pr-checkmate 1.23.24 → 2.1.0

package/dist/core/checks/findings.js

@@ -1,13 +1,27 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.severityEmitter = severityEmitter;
+exports.mergeSeverityBuckets = mergeSeverityBuckets;
+exports.emptyBuckets = emptyBuckets;
 exports.diffAddedLines = diffAddedLines;
+exports.scanTrackedFiles = scanTrackedFiles;
+exports.reviewLines = reviewLines;
+exports.commentSyntaxFor = commentSyntaxFor;
 exports.stripInlineComment = stripInlineComment;
+exports.stripStringLiterals = stripStringLiterals;
+exports.scanDiffPatterns = scanDiffPatterns;
 exports.bucketTotal = bucketTotal;
-exports.logFindings = logFindings;
+exports.reportCountedFindings = reportCountedFindings;
+exports.clientFindingOptions = clientFindingOptions;
 exports.reportSeverityBuckets = reportSeverityBuckets;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../utils");
 const execa_1 = require("../../utils/execa");
+const targets_1 = require("../targets");
 const types_1 = require("../types");
 /**
  * Resolve a check's effective severity (`configured` from config, else its
@@ -22,6 +36,31 @@ function severityEmitter(configured, fallback) {
         emit: (details) => (isError ? (0, types_1.fail)(details) : (0, types_1.warn)(details)),
     };
 }
+/** Append `from`'s samples to `into`, merging labels both sides produced. */
+function mergeBucket(into, from) {
+    for (const [label, items] of Object.entries(from))
+        (into[label] ?? (into[label] = [])).push(...items);
+}
+/**
+ * Fold one scan's findings into a check's running totals.
+ *
+ * Checks accumulate across several scans — one per language, or one per file on
+ * the full-scan path — so every accumulating check needs this, and each had the
+ * same pair of nested loops written out inline.
+ */
+function mergeSeverityBuckets(into, from) {
+    mergeBucket(into.errors, from.errors);
+    mergeBucket(into.warnings, from.warnings);
+}
+/** A fresh pair of empty buckets for a check to accumulate into. */
+function emptyBuckets() {
+    return { errors: {}, warnings: {} };
+}
+/**
+ * Inline opt-out honoured by every content check, on both the diff path and the
+ * whole-file path — a line muted in a PR must stay muted in a full scan.
+ */
+const IGNORE_DIRECTIVE = 'pr-checkmate-ignore';
 /**
  * Run `git diff` over the given file globs, returning the raw unified diff
  * (zero context, added/copied/modified/renamed files) for added-line scanning.
@@ -47,41 +86,398 @@ async function diffAddedLines(ctx, globs) {
     // diff honours it without repeating the check itself.
     return stdout
         .split('\n')
-        .filter(line => !(line.startsWith('+') && line.includes('pr-checkmate-ignore')))
+        .filter(line => !(line.startsWith('+') && line.includes(IGNORE_DIRECTIVE)))
         .join('\n');
 }
 /**
- * Strip a trailing line comment (`//` or `#`) from a line, tracking quote state
- * so a marker inside a string literal (or a `#` in `"#fff"`, a `//` in a quoted
- * URL) is preserved. Heuristic, not a tokenizer: block comments and regex
- * literals aren't handled. Used by code-targeting checks so `# print(x)` or
- * `// eval(x)` in a comment isn't flagged as real code.
+ * Present tracked files as if every line had just been added, so a check written
+ * for a diff can review the whole repository unchanged.
+ *
+ * The patterns are anchored on the diff's `+` marker (`/^\+(?!\+)…/`), which is
+ * why `--full` used to skip most of the security surface: no diff, no lines
+ * starting with `+`, no findings. Rather than rewrite forty patterns — and lose
+ * the guarantee that both modes agree — the file contents are wrapped in the
+ * shape the pipeline already understands. Comment stripping, string blanking,
+ * `view: 'code'`, grouping and every client knob then work identically.
+ *
+ * Files are read one at a time and handed to `onFile` rather than concatenated:
+ * a monorepo would otherwise be assembled into a single multi-megabyte string
+ * before the first pattern ran.
