pr-checkmate 1.22.8 → 1.23.1

package/dist/config/constants.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
+exports.KNOWN_CONFIG_KEYS = exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
 const node_path_1 = __importDefault(require("node:path"));
 /**
  * Build output, dependency, tooling, and report directories that are never
@@ -214,3 +214,70 @@ exports.documentation = {
     cspell: 'https://cspell.org/configuration/',
 };
 exports.CONFIG_FILE = node_path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
+/**
+ * Every top-level key PR CheckMate recognises in pr-checkmate.json — the union
+ * of the `PRCheckMateConfig` interface fields and the keys the `init` generator
+ * writes (which use `eslint`/`cspell`/`markdownlint` rather than the interface's
+ * `lint`/`spellcheck`). The Config Validation check warns on any key not in this
+ * set (typos), ignoring `//`-prefixed comment keys and `$schema`. Keep in sync
+ * when adding a new configurable check.
+ */
+exports.KNOWN_CONFIG_KEYS = new Set([
+    // core
+    'sourcePath',
+    'ignoreDirs',
+    'languages',
+    'severity',
+    'customRules',
+    '$schema',
+    'commands',
+    'documentation',
+    'configValidation',
+    // linters/formatters (interface + init aliases)
+    'lint',
+    'eslint',
+    'prettier',
+    'spellcheck',
+    'cspell',
+    'markdownlint',
+    'typecheck',
+    // security
+    'security',
+    'diffSecurity',
+    'workflowSecurity',
+    'dockerfileSecurity',
+    'sensitiveFileGuard',
+    'migrationSafety',
+    // dependencies
+    'dependency',
+    'outdatedDeps',
+    'licenseCheck',
+    'vulnScan',
+    'bannedImports',
+    // git-diff / PR
+    'mergeConflict',
+    'diffSmell',
+    'leftoverDebug',
+    'todoFixme',
+    'lockfileDrift',
+    'largeFiles',
+    'missingTests',
+    'coverage',
+    'caseCollision',
+    'licenseHeader',
+    'duplicate',
+    'deadCode',
+    'prBody',
+    'prSize',
+    'commitlint',
+    // languages
+    'cpp',
+    'python',
+    'swift',
+    'kotlin',
+    'go',
+    'rust',
+    'csharp',
+    'ruby',
+    'php',
+]);

package/dist/core/checks/dependencies/banned-imports.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const bannedImportsCheck: Check;

package/dist/core/checks/dependencies/banned-imports.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bannedImportsCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const PREFIX = 'Banned Imports';
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * Compile `bannedImports` into matchers that catch a banned package via an ES
+ * import, a CommonJS require, or its addition to a manifest dependency list.
+ */
+function compileBans(ctx) {
+    const list = ctx.config.bannedImports ?? [];
+    return list
+        .filter(b => b?.name)
+        .map(b => {
+        const n = escapeRe(b.name);
+        const re = new RegExp(`from\\s+['"]${n}(?:/[^'"]*)?['"]|require\\(\\s*['"]${n}(?:/[^'"]*)?['"]|import\\s+['"]${n}['"]|["']${n}["']\\s*:`);
+        return {
+            message: b.message ?? `banned dependency: ${b.name}`,
+            re,
+            severity: b.severity === 'error' ? 'error' : 'warn',
+        };
+    });
+}
+exports.bannedImportsCheck = {
+    name: 'Banned Imports',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.bannedImports?.length ?? 0) > 0 && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        var _a;
+        const bans = compileBans(ctx);
+        if (bans.length === 0)
+            return (0, types_1.pass)('no banned imports configured');
+        try {
+            const stdout = await (0, findings_1.diffAddedLines)(ctx, ['*']);
+            const errors = {};
+            const warnings = {};
+            for (const raw of stdout.split('\n')) {
+                if (!raw.startsWith('+') || raw.startsWith('+++'))
+                    continue;
+                const content = raw.slice(1);
+                for (const ban of bans) {
+                    if (ban.re.test(content)) {
+                        const bucket = ban.severity === 'error' ? errors : warnings;
+                        (bucket[_a = ban.message] ?? (bucket[_a] = [])).push(content.trim().substring(0, 100));
+                    }
+                }
+            }
+            const totalErrors = (0, findings_1.bucketTotal)(errors);
+            const totalWarnings = (0, findings_1.bucketTotal)(warnings);
+            if (totalErrors === 0 && totalWarnings === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logFindings)(errors, { prefix: PREFIX, isError: true, sampleLimit: 3 });
+            (0, findings_1.logFindings)(warnings, { prefix: PREFIX, sampleLimit: 3 });
+            const parts = [];
+            if (totalErrors > 0)
+                parts.push(`${totalErrors} banned (error)`);
+            if (totalWarnings > 0)
+                parts.push(`${totalWarnings} banned (warn)`);
+            return totalErrors > 0 ? (0, types_1.fail)(parts.join(', ')) : (0, types_1.warn)(parts.join(', '));
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Banned Imports]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{circular-deps.d.ts → dependencies/circular-deps.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const circularDepsCheck: Check;

