pr-checkmate 1.22.7 → 1.23.0

package/dist/core/checks/findings.js

@@ -1,19 +1,81 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.severityEmitter = severityEmitter;
 exports.diffAddedLines = diffAddedLines;
+exports.stripInlineComment = stripInlineComment;
 exports.bucketTotal = bucketTotal;
 exports.logFindings = logFindings;
 exports.reportSeverityBuckets = reportSeverityBuckets;
 const utils_1 = require("../../utils");
 const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
+/**
+ * Resolve a check's effective severity (`configured` from config, else its
+ * `fallback`) into a matched logger, icon, and outcome constructor — so a check
+ * logs and returns consistently at whatever level the client chose.
+ */
+function severityEmitter(configured, fallback) {
+    const isError = (configured ?? fallback) === 'error';
+    return {
+        log: (isError ? utils_1.logger.error : utils_1.logger.warn).bind(utils_1.logger),
+        icon: isError ? '❌' : '⚠️',
+        emit: (details) => (isError ? (0, types_1.fail)(details) : (0, types_1.warn)(details)),
+    };
+}
 /**
  * Run `git diff` over the given file globs, returning the raw unified diff
  * (zero context, added/copied/modified/renamed files) for added-line scanning.
  */
 async function diffAddedLines(ctx, globs) {
-    const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, 'HEAD', '--', ...globs], { cwd: ctx.cwd });
-    return stdout;
+    const args = [
+        'diff',
+        '--unified=0',
+        '--diff-filter=ACMR',
+        ctx.baseSha,
+        ctx.headSha ?? 'HEAD',
+        '--',
+        ...globs,
+    ];
+    const cacheKey = `d:${args.join('')}`;
+    let stdout = ctx.cache?.get(cacheKey);
+    if (stdout === undefined) {
+        stdout = (await (0, execa_1.execa)('git', args, { cwd: ctx.cwd })).stdout;
+        ctx.cache?.set(cacheKey, stdout);
+    }
+    // Universal inline suppression: strip added lines opted out with the
+    // `pr-checkmate-ignore` directive, so every content check that scans this
+    // diff honours it without repeating the check itself.
+    return stdout
+        .split('\n')
+        .filter(line => !(line.startsWith('+') && line.includes('pr-checkmate-ignore')))
+        .join('\n');
+}
+/**
+ * Strip a trailing line comment (`//` or `#`) from a line, tracking quote state
+ * so a marker inside a string literal (or a `#` in `"#fff"`, a `//` in a quoted
+ * URL) is preserved. Heuristic, not a tokenizer: block comments and regex
+ * literals aren't handled. Used by code-targeting checks so `# print(x)` or
+ * `// eval(x)` in a comment isn't flagged as real code.
+ */
+function stripInlineComment(line) {
+    let quote = '';
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === quote && line[i - 1] !== '\\')
+                quote = '';
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            continue;
+        }
+        if (c === '#')
+            return line.slice(0, i);
+        if (c === '/' && line[i + 1] === '/')
+            return line.slice(0, i);
+    }
+    return line;
 }
 /** Total number of findings across all labels in a bucket. */
 function bucketTotal(bucket) {
@@ -34,11 +96,26 @@ function logFindings(bucket, opts) {
         }
     }
 }
+/** Remove bucket entries whose label matches any ignore substring. */
+function dropIgnored(bucket, ignore) {
+    if (ignore.length === 0)
+        return bucket;
+    const lowered = ignore.map(i => i.toLowerCase());
+    const kept = {};
+    for (const [label, items] of Object.entries(bucket)) {
+        if (!lowered.some(i => label.toLowerCase().includes(i)))
+            kept[label] = items;
+    }
+    return kept;
+}
 /**
  * Report error/warning finding buckets: log both, then produce the outcome.
  * Returns pass() when both buckets are empty, otherwise warn() with a summary.
  */
-function reportSeverityBuckets(errors, warnings, opts) {
+function reportSeverityBuckets(errorsIn, warningsIn, opts) {
+    const ignore = opts.ignore ?? [];
+    const errors = dropIgnored(errorsIn, ignore);
+    const warnings = dropIgnored(warningsIn, ignore);
     const totalErrors = bucketTotal(errors);
     const totalWarnings = bucketTotal(warnings);
     if (totalErrors === 0 && totalWarnings === 0)

package/dist/core/checks/git/custom-rules.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const customRulesCheck: Check;