+ */
+async function scanTrackedFiles(ctx, files, onFile) {
+    for (const file of files) {
+        let content;
+        try {
+            content = node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, file), 'utf-8');
+        }
+        catch {
+            // Unreadable or vanished between listing and reading — nothing to review.
+            continue;
+        }
+        // Binary files have no lines worth matching and would produce nonsense
+        // samples in the report.
+        if (content.includes('\0'))
+            continue;
+        // The `pr-checkmate-ignore` opt-out has to be honoured here too. It is applied
+        // in `diffAddedLines` for the delta path, and a line muted in a PR that then
+        // reappears in the full scan would make the directive look unreliable.
+        const lines = content
+            .split('\n')
+            .filter(line => !line.includes(IGNORE_DIRECTIVE))
+            .map(line => `+${line}`);
+        // The `+++` header tells `scanDiffPatterns` which comment syntax applies;
+        // the `@@` hunk header is what makes line numbers come out 1-based for the
+        // checks that report them (Merge Conflict). Without it they start at zero.
+        onFile([`+++ b/${file}`, `@@ -0,0 +1,${lines.length} @@`, ...lines].join('\n'));
+    }
+}
+/**
+ * Hand a check the lines it should review, from the diff when there is one and
+ * from the tracked files otherwise.
+ *
+ * The single entry point every content check uses, so the choice between the two
+ * modes is made once rather than re-implemented per check — and so a check cannot
+ * accidentally support only one of them, which is how `--full` ended up with no
+ * security coverage at all (ticket 067).
+ *
+ * `onChunk` is called once per diff in delta mode and once per file in full mode,
+ * which keeps a whole monorepo from being concatenated before matching starts.
+ */
+async function reviewLines(ctx, globs, onChunk) {
+    if (ctx.baseSha) {
+        onChunk(await diffAddedLines(ctx, globs));
+        return;
+    }
+    if (ctx.config.run?.fullScanBehaviour === 'skip')
+        return;
+    const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.']);
+    await scanTrackedFiles(ctx, files, onChunk);
+}
+const C_LIKE_EXTENSIONS = new Set([
+    'ts',
+    'tsx',
+    'js',
+    'jsx',
+    'mjs',
+    'cjs',
+    'go',
+    'java',
+    'kt',
+    'kts',
+    'cs',
+    'c',
+    'cc',
+    'cpp',
+    'cxx',
+    'h',
+    'hpp',
+    'php',
+    'rs',
+    'swift',
+    'scala',
+    'm',
+    'mm',
+]);
+const HASH_EXTENSIONS = new Set([
+    'py',
+    'pyi',
+    'sh',
+    'bash',
+    'zsh',
+    'ksh',
+    'yml',
+    'yaml',
+    'rb',
+    'toml',
+    'tf',
+    'pl',
+    'r',
+]);
+/** Comment syntax for a repo-relative path; `both` when the extension is unknown. */
+function commentSyntaxFor(file) {
+    const ext = file.slice(file.lastIndexOf('.') + 1).toLowerCase();
+    if (C_LIKE_EXTENSIONS.has(ext))
+        return 'c-like';
+    if (HASH_EXTENSIONS.has(ext))
+        return 'hash';
+    return 'both';
+}
+/**
+ * True when the `//` at `i` opens a comment rather than a regex literal.
+ *
+ * A regex literal can contain `//` (`line.replace(/\/\//g, '')`), and treating
+ * it as a comment truncates the line — dropping whatever a security pattern
+ * would have matched further along. Regex literals only appear where a value is
+ * expected, so the preceding non-space character is enough to tell them apart
+ * without tokenizing.
+ */
+function isCommentSlash(line, i) {
+    const before = line.slice(0, i).trimEnd();
+    if (before.length === 0)
+        return true;
+    // These all precede a value, so a `/` after one opens a regex literal.
+    // `;` and `}` are deliberately absent: they close a statement, where a
+    // trailing `// comment` is overwhelmingly the more likely reading.
+    if (/[(,=:[!&|?]$/.test(before))
+        return false;
+    return !/\breturn$/.test(before);
+}
+/** Returned by a {@link walkStringState} visitor to end the walk early. */
+const STOP = Symbol('stop');
+/**
+ * Walk `line` once, reporting for each character whether it sits inside a string
+ * literal.
