Check matrix

See what Swarm checks, which profiles enable it, and the managed engines behind each result.

Version snapshot: Zedbee 0.1.0, verified against the package source on September 7, 2026. These are the versions pinned by that package revision, not a claim about the latest npm release or your installed version.

At a glance

Which checks does each profile enable?

Profiles are starting points for .zedbeerc.jsonc. On means the profile sets the check to error; Off means it is disabled by default. Repository settings and file overrides can change that policy.

All three profiles default to when: "relevant", so enabled checks run when the selected changes can affect them and the project is applicable. React checks, for example, do not run in every repository. when: "always" requests a check whenever its required project inputs exist.

Default profile membership
Check ID	fast	recommended	thorough
`formatting`	On	On	On
`lint`	On	On	On
`types`	Off	On	On
`cyclomaticComplexity`	On	On	On
`readabilityComplexity`	On	On	On
`structuralSecurity`	On	On	On
`secrets`	Off	On	On
`duplication`	Off	Off	On
`dependencyArchitecture`	Off	Off	On
`deadCode`	Off	Off	On
`reactCorrectness`	On	On	On
`reactAccessibility`	On	On	On
`vulnerabilities`	Off	Off	On

On smaller screens, scroll tables horizontally to compare all columns. You can also focus a table and use the arrow keys.

Severity controls the decision: off disables a check, warn keeps findings visible without blocking, and error can block attributable findings. An enabled check that cannot complete returns exit code 2 when failOnIncomplete is enabled.

How findings are attributed to your change

Coverage and versions

What runs behind each check?

Swarm pins its analyzer versions and uses managed configuration. It does not load your project’s native Prettier, ESLint, or executable analyzer configuration. The same tool name does not guarantee the same results as a separate invocation using your existing project settings.

Versions below identify the primary engines and relevant lint plugins in the Zedbee 0.1.0 source snapshot. They are not a complete dependency inventory. Zedbee’s original rules ship with Zedbee; they do not have a separate published version here. OSV v1 identifies the API, not the age or version of its advisory data.

Managed engines, coverage, and fixes
Check ID	Managed engine / version	Coverage and limits	Managed fix
`formatting`	Prettier 3.9.6	Compares formatting changes with added lines in selected files. Scanning does not modify files; a formatting fix formats the complete working file.	Yes
`lint`	ESLint 9.39.5 · typescript-eslint 8.67.0	JavaScript and TypeScript correctness, with workspace diagnostics attributed to changed locations or entities. Uses bundled rules, not project ESLint plugins or configuration.	Supported official fixes
`types`	TypeScript 6.0.3	Compares baseline and target TypeScript programs per workspace. Requires a contained tsconfig.json in the selected Git state; it does not invent compiler settings.	No
`cyclomaticComplexity`	ESLint 9.39.5	Measures branch-path complexity in changed syntax entities against the configured limit and worsening policy. Syntax complexity is not a measure of runtime behavior.	No
`readabilityComplexity`	ESLint 9.39.5 + Zedbee rule	Measures nesting and readability in changed syntax entities. This is Zedbee’s original metric, not Sonar Cognitive Complexity; the scores are not interchangeable.	No
`structuralSecurity`	ast-grep 0.45.1 + Zedbee rules	Finds high-confidence local JavaScript and TypeScript patterns. No general taint, dataflow, reachability, or inter-file analysis.	No
`secrets`	Secretlint 13.0.4 · recommended preset 13.0.4	Compares redacted findings in changed regular UTF-8 files up to 1 MiB. Does not scan complete Git history; pattern matches can require human review.	No
`duplication`	jscpd 5.0.15	Compares workspaces for new clone regions and duplication regressions. Small clones below configured thresholds are omitted; very large source lists can hit OS argument limits.	No
`dependencyArchitecture`	dependency-cruiser 18.2.0	Compares module graphs for cycles and invalid edges using managed rules. Dynamically constructed dependencies can evade static resolution.	No
`deadCode`	Knip 6.32.2	Compares workspaces for unused files, exports, and dependency hygiene. Framework plugins are disabled; dynamic conventions and aliases can need additional managed support.	No
`reactCorrectness`	ESLint 9.39.5 · eslint-plugin-react 7.37.5 · eslint-plugin-react-hooks 7.1.1	React, Hooks, and JSX correctness in discovered React, Ink, Next.js, and Remix workspaces. Calibrates from selected dependency data, with a managed React 19.2 fallback. That fallback is not an installed React version.	Supported official fixes
`reactAccessibility`	ESLint 9.39.5 · eslint-plugin-jsx-a11y 6.10.2	Static DOM JSX accessibility in React DOM, Next.js, and Remix, not Ink terminal UI. Cannot prove runtime accessibility; manual interaction testing is still needed.	No
`vulnerabilities`	Zedbee client · OSV API v1	Compares advisories, packages, and dependency paths when supported lockfiles change or timing is always. Online only: sends package names, exact versions, and the npm ecosystem identifier to api.osv.dev, not source code or file hashes.	No

Your repository

Inspect your installed checks

Run these commands from your repository after installing Zedbee. For npm projects, npm ls zedbee --depth=0 reports the installed Zedbee package version. zedbee checks shows each check’s primary managed engine version, effective policy, applicability, configuration sources, and overrides. JSON output provides deterministic settings metadata for automation.

The checks command reads the staged configuration. After editing .zedbeerc.jsonc, run git add .zedbeerc.jsonc before inspecting the updated settings. A check enabled by a profile can still be inapplicable to your project or current changes.

Your installed release may differ from this page’s snapshot. Use its checks output for the primary engine versions actually reported by that installation, not the version of a separately installed global analyzer.

When settings updates take effect

npm ls zedbee --depth=0
npx zedbee checks
npx zedbee checks --format json

After the scan

Know which fixes Swarm can apply

zedbee fix rescans the index and offers warning and blocking candidates for formatting, lint, and React correctness. For lint and React correctness, only exact reported official fixes are supported. Analyzer suggestions and findings from other checks remain manual.

Fixes change working files, never the Git index. Review the changes, stage what you intend to keep, and scan again. Base-mode fixes in CI are not supported.

Formatting can also change unstaged work.

A formatting fix runs Prettier over the complete current working file, not just its staged lines. Review the full diff before staging the result.

npx zedbee fix
git diff
git add --patch
npx zedbee scan