pr-checkmate 1.21.15 → 1.21.16

package/README.md

@@ -4,6 +4,13 @@
 ![npm](https://img.shields.io/npm/v/pr-checkmate?color=blue&label=npm)
 ![License](https://img.shields.io/badge/license-Proprietary-lightgrey)
 
+**Bundled tools:**
+![ESLint](https://img.shields.io/badge/ESLint-9-4B32C3?logo=eslint&logoColor=white)
+![Prettier](https://img.shields.io/badge/Prettier-3-F7B93E?logo=prettier&logoColor=white)
+![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)
+![cspell](https://img.shields.io/badge/cspell-10-4285F4)
+![jscpd](https://img.shields.io/badge/jscpd-3.5-blue)
+
 > **PR CheckMate** is a universal PR quality checker that runs as a single `npm install` and works across **TypeScript, JavaScript, Python, C++, Swift, and Android/Kotlin** repositories — no per-language toolchain setup required.
 
 ---
@@ -280,7 +287,7 @@ In GitHub Actions PR context, language checks automatically switch to **delta mo
 
 After `npx pr-checkmate all`, a summary table is posted to the PR. On repeated pushes the comment is updated in place — no duplicate comments.
 
-```
+```text
 ## PR CheckMate Summary
 
 11 passed · 3 warnings · 0 failed · 0 skipped

package/cspell.json

@@ -189,6 +189,16 @@
     "sultansadikov",
     "telaviv",
     "travis",
+    "kotlin",
+    "Werror",
+    "positiving",
+    "pyflakes",
+    "pycodestyle",
+    "swiftlint",
+    "pathspec",
+    "Pipfile",
+    "conanfile",
+    "ktlint",
     "Términos",
     "Teudat",
     "Tiempo",
@@ -543,7 +553,145 @@
     "Makefiles",
     "dpdm",
     "commitlintrc",
-    "shortstat"
+    "shortstat",
+    "Cooldown",
+    "SCRIPTERROR",
+    "attendace",
+    "attendance",
+    "kupat",
+    "gemel",
+    "hishtalmut",
+    "keren",
+    "tofes",
+    "Bdikat",
+    "Hishuv",
+    "formcontrolname",
+    "zrufot",
+    "Klali",
+    "contenteditable",
+    "האניקומב",
+    "ishur",
+    "Yeshut",
+    "Nihul",
+    "pratim",
+    "nispahim",
+    "networkidle",
+    "domcontentloaded",
+    "secapp",
+    "taxinfo",
+    "gmishurim",
+    "ezor",
+    "ishi",
+    "ishurim",
+    "nikui",
+    "mekabel",
+    "shdochshana",
+    "gershayim",
+    "Rashum",
+    "Shem",
+    "Mishpaha",
+    "Rshum",
+    "Prati",
+    "Ktovet",
+    "Doar",
+    "Megurim",
+    "ddlkidomet",
+    "Aher",
+    "Esek",
+    "Isuk",
+    "Mazav",
+    "Mish",
+    "Beyachad",
+    "Shlichat",
+    "Neezarti",
+    "Doch",
+    "Klalim",
+    "Hehzer",
+    "Ozer",
+    "נייע",
+    "recognised",
+    "קולומייץ",
+    "אירינה",
+    "סרגיי",
+    "פולישוק",
+    "ולדימיר",
+    "moov",
+    "virtualenv",
+    "pytesseract",
+    "qrdet",
+    "Jsons",
+    "easyocr",
+    "EXIF",
+    "fliplr",
+    "noautorotate",
+    "timestep",
+    "VAQH",
+    "DSBL",
+    "MAXU",
+    "XCUI",
+    "Apks",
+    "bootstatus",
+    "BEGINSWITH",
+    "anypassword",
+    "wrongpassword",
+    "xmark",
+    "didnt",
+    "Anthropic",
+    "bartowski",
+    "specialisation",
+    "cursorrules",
+    "deepseek",
+    "GGUF",
+    "hf",
+    "llm",
+    "machdep",
+    "migrat",
+    "modelcontextprotocol",
+    "mxbai",
+    "noheader",
+    "codedb",
+    "nomic",
+    "nounits",
+    "nvidia",
+    "ollama",
+    "qwen",
+    "shellcheck",
+    "standards",
+    "vram",
+    "ATATT",
+    "ATSTT",
+    "AUTOINCREMENT",
+    "BEAGENT",
+    "CEREBRAS",
+    "cpucore",
+    "Fingerprinter",
+    "FREELLM",
+    "ircular",
+    "integrat",
+    "LOOKBACK",
+    "markitdown",
+    "memswap",
+    "nknown",
+    "processlist",
+    "unixepoch",
+    "unreviewed",
+    "xapp",
+    "bpoa",
+    "installroot",
+    "dedups",
+    "behaviourally",
+    "normalised",
+    "раннера",
+    "раннере",
+    "пайплайн",
+    "dind",
+    "dlib",
+    "pugixml",
+    "opencvcommit",
+    "litert",
+    "SHTPB",
+    "FUTX",
+    "subdirs"
   ],
   "ignorePaths": [
     "**/node_modules/**",

