pr-checkmate 1.23.23 → 2.0.0

package/dist/core/checks/git/diff-smell.js

@@ -1,44 +1,63 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.diffSmellCheck = void 0;
+exports.diffSmellCheck = exports.COMMENT_SMELLS = exports.CODE_SMELLS = void 0;
 const utils_1 = require("../../../utils");
 const types_1 = require("../../types");
 const findings_1 = require("../findings");
-const SMELL_PATTERNS = [
+/**
+ * Smells that are only smells in live code.
+ *
+ * `view: 'code'` blanks string literals before matching, which is what tells a
+ * `debugger` statement apart from the seven places an ESLint config names the
+ * rule that bans it — `'no-debugger': 'error'` was reported as a leftover
+ * `debugger` in every repo that configures the rule, this one included.
+ * Comment stripping (the default) covers the other half: prose *about* a
+ * `debugger` is not one.
+ */
+exports.CODE_SMELLS = [
     {
-        pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/,
+        pattern: /^\+(?!\+).*\bconsole\.(log|error|warn|debug|info)\s*\(/,
         label: 'console.*()',
+        severity: 'warn',
+        view: 'code',
     },
-    { pattern: /^\+(?!\+).*\bdebugger\b/, label: 'debugger statement' },
-    { pattern: /^\+\s*\/\/\s*TODO\b/i, label: 'TODO comment' },
-    { pattern: /^\+\s*\/\/\s*FIXME\b/i, label: 'FIXME comment' },
-    { pattern: /^\+\s*\/\/\s*HACK\b/i, label: 'HACK comment' },
-    { pattern: /^\+\s*\/\/\s*XXX\b/i, label: 'XXX marker' },
+    {
+        pattern: /^\+(?!\+).*\bdebugger\b/,
+        label: 'debugger statement',
+        severity: 'warn',
+        view: 'code',
+    },
+];
+/**
+ * Markers that live *in* comments, so this set is scanned with comment handling
+ * off — stripping comments first would leave these patterns nothing to match.
+ */
+exports.COMMENT_SMELLS = [
+    { pattern: /^\+\s*\/\/\s*TODO\b/i, label: 'TODO comment', severity: 'warn' },
+    { pattern: /^\+\s*\/\/\s*FIXME\b/i, label: 'FIXME comment', severity: 'warn' },
+    { pattern: /^\+\s*\/\/\s*HACK\b/i, label: 'HACK comment', severity: 'warn' },
+    { pattern: /^\+\s*\/\/\s*XXX\b/i, label: 'XXX marker', severity: 'warn' },
 ];
 exports.diffSmellCheck = {
     name: 'Diff Smells',
     phase: 'informational',
+    // No `requiresDiff`: a leftover `debugger` is leftover whether it arrived in
+    // this PR or an earlier one (ticket 067).
     applies(ctx) {
-        return ctx.config.diffSmell?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.diffSmell?.enabled !== false;
     },
     async run(ctx) {
         try {
-            const stdout = await (0, findings_1.diffAddedLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx']);
-            const findings = {};
-            for (const line of stdout.split('\n')) {
-                for (const { pattern, label } of SMELL_PATTERNS) {
-                    if (pattern.test(line)) {
-                        (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 100));
-                    }
-                }
-            }
-            if ((0, findings_1.bucketTotal)(findings) === 0)
+            const { ignorePaths } = ctx.config.diffSmell ?? {};
+            const found = (0, findings_1.emptyBuckets)();
+            await (0, findings_1.reviewLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], stdout => {
+                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.CODE_SMELLS, { ignorePaths }));
+                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.COMMENT_SMELLS, { comments: 'off', ignorePaths }));
+            });
+            // Every smell here is declared `warn`, so nothing reaches the error bucket.
+            if ((0, findings_1.bucketTotal)(found.warnings) === 0)
                 return (0, types_1.pass)();
-            (0, findings_1.logFindings)(findings, { prefix: 'Diff Smells', sampleLimit: 3 });
-            const summary = Object.entries(findings)
-                .map(([label, arr]) => `${arr.length}× ${label}`)
-                .join(', ');
-            return (0, types_1.warn)(summary);
+            return (0, findings_1.reportCountedFindings)(found.warnings, ctx, { prefix: 'Diff Smells' });
         }
         catch (err) {
             utils_1.logger.warn(`[Diff Smells]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/git/large-files.js

