pr-checkmate 2.1.0 → 3.0.0

package/dist/core/checks/languages/go-format.js

@@ -1,16 +1,146 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.goFormatCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
 const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const tool_install_1 = require("../tool-install");
+const external_runner_1 = require("./external-runner");
 const GO_GLOBS = ['*.go'];
 /**
- * Formats changed Go files with `gofmt`. Runner-dependency (needs `gofmt` on the
- * runner), gracefully skipping when absent. Read-only in check mode (`gofmt -l`
- * lists files that differ from gofmt output); rewrites in place with `gofmt -w`
- * when `write`, so CI can auto-commit — mirrors the Prettier/C++/Ruff format checks.
+ * Load the bundled WASM gofmt, or explain why it could not be loaded.
+ *
+ * This is what stopped `⏭️ Go Format: gofmt not installed` from being the answer
+ * on every runner without a Go toolchain — a ~285 KB WASM build of gofmt does
+ * the same job with nothing to install, the same way Ruff covers Python and
+ * clang-format covers C++.
+ *
+ * Three details, each of which was a way to get this wrong:
+ *
+ * - **Resolved through `resolvePackageBin`, not a bare specifier.** The package
+ *   may live in a fetched profile directory rather than in our own tree, and only
+ *   the resolver knows about those. A bare `import('@wasm-fmt/gofmt')` resolves
+ *   relative to this file and would miss it.
+ * - **`gofmt_node.js` explicitly**, because the package's `exports` map routes
+ *   `.` per runtime and the node entry is the one that reads the `.wasm` off disk.
+ * - **A dynamic `import()`.** The package is ESM and we emit CommonJS;
+ *   `require` cannot load it, and TypeScript preserves dynamic `import()` in CJS
+ *   output under `module: NodeNext` precisely so this works.
+ */
+async function loadBundledGofmt() {
+    try {
+        const entry = (0, utils_1.resolvePackageBin)('@wasm-fmt/gofmt', 'gofmt_node.js');
+        const mod = (await import((0, node_url_1.pathToFileURL)(entry).href));
+        return mod.format;
+    }
+    catch (err) {
+        utils_1.logger.warn(`[Go Format]: ⚠️ bundled gofmt could not be loaded\n${err}`);
+        return null;
+    }
+}
+/**
+ * The verdict, given the files that turned out to need formatting.
+ *
+ * Shared by both routes on purpose. It was written out twice — once after
+ * `gofmt -l` and once after the in-memory comparison — and the two copies are how
+ * the wording of a verdict comes to depend on whether Go happens to be installed
+ * on the runner (ticket 079). What a client is told about their code must not be a
+ * function of our own resolution order.
+ *
+ * Called only once the rewriting, if any, is done — so reaching the last branch
+ * means the files really were rewritten and CI has something to commit. The
+ * routes differ in when that happens (the system route shells out to `gofmt -w`,
+ * the bundled one wrote each file as it went) and in nothing this function can
+ * see.
+ */
+function verdictFor(ctx, unformatted) {
+    if (unformatted.length === 0)
+        return (0, types_1.pass)();
+    if (!ctx.write) {
+        utils_1.logger.warn(`[Go Format]: ⚠️ ${unformatted.length} Go file(s) need formatting`);
+        unformatted.slice(0, 10).forEach(file => utils_1.logger.warn(`  ${file}`));
+        return (0, types_1.warn)(`${unformatted.length} file(s) need formatting (run with write to fix)`);
+    }
+    utils_1.logger.info(`[Go Format]: ✅ Reformatted ${unformatted.length} Go file(s)`);
+    return (0, types_1.pass)(`reformatted ${unformatted.length} file(s)`);
+}
+/**
+ * Format with the runner's own `gofmt`, when it has one.
+ *
+ * Tried ahead of the bundled copy on purpose, and it is the same policy as
+ * preferring a repo's `.clang-format` or its own ESLint: gofmt's output is a
+ * function of the Go release, and the one release we know a repository agrees
+ * with is the one installed beside it. Reaching for ours first would mean
+ * rewriting a Go 1.18 tree by current rules in `write` mode — us and their CI
+ * reformatting the same files in opposite directions.
+ *
+ * @returns The outcome, or `null` when there is no system `gofmt` to ask.
+ */
+async function formatWithSystemGofmt(ctx, targets) {
+    const list = await (0, external_runner_1.runTool)(ctx, 'gofmt', ['-l', ...targets]);
+    if (list.missing)
+        return null;
+    const unformatted = list.stdout.split('\n').filter(Boolean);
+    // Decided before the rewrite, so a read-only run answers without `gofmt -w`
+    // having been considered at all.
+    if (unformatted.length === 0 || !ctx.write)
+        return verdictFor(ctx, unformatted);
+    const fix = await (0, external_runner_1.runTool)(ctx, 'gofmt', ['-w', ...unformatted]);
