pr-checkmate 3.2.3 → 4.0.0

package/dist/esm/utils/execa.js

@@ -1,3 +1,42 @@
+/**
+ * Whether children that would inherit our standard streams are kept off them.
+ *
+ * A few checks run a tool with `stdio: 'inherit'` so its output reaches the
+ * terminal. That is right for the CLI and fatal for the MCP server, whose stdout
+ * *is* the protocol: gitleaks printing its banner there is a line that is not
+ * JSON, and the client drops the connection. Swapping `process.stdout.write`
+ * cannot help, because an inherited descriptor never passes through it — so the
+ * redirection has to happen where the child is spawned.
+ */
+let childOutput = null;
+/**
+ * Keep children that would inherit our streams off them, and stop them sharing
+ * stdin. `stderr` (the MCP server) keeps their output as the server's log;
+ * `discard` (the commit hook) drops it, because a hook's stderr is read by the
+ * model and tool banners are not what it needs to hear. No other command is affected.
+ */
+export function isolateInheritedStdio(output = 'stderr') {
+    childOutput = output === 'stderr' ? 2 : 'ignore';
+}
+/** Redirect inherited stdout/stderr per {@link isolateInheritedStdio}; stdin is never ours to give away. */
+function isolated(options) {
+    if (childOutput === null || !options)
+        return options;
+    const { stdio } = options;
+    if (stdio === 'inherit')
+        return { ...options, stdio: ['ignore', childOutput, childOutput] };
+    if (Array.isArray(stdio)) {
+        const next = stdio.map((entry, fd) => {
+            if (fd === 0 && entry === 'inherit')
+                return 'ignore';
+            if ((fd === 1 || fd === 2) && entry === 'inherit')
+                return childOutput;
+            return entry;
+        });
+        return { ...options, stdio: next };
+    }
+    return options;
+}
 /**
  * Run a command via execa, loading the module lazily on first call.
  *
@@ -6,5 +45,5 @@
  */
 export async function execa(file, args, options) {
     const { execa: run } = await import('execa');
-    return (await run(file, args, options));
+    return (await run(file, args, isolated(options)));
 }

package/dist/esm/utils/own-deps.js

@@ -3,6 +3,7 @@ import { dirname as __dirnameFn } from 'node:path';
 const __dirname = __dirnameFn(__fileURLToPath(import.meta.url));
 import fs from 'node:fs';
 import path from 'node:path';
+import { PROFILES } from '../core/install/profiles.js';
 const OWN_PACKAGE_NAME = 'pr-checkmate';
 const PACKAGE_JSON = 'package.json';
 let cachedClosure;
@@ -85,7 +86,13 @@ export function getOwnDependencyClosure() {
     }
     // BFS over the dependency graph, resolving each package relative to the parent
     // that declared it so nested (non-hoisted) installs resolve correctly.
-    const queue = readDependencyNames(root).map(name => ({
+    //
+    // Profile tooling is ours even though it no longer sits in `dependencies`: it is
+    // fetched on demand, so the roots are what we declare plus what the profiles
+    // name. Without the second half every fetched tool is "the client's" and its
+    // licence blocks the client for a dependency they cannot remove.
+    const roots = new Set([...readDependencyNames(root), ...PROFILES.flatMap(p => p.packages)]);
+    const queue = [...roots].map(name => ({
         name,
         fromDir: root,
     }));

package/dist/esm/utils/resolve-bin.d.ts

@@ -16,6 +16,8 @@ export interface ResolvedTool {
  * to a run from before there was anything to fetch.
  */
 export declare function registerToolPaths(dirs: string[]): void;
+/** The roots registered for this run, for tools that load plugins by themselves. */
+export declare function registeredToolPaths(): string[];
 /** Drop every registered profile root. For tests, and for a second run in-process. */
 export declare function clearToolPaths(): void;
 /** The root of the installed pr-checkmate package — where our own tooling lives. */

package/dist/esm/utils/resolve-bin.js

@@ -25,6 +25,10 @@ let profileRoots = [];
 export function registerToolPaths(dirs) {
     profileRoots = [...dirs];
 }
+/** The roots registered for this run, for tools that load plugins by themselves. */
+export function registeredToolPaths() {
+    return [...profileRoots];
+}
 /** Drop every registered profile root. For tests, and for a second run in-process. */
 export function clearToolPaths() {
     profileRoots = [];

package/dist/esm/utils/result-collector.d.ts

@@ -1,8 +1,24 @@
 export type CheckStatus = 'pass' | 'warn' | 'fail' | 'skip';
+/**
+ * One thing a check found, with where it is. Optional on every result: only the
+ * checks that can say where report it, and a result without any is not an error —
+ * it just has a summary and no location.
+ */
+export interface Finding {
+    file: string;
+    /** 1-based line in the file as it will be committed. */
+    line?: number;
+    /** Which rule or pattern matched, as the check names it. */
+    rule: string;
+    /** The offending text, shortened. Never a secret: scanners that find those leave it out. */
+    snippet?: string;
+    severity: 'error' | 'warn';
+}
 export interface CheckResult {
     name: string;
     status: CheckStatus;
     details?: string;
+    findings?: Finding[];
 }
 /**
  *
@@ -12,7 +28,7 @@ export declare class ResultCollector {
     /**
      *
      */
-    register(name: string, status: CheckStatus, details?: string): void;
+    register(name: string, status: CheckStatus, details?: string, findings?: Finding[]): void;
     /**
      *
      */

package/dist/esm/utils/result-collector.js

@@ -8,9 +8,14 @@ export class ResultCollector {
     /**
      *
      */
-    register(name, status, details) {
+    register(name, status, details, findings) {
         const idx = this.results.findIndex(r => r.name === name);
-        const entry = { name, status, ...(details && { details }) };
+        const entry = {
+            name,
+            status,
+            ...(details && { details }),
+            ...(findings && findings.length > 0 && { findings }),
+        };
         if (idx >= 0) {
             this.results[idx] = entry;
         }

