@promptci/core 0.0.1 → 0.1.0

package/dist/copilot-instructions-detector.js

@@ -0,0 +1,145 @@
+/**
+ * Copilot Instructions Detector (issue #66)
+ *
+ * Audits GitHub Copilot per-file instruction files (`.github/instructions/**\/*.md`).
+ * These use `applyTo:` frontmatter globs to scope which files they apply to —
+ * analogous to Cursor's `.mdc` `globs`. This mirrors `detectCursorRules`:
+ *
+ *  - Frontmatter validity: present, closed, structurally sound.
+ *  - `applyTo:` absent — the file then applies to *every* Copilot request by
+ *    default, which is often unintentional.
+ *  - `applyTo:` globs that match zero files in the repo — a scope keyed to a
+ *    path that no longer exists never fires.
+ *  - `applyTo:` globs that match only ignored / build-output files — informational.
+ *
+ * The legacy single-file `.github/copilot-instructions.md` is always-on and has
+ * no `applyTo` support, so discovery (see AI_CONFIG_GLOBS) scopes to
+ * `.github/instructions/` only and never reaches this detector.
+ *
+ * Deterministic and offline; findings are cautiously worded.
+ */
+import micromatch from 'micromatch';
+import { parseFrontmatter, readTextWithinRoot, listFiles, shortHash, asStringList, withScannerPaths, aiConfigIssue as base, frontmatterStructureIssues, } from './ai-config.js';
+const SURFACE = {
+    idPrefix: 'copilot',
+    noun: 'Copilot instructions file',
+    why: 'A `.instructions.md` file uses an `applyTo:` frontmatter glob to control which files it applies to.',
+    recommendation: 'Add a frontmatter block with an `applyTo:` glob (use `applyTo: "**"` to apply to every request).',
+    // A frontmatter-less instructions file still loads (Copilot treats it as
+    // apply-to-everything), so this is softer news than a skill that cannot register.
+    noFrontmatterTitle: 'Copilot instructions file is missing frontmatter',
+    noFrontmatterSeverity: 'warning',
+    noFrontmatterConfidence: 0.7,
+};
+/**
+ * "Does this glob match any real file" excludes only dependency/VCS trees — a
+ * scope may legitimately target `dist/` or a source dir named `build/`.
+ */
+const GLOB_TEST_IGNORE = ['**/node_modules/**', '**/.git/**'];
+/**
+ * Trees that are ignored or build output: a glob matching only these is scoped
+ * to generated/vendored files, which is worth an info but not a warning.
+ */
+const IGNORED_TREES = [
+    '**/node_modules/**', '**/.git/**', '**/dist/**', '**/build/**',
+    '**/.next/**', '**/out/**', '**/coverage/**', '**/worktrees/**', '**/.worktrees/**',
+];
+function id(kind, key) {
+    return `ai-config-copilot-${kind}-${shortHash(key)}`;
+}
+/** A glob we can meaningfully test for zero matches (skip negations/vars/placeholders). */
+function isTestableGlob(glob) {
+    const g = glob.trim();
+    if (!g)
+        return false;
+    if (g.startsWith('!'))
+        return false;
+    if (g.includes('$') || g.includes('<') || g.includes('>'))
+        return false;
+    return true;
+}
+/** A glob of `**` (or `** slash *`) means "every file" — always valid, never dead. */
+function matchesEverything(glob) {
+    const g = glob.trim();
+    return g === '**' || g === '**/*';
+}
+export function detectCopilotInstructions(context) {
+    const issues = [];
+    const files = context.aiConfig.copilotInstructions;
+    // TWO repo walks shared across every glob test, built lazily so repos with no
+    // testable globs never pay for them. `broad` includes build/vendored output
+    // (only node_modules/.git excluded); `source` excludes ignored trees, so a
+    // glob that matches `broad` but not `source` hits only ignored files.