package/dist/core/checks/{circular-deps.js → dependencies/circular-deps.js}

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.circularDepsCheck = void 0;
-const config_1 = require("../../config");
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const targets_1 = require("../targets");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
 exports.circularDepsCheck = {
     name: 'Circular Deps',
     phase: 'blocking',

package/dist/core/checks/{dependency-check.d.ts → dependencies/dependency-check.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const dependencyCheck: Check;

package/dist/core/checks/{dependency-check.js → dependencies/dependency-check.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.dependencyCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',

package/dist/core/checks/{license-check.d.ts → dependencies/license-check.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const licenseCheck: Check;

package/dist/core/checks/{license-check.js → dependencies/license-check.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 const FORBIDDEN_LICENSES = ['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0'];
 /** Strip the trailing "@version" to get the bare package name (scoped-safe). */
 function bareName(pkgKey) {

package/dist/core/checks/{npm-audit.d.ts → dependencies/npm-audit.d.ts}

@@ -1,4 +1,4 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 /**
  * npm audit — only direct-dependency vulnerabilities block. Transitive ones and
  * vulnerabilities in pr-checkmate itself are ignored (the client cannot fix those).

package/dist/core/checks/{npm-audit.js → dependencies/npm-audit.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.npmAuditCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 function isSeverityAtLeast(severity, level) {
     const sevIdx = SEVERITY_ORDER.indexOf(severity);

package/dist/core/checks/{outdated-deps.d.ts → dependencies/outdated-deps.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const outdatedDepsCheck: Check;

package/dist/core/checks/{outdated-deps.js → dependencies/outdated-deps.js}

@@ -6,9 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.outdatedDepsCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const DEFAULT_TIMEOUT_MS = 30000;
 exports.outdatedDepsCheck = {
     name: 'Outdated Deps',
     phase: 'informational',
@@ -18,8 +19,20 @@ exports.outdatedDepsCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
+        // `npm outdated` queries the registry for every dependency and can take a
+        // long time on big dependency trees — cap it so an advisory check never
+        // holds up CI. On timeout, skip rather than fail.
+        const timeout = ctx.config.outdatedDeps?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         // npm outdated exits 1 when outdated packages exist — use reject:false.
-        const result = await (0, execa_1.execa)('npm', ['outdated', '--json'], { cwd: ctx.cwd, reject: false });
+        const result = await (0, execa_1.execa)('npm', ['outdated', '--json'], {
+            cwd: ctx.cwd,
+            reject: false,
+            timeout,
+        });
+        if (result.timedOut) {
+            utils_1.logger.warn(`[Outdated Deps]: ⚠️ npm outdated timed out after ${timeout}ms — skipping`);
+            return (0, types_1.skip)('npm outdated timed out');
+        }
         if (!result.stdout?.trim())
             return (0, types_1.pass)();
         let outdated;

package/dist/core/checks/dependencies/vuln-scan.d.ts

@@ -0,0 +1,9 @@
+import { Check } from '../../types';
+/**
+ * Cross-language dependency vulnerability scan via osv-scanner, which reads
+ * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
+ * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
+ * must be on the runner, and the check skips gracefully when it is absent.
+ * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
+ */
+export declare const vulnScanCheck: Check;

