pr-checkmate 3.2.2 → 3.3.0

package/.eslintrc.js

@@ -41,7 +41,7 @@ module.exports = {
     sourceType: 'module',
     project: './tsconfig.json',
   },
-  plugins: ['@typescript-eslint', 'prettier', 'import-x', 'jsdoc'],
+  plugins: ['@typescript-eslint', 'prettier', 'simple-import-sort', 'jsdoc'],
   extends: [
     'eslint:recommended',
     'plugin:@typescript-eslint/recommended',
@@ -85,14 +85,8 @@ module.exports = {
     // Complexity analysis (#61)
     complexity: ['warn', 30],
     // Import ordering (#65)
-    'import-x/order': [
-      'warn',
-      {
-        groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
-        alphabetize: { order: 'asc', caseInsensitive: true },
-      },
-    ],
-    'import-x/no-duplicates': 'error',
+    'simple-import-sort/imports': 'warn',
+    'no-duplicate-imports': ['error', { allowSeparateTypeImports: true }],
     // Documentation (#62). `jsdoc/require-jsdoc` is deliberately absent — see the
     // note in eslint-flat-config.mjs. These three check docblocks that exist and
     // fix only inside them; they never fabricate one.

package/README.md

@@ -72,7 +72,7 @@ tool installed; the check skips gracefully when the tool is absent.
 | Language | Checks | Toolchain |
 |---|---|---|
 | TypeScript / JavaScript | ESLint, Prettier, `tsc --noEmit` | Bundled |
-| Python | Ruff (lint + format), mypy/pyright (types) | Bundled — Ruff, and pyright for types; the runner's own mypy is preferred when it has one |
+| Python | Ruff (lint + format), mypy/pyright (types) | Fetched on first use — Ruff, and pyright for types; the runner's own mypy is preferred when it has one |
 | C++ | clang-format | Bundled |
 | Swift | SwiftLint | `swiftlint` on the runner |
 | Kotlin / Java | ktlint | `ktlint` on the runner |

package/dist/cjs/cli.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const loader_js_1 = require("./config/loader.js");
 const commands_js_1 = require("./core/commands.js");
 const index_js_1 = require("./core/index.js");
 const doctor_js_1 = require("./core/install/doctor.js");
+const grype_db_js_1 = require("./core/install/grype-db.js");
 const init_js_1 = require("./init.js");
 const index_js_2 = require("./utils/index.js");
 const argv = process.argv.slice(2);
@@ -90,6 +92,17 @@ void (async () => {
             for (const result of failed) {
                 index_js_2.logger.error(`[install]: ❌ ${result.profiles.join(', ') || 'tooling'}: ${result.reason}`);
             }
+            // Warm grype's vulnerability database too, with no time cap: the download is
+            // hundreds of MB and the scan itself would only be allowed a couple of minutes.
+            // Best-effort — an absent grype or a failed download is a warning, not a
+            // failed install, since Grype Scan skips cleanly without it.
+            if ((0, loader_js_1.loadProjectConfig)().grypeScan?.enabled !== false) {
+                const why = await (0, grype_db_js_1.ensureGrypeDb)(process.cwd());
+                if (why && why !== 'ENOENT')
+                    index_js_2.logger.warn(`[install]: ⚠️ grype: ${why}`);
+                else if (!why)
+                    index_js_2.logger.info('[install]: grype vulnerability database is up to date');
+            }
             process.exit(failed.length > 0 ? 1 : 0);
         }
         if (cmd === 'doctor') {

