pr-checkmate 1.21.15 → 1.22.0

package/.eslintrc.js

@@ -41,7 +41,7 @@ module.exports = {
     sourceType: 'module',
     project: './tsconfig.json',
   },
-  plugins: ['@typescript-eslint', 'prettier', 'import', 'jsdoc'],
+  plugins: ['@typescript-eslint', 'prettier', 'import-x', 'jsdoc'],
   extends: [
     'eslint:recommended',
     'plugin:@typescript-eslint/recommended',
@@ -83,14 +83,14 @@ module.exports = {
     // Complexity analysis (#61)
     complexity: ['warn', 15],
     // Import ordering (#65)
-    'import/order': [
+    'import-x/order': [
       'warn',
       {
         groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
         alphabetize: { order: 'asc', caseInsensitive: true },
       },
     ],
-    'import/no-duplicates': 'error',
+    'import-x/no-duplicates': 'error',
     // Documentation (#62)
     'jsdoc/require-jsdoc': [
       'warn',

package/README.md

@@ -4,6 +4,12 @@
 ![npm](https://img.shields.io/npm/v/pr-checkmate?color=blue&label=npm)
 ![License](https://img.shields.io/badge/license-Proprietary-lightgrey)
 
+![ESLint](https://img.shields.io/badge/ESLint-10-4B32C3?logo=eslint&logoColor=white)
+![Prettier](https://img.shields.io/badge/Prettier-3-F7B93E?logo=prettier&logoColor=white)
+![TypeScript](https://img.shields.io/badge/TypeScript-6-3178C6?logo=typescript&logoColor=white)
+![cspell](https://img.shields.io/badge/cspell-10-4285F4)
+![jscpd](https://img.shields.io/badge/jscpd-5-blue)
+
 > **PR CheckMate** is a universal PR quality checker that runs as a single `npm install` and works across **TypeScript, JavaScript, Python, C++, Swift, and Android/Kotlin** repositories — no per-language toolchain setup required.
 
 ---
@@ -280,7 +286,7 @@ In GitHub Actions PR context, language checks automatically switch to **delta mo
 
 After `npx pr-checkmate all`, a summary table is posted to the PR. On repeated pushes the comment is updated in place — no duplicate comments.
 
-```
+```text
 ## PR CheckMate Summary
 
 11 passed · 3 warnings · 0 failed · 0 skipped

package/cspell.json

@@ -189,6 +189,18 @@
     "sultansadikov",
     "telaviv",
     "travis",
+    "kotlin",
+    "kucherenko",
+    "opencollective",
+    "Werror",
+    "positiving",
+    "pyflakes",
+    "pycodestyle",
+    "swiftlint",
+    "pathspec",
+    "Pipfile",
+    "conanfile",
+    "ktlint",
     "Términos",
     "Teudat",
     "Tiempo",
@@ -543,7 +555,145 @@
     "Makefiles",
     "dpdm",
     "commitlintrc",
-    "shortstat"
+    "shortstat",
+    "Cooldown",
+    "SCRIPTERROR",
+    "attendace",
+    "attendance",
+    "kupat",
+    "gemel",
+    "hishtalmut",
+    "keren",
+    "tofes",
+    "Bdikat",
+    "Hishuv",
+    "formcontrolname",
+    "zrufot",
+    "Klali",
+    "contenteditable",
+    "האניקומב",
+    "ishur",
+    "Yeshut",
+    "Nihul",
+    "pratim",
+    "nispahim",
+    "networkidle",
+    "domcontentloaded",
+    "secapp",
+    "taxinfo",
+    "gmishurim",
+    "ezor",
+    "ishi",
+    "ishurim",
+    "nikui",
+    "mekabel",
+    "shdochshana",
+    "gershayim",
+    "Rashum",
+    "Shem",
+    "Mishpaha",
+    "Rshum",
+    "Prati",
+    "Ktovet",
+    "Doar",
+    "Megurim",
+    "ddlkidomet",
+    "Aher",
+    "Esek",
+    "Isuk",
+    "Mazav",
+    "Mish",
+    "Beyachad",
+    "Shlichat",
+    "Neezarti",
+    "Doch",
+    "Klalim",
+    "Hehzer",
+    "Ozer",
+    "נייע",
+    "recognised",
+    "קולומייץ",
+    "אירינה",
+    "סרגיי",
+    "פולישוק",
+    "ולדימיר",
+    "moov",
+    "virtualenv",
+    "pytesseract",
+    "qrdet",
+    "Jsons",
+    "easyocr",
+    "EXIF",
+    "fliplr",
+    "noautorotate",
+    "timestep",
+    "VAQH",
+    "DSBL",
+    "MAXU",
+    "XCUI",
+    "Apks",
+    "bootstatus",
+    "BEGINSWITH",
+    "anypassword",
+    "wrongpassword",
+    "xmark",
+    "didnt",
+    "Anthropic",
+    "bartowski",
+    "specialisation",
+    "cursorrules",
+    "deepseek",
+    "GGUF",
+    "hf",
+    "llm",
+    "machdep",
+    "migrat",
+    "modelcontextprotocol",
+    "mxbai",
+    "noheader",
+    "codedb",
+    "nomic",
+    "nounits",
+    "nvidia",
+    "ollama",
+    "qwen",
+    "shellcheck",
+    "standards",
+    "vram",
+    "ATATT",
+    "ATSTT",
+    "AUTOINCREMENT",
+    "BEAGENT",
+    "CEREBRAS",
+    "cpucore",
+    "Fingerprinter",
+    "FREELLM",
+    "ircular",
+    "integrat",
+    "LOOKBACK",
+    "markitdown",
+    "memswap",
+    "nknown",
+    "processlist",
+    "unixepoch",
+    "unreviewed",
+    "xapp",
+    "bpoa",
+    "installroot",
+    "dedups",
+    "behaviourally",
+    "normalised",
+    "раннера",
+    "раннере",
+    "пайплайн",
+    "dind",
+    "dlib",
+    "pugixml",
+    "opencvcommit",
+    "litert",
+    "SHTPB",
+    "FUTX",
+    "subdirs"
   ],
   "ignorePaths": [
     "**/node_modules/**",