+    if (fix.missing || fix.exitCode !== 0) {
+        utils_1.logger.warn(`[Go Format]: ⚠️ gofmt -w failed\n${fix.missing ? '' : fix.stderr}`);
+        return (0, types_1.warn)('gofmt failed to rewrite files');
+    }
+    return verdictFor(ctx, unformatted);
+}
+/**
+ * Format in-process with the bundled WASM gofmt — the route taken on a runner
+ * with no Go toolchain, which is most of them.
+ *
+ * Compares rather than trusting an exit code, because the WASM build is a
+ * library and not a CLI: it formats a string and says nothing about whether it
+ * changed anything. Mirrors the Ruff format check for that reason.
+ */
+function formatWithBundledGofmt(ctx, targets, format) {
+    const unformatted = [];
+    for (const rel of targets) {
+        const abs = node_path_1.default.join(ctx.cwd, rel);
+        let content;
+        try {
+            content = node_fs_1.default.readFileSync(abs, 'utf-8');
+        }
+        catch {
+            continue; // renamed or removed between the diff and the read
+        }
+        let formatted;
+        try {
+            formatted = format(content);
+        }
+        catch (err) {
+            // gofmt parses before it formats, so a throw here is a syntax error. That
+            // is Go Vet's finding to report, not a formatting verdict — and calling it
+            // one sends people looking for a style problem that does not exist.
+            utils_1.logger.warn(`[Go Format]: ⚠️ could not parse ${rel} (syntax error?)\n${err}`);
+            continue;
+        }
+        if (formatted === content)
+            continue;
+        unformatted.push(rel);
+        if (ctx.write)
+            node_fs_1.default.writeFileSync(abs, formatted);
+    }
+    return verdictFor(ctx, unformatted);
+}
+/**
+ * Formats changed Go files with gofmt — the runner's own when it has one, and a
+ * bundled WASM build otherwise, so the check has no runner dependency at all.
+ * Read-only in check mode; rewrites in place when `write`, so CI can auto-commit
+ * — mirrors the Prettier/C++/Ruff format checks.
  */
 exports.goFormatCheck = {
     name: 'Go Format',
@@ -19,30 +149,21 @@ exports.goFormatCheck = {
         return ctx.config.go?.enabled !== false && ctx.languages.includes('go');
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveTargetFiles)(ctx, GO_GLOBS);
-        if (targets === null)
-            return (0, types_1.skip)('git unavailable');
-        if (targets.length === 0)
-            return (0, types_1.pass)('no Go files changed');
-        const list = await (0, execa_1.execa)('gofmt', ['-l', ...targets], { cwd: ctx.cwd, reject: false });
-        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'` when
-        // the binary is absent — detect the missing toolchain on the result.
-        if (list.code === 'ENOENT')
-            return (0, types_1.skip)('gofmt not installed');
-        const unformatted = list.stdout.split('\n').filter(Boolean);
-        if (unformatted.length === 0)
-            return (0, types_1.pass)();
-        if (!ctx.write) {
-            utils_1.logger.warn(`[Go Format]: ⚠️ ${unformatted.length} Go file(s) need formatting`);
-            unformatted.slice(0, 10).forEach(f => utils_1.logger.warn(`  ${f}`));
-            return (0, types_1.warn)(`${unformatted.length} file(s) need formatting (run with write to fix)`);
-        }
-        const fix = await (0, execa_1.execa)('gofmt', ['-w', ...unformatted], { cwd: ctx.cwd, reject: false });
-        if (fix.exitCode !== 0) {
-            utils_1.logger.warn(`[Go Format]: ⚠️ gofmt -w failed\n${fix.stderr}`);
-            return (0, types_1.warn)('gofmt failed to rewrite files');
-        }
-        utils_1.logger.info(`[Go Format]: ✅ Reformatted ${unformatted.length} Go file(s)`);
-        return (0, types_1.pass)(`reformatted ${unformatted.length} file(s)`);
+        const targets = await (0, targets_1.resolveTargets)(ctx, GO_GLOBS, {
+            onEmpty: { pass: 'no Go files changed' },
+        });
+        if (!Array.isArray(targets))
+            return targets;
+        const viaSystem = await formatWithSystemGofmt(ctx, targets);
+        if (viaSystem)
+            return viaSystem;
+        const format = await loadBundledGofmt();
+        // Neither route: no Go toolchain on the runner AND our own copy could not be
+        // loaded, which means a partial install of this package. Installing Go is
+        // the fix a client can actually act on.
+        if (!format)
+            return (0, tool_install_1.notInstalled)('gofmt', 'gofmt');
+        utils_1.logger.debug('[Go Format]: no system gofmt — using the bundled WASM formatter');
+        return formatWithBundledGofmt(ctx, targets, format);
     },
 };