package/dist/core/checks/git/custom-rules.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.customRulesCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Compile the user's `customRules` into ready-to-run matchers. A rule with an
+ * invalid regex is skipped with a warning rather than crashing the run. `g`/`y`
+ * flags are stripped because `.test()` on a sticky/global regex is stateful and
+ * would skip matches across lines.
+ */
+function compileRules(ctx) {
+    const rules = ctx.config.customRules ?? [];
+    const compiled = [];
+    for (const r of rules) {
+        if (!r?.name || !r?.pattern)
+            continue;
+        let re;
+        try {
+            re = new RegExp(r.pattern, (r.flags ?? '').replace(/[gy]/g, ''));
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Custom Rules]: ⚠️ invalid regex in rule "${r.name}" — skipped\n${err}`);
+            continue;
+        }
+        compiled.push({
+            message: r.message ?? r.name,
+            re,
+            severity: r.severity === 'error' ? 'error' : 'warn',
+            include: r.include,
+            exclude: r.exclude,
+        });
+    }
+    return compiled;
+}
+const PREFIX = 'Custom Rules';
+/** Parse the diff, bucketing rule matches on added lines by severity. */
+function scanDiff(stdout, rules) {
+    var _a;
+    const errors = {};
+    const warnings = {};
+    let file = '';
+    for (const raw of stdout.split('\n')) {
+        if (raw.startsWith('+++ ')) {
+            const p = raw.slice(4).trim();
+            file = p === '/dev/null' ? '' : p.replace(/^b\//, '');
+            continue;
+        }
+        if (!raw.startsWith('+') || raw.startsWith('+++'))
+            continue;
+        if (raw.includes('pr-checkmate-ignore'))
+            continue;
+        const content = raw.slice(1);
+        for (const rule of rules) {
+            if (rule.include && !(0, utils_1.matchesAnyGlob)(file, rule.include))
+                continue;
+            if (rule.exclude && (0, utils_1.matchesAnyGlob)(file, rule.exclude))
+                continue;
+            if (rule.re.test(content)) {
+                const bucket = rule.severity === 'error' ? errors : warnings;
+                (bucket[_a = rule.message] ?? (bucket[_a] = [])).push(`${file}: ${content.trim().substring(0, 100)}`);
+            }
+        }
+    }
+    return { errors, warnings };
+}
+exports.customRulesCheck = {
+    name: 'Custom Rules',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.customRules?.length ?? 0) > 0 && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        const rules = compileRules(ctx);
+        if (rules.length === 0)
+            return (0, types_1.pass)('no valid custom rules');
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+            const { errors, warnings } = scanDiff(stdout, rules);
+            const totalErrors = (0, findings_1.bucketTotal)(errors);
+            const totalWarnings = (0, findings_1.bucketTotal)(warnings);
+            if (totalErrors === 0 && totalWarnings === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logFindings)(errors, { prefix: PREFIX, isError: true, sampleLimit: 3 });
+            (0, findings_1.logFindings)(warnings, { prefix: PREFIX, sampleLimit: 3 });
+            const parts = [];
+            if (totalErrors > 0)
+                parts.push(`${totalErrors} error(s)`);
+            if (totalWarnings > 0)
+                parts.push(`${totalWarnings} warning(s)`);
+            const summary = parts.join(', ');
+            // A rule with severity "error" blocks the run (fail), regardless of phase.
+            return totalErrors > 0 ? (0, types_1.fail)(summary) : (0, types_1.warn)(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Custom Rules]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{diff-smell.d.ts → git/diff-smell.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const diffSmellCheck: Check;

package/dist/core/checks/{diff-smell.js → git/diff-smell.js}

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSmellCheck = void 0;
-const utils_1 = require("../../utils");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
 const SMELL_PATTERNS = [
     {
         pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/,

package/dist/core/checks/git/large-files.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const largeFilesCheck: Check;