package/dist/config/loader.js

@@ -163,6 +163,10 @@ function getDefaultConfig() {
                 'test',
                 'build',
             ],
+            // Skip release PRs and squash-merge titles that don't follow conventional
+            // commits (e.g. "Release 15 (#114)"). commitlint already ignores literal
+            // "Merge"/"Revert" messages, but not GitHub squash-merge PR titles.
+            ignores: ['^Release\\b', '^chore\\(release\\):'],
         },
         licenseCheck: {
             allowPackages: [...constants_1.DEFAULT_ALLOW_PACKAGES],

package/dist/core/checks/commitlint.js

@@ -36,14 +36,21 @@ const DEFAULT_TYPES = [
     'test',
     'build',
 ];
-function buildTempConfig(types) {
-    const config = {
-        // Resolve via Node module resolution — robust to npm hoisting in the client.
-        extends: [require.resolve('@commitlint/config-conventional')],
-        rules: { 'type-enum': [2, 'always', types] },
-    };
-    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.commitlint-${process.pid}.json`);
-    node_fs_1.default.writeFileSync(tmpFile, JSON.stringify(config, null, 2));
+const DEFAULT_IGNORES = ['^Release\\b', '^chore\\(release\\):'];
+function buildTempConfig(types, ignores) {
+    // Emit a CJS module so `ignores` can hold functions — commitlint requires
+    // predicate functions there, which a JSON config cannot express.
+    // Resolve config-conventional via Node module resolution — robust to hoisting.
+    const configConventional = require.resolve('@commitlint/config-conventional');
+    const content = `const patterns = ${JSON.stringify(ignores)}.map((p) => new RegExp(p, 'i'));
+module.exports = {
+  extends: [${JSON.stringify(configConventional)}],
+  rules: { 'type-enum': [2, 'always', ${JSON.stringify(types)}] },
+  ignores: [(commit) => patterns.some((re) => re.test(commit))],
+};
+`;
+    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.commitlint-${process.pid}.cjs`);
+    node_fs_1.default.writeFileSync(tmpFile, content);
     return tmpFile;
 }
 exports.commitlintCheck = {
@@ -65,7 +72,8 @@ exports.commitlintCheck = {
             }
             else {
                 const types = ctx.config.commitlint?.types ?? DEFAULT_TYPES;
-                tempConfigFile = buildTempConfig(types);
+                const ignores = ctx.config.commitlint?.ignores ?? DEFAULT_IGNORES;
+                tempConfigFile = buildTempConfig(types, ignores);
                 args.push('--config', tempConfigFile);
             }
             const result = await (0, execa_1.execa)(process.execPath, [commitlintBin, ...args], {

