pr-checkmate 1.21.10 → 1.21.12

package/dist/cli.js

@@ -1,9 +1,35 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const scripts_1 = require("./scripts");
+const core_1 = require("./core");
 const init_1 = require("./init");
 const utils_1 = require("./utils");
+/** Maps short CLI command names to their registry check names. */
+const COMMAND_TO_CHECK = {
+    lint: 'ESLint',
+    deps: 'Dependencies',
+    dependencies: 'Dependencies',
+    'npm-audit': 'NPM Audit',
+    prettier: 'Prettier',
+    spellcheck: 'Spellcheck',
+    security: 'Security Scan',
+    circular: 'Circular Deps',
+    license: 'License Check',
+    'pr-size': 'PR Size',
+    'pr-title': 'PR Title',
+    outdated: 'Outdated Deps',
+    markdown: 'Markdown',
+    typecheck: 'TypeScript',
+    'diff-smell': 'Diff Smells',
+    'diff-security': 'Diff Security',
+    'sensitive-files': 'Sensitive Files',
+    'pr-body': 'PR Body',
+    duplicate: 'Duplicate Code',
+    commitlint: 'Commitlint',
+    'cpp-format': 'C++ Format',
+    'python-lint': 'Ruff Lint',
+    'python-format': 'Ruff Format',
+};
 const cmd = process.argv[2];
 void (async () => {
     try {
@@ -11,8 +37,18 @@ void (async () => {
             await (0, init_1.init)();
             process.exit(0);
         }
-        await (0, scripts_1.runJob)(cmd ?? 'all');
-        process.exit(0);
+        // Full run: post a GitHub summary comment and allow formatters to write.
+        if (!cmd || cmd === 'all') {
+            const report = await (0, core_1.runChecks)({ reporter: 'github', write: true });
+            process.exit(report.ok ? 0 : 1);
+        }
+        const checkName = COMMAND_TO_CHECK[cmd];
+        if (!checkName) {
+            utils_1.logger.warn(`[cli]: Unknown command "${cmd}". Available: all, init, ${Object.keys(COMMAND_TO_CHECK).join(', ')}`);
+            process.exit(1);
+        }
+        const report = await (0, core_1.runChecks)({ only: [checkName], reporter: 'stdout', write: true });
+        process.exit(report.ok ? 0 : 1);
     }
     catch (err) {
         utils_1.logger.error(`❌ CLI failed: ${err}`);

package/dist/config/loader.js

@@ -56,6 +56,16 @@ function mergeWithDefaults(userConfig) {
         },
         security: userConfig.security || defaults.security,
         typecheck: { ...defaults.typecheck, ...userConfig.typecheck },
+        cpp: {
+            ...defaults.cpp,
+            ...userConfig.cpp,
+            clangFormat: { ...defaults.cpp?.clangFormat, ...userConfig.cpp?.clangFormat },
+        },
+        python: {
+            ...defaults.python,
+            ...userConfig.python,
+            ruff: { ...defaults.python?.ruff, ...userConfig.python?.ruff },
+        },
         diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
         prBody: { ...defaults.prBody, ...userConfig.prBody },
         duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
@@ -127,6 +137,8 @@ function getDefaultConfig() {
             'npm-audit': { enabled: true, auditLevel: 'moderate' },
         },
         typecheck: { enabled: true },
+        cpp: { enabled: true, clangFormat: { style: 'LLVM' } },
+        python: { enabled: true, ruff: { lint: true, format: true } },
         diffSmell: { enabled: true },
         prBody: { enabled: true, minLength: 20, requireTicket: true },
         duplicate: { enabled: true, minLines: 5, minTokens: 50 },

package/dist/core/checks/circular-deps.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.circularDepsCheck = void 0;
+const execa_1 = require("execa");
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../utils");
+const config_1 = require("../../config");
+const types_1 = require("../types");
+exports.circularDepsCheck = {
+    name: 'Circular Deps',
+    phase: 'blocking',
+    applies(ctx) {
+        return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
+    },
+    async run(ctx) {
+        const pattern = node_path_1.default.join(ctx.cwd, (0, config_1.getSourcePath)(), '**/*.{ts,tsx,js,jsx}');
+        const result = await (0, execa_1.execa)('npx', ['dpdm', '--no-warning', '--no-tree', '--circular', pattern], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
+        const output = (result.stdout + result.stderr).trim();
+        // dpdm's success message also contains "circular" — match only its error shapes:
+        // the "Circular Dependencies:" header or a numbered entry "[1] src/a.ts -> src/b.ts".
+        const hasCircular = /circular dependencies:/i.test(output) || /^\s*\[\d+\]/m.test(output);
+        if (hasCircular) {
+            utils_1.logger.error(`[Circular Deps]: ❌ circular dependencies detected:\n${output}`);
+            return (0, types_1.fail)('circular dependencies found');
+        }
+        return (0, types_1.pass)();
+    },
+};