package/dist/core/checks/dependencies/vuln-scan.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vulnScanCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+/**
+ * Cross-language dependency vulnerability scan via osv-scanner, which reads
+ * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
+ * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
+ * must be on the runner, and the check skips gracefully when it is absent.
+ * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
+ */
+exports.vulnScanCheck = {
+    name: 'Vuln Scan',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.vulnScan?.enabled === true;
+    },
+    async run(ctx) {
+        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], { cwd: ctx.cwd, reject: false });
+        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
+        // when the binary is absent — detect the missing scanner on the result.
+        if (result.code === 'ENOENT')
+            return (0, types_1.skip)('osv-scanner not installed');
+        if (result.exitCode === 0) {
+            utils_1.logger.info('[Vuln Scan]: ✅ No known vulnerabilities');
+            return (0, types_1.pass)();
+        }
+        const lines = [result.stdout, result.stderr]
+            .filter(Boolean)
+            .join('\n')
+            .split('\n')
+            .filter(l => /\b(CVE-|GHSA-|vulnerab|advisor)/i.test(l));
+        utils_1.logger.warn('[Vuln Scan]: ⚠️ known vulnerabilities found:');
+        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l.trim()}`));
+        if (lines.length > 10)
+            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
+        return (0, types_1.warn)(`${lines.length || 'unknown'} vulnerability finding(s) (osv-scanner)`);
+    },
+};

package/dist/core/checks/findings.d.ts

@@ -1,4 +1,26 @@
 import { CheckContext, CheckOutcome } from '../types';
+/**
+ * Client-configurable severity for a check's findings, read from that check's
+ * config block (e.g. `mergeConflict.severity`). `error` fails the run, `warn`
+ * only advises. Every check declares a natural default; the client overrides it
+ * per repo in pr-checkmate.json — promoting an advisory check to a gate, or
+ * downgrading a blocking one, with no code change.
+ */
+export type Severity = 'error' | 'warn';
+export interface SeverityEmitter {
+    /** Log at the resolved level (`logger.error` for error, `logger.warn` for warn). */
+    log: (msg: string) => void;
+    /** Prefix icon matching the level. */
+    icon: string;
+    /** Build the outcome at the resolved level (`fail` for error, `warn` for warn). */
+    emit: (details: string) => CheckOutcome;
+}
+/**
+ * Resolve a check's effective severity (`configured` from config, else its
+ * `fallback`) into a matched logger, icon, and outcome constructor — so a check
+ * logs and returns consistently at whatever level the client chose.
+ */
+export declare function severityEmitter(configured: Severity | undefined, fallback: Severity): SeverityEmitter;
 /** Findings grouped by label → matching sample strings. */
 export type FindingBucket = Record<string, string[]>;
 /**
@@ -6,6 +28,14 @@ export type FindingBucket = Record<string, string[]>;
  * (zero context, added/copied/modified/renamed files) for added-line scanning.
  */
 export declare function diffAddedLines(ctx: CheckContext, globs: string[]): Promise<string>;
+/**
+ * Strip a trailing line comment (`//` or `#`) from a line, tracking quote state
+ * so a marker inside a string literal (or a `#` in `"#fff"`, a `//` in a quoted
+ * URL) is preserved. Heuristic, not a tokenizer: block comments and regex
+ * literals aren't handled. Used by code-targeting checks so `# print(x)` or
+ * `// eval(x)` in a comment isn't flagged as real code.
+ */
+export declare function stripInlineComment(line: string): string;
 /** Total number of findings across all labels in a bucket. */
 export declare function bucketTotal(bucket: FindingBucket): number;
 interface LogOptions {
@@ -31,10 +61,16 @@ interface SeverityReportOptions {
     showCount?: boolean;
     /** Max samples printed per label; omit to print all. */
     sampleLimit?: number;
+    /**
+     * Finding labels to suppress (client `<check>.ignore`). A label is dropped
+     * when it contains any ignore entry (case-insensitive), so a repo can mute a
+     * single built-in finding without disabling the whole check.
+     */
+    ignore?: string[];
 }
 /**
  * Report error/warning finding buckets: log both, then produce the outcome.
  * Returns pass() when both buckets are empty, otherwise warn() with a summary.
  */
-export declare function reportSeverityBuckets(errors: FindingBucket, warnings: FindingBucket, opts: SeverityReportOptions): CheckOutcome;
+export declare function reportSeverityBuckets(errorsIn: FindingBucket, warningsIn: FindingBucket, opts: SeverityReportOptions): CheckOutcome;
 export {};

