key change in `pr.yml` and `publish.yml`
+- New config files: `.coderabbit.yaml`, `.mega-linter.yml`
+
+No correctness, security, reliability, maintainability, or convention defects were found.
+
+## Open Findings
+
+### Advisory
+
+#### [N1] zizmor online-audit re-enable cannot be confirmed without a CI run
+
+- Category: reliability
+- Area: `.mega-linter.yml`
+- Problem: Exposing `GITHUB_TOKEN` lets zizmor's online `impostor-commit` audit authenticate instead of returning HTTP 401.
+- Evidence: `ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES` is in the MegaLinter v9.5.0 schema and is the documented remedy.
+- Evidence: Online audits run only inside MegaLinter's CI; local validation cannot exercise the token hand-off.
+- Impact: Informational. If MegaLinter does not surface `GITHUB_TOKEN` to the zizmor step in CI, the 401 may persist.
+- Fix: No action now. If CI still 401s, set `ACTION_ZIZMOR_ARGUMENTS: --no-online-audits` to skip only online audits.
+
+## Verification notes (no findings)
+
+- Prettier quote changes parse to identical YAML trees versus `HEAD` for all four files; no semantic change.
+- `js-yaml` `^4.2.0` removes the vulnerable `4.1.1` (CVE-2026-53550); only `4.2.0` remains, with no `3.x` consumer.
+- Cache key `hashFiles('.nvmrc', '**/yarn.lock')` references existing files; no `restore-keys`, so a Node bump misses cleanly.
+- `.coderabbit.yaml` and `.mega-linter.yml` pass prettier and yamllint, and validate against their published JSON schemas.
+- `zizmor --persona auditor .github/workflows/` reports no findings.
+
+## Fixed
+
+None.
+
+## Invalid
+
+None.

package/eslint.config.mjs

@@ -0,0 +1,12 @@
+import ivuorinenConfig from '@ivuorinen/eslint-config'
+
+export default [
+  ...ivuorinenConfig,
+
+  // your modifications
+  {
+    rules: {
+      // "no-unused-vars": "warn"
+    }
+  }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ivuorinen/base-configs",
-  "version": "2.0.31",
+  "version": "3.0.1",
   "type": "module",
   "description": "ivuorinen's shareable configurations meta package",
   "author": {
@@ -10,30 +10,64 @@
   "bugs": {
     "url": "https://github.com/ivuorinen/base-configs/issues"
   },
+  "contributors": [
+    {
+      "name": "Base Configs Contributors",
+      "url": "https://github.com/ivuorinen/base-configs/graphs/contributors"
+    }
+  ],
   "engines": {
     "node": ">=20"
   },
-  "homepage": "https://github.com/ivuorinen/base-configs/tree/main/packages/base-configs#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/ivuorinen/base-configs#readme",
   "keywords": [
-    "base-config",
+    "commitlint",
     "config",
-    "ivuorinen"
+    "eslint",
+    "lint",
+    "markdownlint",
+    "prettier",
+    "semantic-release",
+    "stylelint"
   ],
   "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/ivuorinen/base-configs.git"
+    "url": "https://github.com/ivuorinen/base-configs.git"
+  },
+  "scripts": {
+    "commitlint": "./node_modules/.bin/commitlint --from HEAD~1 --to HEAD --verbose",
+    "eslint:fix": "./node_modules/.bin/eslint '**/*.{js,tsx,ts,mjs,cjs}' --fix",
+    "eslint:report": "./node_modules/.bin/eslint '**/*.{js,tsx,ts,mjs,cjs}'",
+    "fix": "./node_modules/.bin/run-s prettier:fix eslint:fix markdownlint:fix",
+    "markdownlint:fix": "./node_modules/.bin/markdownlint '**/*.md' --fix",
+    "markdownlint:report": "./node_modules/.bin/markdownlint '**/*.md'",
+    "prettier:fix": "./node_modules/.bin/prettier '**/*.{js,tsx,ts,json,mjs,cjs}' '.*.{js,mjs,cjs,json}' --write",
+    "prettier:report": "./node_modules/.bin/prettier '**/*.{js,tsx,ts,json,mjs,cjs}' '.*.{js,mjs,cjs,json}' --check"
   },
   "dependencies": {
-    "@ivuorinen/browserslist-config": "^0.4.4",
-    "@ivuorinen/commitlint-config": "^0.3.8",
-    "@ivuorinen/eslint-config": "^0.5.12",
-    "@ivuorinen/markdownlint-config": "^0.3.15",
-    "@ivuorinen/prettier-config": "^0.3.8",
-    "@ivuorinen/semantic-release-config": "^0.3.9"
-  },
-  "gitHead": "b57fd98a95ff5b7822f8c8da04439f5c8d3e6033"
+    "@ivuorinen/browserslist-config": "^1.1.4",
+    "@ivuorinen/commitlint-config": "^1.0.32",
+    "@ivuorinen/eslint-config": "^1.2.3",
+    "@ivuorinen/markdownlint-config": "^1.1.3",
+    "@ivuorinen/prettier-config": "^2.0.0",
+    "@ivuorinen/semantic-release-config": "^2.0.0",
+    "@ivuorinen/stylelint-config": "^1.1.2"
+  },
+  "devDependencies": {
+    "@types/node": "^26.0.0",
+    "npm-run-all2": "^9.0.2",
+    "simple-git-hooks": "^2.13.1",
+    "typescript": "^6.0.3"
+  },
+  "resolutions": {
+    "js-yaml": "^5.0.0",
+    "minimatch": "^10.2.4",
+    "picomatch": "^4.0.4",
+    "undici": "^8.5.0"
+  },
+  "packageManager": "yarn@4.17.1"
 }