pr-checkmate 3.1.0 → 3.2.1

package/dist/cjs/core/checks/dependencies/grype-scan.d.ts

@@ -1,3 +1,4 @@
+import type { GrypeScanEnvOverrides, PRCheckMateConfig } from '../../../interfaces/index.js';
 import { Check } from '../../types.js';
 /**
  * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
@@ -19,4 +20,11 @@ import { Check } from '../../types.js';
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+export declare function resolveGrypeScan(config: PRCheckMateConfig['grypeScan'], env?: NodeJS.ProcessEnv): GrypeScanEnvOverrides;
 export declare const grypeScanCheck: Check;

package/dist/cjs/core/checks/dependencies/grype-scan.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.grypeScanCheck = void 0;
+exports.resolveGrypeScan = resolveGrypeScan;
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
 const types_js_1 = require("../../types.js");
@@ -43,17 +44,30 @@ function severityRank(severity) {
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+function resolveGrypeScan(config, env = process.env) {
+    const { ci, local, ...base } = config ?? {};
+    const overrides = ((0, index_js_1.isCiEnvironment)(env) ? ci : local) ?? {};
+    const defined = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));
+    return { ...base, ...defined };
+}
 exports.grypeScanCheck = {
     name: 'Grype Scan',
     phase: 'informational',
     weight: 'heavy',
     applies(ctx) {
-        return ctx.config.grypeScan?.enabled !== false;
+        return resolveGrypeScan(ctx.config.grypeScan).enabled !== false;
     },
     async run(ctx) {
-        const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
+        const settings = resolveGrypeScan(ctx.config.grypeScan);
+        const minSeverity = (settings.minSeverity ?? 'medium').toLowerCase();
         const minRank = severityRank(minSeverity);
-        const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
+        const ignore = (settings.ignore ?? []).map(s => s.toLowerCase());
         // Never walk `ignoreDirs` — the same contract every other check honours, and
         // here it is the difference between a usable check and an unusable one. A bare
         // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
@@ -61,7 +75,7 @@ exports.grypeScanCheck = {
         // findings: grype resolves package versions from the lockfile, and installed
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
-        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         const result = await (0, execa_js_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,

package/dist/cjs/core/checks/languages/go-format.js

@@ -1,37 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -69,7 +36,7 @@ const GO_GLOBS = ['*.go'];
 async function loadBundledGofmt() {
     try {
         const entry = (0, index_js_1.resolvePackageBin)('@wasm-fmt/gofmt', 'gofmt_node.js');
-        const mod = (await Promise.resolve(`${(0, node_url_1.pathToFileURL)(entry).href}`).then(s => __importStar(require(s))));
+        const mod = (await import((0, node_url_1.pathToFileURL)(entry).href));
         return mod.format;
     }
     catch (err) {