package/dist/core/checks/git/large-files.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.largeFilesCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const DEFAULT_MAX_KB = 500;
+/**
+ * Parse `git diff --numstat` and collect files git reports as binary — those
+ * rows carry `-` in both the additions and deletions columns.
+ */
+function binaryPaths(numstat) {
+    const binary = new Set();
+    for (const line of numstat.split('\n')) {
+        if (!line)
+            continue;
+        const [add, del, ...rest] = line.split('\t');
+        if (add === '-' && del === '-')
+            binary.add(rest.join('\t'));
+    }
+    return binary;
+}
+exports.largeFilesCheck = {
+    name: 'Large Files',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.largeFiles?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        // resolveTargetFiles (not the scoped variant): a bloat guard should catch
+        // large files anywhere in the repo — a root-level asset is exactly the case
+        // a narrowed `sourcePath` would miss — but still skip `ignoreDirs`
+        // (dist/build/vendor), where large generated files are expected.
+        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        if (files.length === 0)
+            return (0, types_1.pass)();
+        const maxKb = ctx.config.largeFiles?.maxSizeKb ?? DEFAULT_MAX_KB;
+        const maxBytes = maxKb * 1024;
+        const allow = ctx.config.largeFiles?.allow ?? [];
+        let binary;
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--numstat', '--diff-filter=ACM', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+            binary = binaryPaths(stdout);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Large Files]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+        const findings = [];
+        for (const file of files) {
+            if (allow.length > 0 && (0, utils_1.matchesAnyGlob)(file, allow))
+                continue;
+            let size;
+            try {
+                size = node_fs_1.default.statSync(node_path_1.default.join(ctx.cwd, file)).size;
+            }
+            catch {
+                continue; // renamed/removed between diff and stat — skip
+            }
+            const reasons = [];
+            if (size > maxBytes)
+                reasons.push(`${Math.round(size / 1024)} KB > ${maxKb} KB`);
+            if (binary.has(file))
+                reasons.push('binary');
+            if (reasons.length > 0)
+                findings.push(`${file} (${reasons.join(', ')})`);
+        }
+        if (findings.length === 0)
+            return (0, types_1.pass)();
+        const sev = (0, findings_1.severityEmitter)(ctx.config.largeFiles?.severity, 'warn');
+        findings.forEach(f => sev.log(`[Large Files]: ${sev.icon} ${f}`));
+        return sev.emit(`${findings.length} large/binary file(s) added`);
+    },
+};

package/dist/core/checks/git/leftover-debug.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const leftoverDebugCheck: Check;

package/dist/core/checks/git/leftover-debug.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.leftoverDebugCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Debug statements for languages NOT already covered by the Diff Smells check
+ * (which handles `console.*`/`debugger` for JS/TS). Kept separate so the two
+ * checks never double-report the same finding in a PR comment.
+ */
+const PYTHON_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bprint\s*\(/, label: 'print()' },
+    { pattern: /^\+(?!\+).*\bpprint\s*\(/, label: 'pprint()' },
+    { pattern: /^\+(?!\+).*\bbreakpoint\s*\(/, label: 'breakpoint()' },
+    { pattern: /^\+(?!\+).*\bpdb\.set_trace\s*\(/, label: 'pdb.set_trace()' },
+];
+const KOTLIN_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bSystem\.(out|err)\.println\s*\(/, label: 'System.out/err.println()' },
+    // Bare println(...), but not the qualified System.out.println above — the
+    // negative lookbehind rejects a preceding `.` or identifier char.
+    { pattern: /^\+(?!\+).*(?<![.\w])println\s*\(/, label: 'println()' },
+];
+/** Bucket added-line matches by label, skipping lines opted out via directive. */
+function collect(stdout, patterns, findings) {
+    for (const line of stdout.split('\n')) {
+        // Honour an inline opt-out in any comment style (`// pr-checkmate-ignore`,
+        // `# pr-checkmate-ignore`).
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        // Match on the comment-stripped line so `# print(x)` in a comment isn't flagged.
+        const scanned = (0, findings_1.stripInlineComment)(line);
+        for (const { pattern, label } of patterns) {
+            if (pattern.test(scanned)) {
+                (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 100));
+            }
+        }
+    }
+}
+exports.leftoverDebugCheck = {
+    name: 'Leftover Debug',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.leftoverDebug?.enabled !== false &&
+            Boolean(ctx.baseSha) &&
+            (ctx.languages.includes('python') || ctx.languages.includes('kotlin')));
+    },
+    async run(ctx) {
+        try {
+            const findings = {};
+            if (ctx.languages.includes('python')) {
+                collect(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), PYTHON_PATTERNS, findings);
+            }
+            if (ctx.languages.includes('kotlin')) {
+                collect(await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']), KOTLIN_PATTERNS, findings);
+            }
+            if ((0, findings_1.bucketTotal)(findings) === 0)
+                return (0, types_1.pass)();
+            // Advisory by default; a repo may promote to a gate via
+            // `leftoverDebug.severity: 'error'`.
+            const sev = (0, findings_1.severityEmitter)(ctx.config.leftoverDebug?.severity, 'warn');
+            (0, findings_1.logFindings)(findings, {
+                prefix: 'Leftover Debug',
+                sampleLimit: 3,
+                isError: sev.icon === '❌',
+            });
+            const summary = Object.entries(findings)
+                .map(([label, arr]) => `${arr.length}× ${label}`)
+                .join(', ');
+            return sev.emit(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Leftover Debug]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/git/lockfile-drift.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const lockfileDriftCheck: Check;

