fix(cli): prefer project lockfile over invocation package manager

[sorccu]

Problem

detectPackageManager consulted ambient signals — the npm_config_user_agent env var and the JS runtime — before the project's lockfile. These describe how the CLI was launched, not what the project uses, so:

• Running npx checkly in a pnpm repo reported an npm user agent → we detected npm → project parsing then failed to find an npm lockfile.
• Internally, pnpm vitest leaks a pnpm user agent into the CLI process, so tests detected pnpm even when the fixture used a different package manager.

Fix

Detection now runs a lockfile-required pass first: a user-agent/runtime signal only counts when that package manager has a backing lockfile in the directory lineage. When no lockfile exists anywhere (e.g. running outside a repo), it falls back to the previous un-gated order, ultimately defaulting to npm. Behavior is therefore unchanged when there's no lockfile, and the lockfile wins whenever one is present.

cnpm

cnpm shares npm's package-lock.json. CNpmDetector now claims it so cnpm stays detectable, and:

• a bare package-lock.json defaults to npm;
• a cnpm user agent alongside one resolves to cnpm;
• running cnpm inside a pnpm repo still resolves to pnpm (no cross-package-manager regression).

Tie-breaking by priority (not detector order)

Detection tie-breaks previously depended on the order detectors were supplied in. Most visibly, the executable-on-PATH tier returned the first detector whose binary was found — and since npm is almost always installed, it beat cnpm even though its presence is no signal.

Each detector now carries an intrinsic priority(method) (higher wins), and every tier selects the highest-priority match rather than the first by position, so input order no longer affects the result. npm deprioritizes its executable (so an installed cnpm/pnpm/yarn wins the executable tier) while keeping its normal priority elsewhere — it still wins the package-lock.json lockfile tie over cnpm and remains the ultimate fallback.

Tests

Unit suite (package-manager.spec.ts, 35 cases) covering every detection tier hermetically (temp dirs, bounded lineage, restricted detectors, spied executables/runtime, saved/restored user agent): lockfile-beats-ambient, no-lockfile fallback, lineage walking, co-located lockfiles, the cnpm cases, executable-tier priority (cnpm beats npm; npm alone still wins), config-file priority, and order-independence (same detectors in different orders yield the same result).

Other changes

• Removed the now-redundant skipUserAgent workaround in boilerplate.ts.
• Consolidated lockfile and config-file detection into single detectNearestLockfiles / detectNearestConfigFiles finders (plural, collect-all), removing the nondeterministic Promise.any-based singular variants. Both tiers now select by priority(method), so they're deterministic and order-independent.

🤖 Generated with Claude Code