package/dist/cjs/core/checks/quality/markdown-lint.js

@@ -5,10 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.markdownLintCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
 const index_js_1 = require("../../../config/index.js");
-const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
 const targets_js_1 = require("../../targets.js");
 const types_js_1 = require("../../types.js");
@@ -24,12 +23,66 @@ function loadUserMarkdownConfig(cwd) {
         return {};
     }
 }
-function buildMergedConfig(bundledConfigPath, userRules) {
-    const bundled = JSON.parse(node_fs_1.default.readFileSync(bundledConfigPath, 'utf-8'));
-    const merged = { ...bundled, ...userRules };
-    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.markdownlint-merged-${process.pid}.json`);
-    node_fs_1.default.writeFileSync(tmpFile, JSON.stringify(merged, null, 2));
-    return tmpFile;
+/**
+ * Load the markdownlint library, or `null` when it cannot be found.
+ *
+ * The library rather than `markdownlint-cli2`: the CLI drags in globby →
+ * micromatch → braces, which carries an unpatched advisory every client's
+ * `npm audit` then reports against pr-checkmate. We already have the file list
+ * from git, so the CLI's globbing bought nothing.
+ *
+ * Resolved through `resolvePackageBin` and loaded by a dynamic `import()` for the
+ * same two reasons as the bundled gofmt: the package may live in a fetched
+ * profile directory, and it is ESM while we emit CommonJS.
+ */
+async function loadMarkdownlint() {
+    try {
+        const promiseEntry = (0, index_js_2.resolvePackageBin)('markdownlint', 'lib/exports-promise.mjs');
+        const mainEntry = node_path_1.default.join(node_path_1.default.dirname(promiseEntry), 'exports.mjs');
+        const promise = (await import((0, node_url_1.pathToFileURL)(promiseEntry).href));
+        const main = (await import((0, node_url_1.pathToFileURL)(mainEntry).href));
+        return { lint: promise.lint, readConfig: promise.readConfig, applyFixes: main.applyFixes };
+    }
+    catch (err) {
+        index_js_2.logger.warn(`[Markdown]: ⚠️ markdownlint could not be loaded\n${err}`);
+        return null;
+    }
+}
+/**
+ * The rules to lint with: the repository's own config when it has one, ours
+ * (plus the client's `markdownlint.rules`) when it does not. Someone with a
+ * `.markdownlint.json` has an opinion; merging ours into it would silently
+ * override the rules they wrote.
+ */
+async function readLintConfig(lib, cwd, userRules) {
+    const local = ['.markdownlint.json', '.markdownlint.jsonc'].find(name => (0, index_js_1.hasLocalConfig)([name], cwd));
+    if (local)
+        return lib.readConfig(node_path_1.default.join(cwd, local));
+    if ((0, index_js_1.hasLocalConfig)(['.markdownlint.yaml', '.markdownlint.yml'], cwd)) {
+        index_js_2.logger.warn('[Markdown]: ⚠️ YAML markdownlint configs are not supported, using bundled rules');
+    }
+    const bundled = await lib.readConfig((0, index_js_1.getPackageConfigPath)('.markdownlint.json'));
+    return { ...bundled, ...userRules };
+}
+/**
+ * An ignore pattern as a regular expression over a repo-relative path.
+ *
+ * A bare directory name excludes its contents; a file name matches exactly; `*`
+ * stays within a segment and `**` crosses them. `path.extname` is what tells a
+ * directory from a file, and it reads a leading dot as part of the name, so
+ * `.claude` is still the directory it is.
+ */
+function toIgnoreRegExp(pattern) {
+    const clean = pattern.replace(/\/+$/, '');
+    const escaped = clean
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*\//g, '\u0001')
+        .replace(/\*\*/g, '\u0000')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0001/g, '(?:.*/)?')
+        .replace(/\u0000/g, '.*');
+    const isDir = !clean.includes('*') && !node_path_1.default.extname(clean);
+    return new RegExp(`^${escaped}${isDir ? '(/.*)?' : ''}$`);
 }
 exports.markdownLintCheck = {
     name: 'Markdown',
@@ -45,23 +98,10 @@ exports.markdownLintCheck = {
             return (0, types_js_1.skip)('no markdown files');
         const userConfig = loadUserMarkdownConfig(ctx.cwd);
         const userRules = userConfig.rules ?? {};
-        let tempConfigFile = null;
-        let configArg;
-        if ((0, index_js_1.hasLocalConfig)(['.markdownlint.json', '.markdownlint.jsonc', '.markdownlint.yaml', '.markdownlint.yml'], ctx.cwd)) {
-            configArg = [];
-        }
-        else {
-            const bundledConfig = (0, index_js_1.getPackageConfigPath)('.markdownlint.json');
-            if (Object.keys(userRules).length > 0) {
-                tempConfigFile = buildMergedConfig(bundledConfig, userRules);