package/dist/core/checks/git/lockfile-drift.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockfileDriftCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Manifest → its lockfile(s). A change to the manifest's dependency set without
+ * a corresponding lockfile update is drift: CI resolves versions the author
+ * never locked. Matched by basename so monorepo sub-packages work too.
+ */
+const LOCK_PAIRS = [
+    { manifest: 'package.json', locks: ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'] },
+    { manifest: 'pyproject.toml', locks: ['poetry.lock', 'uv.lock'] },
+    { manifest: 'requirements.in', locks: ['requirements.txt'] },
+    { manifest: 'go.mod', locks: ['go.sum'] },
+    { manifest: 'Cargo.toml', locks: ['Cargo.lock'] },
+    { manifest: 'Gemfile', locks: ['Gemfile.lock'] },
+];
+const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+/** Extract only the dependency sections of a parsed package.json, or `{}`. */
+function extractDeps(raw) {
+    try {
+        const json = JSON.parse(raw);
+        const deps = {};
+        for (const key of DEP_KEYS)
+            if (json[key])
+                deps[key] = json[key];
+        return deps;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * True when a package.json's dependency sections differ between base and head.
+ * Guards against false positives from `version`/`scripts`-only edits that don't
+ * need a lockfile refresh. A newly added manifest (no base version) counts as
+ * changed. Other ecosystems have no zero-dependency parser here, so they trigger
+ * on any manifest change.
+ */
+async function packageDepsChanged(ctx, manifestPath, base) {
+    let headDeps = {};
+    try {
+        headDeps = extractDeps(node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, manifestPath), 'utf-8'));
+    }
+    catch {
+        // Head file unreadable (e.g. deleted) — treat as changed so it surfaces.
+        return true;
+    }
+    const { stdout, exitCode } = await (0, execa_1.execa)('git', ['show', `${base}:${manifestPath}`], {
+        cwd: ctx.cwd,
+        reject: false,
+    });
+    const baseDeps = exitCode === 0 ? extractDeps(stdout) : {};
+    return JSON.stringify(headDeps) !== JSON.stringify(baseDeps);
+}
+exports.lockfileDriftCheck = {
+    name: 'Lockfile Drift',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.lockfileDrift?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            // Raw name-only diff — manifests/locks live at the repo root, outside any
+            // configured `sourcePath`, so this deliberately does NOT scope (same as
+            // the Sensitive Files guard). Scoping would hide the very files we check.
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--name-only',
+                '--diff-filter=ACMRD',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+            ], { cwd: ctx.cwd });
+            const changed = new Set(stdout.split('\n').filter(Boolean));
+            const warnings = [];
+            for (const changedPath of changed) {
+                const pair = LOCK_PAIRS.find(p => p.manifest === node_path_1.default.basename(changedPath));
+                if (!pair)
+                    continue;
+                // For package.json, only flag when the dependency set actually changed.
+                if (pair.manifest === 'package.json') {
+                    if (!(await packageDepsChanged(ctx, changedPath, ctx.baseSha)))
+                        continue;
+                }
+                const dir = node_path_1.default.dirname(changedPath);
+                const lockPath = (lock) => (dir === '.' ? lock : `${dir}/${lock}`);
+                const presentLocks = pair.locks.filter(lock => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, lockPath(lock))));
+                if (presentLocks.length === 0)
+                    continue; // no lockfile committed → nothing to drift
+                const anyLockChanged = presentLocks.some(lock => changed.has(lockPath(lock)));
+                if (!anyLockChanged) {
+                    warnings.push(`${changedPath} changed but ${presentLocks.join(' / ')} not updated`);
+                }
+            }
+            if (warnings.length === 0)
+                return (0, types_1.pass)();
+            const sev = (0, findings_1.severityEmitter)(ctx.config.lockfileDrift?.severity, 'warn');
+            warnings.forEach(w => sev.log(`[Lockfile Drift]: ${sev.icon} ${w}`));
+            return sev.emit(`${warnings.length} manifest(s) changed without a lockfile update`);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Lockfile Drift]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/git/merge-conflict.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const mergeConflictCheck: Check;

