vibecodedshit 0.0.0-stage → 0.2.0

package/dist/tools/workcopy.js

@@ -0,0 +1,27 @@
+import { existsSync } from 'node:fs';
+import { copyFile, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+/**
+ * Copy these working-tree files (same relative paths) into a new temp directory.
+ * Tools that read their own config run there, so no repository config can change a score.
+ * A path missing from the working tree (tracked but deleted, or a broken symlink) is skipped.
+ */
+export async function createWorkCopy(repoPath, relPaths) {
+    const dir = await mkdtemp(path.join(tmpdir(), 'health-work-'));
+    try {
+        for (const rel of relPaths) {
+            const src = path.join(repoPath, rel);
+            if (!existsSync(src))
+                continue;
+            const dest = path.join(dir, rel);
+            await mkdir(path.dirname(dest), { recursive: true });
+            await copyFile(src, dest);
+        }
+    }
+    catch (err) {
+        await rm(dir, { recursive: true, force: true });
+        throw err;
+    }
+    return { dir, cleanup: () => rm(dir, { recursive: true, force: true }) };
+}

package/dist/util/ini.js

@@ -0,0 +1,37 @@
+/**
+ * Minimal INI reader for mypy's `mypy.ini`, `.mypy.ini` and `setup.cfg`: sections, `key = value`
+ * and `key: value`, `;` and `#` comment lines, indented continuation lines, no interpolation.
+ * Keys before any section go to the section "".
+ */
+export function parseIni(text) {
+    const sections = {};
+    let current = '';
+    let lastKey;
+    for (const rawLine of text.split(/\r\n|\r|\n/)) {
+        if (rawLine.trim() === '') {
+            lastKey = undefined;
+            continue;
+        }
+        if (/^\s*[;#]/.test(rawLine))
+            continue;
+        if (/^\s/.test(rawLine) && lastKey !== undefined) {
+            const section = (sections[current] ??= {});
+            section[lastKey] = `${section[lastKey] ?? ''}\n${rawLine.trim()}`;
+            continue;
+        }
+        const header = /^\s*\[([^\]]*)\]/.exec(rawLine);
+        if (header) {
+            current = (header[1] ?? '').trim();
+            sections[current] ??= {};
+            lastKey = undefined;
+            continue;
+        }
+        const pair = /^\s*([^=:]+?)\s*[=:]\s*(.*?)\s*$/.exec(rawLine);
+        if (pair?.[1] !== undefined) {
+            const section = (sections[current] ??= {});
+            lastKey = pair[1];
+            section[lastKey] = pair[2] ?? '';
+        }
+    }
+    return sections;
+}

