pr-checkmate 2.1.2 → 3.0.1

package/dist/core/checks/languages/python-typecheck.js

@@ -1,27 +1,154 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pythonTypecheckCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const tool_install_1 = require("../tool-install");
+const external_runner_1 = require("./external-runner");
 const ruff_shared_1 = require("./ruff-shared");
-/** Run a type checker over the target files, or return null if the binary is absent. */
-async function runChecker(ctx, bin, targets) {
-    const result = await (0, execa_1.execa)(bin, targets, { cwd: ctx.cwd, reject: false });
-    if (result.code === 'ENOENT')
+/** How many diagnostics reach the log before the rest are counted instead. */
+const MAX_LOGGED = 10;
+/** The check's display name — the log prefix, and the row in the report. */
+const NAME = 'Python Types';
+/**
+ * Diagnostics that mean pyright could not see the repository's dependencies.
+ *
+ * Their presence is a verdict about the *setup*, not about the code, and the
+ * first attempt at this got it backwards: it dropped these two rules and
+ * reported everything else. That removes the cause and keeps the consequences,
+ * which is worse than either extreme — on a real client repository (ticket 076)
+ * it produced fifteen confident "type errors" of which nine were one cascade:
+ *
+ * ```python
+ * @click.group()
+ * def main() -> None: ...
+ *
+ * @main.command("list-jobs")     # nine of these
+ * def list_jobs() -> None: ...
+ * ```
+ *
+ * With `click` absent, pyright sees `main` as a plain `FunctionType` and every
+ * `@main.command(...)` becomes an error. Pyright is answering correctly; the
+ * question is wrong. The same shape follows from typer, flask, celery and pytest
+ * fixtures — most Python projects, in any CI job that does not install first.
+ *
+ * So an unresolved import means we cannot type-check at all, and the honest
+ * answer is a skip that says so. That is exactly what the TypeScript check does
+ * with a missing `node_modules`, in the same words.
+ */
+const UNRESOLVED_IMPORT_RULES = new Set(['reportMissingImports', 'reportMissingModuleSource']);
+/** How many unresolved module names the skip message names before stopping. */
+const NAMED_IMPORTS = 3;
+/** The module a `reportMissingImports` diagnostic is about, for the skip message. */
+function unresolvedModule(message) {
+    return /"([^"]+)"/.exec(message)?.[1] ?? null;
+}
+/** Whether the repository configures pyright itself. */
+function hasOwnPyrightConfig(cwd) {
+    if (node_fs_1.default.existsSync(node_path_1.default.join(cwd, 'pyrightconfig.json')))
+        return true;
+    try {
+        return node_fs_1.default.readFileSync(node_path_1.default.join(cwd, 'pyproject.toml'), 'utf-8').includes('[tool.pyright]');
+    }
+    catch {
+        return false;
+    }
+}
+/** Where our copy of pyright lives — bundled, or in a fetched profile. */
+function resolvePyright() {
+    try {
+        return (0, utils_1.resolvePackageBin)('pyright', 'index.js');
+    }
+    catch {
         return null;
-    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    }
+}
+/** Read mypy's text output: one diagnostic per line, with its own final count. */
+function reportMypy(output) {
+    const lines = output.split('\n').filter(line => /\berror\b|\bwarning\b/i.test(line));
+    if (lines.length === 0)
+        return (0, types_1.pass)();
+    // "Found 3 errors in 1 file (checked 12 source files)" — mypy's own count says
+    // more than a tally of lines that merely contained the word.
+    const summary = lines.find(line => /found\s+\d+\s+error/i.test(line))?.trim();
+    (0, findings_1.logSample)(NAME, 'type issues (mypy):', lines);
+    return (0, types_1.warn)(summary ?? `${lines.length} type issue(s)`);
 }
 /**
- * Type-checks changed Python files — the Python analogue of the TypeScript
- * `tsc --noEmit` check. Runner-dependency (needs mypy or pyright on the runner),
- * gracefully skipping when neither is present. Informational by design (like
- * Ruff lint) so teams can adopt gradually; force a checker with
- * `python.typeChecker`, else mypy is tried first, then pyright.
+ * Type-check with our own pyright, and report only what the client can act on.
+ *
+ * Pyright is a Node bundle, so it runs through `process.execPath` rather than as
+ * a binary on the path — the same reason clang-format does.
+ */
+function reportPyright(ctx, stdout) {
+    let report;
+    try {
+        report = JSON.parse(stdout);
+    }
+    catch {
+        // Pyright exits non-zero for a bad invocation too, and calling that a type
+        // error would put a finding in the report that is really our own bug.
+        utils_1.logger.warn(`[${NAME}]: ⚠️ pyright produced no readable report`);
+        return (0, types_1.skip)('pyright produced no readable report');
+    }
+    const diagnostics = (report.generalDiagnostics ?? []).filter(diagnostic => diagnostic.severity !== 'information');
+    // Nothing downstream of an unresolved import can be trusted, so this is
+    // checked before anything is reported — and skipped rather than filtered.
