pr-checkmate 3.2.3 → 3.3.0

package/.eslintrc.js

@@ -41,7 +41,7 @@ module.exports = {
     sourceType: 'module',
     project: './tsconfig.json',
   },
-  plugins: ['@typescript-eslint', 'prettier', 'import-x', 'jsdoc'],
+  plugins: ['@typescript-eslint', 'prettier', 'simple-import-sort', 'jsdoc'],
   extends: [
     'eslint:recommended',
     'plugin:@typescript-eslint/recommended',
@@ -85,14 +85,8 @@ module.exports = {
     // Complexity analysis (#61)
     complexity: ['warn', 30],
     // Import ordering (#65)
-    'import-x/order': [
-      'warn',
-      {
-        groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
-        alphabetize: { order: 'asc', caseInsensitive: true },
-      },
-    ],
-    'import-x/no-duplicates': 'error',
+    'simple-import-sort/imports': 'warn',
+    'no-duplicate-imports': ['error', { allowSeparateTypeImports: true }],
     // Documentation (#62). `jsdoc/require-jsdoc` is deliberately absent — see the
     // note in eslint-flat-config.mjs. These three check docblocks that exist and
     // fix only inside them; they never fabricate one.

package/README.md

@@ -72,7 +72,7 @@ tool installed; the check skips gracefully when the tool is absent.
 | Language | Checks | Toolchain |
 |---|---|---|
 | TypeScript / JavaScript | ESLint, Prettier, `tsc --noEmit` | Bundled |
-| Python | Ruff (lint + format), mypy/pyright (types) | Bundled — Ruff, and pyright for types; the runner's own mypy is preferred when it has one |
+| Python | Ruff (lint + format), mypy/pyright (types) | Fetched on first use — Ruff, and pyright for types; the runner's own mypy is preferred when it has one |
 | C++ | clang-format | Bundled |
 | Swift | SwiftLint | `swiftlint` on the runner |
 | Kotlin / Java | ktlint | `ktlint` on the runner |

package/dist/cjs/cli.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const loader_js_1 = require("./config/loader.js");
 const commands_js_1 = require("./core/commands.js");
 const index_js_1 = require("./core/index.js");
 const doctor_js_1 = require("./core/install/doctor.js");
+const grype_db_js_1 = require("./core/install/grype-db.js");
 const init_js_1 = require("./init.js");
 const index_js_2 = require("./utils/index.js");
 const argv = process.argv.slice(2);
@@ -90,6 +92,17 @@ void (async () => {
             for (const result of failed) {
                 index_js_2.logger.error(`[install]: ❌ ${result.profiles.join(', ') || 'tooling'}: ${result.reason}`);
             }
+            // Warm grype's vulnerability database too, with no time cap: the download is
+            // hundreds of MB and the scan itself would only be allowed a couple of minutes.
+            // Best-effort — an absent grype or a failed download is a warning, not a
+            // failed install, since Grype Scan skips cleanly without it.
+            if ((0, loader_js_1.loadProjectConfig)().grypeScan?.enabled !== false) {
+                const why = await (0, grype_db_js_1.ensureGrypeDb)(process.cwd());
+                if (why && why !== 'ENOENT')
+                    index_js_2.logger.warn(`[install]: ⚠️ grype: ${why}`);
+                else if (!why)
+                    index_js_2.logger.info('[install]: grype vulnerability database is up to date');
+            }
             process.exit(failed.length > 0 ? 1 : 0);
         }
         if (cmd === 'doctor') {

