fix: resolve tool binaries without npx so pnpm and yarn hosts work

[SamuelDenani]

Two npm/eslint assumptions that both fail silently on a repo that uses neither. Found by installing loopwright into a pnpm + biome repo, where the gate reported nine blockers, none of which was a quality problem.

1. Tool binaries resolved through npx

The workflow installed host dependencies only when a package-lock.json existed, so on a pnpm or yarn repo that step was a no-op and the whole gate ran against an empty node_modules. Every adapter then invoked its tool through npx, which falls back to the registry when a binary is missing locally:

Command	What CI actually downloaded
npx tsc --noEmit	tsc@2.0.4 — an unrelated abandoned package that is not TypeScript
npx vitest run --coverage	a bare vitest with no coverage provider and no project config
npx biome check --reporter=json	the deprecated biome placeholder (the real package is @biomejs/biome), which emits no JSON

The tsc case is the worst: it runs, exits, and reports nonsense. That is precisely the "infrastructure failure must never look like success" outcome the gate exists to prevent.

Fix: adapters name bare binaries and runShell puts the host's — and the collector cwd's — node_modules/.bin on PATH. All three package managers populate that directory, so one mechanism covers npm, pnpm and yarn, and a genuinely missing tool now fails with command not found, which every adapter's existing TOOL_MISSING check already reports honestly. The workflow installs with whichever package manager the lockfile names, and enables corepack so the host's pinned packageManager version is used.

2. The lint-suppression metric only knew eslint

integrity.lintSuppressions matched eslint-disable and nothing else, so a biome repo reported 0 however many biome-ignore comments it carried. The repo this was found on has 12, and its own contributor docs list inline lint suppression as a gated shortcut. A check that cannot see anything reads exactly like nothing to see.

Fix: match both linters. The labels are renamed for what the metric measures rather than for one of the two tools that can produce it — Lint errors / Lint warnings / Inline lint suppressions. Labels are cosmetic; metric keys are unchanged, so existing baselines still match.

3. Self-detection, handled by exclusion rather than by dodging it

Adding a pattern to the detector trips the detector. Two places needed an answer, and both now use the exclusion mechanism this repo already had, rather than a workaround:

• Test bait lives in tests/fixtures/, spelled out literally in ordinary files, which is exactly what sources.ignore: ["**/fixtures/**"] and the hook's :(exclude)**/fixtures/** were already there for — fixtures exist to give the detectors something to detect. (An earlier revision of this PR composed the marker strings from fragments so the scanner would not match them; that is the very thing the gate discourages, written into the gate's own tests. Removed.)
• The pre-commit hook excludes .loopwright/ wholesale. In a host repo it is vendored code nobody hand-edits, so policing it only ever fires on a re-vendor. In this repo it is the engine, whose definitions necessarily spell out every pattern they look for. Either way the gate still scans it in CI, and the gate is the authority — the hook exists only to deliver the same answer sooner. Verified both directions: a suppression staged outside .loopwright/ still fails the hook; the fixtures no longer trip it.

Deliberately not changed

audit stays npm-only. pnpm audit --json emits the v1 shape (advisories + metadata) while auditEntries() reads npm's v2 vulnerabilities shape — it would clear the metadata.vulnerabilities guard and report 0 critical / 0 high on a repo that has them. On the pnpm repo this was found on, that would have hidden 1 critical and 24 high advisories. unconfigured warns forever and is honest; a silent false pass is not. Documented in the README.

Verification

• 152 engine tests pass — 6 new, covering local-bin resolution, the fail-loud path for a missing binary, and both linters' suppression forms. The two biome cases were confirmed to fail against the old regex.
• Gate on this repo: passes, 1 warning, 6 improvements, 0 blockers.
• Verified end-to-end in a GitHub Actions runner on a real pnpm repo (Next.js, biome, vitest against a Postgres-backed suite): 9 blockers → 0 collector failures, every metric reporting a real number, all checks green.

🤖 Generated with Claude Code

[github-actions]

✅ Quality gate passed

commit 97bf796 · baseline ece7656 · 1 warning(s) · 6 improvement(s) 📈

⚠️ 1 warning(s) — not blocking

	Check	Baseline	Now	Verdict
⚠️	TypeScript errors	—	n/a	collector not configured — see docs/loopwright/quality-gate.md

📊 All metrics

	Check	Baseline	Now	Verdict
✅	Failing tests	0	0	holding
✅	Failing test suites	0	0	holding
⚠️	TypeScript errors	—	n/a	collector not configured — see docs/loopwright/quality-gate.md
✅	Lint errors	0	0	holding
✅	Lint warnings	0	0	holding
✅	Critical advisories	0	0	holding
✅	High advisories	0	0	holding
✅	Suppressed advisories	0	0	holding
📈	Line coverage	84.67%	85.01%	improved 0.34%
📈	Branch coverage	78.93%	79.44%	improved 0.51%
📈	Function coverage	89.65%	89.71%	improved 0.06%
📈	Statement coverage	85.01%	85.41%	improved 0.40%
📈	Duplicated code	0.90%	0.88%	improved 0.02%
✅	Highest function complexity	14	14	holding
📈	Average function complexity	1.81	1.80	improved 0.01
✅	Oversized files	0	0	holding
✅	Skipped tests	0	0	holding
✅	Focused tests (.only)	0	0	holding
✅	Tests with no assertion	0	0	holding
✅	Coverage-ignore hints	1	1	holding
✅	Type suppressions (@ts-ignore etc.)	2	2	holding
✅	Inline lint suppressions	2	2	holding
✅	Empty catch blocks	0	0	holding

📈 This PR improves 6 metric(s). Run node .loopwright/scripts/quality-gate.mjs --update-baseline and commit .loopwright/baseline.json to lock the gain in.