package/dist/config/loader.js

@@ -163,6 +163,10 @@ function getDefaultConfig() {
                 'test',
                 'build',
             ],
+            // Skip release PRs and squash-merge titles that don't follow conventional
+            // commits (e.g. "Release 15 (#114)"). commitlint already ignores literal
+            // "Merge"/"Revert" messages, but not GitHub squash-merge PR titles.
+            ignores: ['^Release\\b', '^chore\\(release\\):'],
         },
         licenseCheck: {
             allowPackages: [...constants_1.DEFAULT_ALLOW_PACKAGES],

package/dist/core/checks/commitlint.js

@@ -36,14 +36,21 @@ const DEFAULT_TYPES = [
     'test',
     'build',
 ];
-function buildTempConfig(types) {
-    const config = {
-        // Resolve via Node module resolution — robust to npm hoisting in the client.
-        extends: [require.resolve('@commitlint/config-conventional')],
-        rules: { 'type-enum': [2, 'always', types] },
-    };
-    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.commitlint-${process.pid}.json`);
-    node_fs_1.default.writeFileSync(tmpFile, JSON.stringify(config, null, 2));
+const DEFAULT_IGNORES = ['^Release\\b', '^chore\\(release\\):'];
+function buildTempConfig(types, ignores) {
+    // Emit a CJS module so `ignores` can hold functions — commitlint requires
+    // predicate functions there, which a JSON config cannot express.
+    // Resolve config-conventional via Node module resolution — robust to hoisting.
+    const configConventional = require.resolve('@commitlint/config-conventional');
+    const content = `const patterns = ${JSON.stringify(ignores)}.map((p) => new RegExp(p, 'i'));
+module.exports = {
+  extends: [${JSON.stringify(configConventional)}],
+  rules: { 'type-enum': [2, 'always', ${JSON.stringify(types)}] },
+  ignores: [(commit) => patterns.some((re) => re.test(commit))],
+};
+`;
+    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.commitlint-${process.pid}.cjs`);
+    node_fs_1.default.writeFileSync(tmpFile, content);
     return tmpFile;
 }
 exports.commitlintCheck = {
@@ -65,7 +72,8 @@ exports.commitlintCheck = {
             }
             else {
                 const types = ctx.config.commitlint?.types ?? DEFAULT_TYPES;
-                tempConfigFile = buildTempConfig(types);
+                const ignores = ctx.config.commitlint?.ignores ?? DEFAULT_IGNORES;
+                tempConfigFile = buildTempConfig(types, ignores);
                 args.push('--config', tempConfigFile);
             }
             const result = await (0, execa_1.execa)(process.execPath, [commitlintBin, ...args], {

package/dist/core/checks/diff-security.js

@@ -99,6 +99,46 @@ const SECURITY_PATTERNS = [
         severity: 'error',
     },
 ];
+/** Bucket added-line matches by severity, keyed by pattern label. */
+function scanDiff(stdout) {
+    const errors = {};
+    const warnings = {};
+    for (const line of stdout.split('\n')) {
+        for (const { pattern, label, severity } of SECURITY_PATTERNS) {
+            if (pattern.test(line)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+    return { errors, warnings };
+}
+/** Log up to 3 sample lines per label at the given severity. */
+function logFindings(bucket, isError) {
+    const emit = isError ? utils_1.logger.error.bind(utils_1.logger) : utils_1.logger.warn.bind(utils_1.logger);
+    const icon = isError ? '❌' : '⚠️';
+    for (const [label, occurrences] of Object.entries(bucket)) {
+        emit(`[Diff Security]: ${icon} ${label}: ${occurrences.length} occurrence(s)`);
+        occurrences.slice(0, 3).forEach(l => emit(`    ${l}`));
+        if (occurrences.length > 3)
+            emit(`    ... and ${occurrences.length - 3} more`);
+    }
+}
+/** Report findings and produce the check outcome. */
+function reportFindings(errors, warnings) {
+    const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
+    const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
+    if (totalErrors === 0 && totalWarnings === 0)
+        return (0, types_1.pass)();
+    logFindings(errors, true);
+    logFindings(warnings, false);
+    const parts = [];
+    if (totalErrors > 0)
+        parts.push(`${totalErrors} issue(s)`);
+    if (totalWarnings > 0)
+        parts.push(`${totalWarnings} warning(s)`);
+    return (0, types_1.warn)(parts.join(', '));
+}
 exports.diffSecurityCheck = {
     name: 'Diff Security',
     phase: 'informational',
@@ -121,38 +161,8 @@ exports.diffSecurityCheck = {
                 '*.mjs',
                 '*.cjs',
             ], { cwd: ctx.cwd });
-            const errors = {};
-            const warnings = {};
-            for (const line of stdout.split('\n')) {
-                for (const { pattern, label, severity } of SECURITY_PATTERNS) {
-                    if (pattern.test(line)) {
-                        const bucket = severity === 'error' ? errors : warnings;
-                        (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-                    }
-                }
-            }
-            const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
-            const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
-            if (totalErrors === 0 && totalWarnings === 0)
-                return (0, types_1.pass)();
-            for (const [label, occurrences] of Object.entries(errors)) {
-                utils_1.logger.error(`[Diff Security]: ❌ ${label}: ${occurrences.length} occurrence(s)`);
-                occurrences.slice(0, 3).forEach(l => utils_1.logger.error(`    ${l}`));
-                if (occurrences.length > 3)
-                    utils_1.logger.error(`    ... and ${occurrences.length - 3} more`);
-            }
-            for (const [label, occurrences] of Object.entries(warnings)) {
-                utils_1.logger.warn(`[Diff Security]: ⚠️ ${label}: ${occurrences.length} occurrence(s)`);
-                occurrences.slice(0, 3).forEach(l => utils_1.logger.warn(`    ${l}`));
-                if (occurrences.length > 3)
-                    utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
-            }
-            const parts = [];
-            if (totalErrors > 0)
-                parts.push(`${totalErrors} issue(s)`);
-            if (totalWarnings > 0)
-                parts.push(`${totalWarnings} warning(s)`);
-            return (0, types_1.warn)(parts.join(', '));
+            const { errors, warnings } = scanDiff(stdout);
+            return reportFindings(errors, warnings);
         }
         catch (err) {
             utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/duplicate-check.js

