Docs/Agentic checks
Agentic finding codes
Reported by default. Turn off with [agentic] enabled = false in config. --fix writes settings only. [agentic] apply stays off.
Catalog
Taken from the binary viapkguard dump-catalog. The codes are part of the finding-code contract carried over from the previous build.
cache.path-committed
Committed store or cache path. A project file pins storeDir, cache, cacheFolder, or install.cache.dir.
Shared caches belong in user config. A committed home path breaks CI and other agents. Apply only unsets an in-repo path — it never writes ~/…/store.
agentic.cache-disabled
Global cache disabled. yarn enableGlobalCache is false.
Leave enableGlobalCache true unless the team vendors .yarn/cache (Zero-Installs).
overrides.present
Version override precedent. overrides, resolutions, or pnpm workspace overrides force a version the manifest does not show.
The next agent will copy this instead of upgrading. Presence is the warning; apply never deletes a pin.
overrides.legacy-location
Legacy pnpm overrides location. package.json#pnpm.overrides on pnpm 11 or later.
pnpm 11 ignores package.json#pnpm. Apply can move the map to pnpm-workspace.yaml only.
layout.shamefully-hoist
Shameful hoist. pnpm shamefullyHoist is true, or publicHoistPattern contains *.
Makes require() succeed for undeclared deps. The next isolated install breaks.
layout.pnp
Plug'n'Play linker. yarn or pnpm nodeLinker is pnp (yarn's default).
Most agents assume node_modules and run node, not yarn node. Apply to node-modules is opt-in because it changes the team layout.
scan without --fix is read-only. --fix writes settings files only. It never writes a home-dir store or deletes overrides. [agentic] apply is still off.