package/dist/core/checks/languages/lint.js

@@ -4,20 +4,23 @@ exports.lintCheck = void 0;
 const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const reuse_1 = require("../../install/reuse");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 /**
- * Resolve the ESLint binary, preferring the consumer project's own copy so a
- * repo pinned to ESLint 8 (+ legacy `.eslintrc.*`) keeps working. Falls back to
- * the version bundled with pr-checkmate when the project has no local install.
+ * Resolve the ESLint binary under the client's `install.reuseLocal` policy.
+ *
+ * A repo pinned to ESLint 8 with a legacy `.eslintrc.*` must run ITS ESLint —
+ * ours does not read eslintrc — so when the client owns the config the version is
+ * not asked about. When the config is the flat one WE generate, it is: ESLint 8
+ * cannot read it, and reusing their copy there produced a failure about our
+ * configuration rather than about their code. That asymmetry is the whole reason
+ * `clientOwnsConfig` exists (ticket 064, lever A).
  */
-function resolveESLintBin(cwd) {
-    try {
-        return (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js', { paths: [cwd] });
-    }
-    catch {
-        return (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js');
-    }
+function resolveESLintBin(ctx, clientOwnsConfig) {
+    return (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js', {
+        paths: (0, reuse_1.clientToolPaths)('eslint', ctx, { clientOwnsConfig }),
+    });
 }
 async function getESLintMajorVersion(eslintBin) {
     try {
@@ -36,19 +39,16 @@ exports.lintCheck = {
         return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
     },
     async run(ctx) {
-        const eslintBin = resolveESLintBin(ctx.cwd);
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.pass)('no TypeScript/JavaScript files to lint');
-        const hasLocal = (0, config_1.hasLocalConfig)([
-            'eslint.config.mjs',
-            'eslint.config.js',
-            '.eslintrc.js',
-            '.eslintrc.json',
-            '.eslintrc',
-        ]);
+        // Whose config decides whose binary, so this is read BEFORE resolving one.
+        // It used to be the other way round, which is how a client's ESLint 8 ended
+        // up pointed at the flat config we generate.
+        const hasLocal = (0, config_1.hasLocalConfig)(['eslint.config.mjs', 'eslint.config.js', '.eslintrc.js', '.eslintrc.json', '.eslintrc'], ctx.cwd);
+        const eslintBin = resolveESLintBin(ctx, hasLocal);
         const version = await getESLintMajorVersion(eslintBin);
         const args = [...targets];
         // `--ext` is an eslintrc-only flag. Under flat config (ESLint 9+) it is

package/dist/core/checks/languages/prettier.js

@@ -42,7 +42,7 @@ exports.prettierCheck = {
         return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.json', '*.md'], (0, config_1.getSourcePaths)());
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.json', '*.md'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
@@ -57,12 +57,7 @@ exports.prettierCheck = {
             ignorePath = gitignore;
         else
             ignorePath = tempIgnore = createTempIgnoreFile(ctx.cwd);
-        const hasLocal = (0, config_1.hasLocalConfig)([
-            '.prettierrc',
-            '.prettierrc.json',
-            '.prettierrc.js',
-            'prettier.config.js',
-        ]);
+        const hasLocal = (0, config_1.hasLocalConfig)(['.prettierrc', '.prettierrc.json', '.prettierrc.js', 'prettier.config.js'], ctx.cwd);
         // write=true → format in place; write=false → report-only (`--check`, never mutates files).
         const mode = ctx.write ? '--write' : '--check';
         let tempConfig = null;

package/dist/core/checks/languages/python-typecheck.d.ts

@@ -1,9 +1,14 @@
 import { Check } from '../../types';
 /**
- * Type-checks changed Python files — the Python analogue of the TypeScript
- * `tsc --noEmit` check. Runner-dependency (needs mypy or pyright on the runner),
- * gracefully skipping when neither is present. Informational by design (like
- * Ruff lint) so teams can adopt gradually; force a checker with
- * `python.typeChecker`, else mypy is tried first, then pyright.
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
  */
 export declare const pythonTypecheckCheck: Check;