@@ -53,8 +53,12 @@ function binaryPaths(numstat) {
 exports.largeFilesCheck = {
     name: 'Large Files',
     phase: 'informational',
+    // No `requiresDiff`: a committed 40 MB binary bloats every clone whether it
+    // landed in this PR or two years ago (ticket 067). `resolveTargetFiles` already
+    // falls back to `git ls-files` with no range, so the file list is right either
+    // way; only the binary-detection diff below needed a second path.
     applies(ctx) {
-        return ctx.config.largeFiles?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.largeFiles?.enabled !== false;
     },
     async run(ctx) {
         // resolveTargetFiles (not the scoped variant): a bloat guard should catch
@@ -69,9 +73,17 @@ exports.largeFilesCheck = {
         const maxKb = ctx.config.largeFiles?.maxSizeKb ?? DEFAULT_MAX_KB;
         const maxBytes = maxKb * 1024;
         const allow = [...LOCKFILE_ALLOW, ...(ctx.config.largeFiles?.allow ?? [])];
+        if (!ctx.baseSha && ctx.config.run?.fullScanBehaviour === 'skip')
+            return (0, types_1.pass)();
         let binary;
         try {
-            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--numstat', '--diff-filter=ACM', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+            // `--numstat` reports `-\t-` for binary files. With no range there is
+            // nothing to diff, so binary detection falls back to reading the bytes —
+            // the size check is what matters here, and it works either way.
+            const args = ctx.baseSha
+                ? ['diff', '--numstat', '--diff-filter=ACM', ctx.baseSha, ctx.headSha ?? 'HEAD']
+                : null;
+            const { stdout } = args ? await (0, execa_1.execa)('git', args, { cwd: ctx.cwd }) : { stdout: '' };
             binary = binaryPaths(stdout);
         }
         catch (err) {

package/dist/core/checks/git/leftover-debug.js

@@ -21,15 +21,29 @@ const KOTLIN_PATTERNS = [
     // negative lookbehind rejects a preceding `.` or identifier char.
     { pattern: /^\+(?!\+).*(?<![.\w])println\s*\(/, label: 'println()' },
 ];
-/** Bucket added-line matches by label, skipping lines opted out via directive. */
-function collect(stdout, patterns, findings) {
+/** `+++ b/path/to/file.py` — the header that says which file follows. */
+const DIFF_FILE_HEADER = /^\+\+\+ b\/(.+)$/;
+/**
+ * Bucket added-line matches by label, skipping lines opted out via directive.
+ *
+ * Comment stripping follows the file each hunk belongs to (ticket 059). It
+ * matters here as much as in Diff Security: `#` is a comment in Python but a
+ * private field in Kotlin/Java-adjacent syntax, and this check scans both.
+ */
+function collect(stdout, patterns, findings, mode = 'language') {
+    let syntax = 'both';
     for (const line of stdout.split('\n')) {
+        const header = DIFF_FILE_HEADER.exec(line);
+        if (header) {
+            syntax = mode === 'language' ? (0, findings_1.commentSyntaxFor)(header[1]) : 'both';
+            continue;
+        }
         // Honour an inline opt-out in any comment style (`// pr-checkmate-ignore`,
         // `# pr-checkmate-ignore`).
         if (line.includes('pr-checkmate-ignore'))
             continue;
         // Match on the comment-stripped line so `# print(x)` in a comment isn't flagged.
-        const scanned = (0, findings_1.stripInlineComment)(line);
+        const scanned = mode === 'off' ? line : (0, findings_1.stripInlineComment)(line, syntax);
         for (const { pattern, label } of patterns) {
             if (pattern.test(scanned)) {
                 (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 100));
@@ -40,34 +54,29 @@ function collect(stdout, patterns, findings) {
 exports.leftoverDebugCheck = {
     name: 'Leftover Debug',
     phase: 'informational',
+    // No `requiresDiff`: a stray `print()` is stray wherever it sits (ticket 067).
     applies(ctx) {
         return (ctx.config.leftoverDebug?.enabled !== false &&
-            Boolean(ctx.baseSha) &&
             (ctx.languages.includes('python') || ctx.languages.includes('kotlin')));
     },
     async run(ctx) {
         try {
             const findings = {};
+            const comments = ctx.config.leftoverDebug?.commentHandling ?? 'language';
             if (ctx.languages.includes('python')) {
-                collect(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), PYTHON_PATTERNS, findings);
+                await (0, findings_1.reviewLines)(ctx, ['*.py'], out => collect(out, PYTHON_PATTERNS, findings, comments));
             }
             if (ctx.languages.includes('kotlin')) {
-                collect(await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']), KOTLIN_PATTERNS, findings);
+                await (0, findings_1.reviewLines)(ctx, ['*.kt', '*.kts', '*.java'], out => collect(out, KOTLIN_PATTERNS, findings, comments));
             }
             if ((0, findings_1.bucketTotal)(findings) === 0)
                 return (0, types_1.pass)();
             // Advisory by default; a repo may promote to a gate via
             // `leftoverDebug.severity: 'error'`.
-            const sev = (0, findings_1.severityEmitter)(ctx.config.leftoverDebug?.severity, 'warn');
-            (0, findings_1.logFindings)(findings, {
+            return (0, findings_1.reportCountedFindings)(findings, ctx, {
                 prefix: 'Leftover Debug',
-                sampleLimit: 3,
-                isError: sev.icon === '❌',
+                severity: ctx.config.leftoverDebug?.severity,
             });
-            const summary = Object.entries(findings)
-                .map(([label, arr]) => `${arr.length}× ${label}`)
-                .join(', ');
-            return sev.emit(summary);
         }
         catch (err) {
             utils_1.logger.warn(`[Leftover Debug]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/git/lockfile-drift.js

