pr-checkmate 3.0.0 → 3.0.1

package/dist/core/install/ensure.js

@@ -4,7 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manifestDir = manifestDir;
-exports.ensureProfile = ensureProfile;
+exports.cachedProfiles = cachedProfiles;
+exports.ensureTooling = ensureTooling;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -12,84 +13,152 @@ const execa_1 = require("../../utils/execa");
 const logger_1 = require("../../utils/logger");
 const cache_1 = require("./cache");
 const lock_1 = require("./lock");
+const merge_1 = require("./merge");
 /** Where the shipped manifests live inside the installed package. */
 function manifestDir(profile) {
     return node_path_1.default.resolve(__dirname, '../../..', 'install-manifests', profile);
 }
 const stampPath = (dir) => node_path_1.default.join(dir, '.pr-checkmate-installed');
-/** The manifest pair copied into the cache; `npm ci` reads exactly these two. */
-const MANIFEST_FILES = ['package.json', 'package-lock.json'];
-const LOCKFILE = MANIFEST_FILES[1];
+const MANIFEST = 'package.json';
+const LOCKFILE = 'package-lock.json';
 /**
- * A fingerprint of the manifest a profile directory was installed from.
+ * Merge the shipped manifests for a set of profiles, or say which one is missing.
+ *
+ * Returns `null` rather than throwing on a missing manifest, because that is an
+ * ordinary condition: a stamp written by another version can name a profile this
+ * one no longer ships. A *disagreement* between two manifests is different and
+ * still throws — see {@link mergeManifests}.
+ */
+function manifestFor(profiles) {
+    const dirs = profiles.map(name => ({ name, dir: manifestDir(name) }));
+    if (dirs.some(d => !node_fs_1.default.existsSync(node_path_1.default.join(d.dir, LOCKFILE))))
+        return null;
+    return (0, merge_1.mergeManifests)(dirs);
+}
+/**
+ * A fingerprint of the manifest a tooling directory was installed from.
  *
  * Comparing the lockfile hash rather than merely checking that `node_modules`
  * exists is what makes an upgrade correct: the cache path already includes our
  * version, but a client can also pin a `cacheDir` shared between checkouts, and
  * a half-written directory from an interrupted install must not read as ready.
  */
-function manifestHash(dir) {
+function hashOf(manifest) {
+    return node_crypto_1.default.createHash('sha256').update(JSON.stringify(manifest.lockfile)).digest('hex');
+}
+function readStamp(dir) {
     try {
-        const lock = node_fs_1.default.readFileSync(node_path_1.default.join(dir, LOCKFILE));
-        return node_crypto_1.default.createHash('sha256').update(lock).digest('hex');
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(stampPath(dir), 'utf-8'));
+        return Array.isArray(parsed.profiles) && typeof parsed.hash === 'string' ? parsed : null;
     }
     catch {
+        // Unreadable, absent, or written by a version that stamped a bare hash.
+        // All three mean the same thing here: we cannot claim to know what is there.
         return null;
     }
 }
-/** Whether this profile directory already holds exactly this manifest, installed. */
-function isInstalled(dir, expected) {
-    if (!expected)
+/**
+ * Whether the directory already holds everything asked for.
+ *
+ * A **superset** check, not an equality one, and that is the point of the shared
+ * directory. `install --all` warms the cache with every profile; a run that needs
+ * two of them must read that as ready, or the pre-warming built into our Docker
+ * image buys nothing — the failure ticket 083 was about. It is also what makes a
+ * language added six months later cost one install rather than one per run.
+ *
+ * The stamp's own hash is re-derived from the manifests we ship *now*, so a
+ * directory installed by a build with different manifests is correctly rejected
+ * even when its profile list still looks right.
+ */
+function holdsAll(dir, stamp, needed) {
+    if (!stamp || !node_fs_1.default.existsSync(node_path_1.default.join(dir, 'node_modules')))
         return false;
-    try {
-        return (node_fs_1.default.readFileSync(stampPath(dir), 'utf-8').trim() === expected &&
-            node_fs_1.default.existsSync(node_path_1.default.join(dir, 'node_modules')));
-    }
-    catch {
+    if (!needed.every(p => stamp.profiles.includes(p)))
         return false;
-    }
+    const installed = manifestFor(stamp.profiles);
+    return installed !== null && hashOf(installed) === stamp.hash;
 }
-/** Copy the shipped manifest into the cache so `npm ci` has something to read. */
-function stageManifest(from, to) {
-    node_fs_1.default.mkdirSync(to, { recursive: true });
-    for (const file of MANIFEST_FILES) {
-        node_fs_1.default.copyFileSync(node_path_1.default.join(from, file), node_path_1.default.join(to, file));
-    }
+/** Write the merged manifest into the cache so `npm ci` has something to read. */
+function writeManifest(dir, manifest) {
+    node_fs_1.default.mkdirSync(dir, { recursive: true });
+    node_fs_1.default.writeFileSync(node_path_1.default.join(dir, MANIFEST), JSON.stringify(manifest.pkg, null, 2));