package/dist/core/checks/commitlint.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commitlintCheck = void 0;
+const execa_1 = require("execa");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const utils_1 = require("../../utils");
+const config_1 = require("../../config");
+const types_1 = require("../types");
+const LOCAL_CONFIG_FILES = [
+    'commitlint.config.cjs',
+    'commitlint.config.js',
+    'commitlint.config.mjs',
+    'commitlint.config.ts',
+    '.commitlintrc',
+    '.commitlintrc.json',
+    '.commitlintrc.yaml',
+    '.commitlintrc.yml',
+    '.commitlintrc.js',
+    '.commitlintrc.cjs',
+];
+const DEFAULT_TYPES = [
+    'feat',
+    'fix',
+    'docs',
+    'chore',
+    'ci',
+    'refactor',
+    'perf',
+    'style',
+    'revert',
+    'test',
+    'build',
+];
+function buildTempConfig(types) {
+    const config = {
+        // Resolve via Node module resolution — robust to npm hoisting in the client.
+        extends: [require.resolve('@commitlint/config-conventional')],
+        rules: { 'type-enum': [2, 'always', types] },
+    };
+    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.commitlint-${process.pid}.json`);
+    node_fs_1.default.writeFileSync(tmpFile, JSON.stringify(config, null, 2));
+    return tmpFile;
+}
+exports.commitlintCheck = {
+    name: 'Commitlint',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.commitlint?.enabled !== false;
+    },
+    async run(ctx) {
+        const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
+        const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
+        let tempConfigFile = null;
+        const from = ctx.baseSha ?? 'HEAD~1';
+        const to = ctx.headSha ?? 'HEAD';
+        const args = ['--from', from, '--to', to, '--verbose'];
+        try {
+            if (hasLocal) {
+                utils_1.logger.info('[Commitlint]: Using local config');
+            }
+            else {
+                const types = ctx.config.commitlint?.types ?? DEFAULT_TYPES;
+                tempConfigFile = buildTempConfig(types);
+                args.push('--config', tempConfigFile);
+            }
+            const result = await (0, execa_1.execa)(process.execPath, [commitlintBin, ...args], {
+                cwd: ctx.cwd,
+                reject: false,
+                stdio: 'inherit',
+            });
+            return result.exitCode === 0 ? (0, types_1.pass)() : (0, types_1.warn)('commit message violations found');
+        }
+        finally {
+            if (tempConfigFile && node_fs_1.default.existsSync(tempConfigFile))
+                node_fs_1.default.unlinkSync(tempConfigFile);
+        }
+    },
+};