+    //
+    // Not applied to a repository that configures pyright itself: having written
+    // `pyrightconfig.json` (or a `[tool.pyright]` section) is having an opinion
+    // about import resolution — a `venvPath`, or these rules downgraded on
+    // purpose — and overriding it with a skip would ignore the one client who
+    // said what they wanted.
+    const unresolved = diagnostics.filter(diagnostic => UNRESOLVED_IMPORT_RULES.has(diagnostic.rule ?? ''));
+    if (unresolved.length > 0 && !hasOwnPyrightConfig(ctx.cwd)) {
+        const modules = [
+            ...new Set(unresolved
+                .map(diagnostic => unresolvedModule(diagnostic.message))
+                .filter((name) => Boolean(name))),
+        ];
+        const named = modules.slice(0, NAMED_IMPORTS).join(', ');
+        const rest = modules.length > NAMED_IMPORTS ? ` and ${modules.length - NAMED_IMPORTS} more` : '';
+        utils_1.logger.warn(`[${NAME}]: ⚠️ ${unresolved.length} import(s) could not be resolved — not type-checking`);
+        return (0, types_1.skip)(`project dependencies not installed (${named || `${unresolved.length} import(s)`}${rest}) ` +
+            '— run `pip install` before typecheck');
+    }
+    if (diagnostics.length === 0) {
+        utils_1.logger.info(`[${NAME}]: ✅ No type errors (pyright)`);
+        return (0, types_1.pass)();
+    }
+    const errors = diagnostics.filter(diagnostic => diagnostic.severity === 'error').length;
+    const summary = `${errors} error(s), ${diagnostics.length - errors} warning(s)`;
+    (0, findings_1.logSample)(NAME, `type issues (pyright): ${summary}`, diagnostics.slice(0, MAX_LOGGED).map(diagnostic => {
+        const rel = node_path_1.default.relative(ctx.cwd, diagnostic.file) || diagnostic.file;
+        // Pyright counts lines from zero; every other tool in the report counts
+        // from one, and a line number that is off by one is worse than none.
+        const line = (diagnostic.range?.start?.line ?? 0) + 1;
+        return `${rel}:${line} ${diagnostic.severity}: ${diagnostic.message.split('\n')[0]}`;
+    }));
+    return (0, types_1.warn)(summary);
+}
+/**
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
  */
 exports.pythonTypecheckCheck = {
-    name: 'Python Types',
+    name: NAME,
     phase: 'informational',
     applies(ctx) {
         return (ctx.config.python?.enabled !== false &&
@@ -35,32 +162,29 @@ exports.pythonTypecheckCheck = {
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
         const forced = ctx.config.python?.typeChecker;
-        const order = forced ? [forced] : ['mypy', 'pyright'];
-        let result = null;
-        let used = '';
-        for (const bin of order) {
-            result = await runChecker(ctx, bin, targets);
-            if (result) {
-                used = bin;
-                break;
+        if (forced !== 'pyright') {
+            const mypy = await (0, external_runner_1.runTool)(ctx, 'mypy', targets);
+            if (!mypy.missing) {
+                if (mypy.exitCode === 0) {
+                    utils_1.logger.info(`[${NAME}]: ✅ No type errors (mypy)`);
+                    return (0, types_1.pass)();
+                }
+                return reportMypy([mypy.stdout, mypy.stderr].filter(Boolean).join('\n'));
             }
+            // Asking for mypy by name and not having it is a configuration error the
+            // client meant to make visible; falling back to pyright would hide it.
+            if (forced === 'mypy')
+                return (0, tool_install_1.notInstalled)('mypy', 'mypy');
         }
-        if (!result)
-            return (0, types_1.skip)(`${forced ?? 'mypy/pyright'} not installed`);
-        if (result.exitCode === 0) {
-            utils_1.logger.info(`[Python Types]: ✅ No type errors (${used})`);
-            return (0, types_1.pass)();
-        }
-        const lines = [result.stdout, result.stderr]
-            .filter(Boolean)
-            .join('\n')
-            .split('\n')
-            .filter(l => /\berror\b|\bwarning\b/i.test(l));
-        utils_1.logger.warn(`[Python Types]: ⚠️ type issues (${used}):`);
-        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l}`));
-        if (lines.length > 10)
-            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
-        const summary = lines.find(l => /found\s+\d+\s+error/i.test(l)) ?? `${lines.length} type issue(s)`;
-        return (0, types_1.warn)(summary.trim());
+        const entry = resolvePyright();
+        if (!entry)
+            return (0, tool_install_1.notInstalled)('pyright', 'pyright');
+        const result = await (0, external_runner_1.runTool)(ctx, process.execPath, [entry, '--outputjson', ...targets]);
+        // The binary here is the Node running this process, so `missing` is not a
+        // reachable state — it is a case of the type, folded in rather than asserted
+        // away.
+        if (result.missing)
+            return (0, tool_install_1.notInstalled)('pyright', 'pyright');
+        return reportPyright(ctx, result.stdout);
     },
 };