package/dist/cjs/config/pr-checkmate.template.json

@@ -318,7 +318,7 @@
     "//ignores": "APPENDED to the built-in list: node_modules, dist, coverage, graphify-out, .claude and CHANGELOG.md.",
     "ignores": []
   },
-  "//7b-install": "WHICH TOOLING IS FETCHED. The package ships ~233 MB and no repository needs all of it. \"adaptive\" (default) fetches only what this repository turns out to need; \"eager\" fetches everything up front, which is what a closed network or a prebuilt image wants and is also the exact previous behaviour; \"manual\" fetches nothing because the tools are already on the runner. A missing tool never fails silently: the affected checks skip with a reason in the report, or fail the run outright with onMissingTool: \"error\".",
+  "//7b-install": "WHICH TOOLING IS FETCHED. The tooling totals ~233 MB and no repository needs all of it. \"adaptive\" (default) fetches only what this repository turns out to need; \"eager\" fetches everything up front, which is what a closed network or a prebuilt image wants and is also the exact previous behaviour; \"manual\" fetches nothing because the tools are already on the runner. A missing tool never fails silently: the affected checks skip with a reason in the report, or fail the run outright with onMissingTool: \"error\".",
   "install": {
     "strategy": "adaptive",
     "//profiles": "Extra profiles beyond what detection concluded, for generated code or a monorepo layout detection cannot see through. Names: core, js, python, cpp, spellcheck, markdown, commitlint, duplicate.",

package/dist/cjs/core/checks/dependencies/grype-scan.js

@@ -4,6 +4,7 @@ exports.grypeScanCheck = void 0;
 exports.resolveGrypeScan = resolveGrypeScan;
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
+const grype_db_js_1 = require("../../install/grype-db.js");
 const types_js_1 = require("../../types.js");
 const tool_install_js_1 = require("../tool-install.js");
 const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
@@ -21,6 +22,14 @@ const TYPE_TO_ECOSYSTEM = {
  * looks like a hung commit — an advisory check must never be able to do that.
  */
 const DEFAULT_TIMEOUT_MS = 120000;
+/**
+ * Cap for refreshing grype's vulnerability database. A stale database (grype
+ * refuses one older than 5 days) is re-downloaded, hundreds of MB, which takes
+ * longer than the scan's own cap. Kept below the per-check timeout so the check
+ * itself reports the outcome instead of being cut off by the runner. `npx
+ * pr-checkmate install` refreshes it without any cap, ahead of time.
+ */
+const DB_UPDATE_TIMEOUT_MS = 240000;
 function severityRank(severity) {
     return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
 }
@@ -76,10 +85,19 @@ exports.grypeScanCheck = {
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
         const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const unusable = await (0, grype_db_js_1.ensureGrypeDb)(ctx.cwd, DB_UPDATE_TIMEOUT_MS);
+        if (unusable === 'ENOENT')
+            return (0, tool_install_js_1.notInstalled)('grype');
+        if (unusable) {
+            index_js_1.logger.warn(`[Grype Scan]: ⚠️ ${unusable} — skipping`);
+            return (0, types_js_1.skip)(unusable);
+        }
+        // The database was just checked, so the scan must not try to fetch one itself.
         const result = await (0, execa_js_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,
             timeout,
+            env: { GRYPE_DB_AUTO_UPDATE: 'false' },
         });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.

package/dist/cjs/core/checks/languages/lint.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lintCheck = void 0;
+const node_path_1 = __importDefault(require("node:path"));
 const index_js_1 = require("../../../config/index.js");
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
@@ -76,10 +80,18 @@ exports.lintCheck = {
             index_js_2.logger.info(`[ESLint]: Using pr-checkmate config (ESLint v${version}, ${configFile})`);
         }
         index_js_1.IGNORE_PATTERNS.forEach(p => args.push('--ignore-pattern', p));
+        // Our bundled config loads its plugins through these roots, and an ESLint
+        // older than 9 resolves legacy-config plugins relative to the path below — in
+        // both cases the plugins are in a fetched profile rather than beside us.
+        const toolRoots = (0, index_js_2.registeredToolPaths)();
+        if (!hasLocal && version < 9 && toolRoots.length > 0) {
+            args.push('--resolve-plugins-relative-to', toolRoots[0]);
+        }
         const result = await (0, execa_js_1.execa)(process.execPath, [eslintBin, ...args], {
             cwd: ctx.cwd,
             stdio: 'inherit',
             reject: false,
+            env: { PR_CHECKMATE_TOOL_ROOTS: toolRoots.join(node_path_1.default.delimiter) },
         });
         if (result.exitCode === 0)
             return (0, types_js_1.pass)();

