pr-checkmate 4.1.1 → 4.2.0

package/README.md

@@ -17,12 +17,21 @@
 > [VirusTotal scan](https://github.com/Mybono/pr_checkmate_public/releases/latest) of the
 > exact published tarball on every release — plus 54 code-quality checks across 11
 > languages, bundled. One npm package, one `pr-checkmate.json`, no per-language toolchain
-> setup for the bundled ones. Also an [MCP server](#ai-agents-mcp): your AI coding agent runs the
-> same gate while it writes code.
+> setup for the bundled ones. Also an [MCP server](#ai-agents-mcp) and a
+> [Claude Code plugin](#ai-agents-mcp): your AI coding agent runs the same gate while it writes code.
 
 Language is auto-detected. Checks run in parallel phases, results post as one PR comment
 that updates in place, and formatter fixes are committed back to the branch.
 
+**Using Claude Code?** Install it as a plugin, one command, no `npm install` needed to start:
+
+```text
+/plugin install pr-checkmate --marketplace Mybono/pr_checkmate_public
+```
+
+It connects the MCP server and adds a skill that sets the package up in your repository when you
+agree. [Details below](#ai-agents-mcp).
+
 ## Quickstart
 
 **1. Install.**
@@ -84,6 +93,12 @@ your `PATH`). To stop Claude Code asking before every call, allow `mcp__pr-check
 `permissions.allow`
 ([details](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/ai-agents.md#after-installing)).
 
+**Claude Code plugin.** The one-command install at the top of this page replaces the two commands
+above. It runs the MCP server with `npx`, pinned to the released version, and adds a skill that
+offers to install the npm package if it is missing. The tools are named
+`mcp__plugin_pr-checkmate_mcp__*`, so allow that prefix instead of `mcp__pr-checkmate`. Claude
+Code still asks before the first call of each tool.
+
 | Tool | The agent calls it |
 |---|---|
 | `get_rules` | before writing — what blocks a PR, what only warns, your custom rules and banned imports |

package/dist/cjs/cli.js

@@ -29,6 +29,12 @@ const argv = process.argv.slice(2);
 const flags = argv.filter(arg => arg.startsWith('-'));
 const args = argv.filter(arg => !arg.startsWith('-'));
 const cmd = args[0];
+const WITH_AGENT = '--with-agent';
+const NO_HOOK = '--no-hook';
+/** Runs `agent-setup`; the commit hook is on unless `--no-hook` was passed. */
+function runAgentSetup() {
+    (0, setup_js_1.reportSetup)((0, setup_js_1.setupAgent)(process.cwd(), { hook: !flags.includes(NO_HOOK) }));
+}
 /**
  * An unrecognised flag aborts the run. Ignoring it would report success for a scope
  * the user did not ask for: a misspelling of `--full` must not quietly review the
@@ -55,8 +61,13 @@ function rejectConflictingScope() {
         index_js_2.logger.error('[cli]: "precommit --full" is contradictory — precommit reviews the staged changes. Run "pr-checkmate all --full" for a whole-repo review.');
         process.exit(1);
     }
-    if (cmd === 'init' && flags.length > 0) {
-        index_js_2.logger.error(`[cli]: "init" takes no flags, got: ${flags.join(', ')}.`);
+    const initFlags = flags.filter(flag => flag !== WITH_AGENT && flag !== NO_HOOK);
+    if (cmd === 'init' && initFlags.length > 0) {
+        index_js_2.logger.error(`[cli]: "init" takes only "--with-agent", got: ${initFlags.join(', ')}.`);
+        process.exit(1);
+    }
+    if (flags.includes(WITH_AGENT) && cmd !== 'init') {
+        index_js_2.logger.error('[cli]: "--with-agent" applies only to "init".');
         process.exit(1);
     }
     // `--all` belongs to `install` alone. Accepting it elsewhere would look like a
@@ -80,8 +91,9 @@ function rejectConflictingScope() {
         index_js_2.logger.error('[cli]: "--sarif" applies only to commands that run checks.');
         process.exit(1);
     }
-    if (flags.includes('--no-hook') && cmd !== 'agent-setup') {
-        index_js_2.logger.error('[cli]: "--no-hook" applies only to "agent-setup".');
+    const agentSetupInInit = cmd === 'init' && flags.includes(WITH_AGENT);
+    if (flags.includes(NO_HOOK) && cmd !== 'agent-setup' && !agentSetupInInit) {
+        index_js_2.logger.error('[cli]: "--no-hook" applies only to "agent-setup" or "init --with-agent".');
         process.exit(1);
     }
     if (flags.includes('--full') && commands_js_1.AGENT_COMMANDS.includes(cmd ?? '')) {
@@ -153,7 +165,7 @@ async function runAgentCommand() {
         process.exit(verdict.exitCode);
     }
     if (cmd === 'agent-setup') {
-        (0, setup_js_1.reportSetup)((0, setup_js_1.setupAgent)(process.cwd(), { hook: !flags.includes('--no-hook') }));
+        runAgentSetup();
         process.exit(0);
     }
     return false;
@@ -165,6 +177,8 @@ void (async () => {
         rejectExtraArgs();
         if (cmd === 'init') {
             await (0, init_js_1.init)();
+            if (flags.includes(WITH_AGENT))
+                runAgentSetup();
             process.exit(0);
         }
         if (await runAgentCommand())

