pr-checkmate 3.2.3 → 4.0.0

package/install-manifests/js/package.json

@@ -3,14 +3,14 @@
   "version": "1.0.0",
   "dependencies": {
     "typescript": "6.0.3",
-    "eslint": "10.11.0",
+    "eslint": "10.14.0",
     "eslint-config-prettier": "10.1.8",
-    "eslint-plugin-import-x": "4.17.1",
-    "eslint-plugin-jsdoc": "65.1.0",
-    "eslint-plugin-prettier": "5.5.6",
-    "eslint-plugin-sonarjs": "4.2.1",
-    "@typescript-eslint/eslint-plugin": "8.70.1",
-    "@typescript-eslint/parser": "8.70.1",
+    "eslint-plugin-jsdoc": "65.4.2",
+    "eslint-plugin-prettier": "5.5.7",
+    "eslint-plugin-simple-import-sort": "14.0.0",
+    "eslint-plugin-sonarjs": "4.2.2",
+    "@typescript-eslint/eslint-plugin": "8.72.1",
+    "@typescript-eslint/parser": "8.72.1",
     "prettier": "3.9.9",
     "dpdm": "4.3.0",
     "knip": "6.38.0",
@@ -20,7 +20,9 @@
   "overrides": {
     "dpdm": {
       "typescript": "$typescript"
-    }
+    },
+    "minimatch": "^11.0.3",
+    "glob": "^14.0.3"
   },
   "private": true
 }

package/install-manifests/markdown/package-lock.json

@@ -9,6 +9,9 @@
       "version": "1.0.0",
       "dependencies": {
         "markdownlint": "0.41.1"
+      },
+      "overrides": {
+        "katex": "^0.19.1"
       }
     },
     "node_modules/@types/debug": {
@@ -80,6 +83,15 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/commander": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
+      "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -189,30 +201,21 @@
       }
     },
     "node_modules/katex": {
-      "version": "0.16.47",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
-      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
+      "version": "0.19.1",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.19.1.tgz",
+      "integrity": "sha512-jG8uKntjSEcm2EpQOh0XturpPuuC9r3Sq5HLHdsFdWZT27E672SF19QEi+of0/YeOy15lDgRhKvr5614uRrEfA==",
       "funding": [
         "https://opencollective.com/katex",
         "https://github.com/sponsors/katex"
       ],
       "license": "MIT",
       "dependencies": {
-        "commander": "^8.3.0"
+        "commander": "^15.0.0"
       },
       "bin": {
         "katex": "cli.js"
       }
     },
-    "node_modules/katex/node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/markdownlint": {
       "version": "0.41.1",
       "resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.41.1.tgz",

package/install-manifests/markdown/package.json

@@ -4,5 +4,8 @@
   "dependencies": {
     "markdownlint": "0.41.1"
   },
+  "overrides": {
+    "katex": "^0.19.1"
+  },
   "private": true
 }

package/install-manifests/spellcheck/package-lock.json

@@ -982,9 +982,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz",
-      "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==",
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.1.tgz",
+      "integrity": "sha512-j7WyPdf0CJoutMzMoPLF/bVXHtKZIT9Rb4eGeEbWw8X2t5oirjPgpL+OpaENZrILYaXqYwnVH+qgUwVbl+pUJQ==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 18"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "3.2.3",
+    "version": "4.0.0",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -9,7 +9,11 @@
         "eslint",
         "prettier",
         "code-quality",
-        "automation"
+        "automation",
+        "mcp",
+        "model-context-protocol",
+        "ai-agents",
+        "claude-code"
     ],
     "main": "./dist/cjs/index.js",
     "module": "./dist/esm/index.js",
@@ -78,6 +82,12 @@
     "author": "Artur Polishchuk",
     "license": "SEE LICENSE IN LICENSE",
     "dependencies": {
+        "execa": "^9.6.0",
+        "gitleaks-secret-scanner-fixed": "3.0.4",
+        "inquirer": "^14.1.0",
+        "yaml": "^2.9.0"
+    },
+    "devDependencies": {
         "@astral-sh/ruff-wasm-nodejs": "^0.16.3",
         "@commitlint/cli": "^21.2.2",
         "@commitlint/config-conventional": "^21.2.2",
@@ -86,37 +96,35 @@
         "@typescript-eslint/parser": "^8.67.0",
         "@wasm-fmt/clang-format": "^23.1.1",
         "@wasm-fmt/gofmt": "^0.7.3",
+        "conventional-commits-filter": "^6.0.1",
+        "conventional-commits-parser": "^7.1.2",
         "cspell": "^10.0.1",
         "dpdm": "^4.3.0",
         "eslint": "^10.8.1",
         "eslint-config-prettier": "^10.1.8",
-        "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jsdoc": "^65.1.0",
         "eslint-plugin-prettier": "^5.5.6",
+        "eslint-plugin-simple-import-sort": "^14.0.0",
         "eslint-plugin-sonarjs": "^4.2.0",
-        "execa": "^9.6.0",
-        "gitleaks-secret-scanner-fixed": "3.0.4",
-        "inquirer": "^14.1.0",
         "jscpd": "^5.0.16",
         "knip": "^6.32.2",
         "license-checker-rseidelsohn": "^5.0.1",
         "markdownlint": "^0.41.1",
         "prettier": "^3.9.6",
-        "ts-node": "^10.9.1",
-        "ts-unused-exports": "^11.0.1",
-        "typescript": "^6.0.3",
-        "yaml": "^2.9.0"
-    },
-    "devDependencies": {
-        "conventional-commits-filter": "^6.0.1",
-        "conventional-commits-parser": "^7.1.2",
         "pyright": "^1.1.413",
         "standard-version": "^9.5.0",
-        "typedoc": "^0.28.20"
+        "ts-node": "^10.9.1",
+        "ts-unused-exports": "^11.0.1",
+        "typedoc": "^0.28.20",
+        "typescript": "^6.0.3"
     },
     "overrides": {
         "dpdm": {
             "typescript": "$typescript"
-        }
+        },
+        "minimatch": "^11.0.3",
+        "glob": "^14.0.3",
+        "katex": "^0.19.1",
+        "dotgitignore": "file:./tools/dotgitignore"
     }
 }