@@ -64,8 +64,9 @@ async function packageDepsChanged(ctx, manifestPath, base) {
 exports.lockfileDriftCheck = {
     name: 'Lockfile Drift',
     phase: 'informational',
+    requiresDiff: true,
     applies(ctx) {
-        return ctx.config.lockfileDrift?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.lockfileDrift?.enabled !== false;
     },
     async run(ctx) {
         try {

package/dist/core/checks/git/merge-conflict.js

@@ -70,8 +70,12 @@ function filterHits(hits) {
 exports.mergeConflictCheck = {
     name: 'Merge Conflict',
     phase: 'blocking',
+    // No `requiresDiff`: a committed conflict marker is broken code whether it
+    // arrived in this PR or survived an earlier bad merge (ticket 067). This is
+    // the check most worth running over a whole repository, since a marker that
+    // slipped through once stays there silently.
     applies(ctx) {
-        return ctx.config.mergeConflict?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.mergeConflict?.enabled !== false;
     },
     async run(ctx) {
         // Resolve the scoped file set the canonical way (delta-aware, honouring the
@@ -84,22 +88,29 @@ exports.mergeConflictCheck = {
         if (files.length === 0)
             return (0, types_1.pass)();
         try {
-            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...files], { cwd: ctx.cwd });
-            const hits = filterHits(scanDiff(stdout));
-            if (hits.length === 0)
+            const hits = [];
+            if (ctx.baseSha) {
+                const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...files], { cwd: ctx.cwd });
+                hits.push(...scanDiff(stdout));
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                await (0, findings_1.scanTrackedFiles)(ctx, files, asDiff => hits.push(...scanDiff(asDiff)));
+            }
+            const found = filterHits(hits);
+            if (found.length === 0)
                 return (0, types_1.pass)();
             // Conflict markers are a hard error by default; a repo may downgrade to
             // `warn` via `mergeConflict.severity`.
             const sev = (0, findings_1.severityEmitter)(ctx.config.mergeConflict?.severity, 'error');
-            for (const h of hits) {
+            for (const h of found) {
                 sev.log(`[Merge Conflict]: ${sev.icon} ${h.file}:${h.line}`);
             }
-            const sample = hits
+            const sample = found
                 .slice(0, 5)
                 .map(h => `${h.file}:${h.line}`)
                 .join(', ');
-            const more = hits.length > 5 ? ` (+${hits.length - 5} more)` : '';
-            return sev.emit(`${hits.length} unresolved conflict marker(s): ${sample}${more}`);
+            const more = found.length > 5 ? ` (+${found.length - 5} more)` : '';
+            return sev.emit(` unresolved conflict marker(s): ${sample}${more}`);
         }
         catch (err) {
             utils_1.logger.warn(`[Merge Conflict]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/git/missing-tests.js