package/dist/core/checks/languages/ruff-shared.d.ts

@@ -2,9 +2,9 @@ type RuffModule = typeof import('@astral-sh/ruff-wasm-nodejs');
 type RuffWorkspace = InstanceType<RuffModule['Workspace']>;
 export declare const PY_GLOBS: string[];
 /**
- * Instantiate a Ruff WASM workspace with default settings. Shared by the Ruff
- * lint and format checks so their setup stays identical, and kept as a function
- * (not a module-level singleton) so the WASM module loads only when a check runs.
+ * Instantiate a Ruff WASM workspace. Shared by the Ruff lint and format checks so
+ * their setup stays identical, and kept as a function (not a module-level
+ * singleton) so the WASM module loads only when a check runs.
  */
 export declare function createRuffWorkspace(): RuffWorkspace;
 export {};

package/dist/core/checks/languages/ruff-shared.js

@@ -4,11 +4,34 @@ exports.PY_GLOBS = void 0;
 exports.createRuffWorkspace = createRuffWorkspace;
 exports.PY_GLOBS = ['*.py'];
 /**
- * Instantiate a Ruff WASM workspace with default settings. Shared by the Ruff
- * lint and format checks so their setup stays identical, and kept as a function
- * (not a module-level singleton) so the WASM module loads only when a check runs.
+ * The rules we lint Python with — pinned here rather than left to Ruff's defaults.
+ *
+ * `E4`/`E7`/`E9` (import placement, statement style, syntax) plus `F` (pyflakes:
+ * undefined names, unused imports, unreachable code) — the set Ruff itself
+ * shipped as its default through 0.15.
+ *
+ * Written down because leaving it implicit made our verdict change under us.
+ * Ruff 0.16 added the isort rules (`I`) to its defaults, and a routine dependency
+ * bump turned that into a 5- to 48-fold increase in findings across seventeen
+ * Python repositories — every one of them `I001`, "import block is un-sorted".
+ * Two repositories went from a clean report to a warning on code nobody had
+ * touched. Import order is a matter of taste, and a check that fires on every
+ * file in a repository is how people learn to ignore the whole report.
+ *
+ * Adding a rule to this list is a decision with a measurement behind it, which
+ * is the point: it is ours to make, not our dependency's to make for us.
+ */
+const SELECTED_RULES = ['E4', 'E7', 'E9', 'F'];
+/**
+ * Instantiate a Ruff WASM workspace. Shared by the Ruff lint and format checks so
+ * their setup stays identical, and kept as a function (not a module-level
+ * singleton) so the WASM module loads only when a check runs.
  */
 function createRuffWorkspace() {
     const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
-    return new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+    const settings = {
+        ...Workspace.defaultSettings(),
+        lint: { select: SELECTED_RULES },
+    };
+    return new Workspace(settings, PositionEncoding.Utf16);
 }