package/dist/cjs/config/pr-checkmate.template.json

@@ -0,0 +1,393 @@
+{
+  "$schema": "https://raw.githubusercontent.com/Mybono/pr_checkmate_public/main/pr-checkmate.schema.json",
+  "//": "PR CheckMate configuration template. Place this file at your repository root as 'pr-checkmate.json'. Every value below is the built-in DEFAULT — delete any block you do not want to change, because the file is deep-merged with the defaults. Keys starting with '//' are comments and are ignored. Full per-check reference: https://github.com/Mybono/pr_checkmate_public",
+  "//excludePaths": "FILES AND FOLDERS NO CHECK EVER LOOKS AT, as globs: \"src/generated/**\" for a whole folder, \"vendor/legacy.ts\" for one file. Applied where every check gets its file list, so the rule is written once rather than per check. Use this before reaching for a per-check ignore; use 'ignoreDirs' only when you mean a directory NAME wherever it appears.",
+  "excludePaths": [],
+  "//1-scope": "WHERE CHECKS LOOK. 'sourcePath' may be a string or an array. 'ignoreDirs' REPLACES the default ignore list rather than extending it, so copy the defaults you still want — the defaults cover build output, dependency and report directories, plus generated 'graphify-out'. Test directories are deliberately NOT in it: test code is still linted, type-checked and formatted, and is excluded per-check where it is noise (see 'duplicate', 'deadCode', 'diffSecurity' and the bundled cspell ignores).",
+  "sourcePath": ".",
+  "//2-severity": "UNIVERSAL ON/OFF SWITCH, keyed by a check's DISPLAY NAME (see //check-names below). 'off' removes the check before it runs; 'error' promotes a warning to a failure; 'warn' demotes a failure to a warning. This works for every check, including those with no 'enabled' flag of their own.",
+  "severity": {},
+  "//check-names": [
+    "Banned Imports",
+    "Circular Deps",
+    "Dependencies",
+    "Grype Scan",
+    "License Check",
+    "NPM Audit",
+    "Outdated Deps",
+    "Vuln Scan",
+    "Custom Rules",
+    "Diff Smells",
+    "Large Files",
+    "Leftover Debug",
+    "Lockfile Drift",
+    "Merge Conflict",
+    "Missing Tests",
+    "TODO/FIXME",
+    "ESLint",
+    "TypeScript",
+    "Prettier",
+    "Ruff Lint",
+    "Ruff Format",
+    "Python Types",
+    "C++ Format",
+    "SwiftLint",
+    "ktlint",
+    "Go Vet",
+    "Go Format",
+    "Clippy",
+    "Rustfmt",
+    "C# Format",
+    "RuboCop",
+    "PHP CS Fixer",
+    "Commitlint",
+    "PR Body",
+    "PR Size",
+    "PR Title",
+    "Case Collision",
+    "Config Validation",
+    "Coverage",
+    "Dead Code",
+    "Duplicate Code",
+    "License Header",
+    "Markdown",
+    "Spellcheck",
+    "YAML Lint",
+    "Broken Symlinks",
+    "ShellCheck",
+    "Security Scan",
+    "Diff Security",
+    "Dockerfile Security",
+    "Migration Safety",
+    "Sensitive Files",
+    "Workflow Security"
+  ],
+  "//3-security": "Secret scanning and dependency vulnerabilities.",
+  "security": {
+    "gitleaks": {
+      "enabled": true
+    },
+    "npm-audit": {
+      "enabled": true,
+      "//auditLevel": "info | low | moderate | high | critical. Only DIRECT dependencies at or above this level block. Default 'high': a moderate CVE often has no fix available, and blocking on it stops releases indefinitely for a risk most teams have already accepted. Set 'moderate' for a stricter line.",
+      "auditLevel": "high",
+      "//ignore": "Package names that never block, but are still reported as warnings.",
+      "ignore": []
+    }
+  },
+  "//diffSecurity": "'ignorePaths' skips whole files by glob; setting it REPLACES the test-path defaults shown here, which exist because a security test's job is to contain the exact constructs this check hunts for. 'ignore' silences a finding LABEL everywhere instead. 'dataflowWindow' is how many added lines a value stays tainted for, so `const q = `...${x}`` on one line and `db.query(q)` on the next are still connected — a heuristic with no scopes and no reassignment tracking, so it only ever advises; 0 switches it off.",
+  "diffSecurity": {
+    "enabled": true,
+    "ignore": [],
+    "dataflowWindow": 10,
+    "ignorePaths": [
+      "**/__tests__/**",
+      "**/__mocks__/**",
+      "**/*.test.*",
+      "**/*.spec.*",
+      "**/test/**",
+      "**/tests/**"
+    ]
+  },
+  "workflowSecurity": {
+    "enabled": true,
+    "ignore": []