package/dist/util/pep440.js

@@ -0,0 +1,163 @@
+/** The part of PEP 440 that dependency checks need: versions, ordering and specifiers. */
+const VERSION = /^\s*v?(?:(\d+)!)?(\d+(?:\.\d+)*)(?:[-_.]?(a|alpha|b|beta|c|rc|pre|preview)[-_.]?(\d+)?)?(?:-(\d+)|[-_.]?(post|rev|r)[-_.]?(\d+)?)?(?:[-_.]?(dev)[-_.]?(\d+)?)?(?:\+([a-z0-9]+(?:[-_.][a-z0-9]+)*))?\s*$/;
+export function parseVersion(text) {
+    const m = VERSION.exec(text.toLowerCase());
+    if (!m)
+        return undefined;
+    const version = { epoch: Number(m[1] ?? 0), release: (m[2] ?? '0').split('.').map(Number) };
+    if (m[3] !== undefined) {
+        const label = m[3];
+        const kind = label === 'a' || label === 'alpha' ? 'a' : label === 'b' || label === 'beta' ? 'b' : 'rc';
+        version.pre = { kind, n: Number(m[4] ?? 0) };
+    }
+    if (m[5] !== undefined)
+        version.post = Number(m[5]);
+    else if (m[6] !== undefined)
+        version.post = Number(m[7] ?? 0);
+    if (m[8] !== undefined)
+        version.dev = Number(m[9] ?? 0);
+    if (m[10] !== undefined)
+        version.local = m[10];
+    return version;
+}
+function cmpNumbers(a, b) {
+    const length = Math.max(a.length, b.length);
+    for (let i = 0; i < length; i += 1) {
+        const diff = (a[i] ?? 0) - (b[i] ?? 0);
+        if (diff !== 0)
+            return diff < 0 ? -1 : 1;
+    }
+    return 0;
+}
+const PRE_RANK = { a: 0, b: 1, rc: 2 };
+/** Sort key for the pre/post/dev part, following the PEP 440 ordering rules. */
+function phase(v) {
+    const pre = v.pre ? PRE_RANK[v.pre.kind] : v.post === undefined && v.dev !== undefined ? -1 : 3;
+    const preN = v.pre ? v.pre.n : 0;
+    const post = v.post === undefined ? -1 : v.post;
+    const dev = v.dev === undefined ? Number.POSITIVE_INFINITY : v.dev;
+    return [pre, preN, post, dev, 0];
+}
+export function compareVersions(a, b) {
+    if (a.epoch !== b.epoch)
+        return a.epoch < b.epoch ? -1 : 1;
+    const release = cmpNumbers(a.release, b.release);
+    if (release !== 0)
+        return release;
+    const pa = phase(a);
+    const pb = phase(b);
+    for (let i = 0; i < pa.length; i += 1) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (x !== y)
+            return x < y ? -1 : 1;
+    }
+    const la = a.local ?? '';
+    const lb = b.local ?? '';
+    return la === lb ? 0 : la < lb ? -1 : 1;
+}
+/** A stable release: no pre-release and no dev part (post releases are stable). */
+export function isStable(v) {
+    return v.pre === undefined && v.dev === undefined;
+}
+function stripLocal(v) {
+    return { epoch: v.epoch, release: v.release, pre: v.pre, post: v.post, dev: v.dev };
+}
+function parseClauses(specifier) {
+    const clauses = [];
+    for (const part of specifier.split(',')) {
+        const trimmed = part.trim();
+        if (trimmed === '')
+            continue;
+        const m = /^(===|==|!=|<=|>=|~=|<|>)\s*(.+)$/.exec(trimmed);
+        if (!m?.[1] || !m[2])
+            return undefined;
+        clauses.push({ op: m[1], version: m[2].trim() });
+    }
+    return clauses;
+}
+function clauseHolds(version, raw, clause) {
+    const wildcard = clause.version.endsWith('.*');
+    const target = parseVersion(wildcard ? clause.version.slice(0, -2) : clause.version);