package/dist/core/checks/git/merge-conflict.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeConflictCheck = void 0;
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Git conflict markers, matched against the content of an added diff line
+ * (the leading `+` already stripped). Each is exactly seven characters at the
+ * start of the line, optionally followed by a space + branch/ref label
+ * (`=======` stands alone). `|||||||` is the diff3 base-section marker.
+ */
+const MARKER_START = /^<{7}(?: |$)/;
+const MARKER_BASE = /^\|{7}(?: |$)/;
+const MARKER_SEP = /^={7}$/;
+const MARKER_END = /^>{7}(?: |$)/;
+/** An angle marker (`<<<<<<<` / `>>>>>>>`) is unambiguous on its own. */
+function isAngleMarker(content) {
+    return MARKER_START.test(content) || MARKER_END.test(content);
+}
+/**
+ * Parse a `git diff --unified=0` and return every added line that looks like a
+ * conflict marker, tracking the file and new-file line number for reporting.
+ */
+function scanDiff(diff) {
+    const hits = [];
+    let file = '';
+    let newLine = 0;
+    for (const raw of diff.split('\n')) {
+        if (raw.startsWith('+++ ')) {
+            // `+++ b/path` (or `+++ /dev/null` for deletions). Strip the `b/` prefix.
+            const path = raw.slice(4).trim();
+            file = path === '/dev/null' ? '' : path.replace(/^b\//, '');
+            continue;
+        }
+        if (raw.startsWith('---'))
+            continue; // old-file header, never a content line
+        if (raw.startsWith('@@')) {
+            // @@ -oldStart,oldLen +newStart,newLen @@ — reset the new-file counter.
+            const m = /\+(\d+)/.exec(raw);
+            newLine = m ? Number(m[1]) : 0;
+            continue;
+        }
+        if (raw.startsWith('+')) {
+            const content = raw.slice(1);
+            if (file &&
+                (isAngleMarker(content) || MARKER_BASE.test(content) || MARKER_SEP.test(content))) {
+                hits.push({ file, line: newLine, angle: isAngleMarker(content) });
+            }
+            newLine += 1;
+        }
+        // Removed (`-`) lines don't advance the new-file counter; with --unified=0
+        // there are no context lines to account for.
+    }
+    return hits;
+}
+/**
+ * Keep every angle/base marker, but a bare `=======` only counts when the same
+ * file also carries an angle marker. A standalone `=======` is a legitimate
+ * markdown setext-heading underline; requiring a bracketing `<<<<<<<`/`>>>>>>>`
+ * in the file avoids that false positive while still catching real conflicts.
+ */
+function filterHits(hits) {
+    const filesWithAngle = new Set(hits.filter(h => h.angle).map(h => h.file));
+    return hits.filter(h => h.angle || filesWithAngle.has(h.file));
+}
+exports.mergeConflictCheck = {
+    name: 'Merge Conflict',
+    phase: 'blocking',
+    applies(ctx) {
+        return ctx.config.mergeConflict?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        // Resolve the scoped file set the canonical way (delta-aware, honouring the
+        // client's `ignoreDirs` and `sourcePath`), then diff only those files for
+        // content. `['*']` matches every path since conflicts are language-agnostic;
+        // scoping still keeps build/vendor/report dirs out, like every other check.
+        const files = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        if (files.length === 0)
+            return (0, types_1.pass)();
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...files], { cwd: ctx.cwd });
+            const hits = filterHits(scanDiff(stdout));
+            if (hits.length === 0)
+                return (0, types_1.pass)();
+            // Conflict markers are a hard error by default; a repo may downgrade to
+            // `warn` via `mergeConflict.severity`.
+            const sev = (0, findings_1.severityEmitter)(ctx.config.mergeConflict?.severity, 'error');
+            for (const h of hits) {
+                sev.log(`[Merge Conflict]: ${sev.icon} ${h.file}:${h.line}`);
+            }
+            const sample = hits
+                .slice(0, 5)
+                .map(h => `${h.file}:${h.line}`)
+                .join(', ');
+            const more = hits.length > 5 ? ` (+${hits.length - 5} more)` : '';
+            return sev.emit(`${hits.length} unresolved conflict marker(s): ${sample}${more}`);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Merge Conflict]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/git/missing-tests.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const missingTestsCheck: Check;