pr-checkmate 2.1.2 → 3.0.0

package/dist/core/checks/languages/python-typecheck.js

@@ -1,27 +1,154 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pythonTypecheckCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const tool_install_1 = require("../tool-install");
+const external_runner_1 = require("./external-runner");
 const ruff_shared_1 = require("./ruff-shared");
-/** Run a type checker over the target files, or return null if the binary is absent. */
-async function runChecker(ctx, bin, targets) {
-    const result = await (0, execa_1.execa)(bin, targets, { cwd: ctx.cwd, reject: false });
-    if (result.code === 'ENOENT')
+/** How many diagnostics reach the log before the rest are counted instead. */
+const MAX_LOGGED = 10;
+/** The check's display name — the log prefix, and the row in the report. */
+const NAME = 'Python Types';
+/**
+ * Diagnostics that mean pyright could not see the repository's dependencies.
+ *
+ * Their presence is a verdict about the *setup*, not about the code, and the
+ * first attempt at this got it backwards: it dropped these two rules and
+ * reported everything else. That removes the cause and keeps the consequences,
+ * which is worse than either extreme — on a real client repository (ticket 076)
+ * it produced fifteen confident "type errors" of which nine were one cascade:
+ *
+ * ```python
+ * @click.group()
+ * def main() -> None: ...
+ *
+ * @main.command("list-jobs")     # nine of these
+ * def list_jobs() -> None: ...
+ * ```
+ *
+ * With `click` absent, pyright sees `main` as a plain `FunctionType` and every
+ * `@main.command(...)` becomes an error. Pyright is answering correctly; the
+ * question is wrong. The same shape follows from typer, flask, celery and pytest
+ * fixtures — most Python projects, in any CI job that does not install first.
+ *
+ * So an unresolved import means we cannot type-check at all, and the honest
+ * answer is a skip that says so. That is exactly what the TypeScript check does
+ * with a missing `node_modules`, in the same words.
+ */
+const UNRESOLVED_IMPORT_RULES = new Set(['reportMissingImports', 'reportMissingModuleSource']);
+/** How many unresolved module names the skip message names before stopping. */
+const NAMED_IMPORTS = 3;
+/** The module a `reportMissingImports` diagnostic is about, for the skip message. */
+function unresolvedModule(message) {
+    return /"([^"]+)"/.exec(message)?.[1] ?? null;
+}
+/** Whether the repository configures pyright itself. */
+function hasOwnPyrightConfig(cwd) {
+    if (node_fs_1.default.existsSync(node_path_1.default.join(cwd, 'pyrightconfig.json')))
+        return true;
+    try {
+        return node_fs_1.default.readFileSync(node_path_1.default.join(cwd, 'pyproject.toml'), 'utf-8').includes('[tool.pyright]');
+    }
+    catch {
+        return false;
+    }
+}
+/** Where our copy of pyright lives — bundled, or in a fetched profile. */
+function resolvePyright() {
+    try {
+        return (0, utils_1.resolvePackageBin)('pyright', 'index.js');
+    }
+    catch {
         return null;
-    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    }
+}
+/** Read mypy's text output: one diagnostic per line, with its own final count. */
+function reportMypy(output) {
+    const lines = output.split('\n').filter(line => /\berror\b|\bwarning\b/i.test(line));
+    if (lines.length === 0)
+        return (0, types_1.pass)();
+    // "Found 3 errors in 1 file (checked 12 source files)" — mypy's own count says
+    // more than a tally of lines that merely contained the word.
+    const summary = lines.find(line => /found\s+\d+\s+error/i.test(line))?.trim();
+    (0, findings_1.logSample)(NAME, 'type issues (mypy):', lines);
+    return (0, types_1.warn)(summary ?? `${lines.length} type issue(s)`);
 }
 /**
- * Type-checks changed Python files — the Python analogue of the TypeScript
- * `tsc --noEmit` check. Runner-dependency (needs mypy or pyright on the runner),
- * gracefully skipping when neither is present. Informational by design (like
- * Ruff lint) so teams can adopt gradually; force a checker with
- * `python.typeChecker`, else mypy is tried first, then pyright.
+ * Type-check with our own pyright, and report only what the client can act on.
+ *
+ * Pyright is a Node bundle, so it runs through `process.execPath` rather than as
+ * a binary on the path — the same reason clang-format does.
+ */
+function reportPyright(ctx, stdout) {
+    let report;
+    try {
+        report = JSON.parse(stdout);
+    }
+    catch {
+        // Pyright exits non-zero for a bad invocation too, and calling that a type
+        // error would put a finding in the report that is really our own bug.
+        utils_1.logger.warn(`[${NAME}]: ⚠️ pyright produced no readable report`);
+        return (0, types_1.skip)('pyright produced no readable report');
+    }
+    const diagnostics = (report.generalDiagnostics ?? []).filter(diagnostic => diagnostic.severity !== 'information');
+    // Nothing downstream of an unresolved import can be trusted, so this is
+    // checked before anything is reported — and skipped rather than filtered.