+    let broad = null;
+    let source = null;
+    const matchesBroad = (patterns) => {
+        broad ??= listFiles(context.repoRoot, ['**/*'], GLOB_TEST_IGNORE);
+        return micromatch.some(broad, patterns, { dot: true });
+    };
+    const matchesSource = (patterns) => {
+        source ??= listFiles(context.repoRoot, ['**/*'], IGNORED_TREES);
+        return micromatch.some(source, patterns, { dot: true });
+    };
+    for (const filePath of files) {
+        const content = readTextWithinRoot(context.repoRoot, filePath);
+        if (content === undefined)
+            continue;
+        const fm = parseFrontmatter(content);
+        issues.push(...frontmatterStructureIssues(filePath, content, fm, SURFACE));
+        if (!fm.present)
+            continue;
+        const applyTo = asStringList(fm.data.applyTo);
+        // No `applyTo` at all → the file applies to every request.
+        if (applyTo.length === 0) {
+            issues.push(base({
+                id: id('no-applyto', filePath),
+                title: 'Copilot instructions file has no applyTo glob',
+                summary: `${filePath} defines no \`applyTo\` glob, so Copilot applies it to every request by default — often unintentional.`,
+                filePaths: [filePath],
+                locations: [{ filePath, startLine: 1, endLine: fm.fenceEndLine > 0 ? fm.fenceEndLine : 1 }],
+                evidence: [`Keys present: ${Object.keys(fm.data).join(', ') || '(none)'}`],
+                recommendation: 'Add an `applyTo:` glob scoping the file to the paths it is about, or set `applyTo: "**"` to make the always-on scope explicit.',
+                confidence: 0.7,
+            }));
+            continue; // no globs to test
+        }
+        const globLine = fm.keyLines.applyTo ?? 1;
+        for (const glob of applyTo) {
+            if (!isTestableGlob(glob) || matchesEverything(glob))
+                continue;
+            const normalized = glob.replace(/^\//, '');
+            // A slashless pattern like `*.ts` is intended as "any depth"; fast-glob
+            // only matches it at the root, so also try a `**/`-anchored variant
+            // before declaring the glob dead, to avoid false positives.
+            const candidates = normalized.includes('/') ? [normalized] : [normalized, `**/${normalized}`];
+            if (!matchesBroad(candidates)) {
+                issues.push(base({
+                    id: id('dead-glob', `${filePath}|${glob}`),
+                    title: 'Copilot instructions applyTo glob matches no files',
+                    summary: `${filePath}: the \`applyTo\` glob \`${glob}\` matches no files in the repository, so this instructions file never applies.`,
+                    filePaths: [filePath],
+                    locations: [{ filePath, startLine: globLine, endLine: globLine }],
+                    evidence: [`Glob: ${glob}`],
+                    recommendation: 'Update the glob to match real paths, or remove the file if the code it targeted is gone.',
+                    confidence: 0.6,
+                }));
+            }
+            else if (!matchesSource(candidates)) {
+                issues.push(base({
+                    id: id('ignored-glob', `${filePath}|${glob}`),
+                    severity: 'info',
+                    title: 'Copilot instructions applyTo glob matches only ignored files',
+                    summary: `${filePath}: the \`applyTo\` glob \`${glob}\` matches only ignored or build-output files, so it rarely applies to files you edit.`,
+                    filePaths: [filePath],
+                    locations: [{ filePath, startLine: globLine, endLine: globLine }],
+                    evidence: [`Glob: ${glob}`],
+                    recommendation: 'Point the glob at source paths, or remove the file if it was meant to target generated output.',
+                    confidence: 0.55,
+                }));
+            }
+        }
+    }
+    // Scanner-form paths so inline suppressions can match (see withScannerPaths).
