[lucasbraum]

What and why

check's compile signal judged every repository with the TypeScript ts-morph bundles (6.0.2), whatever the repository installs. A repository on TypeScript 4.9 was read by TypeScript 6's rules and its error positions: a JSX child "not assignable to ReactNode" sits on the element's first line in 4.9 and on the child in 6, which alone accounted for 7 of the react pack's 11 remaining false positives in excalidraw.

check now compiles with the repository's own TypeScript, found the way fix's verification has found it since #40 (node_modules/typescript in the workspace or the nearest ancestor, never NODE_PATH or a global folder), and falls back to the bundled compiler only when the repository installs none. The coverage line says which one judged:

compiled 11 of 11 files in 2 workspaces with the repo's TypeScript 5.9.3
compiled 355 of 356 files in 5 workspaces with the repo's TypeScript 4.9.4 and 5.4.5

How:

• adapters/typescript/compiler.ts holds the resolver (moved from fix/verify.ts, same behavior, same tests) plus repositoryCompiler (loaded once per install directory) and describeCompiler.
• With the repository's compiler, a baseline program is built once per workspace from the ts-morph program's root files and the options that compiler reads from the tsconfig (an option a newer compiler dropped or defaults differently is the repository's compiler's to read), with the same workspace-source paths; the overlay shares that baseline. With the bundled compiler the ts-morph program stays the baseline, as before. Signal A (usages) still runs on ts-morph.
• The host resolver is installed both ways compilers ask: resolveModuleNameLiterals (TypeScript 5+) and resolveModuleNames (TypeScript 4).
• The cause tracers take the compiler with the programs: node kinds and enum flags are the judging compiler's, not the bundled one's.
• CompileCoverage.compilers records which compiler judged, merged across workspaces (one entry per distinct version); coverageLine prints it.
• Found on the way: a workspace without a tsconfig of its own (excalidraw-app, covered by the root's include) got synthetic options. The bundled compiler's defaults papered over that (esModuleInterop, JSX); TypeScript 4.9 did not, and every default import and JSX element in that workspace errored at the target. Both programs now read the nearest ancestor tsconfig's options (never its file list) when the workspace has none. This also lifted excalidraw's coverage from 355 of 356 to 358 of 358 (the with-script-in-browser example resolves its imports now).
• Security and privacy text: SECURITY.md, the CONTRIBUTING.md rules, the README privacy section and the CLI's --help privacy statement (kept word for word with the README) now say that check and verify load the typescript package the repository installs, resolved from its node_modules, to compile with, and never run the repository's scripts or other code outside fix's verification step.

Cost: a repository with its own TypeScript is parsed twice (ts-morph for Signal A, its compiler for Signal B). The react pack test went from about 12 to 9 minutes anyway, since the baseline is built once per workspace and shared.

How it was verified

New tests: fix/compiler.test.ts (compiler naming, bundled fallback, one load per install directory), check/verdict.test.ts (coverage line with one, several and mixed compilers), check/check.test.ts (compilers merged across workspaces), adapters/typescript/compile.test.ts (coverage names this repository's own TypeScript 5.9.3, which the fixture finds above it), adapters/typescript/repo-inherited.test.ts (inherited tsconfig options, own file list). config-cause.test.ts passes the compiler. The whole suite runs the overlay through the native path, since the fixtures sit under this repository's TypeScript.

pnpm lint && pnpm typecheck && pnpm test pass (core 900 tests, cli 346).

Storefront (fixtures/repos/storefront, built CLI): findings, counts and verdicts identical to main; only the coverage lines changed, to compiled 11 of 11 files in 2 workspaces with the repo's TypeScript 5.9.3 and compiled 7 of 7 files in 1 workspace with the repo's TypeScript 5.9.3. README sample updated accordingly.

Pack tests, before (main, same commit as #46's final numbers) and after, breaking findings:

pack	before	after
react (#45's pack, uncommitted here)	88% precision / 64% recall, 11 FP, 46 FN	96% / 69%, 4 FP, 40 FN
zod	100% / 71%	100% / 71%, identical
stripe	100% / 90% on 3 repos	100% / 90%, identical
ai	100% / 36%	100% / 36%, identical

react per repo: excalidraw 9 FP → 2 (predicted 61, expected 73), tldraw unchanged at 9 FP / 26 FN. The 6 "TS 6 vs 4.9 location" false positives in packages/excalidraw are gone, as is the with-script-in-browser one. The 4 remaining breaking false positives: dev-docs/.../Homepage/index.tsx:52 (TS2322 at a JSX child in a workspace on the root's 4.9, same shape as before), tldraw apps/docs/components/content/index.tsx:18 (next-mdx-remote-client/rsc after the companion move), and the two useTransform(rSvg) single-site-per-workspace ref-object-nullable findings. The other 7 of the 11 are deprecated or unverified, never counted as breaking. These go to #45.

Checklist

• Tests for the change (a bug fix starts with a failing test)
• pnpm lint && pnpm typecheck && pnpm test pass
• README and docs updated if behavior changed
• Changeset added if a user would notice (pnpm changeset)
• No new dependency, or it was agreed in an issue
• No private code, names or paths in fixtures, tests or docs
• The rules in CONTRIBUTING.md ("Rules that do not bend") still hold

🤖 Generated with Claude Code

https://claude.ai/code/session_018u9b3Pp5H68DdYZGp5Qg1U