-                configArg = ['--config', tempConfigFile];
-            }
-            else {
-                configArg = ['--config', bundledConfig];
-            }
-        }
-        const markdownlintBin = (0, index_js_2.resolvePackageBin)('markdownlint-cli2', 'markdownlint-cli2-bin.mjs');
-        const defaultIgnorePatterns = [
+        const lib = await loadMarkdownlint();
+        if (!lib)
+            return (0, types_js_1.warn)('markdownlint failed to run (exit 2) — check the markdownlint config');
+        const ignores = [
             'node_modules/**',
             'dist/**',
             'coverage/**',
@@ -70,41 +110,38 @@ exports.markdownLintCheck = {
             // Release-tool output, not prose anyone edits — see GENERATED_DOC_FILES.
             ...index_js_1.GENERATED_DOC_FILES,
             ...(userConfig.ignores ?? []),
-        ];
-        // markdownlint-cli2 has no --ignore-path flag; exclusions are expressed as
-        // negated globs (`#pattern`). A bare directory name also needs `#name/**`
-        // to exclude its contents — but a filename does not, and `#CHANGELOG.md/**`
-        // is a glob that can never match. `path.extname` is what tells them apart,
-        // and it reads a leading dot as part of the name, so `.claude` is still
-        // treated as the directory it is.
-        const ignoreGlobs = defaultIgnorePatterns.flatMap(pattern => {
-            const clean = pattern.replace(/\/+$/, '');
-            const globs = [`#${clean}`];
-            if (!clean.includes('*') && !node_path_1.default.extname(clean))
-                globs.push(`#${clean}/**`);
-            return globs;
-        });
-        const args = [...(ctx.write ? ['--fix'] : []), ...targets, ...ignoreGlobs, ...configArg];
+        ].map(toIgnoreRegExp);
+        const files = targets.filter(file => !ignores.some(re => re.test(file)));
+        if (files.length === 0)
+            return (0, types_js_1.skip)('no markdown files');
         try {
-            const result = await (0, execa_js_1.execa)(process.execPath, [markdownlintBin, ...args], {
-                cwd: ctx.cwd,
-                reject: false,
-                stdio: 'inherit',
-            });
-            if (result.exitCode === 0)
-                return (0, types_js_1.pass)();
-            // markdownlint-cli2 exits 1 for lint findings and 2 when it could not run
-            // (an unreadable config, a bad glob). Reporting the latter as "markdown lint
-            // issues found" names the wrong cause — and under `severity: error` it
-            // becomes a gate on a tooling problem.
-            if (result.exitCode === 2) {
-                return (0, types_js_1.warn)('markdownlint failed to run (exit 2) — check the markdownlint config');
+            const config = await readLintConfig(lib, ctx.cwd, userRules);
+            const results = await lib.lint({ files: files.map(f => node_path_1.default.resolve(ctx.cwd, f)), config });
+            let findings = 0;
+            for (const [file, errors] of Object.entries(results)) {
+                if (errors.length === 0)
+                    continue;
+                const rel = node_path_1.default.relative(ctx.cwd, file);
+                let remaining = errors;
+                if (ctx.write && errors.some(e => e.fixInfo)) {
+                    const fixed = lib.applyFixes(node_fs_1.default.readFileSync(file, 'utf-8'), errors);
+                    node_fs_1.default.writeFileSync(file, fixed);
+                    remaining = errors.filter(e => !e.fixInfo);
+                }
+                for (const e of remaining) {
+                    findings++;
+                    const col = e.errorRange?.[0] ? `:${e.errorRange[0]}` : '';
+                    index_js_2.logger.warn(`${rel}:${e.lineNumber}${col} ${e.ruleNames.join('/')} ${e.ruleDescription}` +
+                        (e.errorDetail ? ` [${e.errorDetail}]` : ''));
+                }
             }
-            return (0, types_js_1.warn)('markdown lint issues found');
+            return findings === 0 ? (0, types_js_1.pass)() : (0, types_js_1.warn)('markdown lint issues found');
         }
-        finally {
-            if (tempConfigFile && node_fs_1.default.existsSync(tempConfigFile))
-                node_fs_1.default.unlinkSync(tempConfigFile);
+        catch (err) {
+            // An unreadable config or a file that vanished: the tool could not run,
+            // which is not the same claim as "the prose has problems".
+            index_js_2.logger.warn(`[Markdown]: ⚠️ ${err}`);
+            return (0, types_js_1.warn)('markdownlint failed to run (exit 2) — check the markdownlint config');
         }
     },
 };