@@ -26,7 +26,7 @@ exports.duplicateCheck = {
             return (0, types_1.skip)('no relevant files changed');
         const srcPath = node_path_1.default.join(ctx.cwd, 'src');
         const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [ctx.cwd]);
-        const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'bin/jscpd');
+        const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'run-jscpd.js');
         try {
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
@@ -38,7 +38,6 @@ exports.duplicateCheck = {
                 'console',
                 '--ignore',
                 'node_modules/**,dist/**,.git/**',
-                '--quiet',
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
             const output = [result.stdout, result.stderr].filter(Boolean).join('\n');

package/dist/core/checks/license-check.js

@@ -24,6 +24,11 @@ exports.licenseCheck = {
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);
         const allowLicenses = ctx.config.licenseCheck?.allowLicenses ?? [];
+        // pr-checkmate installs into the consumer's node_modules, so its own runtime
+        // deps (eslint plugins, cspell dictionaries, …) leak into the client's
+        // production tree. Those are our dependencies, not the client's — never fail
+        // a client's PR because of a license we ourselves pulled in.
+        const ownDeps = (0, utils_1.getOwnDependencyClosure)();
         // Resolve the bundled license-checker binary and run it via the current node — never
         // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
         let licenseCheckerBin;
@@ -44,7 +49,8 @@ exports.licenseCheck = {
         }
         const violations = [];
         for (const [pkg, info] of Object.entries(licenses)) {
-            if (allowPackages.has(bareName(pkg)))
+            const name = bareName(pkg);
+            if (allowPackages.has(name) || ownDeps.has(name))
                 continue;
             const raw = info.licenses ?? '';
             const license = Array.isArray(raw) ? raw.join(' OR ') : raw;

package/dist/core/checks/markdown-lint.js

@@ -87,19 +87,17 @@ exports.markdownLintCheck = {
             '.claude/**',
             ...(userConfig.ignores ?? []),
         ];
-        const gitignorePath = node_path_1.default.join(ctx.cwd, '.gitignore');
-        const tmpIgnoreFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.markdownlintignore-${process.pid}`);
-        const gitignoreContent = node_fs_1.default.existsSync(gitignorePath)
-            ? node_fs_1.default.readFileSync(gitignorePath, 'utf-8') + '\n'
-            : '';
-        node_fs_1.default.writeFileSync(tmpIgnoreFile, gitignoreContent + defaultIgnorePatterns.join('\n') + '\n');
-        const args = [
-            ...(ctx.write ? ['--fix'] : []),
-            ...targets,
-            ...configArg,
-            '--ignore-path',
-            tmpIgnoreFile,
-        ];
+        // markdownlint-cli2 has no --ignore-path flag; exclusions are expressed as
+        // negated globs (`#pattern`). A bare directory name also needs `#name/**`
+        // to exclude its contents.
+        const ignoreGlobs = defaultIgnorePatterns.flatMap(pattern => {
+            const clean = pattern.replace(/\/+$/, '');
+            const globs = [`#${clean}`];
+            if (!clean.includes('*'))
+                globs.push(`#${clean}/**`);
+            return globs;
+        });
+        const args = [...(ctx.write ? ['--fix'] : []), ...targets, ...ignoreGlobs, ...configArg];
         try {
             const result = await (0, execa_1.execa)(process.execPath, [markdownlintBin, ...args], {
                 cwd: ctx.cwd,
@@ -111,8 +109,6 @@ exports.markdownLintCheck = {
         finally {
             if (tempConfigFile && node_fs_1.default.existsSync(tempConfigFile))
                 node_fs_1.default.unlinkSync(tempConfigFile);
-            if (node_fs_1.default.existsSync(tmpIgnoreFile))
-                node_fs_1.default.unlinkSync(tmpIgnoreFile);
         }
     },
 };