+    node_fs_1.default.writeFileSync(node_path_1.default.join(dir, LOCKFILE), JSON.stringify(manifest.lockfile, null, 2));
+}
+/** Sorted, de-duplicated, so a set is one set however it was assembled. */
+const normalise = (profiles) => [...new Set(profiles)].sort();
+/**
+ * Which profiles the tooling cache holds, as recorded by the install that filled it.
+ *
+ * The one way to ask, so the stamp's format has a single owner. There is one tree
+ * for all fetched tooling now, so what is in it is written down rather than
+ * readable from the directory layout.
+ */
+function cachedProfiles(cacheDir) {
+    const dir = (0, cache_1.toolingDir)(cacheDir);
+    if (!node_fs_1.default.existsSync(node_path_1.default.join(dir, 'node_modules')))
+        return [];
+    return readStamp(dir)?.profiles ?? [];
 }
 /**
- * Make one profile's tooling available, fetching it only if it is not already there.
+ * Make a set of profiles' tooling available, fetching only what is not already there.
  *
- * Idempotent by design: this is the single entry point for both the postinstall
- * warm-up and the lazy path taken when postinstall never ran (`npm ci
+ * Idempotent by design: this is the single entry point for both the `install`
+ * command and the lazy path taken when it was never run (`npm ci
  * --ignore-scripts`, a `node_modules` restored from a CI cache). Two code paths
  * for the same job is how the two drift apart and how one of them silently stops
  * working.
  *
- * The install itself is a plain `npm ci` against a manifest we generated from our
- * own lockfile, run from the client's repository so their `.npmrc`, registry and
- * proxy settings apply unchanged. `--ignore-scripts` is not negotiable: we are a
- * supply-chain tool, and running arbitrary install hooks from a security check
- * would be indefensible. Integrity is npm's own, over the whole transitive tree —
- * a tampered tarball aborts with `EINTEGRITY` rather than being installed.
+ * Everything needed goes into **one** tree. Profiles overlap heavily — `js` and
+ * `commitlint` share 30 MB — and a directory each left npm nothing to
+ * deduplicate: 267 MB against the 211 one merged tree costs for the same set
+ * (ticket 087). The set only ever grows: a run needing a profile the directory
+ * lacks reinstalls the union, so nothing already fetched is lost.
+ *
+ * The install itself is a plain `npm ci` against a manifest merged from the ones
+ * we generated from our own lockfile, run from the client's repository so their
+ * `.npmrc`, registry and proxy settings apply unchanged. `--ignore-scripts` is
+ * not negotiable: we are a supply-chain tool, and running arbitrary install hooks
+ * from a security check would be indefensible. Integrity is npm's own, over the
+ * whole transitive tree — a tampered tarball aborts with `EINTEGRITY` rather than
+ * being installed.
  */
-async function ensureProfile(profile, opts) {
+async function ensureTooling(wanted, opts) {
     const { install } = opts;
-    const source = manifestDir(profile);
-    const expected = manifestHash(source);
-    if (!expected) {
-        return { profile, status: 'failed', reason: `no shipped manifest for profile "${profile}"` };
+    const needed = normalise(wanted);
+    if (needed.length === 0) {
+        return { status: 'cached', reason: 'nothing to fetch', profiles: [] };
     }
     const location = (0, cache_1.resolveCacheDir)(opts.version, install.cacheDir);
     if (!location) {
         return {
-            profile,
             status: 'failed',
             reason: 'no writable cache directory (tried the configured path, ~/.cache and the temp dir)',
+            profiles: [],
         };
     }
-    const dir = (0, cache_1.profileDir)(location.dir, profile);
-    if (isInstalled(dir, expected)) {
-        return { profile, status: 'cached', reason: 'already installed', dir };
+    const dir = (0, cache_1.toolingDir)(location.dir);
+    const stamp = readStamp(dir);
+    if (holdsAll(dir, stamp, needed)) {
+        return { status: 'cached', reason: 'already installed', dir, profiles: stamp?.profiles ?? [] };
+    }
+    // Never shrink: whatever the directory already holds stays, or a repository
+    // that alternates between two languages would reinstall on every run.
+    const target = normalise([...(stamp?.profiles ?? []), ...needed]);
+    let installing = target;
+    let manifest = manifestFor(target);
+    if (!manifest) {
+        // The stamp names a profile this version no longer ships. Keeping it would
+        // make the directory permanently un-installable; dropping it costs a refetch
+        // of tooling that is obsolete anyway.
+        installing = needed;
+        manifest = manifestFor(needed);
+    }
+    if (!manifest) {
+        return {
+            status: 'failed',
+            reason: `no shipped manifest for ${needed.join(', ')}`,
+            profiles: [],
+        };
     }
     // Both of these mean "do not fetch", and both are asked AFTER the cache check
     // above — because neither means "do not use what has already been fetched".
@@ -107,41 +176,50 @@ async function ensureProfile(profile, opts) {