+    return withScannerPaths(context.repoRoot, issues);
+}
+//# sourceMappingURL=copilot-instructions-detector.js.map

package/dist/copilot-instructions-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot-instructions-detector.js","sourceRoot":"","sources":["../src/copilot-instructions-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,UAAU,MAAM,YAAY,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,aAAa,IAAI,IAAI,EACrB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAuB;IAClC,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,qGAAqG;IAC1G,cAAc,EAAE,kGAAkG;IAClH,yEAAyE;IACzE,kFAAkF;IAClF,kBAAkB,EAAE,kDAAkD;IACtE,qBAAqB,EAAE,SAAS;IAChC,uBAAuB,EAAE,GAAG;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;AAE9D;;;GAGG;AACH,MAAM,aAAa,GAAG;IACpB,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa;IAC/D,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB;CACpF,CAAC;AAEF,SAAS,EAAE,CAAC,IAAY,EAAE,GAAW;IACnC,OAAO,qBAAqB,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAoB;IAC5D,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAEnD,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,KAAK,GAAoB,IAAI,CAAC;IAClC,IAAI,MAAM,GAAoB,IAAI,CAAC;IACnC,MAAM,YAAY,GAAG,CAAC,QAAkB,EAAW,EAAE;QACnD,KAAK,KAAK,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAW,EAAE;QACpD,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;QAChE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QAEpC,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,OAAO;YAAE,SAAS;QAE1B,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9C,2DAA2D;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACf,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;gBAC9B,KAAK,EAAE,+CAA+C;gBACtD,OAAO,EAAE,GAAG,QAAQ,wGAAwG;gBAC5H,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,QAAQ,EAAE,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAC1E,cAAc,EAAE,gIAAgI;gBAChJ,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC,CAAC;YACJ,SAAS,CAAC,mBAAmB;QAC/B,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,wEAAwE;YACxE,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,UAAU,EAAE,CAAC,CAAC;YAE9F,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC1C,KAAK,EAAE,oDAAoD;oBAC3D,OAAO,EAAE,GAAG,QAAQ,4BAA4B,IAAI,iFAAiF;oBACrI,SAAS,EAAE,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;oBACjE,QAAQ,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC3B,cAAc,EAAE,0FAA0F;oBAC1G,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC,CAAC;YACN,CAAC;iBAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,EAAE,CAAC,cAAc,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7C,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,8DAA8D;oBACrE,OAAO,EAAE,GAAG,QAAQ,4BAA4B,IAAI,wFAAwF;oBAC5I,SAAS,EAAE,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;oBACjE,QAAQ,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC3B,cAAc,EAAE,gGAAgG;oBAChH,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,OAAO,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/cursor-rules-detector.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Cursor Rules Detector (issue #23)
+ *
+ * Audits Cursor project rules (`.cursor/rules/**\/*.mdc`):
+ *
+ *  - Frontmatter validity: present, closed, structurally sound.
+ *  - `globs` that match zero files in the repo — an Auto-Attached rule keyed to
+ *    a path that no longer exists never fires.
+ *  - Rules with no trigger at all (no `description`, no `globs`, not
+ *    `alwaysApply`) which can never activate.
+ *
+ * Deterministic and offline; findings are cautiously worded.
+ */
+import type { RepoContext } from './repo-context.js';
+import type { PromptCiIssue } from './types.js';
+export declare function detectCursorRules(context: RepoContext): PromptCiIssue[];
+//# sourceMappingURL=cursor-rules-detector.d.ts.map

package/dist/cursor-rules-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-rules-detector.d.ts","sourceRoot":"","sources":["../src/cursor-rules-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA8ChD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,EAAE,CAkEvE"}

package/dist/cursor-rules-detector.js

@@ -0,0 +1,110 @@
+/**
+ * Cursor Rules Detector (issue #23)
+ *
+ * Audits Cursor project rules (`.cursor/rules/**\/*.mdc`):
+ *
+ *  - Frontmatter validity: present, closed, structurally sound.
+ *  - `globs` that match zero files in the repo — an Auto-Attached rule keyed to
+ *    a path that no longer exists never fires.
+ *  - Rules with no trigger at all (no `description`, no `globs`, not
+ *    `alwaysApply`) which can never activate.
+ *
+ * Deterministic and offline; findings are cautiously worded.
+ */
+import micromatch from 'micromatch';
+import { parseFrontmatter, readTextWithinRoot, listFiles, shortHash, asStringList, withScannerPaths, aiConfigIssue as base, frontmatterStructureIssues, } from './ai-config.js';
+const SURFACE = {
+    idPrefix: 'cursor',
+    noun: 'Cursor rule',
+    why: 'A .mdc rule needs metadata (`description`, `globs`, or `alwaysApply`) to control when it applies.',
+    recommendation: 'Add a frontmatter block describing the rule and its trigger (globs or alwaysApply).',
+    // A metadata-less .mdc still loads as a manual rule, so this is softer news
+    // than a skill/subagent that cannot register at all.