package/dist/cjs/core/commands.js

@@ -98,5 +98,6 @@ exports.FLAGS = {
     '--full': 'review every tracked file instead of the diff (the default outside CI)',
     '--all': 'with "install": fetch every profile, not only the ones this repository needs',
     '--sarif': 'write findings as SARIF 2.1.0 to pr-checkmate.sarif (check-running commands only)',
-    '--no-hook': 'with "agent-setup": skip the git-commit gate for Claude Code',
+    '--no-hook': 'with "agent-setup" or "init --with-agent": skip the git-commit gate for Claude Code',
+    '--with-agent': 'with "init": also run "agent-setup" (MCP server, agent instructions, hook)',
 };

package/dist/esm/cli.js

@@ -24,6 +24,12 @@ const argv = process.argv.slice(2);
 const flags = argv.filter(arg => arg.startsWith('-'));
 const args = argv.filter(arg => !arg.startsWith('-'));
 const cmd = args[0];
+const WITH_AGENT = '--with-agent';
+const NO_HOOK = '--no-hook';
+/** Runs `agent-setup`; the commit hook is on unless `--no-hook` was passed. */
+function runAgentSetup() {
+    reportSetup(setupAgent(process.cwd(), { hook: !flags.includes(NO_HOOK) }));
+}
 /**
  * An unrecognised flag aborts the run. Ignoring it would report success for a scope
  * the user did not ask for: a misspelling of `--full` must not quietly review the
@@ -50,8 +56,13 @@ function rejectConflictingScope() {
         logger.error('[cli]: "precommit --full" is contradictory — precommit reviews the staged changes. Run "pr-checkmate all --full" for a whole-repo review.');
         process.exit(1);
     }
-    if (cmd === 'init' && flags.length > 0) {
-        logger.error(`[cli]: "init" takes no flags, got: ${flags.join(', ')}.`);
+    const initFlags = flags.filter(flag => flag !== WITH_AGENT && flag !== NO_HOOK);
+    if (cmd === 'init' && initFlags.length > 0) {
+        logger.error(`[cli]: "init" takes only "--with-agent", got: ${initFlags.join(', ')}.`);
+        process.exit(1);
+    }
+    if (flags.includes(WITH_AGENT) && cmd !== 'init') {
+        logger.error('[cli]: "--with-agent" applies only to "init".');
         process.exit(1);
     }
     // `--all` belongs to `install` alone. Accepting it elsewhere would look like a
@@ -75,8 +86,9 @@ function rejectConflictingScope() {
         logger.error('[cli]: "--sarif" applies only to commands that run checks.');
         process.exit(1);
     }
-    if (flags.includes('--no-hook') && cmd !== 'agent-setup') {
-        logger.error('[cli]: "--no-hook" applies only to "agent-setup".');
+    const agentSetupInInit = cmd === 'init' && flags.includes(WITH_AGENT);
+    if (flags.includes(NO_HOOK) && cmd !== 'agent-setup' && !agentSetupInInit) {
+        logger.error('[cli]: "--no-hook" applies only to "agent-setup" or "init --with-agent".');
         process.exit(1);
     }
     if (flags.includes('--full') && AGENT_COMMANDS.includes(cmd ?? '')) {
@@ -148,7 +160,7 @@ async function runAgentCommand() {
         process.exit(verdict.exitCode);
     }
     if (cmd === 'agent-setup') {
-        reportSetup(setupAgent(process.cwd(), { hook: !flags.includes('--no-hook') }));
+        runAgentSetup();
         process.exit(0);
     }
     return false;
@@ -160,6 +172,8 @@ void (async () => {
         rejectExtraArgs();
         if (cmd === 'init') {
             await init();
+            if (flags.includes(WITH_AGENT))
+                runAgentSetup();
             process.exit(0);
         }
         if (await runAgentCommand())