     const strategy = process.env.PR_CHECKMATE_INSTALL_STRATEGY ?? install.strategy;
     if (strategy === 'manual') {
         return {
-            profile,
             status: 'skipped',
-            reason: 'install.strategy is "manual" and the profile is not in the cache',
+            reason: 'install.strategy is "manual" and the tooling is not in the cache',
             dir,
+            profiles: stamp?.profiles ?? [],
         };
     }
     if (install.offline || process.env.PR_CHECKMATE_OFFLINE === 'true') {
         return {
-            profile,
             status: 'skipped',
-            reason: 'install.offline is set and the profile is not in the cache',
+            reason: 'install.offline is set and the tooling is not in the cache',
             dir,
+            profiles: stamp?.profiles ?? [],
         };
     }
-    // The lock file lives in the profile directory, so the directory has to exist
+    // The lock file lives in the tooling directory, so the directory has to exist
     // before there is anything to lock. Creating it inside `withLock` would put
     // the creation itself outside the lock, which is the race it exists to close.
     try {
         node_fs_1.default.mkdirSync(dir, { recursive: true });
     }
     catch (err) {
-        return { profile, status: 'failed', reason: `cannot create ${dir}: ${err.message}` };
+        return {
+            status: 'failed',
+            reason: `cannot create ${dir}: ${err.message}`,
+            profiles: [],
+        };
     }
     const release = await (0, lock_1.withLock)(dir, install.waitTimeoutMs ?? 120000);
     if (!release) {
-        return { profile, status: 'failed', reason: `cannot write to ${dir}`, dir };
+        return { status: 'failed', reason: `cannot write to ${dir}`, dir, profiles: [] };
     }
     try {
         // Re-checked inside the lock: while we waited, the process we were waiting
         // for probably did the work. Without this, waiting is pointless — every
         // queued job would reinstall in turn.
-        if (isInstalled(dir, expected)) {
-            return { profile, status: 'cached', reason: 'installed by another process', dir };
+        if (holdsAll(dir, readStamp(dir), needed)) {
+            return {
+                status: 'cached',
+                reason: 'installed by another process',
+                dir,
+                profiles: readStamp(dir)?.profiles ?? [],
+            };
         }
-        return await runInstall(profile, source, dir, expected, opts);
+        return await runInstall(installing, manifest, dir, opts);
     }
     finally {
         release();
@@ -162,27 +240,34 @@ async function npmCi(dir, opts) {
     return { ok: false, detail: detail || `exit ${result.exitCode}` };
 }
 /** The fetch itself, once we hold the lock and know it is needed. */
-async function runInstall(profile, source, dir, expected, opts) {
+async function runInstall(profiles, manifest, dir, opts) {
     const started = Date.now();
-    stageManifest(source, dir);
-    const count = Object.keys(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, LOCKFILE), 'utf-8')).packages).length;
+    writeManifest(dir, manifest);
+    const named = profiles.join(', ');
+    const count = Object.keys(manifest.lockfile.packages).length - 1;
     // Always logged, never behind --debug: this is a security tool downloading
     // code at run time, and that must be visible in every CI log by default.
-    logger_1.logger.info(`[install]: 📦 fetching profile "${profile}" (${count} packages) → ${dir}`);
+    logger_1.logger.info(`[install]: 📦 fetching tooling for ${named} (${count} packages) → ${dir}`);
     try {
         const install = opts.installer ?? ((target) => npmCi(target, opts));
         const result = await install(dir);
         if (!result.ok) {
-            return { profile, status: 'failed', reason: `npm ci failed: ${result.detail}`, dir };
+            return { status: 'failed', reason: `npm ci failed: ${result.detail}`, dir, profiles: [] };
         }
-        node_fs_1.default.writeFileSync(stampPath(dir), expected);
+        const stamp = { hash: hashOf(manifest), profiles };
+        node_fs_1.default.writeFileSync(stampPath(dir), JSON.stringify(stamp));
         const durationMs = Date.now() - started;
-        logger_1.logger.info(`[install]: ✅ profile "${profile}" ready in ${(durationMs / 1000).toFixed(1)}s`);
-        return { profile, status: 'installed', reason: `${count} packages`, dir, durationMs };
+        logger_1.logger.info(`[install]: ✅ tooling ready in ${(durationMs / 1000).toFixed(1)}s (${named})`);
+        return { status: 'installed', reason: `${count} packages`, dir, profiles, durationMs };
     }
     catch (err) {
         // A timeout arrives here as a thrown error. It is a skip, not a crash: the
         // rest of the run is still worth doing, and the affected checks say why.
-        return { profile, status: 'failed', reason: `npm ci failed: ${err.message}`, dir };
+        return {
+            status: 'failed',
+            reason: `npm ci failed: ${err.message}`,
+            dir,
+            profiles: [],
+        };
     }
 }