package/dist/core/checks/languages/python-typecheck.js

@@ -1,27 +1,154 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pythonTypecheckCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const tool_install_1 = require("../tool-install");
+const external_runner_1 = require("./external-runner");
 const ruff_shared_1 = require("./ruff-shared");
-/** Run a type checker over the target files, or return null if the binary is absent. */
-async function runChecker(ctx, bin, targets) {
-    const result = await (0, execa_1.execa)(bin, targets, { cwd: ctx.cwd, reject: false });
-    if (result.code === 'ENOENT')
+/** How many diagnostics reach the log before the rest are counted instead. */
+const MAX_LOGGED = 10;
+/** The check's display name — the log prefix, and the row in the report. */
+const NAME = 'Python Types';
+/**
+ * Diagnostics that mean pyright could not see the repository's dependencies.
+ *
+ * Their presence is a verdict about the *setup*, not about the code, and the
+ * first attempt at this got it backwards: it dropped these two rules and
+ * reported everything else. That removes the cause and keeps the consequences,
+ * which is worse than either extreme — on a real client repository (ticket 076)
+ * it produced fifteen confident "type errors" of which nine were one cascade:
+ *
+ * ```python
+ * @click.group()
+ * def main() -> None: ...
+ *
+ * @main.command("list-jobs")     # nine of these
+ * def list_jobs() -> None: ...
+ * ```
+ *
+ * With `click` absent, pyright sees `main` as a plain `FunctionType` and every
+ * `@main.command(...)` becomes an error. Pyright is answering correctly; the
+ * question is wrong. The same shape follows from typer, flask, celery and pytest
+ * fixtures — most Python projects, in any CI job that does not install first.
+ *
+ * So an unresolved import means we cannot type-check at all, and the honest
+ * answer is a skip that says so. That is exactly what the TypeScript check does
+ * with a missing `node_modules`, in the same words.
+ */
+const UNRESOLVED_IMPORT_RULES = new Set(['reportMissingImports', 'reportMissingModuleSource']);
+/** How many unresolved module names the skip message names before stopping. */
+const NAMED_IMPORTS = 3;
+/** The module a `reportMissingImports` diagnostic is about, for the skip message. */
+function unresolvedModule(message) {
+    return /"([^"]+)"/.exec(message)?.[1] ?? null;
+}
+/** Whether the repository configures pyright itself. */
+function hasOwnPyrightConfig(cwd) {
+    if (node_fs_1.default.existsSync(node_path_1.default.join(cwd, 'pyrightconfig.json')))
+        return true;
+    try {
+        return node_fs_1.default.readFileSync(node_path_1.default.join(cwd, 'pyproject.toml'), 'utf-8').includes('[tool.pyright]');
+    }
+    catch {
+        return false;
+    }
+}
+/** Where our copy of pyright lives — bundled, or in a fetched profile. */
+function resolvePyright() {
+    try {
+        return (0, utils_1.resolvePackageBin)('pyright', 'index.js');
+    }
+    catch {
         return null;
-    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    }
+}
+/** Read mypy's text output: one diagnostic per line, with its own final count. */
+function reportMypy(output) {
+    const lines = output.split('\n').filter(line => /\berror\b|\bwarning\b/i.test(line));
+    if (lines.length === 0)
+        return (0, types_1.pass)();
+    // "Found 3 errors in 1 file (checked 12 source files)" — mypy's own count says
+    // more than a tally of lines that merely contained the word.
+    const summary = lines.find(line => /found\s+\d+\s+error/i.test(line))?.trim();
+    (0, findings_1.logSample)(NAME, 'type issues (mypy):', lines);
+    return (0, types_1.warn)(summary ?? `${lines.length} type issue(s)`);
 }
 /**
- * Type-checks changed Python files — the Python analogue of the TypeScript
- * `tsc --noEmit` check. Runner-dependency (needs mypy or pyright on the runner),
- * gracefully skipping when neither is present. Informational by design (like
- * Ruff lint) so teams can adopt gradually; force a checker with
- * `python.typeChecker`, else mypy is tried first, then pyright.
+ * Type-check with our own pyright, and report only what the client can act on.
+ *
+ * Pyright is a Node bundle, so it runs through `process.execPath` rather than as
+ * a binary on the path — the same reason clang-format does.
+ */
+function reportPyright(ctx, stdout) {
+    let report;
+    try {
+        report = JSON.parse(stdout);
+    }
+    catch {
+        // Pyright exits non-zero for a bad invocation too, and calling that a type
+        // error would put a finding in the report that is really our own bug.
+        utils_1.logger.warn(`[${NAME}]: ⚠️ pyright produced no readable report`);
+        return (0, types_1.skip)('pyright produced no readable report');
+    }
+    const diagnostics = (report.generalDiagnostics ?? []).filter(diagnostic => diagnostic.severity !== 'information');
+    // Nothing downstream of an unresolved import can be trusted, so this is
+    // checked before anything is reported — and skipped rather than filtered.