package/dist/cjs/core/checks/languages/ruff-shared.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PY_GLOBS = void 0;
 exports.createRuffWorkspace = createRuffWorkspace;
+const index_js_1 = require("../../../utils/index.js");
 exports.PY_GLOBS = ['*.py'];
 /**
  * The rules we lint Python with — pinned here rather than left to Ruff's defaults.
@@ -28,7 +29,11 @@ const SELECTED_RULES = ['E4', 'E7', 'E9', 'F'];
  * singleton) so the WASM module loads only when a check runs.
  */
 function createRuffWorkspace() {
-    const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+    // Resolved rather than required by name: the package lives in the `python`
+    // profile, which is fetched into the cache directory when this repository
+    // needs it, and a bare specifier only searches our own tree.
+    const entry = (0, index_js_1.resolvePackageBin)('@astral-sh/ruff-wasm-nodejs', 'ruff_wasm.js');
+    const { Workspace, PositionEncoding } = require(entry);
     const settings = {
         ...Workspace.defaultSettings(),
         lint: { select: SELECTED_RULES },

package/dist/cjs/core/checks/pr/commitlint.js

@@ -40,8 +40,10 @@ const DEFAULT_IGNORES = ['^Release\\b', '^chore\\(release\\):'];
 function buildTempConfig(types, ignores) {
     // Emit a CJS module so `ignores` can hold functions — commitlint requires
     // predicate functions there, which a JSON config cannot express.
-    // Resolve config-conventional via Node module resolution — robust to hoisting.
-    const configConventional = require.resolve('@commitlint/config-conventional');
+    // Resolved through the same roots as the binary, not by bare specifier: both
+    // live in the `commitlint` profile, which is fetched into the cache directory,
+    // and `require.resolve` alone only searches our own tree.
+    const configConventional = (0, index_js_2.resolvePackageBin)('@commitlint/config-conventional', 'lib/index.js');
     const content = `const patterns = ${JSON.stringify(ignores)}.map((p) => new RegExp(p, 'i'));
 module.exports = {
   extends: [${JSON.stringify(configConventional)}],

package/dist/cjs/core/checks/quality/package-size.d.ts

@@ -1,6 +1,27 @@
 import { Check } from '../../types.js';
+/** The slice of `npm pack --dry-run --json` this check reads. */
+interface PackedFile {
+    path: string;
+    size: number;
+}
+interface PackManifest {
+    name: string;
+    version: string;
+    size: number;
+    unpackedSize: number;
+    entryCount: number;
+    files: PackedFile[];
+}
+/**
+ * The manifest out of whatever `npm pack --json` printed.
+ *
+ * npm 10 prints `[ {manifest} ]`; npm 11 prints `{ "<name>": {manifest} }`. Reading
+ * only the first form turned every npm 11 runner into "could not describe this
+ * package" and the check into a permanent skip.
+ */
+export declare function pickManifest(parsed: unknown): PackManifest | null;
 /** Why we could not read a published version. */
-export type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
+type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
 /**
  * Tell "never published" apart from "we were not let in".
  *
@@ -34,3 +55,4 @@ export declare function classifyQueryFailure(stderr: string): QueryFailure;
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
 export declare const packageSizeCheck: Check;
+export {};