package/dist/core/install/merge.d.ts

@@ -0,0 +1,47 @@
+/** The `package.json` half of a shipped profile manifest. */
+interface ProfilePkg {
+    dependencies?: Record<string, string>;
+    overrides?: Record<string, unknown>;
+}
+/** The `package-lock.json` half. Entries are opaque to us beyond their identity. */
+interface ProfileLock {
+    packages: Record<string, unknown>;
+}
+/** A manifest pair `npm ci` can be pointed at. */
+export interface MergedManifest {
+    pkg: object;
+    lockfile: object;
+}
+/**
+ * Merge several profile manifests into the one a single `npm ci` installs.
+ *
+ * This is what stops the tooling cache from paying for the same package twice.
+ * Installing each profile into its own directory leaves npm nothing to
+ * deduplicate: `commitlint` and `js` share 30 MB, and separate trees download
+ * both copies. One tree costs the union instead of the sum — measured at 213 MB
+ * against 234 for a JavaScript repository, where per-profile directories came to
+ * 267 (ticket 087).
+ *
+ * The merge is a union, not a resolution, and it never reaches the network. Every
+ * shipped manifest was cut out of our own `package-lock.json` at build time, so
+ * two profiles that both contain a package contain the *same* entry for it,
+ * byte for byte. That is the whole reason this is safe to do at run time on a
+ * client's machine.
+ *
+ * Which makes a disagreement impossible unless we broke the build — so it throws
+ * rather than picking a winner. Choosing silently would hand a client a tree
+ * neither profile was tested against, and the integrity hashes that make this
+ * design defensible would be describing something we never ran.
+ *
+ * @param profiles Directories holding the shipped manifests, in any order.
+ * @param read Injected by tests; defaults to reading the two files.
+ * @throws If two profiles disagree about a package, or a manifest cannot be read.
+ */
+export declare function mergeManifests(profiles: Array<{
+    name: string;
+    dir: string;
+}>, read?: (dir: string) => {
+    pkg: ProfilePkg;
+    lock: ProfileLock;
+}): MergedManifest;
+export {};