+ *
+ * The bookkeeping — which quote opened the literal, and that a backslash escapes
+ * the closing one — is the part {@link stripInlineComment} and
+ * {@link stripStringLiterals} genuinely have in common; only what each does with
+ * the answer differs. Kept in one place so a correction to the escape handling
+ * cannot land in one of them and be forgotten in the other.
+ *
+ * A visitor may return an index to resume the walk from, which is how a caller
+ * skips wholesale past a regex literal, or {@link STOP} to end the walk.
  */
-function stripInlineComment(line) {
+function walkStringState(line, visit) {
     let quote = '';
     for (let i = 0; i < line.length; i++) {
         const c = line[i];
-        if (quote) {
-            if (c === quote && line[i - 1] !== '\\')
-                quote = '';
+        const closes = quote !== '' && c === quote && line[i - 1] !== '\\';
+        const opens = quote === '' && (c === '"' || c === "'" || c === '`');
+        const signal = visit({ c, i, inString: quote !== '', isDelimiter: closes || opens });
+        if (signal === STOP)
+            return;
+        if (typeof signal === 'number') {
+            i = signal;
             continue;
         }
-        if (c === '"' || c === "'" || c === '`') {
+        if (closes)
+            quote = '';
+        else if (opens)
             quote = c;
+    }
+}
+/**
+ * Strip a trailing line comment from a line, tracking quote state so a marker
+ * inside a string literal (a `#` in `"#fff"`, a `//` in a quoted URL) survives.
+ *
+ * Heuristic, not a tokenizer. `syntax` selects the applicable markers — passing
+ * the wrong one is how a valid `this.#handler = eval(payload)` used to be read
+ * as a comment and dropped entirely (ticket 059).
+ *
+ * Block comments are handled by the caller, which alone can track `/* *\/` state
+ * across lines; see {@link scanDiffPatterns}.
+ */
+function stripInlineComment(line, syntax = 'both') {
+    const hash = syntax !== 'c-like';
+    const slash = syntax !== 'hash';
+    let cut = -1;
+    walkStringState(line, ({ c, i, inString, isDelimiter }) => {
+        if (inString || isDelimiter)
+            return;
+        if (hash && c === '#') {
+            cut = i;
+            return STOP;
+        }
+        if (slash && c === '/') {
+            // A `/` where a value is expected opens a regex literal. Skipping past it
+            // wholesale is what handles the escaped slashes inside one — `/\/\//` ends
+            // in two literal `/` characters that would otherwise read as a comment.
+            if (!isCommentSlash(line, i))
+                return endOfRegexLiteral(line, i);
+            if (line[i + 1] === '/') {
+                cut = i;
+                return STOP;
+            }
+        }
+    });
+    return cut === -1 ? line : line.slice(0, cut);
+}
+/**
+ * Index of the closing `/` of the regex literal opening at `start`, or the end
+ * of the line when it never closes. Escapes and character classes both hide a
+ * `/` that does not terminate the literal.
+ */
+function endOfRegexLiteral(line, start) {
+    let inClass = false;
+    for (let i = start + 1; i < line.length; i++) {
+        const c = line[i];
+        if (c === '\\') {
+            i++;
+            continue;
+        }
+        if (c === '[')
+            inClass = true;
+        else if (c === ']')
+            inClass = false;
+        else if (c === '/' && !inClass)
+            return i;
+    }
+    return line.length;
+}
+/**
+ * Blank out the contents of string literals, keeping the quotes and the original
+ * length so the rest of the line still reads as code.
+ *
+ * This is what lets a pattern ask "is a real call being made here" without a
+ * lookahead that guesses at quoting. The `eval` rule used to carry
+ * `(?![^'"`]*['"`])` — intended to skip `eval` written inside a string, but in
+ * practice it disabled the rule on any line containing a quote anywhere, so
+ * `eval(userInput + "x")` and ``eval(`${payload}`)`` both went unreported
+ * (ticket 058).