package/dist/cjs/core/checks/quality/package-size.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.packageSizeCheck = void 0;
+exports.pickManifest = pickManifest;
 exports.classifyQueryFailure = classifyQueryFailure;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -15,6 +16,22 @@ const findings_js_1 = require("../findings.js");
 const DEFAULT_MAX_GROWTH = 20;
 /** How many of the files behind the growth are named. */
 const NAMED_FILES = 5;
+/**
+ * The manifest out of whatever `npm pack --json` printed.
+ *
+ * npm 10 prints `[ {manifest} ]`; npm 11 prints `{ "<name>": {manifest} }`. Reading
+ * only the first form turned every npm 11 runner into "could not describe this
+ * package" and the check into a permanent skip.
+ */
+function pickManifest(parsed) {
+    const entries = Array.isArray(parsed)
+        ? parsed
+        : parsed !== null && typeof parsed === 'object'
+            ? Object.values(parsed)
+            : [];
+    const first = entries[0];
+    return first !== null && typeof first === 'object' ? first : null;
+}
 /**
  * Ask npm what a tarball would contain, without producing one.
  *
@@ -48,10 +65,9 @@ async function packManifest(cwd, spec, registry) {
     if (result.exitCode !== 0)
         return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
-        const parsed = JSON.parse(result.stdout);
-        if (Array.isArray(parsed) && parsed.length > 0) {
-            return { manifest: parsed[0] };
-        }
+        const manifest = pickManifest(JSON.parse(result.stdout));
+        if (manifest)
+            return { manifest };
     }
     catch {
         // Fall through: npm answered with something that is not a manifest.

package/dist/cjs/core/checks/quality/spellcheck.js

@@ -204,12 +204,15 @@ function dropMissingLanguages(language, missing) {
  */
 function resolveFrom(cwd) {
     return id => {
-        try {
-            return require.resolve(id, { paths: [cwd] });
-        }
-        catch {
-            return require.resolve(id);
+        // The client's copy first, then the fetched `spellcheck` profile (cspell's own
+        // dictionaries live there), then our tree.
+        for (const root of [cwd, ...(0, index_js_2.registeredToolPaths)()]) {
+            try {
+                return require.resolve(id, { paths: [root] });
+            }
+            catch { }
         }
+        return require.resolve(id);
     };
 }
 function createTempCspellConfig(cwd) {

package/dist/cjs/core/install/doctor.js

@@ -16,6 +16,7 @@ const package_version_js_1 = require("../../utils/package-version.js");
 Object.defineProperty(exports, "packageVersion", { enumerable: true, get: function () { return package_version_js_1.packageVersion; } });
 const cache_js_1 = require("./cache.js");
 const ensure_js_1 = require("./ensure.js");
+const grype_db_js_1 = require("./grype-db.js");
 const prepare_js_1 = require("./prepare.js");
 const profiles_js_1 = require("./profiles.js");
 /**
@@ -142,6 +143,17 @@ async function runDoctor(cwd = process.cwd()) {
         lines.push(`  ${missing.length} profile(s) not installed yet. They are fetched on the next`);
         lines.push('  run, or now with: npx pr-checkmate install');
     }
+    if (config.grypeScan?.enabled !== false) {
+        const db = await (0, grype_db_js_1.grypeDbState)(cwd);
+        lines.push('');
+        lines.push('  Grype database (shared by all projects on this machine)');
+        if (db.state === 'missing-tool')
+            lines.push('    — grype is not installed (brew install grype)');
+        else if (db.state === 'ready')
+            lines.push(`    ✅ up to date${db.built ? ` (built ${db.built})` : ''}`);
+        else
+            lines.push(`    ⬇️  stale${db.built ? ` (built ${db.built})` : ''} — refresh: npx pr-checkmate install`);
+    }
     const stale = (0, cache_js_1.stalePaths)((0, package_version_js_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length > 0) {
         lines.push('');

