Expand description
pre-commit-package-lock — keep package.json and its lockfile in step.
Scoped per directory: a package.json that is not a real npm project (no
lockfile beside it — e.g. the .git/hooks/package.json type-marker) never
demands one, and in a monorepo one project’s lockfile does not satisfy
another’s.
§Deliberately non-interactive
This check runs on one of up to twenty WORKER THREADS in pre-commit’s
concurrent fan-out. It used to call trust::confirm, which blocks on
read_line from /dev/tty — so the whole commit stopped dead while the
other nineteen checks went on printing over the prompt, thread::scope
refused to return until somebody answered, and the question itself was
usually scrolled off the screen. The commit simply looked hung.
A pre-scan phase would mean teaching the generic &[&dyn Check] fan-out
about “checks that may ask a question”, for exactly one check — and
confirm() already returns false without a tty, so the interactive path was
the exception rather than the rule. So there is no question: a forgotten
lockfile FAILS, and the message names the two documented ways past it.
trust::confirm itself stays; install.rs calls it from the
single-threaded install path, where a prompt is the whole point.