package/dist/core/checks/diff-security.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSecurityCheck = void 0;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
 const types_1 = require("../types");
+const findings_1 = require("./findings");
 const SECURITY_PATTERNS = [
     {
         pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
@@ -99,6 +99,20 @@ const SECURITY_PATTERNS = [
         severity: 'error',
     },
 ];
+/** Bucket added-line matches by severity, keyed by pattern label. */
+function scanDiff(stdout) {
+    const errors = {};
+    const warnings = {};
+    for (const line of stdout.split('\n')) {
+        for (const { pattern, label, severity } of SECURITY_PATTERNS) {
+            if (pattern.test(line)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+    return { errors, warnings };
+}
 exports.diffSecurityCheck = {
     name: 'Diff Security',
     phase: 'informational',
@@ -107,52 +121,21 @@ exports.diffSecurityCheck = {
     },
     async run(ctx) {
         try {
-            const { stdout } = await (0, execa_1.execa)('git', [
-                'diff',
-                '--unified=0',
-                '--diff-filter=ACMR',
-                ctx.baseSha,
-                'HEAD',
-                '--',
+            const stdout = await (0, findings_1.diffAddedLines)(ctx, [
                 '*.ts',
                 '*.tsx',
                 '*.js',
                 '*.jsx',
                 '*.mjs',
                 '*.cjs',
-            ], { cwd: ctx.cwd });
-            const errors = {};
-            const warnings = {};
-            for (const line of stdout.split('\n')) {
-                for (const { pattern, label, severity } of SECURITY_PATTERNS) {
-                    if (pattern.test(line)) {
-                        const bucket = severity === 'error' ? errors : warnings;
-                        (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-                    }
-                }
-            }
-            const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
-            const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
-            if (totalErrors === 0 && totalWarnings === 0)
-                return (0, types_1.pass)();
-            for (const [label, occurrences] of Object.entries(errors)) {
-                utils_1.logger.error(`[Diff Security]: ❌ ${label}: ${occurrences.length} occurrence(s)`);
-                occurrences.slice(0, 3).forEach(l => utils_1.logger.error(`    ${l}`));
-                if (occurrences.length > 3)
-                    utils_1.logger.error(`    ... and ${occurrences.length - 3} more`);
-            }
-            for (const [label, occurrences] of Object.entries(warnings)) {
-                utils_1.logger.warn(`[Diff Security]: ⚠️ ${label}: ${occurrences.length} occurrence(s)`);
-                occurrences.slice(0, 3).forEach(l => utils_1.logger.warn(`    ${l}`));
-                if (occurrences.length > 3)
-                    utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
-            }
-            const parts = [];
-            if (totalErrors > 0)
-                parts.push(`${totalErrors} issue(s)`);
-            if (totalWarnings > 0)
-                parts.push(`${totalWarnings} warning(s)`);
-            return (0, types_1.warn)(parts.join(', '));
+            ]);
+            const { errors, warnings } = scanDiff(stdout);
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Diff Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+            });
         }
         catch (err) {
             utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/diff-smell.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSmellCheck = void 0;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
 const types_1 = require("../types");
+const findings_1 = require("./findings");
 const SMELL_PATTERNS = [
     {
         pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/,
@@ -23,18 +23,7 @@ exports.diffSmellCheck = {
     },
     async run(ctx) {
         try {
-            const { stdout } = await (0, execa_1.execa)('git', [
-                'diff',
-                '--unified=0',
-                '--diff-filter=ACMR',
-                ctx.baseSha,
-                'HEAD',
-                '--',
-                '*.ts',
-                '*.tsx',
-                '*.js',
-                '*.jsx',
-            ], { cwd: ctx.cwd });
+            const stdout = await (0, findings_1.diffAddedLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx']);
             const findings = {};
             for (const line of stdout.split('\n')) {
                 for (const { pattern, label } of SMELL_PATTERNS) {
@@ -43,15 +32,9 @@ exports.diffSmellCheck = {
                     }
                 }
             }
-            const total = Object.values(findings).reduce((sum, arr) => sum + arr.length, 0);
-            if (total === 0)
+            if ((0, findings_1.bucketTotal)(findings) === 0)
                 return (0, types_1.pass)();
-            for (const [label, occurrences] of Object.entries(findings)) {
-                utils_1.logger.warn(`[Diff Smells]: ⚠️ ${label}: ${occurrences.length} occurrence(s)`);
-                occurrences.slice(0, 3).forEach(l => utils_1.logger.warn(`    ${l}`));
-                if (occurrences.length > 3)
-                    utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
-            }
+            (0, findings_1.logFindings)(findings, { prefix: 'Diff Smells', sampleLimit: 3 });
             const summary = Object.entries(findings)
                 .map(([label, arr]) => `${arr.length}× ${label}`)
                 .join(', ');