package/dist/cjs/core/install/grype-db.d.ts

@@ -0,0 +1,25 @@
+type GrypeDbState = {
+    state: 'missing-tool';
+} | {
+    state: 'ready';
+    built?: string;
+} | {
+    state: 'stale';
+    built?: string;
+};
+/**
+ * Is grype's vulnerability database usable right now? grype refuses one older than
+ * 5 days (exit code 1 from `db status`). The database lives in grype's own cache,
+ * shared by every project on the machine, so one refresh serves them all.
+ */
+export declare function grypeDbState(cwd: string): Promise<GrypeDbState>;
+/**
+ * Download a fresh database when the current one is missing or stale.
+ *
+ * `timeoutMs` bounds the download: a check inside a run passes one so it can never
+ * look like a hung commit, `install` passes none because a person asked for exactly
+ * this and the download is the whole job. Returns why it is still unusable, or
+ * `null` when it is ready.
+ */
+export declare function ensureGrypeDb(cwd: string, timeoutMs?: number): Promise<string | null>;
+export {};

package/dist/cjs/core/install/grype-db.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grypeDbState = grypeDbState;
+exports.ensureGrypeDb = ensureGrypeDb;
+const execa_js_1 = require("../../utils/execa.js");
+const logger_js_1 = require("../../utils/logger.js");
+/** `Built:` line of `grype db status`, so `doctor` can say how old the data is. */
+const builtOf = (stdout) => typeof stdout === 'string' ? /^Built:\s*(.+)$/m.exec(stdout)?.[1]?.trim() : undefined;
+/**
+ * Is grype's vulnerability database usable right now? grype refuses one older than
+ * 5 days (exit code 1 from `db status`). The database lives in grype's own cache,
+ * shared by every project on the machine, so one refresh serves them all.
+ */
+async function grypeDbState(cwd) {
+    const status = await (0, execa_js_1.execa)('grype', ['db', 'status'], { cwd, reject: false, timeout: 30000 });
+    if (status.code === 'ENOENT')
+        return { state: 'missing-tool' };
+    const built = builtOf(status.stdout);
+    return status.exitCode === 0 ? { state: 'ready', built } : { state: 'stale', built };
+}
+/**
+ * Download a fresh database when the current one is missing or stale.
+ *
+ * `timeoutMs` bounds the download: a check inside a run passes one so it can never
+ * look like a hung commit, `install` passes none because a person asked for exactly
+ * this and the download is the whole job. Returns why it is still unusable, or
+ * `null` when it is ready.
+ */
+async function ensureGrypeDb(cwd, timeoutMs) {
+    const current = await grypeDbState(cwd);
+    if (current.state === 'missing-tool')
+        return 'ENOENT';
+    if (current.state === 'ready')
+        return null;
+    logger_js_1.logger.info('[Grype Scan]: vulnerability database missing or stale — updating it');
+    const update = await (0, execa_js_1.execa)('grype', ['db', 'update'], {
+        cwd,
+        reject: false,
+        ...(timeoutMs ? { timeout: timeoutMs } : {}),
+    });
+    if (update.timedOut) {
+        return `database update exceeded ${timeoutMs}ms — run "grype db update" once, then retry`;
+    }
+    return update.exitCode === 0 ? null : 'database update failed (offline?) — run "grype db update"';
+}

package/dist/cjs/core/install/profiles.d.ts

@@ -3,7 +3,7 @@ import type { Language, LanguageUsage } from '../../utils/detect-language.js';
 /**
  * A named bundle of tooling, and the checks that stop working without it.
  *
- * The package ships ~233 MB of tooling, and no repository needs all of it: a
+ * The tooling totals ~233 MB, and no repository needs all of it: a
  * Python service pays for the whole JavaScript toolchain, a repository with
  * Spellcheck switched off still pays for cspell. Profiles are how that stops —
  * they name which slice of the tooling a given repository actually needs.