+    noFrontmatterTitle: 'Cursor rule is missing frontmatter',
+    noFrontmatterSeverity: 'warning',
+    noFrontmatterConfidence: 0.7,
+};
+/**
+ * Glob-existence testing needs different visibility than config discovery: a
+ * rule may legitimately target `dist/` output or a *source* directory named
+ * `build/`, so only dependency/VCS trees are excluded when asking "does this
+ * glob match anything".
+ */
+const GLOB_TEST_IGNORE = ['**/node_modules/**', '**/.git/**'];
+function id(kind, key) {
+    return `ai-config-cursor-${kind}-${shortHash(key)}`;
+}
+/** A glob we can meaningfully test for zero matches (skip negations/vars/placeholders). */
+function isTestableGlob(glob) {
+    const g = glob.trim();
+    if (!g)
+        return false;
+    if (g.startsWith('!'))
+        return false;
+    if (g.includes('$') || g.includes('<') || g.includes('>'))
+        return false;
+    return true;
+}
+export function detectCursorRules(context) {
+    const issues = [];
+    const files = context.aiConfig.cursorRules;
+    // ONE repo walk shared by every dead-glob test, built lazily so repos
+    // without testable globs never pay for it. Testing each glob with its own
+    // fg.sync call would walk the full tree once per glob per rule.
+    let repoListing = null;
+    const globMatchesAnything = (patterns) => {
+        repoListing ??= listFiles(context.repoRoot, ['**/*'], GLOB_TEST_IGNORE);
+        return micromatch.some(repoListing, patterns, { dot: true });
+    };
+    for (const filePath of files) {
+        const content = readTextWithinRoot(context.repoRoot, filePath);
+        if (content === undefined)
+            continue;
+        const fm = parseFrontmatter(content);
+        issues.push(...frontmatterStructureIssues(filePath, content, fm, SURFACE));
+        if (!fm.present)
+            continue;
+        const description = typeof fm.data.description === 'string' ? fm.data.description.trim() : '';
+        const globs = asStringList(fm.data.globs);
+        const alwaysApply = fm.data.alwaysApply === true ||
+            (typeof fm.data.alwaysApply === 'string' && fm.data.alwaysApply.trim().toLowerCase() === 'true');
+        // A rule with no trigger can never activate.
+        if (!description && globs.length === 0 && !alwaysApply) {
+            issues.push(base({
+                id: id('no-trigger', filePath),
+                title: 'Cursor rule has no trigger',
+                summary: `${filePath} defines no \`description\`, no \`globs\`, and \`alwaysApply\` is not set, so Cursor has no signal for when to apply it.`,
+                filePaths: [filePath],
+                locations: [{ filePath, startLine: 1, endLine: fm.fenceEndLine > 0 ? fm.fenceEndLine : 1 }],
+                evidence: [`Keys present: ${Object.keys(fm.data).join(', ') || '(none)'}`],
+                recommendation: 'Add a `description` (agent-requested), `globs` (auto-attached), or `alwaysApply: true`.',
+                confidence: 0.7,
+            }));
+        }
+        // Globs that match zero files.
+        for (const glob of globs) {
+            if (!isTestableGlob(glob))
+                continue;
+            const normalized = glob.replace(/^\//, '');
+            // Cursor treats a slashless pattern like `*.tsx` as "any depth", but
+            // fast-glob only matches it at the root — so also try a `**/`-anchored
+            // variant before declaring the glob dead, to avoid false positives.
+            const candidates = normalized.includes('/') ? [normalized] : [normalized, `**/${normalized}`];
+            if (!globMatchesAnything(candidates)) {
+                issues.push(base({
+                    id: id('dead-glob', `${filePath}|${glob}`),
+                    title: 'Cursor rule glob matches no files',
+                    summary: `${filePath}: the \`globs\` pattern \`${glob}\` matches no files in the repository, so this auto-attached rule never fires.`,
+                    filePaths: [filePath],
+                    locations: [{ filePath, startLine: fm.keyLines.globs ?? 1, endLine: fm.keyLines.globs ?? 1 }],
+                    evidence: [`Glob: ${glob}`],
+                    recommendation: 'Update the glob to match real paths, or remove the rule if the code it targeted is gone.',
+                    confidence: 0.6,
+                }));
+            }
+        }
+    }
+    // Scanner-form paths so inline suppressions can match (see withScannerPaths).