package/dist/core/checks/sensitive-file-guard.js

@@ -53,6 +53,45 @@ const SENSITIVE_CATEGORIES = [
         severity: 'warn',
     },
 ];
+/** Bucket changed files by category severity, keyed by category label. */
+function categorizeFiles(changedFiles) {
+    var _a;
+    const errors = {};
+    const warnings = {};
+    for (const filePath of changedFiles) {
+        for (const category of SENSITIVE_CATEGORIES) {
+            if (category.patterns.some(p => p.test(filePath))) {
+                const bucket = category.severity === 'error' ? errors : warnings;
+                (bucket[_a = category.label] ?? (bucket[_a] = [])).push(filePath);
+            }
+        }
+    }
+    return { errors, warnings };
+}
+/** Log every file per label at the given severity. */
+function logFiles(bucket, isError) {
+    const emit = isError ? utils_1.logger.error.bind(utils_1.logger) : utils_1.logger.warn.bind(utils_1.logger);
+    const icon = isError ? '❌' : '⚠️';
+    for (const [label, files] of Object.entries(bucket)) {
+        emit(`[Sensitive Files]: ${icon} ${label}:`);
+        files.forEach(f => emit(`    ${f}`));
+    }
+}
+/** Report categorized files and produce the check outcome. */
+function reportFiles(errors, warnings) {
+    const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
+    const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
+    if (totalErrors === 0 && totalWarnings === 0)
+        return (0, types_1.pass)();
+    logFiles(errors, true);
+    logFiles(warnings, false);
+    const parts = [];
+    if (totalErrors > 0)
+        parts.push(`${totalErrors} sensitive file(s) changed`);
+    if (totalWarnings > 0)
+        parts.push(`${totalWarnings} notable file(s) changed`);
+    return (0, types_1.warn)(parts.join(', '));
+}
 exports.sensitiveFileGuardCheck = {
     name: 'Sensitive Files',
     phase: 'informational',
@@ -60,40 +99,13 @@ exports.sensitiveFileGuardCheck = {
         return ctx.config.sensitiveFileGuard?.enabled !== false && Boolean(ctx.baseSha);
     },
     async run(ctx) {
-        var _a;
         try {
             const { stdout } = await (0, execa_1.execa)('git', ['diff', '--name-only', '--diff-filter=ACMRD', ctx.baseSha, 'HEAD'], { cwd: ctx.cwd });
             const changedFiles = stdout.split('\n').filter(Boolean);
             if (changedFiles.length === 0)
                 return (0, types_1.pass)();
-            const errors = {};
-            const warnings = {};
-            for (const filePath of changedFiles) {
-                for (const category of SENSITIVE_CATEGORIES) {
-                    if (category.patterns.some(p => p.test(filePath))) {
-                        const bucket = category.severity === 'error' ? errors : warnings;
-                        (bucket[_a = category.label] ?? (bucket[_a] = [])).push(filePath);
-                    }
-                }
-            }
-            const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
-            const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
-            if (totalErrors === 0 && totalWarnings === 0)
-                return (0, types_1.pass)();
-            for (const [label, files] of Object.entries(errors)) {
-                utils_1.logger.error(`[Sensitive Files]: ❌ ${label}:`);
-                files.forEach(f => utils_1.logger.error(`    ${f}`));
-            }
-            for (const [label, files] of Object.entries(warnings)) {
-                utils_1.logger.warn(`[Sensitive Files]: ⚠️ ${label}:`);
-                files.forEach(f => utils_1.logger.warn(`    ${f}`));
-            }
-            const parts = [];
-            if (totalErrors > 0)
-                parts.push(`${totalErrors} sensitive file(s) changed`);
-            if (totalWarnings > 0)
-                parts.push(`${totalWarnings} notable file(s) changed`);
-            return (0, types_1.warn)(parts.join(', '));
+            const { errors, warnings } = categorizeFiles(changedFiles);
+            return reportFiles(errors, warnings);
         }
         catch (err) {
             utils_1.logger.warn(`[Sensitive Files]: ⚠️ Could not check file changes\n${err}`);

package/dist/core/registry.js

@@ -7,27 +7,27 @@ const commitlint_1 = require("./checks/commitlint");
 const cpp_format_1 = require("./checks/cpp-format");
 const dead_code_1 = require("./checks/dead-code");
 const dependency_check_1 = require("./checks/dependency-check");
+const diff_security_1 = require("./checks/diff-security");
 const diff_smell_1 = require("./checks/diff-smell");
+const duplicate_check_1 = require("./checks/duplicate-check");
+const kotlin_lint_1 = require("./checks/kotlin-lint");
 const license_check_1 = require("./checks/license-check");
 const lint_1 = require("./checks/lint");
+const markdown_lint_1 = require("./checks/markdown-lint");
 const npm_audit_1 = require("./checks/npm-audit");
 // informational — warn/skip only, never fail the run
-const diff_security_1 = require("./checks/diff-security");
 const outdated_deps_1 = require("./checks/outdated-deps");
 const pr_body_1 = require("./checks/pr-body");
 const pr_size_check_1 = require("./checks/pr-size-check");
 const pr_title_lint_1 = require("./checks/pr-title-lint");
+const prettier_1 = require("./checks/prettier");
+const python_format_1 = require("./checks/python-format");
+const python_lint_1 = require("./checks/python-lint");
+const security_1 = require("./checks/security");
 const sensitive_file_guard_1 = require("./checks/sensitive-file-guard");
-const duplicate_check_1 = require("./checks/duplicate-check");
-const markdown_lint_1 = require("./checks/markdown-lint");
 const spellcheck_1 = require("./checks/spellcheck");
-const python_lint_1 = require("./checks/python-lint");
 const swift_lint_1 = require("./checks/swift-lint");
-const kotlin_lint_1 = require("./checks/kotlin-lint");
 // format — runs last, may write files
-const prettier_1 = require("./checks/prettier");
-const python_format_1 = require("./checks/python-format");
-const security_1 = require("./checks/security");
 const typecheck_1 = require("./checks/typecheck");
 /**
  * Every check, in declaration order. The orchestrator groups them by `phase`