+ *
+ * Only for patterns that match *code*. Rules that look for string *contents* —
+ * an SQL keyword inside quotes, a hardcoded URL — must keep reading the raw
+ * line, which is what {@link DiffPattern.view} selects.
+ */
+function stripStringLiterals(line) {
+    let out = '';
+    // Both quotes are kept and only what they enclose is blanked, so the line
+    // still reads as code — `f("x")` stays a call with an argument.
+    walkStringState(line, ({ c, inString, isDelimiter }) => {
+        out += inString && !isDelimiter ? ' ' : c;
+    });
+    return out;
+}
+/** Characters kept per logged sample, so one minified added line can't flood the log. */
+const SAMPLE_MAX_LENGTH = 120;
+/** `+++ b/path/to/file.ts` — the header that says which file follows. */
+const DIFF_FILE_HEADER = /^\+\+\+ b\/(.+)$/;
+/**
+ * Bucket added diff lines by the {@link DiffPattern}s they match, split by
+ * severity. Patterns are expected to anchor on the leading `+` themselves
+ * (`/^\+(?!\+)…/`), which is what keeps `+++` file headers and context lines out.
+ *
+ * Comment handling follows the file each hunk belongs to, read from the `+++`
+ * headers as the diff is walked — a single run reviews files of several
+ * languages, so a repo-wide setting would be wrong for most of them.
+ *
+ * `skipIgnored` re-applies the `pr-checkmate-ignore` opt-out for callers that run
+ * `git diff` themselves; a diff obtained from {@link diffAddedLines} is already
+ * filtered and should leave it off.
+ *
+ * `comments: 'off'` scans lines verbatim, which is how a client audits code that
+ * was commented out rather than deleted.
+ */
+function scanDiffPatterns(stdout, patterns, opts = {}) {
+    const errors = {};
+    const warnings = {};
+    const mode = opts.comments ?? 'language';
+    const ignorePaths = opts.ignorePaths ?? [];
+    let syntax = 'both';
+    // Block comments span lines, so the state belongs to the walk, not to one line.
+    let inBlockComment = false;
+    // Whole files can be excluded by glob; the flag persists until the next header.
+    let skippingFile = false;
+    for (const line of stdout.split('\n')) {
+        const header = DIFF_FILE_HEADER.exec(line);
+        if (header) {
+            syntax = mode === 'language' ? commentSyntaxFor(header[1]) : 'both';
+            inBlockComment = false;
+            skippingFile = ignorePaths.length > 0 && (0, utils_1.matchesAnyGlob)(header[1], ignorePaths);
+            continue;
+        }
+        if (skippingFile)
+            continue;
+        // Only added lines carry block-comment state: a `-` line is code being
+        // removed, and letting it open a `/*` would blank the additions after it.
+        if (!line.startsWith('+'))
+            continue;
+        if (opts.skipIgnored && line.includes(IGNORE_DIRECTIVE))
+            continue;
+        const prepared = uncomment(line, { mode, syntax, inBlockComment });
+        inBlockComment = prepared.inBlockComment;
+        const asCode = stripStringLiterals(prepared.text);
+        for (const { pattern, label, severity, view } of patterns) {
+            if (pattern.test(view === 'code' ? asCode : prepared.text)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, SAMPLE_MAX_LENGTH));
+            }
+        }
+    }
+    return { errors, warnings };
+}
+/**
+ * Reduce one added line to what should be matched against: block comments
+ * blanked (carrying the open state on), then the trailing line comment removed.
+ * `mode: 'off'` returns the line untouched.
+ */
+function uncomment(line, state) {
+    const { mode, syntax } = state;
+    if (mode === 'off')
+        return { text: line, inBlockComment: false };
+    // `hash` languages have no `/* */`, and running the stripper over them would
+    // eat a legitimate `/*` appearing in, say, a shell glob.
+    if (syntax === 'hash') {
+        return { text: stripInlineComment(line, syntax), inBlockComment: false };
+    }
+    const { text, open } = stripBlockComments(line, state.inBlockComment);
+    return { text: stripInlineComment(text, syntax), inBlockComment: open };
+}
+/**
+ * Blank out `/* … *\/` regions, carrying the open state across lines. Without
+ * this a call commented out with a block comment reads as live code, and — worse
+ * — a line ending mid-comment leaves the rest of the hunk being scanned as if it
+ * were code.