package/dist/core/install/merge.js

@@ -0,0 +1,91 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeManifests = mergeManifests;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const MERGED_NAME = 'pr-checkmate-tooling';
+const MERGED_VERSION = '1.0.0';
+/** Read a profile's shipped manifest pair from the installed package. */
+function readShippedManifest(dir) {
+    return {
+        pkg: JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, 'package.json'), 'utf-8')),
+        lock: JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, 'package-lock.json'), 'utf-8')),
+    };
+}
+/**
+ * Merge several profile manifests into the one a single `npm ci` installs.
+ *
+ * This is what stops the tooling cache from paying for the same package twice.
+ * Installing each profile into its own directory leaves npm nothing to
+ * deduplicate: `commitlint` and `js` share 30 MB, and separate trees download
+ * both copies. One tree costs the union instead of the sum — measured at 213 MB
+ * against 234 for a JavaScript repository, where per-profile directories came to
+ * 267 (ticket 087).
+ *
+ * The merge is a union, not a resolution, and it never reaches the network. Every
+ * shipped manifest was cut out of our own `package-lock.json` at build time, so
+ * two profiles that both contain a package contain the *same* entry for it,
+ * byte for byte. That is the whole reason this is safe to do at run time on a
+ * client's machine.
+ *
+ * Which makes a disagreement impossible unless we broke the build — so it throws
+ * rather than picking a winner. Choosing silently would hand a client a tree
+ * neither profile was tested against, and the integrity hashes that make this
+ * design defensible would be describing something we never ran.
+ *
+ * @param profiles Directories holding the shipped manifests, in any order.
+ * @param read Injected by tests; defaults to reading the two files.
+ * @throws If two profiles disagree about a package, or a manifest cannot be read.
+ */
+function mergeManifests(profiles, read = readShippedManifest) {
+    const dependencies = {};
+    const overrides = {};
+    const packages = {};
+    // Which profile first claimed a given key, so a conflict names both sides.
+    const claimedBy = new Map();
+    const claim = (kind, key, value, by, into) => {
+        const id = `${kind}:${key}`;
+        const seen = claimedBy.get(id);
+        if (seen === undefined) {
+            claimedBy.set(id, by);
+            into[key] = value;
+            return;
+        }
+        if (JSON.stringify(into[key]) !== JSON.stringify(value)) {
+            throw new Error(`profiles "${seen}" and "${by}" disagree about ${kind} "${key}" — ` +
+                'the shipped manifests are out of sync with our lockfile');
+        }
+    };
+    for (const { name, dir } of profiles) {
+        const { pkg, lock } = read(dir);
+        for (const [dep, version] of Object.entries(pkg.dependencies ?? {})) {
+            claim('dependency', dep, version, name, dependencies);
+        }
+        for (const [target, rule] of Object.entries(pkg.overrides ?? {})) {
+            claim('override', target, rule, name, overrides);
+        }
+        for (const [entryPath, entry] of Object.entries(lock.packages ?? {})) {
+            // The root entry describes the profile itself — its name, its direct
+            // dependencies. It is replaced by the merged root below, not merged: two
+            // profiles always "disagree" about it, and rightly so.
+            if (entryPath === '')
+                continue;
+            claim('package', entryPath, entry, name, packages);
+        }
+    }
+    const scoped = Object.keys(overrides).length > 0 ? { overrides } : {};
+    const root = { name: MERGED_NAME, version: MERGED_VERSION, dependencies, ...scoped };
+    return {
+        pkg: { ...root, private: true },
+        lockfile: {
+            name: MERGED_NAME,
+            version: MERGED_VERSION,
+            lockfileVersion: 3,
+            requires: true,
+            packages: { '': root, ...packages },
+        },
+    };
+}