package/dist/esm/core/commands.js

@@ -95,5 +95,6 @@ export const FLAGS = {
     '--full': 'review every tracked file instead of the diff (the default outside CI)',
     '--all': 'with "install": fetch every profile, not only the ones this repository needs',
     '--sarif': 'write findings as SARIF 2.1.0 to pr-checkmate.sarif (check-running commands only)',
-    '--no-hook': 'with "agent-setup": skip the git-commit gate for Claude Code',
+    '--no-hook': 'with "agent-setup" or "init --with-agent": skip the git-commit gate for Claude Code',
+    '--with-agent': 'with "init": also run "agent-setup" (MCP server, agent instructions, hook)',
 };

package/install-manifests/core/package-lock.json

@@ -11,7 +11,7 @@
         "execa": "9.6.1",
         "yaml": "2.9.1",
         "inquirer": "14.2.2",
-        "gitleaks-secret-scanner-fixed": "3.0.6"
+        "gitleaks-secret-scanner-fixed": "3.1.0"
       }
     },
     "node_modules/@inquirer/ansi": {
@@ -573,9 +573,9 @@
       }
     },
     "node_modules/gitleaks-secret-scanner-fixed": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/gitleaks-secret-scanner-fixed/-/gitleaks-secret-scanner-fixed-3.0.6.tgz",
-      "integrity": "sha512-qW7JSjmuuPGZxn3b6QUu2etB7i5b1xl6Mx6KFodqzw+C4NYifP4YKW0dtKuwc1YYJAI/h3fEM0EftSwFjxy57A==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/gitleaks-secret-scanner-fixed/-/gitleaks-secret-scanner-fixed-3.1.0.tgz",
+      "integrity": "sha512-QDsoAkzJEdV+iOK4iNneUW/2tHCum8TCIISzGIXG/dGNR26+wy9zoYqpWh+20pH1iK/WUBV3WkcESeO91JC0zg==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/install-manifests/core/package.json

@@ -5,7 +5,7 @@
     "execa": "9.6.1",
     "yaml": "2.9.1",
     "inquirer": "14.2.2",
-    "gitleaks-secret-scanner-fixed": "3.0.6"
+    "gitleaks-secret-scanner-fixed": "3.1.0"
   },
   "private": true
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "4.1.1",
+    "version": "4.2.0",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -83,7 +83,7 @@
     "license": "LicenseRef-PR-Checkmate-Proprietary",
     "dependencies": {
         "execa": "^9.6.0",
-        "gitleaks-secret-scanner-fixed": "3.0.6",
+        "gitleaks-secret-scanner-fixed": "3.1.0",
         "inquirer": "^14.1.0",
         "yaml": "^2.9.0"
     },