package/dist/core/reporters.js

@@ -14,6 +14,8 @@ const STATUS_ICON = {
 };
 // Unique marker so we can find and update the comment on re-runs.
 const COMMENT_MARKER = '<!-- pr-checkmate-summary -->';
+const SUMMARY_BORDER = '═══════════════════════════════════════════════════════════════';
+const SUMMARY_RULE = '───────────────────────────────────────────────────────────────';
 function getPrContext() {
     const token = process.env.GITHUB_TOKEN;
     const repository = process.env.GITHUB_REPOSITORY;
@@ -57,16 +59,16 @@ function buildMarkdownReport(report) {
 function printStdout(report) {
     const { passed, warned, failed, skipped } = report.summary;
     utils_1.logger.info('');
-    utils_1.logger.info('═══════════════════════════════════════════════════════════════');
+    utils_1.logger.info(SUMMARY_BORDER);
     utils_1.logger.info('  PR CheckMate Summary');
-    utils_1.logger.info('═══════════════════════════════════════════════════════════════');
+    utils_1.logger.info(SUMMARY_BORDER);
     for (const r of report.results) {
         const details = r.details ? `: ${r.details}` : '';
         utils_1.logger.info(`  ${STATUS_ICON[r.status]}  ${r.name}${details}`);
     }
-    utils_1.logger.info('───────────────────────────────────────────────────────────────');
+    utils_1.logger.info(SUMMARY_RULE);
     utils_1.logger.info(`  ✅ ${passed} passed  ⚠️ ${warned} warnings  ❌ ${failed} failed  ⏭️ ${skipped} skipped`);
-    utils_1.logger.info('═══════════════════════════════════════════════════════════════');
+    utils_1.logger.info(SUMMARY_BORDER);
 }
 async function upsertGithubComment(body) {
     const ctx = getPrContext();