+  },
+  "dockerfileSecurity": {
+    "enabled": true,
+    "ignore": []
+  },
+  "//sensitiveFileGuard": "Flags .env files, private keys, CI config and lockfiles. 'ignorePaths' excuses ONE file by glob (a .pem test fixture); 'ignore' silences a whole CATEGORY and would excuse the next real key too — reach for ignorePaths first.",
+  "sensitiveFileGuard": {
+    "enabled": true,
+    "ignorePaths": []
+  },
+  "migrationSafety": {
+    "enabled": true,
+    "severity": "warn",
+    "//paths": "Globs treated as migrations. Setting this REPLACES the defaults listed here.",
+    "paths": ["**/migrations/**", "**/migrate/**", "**/db/migrate/**", "**/versions/**", "**/*.sql"]
+  },
+  "//4-dependencies": "Manifest, licence, and vulnerability checks.",
+  "dependency": {
+    "enabled": true,
+    "//ignore": "Dependency names, or globs over the whole name (\"eslint-plugin-*\"), that knip should ignore. Only applied when non-empty, and never when the repo ships its own knip config — that file stays the source of truth.",
+    "ignore": []
+  },
+  "circularDeps": {
+    "//": "Circular imports (dpdm, bundled — nothing needed on the runner). Uses the project's own dpdm when it has one. When the analyzer cannot run, the check SKIPS rather than passing or failing.",
+    "enabled": true,
+    "//severity": "Advisory by default: most repos carry long-standing cycles through barrel files. Set 'error' to gate merges on them.",
+    "severity": "warn",
+    "//ignore": "Globs over repo-relative paths to keep out of the analysis (generated or vendored code).",
+    "ignore": [],
+    "//timeoutMs": "Cap on the analysis. On timeout the check skips rather than fails.",
+    "timeoutMs": 120000
+  },
+  "outdatedDeps": {
+    "enabled": true,
+    "ignore": [],
+    "//timeoutMs": "Cap on 'npm outdated'. On timeout the check skips rather than fails.",
+    "timeoutMs": 30000
+  },
+  "licenseCheck": {
+    "//": "GPL/LGPL/AGPL in PRODUCTION dependencies fail the run. Both lists below are APPENDED to the defaults.",
+    "allowPackages": [],
+    "allowLicenses": []
+  },
+  "vulnScan": {
+    "//": "osv-scanner, cross-ecosystem. OPT-IN: must be exactly true. Requires osv-scanner on the runner.",
+    "enabled": false
+  },
+  "grypeScan": {
+    "//": "Anchore grype, cross-ecosystem. ON by default but skips when grype is absent from the runner.",
+    "enabled": true,
+    "minSeverity": "medium",
+    "//ignore": "Suppress by CVE/GHSA id or by package name.",
+    "ignore": [],
+    "//timeoutMs": "Cap on the grype scan. On timeout the check skips rather than fails. The scan never walks 'ignoreDirs' (node_modules, dist, …), which is what keeps it quick.",
+    "timeoutMs": 120000,
+    "//ci": "Optional per-environment overrides (enabled, minSeverity, ignore, timeoutMs): 'ci' applies on CI builds, 'local' elsewhere. Example: \"local\": { \"enabled\": false }"
+  },
+  "//bannedImports": "Packages that must not be ADDED. Empty means the check is inert. severity defaults to 'warn'; use 'error' to fail the run.",
+  "bannedImports": [],
+  "//5-git-and-pr": "Checks on the diff and on pull-request metadata.",
+  "mergeConflict": {
+    "enabled": true,
+    "severity": "error"
+  },
+  "//packageSize": "Growth of the published npm package vs the last release. Advisory — a bigger tarball is usually earned. Only runs where package.json names a non-private package.",
+  "packageSize": {
+    "enabled": true,
+    "maxGrowthPercent": 20,
+    "compareWith": "latest"
+  },
+  "diffSmell": {
+    "enabled": true
+  },
+  "leftoverDebug": {
+    "enabled": true,
+    "severity": "warn"
+  },
+  "todoFixme": {
+    "enabled": true,
+    "severity": "warn",
+    "//requireTicket": "When true, a TODO must reference a ticket id — '#123' or 'PROJ-456'.",
+    "requireTicket": false,
+    "keywords": ["TODO", "FIXME", "XXX", "HACK"]
+  },
+  "lockfileDrift": {
+    "enabled": true,
+    "severity": "warn"
+  },
+  "largeFiles": {
+    "enabled": true,
+    "severity": "warn",
+    "maxSizeKb": 500,
+    "//allow": "Globs exempted from the size limit. APPENDED to a built-in lockfile allow-list.",
+    "allow": []
+  },
+  "missingTests": {
+    "enabled": true,
+    "severity": "warn",
+    "//ignore": "Globs that never require an accompanying test. Setting this REPLACES the defaults, which cover *.d.ts, index files and *.config.*.",
+    "ignore": [