+    //
+    // Not applied to a repository that configures pyright itself: having written
+    // `pyrightconfig.json` (or a `[tool.pyright]` section) is having an opinion
+    // about import resolution — a `venvPath`, or these rules downgraded on
+    // purpose — and overriding it with a skip would ignore the one client who
+    // said what they wanted.
+    const unresolved = diagnostics.filter(diagnostic => UNRESOLVED_IMPORT_RULES.has(diagnostic.rule ?? ''));
+    if (unresolved.length > 0 && !hasOwnPyrightConfig(ctx.cwd)) {
+        const modules = [
+            ...new Set(unresolved
+                .map(diagnostic => unresolvedModule(diagnostic.message))
+                .filter((name) => Boolean(name))),
+        ];
+        const named = modules.slice(0, NAMED_IMPORTS).join(', ');
+        const rest = modules.length > NAMED_IMPORTS ? ` and ${modules.length - NAMED_IMPORTS} more` : '';
+        utils_1.logger.warn(`[${NAME}]: ⚠️ ${unresolved.length} import(s) could not be resolved — not type-checking`);
+        return (0, types_1.skip)(`project dependencies not installed (${named || `${unresolved.length} import(s)`}${rest}) ` +
+            '— run `pip install` before typecheck');
+    }
+    if (diagnostics.length === 0) {
+        utils_1.logger.info(`[${NAME}]: ✅ No type errors (pyright)`);
+        return (0, types_1.pass)();
+    }
+    const errors = diagnostics.filter(diagnostic => diagnostic.severity === 'error').length;
+    const summary = `${errors} error(s), ${diagnostics.length - errors} warning(s)`;
+    (0, findings_1.logSample)(NAME, `type issues (pyright): ${summary}`, diagnostics.slice(0, MAX_LOGGED).map(diagnostic => {
+        const rel = node_path_1.default.relative(ctx.cwd, diagnostic.file) || diagnostic.file;
+        // Pyright counts lines from zero; every other tool in the report counts
+        // from one, and a line number that is off by one is worse than none.
+        const line = (diagnostic.range?.start?.line ?? 0) + 1;
+        return `${rel}:${line} ${diagnostic.severity}: ${diagnostic.message.split('\n')[0]}`;
+    }));
+    return (0, types_1.warn)(summary);
+}
+/**
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
  */
 exports.pythonTypecheckCheck = {
-    name: 'Python Types',
+    name: NAME,
     phase: 'informational',
     applies(ctx) {
         return (ctx.config.python?.enabled !== false &&
@@ -35,32 +162,29 @@ exports.pythonTypecheckCheck = {
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
         const forced = ctx.config.python?.typeChecker;
-        const order = forced ? [forced] : ['mypy', 'pyright'];
-        let result = null;
-        let used = '';
-        for (const bin of order) {
-            result = await runChecker(ctx, bin, targets);
-            if (result) {
-                used = bin;
-                break;
+        if (forced !== 'pyright') {
+            const mypy = await (0, external_runner_1.runTool)(ctx, 'mypy', targets);
+            if (!mypy.missing) {
+                if (mypy.exitCode === 0) {
+                    utils_1.logger.info(`[${NAME}]: ✅ No type errors (mypy)`);
+                    return (0, types_1.pass)();
+                }
+                return reportMypy([mypy.stdout, mypy.stderr].filter(Boolean).join('\n'));
             }
+            // Asking for mypy by name and not having it is a configuration error the
+            // client meant to make visible; falling back to pyright would hide it.
+            if (forced === 'mypy')
+                return (0, tool_install_1.notInstalled)('mypy', 'mypy');
         }
-        if (!result)
-            return (0, types_1.skip)(`${forced ?? 'mypy/pyright'} not installed`);
-        if (result.exitCode === 0) {
-            utils_1.logger.info(`[Python Types]: ✅ No type errors (${used})`);
-            return (0, types_1.pass)();
-        }
-        const lines = [result.stdout, result.stderr]
-            .filter(Boolean)
-            .join('\n')
-            .split('\n')
-            .filter(l => /\berror\b|\bwarning\b/i.test(l));
-        utils_1.logger.warn(`[Python Types]: ⚠️ type issues (${used}):`);
-        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l}`));
-        if (lines.length > 10)
-            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
-        const summary = lines.find(l => /found\s+\d+\s+error/i.test(l)) ?? `${lines.length} type issue(s)`;
-        return (0, types_1.warn)(summary.trim());
+        const entry = resolvePyright();
+        if (!entry)
+            return (0, tool_install_1.notInstalled)('pyright', 'pyright');
+        const result = await (0, external_runner_1.runTool)(ctx, process.execPath, [entry, '--outputjson', ...targets]);
+        // The binary here is the Node running this process, so `missing` is not a
+        // reachable state — it is a case of the type, folded in rather than asserted
+        // away.
+        if (result.missing)
+            return (0, tool_install_1.notInstalled)('pyright', 'pyright');
+        return reportPyright(ctx, result.stdout);
     },
 };