package/dist/core/checks/cpp-format.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cppFormatCheck = void 0;
+const execa_1 = require("execa");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../utils");
+const types_1 = require("../types");
+/**
+ * C/C++ source & header extensions clang-format understands. `.h` is intentionally
+ * included even though it is ambiguous with C — clang-format handles both.
+ */
+const CPP_GLOBS = ['*.c', '*.cc', '*.cpp', '*.cxx', '*.c++', '*.h', '*.hh', '*.hpp', '*.hxx'];
+const DEFAULT_STYLE = 'LLVM';
+/**
+ * Resolves the clang-format style argument. Prefers the project's own `.clang-format`
+ * (via `--style=file`) so pr-checkmate never overrides a repo's established rules;
+ * falls back to the configured style, then LLVM.
+ */
+function resolveStyleArg(ctx) {
+    if (node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, '.clang-format'))) {
+        return '--style=file';
+    }
+    const style = ctx.config.cpp?.clangFormat?.style ?? DEFAULT_STYLE;
+    return `--style=${style}`;
+}
+/**
+ * Returns the C/C++ files to check. Uses the PR diff range when available
+ * (delta mode), else scans all tracked C/C++ files. Returns an empty array
+ * when there is nothing to check, `null` when git is unusable.
+ */
+async function resolveTargets(ctx) {
+    try {
+        if (ctx.baseSha) {
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--name-only',
+                '--diff-filter=ACMR',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+                '--',
+                ...CPP_GLOBS,
+            ], { cwd: ctx.cwd, reject: false });
+            const files = stdout
+                .split('\n')
+                .map(f => f.trim())
+                .filter(Boolean);
+            utils_1.logger.info(`[C++ Format]: 📂 Delta mode: ${files.length} changed C/C++ file(s)`);
+            return files;
+        }
+        const { stdout } = await (0, execa_1.execa)('git', ['ls-files', ...CPP_GLOBS], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
+        const files = stdout
+            .split('\n')
+            .map(f => f.trim())
+            .filter(Boolean);
+        utils_1.logger.info(`[C++ Format]: Full scan: ${files.length} tracked C/C++ file(s)`);
+        return files;
+    }
+    catch (err) {
+        utils_1.logger.warn(`[C++ Format]: ⚠️ Could not list C/C++ files\n${err}`);
+        return null;
+    }
+}
+/** Counts distinct files flagged in clang-format's `--dry-run --Werror` diagnostics. */
+function countOffendingFiles(stderr) {
+    const files = new Set();
+    for (const line of stderr.split('\n')) {
+        const match = line.match(/^(.+?):\d+:\d+: (?:error|warning):/);
+        if (match)
+            files.add(match[1]);
+    }
+    return files.size;
+}
+/**
+ * Formats C/C++ code with clang-format, bundled as a self-contained WASM CLI
+ * (`@wasm-fmt/clang-format`) so it runs on a bare Node image with no system
+ * clang install. Read-only in check mode; rewrites files in place when `write`.
+ */
+exports.cppFormatCheck = {
+    name: 'C++ Format',
+    phase: 'format',
+    applies(ctx) {
+        return ctx.config.cpp?.enabled !== false && ctx.languages.includes('cpp');
+    },
+    async run(ctx) {
+        const targets = await resolveTargets(ctx);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_1.pass)('no C/C++ files changed');
+        const cfBin = (0, utils_1.resolvePackageBin)('@wasm-fmt/clang-format', 'clang-format-cli.cjs');
+        const styleArg = resolveStyleArg(ctx);
+        // Detect unformatted files without mutating anything.
+        const dry = await (0, execa_1.execa)(process.execPath, [cfBin, '--dry-run', '--Werror', styleArg, ...targets], { cwd: ctx.cwd, reject: false });
+        if (dry.exitCode === 0)
+            return (0, types_1.pass)();
+        const offending = countOffendingFiles(dry.stderr) || targets.length;
+        if (!ctx.write) {
+            utils_1.logger.warn(`[C++ Format]: ⚠️ ${offending} C/C++ file(s) need formatting`);
+            return (0, types_1.warn)(`${offending} file(s) need formatting (run with write to fix)`);
+        }
+        // write mode: rewrite the offending files in place so CI can auto-commit them.
+        const fix = await (0, execa_1.execa)(process.execPath, [cfBin, '-i', styleArg, ...targets], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
+        if (fix.exitCode !== 0) {
+            utils_1.logger.warn(`[C++ Format]: ⚠️ clang-format -i failed\n${fix.stderr}`);
+            return (0, types_1.warn)('clang-format failed to rewrite files');
+        }
+        utils_1.logger.info(`[C++ Format]: ✅ Reformatted ${offending} C/C++ file(s)`);
+        return (0, types_1.pass)(`reformatted ${offending} file(s)`);
+    },
+};