+    return withScannerPaths(context.repoRoot, issues);
+}
+//# sourceMappingURL=cursor-rules-detector.js.map

package/dist/cursor-rules-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-rules-detector.js","sourceRoot":"","sources":["../src/cursor-rules-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,UAAU,MAAM,YAAY,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,aAAa,IAAI,IAAI,EACrB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAuB;IAClC,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,mGAAmG;IACxG,cAAc,EAAE,qFAAqF;IACrG,4EAA4E;IAC5E,qDAAqD;IACrD,kBAAkB,EAAE,oCAAoC;IACxD,qBAAqB,EAAE,SAAS;IAChC,uBAAuB,EAAE,GAAG;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;AAE9D,SAAS,EAAE,CAAC,IAAY,EAAE,GAAW;IACnC,OAAO,oBAAoB,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE3C,sEAAsE;IACtE,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,MAAM,mBAAmB,GAAG,CAAC,QAAkB,EAAW,EAAE;QAC1D,WAAW,KAAK,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACxE,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QAEpC,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,OAAO;YAAE,SAAS;QAE1B,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI;YAC9C,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAEnG,6CAA6C;QAC7C,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACf,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;gBAC9B,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,GAAG,QAAQ,0HAA0H;gBAC9I,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,QAAQ,EAAE,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAC1E,cAAc,EAAE,yFAAyF;gBACzG,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,+BAA+B;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,UAAU,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC1C,KAAK,EAAE,mCAAmC;oBAC1C,OAAO,EAAE,GAAG,QAAQ,6BAA6B,IAAI,gFAAgF;oBACrI,SAAS,EAAE,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC7F,QAAQ,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC3B,cAAc,EAAE,0FAA0F;oBAC1G,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,OAAO,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/custom-rules.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Custom-rules engine (Decision D10) — a deterministic interpreter for
+ * `.promptci/custom-rules.json`. It lets a repo add its own instruction checks
+ * without shipping code, and those findings behave exactly like built-in ones:
+ * they carry `custom:*` ids, participate in suppression and the baseline/ratchet,
+ * and run identically in a local scan and the GitHub Action (both go through
+ * `buildRepoContext`).
+ *
+ * Four rule types:
+ *  - `forbiddenPattern`  — flag each file whose text matches a regex.
+ *  - `absentPattern`     — flag the repo when a required regex is absent from all targeted files.
+ *  - `requiredSection`   — flag the repo when a required heading appears in no targeted file.
+ *  - `crossFileConflict` — flag when a regex's captured value differs across files.
+ *
+ * Everything here is deterministic: no clock, network, or randomness. Malformed
+ * config is rejected with a clear, actionable error naming the offending key —
+ * never a crash or a silent skip.
+ */
+import type { InstructionFile, IssueSeverity, PromptCiIssue } from './types.js';
+export declare const CUSTOM_RULES_FILE: string;
+export declare const CUSTOM_RULE_TYPES: readonly ["forbiddenPattern", "absentPattern", "requiredSection", "crossFileConflict"];
+export type CustomRuleType = (typeof CUSTOM_RULE_TYPES)[number];
+/** A validated custom rule. `severity` is resolved (default `warning`). */
+export type CustomRule = {
+    id: string;
+    type: CustomRuleType;
+    message: string;
+    severity: IssueSeverity;
+    files?: string[];
+    pattern?: string;
+    flags?: string;
+    heading?: string;
+};
+/** All validation failures throw this so callers can present them cleanly. */
+export declare class CustomRulesError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate a parsed `.promptci/custom-rules.json` value into typed rules.
+ * Accepts either `{ "rules": [...] }` or a bare `[...]` array. Throws a
+ * {@link CustomRulesError} naming the offending key on any problem.
+ */
+export declare function parseCustomRules(raw: unknown): CustomRule[];
+/**
+ * Load and validate `.promptci/custom-rules.json` from a repo root. A missing
+ * file yields no rules; invalid JSON or an invalid schema throws a
+ * {@link CustomRulesError} with an actionable message.