package/dist/core/checks/duplicate-check.js

@@ -10,6 +10,23 @@ const execa_1 = require("execa");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
 const types_1 = require("../types");
+// jscpd v5 appends promotional/funding lines after its report. Strip them so
+// they never reach the client's terminal when running our package.
+const JSCPD_PROMO_MARKERS = [
+    'Auto-refactor with AI',
+    'github.com/kucherenko/jscpd',
+    'Gangsta Agents',
+    'gangsta.page',
+    'Support jscpd project',
+    'opencollective.com/jscpd',
+];
+function stripJscpdPromo(text) {
+    return text
+        .split('\n')
+        .filter(line => !JSCPD_PROMO_MARKERS.some(marker => line.includes(marker)))
+        .join('\n')
+        .trimEnd();
+}
 exports.duplicateCheck = {
     name: 'Duplicate Code',
     phase: 'informational',
@@ -26,7 +43,7 @@ exports.duplicateCheck = {
             return (0, types_1.skip)('no relevant files changed');
         const srcPath = node_path_1.default.join(ctx.cwd, 'src');
         const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [ctx.cwd]);
-        const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'bin/jscpd');
+        const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'run-jscpd.js');
         try {
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
@@ -38,10 +55,9 @@ exports.duplicateCheck = {
                 'console',
                 '--ignore',
                 'node_modules/**,dist/**,.git/**',
-                '--quiet',
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
-            const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+            const output = stripJscpdPromo([result.stdout, result.stderr].filter(Boolean).join('\n'));
             const clonesMatch = output.match(/(\d+)\s+clone/i);
             const cloneCount = clonesMatch ? parseInt(clonesMatch[1], 10) : 0;
             if (cloneCount > 0) {

package/dist/core/checks/findings.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffAddedLines = diffAddedLines;
+exports.bucketTotal = bucketTotal;
+exports.logFindings = logFindings;
+exports.reportSeverityBuckets = reportSeverityBuckets;
+const execa_1 = require("execa");
+const utils_1 = require("../../utils");
+const types_1 = require("../types");
+/**
+ * Run `git diff` over the given file globs, returning the raw unified diff
+ * (zero context, added/copied/modified/renamed files) for added-line scanning.
+ */
+async function diffAddedLines(ctx, globs) {
+    const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, 'HEAD', '--', ...globs], { cwd: ctx.cwd });
+    return stdout;
+}
+/** Total number of findings across all labels in a bucket. */
+function bucketTotal(bucket) {
+    return Object.values(bucket).reduce((sum, arr) => sum + arr.length, 0);
+}
+/** Log one bucket of findings using the shared check format. */
+function logFindings(bucket, opts) {
+    const emit = opts.isError ? utils_1.logger.error.bind(utils_1.logger) : utils_1.logger.warn.bind(utils_1.logger);
+    const icon = opts.isError ? '❌' : '⚠️';
+    const showCount = opts.showCount ?? true;
+    const { sampleLimit } = opts;
+    for (const [label, items] of Object.entries(bucket)) {
+        emit(`[${opts.prefix}]: ${icon} ${label}${showCount ? `: ${items.length} occurrence(s)` : ':'}`);
+        const shown = sampleLimit === undefined ? items : items.slice(0, sampleLimit);
+        shown.forEach(item => emit(`    ${item}`));
+        if (sampleLimit !== undefined && items.length > sampleLimit) {
+            emit(`    ... and ${items.length - sampleLimit} more`);
+        }
+    }
+}
+/**
+ * Report error/warning finding buckets: log both, then produce the outcome.
+ * Returns pass() when both buckets are empty, otherwise warn() with a summary.
+ */
+function reportSeverityBuckets(errors, warnings, opts) {
+    const totalErrors = bucketTotal(errors);
+    const totalWarnings = bucketTotal(warnings);
+    if (totalErrors === 0 && totalWarnings === 0)
+        return (0, types_1.pass)();
+    const logOpts = { prefix: opts.prefix, showCount: opts.showCount, sampleLimit: opts.sampleLimit };
+    logFindings(errors, { ...logOpts, isError: true });
+    logFindings(warnings, { ...logOpts, isError: false });
+    const parts = [];
+    if (totalErrors > 0)
+        parts.push(opts.errorSummary(totalErrors));
+    if (totalWarnings > 0)
+        parts.push(opts.warningSummary(totalWarnings));
+    return (0, types_1.warn)(parts.join(', '));
+}