package/dist/core/checks/dependency-check.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dependencyCheck = void 0;
+const execa_1 = require("execa");
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const utils_1 = require("../../utils");
+const types_1 = require("../types");
+exports.dependencyCheck = {
+    name: 'Dependencies',
+    phase: 'blocking',
+    applies(ctx) {
+        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+    },
+    async run(ctx) {
+        let stdout;
+        try {
+            ({ stdout } = await (0, execa_1.execa)('npx', ['depcheck', '--json'], { cwd: ctx.cwd }));
+        }
+        catch (err) {
+            // depcheck exits non-zero when it finds issues but still emits JSON on stdout.
+            if (err instanceof execa_1.ExecaError && err.stdout) {
+                stdout = err.stdout;
+            }
+            else {
+                throw err;
+            }
+        }
+        const start = stdout.indexOf('{');
+        const end = stdout.lastIndexOf('}');
+        const json = start !== -1 && end !== -1 ? stdout.slice(start, end + 1) : stdout;
+        let result;
+        try {
+            result = JSON.parse(json);
+        }
+        catch {
+            return (0, types_1.fail)('depcheck produced invalid JSON');
+        }
+        const unused = result.dependencies ?? [];
+        const missing = Object.keys(result.missing ?? {});
+        if (missing.length > 0) {
+            missing.forEach(dep => utils_1.logger.error(`[Dependencies]: ❌ missing ${dep} (used in: ${result.missing[dep]?.join(', ')})`));
+            return (0, types_1.fail)(`missing: ${missing.join(', ')}`);
+        }
+        if (unused.length > 0) {
+            unused.forEach(dep => utils_1.logger.warn(`[Dependencies]: ⚠️ unused ${dep}`));
+            return (0, types_1.warn)(`${unused.length} unused dependency(ies)`);
+        }
+        return (0, types_1.pass)();
+    },
+};