package/dist/core/checks/languages/typecheck.js

@@ -8,18 +8,20 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const reuse_1 = require("../../install/reuse");
 const types_1 = require("../../types");
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
  * version it was written for; fall back to the compiler bundled with pr-checkmate.
  */
-function resolveTsc(cwd) {
-    try {
-        return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc', { paths: [cwd] });
-    }
-    catch {
-        return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc');
-    }
+function resolveTsc(ctx) {
+    // `clientOwnsConfig` unconditionally: this check does not apply without a
+    // `tsconfig.json` in the repository, so the compiler their config was written
+    // for is always theirs. `install.reuseLocal: "off"` still overrides, for a
+    // client who wants our pinned compiler for reproducibility.
+    return (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc', {
+        paths: (0, reuse_1.clientToolPaths)('typescript', ctx, { clientOwnsConfig: true }),
+    });
 }
 exports.typecheckCheck = {
     name: 'TypeScript',
@@ -42,7 +44,7 @@ exports.typecheckCheck = {
         if (!node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'node_modules'))) {
             return (0, types_1.skip)('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
         }
-        const tscBin = resolveTsc(ctx.cwd);
+        const tscBin = resolveTsc(ctx);
         const result = await (0, execa_1.execa)(process.execPath, [tscBin, '--noEmit'], {
             cwd: ctx.cwd,
             reject: false,

package/dist/core/checks/pr/commitlint.js

@@ -60,8 +60,14 @@ exports.commitlintCheck = {
         return ctx.config.commitlint?.enabled !== false;
     },
     async run(ctx) {
+        // This check needs a commit to lint. Without a repository `--last` finds
+        // none, commitlint prints nothing and exits 0, and we reported `pass` — a
+        // verdict on a commit message that does not exist. Ticket 072: a check that
+        // examined nothing must not read as a check that found nothing.
+        if (!(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD')))
+            return (0, types_1.skip)('git unavailable');
         const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
-        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
+        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES, ctx.cwd);
         let tempConfigFile = null;
         // With no diff range (a full-repo review, or `--full`) the check still has a
         // meaningful subject: the newest commit message. `HEAD~1` cannot be assumed to

package/dist/core/checks/quality/case-collision.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.caseCollisionCheck = void 0;
-const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
@@ -18,9 +17,12 @@ exports.caseCollisionCheck = {
         return ctx.config.caseCollision?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
-        if (files.length === 0)
-            return (0, types_1.skip)('no tracked files');
+        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+            wholeTree: true,
+            onEmpty: { skip: 'no tracked files' },
+        });
+        if (!Array.isArray(files))
+            return files;
         const byLower = new Map();
         for (const f of files) {
             const key = f.toLowerCase();

package/dist/core/checks/quality/config-validation.d.ts

@@ -8,11 +8,4 @@ import { Check } from '../../types';
  * slip or two.
  */
 export declare function suggestName(input: string, candidates: string[]): string | null;
-/**
- * Validates pr-checkmate.json itself: unknown top-level keys (typos like
- * `mergeConfict` that silently do nothing), invalid values in `severity` and
- * `failOn`, and names in `severity` that match no check. Reads the raw file so it
- * checks what the user actually wrote, not the merged defaults. `//`-comment keys
- * and `$schema` are ignored.
- */
 export declare const configValidationCheck: Check;