+    if (!target)
+        return false;
+    const a = stripLocal(version);
+    switch (clause.op) {
+        case '===':
+            return raw.trim().toLowerCase() === clause.version.toLowerCase();
+        case '==':
+        case '!=': {
+            let equal;
+            if (wildcard) {
+                equal = a.epoch === target.epoch && target.release.every((n, i) => (a.release[i] ?? 0) === n);
+            }
+            else {
+                equal = compareVersions(target.local ? version : a, target) === 0;
+            }
+            return clause.op === '==' ? equal : !equal;
+        }
+        case '<=':
+            return compareVersions(a, target) <= 0;
+        case '>=':
+            return compareVersions(a, target) >= 0;
+        case '<':
+            return compareVersions(a, target) < 0 && !(target.pre === undefined && a.pre !== undefined && cmpNumbers(a.release, target.release) === 0);
+        case '>':
+            return compareVersions(a, target) > 0 && !(target.post === undefined && a.post !== undefined && cmpNumbers(a.release, target.release) === 0);
+        case '~=': {
+            if (target.release.length < 2)
+                return false;
+            const prefix = target.release.slice(0, -1);
+            if (compareVersions(a, target) < 0)
+                return false;
+            return a.epoch === target.epoch && prefix.every((n, i) => (a.release[i] ?? 0) === n);
+        }
+        default:
+            return false;
+    }
+}
+/** Is this text a well-formed specifier set ('' is valid and means any version)? */
+export function isValidSpecifier(specifier) {
+    return parseClauses(specifier) !== undefined;
+}
+/** Does `version` satisfy a PEP 440 specifier set? An empty specifier accepts everything. */
+export function satisfies(version, specifier) {
+    const parsed = parseVersion(version);
+    if (!parsed)
+        return false;
+    const clauses = parseClauses(specifier);
+    if (!clauses)
+        return false;
+    return clauses.every((clause) => clauseHolds(parsed, version, clause));
+}
+/** `^1.2.3` and `~1.2.3` (Poetry) to a PEP 440 specifier set; other constraints pass through. */
+export function poetryToPep440(constraint) {
+    const text = constraint.trim();
+    if (text === '' || text === '*')
+        return '';
+    return text
+        .split(',')
+        .map((part) => part.trim())
+        .map((part) => {
+        const m = /^([\^~])\s*(\d+(?:\.\d+)*)/.exec(part);
+        if (!m?.[2])
+            return /^\d/.test(part) ? `==${part}` : part;
+        const nums = m[2].split('.').map(Number);
+        let upper;
+        if (m[1] === '^') {
+            const index = nums.findIndex((n) => n !== 0);
+            const at = index === -1 ? nums.length - 1 : index;
+            upper = nums.slice(0, at + 1);
+            upper[at] = (upper[at] ?? 0) + 1;
+        }
+        else {
+            upper = nums.length === 1 ? [(nums[0] ?? 0) + 1] : [nums[0] ?? 0, (nums[1] ?? 0) + 1];
+        }
+        return `>=${nums.join('.')},<${upper.join('.')}`;
+    })
+        .join(',');
+}
+/** PEP 503 name normalization. */
+export function normalizeName(name) {
+    return name.toLowerCase().replace(/[-_.]+/g, '-');
+}