+ */
+export declare function loadCustomRules(repoRoot: string): Promise<CustomRule[]>;
+/** Run all validated custom rules over the scanned instruction files. */
+export declare function runCustomRules(files: InstructionFile[], rules: CustomRule[], repoRoot: string): PromptCiIssue[];
+//# sourceMappingURL=custom-rules.d.ts.map

package/dist/custom-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-rules.d.ts","sourceRoot":"","sources":["../src/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhF,eAAO,MAAM,iBAAiB,QAA8C,CAAC;AAE7E,eAAO,MAAM,iBAAiB,wFAKpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKhE,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AA8BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,EAAE,CAwE3D;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAkB7E;AAoID,yEAAyE;AACzE,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EAAE,EACxB,KAAK,EAAE,UAAU,EAAE,EACnB,QAAQ,EAAE,MAAM,GACf,aAAa,EAAE,CAoBjB"}

package/dist/custom-rules.js

@@ -0,0 +1,298 @@
+/**
+ * Custom-rules engine (Decision D10) — a deterministic interpreter for
+ * `.promptci/custom-rules.json`. It lets a repo add its own instruction checks
+ * without shipping code, and those findings behave exactly like built-in ones:
+ * they carry `custom:*` ids, participate in suppression and the baseline/ratchet,
+ * and run identically in a local scan and the GitHub Action (both go through
+ * `buildRepoContext`).
+ *
+ * Four rule types:
+ *  - `forbiddenPattern`  — flag each file whose text matches a regex.
+ *  - `absentPattern`     — flag the repo when a required regex is absent from all targeted files.
+ *  - `requiredSection`   — flag the repo when a required heading appears in no targeted file.
+ *  - `crossFileConflict` — flag when a regex's captured value differs across files.
+ *
+ * Everything here is deterministic: no clock, network, or randomness. Malformed
+ * config is rejected with a clear, actionable error naming the offending key —
+ * never a crash or a silent skip.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import micromatch from 'micromatch';
+import { snippet } from './evidence.js';
+export const CUSTOM_RULES_FILE = path.join('.promptci', 'custom-rules.json');
+export const CUSTOM_RULE_TYPES = [
+    'forbiddenPattern',
+    'absentPattern',
+    'requiredSection',
+    'crossFileConflict',
+];
+const VALID_SEVERITIES = ['info', 'warning', 'high', 'critical'];
+const VALID_REGEX_FLAGS = /^[gimsuy]*$/;
+// ── Validation ──────────────────────────────────────────────────────────────
+/** All validation failures throw this so callers can present them cleanly. */
+export class CustomRulesError extends Error {
+    constructor(message) {
+        super(`Invalid ${CUSTOM_RULES_FILE}: ${message}`);
+        this.name = 'CustomRulesError';
+    }
+}
+function requireString(obj, key, where) {
+    const value = obj[key];
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new CustomRulesError(`${where} is missing a non-empty string "${key}".`);
+    }
+    return value;
+}
+function requireStringArray(value, key, where) {
+    if (!Array.isArray(value) || !value.every((v) => typeof v === 'string')) {
+        throw new CustomRulesError(`${where}: "${key}" must be an array of strings.`);
+    }
+    return value;
+}
+function validateRegex(pattern, flags, where) {
+    if (flags !== undefined && !VALID_REGEX_FLAGS.test(flags)) {
+        throw new CustomRulesError(`${where}: "flags" may only contain regex flags (gimsuy).`);
+    }
+    try {
+        void new RegExp(pattern, flags);
+    }
+    catch (err) {
+        throw new CustomRulesError(`${where}: "pattern" is not a valid regular expression: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Validate a parsed `.promptci/custom-rules.json` value into typed rules.
+ * Accepts either `{ "rules": [...] }` or a bare `[...]` array. Throws a
+ * {@link CustomRulesError} naming the offending key on any problem.