package/dist/core/checks/findings.js

@@ -1,19 +1,81 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.severityEmitter = severityEmitter;
 exports.diffAddedLines = diffAddedLines;
+exports.stripInlineComment = stripInlineComment;
 exports.bucketTotal = bucketTotal;
 exports.logFindings = logFindings;
 exports.reportSeverityBuckets = reportSeverityBuckets;
 const utils_1 = require("../../utils");
 const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
+/**
+ * Resolve a check's effective severity (`configured` from config, else its
+ * `fallback`) into a matched logger, icon, and outcome constructor — so a check
+ * logs and returns consistently at whatever level the client chose.
+ */
+function severityEmitter(configured, fallback) {
+    const isError = (configured ?? fallback) === 'error';
+    return {
+        log: (isError ? utils_1.logger.error : utils_1.logger.warn).bind(utils_1.logger),
+        icon: isError ? '❌' : '⚠️',
+        emit: (details) => (isError ? (0, types_1.fail)(details) : (0, types_1.warn)(details)),
+    };
+}
 /**
  * Run `git diff` over the given file globs, returning the raw unified diff
  * (zero context, added/copied/modified/renamed files) for added-line scanning.
  */
 async function diffAddedLines(ctx, globs) {
-    const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, 'HEAD', '--', ...globs], { cwd: ctx.cwd });
-    return stdout;
+    const args = [
+        'diff',
+        '--unified=0',
+        '--diff-filter=ACMR',
+        ctx.baseSha,
+        ctx.headSha ?? 'HEAD',
+        '--',
+        ...globs,
+    ];
+    const cacheKey = `d:${args.join('')}`;
+    let stdout = ctx.cache?.get(cacheKey);
+    if (stdout === undefined) {
+        stdout = (await (0, execa_1.execa)('git', args, { cwd: ctx.cwd })).stdout;
+        ctx.cache?.set(cacheKey, stdout);
+    }
+    // Universal inline suppression: strip added lines opted out with the
+    // `pr-checkmate-ignore` directive, so every content check that scans this
+    // diff honours it without repeating the check itself.
+    return stdout
+        .split('\n')
+        .filter(line => !(line.startsWith('+') && line.includes('pr-checkmate-ignore')))
+        .join('\n');
+}
+/**
+ * Strip a trailing line comment (`//` or `#`) from a line, tracking quote state
+ * so a marker inside a string literal (or a `#` in `"#fff"`, a `//` in a quoted
+ * URL) is preserved. Heuristic, not a tokenizer: block comments and regex
+ * literals aren't handled. Used by code-targeting checks so `# print(x)` or
+ * `// eval(x)` in a comment isn't flagged as real code.
+ */
+function stripInlineComment(line) {
+    let quote = '';
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === quote && line[i - 1] !== '\\')
+                quote = '';
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            continue;
+        }
+        if (c === '#')
+            return line.slice(0, i);
+        if (c === '/' && line[i + 1] === '/')
+            return line.slice(0, i);
+    }
+    return line;
 }
 /** Total number of findings across all labels in a bucket. */
 function bucketTotal(bucket) {
@@ -34,11 +96,26 @@ function logFindings(bucket, opts) {
         }
     }
 }
+/** Remove bucket entries whose label matches any ignore substring. */
+function dropIgnored(bucket, ignore) {
+    if (ignore.length === 0)
+        return bucket;
+    const lowered = ignore.map(i => i.toLowerCase());
+    const kept = {};
+    for (const [label, items] of Object.entries(bucket)) {
+        if (!lowered.some(i => label.toLowerCase().includes(i)))
+            kept[label] = items;
+    }
+    return kept;
+}
 /**
  * Report error/warning finding buckets: log both, then produce the outcome.
  * Returns pass() when both buckets are empty, otherwise warn() with a summary.
  */
-function reportSeverityBuckets(errors, warnings, opts) {
+function reportSeverityBuckets(errorsIn, warningsIn, opts) {
+    const ignore = opts.ignore ?? [];
+    const errors = dropIgnored(errorsIn, ignore);
+    const warnings = dropIgnored(warningsIn, ignore);
     const totalErrors = bucketTotal(errors);
     const totalWarnings = bucketTotal(warnings);
     if (totalErrors === 0 && totalWarnings === 0)