+    //
+    // Not applied to a repository that configures pyright itself: having written
+    // `pyrightconfig.json` (or a `[tool.pyright]` section) is having an opinion
+    // about import resolution — a `venvPath`, or these rules downgraded on
+    // purpose — and overriding it with a skip would ignore the one client who
+    // said what they wanted.
+    const unresolved = diagnostics.filter(diagnostic => UNRESOLVED_IMPORT_RULES.has(diagnostic.rule ?? ''));
+    if (unresolved.length > 0 && !hasOwnPyrightConfig(ctx.cwd)) {
+        const modules = [
+            ...new Set(unresolved
+                .map(diagnostic => unresolvedModule(diagnostic.message))
+                .filter((name) => Boolean(name))),
+        ];
+        const named = modules.slice(0, NAMED_IMPORTS).join(', ');
+        const rest = modules.length > NAMED_IMPORTS ? ` and ${modules.length - NAMED_IMPORTS} more` : '';
+        utils_1.logger.warn(`[${NAME}]: ⚠️ ${unresolved.length} import(s) could not be resolved — not type-checking`);
+        return (0, types_1.skip)(`project dependencies not installed (${named || `${unresolved.length} import(s)`}${rest}) ` +
+            '— run `pip install` before typecheck');
+    }
+    if (diagnostics.length === 0) {
+        utils_1.logger.info(`[${NAME}]: ✅ No type errors (pyright)`);
+        return (0, types_1.pass)();
+    }
+    const errors = diagnostics.filter(diagnostic => diagnostic.severity === 'error').length;
+    const summary = `${errors} error(s), ${diagnostics.length - errors} warning(s)`;
+    (0, findings_1.logSample)(NAME, `type issues (pyright): ${summary}`, diagnostics.slice(0, MAX_LOGGED).map(diagnostic => {
+        const rel = node_path_1.default.relative(ctx.cwd, diagnostic.file) || diagnostic.file;
+        // Pyright counts lines from zero; every other tool in the report counts
+        // from one, and a line number that is off by one is worse than none.
+        const line = (diagnostic.range?.start?.line ?? 0) + 1;
+        return `${rel}:${line} ${diagnostic.severity}: ${diagnostic.message.split('\n')[0]}`;
+    }));
+    return (0, types_1.warn)(summary);
+}
+/**
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
  */
 exports.pythonTypecheckCheck = {
-    name: 'Python Types',
+    name: NAME,
     phase: 'informational',
     applies(ctx) {
         return (ctx.config.python?.enabled !== false &&
@@ -35,32 +162,29 @@ exports.pythonTypecheckCheck = {
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
         const forced = ctx.config.python?.typeChecker;
-        const order = forced ? [forced] : ['mypy', 'pyright'];
-        let result = null;
-        let used = '';
-        for (const bin of order) {
-            result = await runChecker(ctx, bin, targets);
-            if (result) {
-                used = bin;
-                break;
+        if (forced !== 'pyright') {
+            const mypy = await (0, external_runner_1.runTool)(ctx, 'mypy', targets);
+            if (!mypy.missing) {
+                if (mypy.exitCode === 0) {
+                    utils_1.logger.info(`[${NAME}]: ✅ No type errors (mypy)`);
+                    return (0, types_1.pass)();
+                }
+                return reportMypy([mypy.stdout, mypy.stderr].filter(Boolean).join('\n'));
             }
+            // Asking for mypy by name and not having it is a configuration error the
+            // client meant to make visible; falling back to pyright would hide it.
+            if (forced === 'mypy')
+                return (0, tool_install_1.notInstalled)('mypy', 'mypy');
         }
-        if (!result)
-            return (0, types_1.skip)(`${forced ?? 'mypy/pyright'} not installed`);
-        if (result.exitCode === 0) {
-            utils_1.logger.info(`[Python Types]: ✅ No type errors (${used})`);
-            return (0, types_1.pass)();
-        }
-        const lines = [result.stdout, result.stderr]
-            .filter(Boolean)
-            .join('\n')
-            .split('\n')
-            .filter(l => /\berror\b|\bwarning\b/i.test(l));
-        utils_1.logger.warn(`[Python Types]: ⚠️ type issues (${used}):`);
-        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l}`));
-        if (lines.length > 10)
-            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
-        const summary = lines.find(l => /found\s+\d+\s+error/i.test(l)) ?? `${lines.length} type issue(s)`;
-        return (0, types_1.warn)(summary.trim());
+        const entry = resolvePyright();
+        if (!entry)
+            return (0, tool_install_1.notInstalled)('pyright', 'pyright');
+        const result = await (0, external_runner_1.runTool)(ctx, process.execPath, [entry, '--outputjson', ...targets]);
+        // The binary here is the Node running this process, so `missing` is not a
+        // reachable state — it is a case of the type, folded in rather than asserted
+        // away.
+        if (result.missing)
+            return (0, tool_install_1.notInstalled)('pyright', 'pyright');
+        return reportPyright(ctx, result.stdout);
     },
 };