package/dist/cjs/core/install/profiles.js

@@ -25,9 +25,9 @@ exports.PROFILES = [
             'typescript',
             'eslint',
             'eslint-config-prettier',
-            'eslint-plugin-import-x',
             'eslint-plugin-jsdoc',
             'eslint-plugin-prettier',
+            'eslint-plugin-simple-import-sort',
             'eslint-plugin-sonarjs',
             '@typescript-eslint/eslint-plugin',
             '@typescript-eslint/parser',

package/dist/cjs/core/install/reuse.js

@@ -12,15 +12,18 @@ const resolve_bin_js_1 = require("../../utils/resolve-bin.js");
 /**
  * The major version we declare for a tool, from our own manifest.
  *
- * Read from `dependencies` rather than from the installed tree: what matters is
+ * Read from the manifest rather than from the installed tree: what matters is
  * the version our configuration was written against, and a hoisted install can
  * resolve to something else entirely.
  */
 function ownMajor(pkgName) {
     try {
         const manifest = node_path_1.default.join((0, resolve_bin_js_1.ownPackageRoot)(), 'package.json');
-        const deps = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8')).dependencies;
-        const range = deps?.[pkgName];
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8'));
+        // Profile tooling is declared in `devDependencies` — it is fetched on demand
+        // rather than installed with us — but it is still the version our config was
+        // written against, and the manifest keeps both.
+        const range = parsed.dependencies?.[pkgName] ?? parsed.devDependencies?.[pkgName];
         if (!range)
             return null;
         // `^10.6.0`, `>=3.0.0`, `~5.1` — the leading number is the major in every

package/dist/cjs/init.d.ts

@@ -30,14 +30,6 @@ export declare function setupWorkflow(root: string, mode: GateMode): void;
  * heart about what should block.
  */
 export declare const BLOCKING_BY_DEFAULT: readonly ["Security Scan", "Sensitive Files", "Diff Security", "Workflow Security", "Merge Conflict", "NPM Audit", "License Check", "Dependencies", "TypeScript", "ESLint", "YAML Lint"];
-/**
- * Every option the template documents that the file does not already carry, at
- * its default. Without this, options such as `vulnScan` (off by default) or
- * `licenseCheck` exist only in the docs, and nobody edits what they cannot see.
- * Comment keys travel with the option they describe, section headers with the
- * first option after them.
- */
-export declare function templateExtras(existing: Record<string, unknown>): Record<string, unknown>;
 export declare function buildInitialConfig(sourcePath: string, languages: string[]): Record<string, unknown>;
 /**
  * Initialize (or refresh) pr-checkmate configuration in the current project.

package/dist/cjs/init.js

@@ -5,12 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BLOCKING_BY_DEFAULT = void 0;
 exports.setupWorkflow = setupWorkflow;
-exports.templateExtras = templateExtras;
 exports.buildInitialConfig = buildInitialConfig;
 exports.init = init;
 const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
 const inquirer_1 = __importDefault(require("inquirer"));
+const path_1 = __importDefault(require("path"));
 const index_js_1 = require("./config/index.js");
 const findings_js_1 = require("./core/checks/findings.js");
 const index_js_2 = require("./utils/index.js");

package/dist/cjs/utils/own-deps.js

@@ -7,6 +7,7 @@ exports.findOwnPackageRoot = findOwnPackageRoot;
 exports.getOwnDependencyClosure = getOwnDependencyClosure;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const profiles_js_1 = require("../core/install/profiles.js");
 const OWN_PACKAGE_NAME = 'pr-checkmate';
 const PACKAGE_JSON = 'package.json';
 let cachedClosure;
@@ -89,7 +90,13 @@ function getOwnDependencyClosure() {
     }
     // BFS over the dependency graph, resolving each package relative to the parent
     // that declared it so nested (non-hoisted) installs resolve correctly.
-    const queue = readDependencyNames(root).map(name => ({
+    //
+    // Profile tooling is ours even though it no longer sits in `dependencies`: it is
+    // fetched on demand, so the roots are what we declare plus what the profiles
+    // name. Without the second half every fetched tool is "the client's" and its
+    // licence blocks the client for a dependency they cannot remove.
+    const roots = new Set([...readDependencyNames(root), ...profiles_js_1.PROFILES.flatMap(p => p.packages)]);
+    const queue = [...roots].map(name => ({
         name,
         fromDir: root,
     }));