@@ -38,8 +38,9 @@ const DEFAULT_IGNORE = [
 exports.missingTestsCheck = {
     name: 'Missing Tests',
     phase: 'informational',
+    requiresDiff: true,
     applies(ctx) {
-        return ctx.config.missingTests?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.missingTests?.enabled !== false;
     },
     async run(ctx) {
         // Scope the same way lint does — a client's `sourcePath` and `ignoreDirs`
@@ -63,10 +64,24 @@ exports.missingTestsCheck = {
                     continue;
                 const [status, ...rest] = line.split('\t');
                 const file = rest.join('\t');
-                if (!file || !scoped.has(file))
+                if (!file)
                     continue;
-                touched.push(file);
-                if (status === 'A')
+                // The two halves are scoped differently on purpose.
+                //
+                // What counts as *new source needing a test* stays inside `sourcePath`,
+                // so generated or out-of-scope directories never raise the question.
+                //
+                // What counts as *evidence a test was written* must not: tests
+                // conventionally live OUTSIDE the source directory — `tests/`,
+                // `__tests__/`, `spec/` at the repository root. Scoping this side too
+                // made the check unsatisfiable in the most ordinary layout there is
+                // (`sourcePath: "src"` with tests in `tests/`): no test change was ever
+                // visible, so the warning fired on every run however many tests were
+                // added with the code. A check that cannot be satisfied teaches people
+                // to ignore it, which costs more than the check is worth.
+                if (isTestFile(file))
+                    touched.push(file);
+                if (status === 'A' && scoped.has(file))
                     added.push(file);
             }
         }
@@ -78,8 +93,9 @@ exports.missingTestsCheck = {
         const addedSource = added.filter(f => SOURCE_EXT.test(f) && !isTestFile(f) && !(0, utils_1.matchesAnyGlob)(f, ignore));
         if (addedSource.length === 0)
             return (0, types_1.pass)(); // no new source that would need a test
-        // A test added OR modified anywhere in scope satisfies the check.
-        if (touched.some(isTestFile))
+        // A test added or modified anywhere in the diff satisfies the check —
+        // `touched` only ever holds test files, collected without the source scope.
+        if (touched.length > 0)
             return (0, types_1.pass)();
         const sev = (0, findings_1.severityEmitter)(ctx.config.missingTests?.severity, 'warn');
         addedSource

package/dist/core/checks/git/todo-fixme.js

@@ -39,9 +39,10 @@ function scan(stdout, pattern, requireTicket, findings) {
 exports.todoFixmeCheck = {
     name: 'TODO/FIXME',
     phase: 'informational',
+    // No `requiresDiff`: an untracked TODO is untracked regardless of its age
+    // (ticket 067). On a legacy codebase this is exactly the inventory question.
     applies(ctx) {
         return (ctx.config.todoFixme?.enabled !== false &&
-            Boolean(ctx.baseSha) &&
             (ctx.languages.includes('python') || ctx.languages.includes('kotlin')));
     },
     async run(ctx) {
@@ -51,20 +52,20 @@ exports.todoFixmeCheck = {
             const requireTicket = cfg?.requireTicket ?? false;
             const findings = {};
             if (ctx.languages.includes('python')) {
-                scan(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), buildPattern('#', keywords), requireTicket, findings);
+                const pattern = buildPattern('#', keywords);
+                await (0, findings_1.reviewLines)(ctx, ['*.py'], out => scan(out, pattern, requireTicket, findings));
             }
             if (ctx.languages.includes('kotlin')) {
                 const ktPattern = buildPattern('//|/\\*', keywords);
-                scan(await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']), ktPattern, requireTicket, findings);
+                await (0, findings_1.reviewLines)(ctx, ['*.kt', '*.kts', '*.java'], out => scan(out, ktPattern, requireTicket, findings));
             }
             if ((0, findings_1.bucketTotal)(findings) === 0)
                 return (0, types_1.pass)();
-            const sev = (0, findings_1.severityEmitter)(cfg?.severity, 'warn');
-            (0, findings_1.logFindings)(findings, { prefix: 'TODO/FIXME', sampleLimit: 3, isError: sev.icon === '❌' });
-            const summary = Object.entries(findings)
-                .map(([label, arr]) => `${arr.length}× ${label}`)
-                .join(', ') + (requireTicket ? ' (no ticket reference)' : '');
-            return sev.emit(summary);
+            return (0, findings_1.reportCountedFindings)(findings, ctx, {
+                prefix: 'TODO/FIXME',
+                severity: cfg?.severity,
+                suffix: requireTicket ? ' (no ticket reference)' : '',
+            });
         }
         catch (err) {
             utils_1.logger.warn(`[TODO/FIXME]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/languages/shellcheck.d.ts