package/dist/cjs/core/install/profiles.js

@@ -91,7 +91,7 @@ exports.PROFILES = [
     },
     {
         name: 'markdown',
-        packages: ['markdownlint-cli2'],
+        packages: ['markdownlint'],
         checks: ['Markdown'],
     },
     {

package/dist/cjs/interfaces/index.d.ts

@@ -369,6 +369,13 @@ export interface PRCheckMateConfig {
          * can never stall a commit.
          */
         timeoutMs?: number;
+        /**
+         * Overrides applied only on a CI build (see `isCiEnvironment`). Any key set here wins
+         * over the top-level value, so CI can keep the scan while local runs turn it off.
+         */
+        ci?: GrypeScanEnvOverrides;
+        /** Same as `ci`, applied only outside CI (a developer's machine, `be-commit`, hooks). */
+        local?: GrypeScanEnvOverrides;
     };
     bannedImports?: Array<{
         name: string;
@@ -430,3 +437,10 @@ export interface PRCheckMateConfig {
 }
 export type { CheckStatus, CheckResult } from '../utils/result-collector.js';
 export type { Language } from '../utils/detect-language.js';
+/** Per-environment overrides for `grypeScan`: the subset of its settings that may differ by environment. */
+export interface GrypeScanEnvOverrides {
+    enabled?: boolean;
+    minSeverity?: 'negligible' | 'low' | 'medium' | 'high' | 'critical';
+    ignore?: string[];
+    timeoutMs?: number;
+}

package/dist/cjs/utils/execa.js

@@ -1,37 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.execa = execa;
 /**
@@ -41,6 +8,6 @@ exports.execa = execa;
  * this package — all of which await the result and read it synchronously.
  */
 async function execa(file, args, options) {
-    const { execa: run } = await Promise.resolve().then(() => __importStar(require('execa')));
+    const { execa: run } = await import('execa');
     return (await run(file, args, options));
 }

package/dist/esm/core/checks/dependencies/grype-scan.d.ts

@@ -1,3 +1,4 @@
+import type { GrypeScanEnvOverrides, PRCheckMateConfig } from '../../../interfaces/index.js';
 import { Check } from '../../types.js';
 /**
  * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
@@ -19,4 +20,11 @@ import { Check } from '../../types.js';
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+export declare function resolveGrypeScan(config: PRCheckMateConfig['grypeScan'], env?: NodeJS.ProcessEnv): GrypeScanEnvOverrides;
 export declare const grypeScanCheck: Check;

package/dist/esm/core/checks/dependencies/grype-scan.js

@@ -1,5 +1,5 @@
 import { execa } from '../../../utils/execa.js';
-import { collectDirectDeps, logger, normalizeName } from '../../../utils/index.js';
+import { collectDirectDeps, isCiEnvironment, logger, normalizeName, } from '../../../utils/index.js';
 import { pass, skip, warn } from '../../types.js';
 import { notInstalled } from '../tool-install.js';
 const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
@@ -40,17 +40,30 @@ function severityRank(severity) {
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+export function resolveGrypeScan(config, env = process.env) {
+    const { ci, local, ...base } = config ?? {};
+    const overrides = (isCiEnvironment(env) ? ci : local) ?? {};
+    const defined = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));
+    return { ...base, ...defined };
+}
 export const grypeScanCheck = {
     name: 'Grype Scan',
     phase: 'informational',
     weight: 'heavy',
     applies(ctx) {
-        return ctx.config.grypeScan?.enabled !== false;
+        return resolveGrypeScan(ctx.config.grypeScan).enabled !== false;
     },
     async run(ctx) {
-        const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
+        const settings = resolveGrypeScan(ctx.config.grypeScan);
+        const minSeverity = (settings.minSeverity ?? 'medium').toLowerCase();
         const minRank = severityRank(minSeverity);
-        const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
+        const ignore = (settings.ignore ?? []).map(s => s.toLowerCase());
         // Never walk `ignoreDirs` — the same contract every other check honours, and
         // here it is the difference between a usable check and an unusable one. A bare
         // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
@@ -58,7 +71,7 @@ export const grypeScanCheck = {
         // findings: grype resolves package versions from the lockfile, and installed
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
-        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         const result = await execa('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,