package/dist/util/toml.js

@@ -0,0 +1,27 @@
+import { readFileSync } from 'node:fs';
+import { parse } from 'smol-toml';
+/** A missing file or invalid TOML gives undefined; the caller adds the warning for invalid TOML. */
+export function readToml(absPath) {
+    let text;
+    try {
+        text = readFileSync(absPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        return parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse TOML text; invalid TOML gives undefined. */
+export function parseTomlText(text) {
+    try {
+        return parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}

package/docker/Dockerfile

@@ -0,0 +1,142 @@
+# health:1.0, the pinned runner for the execution layer and, in full runs, every static tool. Build: npm run image:build
+# Every tool is pinned by an exact version below. The base image is pinned by digest.
+ARG NODE_IMAGE=node:22.20.0-bookworm@sha256:915acd9e9b885ead0c620e27e37c81b74c226e0e1c8177f37a60217b6eabb0d7
+FROM ${NODE_IMAGE}
+
+ARG NPM_VERSION=11.21.0
+ARG PNPM_VERSION=12.9.1
+ARG YARN_VERSION=4.18.1
+ARG BUN_VERSION=1.4.2
+ARG TYPESCRIPT_VERSION=5.9.3
+ARG ESLINT_VERSION=9.39.5
+ARG TYPESCRIPT_ESLINT_VERSION=8.71.0
+ARG ESLINT_PLUGIN_REACT_HOOKS_VERSION=7.1.1
+ARG PYRIGHT_VERSION=1.1.414
+ARG UV_VERSION=0.12.23
+ARG PYTHON_VERSION=3.12.15
+ARG POETRY_VERSION=2.5.1
+ARG PDM_VERSION=2.29.2
+ARG PIPENV_VERSION=2026.8.0
+ARG RUFF_VERSION=0.16.10
+ARG MYPY_VERSION=2.4.0
+ARG C8_VERSION=12.0.0
+# Same version as the host's knip in package.json, so preview and full runs report the same issues.
+ARG KNIP_VERSION=6.39.0
+ARG JSCPD_VERSION=5.4.0
+ARG COMPLEXIPY_VERSION=8.0.1
+ARG VULTURE_VERSION=2.16
+ARG DEPTRY_VERSION=0.25.1
+ARG IMPORT_LINTER_VERSION=2.15
+ARG GRIMP_VERSION=3.17
+ARG GITLEAKS_VERSION=8.30.1
+ARG GITLEAKS_SHA256_AMD64=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+ARG GITLEAKS_SHA256_ARM64=e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080
+ARG OSV_SCANNER_VERSION=2.7.0
+ARG OSV_SCANNER_SHA256_AMD64=160c6253e2922e9e0a6a9771c5c4c40a4b3c6090b34a3cdd5e80c96cc2e4218b
+ARG OSV_SCANNER_SHA256_ARM64=4061ef4c021ed3c47f203b818f337e351336cc5cd67c0274fc36bd1dfc728dd7
+ARG PYTEST_VERSION=9.1.1
+ARG PYTEST_COV_VERSION=7.1.0
+ARG COVERAGE_VERSION=7.16.2
+ARG GO_VERSION=1.27.1
+ARG GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445
+ARG GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec
+# Set by BuildKit. Redeclared here so the stage can see it; empty on a legacy builder.
+ARG TARGETARCH
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git ca-certificates curl build-essential \
+ && rm -rf /var/lib/apt/lists/*
+
+# Node tools. Yarn is Berry because the methodology installs with `yarn install --immutable`.
+# The base image ships Yarn 1 at /usr/local/bin/yarn, which blocks the Berry install, so it is removed first.
+# npm is pinned past the base image's 10.9: its peer resolution crashes on vitest 4 (`reading 'edgesOut'`).
+RUN rm -rf /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-v* \
+ && npm install -g npm@${NPM_VERSION} \
+ && npm install -g \
+    pnpm@${PNPM_VERSION} \
+    @yarnpkg/cli-dist@${YARN_VERSION} \
+    bun@${BUN_VERSION} \
+    typescript@${TYPESCRIPT_VERSION} \
+    eslint@${ESLINT_VERSION} \
+    pyright@${PYRIGHT_VERSION} \
+    c8@${C8_VERSION} \
+    knip@${KNIP_VERSION} \
+    jscpd@${JSCPD_VERSION}
+
+# The pinned lint ruleset and its plugins live in /opt/health, never in a scanned repository.
+# type=module because bin/health-eslint is extensionless ESM; npm 11's `npm init -y` writes "type": "commonjs",
+# under which node exits 0 on it without running it.
+WORKDIR /opt/health
+RUN npm init -y >/dev/null \
+ && npm pkg set type=module \
+ && npm install --save-exact \
+    eslint@${ESLINT_VERSION} \
+    typescript@${TYPESCRIPT_VERSION} \
+    typescript-eslint@${TYPESCRIPT_ESLINT_VERSION} \
+    eslint-plugin-react-hooks@${ESLINT_PLUGIN_REACT_HOOKS_VERSION}
+COPY config/ /opt/health/
+COPY bin/ /opt/health/bin/
+RUN chmod +x /opt/health/bin/*
+