package/dist/core/checks/git/custom-rules.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const customRulesCheck: Check;

package/dist/core/checks/git/custom-rules.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.customRulesCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Compile the user's `customRules` into ready-to-run matchers. A rule with an
+ * invalid regex is skipped with a warning rather than crashing the run. `g`/`y`
+ * flags are stripped because `.test()` on a sticky/global regex is stateful and
+ * would skip matches across lines.
+ */
+function compileRules(ctx) {
+    const rules = ctx.config.customRules ?? [];
+    const compiled = [];
+    for (const r of rules) {
+        if (!r?.name || !r?.pattern)
+            continue;
+        let re;
+        try {
+            re = new RegExp(r.pattern, (r.flags ?? '').replace(/[gy]/g, ''));
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Custom Rules]: ⚠️ invalid regex in rule "${r.name}" — skipped\n${err}`);
+            continue;
+        }
+        compiled.push({
+            message: r.message ?? r.name,
+            re,
+            severity: r.severity === 'error' ? 'error' : 'warn',
+            include: r.include,
+            exclude: r.exclude,
+        });
+    }
+    return compiled;
+}
+const PREFIX = 'Custom Rules';
+/** Parse the diff, bucketing rule matches on added lines by severity. */
+function scanDiff(stdout, rules) {
+    var _a;
+    const errors = {};
+    const warnings = {};
+    let file = '';
+    for (const raw of stdout.split('\n')) {
+        if (raw.startsWith('+++ ')) {
+            const p = raw.slice(4).trim();
+            file = p === '/dev/null' ? '' : p.replace(/^b\//, '');
+            continue;
+        }
+        if (!raw.startsWith('+') || raw.startsWith('+++'))
+            continue;
+        if (raw.includes('pr-checkmate-ignore'))
+            continue;
+        const content = raw.slice(1);
+        for (const rule of rules) {
+            if (rule.include && !(0, utils_1.matchesAnyGlob)(file, rule.include))
+                continue;
+            if (rule.exclude && (0, utils_1.matchesAnyGlob)(file, rule.exclude))
+                continue;
+            if (rule.re.test(content)) {
+                const bucket = rule.severity === 'error' ? errors : warnings;
+                (bucket[_a = rule.message] ?? (bucket[_a] = [])).push(`${file}: ${content.trim().substring(0, 100)}`);
+            }
+        }
+    }
+    return { errors, warnings };
+}
+exports.customRulesCheck = {
+    name: 'Custom Rules',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.customRules?.length ?? 0) > 0 && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        const rules = compileRules(ctx);
+        if (rules.length === 0)
+            return (0, types_1.pass)('no valid custom rules');
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+            const { errors, warnings } = scanDiff(stdout, rules);
+            const totalErrors = (0, findings_1.bucketTotal)(errors);
+            const totalWarnings = (0, findings_1.bucketTotal)(warnings);
+            if (totalErrors === 0 && totalWarnings === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logFindings)(errors, { prefix: PREFIX, isError: true, sampleLimit: 3 });
+            (0, findings_1.logFindings)(warnings, { prefix: PREFIX, sampleLimit: 3 });
+            const parts = [];
+            if (totalErrors > 0)
+                parts.push(`${totalErrors} error(s)`);
+            if (totalWarnings > 0)
+                parts.push(`${totalWarnings} warning(s)`);
+            const summary = parts.join(', ');
+            // A rule with severity "error" blocks the run (fail), regardless of phase.
+            return totalErrors > 0 ? (0, types_1.fail)(summary) : (0, types_1.warn)(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Custom Rules]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{diff-smell.d.ts → git/diff-smell.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const diffSmellCheck: Check;

package/dist/core/checks/{diff-smell.js → git/diff-smell.js}

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSmellCheck = void 0;
-const utils_1 = require("../../utils");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
 const SMELL_PATTERNS = [
     {
         pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/,

package/dist/core/checks/git/large-files.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const largeFilesCheck: Check;