package/dist/esm/core/checks/quality/markdown-lint.js

@@ -1,8 +1,7 @@
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { GENERATED_DOC_FILES, getPackageConfigPath, hasLocalConfig, } from '../../../config/index.js';
-import { execa } from '../../../utils/execa.js';
 import { logger, resolvePackageBin } from '../../../utils/index.js';
 import { resolveTargetFiles } from '../../targets.js';
 import { pass, warn, skip } from '../../types.js';
@@ -18,12 +17,66 @@ function loadUserMarkdownConfig(cwd) {
         return {};
     }
 }
-function buildMergedConfig(bundledConfigPath, userRules) {
-    const bundled = JSON.parse(fs.readFileSync(bundledConfigPath, 'utf-8'));
-    const merged = { ...bundled, ...userRules };
-    const tmpFile = path.join(os.tmpdir(), `.markdownlint-merged-${process.pid}.json`);
-    fs.writeFileSync(tmpFile, JSON.stringify(merged, null, 2));
-    return tmpFile;
+/**
+ * Load the markdownlint library, or `null` when it cannot be found.
+ *
+ * The library rather than `markdownlint-cli2`: the CLI drags in globby →
+ * micromatch → braces, which carries an unpatched advisory every client's
+ * `npm audit` then reports against pr-checkmate. We already have the file list
+ * from git, so the CLI's globbing bought nothing.
+ *
+ * Resolved through `resolvePackageBin` and loaded by a dynamic `import()` for the
+ * same two reasons as the bundled gofmt: the package may live in a fetched
+ * profile directory, and it is ESM while we emit CommonJS.
+ */
+async function loadMarkdownlint() {
+    try {
+        const promiseEntry = resolvePackageBin('markdownlint', 'lib/exports-promise.mjs');
+        const mainEntry = path.join(path.dirname(promiseEntry), 'exports.mjs');
+        const promise = (await import(pathToFileURL(promiseEntry).href));
+        const main = (await import(pathToFileURL(mainEntry).href));
+        return { lint: promise.lint, readConfig: promise.readConfig, applyFixes: main.applyFixes };
+    }
+    catch (err) {
+        logger.warn(`[Markdown]: ⚠️ markdownlint could not be loaded\n${err}`);
+        return null;
+    }
+}
+/**
+ * The rules to lint with: the repository's own config when it has one, ours
+ * (plus the client's `markdownlint.rules`) when it does not. Someone with a
+ * `.markdownlint.json` has an opinion; merging ours into it would silently
+ * override the rules they wrote.
+ */
+async function readLintConfig(lib, cwd, userRules) {
+    const local = ['.markdownlint.json', '.markdownlint.jsonc'].find(name => hasLocalConfig([name], cwd));
+    if (local)
+        return lib.readConfig(path.join(cwd, local));
+    if (hasLocalConfig(['.markdownlint.yaml', '.markdownlint.yml'], cwd)) {
+        logger.warn('[Markdown]: ⚠️ YAML markdownlint configs are not supported, using bundled rules');
+    }
+    const bundled = await lib.readConfig(getPackageConfigPath('.markdownlint.json'));
+    return { ...bundled, ...userRules };
+}
+/**
+ * An ignore pattern as a regular expression over a repo-relative path.
+ *
+ * A bare directory name excludes its contents; a file name matches exactly; `*`
+ * stays within a segment and `**` crosses them. `path.extname` is what tells a
+ * directory from a file, and it reads a leading dot as part of the name, so
+ * `.claude` is still the directory it is.
+ */
+function toIgnoreRegExp(pattern) {
+    const clean = pattern.replace(/\/+$/, '');
+    const escaped = clean
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*\//g, '\u0001')
+        .replace(/\*\*/g, '\u0000')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0001/g, '(?:.*/)?')
+        .replace(/\u0000/g, '.*');
+    const isDir = !clean.includes('*') && !path.extname(clean);
+    return new RegExp(`^${escaped}${isDir ? '(/.*)?' : ''}$`);
 }
 export const markdownLintCheck = {
     name: 'Markdown',
@@ -39,23 +92,10 @@ export const markdownLintCheck = {
             return skip('no markdown files');
         const userConfig = loadUserMarkdownConfig(ctx.cwd);
         const userRules = userConfig.rules ?? {};
-        let tempConfigFile = null;
-        let configArg;
-        if (hasLocalConfig(['.markdownlint.json', '.markdownlint.jsonc', '.markdownlint.yaml', '.markdownlint.yml'], ctx.cwd)) {
-            configArg = [];
-        }
-        else {
-            const bundledConfig = getPackageConfigPath('.markdownlint.json');
-            if (Object.keys(userRules).length > 0) {
-                tempConfigFile = buildMergedConfig(bundledConfig, userRules);
-                configArg = ['--config', tempConfigFile];
-            }
-            else {