+ */
+export function parseCustomRules(raw) {
+    let rawRules;
+    if (Array.isArray(raw)) {
+        rawRules = raw;
+    }
+    else if (raw && typeof raw === 'object' && 'rules' in raw) {
+        rawRules = raw.rules;
+    }
+    else {
+        throw new CustomRulesError('top level must be an object with a "rules" array (or a bare array of rules).');
+    }
+    if (!Array.isArray(rawRules)) {
+        throw new CustomRulesError('"rules" must be an array.');
+    }
+    const rules = [];
+    const seenIds = new Set();
+    for (let i = 0; i < rawRules.length; i++) {
+        const entry = rawRules[i];
+        const where = `rule at index ${i}`;
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            throw new CustomRulesError(`${where} must be an object.`);
+        }
+        const obj = entry;
+        const id = requireString(obj, 'id', where);
+        const ruleWhere = `rule "${id}"`;
+        if (seenIds.has(id)) {
+            throw new CustomRulesError(`${ruleWhere}: duplicate rule id (ids must be unique).`);
+        }
+        seenIds.add(id);
+        const type = requireString(obj, 'type', ruleWhere);
+        if (!CUSTOM_RULE_TYPES.includes(type)) {
+            throw new CustomRulesError(`${ruleWhere}: "type" must be one of ${CUSTOM_RULE_TYPES.join(', ')} (got "${type}").`);
+        }
+        const message = requireString(obj, 'message', ruleWhere);
+        let severity = 'warning';
+        if ('severity' in obj) {
+            if (typeof obj.severity !== 'string' || !VALID_SEVERITIES.includes(obj.severity)) {
+                throw new CustomRulesError(`${ruleWhere}: "severity" must be one of ${VALID_SEVERITIES.join(', ')}.`);
+            }
+            severity = obj.severity;
+        }
+        const rule = { id, type: type, message, severity };
+        if ('files' in obj)
+            rule.files = requireStringArray(obj.files, 'files', ruleWhere);
+        if ('flags' in obj) {
+            if (typeof obj.flags !== 'string') {
+                throw new CustomRulesError(`${ruleWhere}: "flags" must be a string.`);
+            }
+            rule.flags = obj.flags;
+        }
+        if (type === 'requiredSection') {
+            rule.heading = requireString(obj, 'heading', ruleWhere);
+        }
+        else {
+            // pattern-based types
+            rule.pattern = requireString(obj, 'pattern', ruleWhere);
+            validateRegex(rule.pattern, rule.flags, ruleWhere);
+        }
+        rules.push(rule);
+    }
+    return rules;
+}
+/**
+ * Load and validate `.promptci/custom-rules.json` from a repo root. A missing
+ * file yields no rules; invalid JSON or an invalid schema throws a
+ * {@link CustomRulesError} with an actionable message.
+ */
+export async function loadCustomRules(repoRoot) {
+    const filePath = path.join(repoRoot, CUSTOM_RULES_FILE);
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CustomRulesError('file is not valid JSON.');
+    }
+    return parseCustomRules(parsed);
+}
+// ── Interpreter ─────────────────────────────────────────────────────────────
+function shortHash(value) {
+    return crypto.createHash('sha1').update(value).digest('hex').slice(0, 12);
+}
+/** 1-based line number of a character offset within `content`. */
+function lineOfOffset(content, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < content.length; i++) {
+        if (content[i] === '\n')
+            line++;
+    }
+    return line;
+}
+/** Files a rule targets: all instruction files, or those matching its globs. */
+function targetedFiles(files, rule, repoRoot) {
+    if (!rule.files || rule.files.length === 0)
+        return files;
+    return files.filter((f) => {
+        const rel = path.relative(repoRoot, f.path).replace(/\\/g, '/');
+        return micromatch.isMatch(rel, rule.files, { dot: true });
+    });
+}
+function freshRegex(rule) {
+    // A fresh instance per use so a shared `g` flag never leaks lastIndex.