package/dist/core/checks/diff-security.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffSecurityCheck = void 0;
+const execa_1 = require("execa");
+const utils_1 = require("../../utils");
+const types_1 = require("../types");
+const SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
+        label: 'dangerouslySetInnerHTML (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
+        label: 'innerHTML assignment (XSS risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*document\.write\s*\(/,
+        label: 'document.write() (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
+        label: 'new Function() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
+        label: '__proto__ mutation (prototype pollution)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
+        label: 'constructor.prototype access (prototype pollution)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
+        label: 'MD5 (weak hash — use sha256 or stronger)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
+        label: 'SHA-1 (weak hash — use sha256 or stronger)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
+        label: 'deprecated createDecipher() — use createDecipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
+        label: 'deprecated createCipher() — use createCipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
+        label: "CORS wildcard origin: '*' (allows any domain)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
+        label: 'Insecure HTTP (non-HTTPS) in external call',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
+        label: 'exec/spawn with template literal (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
+        label: 'exec/spawn with string concatenation (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
+        label: 'SQL query with template literal interpolation (SQL injection risk)',
+        severity: 'error',
+    },
+    {
+        // A quoted string that contains a whole SQL keyword, concatenated with a
+        // variable — the real injection shape. Word boundaries + the quote context
+        // stop identifiers like `insertions + deletions` from false-positiving.
+        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+exports.diffSecurityCheck = {
+    name: 'Diff Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--unified=0',
+                '--diff-filter=ACMR',
+                ctx.baseSha,
+                'HEAD',
+                '--',
+                '*.ts',
+                '*.tsx',
+                '*.js',
+                '*.jsx',
+                '*.mjs',
+                '*.cjs',
+            ], { cwd: ctx.cwd });
+            const errors = {};
+            const warnings = {};
+            for (const line of stdout.split('\n')) {
+                for (const { pattern, label, severity } of SECURITY_PATTERNS) {
+                    if (pattern.test(line)) {
+                        const bucket = severity === 'error' ? errors : warnings;
+                        (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+                    }
+                }
+            }
+            const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
+            const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
+            if (totalErrors === 0 && totalWarnings === 0)
+                return (0, types_1.pass)();
+            for (const [label, occurrences] of Object.entries(errors)) {
+                utils_1.logger.error(`[Diff Security]: ❌ ${label}: ${occurrences.length} occurrence(s)`);
+                occurrences.slice(0, 3).forEach(l => utils_1.logger.error(`    ${l}`));
+                if (occurrences.length > 3)
+                    utils_1.logger.error(`    ... and ${occurrences.length - 3} more`);
+            }
+            for (const [label, occurrences] of Object.entries(warnings)) {
+                utils_1.logger.warn(`[Diff Security]: ⚠️ ${label}: ${occurrences.length} occurrence(s)`);
+                occurrences.slice(0, 3).forEach(l => utils_1.logger.warn(`    ${l}`));
+                if (occurrences.length > 3)
+                    utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
+            }
+            const parts = [];
+            if (totalErrors > 0)
+                parts.push(`${totalErrors} issue(s)`);
+            if (totalWarnings > 0)
+                parts.push(`${totalWarnings} warning(s)`);
+            return (0, types_1.warn)(parts.join(', '));
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/diff-smell.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffSmellCheck = void 0;
+const execa_1 = require("execa");
+const utils_1 = require("../../utils");
+const types_1 = require("../types");
+const SMELL_PATTERNS = [
+    {
+        pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/,
+        label: 'console.*()',
+    },
+    { pattern: /^\+(?!\+).*\bdebugger\b/, label: 'debugger statement' },
+    { pattern: /^\+\s*\/\/\s*TODO\b/i, label: 'TODO comment' },
+    { pattern: /^\+\s*\/\/\s*FIXME\b/i, label: 'FIXME comment' },
+    { pattern: /^\+\s*\/\/\s*HACK\b/i, label: 'HACK comment' },
+    { pattern: /^\+\s*\/\/\s*XXX\b/i, label: 'XXX marker' },
+];
+exports.diffSmellCheck = {
+    name: 'Diff Smells',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.diffSmell?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--unified=0',
+                '--diff-filter=ACMR',
+                ctx.baseSha,
+                'HEAD',
+                '--',
+                '*.ts',
+                '*.tsx',
+                '*.js',
+                '*.jsx',
+            ], { cwd: ctx.cwd });
+            const findings = {};
+            for (const line of stdout.split('\n')) {
+                for (const { pattern, label } of SMELL_PATTERNS) {
+                    if (pattern.test(line)) {
+                        (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 100));
+                    }
+                }
+            }
+            const total = Object.values(findings).reduce((sum, arr) => sum + arr.length, 0);
+            if (total === 0)
+                return (0, types_1.pass)();
+            for (const [label, occurrences] of Object.entries(findings)) {
+                utils_1.logger.warn(`[Diff Smells]: ⚠️ ${label}: ${occurrences.length} occurrence(s)`);
+                occurrences.slice(0, 3).forEach(l => utils_1.logger.warn(`    ${l}`));
+                if (occurrences.length > 3)
+                    utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
+            }
+            const summary = Object.entries(findings)
+                .map(([label, arr]) => `${arr.length}× ${label}`)
+                .join(', ');
+            return (0, types_1.warn)(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Diff Smells]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/duplicate-check.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.duplicateCheck = void 0;
+const execa_1 = require("execa");
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const utils_1 = require("../../utils");
+const delta_1 = require("../../utils/delta");
+const types_1 = require("../types");
+exports.duplicateCheck = {
+    name: 'Duplicate Code',
+    phase: 'informational',
+    applies(ctx) {
+        if (ctx.config.duplicate?.enabled === false)
+            return false;
+        return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
+    },
+    async run(ctx) {
+        const minLines = ctx.config.duplicate?.minLines ?? 5;
+        const minTokens = ctx.config.duplicate?.minTokens ?? 50;
+        const changedFiles = await (0, delta_1.getChangedFiles)(['.ts', '.tsx', '.js', '.jsx']);
+        if (changedFiles !== null && changedFiles.length === 0)
+            return (0, types_1.skip)('no relevant files changed');
+        const srcPath = node_path_1.default.join(ctx.cwd, 'src');
+        const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [ctx.cwd]);
+        const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'bin/jscpd');
+        try {
+            const result = await (0, execa_1.execa)(process.execPath, [
+                jscpdBin,
+                '--min-lines',
+                String(minLines),
+                '--min-tokens',
+                String(minTokens),
+                '--reporters',
+                'console',
+                '--ignore',
+                'node_modules/**,dist/**,.git/**',
+                '--quiet',
+                ...targetPaths,
+            ], { cwd: ctx.cwd, reject: false });
+            const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+            const clonesMatch = output.match(/(\d+)\s+clone/i);
+            const cloneCount = clonesMatch ? parseInt(clonesMatch[1], 10) : 0;
+            if (cloneCount > 0) {
+                utils_1.logger.warn(`[Duplicate Code]: ⚠️ Found ${cloneCount} duplicate block(s)`);
+                if (output)
+                    utils_1.logger.warn(output);
+                return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
+            }
+            return (0, types_1.pass)();
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Duplicate Code]: ⚠️ Could not run duplicate check\n${err}`);
+            return (0, types_1.skip)('jscpd unavailable');
+        }
+    },
+};