package/dist/cjs/utils/resolve-bin.d.ts

@@ -16,6 +16,8 @@ export interface ResolvedTool {
  * to a run from before there was anything to fetch.
  */
 export declare function registerToolPaths(dirs: string[]): void;
+/** The roots registered for this run, for tools that load plugins by themselves. */
+export declare function registeredToolPaths(): string[];
 /** Drop every registered profile root. For tests, and for a second run in-process. */
 export declare function clearToolPaths(): void;
 /** The root of the installed pr-checkmate package — where our own tooling lives. */

package/dist/cjs/utils/resolve-bin.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerToolPaths = registerToolPaths;
+exports.registeredToolPaths = registeredToolPaths;
 exports.clearToolPaths = clearToolPaths;
 exports.ownPackageRoot = ownPackageRoot;
 exports.packagePresent = packagePresent;
@@ -33,6 +34,10 @@ let profileRoots = [];
 function registerToolPaths(dirs) {
     profileRoots = [...dirs];
 }
+/** The roots registered for this run, for tools that load plugins by themselves. */
+function registeredToolPaths() {
+    return [...profileRoots];
+}
 /** Drop every registered profile root. For tests, and for a second run in-process. */
 function clearToolPaths() {
     profileRoots = [];

package/dist/esm/cli.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
+import { loadProjectConfig } from './config/loader.js';
 import { COMMAND_TO_CHECK, FLAGS, STANDALONE_COMMANDS, TOOLING_COMMANDS } from './core/commands.js';
 import { runChecks } from './core/index.js';
 import { installProfiles, pruneCache, runDoctor } from './core/install/doctor.js';
+import { ensureGrypeDb } from './core/install/grype-db.js';
 import { init } from './init.js';
-import { logger, getUpdateNotice } from './utils/index.js';
+import { getUpdateNotice, logger } from './utils/index.js';
 const argv = process.argv.slice(2);
 /**
  * Flags are separated from positional arguments so they compose with every command
@@ -88,6 +90,17 @@ void (async () => {
             for (const result of failed) {
                 logger.error(`[install]: ❌ ${result.profiles.join(', ') || 'tooling'}: ${result.reason}`);
             }
+            // Warm grype's vulnerability database too, with no time cap: the download is
+            // hundreds of MB and the scan itself would only be allowed a couple of minutes.
+            // Best-effort — an absent grype or a failed download is a warning, not a
+            // failed install, since Grype Scan skips cleanly without it.
+            if (loadProjectConfig().grypeScan?.enabled !== false) {
+                const why = await ensureGrypeDb(process.cwd());
+                if (why && why !== 'ENOENT')
+                    logger.warn(`[install]: ⚠️ grype: ${why}`);
+                else if (!why)
+                    logger.info('[install]: grype vulnerability database is up to date');
+            }
             process.exit(failed.length > 0 ? 1 : 0);
         }
         if (cmd === 'doctor') {