+      "**/*.d.ts",
+      "**/index.ts",
+      "**/index.tsx",
+      "**/index.js",
+      "**/index.jsx",
+      "**/*.config.*"
+    ]
+  },
+  "caseCollision": {
+    "enabled": true
+  },
+  "//customRules": "Your own regex rules run against added diff lines. Each needs 'name' and 'pattern'; optional 'message', 'severity' (error|warn), 'include', 'exclude', 'flags'.",
+  "customRules": [],
+  "prBody": {
+    "enabled": true,
+    "minLength": 20,
+    "requireTicket": true
+  },
+  "prSize": {
+    "enabled": true,
+    "maxFiles": 50,
+    "maxLines": 1000
+  },
+  "commitlint": {
+    "enabled": true,
+    "types": [
+      "feat",
+      "fix",
+      "docs",
+      "chore",
+      "ci",
+      "refactor",
+      "perf",
+      "style",
+      "revert",
+      "test",
+      "build"
+    ],
+    "//ignores": "Regex sources for titles to skip, e.g. release PRs.",
+    "ignores": ["^Release\\b", "^chore\\(release\\):"]
+  },
+  "//6-quality": "Cross-language quality gates.",
+  "yamlLint": {
+    "enabled": true,
+    "severity": "error",
+    "ignore": []
+  },
+  "symlinks": {
+    "//": "Whole-repo scan for tracked symlinks whose target does not exist.",
+    "enabled": true,
+    "//severity": "Advisory by default. Set 'error' to gate merges on a broken link.",
+    "severity": "warn",
+    "//ignore": "Globs for links intentionally left broken (e.g. a fixture testing another tool's own broken-symlink handling).",
+    "ignore": []
+  },
+  "typecheck": {
+    "enabled": true
+  },
+  "duplicate": {
+    "enabled": true,
+    "minLines": 5,
+    "minTokens": 50,
+    "//ignore": "Test and mock paths are excluded by default because test setup legitimately repeats.",
+    "ignore": [
+      "**/__tests__/**",
+      "**/__mocks__/**",
+      "**/*.test.*",
+      "**/*.spec.*",
+      "**/test/**",
+      "**/tests/**"
+    ]
+  },
+  "deadCode": {
+    "enabled": true,
+    "//ignoreFiles": "REGEX sources (not globs), matched against reported file paths. Setting this REPLACES the defaults.",
+    "ignoreFiles": [
+      "/__tests__/",
+      "/__mocks__/",
+      "/__mock__/",
+      "/tests?/",
+      "\\.test\\.",
+      "\\.spec\\."
+    ]
+  },
+  "coverage": {
+    "//": "OPT-IN: must be exactly true. Reads an existing coverage summary; it does not run your tests.",
+    "enabled": false,
+    "severity": "warn",
+    "//reportPath": "Path or array of paths to a coverage summary.",
+    "reportPath": []
+  },
+  "licenseHeader": {
+    "//": "OPT-IN: must be exactly true. Requires a header matching 'pattern' within the first 'lines' lines of each changed source file.",
+    "enabled": false,
+    "pattern": "",
+    "lines": 10
+  },
+  "configValidation": {
+    "enabled": true
+  },
+  "//7-linters": "ESLint, Prettier, cspell and markdownlint. 'rules' blocks are MERGED with the defaults; 'ignorePatterns' and 'ignorePaths' are APPENDED.",
+  "eslint": {
+    "rules": {},
+    "ignorePatterns": []
+  },
+  "prettier": {
+    "rules": {}
+  },
+  "cspell": {
+    "//": "Only \"enabled\" always applies. The rest configures the cspell config pr-checkmate generates, so it is ignored when the repository has its own cspell.json — that file wins.",
+    "//enabled": "Set false to turn the Spellcheck check off entirely.",
+    "enabled": true,
+    "//words": "Project vocabulary that should not be reported as misspelled. Appended to the bundled list.",
+    "words": [],
+    "//ignorePaths": "Globs to skip, APPENDED to the bundled list — which already covers CHANGELOG.md (assembled from commit subjects, so its typos are unfixable), test and mock paths, lockfiles and minified bundles. Anchored to the repository root, so a pattern never matches a directory ABOVE the checkout.",
+    "ignorePaths": [],
+    "ignoreRegExpList": [],
+    "//dictionaries": "Extra cspell dictionaries to enable, on top of the bundled fr, ru, uk, he, es. Unknown names are ignored.",
+    "dictionaries": [],
+    "//language": "Locales to spellcheck against. Omit it to keep the bundled \"en,ru,uk,he,fr,es\" — a value here REPLACES that list, so \"en\" alone reports every non-English word as a typo."
+  },
+  "markdownlint": {
+    "rules": {},
+    "//ignores": "APPENDED to the built-in list: node_modules, dist, coverage, graphify-out, .claude and CHANGELOG.md.",
+    "ignores": []
+  },