package/dist/core/checks/languages/typecheck.js

@@ -8,18 +8,20 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const reuse_1 = require("../../install/reuse");
 const types_1 = require("../../types");
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
  * version it was written for; fall back to the compiler bundled with pr-checkmate.
  */
-function resolveTsc(cwd) {
-    try {
-        return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc', { paths: [cwd] });
-    }
-    catch {
-        return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc');
-    }
+function resolveTsc(ctx) {
+    // `clientOwnsConfig` unconditionally: this check does not apply without a
+    // `tsconfig.json` in the repository, so the compiler their config was written
+    // for is always theirs. `install.reuseLocal: "off"` still overrides, for a
+    // client who wants our pinned compiler for reproducibility.
+    return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc', {
+        paths: (0, reuse_1.clientToolPaths)('typescript', ctx, { clientOwnsConfig: true }),
+    });
 }
 exports.typecheckCheck = {
     name: 'TypeScript',
@@ -42,7 +44,7 @@ exports.typecheckCheck = {
         if (!node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'node_modules'))) {
             return (0, types_1.skip)('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
         }
-        const tscBin = resolveTsc(ctx.cwd);
+        const tscBin = resolveTsc(ctx);
         const result = await (0, execa_1.execa)(process.execPath, [tscBin, '--noEmit'], {
             cwd: ctx.cwd,
             reject: false,

package/dist/core/checks/pr/commitlint.js

@@ -60,8 +60,14 @@ exports.commitlintCheck = {
         return ctx.config.commitlint?.enabled !== false;
     },
     async run(ctx) {
+        // This check needs a commit to lint. Without a repository `--last` finds
+        // none, commitlint prints nothing and exits 0, and we reported `pass` — a
+        // verdict on a commit message that does not exist. Ticket 072: a check that
+        // examined nothing must not read as a check that found nothing.
+        if (!(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD')))
+            return (0, types_1.skip)('git unavailable');
         const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
-        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
+        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES, ctx.cwd);
         let tempConfigFile = null;
         // With no diff range (a full-repo review, or `--full`) the check still has a
         // meaningful subject: the newest commit message. `HEAD~1` cannot be assumed to

package/dist/core/checks/quality/case-collision.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.caseCollisionCheck = void 0;
-const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
@@ -18,9 +17,12 @@ exports.caseCollisionCheck = {
         return ctx.config.caseCollision?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
-        if (files.length === 0)
-            return (0, types_1.skip)('no tracked files');
+        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+            wholeTree: true,
+            onEmpty: { skip: 'no tracked files' },
+        });
+        if (!Array.isArray(files))
+            return files;
         const byLower = new Map();
         for (const f of files) {
             const key = f.toLowerCase();

package/dist/core/checks/quality/config-validation.d.ts

@@ -8,11 +8,4 @@ import { Check } from '../../types';
  * slip or two.
  */
 export declare function suggestName(input: string, candidates: string[]): string | null;
-/**
- * Validates pr-checkmate.json itself: unknown top-level keys (typos like
- * `mergeConfict` that silently do nothing), invalid values in `severity` and
- * `failOn`, and names in `severity` that match no check. Reads the raw file so it
- * checks what the user actually wrote, not the merged defaults. `//`-comment keys
- * and `$schema` are ignored.
- */
 export declare const configValidationCheck: Check;