package/dist/core/checks/quality/config-validation.js

@@ -112,6 +112,35 @@ function validateFailOn(json) {
  * checks what the user actually wrote, not the merged defaults. `//`-comment keys
  * and `$schema` are ignored.
  */
+/**
+ * Report a `sourcePath` that points nowhere.
+ *
+ * Every scoped check restricts itself to these directories, so a path that does
+ * not exist silences them — and silences them as a PASS. Measured on a fixture
+ * with `"sourcePath": "src"` and the code in `app/`: a real conflict marker in
+ * `app/conflict.py` went unreported while Merge Conflict, a blocking check,
+ * printed ✅. Nothing else in the run mentioned that most of the repository had
+ * not been looked at.
+ *
+ * `init` defaults to `.` and recommends it, so this is not the common case — it
+ * is what happens when someone picks `src` at setup, or moves the code later, and
+ * that is precisely when nobody is looking for it.
+ */
+function validateSourcePath(json, cwd) {
+    const raw = json.sourcePath;
+    if (raw === undefined)
+        return [];
+    const paths = (Array.isArray(raw) ? raw : [raw]).filter((p) => typeof p === 'string' && p.trim().length > 0);
+    return paths
+        .filter(p => {
+        const normalised = p.replace(/^\.\/?/, '').replace(/\/+$/, '');
+        // `.` and `./` mean the whole repository and always exist.
+        if (normalised === '')
+            return false;
+        return !node_fs_1.default.existsSync(node_path_1.default.join(cwd, normalised));
+    })
+        .map(p => `sourcePath "${p}" does not exist — every scoped check silently reviews nothing, and reports a pass`);
+}
 exports.configValidationCheck = {
     name: 'Config Validation',
     phase: 'informational',
@@ -153,6 +182,7 @@ exports.configValidationCheck = {
             issues.push(...validateSeverity(json, checkNames));
         }
         issues.push(...validateFailOn(json));
+        issues.push(...validateSourcePath(json, ctx.cwd));
         if (issues.length === 0)
             return (0, types_1.pass)();
         // Advisory by default: a config problem is worth knowing about, but a repo

package/dist/core/checks/quality/coverage.js

@@ -48,7 +48,12 @@ exports.coverageCheck = {
             : DEFAULT_REPORTS;
         const found = candidates.find(rel => {
             try {
-                return node_fs_1.default.statSync(node_path_1.default.join(ctx.cwd, rel)).size > 0;
+                // `isFile()` as well as the size: `statSync` reports a non-zero size for
+                // a directory too, so a path that happens to be one would read as a
+                // report. Non-empty matters because a zero-byte report is what a test
+                // run that died halfway leaves behind — the case this check exists for.
+                const stat = node_fs_1.default.statSync(node_path_1.default.join(ctx.cwd, rel));
+                return stat.isFile() && stat.size > 0;
             }
             catch {
                 return false;

package/dist/core/checks/quality/dead-code.js

@@ -44,7 +44,7 @@ exports.deadCodeCheck = {
             const ignore = compileIgnorePatterns(ctx.config.deadCode?.ignoreFiles ?? constants_1.DEAD_CODE_IGNORE_DEFAULTS);
             // ts-unused-exports prints one `path: sym1, sym2` line per file, preceded
             // by a `N modules with unused exports` summary line we skip.
-            const entries = output
+            const parsed = output
                 .split('\n')
                 .map(line => line.trim().match(/^(.+\.[cm]?tsx?): (.+)$/))
                 .filter((match) => match !== null)
@@ -54,8 +54,17 @@ exports.deadCodeCheck = {
                     .split(',')
                     .map(sym => sym.trim())
                     .filter(Boolean),
-            }))
-                .filter(entry => !ignore.some(re => re.test(entry.file)));
+            }));
+            // The tool said something and none of it was a report. That is not a clean
+            // repository — it is an answer this check cannot read, and calling it a
+            // pass is how Circular Deps stayed green on every repository for its whole
+            // existence while grepping for console wording that had changed. Same
+            // resolution as Grype Scan: say so rather than invent a verdict.
+            if (parsed.length === 0) {
+                utils_1.logger.warn(`[Dead Code]: ⚠️ ts-unused-exports produced no parseable output:\n${output}`);
+                return (0, types_1.warn)('ts-unused-exports produced no parseable output');
+            }
+            const entries = parsed.filter(entry => !ignore.some(re => re.test(entry.file)));
             if (entries.length === 0) {
                 utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
                 return (0, types_1.pass)();