package/dist/core/install/prepare.d.ts

@@ -5,12 +5,14 @@ import { type Profile } from './profiles';
 /**
  * Whether a profile needs fetching at all, or already ships inside the package.
  *
- * This is the hinge the whole adaptive-install rollout turns on. Today every
- * profile's packages sit in our `dependencies`, so every profile answers `true`
- * here, nothing is ever fetched, and a run is byte-for-byte the run it was
- * before any of this existed. When a package is moved out of `dependencies` it
- * stops being present, its profile starts answering `false`, and the fetch turns
- * itself on — no flag, no second code path, nothing to remember to flip.
+ * This is the hinge the whole adaptive-install rollout turns on. Nearly every
+ * profile's packages sit in our `dependencies`, so it answers `true`, nothing is
+ * fetched, and a run is byte-for-byte the run it was before any of this existed.
+ * `pytypes` is the exception that already proves the other half works: `pyright`
+ * is a devDependency, so it reaches no client and is fetched on demand. When a
+ * package is moved out of `dependencies` it stops being present, its profile
+ * starts answering `false`, and the fetch turns itself on — no flag, no second
+ * code path, nothing to remember to flip.
  *
  * Which is what makes releases 2 and 3 of ticket 064 an edit to `package.json`
  * rather than another change to this logic.
@@ -42,14 +44,13 @@ interface PrepareOptions {
      * The profile catalogue. Defaults to the shipped one; injected by tests.
      *
      * A seam rather than a mock of the module, for the same reason `ensure.ts` has
-     * one: every profile currently ships inside the package, so the interesting
-     * half of this function — a profile that is genuinely absent — is unreachable
-     * without either a network install in a unit test or a way to describe a
-     * profile that is not here. The code that runs when a package finally leaves
-     * `dependencies` must be tested before that day, not on it.
+     * one: nearly every profile ships inside the package, so the interesting half
+     * of this function — a profile that is genuinely absent — is otherwise reachable
+     * only through a network install in a unit test. The code that runs when a
+     * package leaves `dependencies` must be tested before that day, not on it.
      */
     profiles?: Profile[];
-    /** The fetch itself, forwarded to `ensureProfile`. Injected by tests. */
+    /** The fetch itself, forwarded to `ensureTooling`. Injected by tests. */
     installer?: EnsureOptions['installer'];
 }
 /**