package/dist/core/checks/license-check.js

@@ -24,6 +24,11 @@ exports.licenseCheck = {
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);
         const allowLicenses = ctx.config.licenseCheck?.allowLicenses ?? [];
+        // pr-checkmate installs into the consumer's node_modules, so its own runtime
+        // deps (eslint plugins, cspell dictionaries, …) leak into the client's
+        // production tree. Those are our dependencies, not the client's — never fail
+        // a client's PR because of a license we ourselves pulled in.
+        const ownDeps = (0, utils_1.getOwnDependencyClosure)();
         // Resolve the bundled license-checker binary and run it via the current node — never
         // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
         let licenseCheckerBin;
@@ -44,7 +49,8 @@ exports.licenseCheck = {
         }
         const violations = [];
         for (const [pkg, info] of Object.entries(licenses)) {
-            if (allowPackages.has(bareName(pkg)))
+            const name = bareName(pkg);
+            if (allowPackages.has(name) || ownDeps.has(name))
                 continue;
             const raw = info.licenses ?? '';
             const license = Array.isArray(raw) ? raw.join(' OR ') : raw;

package/dist/core/checks/lint.js

@@ -38,7 +38,14 @@ exports.lintCheck = {
             '.eslintrc.json',
             '.eslintrc',
         ]);
-        const args = [...targets, '--ext', '.ts,.tsx,.js,.jsx'];
+        const version = await getESLintMajorVersion(eslintBin);
+        const args = [...targets];
+        // `--ext` is an eslintrc-only flag. Under flat config (ESLint 9+) it is
+        // obsolete — extensions come from the config's `files` glob — and in
+        // ESLint 10 passing it makes explicit files fall back to the default JS
+        // parser, breaking TypeScript linting. Only pass it on the legacy path.
+        if (version < 9)
+            args.push('--ext', '.ts,.tsx,.js,.jsx');
         // Only auto-fix when the caller allows file mutations.
         if (ctx.write)
             args.push('--fix');
@@ -46,7 +53,6 @@ exports.lintCheck = {
             utils_1.logger.info(`[ESLint]: Using local config (checking: ${sourcePath})`);
         }
         else {
-            const version = await getESLintMajorVersion(eslintBin);
             const configFile = version >= 9 ? 'eslint.config.mjs' : '.eslintrc.js';
             args.push('--config', (0, config_1.getPackageConfigPath)(configFile));
             utils_1.logger.info(`[ESLint]: Using pr-checkmate config (ESLint v${version}, ${configFile})`);

package/dist/core/checks/markdown-lint.js

@@ -87,19 +87,17 @@ exports.markdownLintCheck = {
             '.claude/**',
             ...(userConfig.ignores ?? []),
         ];
-        const gitignorePath = node_path_1.default.join(ctx.cwd, '.gitignore');
-        const tmpIgnoreFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.markdownlintignore-${process.pid}`);
-        const gitignoreContent = node_fs_1.default.existsSync(gitignorePath)
-            ? node_fs_1.default.readFileSync(gitignorePath, 'utf-8') + '\n'
-            : '';
-        node_fs_1.default.writeFileSync(tmpIgnoreFile, gitignoreContent + defaultIgnorePatterns.join('\n') + '\n');
-        const args = [
-            ...(ctx.write ? ['--fix'] : []),
-            ...targets,
-            ...configArg,
-            '--ignore-path',
-            tmpIgnoreFile,
-        ];
+        // markdownlint-cli2 has no --ignore-path flag; exclusions are expressed as
+        // negated globs (`#pattern`). A bare directory name also needs `#name/**`
+        // to exclude its contents.
+        const ignoreGlobs = defaultIgnorePatterns.flatMap(pattern => {
+            const clean = pattern.replace(/\/+$/, '');
+            const globs = [`#${clean}`];
+            if (!clean.includes('*'))
+                globs.push(`#${clean}/**`);
+            return globs;
+        });
+        const args = [...(ctx.write ? ['--fix'] : []), ...targets, ...ignoreGlobs, ...configArg];
         try {
             const result = await (0, execa_1.execa)(process.execPath, [markdownlintBin, ...args], {
                 cwd: ctx.cwd,
@@ -111,8 +109,6 @@ exports.markdownLintCheck = {
         finally {
             if (tempConfigFile && node_fs_1.default.existsSync(tempConfigFile))
                 node_fs_1.default.unlinkSync(tempConfigFile);
-            if (node_fs_1.default.existsSync(tmpIgnoreFile))
-                node_fs_1.default.unlinkSync(tmpIgnoreFile);
         }
     },
 };