package/dist/core/checks/quality/duplicate-check.js

@@ -1,12 +1,19 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.duplicateCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../../../config");
 const constants_1 = require("../../../config/constants");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
 /**
  * The files to hand jscpd, per language.
  *
@@ -43,22 +50,16 @@ function globsFor(languages) {
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
 // config), so their repetition is expected rather than a code smell.
 const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_1.CONFIG_FILE_PATTERNS];
-// jscpd v5 appends promotional/funding lines after its report. Strip them so
-// they never reach the client's terminal when running our package.
-const JSCPD_PROMO_MARKERS = [
-    'Auto-refactor with AI',
-    'github.com/kucherenko/jscpd',
-    'Gangsta Agents',
-    'gangsta.page',
-    'Support jscpd project',
-    'opencollective.com/jscpd',
-];
-function stripJscpdPromo(text) {
-    return text
-        .split('\n')
-        .filter(line => !JSCPD_PROMO_MARKERS.some(marker => line.includes(marker)))
-        .join('\n')
-        .trimEnd();
+/** `<path>:<start>-<end>`, repo-relative, for one end of a clone. */
+function locate(cwd, at) {
+    const name = at?.name ?? '';
+    const rel = name ? node_path_1.default.relative(cwd, name) || node_path_1.default.basename(name) : '<unknown file>';
+    return `${rel}:${at?.start ?? '?'}-${at?.end ?? '?'}`;
+}
+/** One reportable line per clone: both ends, and how big it is. */
+function describe(cwd, clone) {
+    const size = clone.lines === undefined ? '' : ` (${clone.lines} lines)`;
+    return `${locate(cwd, clone.firstFile)} ↔ ${locate(cwd, clone.secondFile)}${size}`;
 }
 exports.duplicateCheck = {
     name: 'Duplicate Code',
@@ -72,7 +73,7 @@ exports.duplicateCheck = {
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)());
+        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)(ctx.cwd));
         if (targetPaths === null)
             return (0, types_1.skip)('git unavailable');
         if (targetPaths.length === 0)
@@ -86,7 +87,16 @@ exports.duplicateCheck = {
         // defaulting to source-code formats so data files (yaml/json/markdown) are
         // not scanned. Clients can add them back explicitly.
         const formats = (ctx.config.duplicate?.formats ?? constants_1.DUPLICATE_CODE_FORMATS).join(',');
+        // The JSON reporter writes a file, so it needs somewhere to write it. Outside
+        // the repository deliberately: with no `--output`, jscpd creates `report/`
+        // in the client's working tree, and a check that leaves a directory behind is
+        // a check that shows up in the next commit.
+        const reportDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pr-checkmate-jscpd-'));
         try {
+            // `--silent` keeps jscpd's own console output away from the client entirely.
+            // That is what retired `stripJscpdPromo` — six string markers matching the
+            // funding lines jscpd v5 prints after its report, each good until the next
+            // release of somebody else's package.
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
                 '--min-lines',
@@ -94,27 +104,44 @@ exports.duplicateCheck = {
                 '--min-tokens',
                 String(minTokens),
                 '--reporters',
-                'console',
+                'json',
+                '--output',
+                reportDir,
+                '--absolute',
+                '--silent',
                 '--format',
                 formats,
                 '--ignore',
                 ignore,
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
-            const output = stripJscpdPromo([result.stdout, result.stderr].filter(Boolean).join('\n'));
-            const clonesMatch = output.match(/(\d+)\s+clone/i);
-            const cloneCount = clonesMatch ? parseInt(clonesMatch[1], 10) : 0;
-            if (cloneCount > 0) {
-                utils_1.logger.warn(`[Duplicate Code]: ⚠️ Found ${cloneCount} duplicate block(s)`);
-                if (output)
-                    utils_1.logger.warn(output);
-                return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
+            const reportPath = node_path_1.default.join(reportDir, 'jscpd-report.json');
+            if (!node_fs_1.default.existsSync(reportPath)) {
+                // No report and nothing to read it from: jscpd did not get as far as
+                // writing one. Its stderr is the only thing that can say why, and a skip
+                // is the honest outcome — an empty report would read as "no duplication".
+                utils_1.logger.warn(`[Duplicate Code]: ⚠️ jscpd wrote no report (exit ${result.exitCode ?? 'killed'})` +
+                    `${result.stderr ? `\n${result.stderr}` : ''}`);
+                return (0, types_1.skip)('jscpd produced no report');
             }
-            return (0, types_1.pass)();
+            const report = JSON.parse(node_fs_1.default.readFileSync(reportPath, 'utf-8'));
+            const clones = report.duplicates ?? [];
+            // jscpd's own count, not a regex over its prose. `output.match(/(\d+)\s+clone/i)`
+            // read the number out of an English sentence, so a reworded summary upstream
+            // would have reported zero duplication on a repository full of it — and
+            // reported it as a pass.
+            const cloneCount = report.statistics?.total?.clones ?? clones.length;
+            if (cloneCount === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logSample)('Duplicate Code', `${cloneCount} duplicate block(s):`, clones.map(clone => describe(ctx.cwd, clone)));
+            return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
         }
         catch (err) {
             utils_1.logger.warn(`[Duplicate Code]: ⚠️ Could not run duplicate check\n${err}`);
             return (0, types_1.skip)('jscpd unavailable');
         }
+        finally {
+            node_fs_1.default.rmSync(reportDir, { recursive: true, force: true });
+        }
     },
 };