+# Python 3.12 from uv's pinned builds, then the Python tools. Steps run as the host user, so the tool environments
+# live in /opt/uv-tools: uv's default is under /root, which no other user can enter.
+ENV UV_PYTHON_INSTALL_DIR=/opt/python UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin UV_LINK_MODE=copy POETRY_VIRTUALENVS_IN_PROJECT=1 PIPENV_VENV_IN_PROJECT=1
+RUN curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh \
+ && mv /root/.local/bin/uv /root/.local/bin/uvx /usr/local/bin/ \
+ && uv python install ${PYTHON_VERSION} \
+ && ln -s "$(uv python find ${PYTHON_VERSION})" /usr/local/bin/python \
+ && ln -s /usr/local/bin/python /usr/local/bin/python3 \
+ && uv tool install --python ${PYTHON_VERSION} poetry==${POETRY_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} pdm==${PDM_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} pipenv==${PIPENV_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} ruff==${RUFF_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} mypy==${MYPY_VERSION}
+
+# The static tools of a full run (4.1, 4.4, 5.5 and D3 for Python). import-linter's environment also holds grimp,
+# which python/graph_helper.py imports; the helper runs with /opt/uv-tools/import-linter/bin/python.
+RUN uv tool install --python ${PYTHON_VERSION} complexipy==${COMPLEXIPY_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} vulture==${VULTURE_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} deptry==${DEPTRY_VERSION} \
+ && uv tool install --python ${PYTHON_VERSION} import-linter==${IMPORT_LINTER_VERSION} --with grimp==${GRIMP_VERSION}
+
+# pytest, pytest-cov and coverage as wheels, for repositories whose environment has none (the test step has no network). `health-pytest` installs them offline.
+RUN uv venv /tmp/wheel-venv --python ${PYTHON_VERSION} \
+ && uv pip install --python /tmp/wheel-venv/bin/python pip \
+ && /tmp/wheel-venv/bin/python -m pip download -d /opt/health/wheels pytest==${PYTEST_VERSION} pytest-cov==${PYTEST_COV_VERSION} coverage==${COVERAGE_VERSION} \
+ && rm -rf /tmp/wheel-venv
+
+# Go, pinned by checksum for amd64 and arm64. No parameter uses it yet.
+# TARGETARCH is empty without BuildKit, so it falls back to the Debian architecture name.
+RUN arch="${TARGETARCH:-$(dpkg --print-architecture)}" \
+ && case "${arch}" in \
+      amd64) go_sha256="${GO_SHA256_AMD64}" ;; \
+      arm64) go_sha256="${GO_SHA256_ARM64}" ;; \
+      *) echo "unsupported architecture for Go: ${arch}" >&2; exit 1 ;; \
+    esac \
+ && curl -fsSL -o /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-${arch}.tar.gz" \
+ && echo "${go_sha256}  /tmp/go.tgz" | sha256sum -c - \
+ && tar -C /usr/local -xzf /tmp/go.tgz \
+ && rm /tmp/go.tgz
+
+# gitleaks (5.4) and osv-scanner (5.1), release binaries pinned by checksum for amd64 and arm64.
+RUN arch="${TARGETARCH:-$(dpkg --print-architecture)}" \
+ && case "${arch}" in \
+      amd64) gitleaks_arch=x64; gitleaks_sha256="${GITLEAKS_SHA256_AMD64}"; osv_sha256="${OSV_SCANNER_SHA256_AMD64}" ;; \
+      arm64) gitleaks_arch=arm64; gitleaks_sha256="${GITLEAKS_SHA256_ARM64}"; osv_sha256="${OSV_SCANNER_SHA256_ARM64}" ;; \
+      *) echo "unsupported architecture for gitleaks and osv-scanner: ${arch}" >&2; exit 1 ;; \
+    esac \
+ && curl -fsSL -o /tmp/gitleaks.tgz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${gitleaks_arch}.tar.gz" \
+ && echo "${gitleaks_sha256}  /tmp/gitleaks.tgz" | sha256sum -c - \
+ && tar -C /usr/local/bin -xzf /tmp/gitleaks.tgz gitleaks \
+ && rm /tmp/gitleaks.tgz \
+ && curl -fsSL -o /usr/local/bin/osv-scanner "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_${arch}" \
+ && echo "${osv_sha256}  /usr/local/bin/osv-scanner" | sha256sum -c - \
+ && chmod +x /usr/local/bin/osv-scanner
+
+ENV PATH=/opt/health/bin:/usr/local/go/bin:$PATH
+WORKDIR /work
+
+# Bumped whenever the set of tools a full run needs from the image changes. A full scan refuses an image whose
+# label differs from IMAGE_REVISION in src/exec/docker.ts, so an image built before the change is rebuilt.
+LABEL dev.vibecodedshit.health.revision="2"