+    return new RegExp(rule.pattern, rule.flags);
+}
+function baseIssue(rule) {
+    return { severity: rule.severity, category: 'custom', confidence: 1.0, tags: ['custom-rule'] };
+}
+function runForbiddenPattern(files, rule) {
+    const issues = [];
+    for (const file of files) {
+        const match = freshRegex(rule).exec(file.content);
+        if (!match)
+            continue;
+        const line = lineOfOffset(file.content, match.index);
+        issues.push({
+            id: `custom:${rule.id}:${shortHash(file.path)}`,
+            ...baseIssue(rule),
+            title: rule.message,
+            summary: `Custom rule "${rule.id}": a forbidden pattern was found in this file.`,
+            filePaths: [file.path],
+            locations: [{ filePath: file.path, startLine: line, endLine: line }],
+            evidence: [`Matched text: "${snippet(match[0], 120)}" (line ${line})`],
+            recommendation: `Remove or revise the flagged content to satisfy custom rule "${rule.id}".`,
+        });
+    }
+    return issues;
+}
+function runAbsentPattern(files, rule) {
+    const present = files.some((f) => freshRegex(rule).test(f.content));
+    if (present)
+        return [];
+    return [
+        {
+            id: `custom:${rule.id}`,
+            ...baseIssue(rule),
+            title: rule.message,
+            summary: `Custom rule "${rule.id}": a required pattern is absent from all checked instruction files.`,
+            filePaths: files.map((f) => f.path),
+            locations: files.map((f) => ({ filePath: f.path })),
+            evidence: [`Required pattern was not found in any of ${files.length} checked file(s).`],
+            recommendation: `Add content matching custom rule "${rule.id}" to one of the instruction files.`,
+        },
+    ];
+}
+function normalizeHeading(h) {
+    return h.toLowerCase().replace(/^#+\s*/, '').replace(/\s+/g, ' ').trim();
+}
+function runRequiredSection(files, rule) {
+    const wanted = normalizeHeading(rule.heading);
+    const found = files.some((f) => f.sections.some((s) => s.heading !== undefined && normalizeHeading(s.heading).includes(wanted)));
+    if (found)
+        return [];
+    return [
+        {
+            id: `custom:${rule.id}`,
+            ...baseIssue(rule),
+            title: rule.message,
+            summary: `Custom rule "${rule.id}": a required section heading ("${rule.heading}") is missing from all checked files.`,
+            filePaths: files.map((f) => f.path),
+            locations: files.map((f) => ({ filePath: f.path })),
+            evidence: [`No section heading matching "${rule.heading}" was found in ${files.length} checked file(s).`],
+            recommendation: `Add a "${rule.heading}" section to one of the instruction files to satisfy custom rule "${rule.id}".`,
+        },
+    ];
+}
+function runCrossFileConflict(files, rule) {
+    // value → the files (and the line) where it was captured.
+    const byValue = new Map();
+    for (const file of files) {
+        const match = freshRegex(rule).exec(file.content);
+        if (!match)
+            continue;
+        // Prefer the first capture group when present, else the whole match.
+        const value = (match[1] ?? match[0]).trim();
+        const line = lineOfOffset(file.content, match.index);
+        const list = byValue.get(value) ?? [];
+        list.push({ filePath: file.path, line });
+        byValue.set(value, list);
+    }
+    if (byValue.size < 2)
+        return [];
+    const filePaths = [...new Set([...byValue.values()].flat().map((v) => v.filePath))];
+    const locations = [...byValue.values()].flat().map((v) => ({ filePath: v.filePath, startLine: v.line, endLine: v.line }));
+    const evidence = [...byValue.entries()].map(([value, where]) => `"${snippet(value, 60)}" in ${where.map((w) => path.basename(w.filePath)).join(', ')}`);
+    return [
+        {
+            id: `custom:${rule.id}`,
+            ...baseIssue(rule),
+            title: rule.message,
+            summary: `Custom rule "${rule.id}": the tracked value differs across files (${byValue.size} distinct values).`,
+            filePaths,
+            locations,
+            evidence,
+            recommendation: `Reconcile the conflicting values so custom rule "${rule.id}" sees a single consistent value.`,
+        },
+    ];
+}
+/** Run all validated custom rules over the scanned instruction files. */
+export function runCustomRules(files, rules, repoRoot) {
+    const issues = [];
+    for (const rule of rules) {
+        const scoped = targetedFiles(files, rule, repoRoot);
+        switch (rule.type) {
+            case 'forbiddenPattern':
+                issues.push(...runForbiddenPattern(scoped, rule));
+                break;
+            case 'absentPattern':
+                issues.push(...runAbsentPattern(scoped, rule));
+                break;
+            case 'requiredSection':
+                issues.push(...runRequiredSection(scoped, rule));
+                break;
+            case 'crossFileConflict':
+                issues.push(...runCrossFileConflict(scoped, rule));
+                break;
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=custom-rules.js.map