package/dist/init.js

@@ -59,105 +59,124 @@ const DEFAULT_CONFIG = {
     },
     documentation: config_1.documentation,
 };
-/**
- *
- */
-async function init() {
-    const root = process.cwd();
-    if (!fs_1.default.existsSync(exports.CONFIG_FILE)) {
-        const answers = await inquirer_1.default.prompt([
-            {
-                type: 'list',
-                name: 'sourcePath',
-                message: 'Where is your project source code?',
-                choices: ['src', 'app', 'Enter manually'],
-            },
-            {
-                type: 'input',
-                name: 'manualPath',
-                message: 'Enter path:',
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                when: (a) => a.sourcePath === 'Enter manually',
-                validate: (input) => input.trim().length > 0 || 'Cannot be empty',
-            },
-        ]);
-        const sourcePath = answers.sourcePath === 'Enter manually' ? answers.manualPath : answers.sourcePath;
+const MANUAL_ENTRY = 'Enter manually';
+/** Prompt the user for the project source path, allowing a manual entry. */
+async function promptSourcePath() {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'list',
+            name: 'sourcePath',
+            message: 'Where is your project source code?',
+            choices: ['src', 'app', MANUAL_ENTRY],
+        },
+        {
+            type: 'input',
+            name: 'manualPath',
+            message: 'Enter path:',
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            when: (a) => a.sourcePath === MANUAL_ENTRY,
+            validate: (input) => input.trim().length > 0 || 'Cannot be empty',
+        },
+    ]);
+    return answers.sourcePath === MANUAL_ENTRY ? answers.manualPath : answers.sourcePath;
+}
+/** Copy the bundled GitHub Actions workflow into the consumer repo. */
+function setupWorkflow(root) {
+    const workflowSource = path_1.default.join(__dirname, 'config', 'pr-checkmate-workflow.yml');
+    const workflowDir = path_1.default.join(root, '.github', 'workflows');
+    const workflowDest = path_1.default.join(workflowDir, 'pr-checkmate.yml');
+    if (!fs_1.default.existsSync(workflowSource)) {
+        utils_1.logger.warn('[init]: ⚠️ Workflow template not found, skipping workflow setup');
+        return;
+    }
+    if (!fs_1.default.existsSync(workflowDir)) {
+        fs_1.default.mkdirSync(workflowDir, { recursive: true });
+    }
+    fs_1.default.copyFileSync(workflowSource, workflowDest);
+    utils_1.logger.info('[init]: ✅ Created .github/workflows/pr-checkmate.yml');
+    utils_1.logger.info('[init]: GitHub Actions workflow is ready for your PRs!');
+}
+/** Create a tsconfig.json scaffold if the consumer repo lacks one. */
+function setupTsConfig(root, sourcePath) {
+    const tsconfigPath = path_1.default.join(root, 'tsconfig.json');
+    if (fs_1.default.existsSync(tsconfigPath))
+        return;
+    const newTsConfig = {
+        compilerOptions: {
+            target: 'ES2020',
+            module: 'NodeNext',
+            outDir: 'dist',
+            strict: true,
+            rootDir: sourcePath,
+            moduleResolution: 'NodeNext',
+            esModuleInterop: true,
+            resolveJsonModule: true,
+            forceConsistentCasingInFileNames: true,
+            skipLibCheck: true,
+            types: ['node'],
+        },
+        include: [`${sourcePath}/**/*.ts`],
+        exclude: ['node_modules', 'dist'],
+    };
+    fs_1.default.writeFileSync(tsconfigPath, JSON.stringify(newTsConfig, null, 2));
+    utils_1.logger.info('[init]: ✅ Created tsconfig.json using your sourcePath');
+}
+/** First-run setup: prompt, write config, and scaffold workflow + tsconfig. */
+async function createConfig(root) {
+    const sourcePath = await promptSourcePath();
+    const languages = await (0, utils_1.detectLanguages)(root);
+    utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
+    const config = {
+        ...DEFAULT_CONFIG,
+        sourcePath,
+        languages,
+    };
+    fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(config, null, 2));
+    utils_1.logger.info(`[init]: ✅ Created pr-checkmate.json with sourcePath: ${sourcePath}`);
+    utils_1.logger.info(`[init]: 💡 You can now customize ESLint rules, Prettier settings,
+      and cspell words in pr-checkmate.json`);
+    setupWorkflow(root);
+    setupTsConfig(root, sourcePath);
+}
+/** Re-run setup: merge the existing config with current defaults. */
+async function updateConfig(root) {
+    utils_1.logger.info('[init]: pr-checkmate.json already exists — updating it.');
+    try {
+        const raw = fs_1.default.readFileSync(exports.CONFIG_FILE, 'utf-8');
+        const json = JSON.parse(raw);
         const languages = await (0, utils_1.detectLanguages)(root);
         utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
-        const config = {
+        // Merge with defaults to add new fields
+        const updated = {
             ...DEFAULT_CONFIG,
-            sourcePath,
+            ...json,
+            // Refresh detected languages on every init so new source dirs are picked up
             languages,
+            eslint: { ...DEFAULT_CONFIG.eslint, ...(json.eslint || {}) },
+            prettier: { ...DEFAULT_CONFIG.prettier, ...(json.prettier || {}) },
+            cspell: { ...DEFAULT_CONFIG.cspell, ...(json.cspell || {}) },
+            typecheck: { ...DEFAULT_CONFIG.typecheck, ...(json.typecheck || {}) },
+            diffSmell: { ...DEFAULT_CONFIG.diffSmell, ...(json.diffSmell || {}) },
+            prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
+            duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
         };
-        fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(config, null, 2));
-        utils_1.logger.info(`[init]: ✅ Created pr-checkmate.json with sourcePath: ${sourcePath}`);
-        utils_1.logger.info(`[init]: 💡 You can now customize ESLint rules, Prettier settings,
-      and cspell words in pr-checkmate.json`);
-        // Copy workflow file to .github/workflows/
-        const workflowSource = path_1.default.join(__dirname, 'config', 'pr-checkmate-workflow.yml');
-        const workflowDir = path_1.default.join(root, '.github', 'workflows');
-        const workflowDest = path_1.default.join(workflowDir, 'pr-checkmate.yml');
-        if (fs_1.default.existsSync(workflowSource)) {
-            if (!fs_1.default.existsSync(workflowDir)) {
-                fs_1.default.mkdirSync(workflowDir, { recursive: true });
-            }
-            fs_1.default.copyFileSync(workflowSource, workflowDest);
-            utils_1.logger.info('[init]: ✅ Created .github/workflows/pr-checkmate.yml');
-            utils_1.logger.info('[init]: GitHub Actions workflow is ready for your PRs!');
-        }
-        else {
-            utils_1.logger.warn('[init]: ⚠️ Workflow template not found, skipping workflow setup');
-        }
-        const tsconfigPath = path_1.default.join(root, 'tsconfig.json');
-        if (!fs_1.default.existsSync(tsconfigPath)) {
-            const newTsConfig = {
-                compilerOptions: {
-                    target: 'ES2020',
-                    module: 'NodeNext',
-                    outDir: 'dist',
-                    strict: true,
-                    rootDir: sourcePath,
-                    moduleResolution: 'NodeNext',
-                    esModuleInterop: true,
-                    resolveJsonModule: true,
-                    forceConsistentCasingInFileNames: true,
-                    skipLibCheck: true,
-                    types: ['node'],
-                },
-                include: [`${sourcePath}/**/*.ts`],
-                exclude: ['node_modules', 'dist'],
-            };
-            fs_1.default.writeFileSync(tsconfigPath, JSON.stringify(newTsConfig, null, 2));
-            utils_1.logger.info('[init]: ✅ Created tsconfig.json using your sourcePath');
-        }
+        fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(updated, null, 2));
+        utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');
+        utils_1.logger.info('[init]: 💡 You can now add custom ESLint rules, cspell words, and more!');
+    }
+    catch (e) {
+        utils_1.logger.error(`[init]: ❌ Failed to update pr-checkmate.json: ${e}`);
+    }
+}
+/**
+ * Initialize (or refresh) pr-checkmate configuration in the current project.
+ */
+async function init() {
+    const root = process.cwd();
+    if (fs_1.default.existsSync(exports.CONFIG_FILE)) {
+        await updateConfig(root);
     }
     else {
-        utils_1.logger.info('[init]: pr-checkmate.json already exists — updating it.');
-        try {
-            const raw = fs_1.default.readFileSync(exports.CONFIG_FILE, 'utf-8');
-            const json = JSON.parse(raw);
-            const languages = await (0, utils_1.detectLanguages)(root);
-            utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
-            // Merge with defaults to add new fields
-            const updated = {
-                ...DEFAULT_CONFIG,
-                ...json,
-                // Refresh detected languages on every init so new source dirs are picked up
-                languages,
-                eslint: { ...DEFAULT_CONFIG.eslint, ...(json.eslint || {}) },
-                prettier: { ...DEFAULT_CONFIG.prettier, ...(json.prettier || {}) },
-                cspell: { ...DEFAULT_CONFIG.cspell, ...(json.cspell || {}) },
-                typecheck: { ...DEFAULT_CONFIG.typecheck, ...(json.typecheck || {}) },
-                diffSmell: { ...DEFAULT_CONFIG.diffSmell, ...(json.diffSmell || {}) },
-                prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
-                duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
-            };
-            fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(updated, null, 2));
-            utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');
-            utils_1.logger.info('[init]: 💡 You can now add custom ESLint rules, cspell words, and more!');
-        }
-        catch (e) {
-            utils_1.logger.error(`[init]: ❌ Failed to update pr-checkmate.json: ${e}`);
-        }
+        await createConfig(root);
     }
 }