+  "//7b-install": "WHICH TOOLING IS FETCHED. The tooling totals ~233 MB and no repository needs all of it. \"adaptive\" (default) fetches only what this repository turns out to need; \"eager\" fetches everything up front, which is what a closed network or a prebuilt image wants and is also the exact previous behaviour; \"manual\" fetches nothing because the tools are already on the runner. A missing tool never fails silently: the affected checks skip with a reason in the report, or fail the run outright with onMissingTool: \"error\".",
+  "install": {
+    "strategy": "adaptive",
+    "//profiles": "Extra profiles beyond what detection concluded, for generated code or a monorepo layout detection cannot see through. Names: core, js, python, cpp, spellcheck, markdown, commitlint, duplicate.",
+    "profiles": [],
+    "//excludeProfiles": "Never install these, even when the language is detected. Wins over 'profiles'.",
+    "excludeProfiles": [],
+    "//minFilesPerLanguage": "Source files a language needs before its toolchain is worth downloading. Separate from detect.minFiles: running a check that then skips is free, downloading a toolchain is not.",
+    "minFilesPerLanguage": 1,
+    "//reuseLocal": "compatible | always | off. Run the tool the REPOSITORY already has instead of our copy. \"compatible\" (default) does so when the major matches ours, or when the tool reads the repository's own config — a legacy .eslintrc can only be read by the ESLint it was written for, and a tsconfig.json by its own compiler. \"always\" reuses across a major gap at your own risk: our generated flat config does not load in ESLint 8. \"off\" always uses our pinned copy, for reproducibility.",
+    "reuseLocal": "compatible",
+    "//onMissingTool": "auto | skip | error. In a closed contour a silent skip is not acceptable — use 'error'.",
+    "onMissingTool": "auto",
+    "//offline": "Forbid every network install at run time. Pre-warm with: npx pr-checkmate install --all",
+    "offline": false,
+    "//cacheDir": "Where fetched tooling is kept; the path includes the pr-checkmate version. Cache it in CI or the tooling is fetched on every run.",
+    "cacheDir": "~/.cache/pr-checkmate",
+    "//deny": "Packages never fetched, whatever profile asks for them.",
+    "deny": [],
+    "//prewarm": "NOT YET IMPLEMENTED — accepted and ignored. Warming the cache needs a postinstall hook, and there is nothing to warm while every profile's tooling ships inside the package. Documented as inert rather than quietly doing nothing.",
+    "prewarm": true
+  },
+  "//8-languages": "Language is auto-detected. A check skips when its language is absent, and runner-dependency tools skip when the binary is missing — so leaving everything enabled is safe. TypeScript and JavaScript have no block of their own: configure them through 'eslint', 'prettier' and 'typecheck' above.",
+  "//detect": "HOW that auto-detection reads the tree, when 'languages' is not set explicitly. Generated reports, vendored code and marker files are already excluded; these knobs are for the cases the built-in rules get wrong in your repo. 'minFiles' is how many source files a language needs to count (a marker file such as pyproject.toml includes it regardless). 'excludePaths' ADDS to the built-in exclusions rather than replacing them. 'disable' drops a language outright.",
+  "detect": {
+    "minFiles": 1,
+    "excludePaths": [],
+    "disable": []
+  },
+  "python": {
+    "enabled": true,
+    "//typeChecker": "mypy | pyright — pins one checker. Leave unset: the runner's own mypy is used when it has one, our bundled pyright otherwise.",
+    "typecheck": true,
+    "ruff": {
+      "lint": true,
+      "format": true
+    }
+  },
+  "cpp": {
+    "enabled": true,
+    "clangFormat": {
+      "style": "LLVM"
+    }
+  },
+  "swift": {
+    "enabled": true
+  },
+  "kotlin": {
+    "enabled": true
+  },
+  "go": {
+    "enabled": true
+  },
+  "rust": {
+    "enabled": true
+  },
+  "csharp": {
+    "enabled": true
+  },
+  "ruby": {
+    "enabled": true
+  },
+  "php": {
+    "enabled": true
+  },
+  "shellcheck": {
+    "//": "Needs the `shellcheck` binary on the runner; skips when absent.",
+    "enabled": true,
+    "//minSeverity": "error | warning | info | style. Omit to keep ShellCheck's own default (every level).",
+    "//ignore": "ShellCheck codes to suppress, e.g. \"SC2086\".",
+    "ignore": []
+  }
+}