package/dist/esm/config/pr-checkmate.template.json

@@ -318,7 +318,7 @@
     "//ignores": "APPENDED to the built-in list: node_modules, dist, coverage, graphify-out, .claude and CHANGELOG.md.",
     "ignores": []
   },
-  "//7b-install": "WHICH TOOLING IS FETCHED. The package ships ~233 MB and no repository needs all of it. \"adaptive\" (default) fetches only what this repository turns out to need; \"eager\" fetches everything up front, which is what a closed network or a prebuilt image wants and is also the exact previous behaviour; \"manual\" fetches nothing because the tools are already on the runner. A missing tool never fails silently: the affected checks skip with a reason in the report, or fail the run outright with onMissingTool: \"error\".",
+  "//7b-install": "WHICH TOOLING IS FETCHED. The tooling totals ~233 MB and no repository needs all of it. \"adaptive\" (default) fetches only what this repository turns out to need; \"eager\" fetches everything up front, which is what a closed network or a prebuilt image wants and is also the exact previous behaviour; \"manual\" fetches nothing because the tools are already on the runner. A missing tool never fails silently: the affected checks skip with a reason in the report, or fail the run outright with onMissingTool: \"error\".",
   "install": {
     "strategy": "adaptive",
     "//profiles": "Extra profiles beyond what detection concluded, for generated code or a monorepo layout detection cannot see through. Names: core, js, python, cpp, spellcheck, markdown, commitlint, duplicate.",

package/dist/esm/core/checks/dependencies/dependency-check.js

@@ -2,8 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { hasLocalConfig } from '../../../config/index.js';
 import { execa } from '../../../utils/execa.js';
-import { logger, cleanupTempFile, resolvePackageBin } from '../../../utils/index.js';
-import { isNpmProject, pass, fail, warn, skip } from '../../types.js';
+import { cleanupTempFile, logger, resolvePackageBin } from '../../../utils/index.js';
+import { fail, isNpmProject, pass, skip, warn } from '../../types.js';
 /**
  * Config files knip discovers on its own. When a client ships one, it is the source
  * of truth and pr-checkmate passes no config of its own — the same rule spellcheck

package/dist/esm/core/checks/dependencies/grype-scan.js

@@ -1,5 +1,6 @@
 import { execa } from '../../../utils/execa.js';
 import { collectDirectDeps, isCiEnvironment, logger, normalizeName, } from '../../../utils/index.js';
+import { ensureGrypeDb } from '../../install/grype-db.js';
 import { pass, skip, warn } from '../../types.js';
 import { notInstalled } from '../tool-install.js';
 const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
@@ -17,6 +18,14 @@ const TYPE_TO_ECOSYSTEM = {
  * looks like a hung commit — an advisory check must never be able to do that.
  */
 const DEFAULT_TIMEOUT_MS = 120000;
+/**
+ * Cap for refreshing grype's vulnerability database. A stale database (grype
+ * refuses one older than 5 days) is re-downloaded, hundreds of MB, which takes
+ * longer than the scan's own cap. Kept below the per-check timeout so the check
+ * itself reports the outcome instead of being cut off by the runner. `npx
+ * pr-checkmate install` refreshes it without any cap, ahead of time.
+ */
+const DB_UPDATE_TIMEOUT_MS = 240000;
 function severityRank(severity) {
     return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
 }
@@ -72,10 +81,19 @@ export const grypeScanCheck = {
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
         const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const unusable = await ensureGrypeDb(ctx.cwd, DB_UPDATE_TIMEOUT_MS);
+        if (unusable === 'ENOENT')
+            return notInstalled('grype');
+        if (unusable) {
+            logger.warn(`[Grype Scan]: ⚠️ ${unusable} — skipping`);
+            return skip(unusable);
+        }
+        // The database was just checked, so the scan must not try to fetch one itself.
         const result = await execa('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,
             timeout,
+            env: { GRYPE_DB_AUTO_UPDATE: 'false' },
         });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.

package/dist/esm/core/checks/dependencies/license-check.js

@@ -1,6 +1,6 @@
 import { execa } from '../../../utils/execa.js';
-import { logger, resolvePackageBin, getOwnDependencyClosure } from '../../../utils/index.js';
-import { isNpmProject, pass, fail, skip } from '../../types.js';
+import { getOwnDependencyClosure, logger, resolvePackageBin } from '../../../utils/index.js';
+import { fail, isNpmProject, pass, skip } from '../../types.js';
 const FORBIDDEN_LICENSES = ['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0'];
 /** Strip the trailing "@version" to get the bare package name (scoped-safe). */
 function bareName(pkgKey) {