-                configArg = ['--config', bundledConfig];
-            }
-        }
-        const markdownlintBin = resolvePackageBin('markdownlint-cli2', 'markdownlint-cli2-bin.mjs');
-        const defaultIgnorePatterns = [
+        const lib = await loadMarkdownlint();
+        if (!lib)
+            return warn('markdownlint failed to run (exit 2) — check the markdownlint config');
+        const ignores = [
             'node_modules/**',
             'dist/**',
             'coverage/**',
@@ -64,41 +104,38 @@ export const markdownLintCheck = {
             // Release-tool output, not prose anyone edits — see GENERATED_DOC_FILES.
             ...GENERATED_DOC_FILES,
             ...(userConfig.ignores ?? []),
-        ];
-        // markdownlint-cli2 has no --ignore-path flag; exclusions are expressed as
-        // negated globs (`#pattern`). A bare directory name also needs `#name/**`
-        // to exclude its contents — but a filename does not, and `#CHANGELOG.md/**`
-        // is a glob that can never match. `path.extname` is what tells them apart,
-        // and it reads a leading dot as part of the name, so `.claude` is still
-        // treated as the directory it is.
-        const ignoreGlobs = defaultIgnorePatterns.flatMap(pattern => {
-            const clean = pattern.replace(/\/+$/, '');
-            const globs = [`#${clean}`];
-            if (!clean.includes('*') && !path.extname(clean))
-                globs.push(`#${clean}/**`);
-            return globs;
-        });
-        const args = [...(ctx.write ? ['--fix'] : []), ...targets, ...ignoreGlobs, ...configArg];
+        ].map(toIgnoreRegExp);
+        const files = targets.filter(file => !ignores.some(re => re.test(file)));
+        if (files.length === 0)
+            return skip('no markdown files');
         try {
-            const result = await execa(process.execPath, [markdownlintBin, ...args], {
-                cwd: ctx.cwd,
-                reject: false,
-                stdio: 'inherit',
-            });
-            if (result.exitCode === 0)
-                return pass();
-            // markdownlint-cli2 exits 1 for lint findings and 2 when it could not run
-            // (an unreadable config, a bad glob). Reporting the latter as "markdown lint
-            // issues found" names the wrong cause — and under `severity: error` it
-            // becomes a gate on a tooling problem.
-            if (result.exitCode === 2) {
-                return warn('markdownlint failed to run (exit 2) — check the markdownlint config');
+            const config = await readLintConfig(lib, ctx.cwd, userRules);
+            const results = await lib.lint({ files: files.map(f => path.resolve(ctx.cwd, f)), config });
+            let findings = 0;
+            for (const [file, errors] of Object.entries(results)) {
+                if (errors.length === 0)
+                    continue;
+                const rel = path.relative(ctx.cwd, file);
+                let remaining = errors;
+                if (ctx.write && errors.some(e => e.fixInfo)) {
+                    const fixed = lib.applyFixes(fs.readFileSync(file, 'utf-8'), errors);
+                    fs.writeFileSync(file, fixed);
+                    remaining = errors.filter(e => !e.fixInfo);
+                }
+                for (const e of remaining) {
+                    findings++;
+                    const col = e.errorRange?.[0] ? `:${e.errorRange[0]}` : '';
+                    logger.warn(`${rel}:${e.lineNumber}${col} ${e.ruleNames.join('/')} ${e.ruleDescription}` +
+                        (e.errorDetail ? ` [${e.errorDetail}]` : ''));
+                }
             }
-            return warn('markdown lint issues found');
+            return findings === 0 ? pass() : warn('markdown lint issues found');
         }
-        finally {
-            if (tempConfigFile && fs.existsSync(tempConfigFile))
-                fs.unlinkSync(tempConfigFile);
+        catch (err) {
+            // An unreadable config or a file that vanished: the tool could not run,
+            // which is not the same claim as "the prose has problems".
+            logger.warn(`[Markdown]: ⚠️ ${err}`);
+            return warn('markdownlint failed to run (exit 2) — check the markdownlint config');
         }
     },
 };

package/dist/esm/core/install/profiles.js

@@ -86,7 +86,7 @@ export const PROFILES = [
     },
     {
         name: 'markdown',
-        packages: ['markdownlint-cli2'],
+        packages: ['markdownlint'],
         checks: ['Markdown'],
     },
     {