package/dist/cjs/core/checks/dependencies/grype-scan.js

@@ -4,6 +4,7 @@ exports.grypeScanCheck = void 0;
 exports.resolveGrypeScan = resolveGrypeScan;
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
+const grype_db_js_1 = require("../../install/grype-db.js");
 const types_js_1 = require("../../types.js");
 const tool_install_js_1 = require("../tool-install.js");
 const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
@@ -21,6 +22,14 @@ const TYPE_TO_ECOSYSTEM = {
  * looks like a hung commit — an advisory check must never be able to do that.
  */
 const DEFAULT_TIMEOUT_MS = 120000;
+/**
+ * Cap for refreshing grype's vulnerability database. A stale database (grype
+ * refuses one older than 5 days) is re-downloaded, hundreds of MB, which takes
+ * longer than the scan's own cap. Kept below the per-check timeout so the check
+ * itself reports the outcome instead of being cut off by the runner. `npx
+ * pr-checkmate install` refreshes it without any cap, ahead of time.
+ */
+const DB_UPDATE_TIMEOUT_MS = 240000;
 function severityRank(severity) {
     return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
 }
@@ -76,10 +85,19 @@ exports.grypeScanCheck = {
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
         const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const unusable = await (0, grype_db_js_1.ensureGrypeDb)(ctx.cwd, DB_UPDATE_TIMEOUT_MS);
+        if (unusable === 'ENOENT')
+            return (0, tool_install_js_1.notInstalled)('grype');
+        if (unusable) {
+            index_js_1.logger.warn(`[Grype Scan]: ⚠️ ${unusable} — skipping`);
+            return (0, types_js_1.skip)(unusable);
+        }
+        // The database was just checked, so the scan must not try to fetch one itself.
         const result = await (0, execa_js_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,
             timeout,
+            env: { GRYPE_DB_AUTO_UPDATE: 'false' },
         });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.

package/dist/cjs/core/checks/languages/lint.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lintCheck = void 0;
+const node_path_1 = __importDefault(require("node:path"));
 const index_js_1 = require("../../../config/index.js");
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
@@ -76,10 +80,18 @@ exports.lintCheck = {
             index_js_2.logger.info(`[ESLint]: Using pr-checkmate config (ESLint v${version}, ${configFile})`);
         }
         index_js_1.IGNORE_PATTERNS.forEach(p => args.push('--ignore-pattern', p));
+        // Our bundled config loads its plugins through these roots, and an ESLint
+        // older than 9 resolves legacy-config plugins relative to the path below — in
+        // both cases the plugins are in a fetched profile rather than beside us.
+        const toolRoots = (0, index_js_2.registeredToolPaths)();
+        if (!hasLocal && version < 9 && toolRoots.length > 0) {
+            args.push('--resolve-plugins-relative-to', toolRoots[0]);
+        }
         const result = await (0, execa_js_1.execa)(process.execPath, [eslintBin, ...args], {
             cwd: ctx.cwd,
             stdio: 'inherit',
             reject: false,
+            env: { PR_CHECKMATE_TOOL_ROOTS: toolRoots.join(node_path_1.default.delimiter) },
         });
         if (result.exitCode === 0)
             return (0, types_js_1.pass)();