package/dist/utils/index.js

@@ -24,6 +24,7 @@ __exportStar(require("./logger"), exports);
 __exportStar(require("./delta"), exports);
 __exportStar(require("./result-collector"), exports);
 __exportStar(require("./resolve-bin"), exports);
+__exportStar(require("./own-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 /**
  *

package/dist/utils/own-deps.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOwnDependencyClosure = getOwnDependencyClosure;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const OWN_PACKAGE_NAME = 'pr-checkmate';
+const PACKAGE_JSON = 'package.json';
+let cachedClosure;
+/** Read a package.json's `dependencies` keys, tolerating missing/broken files. */
+function readDependencyNames(pkgDir) {
+    try {
+        const pkg = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(pkgDir, PACKAGE_JSON), 'utf-8'));
+        return Object.keys(pkg.dependencies ?? {});
+    }
+    catch {
+        return [];
+    }
+}
+/** Walk up from this module until we find pr-checkmate's own package root. */
+function findOwnPackageRoot() {
+    let dir = __dirname;
+    while (dir !== node_path_1.default.dirname(dir)) {
+        const pkgJsonPath = node_path_1.default.join(dir, PACKAGE_JSON);
+        if (node_fs_1.default.existsSync(pkgJsonPath)) {
+            try {
+                const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
+                if (pkg.name === OWN_PACKAGE_NAME)
+                    return dir;
+            }
+            catch { }
+        }
+        dir = node_path_1.default.dirname(dir);
+    }
+    return null;
+}
+/**
+ * Resolve a dependency's install directory by name, starting the search from
+ * `fromDir`. Relies on Node's upward node_modules walk so hoisted packages are
+ * found regardless of physical layout.
+ */
+function resolvePackageDir(name, fromDir) {
+    // Prefer the explicit package.json subpath.
+    try {
+        return node_path_1.default.dirname(require.resolve(`${name}/package.json`, { paths: [fromDir] }));
+    }
+    catch { }
+    // Fallback for packages whose exports map hides ./package.json: resolve the
+    // entry point and walk up to the package's own root.
+    try {
+        let dir = node_path_1.default.dirname(require.resolve(name, { paths: [fromDir] }));
+        while (dir !== node_path_1.default.dirname(dir)) {
+            const pkgJsonPath = node_path_1.default.join(dir, PACKAGE_JSON);
+            if (node_fs_1.default.existsSync(pkgJsonPath)) {
+                try {
+                    const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
+                    if (pkg.name === name)
+                        return dir;
+                }
+                catch { }
+            }
+            dir = node_path_1.default.dirname(dir);
+        }
+    }
+    catch { }
+    return null;
+}
+/**
+ * Compute the full set of package names in pr-checkmate's own dependency
+ * closure (direct + transitive runtime dependencies), plus pr-checkmate itself.
+ *
+ * pr-checkmate installs into the consumer's node_modules, so its own runtime
+ * deps (eslint plugins, cspell dictionaries, …) become part of the consumer's
+ * production dependency tree. Some carry copyleft licenses that would otherwise
+ * trip pr-checkmate's own license check against an innocent client. These are
+ * pr-checkmate's dependencies, not the client's, so they must be exempt.
+ *
+ * Result is cached for the process. Returns a set containing only pr-checkmate
+ * itself if the package root cannot be located (defensive; never throws).
+ */
+function getOwnDependencyClosure() {
+    if (cachedClosure)
+        return cachedClosure;
+    const closure = new Set([OWN_PACKAGE_NAME]);
+    const root = findOwnPackageRoot();
+    if (!root) {
+        cachedClosure = closure;
+        return closure;
+    }
+    // BFS over the dependency graph, resolving each package relative to the parent
+    // that declared it so nested (non-hoisted) installs resolve correctly.
+    const queue = readDependencyNames(root).map(name => ({
+        name,
+        fromDir: root,
+    }));
+    while (queue.length > 0) {
+        const { name, fromDir } = queue.shift();
+        if (closure.has(name))
+            continue;
+        closure.add(name);
+        const depDir = resolvePackageDir(name, fromDir);
+        if (!depDir)
+            continue;
+        for (const child of readDependencyNames(depDir)) {
+            if (!closure.has(child))
+                queue.push({ name: child, fromDir: depDir });
+        }
+    }
+    cachedClosure = closure;
+    return closure;
+}