---

_{Generated by .loopwright/scripts/quality-gate.mjs · reproduce locally with node .loopwright/scripts/run-report.mjs --all && node .loopwright/scripts/quality-gate.mjs · full reports are in the workflow artifacts.}

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

Code review

Reviewed the diff (bare-binary resolution via node_modules/.bin, workflow lockfile detection, and the biome-suppression detection widening). The core PATH-resolution fix in .loopwright/scripts/lib/shell.mjs is sound — HOST_ROOT/cwd bin dirs are resolved to absolute paths correctly, the corepack enable step does not shim npm/npx (verified against Corepack's own source, which excludes npm from bare corepack enable), and the new tests all carry real assertions. Two small issues found and confirmed:

1. Stale test count in README.md. The PR adds 6 new it(...) blocks (4 in .loopwright/tests/analyze-source-extra.test.mjs, 2 in .loopwright/tests/shell.test.mjs) but only bumped the documented count by 2, from 146 to 148. The actual count at this PR's head commit is 152.

   • loopwright/README.md

     Lines 85 to 87 in 9ad25f4

     	**Or use this repo as a template** if you'd rather own the layer itself — you
     	get the engine, its 148 tests and its docs as a starting point to modify. Point
     	`sources.roots` in `.loopwright/config.json` at your code and re-baseline.

   • loopwright/README.md

     Lines 182 to 184 in 9ad25f4

     	The engine that ships to your repo lives here under `.loopwright/scripts/`,
     	covered by 148 tests in `.loopwright/tests/`, gated by the same workflow that
     	will gate your PRs — baseline, integrity metrics and all. If the gate is wrong,

2. Pre-commit hook: new exclude widens further than intended, and isn't kept in sync with the same PR's own detector change.

   • The new :(exclude).loopwright/scripts/lib/analyze-source.mjs pathspec feeds the single $added variable that all 8 gated patterns are checked against — so it doesn't just exempt this file from the eslint-disable self-match that motivated it, it also silently exempts .only(, .skip(, @ts-ignore, @ts-expect-error, as any, v8 ignore and istanbul ignore for that file. The PR's own new test file avoids this exact self-match problem with string composition (`eslint-${'disable'}`) instead of a blanket file exclude — the same technique would avoid widening the exemption here.
     

     loopwright/.githooks/pre-commit

     Lines 24 to 26 in 9ad25f4

     	# already part of the recorded baseline — so nothing goes unmeasured.
     	added=$(git diff --cached -U0 -- '*.ts' '*.tsx' '*.js' '*.jsx' '*.mjs' ':(exclude)fixtures/**' ':(exclude)**/fixtures/**' ':(exclude).loopwright/scripts/lib/analyze-source.mjs' | grep '^+[^+]' || true)
     	if [ -n "$added" ]; then

   • Separately, this PR widens analyze-source.mjs's suppression detector to also flag biome-ignore comments (feeding the integrity.lintSuppressions metric), but the pre-commit hook's own pattern list was not updated to match — it still only greps for eslint-disable. A staged biome-ignore elsewhere in the repo now passes this local hook silently and only surfaces later in the CI gate, which is the exact round-trip the hook exists to save.
     

     loopwright/.githooks/pre-commit

     Lines 32 to 34 in 9ad25f4

     	'\bas any\b' 'an "as any" cast'
     	'eslint-disable' 'an inline eslint-disable'
     	'v8 ignore' 'a coverage-ignore hint'

No CLAUDE.md compliance issues found.

[claude]

Code review

Checked for bugs and CLAUDE.md compliance. CLAUDE.md compliance looks clean — no rule violations found. Two issues surfaced in the bug pass:

1. Yarn PnP hosts aren't actually covered, despite the PR's claim. binPath() only ever looks in <cwd>/node_modules/.bin and <HOST_ROOT>/node_modules/.bin. Yarn Berry (2+) defaults to nodeLinker: pnp, which creates no node_modules tree at all — and the new CI step runs yarn install --immutable (Berry syntax), targeting exactly that default configuration. On a plain Yarn Berry host, every collector (tsc, vitest/jest, eslint/biome) would fail to resolve its binary and the gate would block on an infrastructure error, not a real quality issue — the same class of failure this PR sets out to fix. That contradicts the comment above binPath ("Every package manager (npm, pnpm, yarn) populates node_modules/.bin") and the new README claim ("npm, pnpm and yarn all work"). Worth either documenting Yarn PnP as unsupported (e.g. require nodeLinker: node-modules) or adding a PnP-aware fallback, and softening the "all work" claim accordingly. This isn't a regression — pre-PR npx on a PnP host was worse (silently downloaded a bogus package) — but the "yarn hosts work" claim doesn't hold for Yarn's own default.

2. Stale test count in README. README.md#L86 and README.md#L183 were bumped from "146 tests" to "148 tests", but this PR actually adds 6 new tests (4 in analyze-source-extra.test.mjs's "lint suppressions" block, 2 in shell.test.mjs's "runShell binary resolution" block), not 2. The correct count is 152.

Not flagged: the pre-commit hook's new .loopwright/** exclusion is broad enough to disable most of its own checks for this repo's own contributors, but it's a deliberate, explicitly-reasoned tradeoff (the CI gate remains fully authoritative and unweakened), not a bug.