package/dist/core/checks/languages/typecheck.js

@@ -8,18 +8,20 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const reuse_1 = require("../../install/reuse");
 const types_1 = require("../../types");
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
  * version it was written for; fall back to the compiler bundled with pr-checkmate.
  */
-function resolveTsc(cwd) {
-    try {
-        return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc', { paths: [cwd] });
-    }
-    catch {
-        return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc');
-    }
+function resolveTsc(ctx) {
+    // `clientOwnsConfig` unconditionally: this check does not apply without a
+    // `tsconfig.json` in the repository, so the compiler their config was written
+    // for is always theirs. `install.reuseLocal: "off"` still overrides, for a
+    // client who wants our pinned compiler for reproducibility.
+    return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc', {
+        paths: (0, reuse_1.clientToolPaths)('typescript', ctx, { clientOwnsConfig: true }),
+    });
 }
 exports.typecheckCheck = {
     name: 'TypeScript',
@@ -42,7 +44,7 @@ exports.typecheckCheck = {
         if (!node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'node_modules'))) {
             return (0, types_1.skip)('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
         }
-        const tscBin = resolveTsc(ctx.cwd);
+        const tscBin = resolveTsc(ctx);
         const result = await (0, execa_1.execa)(process.execPath, [tscBin, '--noEmit'], {
             cwd: ctx.cwd,
             reject: false,

package/dist/core/checks/pr/commitlint.js

@@ -60,8 +60,14 @@ exports.commitlintCheck = {
         return ctx.config.commitlint?.enabled !== false;
     },
     async run(ctx) {
+        // This check needs a commit to lint. Without a repository `--last` finds
+        // none, commitlint prints nothing and exits 0, and we reported `pass` — a
+        // verdict on a commit message that does not exist. Ticket 072: a check that
+        // examined nothing must not read as a check that found nothing.
+        if (!(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD')))
+            return (0, types_1.skip)('git unavailable');
         const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
-        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
+        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES, ctx.cwd);
         let tempConfigFile = null;
         // With no diff range (a full-repo review, or `--full`) the check still has a
         // meaningful subject: the newest commit message. `HEAD~1` cannot be assumed to

package/dist/core/checks/quality/case-collision.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.caseCollisionCheck = void 0;
-const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
@@ -18,9 +17,12 @@ exports.caseCollisionCheck = {
         return ctx.config.caseCollision?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
-        if (files.length === 0)
-            return (0, types_1.skip)('no tracked files');
+        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+            wholeTree: true,
+            onEmpty: { skip: 'no tracked files' },
+        });
+        if (!Array.isArray(files))
+            return files;
         const byLower = new Map();
         for (const f of files) {
             const key = f.toLowerCase();

package/dist/core/checks/quality/config-validation.d.ts

@@ -8,11 +8,4 @@ import { Check } from '../../types';
  * slip or two.
  */
 export declare function suggestName(input: string, candidates: string[]): string | null;
-/**
- * Validates pr-checkmate.json itself: unknown top-level keys (typos like
- * `mergeConfict` that silently do nothing), invalid values in `severity` and
- * `failOn`, and names in `severity` that match no check. Reads the raw file so it
- * checks what the user actually wrote, not the merged defaults. `//`-comment keys
- * and `$schema` are ignored.
- */
 export declare const configValidationCheck: Check;