package/docker/bin/health-capture

@@ -0,0 +1,5 @@
+#!/bin/sh
+# health-capture <file> <command...>: run the command with stdout in <file>, keep its exit code.
+out="$1"
+shift
+exec "$@" > "$out"

package/docker/bin/health-coverage-install

@@ -0,0 +1,5 @@
+#!/bin/sh
+# health-coverage-install: install @vitest/coverage-v8 at the installed vitest version, into the work copy only.
+[ -f node_modules/@vitest/coverage-v8/package.json ] && exit 0
+version=$(node -p "require('vitest/package.json').version") || exit 1
+exec npm install --no-save --no-package-lock --ignore-scripts "@vitest/coverage-v8@$version"

package/docker/bin/health-eslint

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// health-eslint <eslint args...>: run eslint, then relint without type information the files the project service
+// could not place in any tsconfig ("was not found by the project service"). Those files get the core rules and
+// @typescript-eslint/no-unused-vars; their fatal entry is replaced by the untyped result. A real syntax error still
+// reports one fatal message in either pass. Prints the merged JSON report on stdout, exits like eslint (0 clean, 1 findings).
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+
+const UNTYPED_CONFIG = '/opt/health/eslint.untyped.config.mjs';
+const MAX_BUFFER = 512 * 1024 * 1024;
+
+/**
+ * Node's default heap (about 2 GB) is too small for typed linting of a large repository, well inside the
+ * container's memory limit: eslint then dies with "heap out of memory" (exit 2). The heap gets 75% of the
+ * container's cgroup limit (the methodology's runner.memory_gb), or 6 GB when the limit cannot be read.
+ */
+function heapMegabytes() {
+  try {
+    const limit = Number(readFileSync('/sys/fs/cgroup/memory.max', 'utf8').trim());
+    if (Number.isFinite(limit) && limit > 0) return Math.floor((limit / 1024 / 1024) * 0.75);
+  } catch {
+    // No cgroup v2 limit to read.
+  }
+  return 6144;
+}
+
+const env = { ...process.env, NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --max-old-space-size=${heapMegabytes()}`.trim() };
+
+function eslint(args) {
+  return spawnSync('eslint', args, { encoding: 'utf8', maxBuffer: MAX_BUFFER, stdio: ['ignore', 'pipe', 'inherit'], env });
+}
+
+function parse(text) {
+  try {
+    const doc = JSON.parse(text);
+    return Array.isArray(doc) ? doc : null;
+  } catch {
+    return null;
+  }
+}
+
+const args = process.argv.slice(2);
+const first = eslint(args);
+const report = parse(first.stdout ?? '');
+if (report === null || (first.status !== 0 && first.status !== 1)) {
+  process.stdout.write(first.stdout ?? '');
+  process.exit(first.status ?? 2);
+}
+
+const outsideProject = (entry) =>
+  entry.messages?.length === 1 && entry.messages[0].fatal === true && /project service/.test(entry.messages[0].message ?? '');
+const stray = report.filter(outsideProject);
+
+let merged = report;
+if (stray.length > 0) {
+  const second = eslint(['-c', UNTYPED_CONFIG, '-f', 'json', '--no-error-on-unmatched-pattern', ...stray.map((entry) => entry.filePath)]);
+  const relinted = parse(second.stdout ?? '');
+  if (relinted === null || (second.status !== 0 && second.status !== 1)) {
+    process.stdout.write(first.stdout ?? '');
+    process.exit(second.status ?? 2);
+  }
+  merged = [...report.filter((entry) => !outsideProject(entry)), ...relinted];
+}
+
+process.stdout.write(JSON.stringify(merged));
+process.exit(merged.some((entry) => entry.messages?.length > 0) ? 1 : 0);

package/docker/bin/health-pytest

@@ -0,0 +1,10 @@
+#!/bin/sh
+# health-pytest <pytest args...>: python -m pytest in the repository's .venv. When the environment has no
+# pytest or pytest-cov, they are installed offline from the wheels baked into the image (exit 127 if that fails).
+exec health-venv sh -c '
+  python -c "import pytest, pytest_cov" 2>/dev/null || {
+    [ -n "$VIRTUAL_ENV" ] || { python -m venv .venv && . .venv/bin/activate; } || exit 127
+    pip install --no-index --find-links /opt/health/wheels pytest pytest-cov >/dev/null || exit 127
+  }
+  exec python -m pytest "$@"
+' sh "$@"

package/docker/bin/health-tsc

@@ -0,0 +1,10 @@
+#!/bin/sh
+# health-tsc <tsc args...>: the repository's installed tsc (nearest node_modules/.bin/tsc), else the image's.
+d="$PWD"
+while [ "$d" != "/" ]; do
+  if [ -x "$d/node_modules/.bin/tsc" ]; then
+    exec "$d/node_modules/.bin/tsc" "$@"
+  fi
+  d=$(dirname "$d")
+done
+exec tsc "$@"