+ */
+function stripBlockComments(line, open) {
+    let out = '';
+    let i = 0;
+    let inside = open;
+    while (i < line.length) {
+        if (inside) {
+            const end = line.indexOf('*/', i);
+            if (end === -1)
+                return { text: out, open: true };
+            out += ' '.repeat(end + 2 - i);
+            i = end + 2;
+            inside = false;
             continue;
         }
-        if (c === '#')
-            return line.slice(0, i);
-        if (c === '/' && line[i + 1] === '/')
-            return line.slice(0, i);
+        const start = line.indexOf('/*', i);
+        if (start === -1) {
+            out += line.slice(i);
+            break;
+        }
+        out += line.slice(i, start);
+        i = start;
+        inside = true;
     }
-    return line;
+    return { text: out, open: inside };
 }
 /** Total number of findings across all labels in a bucket. */
 function bucketTotal(bucket) {
     return Object.values(bucket).reduce((sum, arr) => sum + arr.length, 0);
 }
-/** Log one bucket of findings using the shared check format. */
+/**
+ * Report a bucket at the check's configured level, summarized as
+ * `9× console.*(), 1× debugger statement`.
+ *
+ * The phrasing every keyword-counting check uses: the label already says what
+ * was found, so only the count varies. Written out per check, the four-step tail
+ * — resolve the level, log at it, join the counts, emit at the same level — was
+ * copied verbatim, and `isError: sev.icon === '❌'` is exactly the kind of link
+ * between two of those steps that silently rots when only one side is edited.
+ */
+function reportCountedFindings(findings, ctx, opts) {
+    const sev = severityEmitter(opts.severity, opts.fallback ?? 'warn');
+    logFindings(findings, {
+        prefix: opts.prefix,
+        sampleLimit: opts.sampleLimit ?? ctx.config.log?.sampleLimit ?? 3,
+        isError: sev.icon === '❌',
+    });
+    const label = opts.summaryLabel ?? ((l) => l);
+    const summary = Object.entries(findings)
+        .map(([name, arr]) => `${arr.length}× ${label(name)}`)
+        .join(', ');
+    return sev.emit(summary + (opts.suffix ?? ''));
+}
+/**
+ * Log one bucket of findings using the shared check format.
+ *
+ * Internal: checks reach it through {@link reportCountedFindings} or
+ * {@link reportSeverityBuckets}, which pair the logging with the outcome so the
+ * two cannot report different levels.
+ */
 function logFindings(bucket, opts) {
     const emit = opts.isError ? utils_1.logger.error.bind(utils_1.logger) : utils_1.logger.warn.bind(utils_1.logger);
     const icon = opts.isError ? '❌' : '⚠️';
@@ -96,6 +492,25 @@ function logFindings(bucket, opts) {
         }
     }
 }
+/**
+ * The half of {@link SeverityReportOptions} every check fills in identically:
+ * the client's own `<check>.ignore` / `failOn` / `severityOverrides`, the shared
+ * sample limit, and the repo-wide `severityDefaults` fallback.
+ *
+ * Only the phrasing (`prefix` and the two summaries) is ever check-specific, so
+ * spelling the rest out per check meant five lines of copy-paste that had to be
+ * kept in step by hand — and a check that forgot one line silently ignored a
+ * knob the client had set.
+ */
+function clientFindingOptions(ctx, cfg = {}) {
+    return {
+        sampleLimit: ctx.config.log?.sampleLimit ?? 3,
+        ignore: cfg.ignore,
+        failOn: cfg.failOn,
+        severityOverrides: cfg.severityOverrides,
+        defaults: ctx.config.severityDefaults,
+    };
+}
 /** Remove bucket entries whose label matches any ignore substring. */
 function dropIgnored(bucket, ignore) {
     if (ignore.length === 0)
@@ -108,14 +523,47 @@ function dropIgnored(bucket, ignore) {
     }
     return kept;
 }
+/**
+ * Re-file findings according to the client's per-label overrides, returning
+ * fresh buckets. A label matching several overrides takes the longest (most
+ * specific) match, so a broad rule and a narrow exception can coexist.