package/dist/core/checks/quality/config-validation.js

@@ -112,6 +112,35 @@ function validateFailOn(json) {
  * checks what the user actually wrote, not the merged defaults. `//`-comment keys
  * and `$schema` are ignored.
  */
+/**
+ * Report a `sourcePath` that points nowhere.
+ *
+ * Every scoped check restricts itself to these directories, so a path that does
+ * not exist silences them — and silences them as a PASS. Measured on a fixture
+ * with `"sourcePath": "src"` and the code in `app/`: a real conflict marker in
+ * `app/conflict.py` went unreported while Merge Conflict, a blocking check,
+ * printed ✅. Nothing else in the run mentioned that most of the repository had
+ * not been looked at.
+ *
+ * `init` defaults to `.` and recommends it, so this is not the common case — it
+ * is what happens when someone picks `src` at setup, or moves the code later, and
+ * that is precisely when nobody is looking for it.
+ */
+function validateSourcePath(json, cwd) {
+    const raw = json.sourcePath;
+    if (raw === undefined)
+        return [];
+    const paths = (Array.isArray(raw) ? raw : [raw]).filter((p) => typeof p === 'string' && p.trim().length > 0);
+    return paths
+        .filter(p => {
+        const normalised = p.replace(/^\.\/?/, '').replace(/\/+$/, '');
+        // `.` and `./` mean the whole repository and always exist.
+        if (normalised === '')
+            return false;
+        return !node_fs_1.default.existsSync(node_path_1.default.join(cwd, normalised));
+    })
+        .map(p => `sourcePath "${p}" does not exist — every scoped check silently reviews nothing, and reports a pass`);
+}
 exports.configValidationCheck = {
     name: 'Config Validation',
     phase: 'informational',
@@ -153,6 +182,7 @@ exports.configValidationCheck = {
             issues.push(...validateSeverity(json, checkNames));
         }
         issues.push(...validateFailOn(json));
+        issues.push(...validateSourcePath(json, ctx.cwd));
         if (issues.length === 0)
             return (0, types_1.pass)();
         // Advisory by default: a config problem is worth knowing about, but a repo