package/pr-checkmate.schema.json

@@ -309,6 +309,41 @@
     "dockerfileSecurity": {
       "$ref": "#/$defs/toggleIgnorePaths"
     },
+    "agentInstructions": {
+      "$ref": "#/$defs/toggleIgnorePaths"
+    },
+    "mcp": {
+      "type": "object",
+      "description": "What the pr-checkmate MCP server offers an AI agent working in this project. Changes apply to the agent's next request.",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "false turns the server off for this project: it still connects, but offers no tools, resources or prompts. Default true."
+        },
+        "disabledTools": {
+          "type": "array",
+          "description": "Tools to hide from the agent.",
+          "items": {
+            "enum": [
+              "get_rules",
+              "check_changes",
+              "apply_fixes",
+              "scan_secrets",
+              "check_dependency",
+              "suggest_config",
+              "write_config",
+              "explain_config",
+              "verify"
+            ]
+          }
+        },
+        "readOnly": {
+          "type": "boolean",
+          "description": "Hide the tools that write files (apply_fixes, write_config), so the agent can only read and report. Default false."
+        }
+      }
+    },
     "migrationSafety": {
       "$ref": "#/$defs/toggleSeverity"
     },

package/src/config/.eslintrc.js

@@ -41,7 +41,7 @@ module.exports = {
     sourceType: 'module',
     project: './tsconfig.json',
   },
-  plugins: ['@typescript-eslint', 'prettier', 'import-x', 'jsdoc'],
+  plugins: ['@typescript-eslint', 'prettier', 'simple-import-sort', 'jsdoc'],
   extends: [
     'eslint:recommended',
     'plugin:@typescript-eslint/recommended',
@@ -85,14 +85,8 @@ module.exports = {
     // Complexity analysis (#61)
     complexity: ['warn', 30],
     // Import ordering (#65)
-    'import-x/order': [
-      'warn',
-      {
-        groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
-        alphabetize: { order: 'asc', caseInsensitive: true },
-      },
-    ],
-    'import-x/no-duplicates': 'error',
+    'simple-import-sort/imports': 'warn',
+    'no-duplicate-imports': ['error', { allowSeparateTypeImports: true }],
     // Documentation (#62). `jsdoc/require-jsdoc` is deliberately absent — see the
     // note in eslint-flat-config.mjs. These three check docblocks that exist and
     // fix only inside them; they never fabricate one.

package/src/config/eslint-default-rules.json

@@ -26,14 +26,8 @@
   "sonarjs/cognitive-complexity": ["warn", 30],
   "sonarjs/no-duplicate-string": ["warn", { "threshold": 3 }],
   "sonarjs/no-identical-functions": "warn",
-  "import/order": [
-    "warn",
-    {
-      "groups": ["builtin", "external", "internal", "parent", "sibling", "index"],
-      "alphabetize": { "order": "asc", "caseInsensitive": true }
-    }
-  ],
-  "import/no-duplicates": "error",
+  "simple-import-sort/imports": "warn",
+  "no-duplicate-imports": ["error", { "allowSeparateTypeImports": true }],
   "jsdoc/check-param-names": "warn",
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",

package/src/config/pr-checkmate.schema.json

@@ -309,6 +309,41 @@
     "dockerfileSecurity": {
       "$ref": "#/$defs/toggleIgnorePaths"
     },
+    "agentInstructions": {
+      "$ref": "#/$defs/toggleIgnorePaths"
+    },
+    "mcp": {
+      "type": "object",
+      "description": "What the pr-checkmate MCP server offers an AI agent working in this project. Changes apply to the agent's next request.",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "false turns the server off for this project: it still connects, but offers no tools, resources or prompts. Default true."
+        },
+        "disabledTools": {
+          "type": "array",
+          "description": "Tools to hide from the agent.",
+          "items": {
+            "enum": [
+              "get_rules",
+              "check_changes",
+              "apply_fixes",
+              "scan_secrets",
+              "check_dependency",
+              "suggest_config",
+              "write_config",
+              "explain_config",
+              "verify"
+            ]
+          }
+        },
+        "readOnly": {
+          "type": "boolean",
+          "description": "Hide the tools that write files (apply_fixes, write_config), so the agent can only read and report. Default false."
+        }
+      }
+    },
     "migrationSafety": {
       "$ref": "#/$defs/toggleSeverity"
     },