package/eslint-default-rules.json

@@ -26,14 +26,8 @@
   "sonarjs/cognitive-complexity": ["warn", 30],
   "sonarjs/no-duplicate-string": ["warn", { "threshold": 3 }],
   "sonarjs/no-identical-functions": "warn",
-  "import/order": [
-    "warn",
-    {
-      "groups": ["builtin", "external", "internal", "parent", "sibling", "index"],
-      "alphabetize": { "order": "asc", "caseInsensitive": true }
-    }
-  ],
-  "import/no-duplicates": "error",
+  "simple-import-sort/imports": "warn",
+  "no-duplicate-imports": ["error", { "allowSeparateTypeImports": true }],
   "jsdoc/check-param-names": "warn",
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",

package/eslint.config.mjs

@@ -1,12 +1,41 @@
 import fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
-import tsPlugin from '@typescript-eslint/eslint-plugin';
-import tsParser from '@typescript-eslint/parser';
-import prettierPlugin from 'eslint-plugin-prettier';
-import sonarjsPlugin from 'eslint-plugin-sonarjs';
-import importPlugin from 'eslint-plugin-import-x';
-import jsdocPlugin from 'eslint-plugin-jsdoc';
+import { pathToFileURL } from 'url';
+
+/**
+ * Plugins are loaded through the roots pr-checkmate registered for this run
+ * (`PR_CHECKMATE_TOOL_ROOTS`), because the `js` profile is fetched into a cache
+ * directory when a repository needs it and a bare `import` only searches the tree
+ * this file sits in. With no roots — development, or tooling that shipped beside
+ * the package — it is the plain import it always was.
+ */
+const toolRoots = (process.env.PR_CHECKMATE_TOOL_ROOTS ?? '').split(path.delimiter).filter(Boolean);
+const resolveFrom = createRequire(import.meta.url);
+
+async function loadPlugin(name) {
+  for (const root of toolRoots) {
+    try {
+      const entry = resolveFrom.resolve(name, { paths: [root] });
+      const mod = await import(pathToFileURL(entry).href);
+
+      return mod.default ?? mod;
+    } catch {}
+  }
+  const mod = await import(name);
+
+  return mod.default ?? mod;
+}
+
+const [tsPlugin, tsParser, prettierPlugin, sonarjsPlugin, jsdocPlugin, simpleImportSort] =
+  await Promise.all([
+    loadPlugin('@typescript-eslint/eslint-plugin'),
+    loadPlugin('@typescript-eslint/parser'),
+    loadPlugin('eslint-plugin-prettier'),
+    loadPlugin('eslint-plugin-sonarjs'),
+    loadPlugin('eslint-plugin-jsdoc'),
+    loadPlugin('eslint-plugin-simple-import-sort'),
+  ]);
 
 /**
  * Default ESLint rules — single source of truth, shared with init.ts so the
@@ -15,7 +44,7 @@ import jsdocPlugin from 'eslint-plugin-jsdoc';
  *
  * SEVERITY POLICY: `error` is reserved for defects a human has to resolve —
  * `no-debugger`, `eqeqeq`, `prefer-const`, `@typescript-eslint/no-unused-vars`,
- * `@typescript-eslint/no-floating-promises`, `import/no-duplicates`. Everything
+ * `@typescript-eslint/no-floating-promises`, `no-duplicate-imports`. Everything
  * that is purely formatting is `warn`, even
  * though it is auto-fixable, precisely BECAUSE it is auto-fixable: ESLint exits 1
  * on errors only, and the ESLint check maps exit 1 to a blocking failure, so an
@@ -179,7 +208,7 @@ export default [
       '@typescript-eslint': tsPlugin,
       prettier: prettierPlugin,
       sonarjs: sonarjsPlugin,
-      import: importPlugin,
+      'simple-import-sort': simpleImportSort,
       jsdoc: jsdocPlugin,
     },
 

package/install-manifests/commitlint/package-lock.json

@@ -421,6 +421,7 @@
       "version": "26.6.2",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
       "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.9.0"
@@ -481,7 +482,6 @@
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/conventional-commits-filter/-/conventional-commits-filter-6.0.1.tgz",
       "integrity": "sha512-cs+LadpH7Kpw0M3k8wurk+sOVVDAENA0iK4OBOrkL94j5lEVYRJ4j3zd2bhY9qgzyrPqthdcYT3axzRN7AliMg==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=22"
@@ -616,9 +616,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "funding": [
         {
           "type": "github",
@@ -874,6 +874,7 @@
       "version": "8.9.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
       "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/wrap-ansi": {

package/install-manifests/core/package-lock.json

@@ -376,6 +376,7 @@
       "version": "26.6.2",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
       "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.9.0"
@@ -906,9 +907,9 @@
       }
     },
     "node_modules/toml": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.0.tgz",
-      "integrity": "sha512-bsqEd+g7fzlrw7LEynQ6W6aOK/lTOlepz5x1sJyIV9fTZVJS2Q76nuju6FK+gZhW5bUpvB7mCEqdR0u4WziMFw==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.1.tgz",
+      "integrity": "sha512-EqYNA/YvUNndrA2B3O2ojzLQoTQrBxeZ9UIjQwk8t10oe6n7dwclBwd9IdZQTOKwe6vWX+AXtl6IntXRbepdxQ==",
       "license": "MIT",
       "engines": {
         "node": ">=20"
@@ -918,6 +919,7 @@
       "version": "8.9.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
       "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/unicorn-magic": {