@getfootgun/footgun 0.2.1 → 0.2.2

package/lib/rules.mjs

@@ -128,6 +128,13 @@ function isSafe(rule) {
   return v;
 }
 
+// A line whose trimmed start is a comment marker is not matched (`#!` shebangs fall under `#`).
+// Block comments are not parsed: only lines starting with `/*` or `*` are skipped.
+const COMMENT_START = /^(?:\/\/|#|\/\*|\*|<!--|--)/;
+// A rule whose pattern itself targets comment syntax (contains `<!--`, or starts with a comment marker) is not subject to the skip.
+// For ordinary rules, `#[attr]`, `#include` and Markdown `*` bullets are skipped like any other comment-looking line.
+const COMMENT_RULE = /<!--|^\^?(?:\\s\*|\(\?:|\()*(?:--|#|\/\/|\/\\\*|\\\*)/;
+
 export function matchRule(rule, relPath, text) {
   if (!isSafe(rule)) return [];
   if (!rule.files.some((g) => globMatch(g, relPath))) return [];
@@ -139,10 +146,12 @@ export function matchRule(rule, relPath, text) {
     return [];
   }
   if (unless && unless.test(text)) return [];
+  const skipComments = !COMMENT_RULE.test(rule.pattern);
   const hits = [];
   const lines = text.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
     if (lines[i].length > MAX_LINE) continue;
+    if (skipComments && COMMENT_START.test(lines[i].trimStart())) continue;
     if (re.test(lines[i])) hits.push(i + 1);
   }
   return hits;

package/lib/scan.mjs

@@ -303,16 +303,16 @@ export async function scanProject(root, rules) {
     : [];
 
   const findings = [];
-  const seen = new Set();
+  // one finding per trap per file, at its lowest matching line
+  const first = new Map();
   const hitRules = new Set();
   for (const { rel, d, line } of hits) {
     const ri = detects[d].ri;
-    const key = `${ri}\0${rel}\0${line}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
+    const key = `${ri}\0${rel}`;
     hitRules.add(ri);
-    findings.push(finding(good[ri], rel, line, false));
+    if (!first.has(key) || line < first.get(key).line) first.set(key, { ri, rel, line });
   }
+  for (const { ri, rel, line } of first.values()) findings.push(finding(good[ri], rel, line, false));
   findings.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line));
   // a manual finding and the applicable list both need a ref narrower than "any version": a broad ref
   // only shows the package is present, which is enough to run detect rules but not to say the trap applies

package/package.json

@@ -1 +1 @@
-{ "name": "@getfootgun/footgun", "version": "0.2.1", "description": "Ask Footgun why a third-party API, platform, or AI tool just broke.", "bin": { "footgun": "bin/footgun.mjs" }, "scripts": { "prepublishOnly": "node ../scripts/check-publish.mjs" }, "type": "module", "license": "MIT", "files": ["bin", "lib", "README.md"], "engines": { "node": ">=20" } }
+{ "name": "@getfootgun/footgun", "version": "0.2.2", "description": "Ask Footgun why a third-party API, platform, or AI tool just broke.", "bin": { "footgun": "bin/footgun.mjs" }, "scripts": { "prepublishOnly": "node ../scripts/check-publish.mjs" }, "type": "module", "license": "MIT", "files": ["bin", "lib", "README.md"], "engines": { "node": ">=20" } }