package/dist/cjs/core/checks/languages/ruff-shared.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PY_GLOBS = void 0;
 exports.createRuffWorkspace = createRuffWorkspace;
+const index_js_1 = require("../../../utils/index.js");
 exports.PY_GLOBS = ['*.py'];
 /**
  * The rules we lint Python with — pinned here rather than left to Ruff's defaults.
@@ -28,7 +29,11 @@ const SELECTED_RULES = ['E4', 'E7', 'E9', 'F'];
  * singleton) so the WASM module loads only when a check runs.
  */
 function createRuffWorkspace() {
-    const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+    // Resolved rather than required by name: the package lives in the `python`
+    // profile, which is fetched into the cache directory when this repository
+    // needs it, and a bare specifier only searches our own tree.
+    const entry = (0, index_js_1.resolvePackageBin)('@astral-sh/ruff-wasm-nodejs', 'ruff_wasm.js');
+    const { Workspace, PositionEncoding } = require(entry);
     const settings = {
         ...Workspace.defaultSettings(),
         lint: { select: SELECTED_RULES },

package/dist/cjs/core/checks/pr/commitlint.js

@@ -40,8 +40,10 @@ const DEFAULT_IGNORES = ['^Release\\b', '^chore\\(release\\):'];
 function buildTempConfig(types, ignores) {
     // Emit a CJS module so `ignores` can hold functions — commitlint requires
     // predicate functions there, which a JSON config cannot express.
-    // Resolve config-conventional via Node module resolution — robust to hoisting.
-    const configConventional = require.resolve('@commitlint/config-conventional');
+    // Resolved through the same roots as the binary, not by bare specifier: both
+    // live in the `commitlint` profile, which is fetched into the cache directory,
+    // and `require.resolve` alone only searches our own tree.
+    const configConventional = (0, index_js_2.resolvePackageBin)('@commitlint/config-conventional', 'lib/index.js');
     const content = `const patterns = ${JSON.stringify(ignores)}.map((p) => new RegExp(p, 'i'));
 module.exports = {
   extends: [${JSON.stringify(configConventional)}],

package/dist/cjs/core/checks/quality/package-size.d.ts

@@ -1,6 +1,27 @@
 import { Check } from '../../types.js';
+/** The slice of `npm pack --dry-run --json` this check reads. */
+interface PackedFile {
+    path: string;
+    size: number;
+}
+interface PackManifest {
+    name: string;
+    version: string;
+    size: number;
+    unpackedSize: number;
+    entryCount: number;
+    files: PackedFile[];
+}
+/**
+ * The manifest out of whatever `npm pack --json` printed.
+ *
+ * npm 10 prints `[ {manifest} ]`; npm 11 prints `{ "<name>": {manifest} }`. Reading
+ * only the first form turned every npm 11 runner into "could not describe this
+ * package" and the check into a permanent skip.
+ */
+export declare function pickManifest(parsed: unknown): PackManifest | null;
 /** Why we could not read a published version. */
-export type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
+type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
 /**
  * Tell "never published" apart from "we were not let in".
  *
@@ -34,3 +55,4 @@ export declare function classifyQueryFailure(stderr: string): QueryFailure;
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
 export declare const packageSizeCheck: Check;
+export {};

package/dist/cjs/core/checks/quality/package-size.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.packageSizeCheck = void 0;
+exports.pickManifest = pickManifest;
 exports.classifyQueryFailure = classifyQueryFailure;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -15,6 +16,22 @@ const findings_js_1 = require("../findings.js");
 const DEFAULT_MAX_GROWTH = 20;
 /** How many of the files behind the growth are named. */
 const NAMED_FILES = 5;
+/**
+ * The manifest out of whatever `npm pack --json` printed.
+ *
+ * npm 10 prints `[ {manifest} ]`; npm 11 prints `{ "<name>": {manifest} }`. Reading
+ * only the first form turned every npm 11 runner into "could not describe this
+ * package" and the check into a permanent skip.
+ */
+function pickManifest(parsed) {
+    const entries = Array.isArray(parsed)
+        ? parsed
+        : parsed !== null && typeof parsed === 'object'
+            ? Object.values(parsed)
+            : [];
+    const first = entries[0];
+    return first !== null && typeof first === 'object' ? first : null;
+}
 /**
  * Ask npm what a tarball would contain, without producing one.
  *
@@ -48,10 +65,9 @@ async function packManifest(cwd, spec, registry) {
     if (result.exitCode !== 0)
         return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
-        const parsed = JSON.parse(result.stdout);
-        if (Array.isArray(parsed) && parsed.length > 0) {
-            return { manifest: parsed[0] };
-        }
+        const manifest = pickManifest(JSON.parse(result.stdout));
+        if (manifest)
+            return { manifest };
     }
     catch {
         // Fall through: npm answered with something that is not a manifest.