package/dist/core/checks/quality/duplicate-check.js

@@ -1,12 +1,19 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.duplicateCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../../../config");
 const constants_1 = require("../../../config/constants");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
 /**
  * The files to hand jscpd, per language.
  *
@@ -43,22 +50,16 @@ function globsFor(languages) {
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
 // config), so their repetition is expected rather than a code smell.
 const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_1.CONFIG_FILE_PATTERNS];
-// jscpd v5 appends promotional/funding lines after its report. Strip them so
-// they never reach the client's terminal when running our package.
-const JSCPD_PROMO_MARKERS = [
-    'Auto-refactor with AI',
-    'github.com/kucherenko/jscpd',
-    'Gangsta Agents',
-    'gangsta.page',
-    'Support jscpd project',
-    'opencollective.com/jscpd',
-];
-function stripJscpdPromo(text) {
-    return text
-        .split('\n')
-        .filter(line => !JSCPD_PROMO_MARKERS.some(marker => line.includes(marker)))
-        .join('\n')
-        .trimEnd();
+/** `<path>:<start>-<end>`, repo-relative, for one end of a clone. */
+function locate(cwd, at) {
+    const name = at?.name ?? '';
+    const rel = name ? node_path_1.default.relative(cwd, name) || node_path_1.default.basename(name) : '<unknown file>';
+    return `${rel}:${at?.start ?? '?'}-${at?.end ?? '?'}`;
+}
+/** One reportable line per clone: both ends, and how big it is. */
+function describe(cwd, clone) {
+    const size = clone.lines === undefined ? '' : ` (${clone.lines} lines)`;
+    return `${locate(cwd, clone.firstFile)} ↔ ${locate(cwd, clone.secondFile)}${size}`;
 }
 exports.duplicateCheck = {
     name: 'Duplicate Code',
@@ -72,7 +73,7 @@ exports.duplicateCheck = {
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)());
+        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)(ctx.cwd));
         if (targetPaths === null)
             return (0, types_1.skip)('git unavailable');
         if (targetPaths.length === 0)
@@ -86,7 +87,16 @@ exports.duplicateCheck = {
         // defaulting to source-code formats so data files (yaml/json/markdown) are
         // not scanned. Clients can add them back explicitly.
         const formats = (ctx.config.duplicate?.formats ?? constants_1.DUPLICATE_CODE_FORMATS).join(',');
+        // The JSON reporter writes a file, so it needs somewhere to write it. Outside
+        // the repository deliberately: with no `--output`, jscpd creates `report/`
+        // in the client's working tree, and a check that leaves a directory behind is
+        // a check that shows up in the next commit.
+        const reportDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pr-checkmate-jscpd-'));
         try {
+            // `--silent` keeps jscpd's own console output away from the client entirely.
+            // That is what retired `stripJscpdPromo` — six string markers matching the
+            // funding lines jscpd v5 prints after its report, each good until the next
+            // release of somebody else's package.
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
                 '--min-lines',
@@ -94,27 +104,44 @@ exports.duplicateCheck = {
                 '--min-tokens',
                 String(minTokens),
                 '--reporters',
-                'console',
+                'json',
+                '--output',
+                reportDir,
+                '--absolute',
+                '--silent',
                 '--format',
                 formats,
                 '--ignore',
                 ignore,
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
-            const output = stripJscpdPromo([result.stdout, result.stderr].filter(Boolean).join('\n'));
-            const clonesMatch = output.match(/(\d+)\s+clone/i);
-            const cloneCount = clonesMatch ? parseInt(clonesMatch[1], 10) : 0;
-            if (cloneCount > 0) {
-                utils_1.logger.warn(`[Duplicate Code]: ⚠️ Found ${cloneCount} duplicate block(s)`);
-                if (output)
-                    utils_1.logger.warn(output);
-                return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
+            const reportPath = node_path_1.default.join(reportDir, 'jscpd-report.json');
+            if (!node_fs_1.default.existsSync(reportPath)) {
+                // No report and nothing to read it from: jscpd did not get as far as
+                // writing one. Its stderr is the only thing that can say why, and a skip
+                // is the honest outcome — an empty report would read as "no duplication".
+                utils_1.logger.warn(`[Duplicate Code]: ⚠️ jscpd wrote no report (exit ${result.exitCode ?? 'killed'})` +
+                    `${result.stderr ? `\n${result.stderr}` : ''}`);
+                return (0, types_1.skip)('jscpd produced no report');
             }
-            return (0, types_1.pass)();
+            const report = JSON.parse(node_fs_1.default.readFileSync(reportPath, 'utf-8'));
+            const clones = report.duplicates ?? [];
+            // jscpd's own count, not a regex over its prose. `output.match(/(\d+)\s+clone/i)`
+            // read the number out of an English sentence, so a reworded summary upstream
+            // would have reported zero duplication on a repository full of it — and
+            // reported it as a pass.
+            const cloneCount = report.statistics?.total?.clones ?? clones.length;
+            if (cloneCount === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logSample)('Duplicate Code', `${cloneCount} duplicate block(s):`, clones.map(clone => describe(ctx.cwd, clone)));
+            return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
         }
         catch (err) {
             utils_1.logger.warn(`[Duplicate Code]: ⚠️ Could not run duplicate check\n${err}`);
             return (0, types_1.skip)('jscpd unavailable');
         }
+        finally {
+            node_fs_1.default.rmSync(reportDir, { recursive: true, force: true });
+        }
     },
 };

package/dist/core/checks/quality/license-header.js

@@ -8,6 +8,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 /** Source extensions a license header is expected on. */
 const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|kt|java|go|rs|cs|rb|php|swift|c|cc|cpp|h|hpp)$/i;
@@ -49,10 +50,12 @@ exports.licenseHeaderCheck = {
                 ? ['diff', '--name-only', '--diff-filter=A', ctx.baseSha, ctx.headSha ?? 'HEAD']
                 : ['ls-files'];
             const { stdout } = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd });
-            added = stdout
-                .split('\n')
-                .filter(Boolean)
-                .filter(f => SOURCE_EXT.test(f));
+            // Its own git call rather than `resolveTargets`, and for one reason:
+            // `--diff-filter=A`. This check is about files a PR ADDS, and the shared
+            // resolver asks for ACMR — routing through it would start demanding a
+            // header on every modified file too, which is a different check. So the
+            // client's `excludePaths` is applied here explicitly instead (ticket 080).
+            added = (0, targets_1.excludeClientPaths)(stdout.split('\n').filter(Boolean), ctx.cwd).filter(f => SOURCE_EXT.test(f));
         }
         catch (err) {
             utils_1.logger.warn(`[License Header]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/quality/markdown-lint.js

