[Martin Bens (SpiGAndromeda)]

Path-scoped runs of the JS lint and format tools refused on every Shopware checkout. stylelint_check/stylelint_fix and prettier_check/prettier_fix on js-admin-tooling, and stylelint_check/stylelint_fix and eslint_check/eslint_fix on js-storefront-tooling, routed a call with paths to stylelint:base, prettier:base, stylelint:app, eslint:app and eslint:components. No Shopware package.json defines these scripts, so the tools answered with npm script "stylelint:base" is not defined in package.json and refused.

Path-scoped runs

• A call with paths now runs the package's own binary through npm exec --no -- <binary>, with the flags of the aggregate script (lint:scss, format, lint:js). The Storefront components tree runs npm exec --no -c "cd ../.. && eslint …", as lint:js does. Admin ESLint keeps lint:debugging, which Shopware defines. Runs without paths still use the aggregate scripts.
• Before the run, the tool checks that node_modules/.bin/<binary> exists, because npm exec --no runs a global binary of the same name when the package has none. A missing binary refuses with a message naming the binary and the directory the check ran in.
• A directory path reaches Stylelint and Prettier as a quoted pattern limited to the extensions the aggregate script lints: <dir>/**/*.scss for Admin Stylelint, <dir>/**/*.{scss,css} for Storefront Stylelint, <dir>/**/*.{js,ts,mjs} for Prettier. A directory whose name ends in such an extension gets the same pattern. Under ddev on a linked worktree, directory and glob paths for these tools are refused, because ddev exec re-parses the command in the container shell, which would expand the pattern first.
• Scopes: components-tree ESLint paths are refused under a scope other than shopware. Storefront Stylelint adds the core --config stylelint.config.js only without a scope. A scope-selected Stylelint config on a run without paths is refused when the aggregate script already passes --config, instead of handing Stylelint two --config flags.
• The path handling the JS servers share (glob detection, the binary check, directory patterns, the ddev worktree refusal, the --config check) lives in shared/js_paths.sh. This file belongs to dev-tooling and is not synced from templates/.

Hooks

• The Administration and Storefront PreToolUse hooks matched only npx <binary> without flags. They now also block npm exec and npm x, a node_modules/.bin/<binary> path, an @version suffix, the valueless flags -y, --yes, --no, --no-install, -q, --quiet, --silent and --, and a -c/--call string that runs the binary. The binaries are eslint, stylelint and jest on both hooks, prettier and tsc on the Administration hook, and vitest on the Storefront hook.
• Both hooks take the matcher for these forms from hooks/scripts/lib/js_binary.sh.
• docs/mcp-enforcement.md documents that the hooks match each line of a command on its own, so a commit message line such as npx eslint now runs in a heredoc is blocked, and names git commit -F <file> as the way around it. It no longer claims that both package.json files declare jest:base.

Tests

• The JS server tests answer script probes from the scripts blocks of Shopware trunk (plugin-tests/dev-tooling/fixtures/shopware-trunk/), and the npm fake fails an undefined npm run the way npm does. The previous fixtures defined the missing scripts, which is why the suite passed while every real call refused. regenerate.sh in that directory rebuilds the fixtures from a Shopware checkout.
• The Stylelint, Prettier and ESLint commands and the binary check run through the native, docker, docker-compose, vagrant, ddev and ddev-worktree wrappers.

[github-actions]

Agent Skills Export

Built 7 skill packages:

• release-info-writing
• adr-writing
• feature-branch-pr-writing
• pr-description-writing
• commit-message-writing
• structuring-documentation
• ci-log-interpretation