@@ -0,0 +1,8 @@
+import { Check } from '../../types';
+/**
+ * Lints changed shell scripts with ShellCheck. Runner-dependency: needs the
+ * `shellcheck` binary on the runner (like Go Vet/Clippy/RuboCop), gracefully
+ * skipping when it's absent. `-f gcc` gives one line per finding, ending in
+ * an `[SC…]` rule code, which both a human and the count below can read directly.
+ */
+export declare const shellcheckCheck: Check;

package/dist/core/checks/languages/shellcheck.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shellcheckCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const SHELL_GLOBS = ['*.sh', '*.bash', '*.ksh'];
+/**
+ * Lints changed shell scripts with ShellCheck. Runner-dependency: needs the
+ * `shellcheck` binary on the runner (like Go Vet/Clippy/RuboCop), gracefully
+ * skipping when it's absent. `-f gcc` gives one line per finding, ending in
+ * an `[SC…]` rule code, which both a human and the count below can read directly.
+ */
+exports.shellcheckCheck = {
+    name: 'ShellCheck',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.shellcheck?.enabled !== false;
+    },
+    async run(ctx) {
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, SHELL_GLOBS);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_1.pass)('no shell scripts changed');
+        const minSeverity = ctx.config.shellcheck?.minSeverity;
+        const ignore = ctx.config.shellcheck?.ignore ?? [];
+        const args = ['-f', 'gcc'];
+        if (minSeverity)
+            args.push('-S', minSeverity);
+        if (ignore.length > 0)
+            args.push('-e', ignore.join(','));
+        args.push(...targets);
+        const result = await (0, execa_1.execa)('shellcheck', args, { cwd: ctx.cwd, reject: false });
+        // execa v9 with reject:false does NOT throw on a missing binary — it resolves
+        // with `code: 'ENOENT'`. Detect that on the result, not via try/catch.
+        if (result.code === 'ENOENT')
+            return (0, types_1.skip)('shellcheck not installed');
+        if (result.exitCode === 0) {
+            utils_1.logger.info('[ShellCheck]: ✅ No issues found');
+            return (0, types_1.pass)();
+        }
+        const lines = [result.stdout, result.stderr]
+            .filter(Boolean)
+            .join('\n')
+            .split('\n')
+            .filter(Boolean);
+        utils_1.logger.warn(`[ShellCheck]: ⚠️ ${lines.length} issue(s):`);
+        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l}`));
+        if (lines.length > 10)
+            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
+        return (0, types_1.warn)(`${lines.length} issue(s) in ${targets.length} file(s)`);
+    },
+};

package/dist/core/checks/languages/typecheck.js

@@ -24,6 +24,7 @@ function resolveTsc(cwd) {
 exports.typecheckCheck = {
     name: 'TypeScript',
     phase: 'blocking',
+    weight: 'heavy',
     applies(ctx) {
         if (ctx.config.typecheck?.enabled === false)
             return false;

package/dist/core/checks/pr/pr-size-check.js

@@ -9,8 +9,9 @@ const DEFAULT_MAX_LINES = 1000;
 exports.prSizeCheck = {
     name: 'PR Size',
     phase: 'informational',
+    requiresDiff: true,
     applies(ctx) {
-        return ctx.config.prSize?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.prSize?.enabled !== false;
     },
     async run(ctx) {
         const maxFiles = ctx.config.prSize?.maxFiles ?? DEFAULT_MAX_FILES;