package/dist/core/install/prepare.js

@@ -5,18 +5,19 @@ exports.prepareTooling = prepareTooling;
 exports.noTooling = noTooling;
 const logger_1 = require("../../utils/logger");
 const resolve_bin_1 = require("../../utils/resolve-bin");
-const cache_1 = require("./cache");
 const ensure_1 = require("./ensure");
 const profiles_1 = require("./profiles");
 /**
  * Whether a profile needs fetching at all, or already ships inside the package.
  *
- * This is the hinge the whole adaptive-install rollout turns on. Today every
- * profile's packages sit in our `dependencies`, so every profile answers `true`
- * here, nothing is ever fetched, and a run is byte-for-byte the run it was
- * before any of this existed. When a package is moved out of `dependencies` it
- * stops being present, its profile starts answering `false`, and the fetch turns
- * itself on — no flag, no second code path, nothing to remember to flip.
+ * This is the hinge the whole adaptive-install rollout turns on. Nearly every
+ * profile's packages sit in our `dependencies`, so it answers `true`, nothing is
+ * fetched, and a run is byte-for-byte the run it was before any of this existed.
+ * `pytypes` is the exception that already proves the other half works: `pyright`
+ * is a devDependency, so it reaches no client and is fetched on demand. When a
+ * package is moved out of `dependencies` it stops being present, its profile
+ * starts answering `false`, and the fetch turns itself on — no flag, no second
+ * code path, nothing to remember to flip.
  *
  * Which is what makes releases 2 and 3 of ticket 064 an edit to `package.json`
  * rather than another change to this logic.
@@ -77,23 +78,10 @@ async function prepareTooling(opts) {
         for (const check of profile.checks)
             unavailable.set(check, reason);
     };
-    // Resolved lazily, and at most once.
-    //
-    // Lazily because resolving is not a read: it creates the directory and, when the
-    // configured one is unwritable, warns about where fetched tooling will live
-    // instead. On a run that fetches nothing — every run, while the tooling still
-    // ships in `dependencies` — that warning is about a thing that never happens,
-    // and a container with a read-only home would print it on every single run.
-    // At most once because the warning belongs to the run, not to each profile.
-    let location;
-    const cacheDir = () => {
-        if (location === undefined)
-            location = (0, cache_1.resolveCacheDir)(opts.version, install.cacheDir);
-        return location;
-    };
+    const toFetch = [];
     for (const profile of wanted) {
-        // Bundled tooling is the answer to "where is it" for every profile today,
-        // and asking first is what keeps this whole path free of network calls.
+        // Bundled tooling is the answer to "where is it" for most profiles, and
+        // asking first is what keeps this whole path free of network calls.
         if (profileSatisfiedLocally(profile))
             continue;
         const block = denied(profile, deny);
@@ -101,30 +89,38 @@ async function prepareTooling(opts) {
             miss(profile, block);
             continue;
         }
-        // No early exit for `install.strategy: "manual"` any more. It means "never
-        // fetch", and `ensureProfile` enforces that — but only after checking the
-        // cache, so a pre-warmed profile is still used. Returning here instead
-        // meant `manual` also refused tooling that was already downloaded.
+        // No early exit for `install.strategy: "manual"`. It means "never fetch",
+        // and `ensureTooling` enforces that — but only after checking the cache, so
+        // pre-warmed tooling is still used. Returning here instead meant `manual`
+        // also refused tooling that was already downloaded.
         if (onMissing === 'skip') {
             miss(profile, 'install.onMissingTool is "skip"');
             continue;
         }
-        const cache = cacheDir();
-        if (!cache) {
-            miss(profile, 'no writable cache directory for fetched tooling');
-            continue;
-        }
-        const result = await (0, ensure_1.ensureProfile)(profile.name, {
+        toFetch.push(profile);
+    }
+    // One call, one directory, one lock — for the whole run rather than per profile.
+    // Profiles overlap heavily, and a tree each made the client download the shared
+    // half once per profile that named it (ticket 087).
+    //
+    // Reached only when something actually needs fetching, which is also what keeps
+    // the cache directory untouched otherwise: resolving it is not a read — it
+    // creates the directory and warns when the configured path is unwritable, and a
+    // container with a read-only home would print that on every single run.
+    if (toFetch.length > 0) {
+        const result = await (0, ensure_1.ensureTooling)(toFetch.map(profile => profile.name), {
             cwd: opts.cwd,
             version: opts.version,
             install,
             ...(opts.installer ? { installer: opts.installer } : {}),
         });
         if (result.status === 'failed' || result.status === 'skipped') {
-            miss(profile, result.reason);
-            continue;
+            for (const profile of toFetch)
+                miss(profile, result.reason);
+        }
+        else if (result.dir) {
+            dirs.push(result.dir);
         }
-        dirs.push(result.dir ?? (0, cache_1.profileDir)(cache.dir, profile.name));
     }
     if (unavailable.size > 0) {
         // Always logged, never behind --debug. A check that did not run is the

package/dist/core/registry.js

@@ -37,6 +37,7 @@ const dead_code_1 = require("./checks/quality/dead-code");
 const duplicate_check_1 = require("./checks/quality/duplicate-check");
 const license_header_1 = require("./checks/quality/license-header");
 const markdown_lint_1 = require("./checks/quality/markdown-lint");
+const package_size_1 = require("./checks/quality/package-size");
 const spellcheck_1 = require("./checks/quality/spellcheck");
 const symlinks_1 = require("./checks/quality/symlinks");
 const yaml_lint_1 = require("./checks/quality/yaml-lint");
@@ -90,6 +91,7 @@ exports.REGISTRY = [
     spellcheck_1.spellcheckCheck,
     yaml_lint_1.yamlLintCheck,
     symlinks_1.symlinksCheck,
+    package_size_1.packageSizeCheck,
     python_lint_1.pythonLintCheck,
     python_typecheck_1.pythonTypecheckCheck,
     dead_code_1.deadCodeCheck,

package/dist/interfaces/index.d.ts

@@ -180,6 +180,11 @@ export interface PRCheckMateConfig {
         typecheck?: boolean;
         typeChecker?: 'mypy' | 'pyright';
     };
+    packageSize?: {
+        enabled?: boolean;
+        maxGrowthPercent?: number;
+        compareWith?: string;
+    };
     diffSmell?: {
         enabled?: boolean;
         ignorePaths?: string[];