package/dist/utils/resolve-bin.js

@@ -14,6 +14,9 @@ const node_path_1 = __importDefault(require("node:path"));
  * 2. Via package.json — for packages that export ./package.json but not the bin subpath (e.g. eslint)
  * 3. Walk up from main entry — for packages that export neither (e.g. cspell)
  *
+ * @param pkgName - The package whose binary to resolve (e.g. `eslint`).
+ * @param binRelPath - The bin path relative to the package root (e.g. `bin/eslint.js`).
+ * @param options - Resolution options.
  * @param options.paths - Directories to resolve from (passed to `require.resolve`).
  *   Use `[process.cwd()]` to prefer the consumer project's copy of the package.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.21.15",
+    "version": "1.21.16",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -71,7 +71,7 @@
         "@typescript-eslint/eslint-plugin": "^8.47.0",
         "@typescript-eslint/parser": "^8.47.0",
         "@wasm-fmt/clang-format": "^22.1.8",
-        "cspell": "^9.3.2",
+        "cspell": "^10.0.1",
         "depcheck": "^1.4.7",
         "eslint": "^9.26.0",
         "eslint-config-prettier": "^10.1.8",
@@ -81,8 +81,8 @@
         "eslint-plugin-sonarjs": "^4.1.0",
         "execa": "^9.6.0",
         "gitleaks-secret-scanner-fixed": "^2.1.3",
-        "inquirer": "^13.0.1",
-        "jscpd": "^3.5.10",
+        "inquirer": "^14.0.2",
+        "jscpd": "^5.0.11",
         "license-checker": "^25.0.1",
         "markdownlint-cli2": "^0.23.0",
         "prettier": ">=3.0.0",

package/src/config/cspell.json

@@ -189,6 +189,16 @@
     "sultansadikov",
     "telaviv",
     "travis",
+    "kotlin",
+    "Werror",
+    "positiving",
+    "pyflakes",
+    "pycodestyle",
+    "swiftlint",
+    "pathspec",
+    "Pipfile",
+    "conanfile",
+    "ktlint",
     "Términos",
     "Teudat",
     "Tiempo",
@@ -543,7 +553,145 @@
     "Makefiles",
     "dpdm",
     "commitlintrc",
-    "shortstat"
+    "shortstat",
+    "Cooldown",
+    "SCRIPTERROR",
+    "attendace",
+    "attendance",
+    "kupat",
+    "gemel",
+    "hishtalmut",
+    "keren",
+    "tofes",
+    "Bdikat",
+    "Hishuv",
+    "formcontrolname",
+    "zrufot",
+    "Klali",
+    "contenteditable",
+    "האניקומב",
+    "ishur",
+    "Yeshut",
+    "Nihul",
+    "pratim",
+    "nispahim",
+    "networkidle",
+    "domcontentloaded",
+    "secapp",
+    "taxinfo",
+    "gmishurim",
+    "ezor",
+    "ishi",
+    "ishurim",
+    "nikui",
+    "mekabel",
+    "shdochshana",
+    "gershayim",
+    "Rashum",
+    "Shem",
+    "Mishpaha",
+    "Rshum",
+    "Prati",
+    "Ktovet",
+    "Doar",
+    "Megurim",
+    "ddlkidomet",
+    "Aher",
+    "Esek",
+    "Isuk",
+    "Mazav",
+    "Mish",
+    "Beyachad",
+    "Shlichat",
+    "Neezarti",
+    "Doch",
+    "Klalim",
+    "Hehzer",
+    "Ozer",
+    "נייע",
+    "recognised",
+    "קולומייץ",
+    "אירינה",
+    "סרגיי",
+    "פולישוק",
+    "ולדימיר",
+    "moov",
+    "virtualenv",
+    "pytesseract",
+    "qrdet",
+    "Jsons",
+    "easyocr",
+    "EXIF",
+    "fliplr",
+    "noautorotate",
+    "timestep",
+    "VAQH",
+    "DSBL",
+    "MAXU",
+    "XCUI",
+    "Apks",
+    "bootstatus",
+    "BEGINSWITH",
+    "anypassword",
+    "wrongpassword",
+    "xmark",
+    "didnt",
+    "Anthropic",
+    "bartowski",
+    "specialisation",
+    "cursorrules",
+    "deepseek",
+    "GGUF",
+    "hf",
+    "llm",
+    "machdep",
+    "migrat",
+    "modelcontextprotocol",
+    "mxbai",
+    "noheader",
+    "codedb",
+    "nomic",
+    "nounits",
+    "nvidia",
+    "ollama",
+    "qwen",
+    "shellcheck",
+    "standards",
+    "vram",
+    "ATATT",
+    "ATSTT",
+    "AUTOINCREMENT",
+    "BEAGENT",
+    "CEREBRAS",
+    "cpucore",
+    "Fingerprinter",
+    "FREELLM",
+    "ircular",
+    "integrat",
+    "LOOKBACK",
+    "markitdown",
+    "memswap",
+    "nknown",
+    "processlist",
+    "unixepoch",
+    "unreviewed",
+    "xapp",
+    "bpoa",
+    "installroot",
+    "dedups",
+    "behaviourally",
+    "normalised",
+    "раннера",
+    "раннере",
+    "пайплайн",
+    "dind",
+    "dlib",
+    "pugixml",
+    "opencvcommit",
+    "litert",
+    "SHTPB",
+    "FUTX",
+    "subdirs"
   ],
   "ignorePaths": [
     "**/node_modules/**",