package/dist/core/checks/quality/config-validation.d.ts

@@ -1,8 +1,18 @@
 import { Check } from '../../types';
 /**
- * Validates pr-checkmate.json itself: warns on unknown top-level keys (typos
- * like `mergeConfict` that silently do nothing) and on invalid values in the
- * `severity` map. Reads the raw file so it checks what the user actually wrote,
- * not the merged defaults. `//`-comment keys and `$schema` are ignored.
+ * The closest real name to `input`, when one is close enough to be a typo.
+ *
+ * "unknown check" alone leaves someone rereading their config for the missing
+ * character; naming the intended check ends the search. The threshold scales
+ * with length so short names need an exact-ish match and long ones tolerate a
+ * slip or two.
+ */
+export declare function suggestName(input: string, candidates: string[]): string | null;
+/**
+ * Validates pr-checkmate.json itself: unknown top-level keys (typos like
+ * `mergeConfict` that silently do nothing), invalid values in `severity` and
+ * `failOn`, and names in `severity` that match no check. Reads the raw file so it
+ * checks what the user actually wrote, not the merged defaults. `//`-comment keys
+ * and `$schema` are ignored.
  */
 export declare const configValidationCheck: Check;

package/dist/core/checks/quality/config-validation.js

@@ -4,17 +4,113 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configValidationCheck = void 0;
+exports.suggestName = suggestName;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
 const VALID_SEVERITIES = ['error', 'warn', 'off'];
+const VALID_FAIL_ON = ['error', 'warn', 'never'];
+/** Edit distance, capped: we only care whether two names are one or two typos apart. */
+function distance(a, b) {
+    const rows = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+    for (let j = 0; j <= b.length; j++)
+        rows[0][j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1].toLowerCase() === b[j - 1].toLowerCase() ? 0 : 1;
+            rows[i][j] = Math.min(rows[i - 1][j] + 1, rows[i][j - 1] + 1, rows[i - 1][j - 1] + cost);
+        }
+    }
+    return rows[a.length][b.length];
+}
+/**
+ * The closest real name to `input`, when one is close enough to be a typo.
+ *
+ * "unknown check" alone leaves someone rereading their config for the missing
+ * character; naming the intended check ends the search. The threshold scales
+ * with length so short names need an exact-ish match and long ones tolerate a
+ * slip or two.
+ */
+function suggestName(input, candidates) {
+    let best = null;
+    for (const name of candidates) {
+        const d = distance(input, name);
+        if (!best || d < best.d)
+            best = { name, d };
+    }
+    const limit = Math.max(2, Math.floor(input.length / 4));
+    return best && best.d <= limit ? best.name : null;
+}
+/** Describe a bad value without dumping an entire nested object into the report. */
+function shortValue(value) {
+    const text = JSON.stringify(value);
+    return text === undefined ? String(value) : text.slice(0, 40);
+}
 /**
- * Validates pr-checkmate.json itself: warns on unknown top-level keys (typos
- * like `mergeConfict` that silently do nothing) and on invalid values in the
- * `severity` map. Reads the raw file so it checks what the user actually wrote,
- * not the merged defaults. `//`-comment keys and `$schema` are ignored.
+ * Validate the `severity` map: values must be a known level, and — more
+ * importantly — keys must name a check that exists.
+ *
+ * A typo here is the worst kind of silent failure in the whole config. `severity`
+ * is how a client promotes an advisory check to a gate, so `"Diff Securty":
+ * "error"` reads as "this now blocks merges", does nothing at all, and leaves a
+ * green pipeline that looks like proof it worked.
+ *
+ * The misspelling above is the example, so it is muted here rather than added to
+ * the dictionary — a global entry would wave through every real "Securty" typo
+ * in the repo, which is the exact failure this function exists to catch.
+ * cspell:ignore Securty
+ */
+function validateSeverity(json, checkNames) {
+    const issues = [];
+    const sev = json.severity;
+    if (!sev || typeof sev !== 'object')
+        return issues;
+    for (const [name, val] of Object.entries(sev)) {
+        if (!VALID_SEVERITIES.includes(val)) {
+            issues.push(`severity["${name}"] must be error|warn|off (got ${shortValue(val)})`);
+        }
+        if (!checkNames.includes(name)) {
+            const hint = suggestName(name, checkNames);
+            issues.push(`severity["${name}"] names no check${hint ? ` — did you mean "${hint}"?` : ''}` +