package/docker/bin/health-venv

@@ -0,0 +1,11 @@
+#!/bin/sh
+# health-venv <command...>: run the command with the nearest .venv (current directory or above) activated.
+d="$PWD"
+while [ "$d" != "/" ]; do
+  if [ -f "$d/.venv/bin/activate" ]; then
+    . "$d/.venv/bin/activate"
+    break
+  fi
+  d=$(dirname "$d")
+done
+exec "$@"

package/docker/config/eslint.config.mjs

@@ -0,0 +1,4 @@
+// The methodology's 2.5 ESLint ruleset. Used with `eslint -c`, so a repository's own config is never read.
+import { buildConfig } from './eslint.rules.mjs';
+
+export default buildConfig({ typeAware: true });

package/docker/config/eslint.rules.mjs

@@ -0,0 +1,65 @@
+// The methodology's 2.5 ESLint ruleset, shared by eslint.config.mjs (typed) and eslint.untyped.config.mjs (no type information).
+import { readFileSync } from 'node:fs';
+import tseslint from 'typescript-eslint';
+import reactHooks from 'eslint-plugin-react-hooks';
+
+function dependsOnReact() {
+  try {
+    const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies, ...pkg.peerDependencies }.react);
+  } catch {
+    return false;
+  }
+}
+
+const core = {
+  'no-unreachable': 'error',
+  'no-dupe-keys': 'error',
+  'no-self-compare': 'error',
+  'no-unsafe-finally': 'error',
+  'no-fallthrough': 'error',
+  'no-cond-assign': 'error',
+  'use-isnan': 'error',
+  'valid-typeof': 'error',
+  'no-unsafe-optional-chaining': 'error',
+  'no-dupe-else-if': 'error',
+  'no-duplicate-case': 'error',
+  'no-self-assign': 'error',
+  'getter-return': 'error',
+  'no-async-promise-executor': 'error',
+  'no-constant-binary-expression': 'error',
+};
+
+const typed = ['**/*.ts', '**/*.tsx', '**/*.mts', '**/*.cts'];
+
+/** `typeAware: false` is the second pass for TypeScript files outside every tsconfig: no projectService, no type-aware rules. */
+export function buildConfig({ typeAware }) {
+  return [
+    { ignores: ['**/node_modules/**', '**/dist/**', '**/build/**'] },
+    {
+      files: ['**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}'],
+      languageOptions: { parser: tseslint.parser, parserOptions: { ecmaFeatures: { jsx: true } } },
+      linterOptions: { reportUnusedDisableDirectives: 'off', noInlineConfig: true },
+      rules: { ...core, 'no-unused-vars': 'error' },
+    },
+    {
+      files: typed,
+      ...(typeAware ? { languageOptions: { parserOptions: { projectService: true, tsconfigRootDir: process.cwd() } } } : {}),
+      plugins: { '@typescript-eslint': tseslint.plugin },
+      rules: {
+        'no-unused-vars': 'off',
+        '@typescript-eslint/no-unused-vars': 'error',
+        ...(typeAware
+          ? {
+              '@typescript-eslint/no-floating-promises': 'error',
+              '@typescript-eslint/no-misused-promises': 'error',
+              '@typescript-eslint/await-thenable': 'error',
+            }
+          : {}),
+      },
+    },
+    ...(dependsOnReact()
+      ? [{ files: ['**/*.{js,jsx,ts,tsx}'], plugins: { 'react-hooks': reactHooks }, rules: { 'react-hooks/rules-of-hooks': 'error' } }]
+      : []),
+  ];
+}

package/docker/config/eslint.untyped.config.mjs

@@ -0,0 +1,4 @@
+// The 2.5 ESLint ruleset without type information. health-eslint relints TypeScript files outside every tsconfig with it.
+import { buildConfig } from './eslint.rules.mjs';
+
+export default buildConfig({ typeAware: false });

package/docker/config/knip.json

@@ -0,0 +1 @@
+{}

package/docker/config/ruff.toml

@@ -0,0 +1,7 @@
+# The methodology's 2.5 Python ruleset: F (Pyflakes), B (flake8-bugbear), E9 (syntax and IO errors).
+# Used with `ruff check --config`, so a repository's own ruff config is never read.
+target-version = "py312"
+line-length = 88
+
+[lint]
+select = ["F", "B", "E9"]