@@ -47,12 +47,7 @@ exports.markdownLintCheck = {
         const userRules = userConfig.rules ?? {};
         let tempConfigFile = null;
         let configArg;
-        if ((0, config_1.hasLocalConfig)([
-            '.markdownlint.json',
-            '.markdownlint.jsonc',
-            '.markdownlint.yaml',
-            '.markdownlint.yml',
-        ])) {
+        if ((0, config_1.hasLocalConfig)(['.markdownlint.json', '.markdownlint.jsonc', '.markdownlint.yaml', '.markdownlint.yml'], ctx.cwd)) {
             configArg = [];
         }
         else {

package/dist/core/checks/quality/spellcheck.js

@@ -188,19 +188,48 @@ function dropMissingLanguages(language, missing) {
     // to its own default, which is not necessarily what was configured here.
     return kept.length > 0 ? kept.join(',') : 'en';
 }
+/**
+ * Resolve a package id from the repository under review first, then from our own
+ * tree.
+ *
+ * The default `require.resolve` searches from THIS module, which is only the
+ * client's tree by accident. Installed as a dependency we sit in their
+ * `node_modules` and npm hoists `@cspell/dict-*` above us, so walking up finds
+ * it. Run through `npx` we sit in the npx cache and their `node_modules` is not
+ * on the path at all — so `npm i -D @cspell/dict-ru_ru`, which this file's own
+ * docstring promises is all it takes, did nothing and said nothing (ticket 081).
+ *
+ * Same policy as tool resolution for binaries: the client's copy first, ours as
+ * the fallback.
+ */
+function resolveFrom(cwd) {
+    return id => {
+        try {
+            return require.resolve(id, { paths: [cwd] });
+        }
+        catch {
+            return require.resolve(id);
+        }
+    };
+}
 function createTempCspellConfig(cwd) {
     const packageConfigPath = (0, config_1.getPackageConfigPath)('cspell.json');
     const packageConfigDir = node_path_1.default.dirname(packageConfigPath);
     const defaultConfig = JSON.parse(node_fs_1.default.readFileSync(packageConfigPath, 'utf-8'));
     const userConfig = loadUserCspellConfig(cwd);
     const merged = mergeCspellConfig(defaultConfig, userConfig);
-    const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir);
-    const available = availableDictionaries();
+    const resolve = resolveFrom(cwd);
+    const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir, resolve);
+    const available = availableDictionaries(resolve);
     for (const { pkg } of missing) {
         utils_1.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
     }
     if (available.absent.length > 0) {
-        utils_1.logger.debug(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
+        // `info`, not `debug`. A client who installed a dictionary and saw no change
+        // had nothing to read: the one line that would have explained it was behind a
+        // flag. Which dictionaries are in play decides which findings appear, so it
+        // belongs in the ordinary log (ticket 081).
+        utils_1.logger.info(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
             `Install any of them to spellcheck that language (\`npm i -D ${available.absent[0]}\`).`);
     }
     // A language the client asked for whose dictionary is absent is dropped rather
@@ -230,7 +259,7 @@ exports.spellcheckCheck = {
         return ctx.config.cspell?.enabled !== false && ctx.config.spellcheck?.enabled !== false;
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)());
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         // Committed build output and test reports are dropped here, in JS, against
@@ -246,7 +275,7 @@ exports.spellcheckCheck = {
         const files = targets.filter(f => !(0, utils_1.matchesAnyGlob)(f, config_1.IGNORE_PATTERNS));
         if (files.length === 0)
             return (0, types_1.pass)('no files to spellcheck');
-        const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json']);
+        const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json'], ctx.cwd);
         let tempConfigPath = null;
         const cspellBin = (0, utils_1.resolvePackageBin)('cspell', 'bin.mjs');
         // `--no-must-find-files`: cspell exits 1 when it checked nothing, which the

package/dist/core/checks/quality/symlinks.js

@@ -7,7 +7,6 @@ exports.symlinksCheck = void 0;
 exports.isBrokenSymlink = isBrokenSymlink;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
@@ -42,9 +41,12 @@ exports.symlinksCheck = {
         return ctx.config.symlinks?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
-        if (files.length === 0)
-            return (0, types_1.skip)('no tracked files');
+        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+            wholeTree: true,
+            onEmpty: { skip: 'no tracked files' },
+        });
+        if (!Array.isArray(files))
+            return files;
         const ignore = ctx.config.symlinks?.ignore ?? [];
         const broken = [];
         for (const file of files) {