+                ' (it has no effect)');
+        }
+    }
+    return issues;
+}
+/** `failOn` and `severityOverrides` are new and easy to mistype; check them too. */
+function validateFailOn(json) {
+    const issues = [];
+    const check = (where, block) => {
+        if (!block || typeof block !== 'object')
+            return;
+        const { failOn, severityOverrides } = block;
+        if (failOn !== undefined && !VALID_FAIL_ON.includes(failOn)) {
+            issues.push(`${where}.failOn must be error|warn|never (got ${shortValue(failOn)})`);
+        }
+        if (severityOverrides && typeof severityOverrides === 'object') {
+            for (const [label, level] of Object.entries(severityOverrides)) {
+                if (!VALID_SEVERITIES.includes(level)) {
+                    issues.push(`${where}.severityOverrides["${label}"] must be error|warn|off (got ${shortValue(level)})`);
+                }
+            }
+        }
+    };
+    check('severityDefaults', json.severityDefaults);
+    for (const key of Object.keys(json)) {
+        if (key.startsWith('//') || key === 'severityDefaults')
+            continue;
+        check(key, json[key]);
+    }
+    return issues;
+}
+/**
+ * Validates pr-checkmate.json itself: unknown top-level keys (typos like
+ * `mergeConfict` that silently do nothing), invalid values in `severity` and
+ * `failOn`, and names in `severity` that match no check. Reads the raw file so it
+ * checks what the user actually wrote, not the merged defaults. `//`-comment keys
+ * and `$schema` are ignored.
  */
 exports.configValidationCheck = {
     name: 'Config Validation',
@@ -23,6 +119,7 @@ exports.configValidationCheck = {
         return ctx.config.configValidation?.enabled !== false;
     },
     async run(ctx) {
+        const cfg = ctx.config.configValidation ?? {};
         const file = node_path_1.default.join(ctx.cwd, 'pr-checkmate.json');
         let raw;
         try {
@@ -40,24 +137,29 @@ exports.configValidationCheck = {
             return (0, types_1.warn)(`pr-checkmate.json is not valid JSON: ${msg}`);
         }
         const issues = [];
+        const allowed = new Set(cfg.allowUnknownKeys ?? []);
+        // Absent only for a hand-built context; then there is nothing to verify names
+        // against, and claiming a name is wrong would be worse than staying quiet.
+        const checkNames = ctx.checkNames ?? [];
         for (const key of Object.keys(json)) {
-            if (key.startsWith('//') || key === '$schema')
+            if (key.startsWith('//') || key === '$schema' || allowed.has(key))
                 continue;
-            if (!config_1.KNOWN_CONFIG_KEYS.has(key))
-                issues.push(`unknown key "${key}"`);
-        }
-        const sev = json.severity;
-        if (sev && typeof sev === 'object') {
-            for (const [name, val] of Object.entries(sev)) {
-                if (!VALID_SEVERITIES.includes(val)) {
-                    issues.push(`severity["${name}"] must be error|warn|off (got ${JSON.stringify(val)})`);
-                }
+            if (!config_1.KNOWN_CONFIG_KEYS.has(key)) {
+                const hint = suggestName(key, [...config_1.KNOWN_CONFIG_KEYS]);
+                issues.push(`unknown key "${key}"${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
         }
+        if (cfg.validateCheckNames !== false && checkNames.length > 0) {
+            issues.push(...validateSeverity(json, checkNames));
+        }
+        issues.push(...validateFailOn(json));
         if (issues.length === 0)
             return (0, types_1.pass)();
-        issues.slice(0, 10).forEach(i => utils_1.logger.warn(`[Config Validation]: ⚠️ ${i}`));
+        // Advisory by default: a config problem is worth knowing about, but a repo
+        // that wants a broken config to stop the build sets `severity: "error"`.
+        const sev = (0, findings_1.severityEmitter)(cfg.severity, 'warn');
+        issues.slice(0, 10).forEach(i => sev.log(`[Config Validation]: ${sev.icon} ${i}`));
         const sample = issues.slice(0, 3).join('; ');
-        return (0, types_1.warn)(`${issues.length} config issue(s): ${sample}${issues.length > 3 ? ' …' : ''}`);
+        return sev.emit(`${issues.length} config issue(s): ${sample}${issues.length > 3 ? ' …' : ''}`);
     },
 };

package/dist/core/checks/quality/dead-code.js

@@ -13,6 +13,7 @@ const types_1 = require("../../types");
 exports.deadCodeCheck = {
     name: 'Dead Code',
     phase: 'informational',
+    weight: 'heavy',
     applies(ctx) {
         if (ctx.config.deadCode?.enabled === false)
             return false;