package/dist/core/checks/quality/license-header.js

@@ -8,6 +8,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 /** Source extensions a license header is expected on. */
 const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|kt|java|go|rs|cs|rb|php|swift|c|cc|cpp|h|hpp)$/i;
@@ -49,10 +50,12 @@ exports.licenseHeaderCheck = {
                 ? ['diff', '--name-only', '--diff-filter=A', ctx.baseSha, ctx.headSha ?? 'HEAD']
                 : ['ls-files'];
             const { stdout } = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd });
-            added = stdout
-                .split('\n')
-                .filter(Boolean)
-                .filter(f => SOURCE_EXT.test(f));
+            // Its own git call rather than `resolveTargets`, and for one reason:
+            // `--diff-filter=A`. This check is about files a PR ADDS, and the shared
+            // resolver asks for ACMR — routing through it would start demanding a
+            // header on every modified file too, which is a different check. So the
+            // client's `excludePaths` is applied here explicitly instead (ticket 080).
+            added = (0, targets_1.excludeClientPaths)(stdout.split('\n').filter(Boolean), ctx.cwd).filter(f => SOURCE_EXT.test(f));
         }
         catch (err) {
             utils_1.logger.warn(`[License Header]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/quality/markdown-lint.js

@@ -47,12 +47,7 @@ exports.markdownLintCheck = {
         const userRules = userConfig.rules ?? {};
         let tempConfigFile = null;
         let configArg;
-        if ((0, config_1.hasLocalConfig)([
-            '.markdownlint.json',
-            '.markdownlint.jsonc',
-            '.markdownlint.yaml',
-            '.markdownlint.yml',
-        ])) {
+        if ((0, config_1.hasLocalConfig)(['.markdownlint.json', '.markdownlint.jsonc', '.markdownlint.yaml', '.markdownlint.yml'], ctx.cwd)) {
             configArg = [];
         }
         else {