+ */
+function applyOverrides(errors, warnings, overrides) {
+    const entries = Object.entries(overrides).map(([k, v]) => [k.toLowerCase(), v]);
+    if (entries.length === 0)
+        return { errors, warnings };
+    const out = { errors: {}, warnings: {} };
+    const place = (label, items, fallback) => {
+        const lowered = label.toLowerCase();
+        const matches = entries.filter(([key]) => lowered.includes(key));
+        const best = matches.sort((a, b) => b[0].length - a[0].length)[0];
+        const level = best ? best[1] : fallback;
+        if (level === 'off')
+            return;
+        const bucket = level === 'error' ? out.errors : out.warnings;
+        (bucket[label] ?? (bucket[label] = [])).push(...items);
+    };
+    for (const [label, items] of Object.entries(errors))
+        place(label, items, 'error');
+    for (const [label, items] of Object.entries(warnings))
+        place(label, items, 'warn');
+    return out;
+}
 /**
  * Report error/warning finding buckets: log both, then produce the outcome.
- * Returns pass() when both buckets are empty, otherwise warn() with a summary.
+ *
+ * Order is the contract, and each step exists because the one before it is too
+ * blunt on its own:
+ *   1. `ignore` — drop the finding outright.
+ *   2. `severityOverrides` — re-file what survived.
+ *   3. `failOn` — decide what a remaining error means for the run.
+ * The universal `severity[<check name>]` map is applied later still, by the
+ * orchestrator, so a client can always override a check wholesale by name.
  */
 function reportSeverityBuckets(errorsIn, warningsIn, opts) {
     const ignore = opts.ignore ?? [];
-    const errors = dropIgnored(errorsIn, ignore);
-    const warnings = dropIgnored(warningsIn, ignore);
+    const filed = applyOverrides(dropIgnored(errorsIn, ignore), dropIgnored(warningsIn, ignore), opts.severityOverrides ?? {});
+    const { errors, warnings } = filed;
     const totalErrors = bucketTotal(errors);
     const totalWarnings = bucketTotal(warnings);
     if (totalErrors === 0 && totalWarnings === 0)
@@ -123,10 +571,14 @@ function reportSeverityBuckets(errorsIn, warningsIn, opts) {
     const logOpts = { prefix: opts.prefix, showCount: opts.showCount, sampleLimit: opts.sampleLimit };
     logFindings(errors, { ...logOpts, isError: true });
     logFindings(warnings, { ...logOpts, isError: false });
+    const failOn = opts.failOn ?? opts.defaults?.failOn ?? 'error';
+    if (failOn === 'never')
+        return (0, types_1.pass)();
     const parts = [];
     if (totalErrors > 0)
         parts.push(opts.errorSummary(totalErrors));
     if (totalWarnings > 0)
         parts.push(opts.warningSummary(totalWarnings));
-    return (0, types_1.warn)(parts.join(', '));
+    const summary = parts.join(', ');
+    return failOn === 'error' && totalErrors > 0 ? (0, types_1.fail)(summary) : (0, types_1.warn)(summary);
 }

package/dist/core/checks/git/custom-rules.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.customRulesCheck = void 0;
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 const findings_1 = require("../findings");
 /**
@@ -69,30 +70,34 @@ function scanDiff(stdout, rules) {
 exports.customRulesCheck = {
     name: 'Custom Rules',
     phase: 'informational',
+    // No `requiresDiff`: a project rule describes what the code should look like,
+    // not what this PR changed (ticket 067). A repo adopting a rule wants to know
+    // where it is already violated.
     applies(ctx) {
-        return (ctx.config.customRules?.length ?? 0) > 0 && Boolean(ctx.baseSha);
+        return (ctx.config.customRules?.length ?? 0) > 0;
     },
     async run(ctx) {
         const rules = compileRules(ctx);
         if (rules.length === 0)
             return (0, types_1.pass)('no valid custom rules');
         try {
-            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
-            const { errors, warnings } = scanDiff(stdout, rules);
-            const totalErrors = (0, findings_1.bucketTotal)(errors);
-            const totalWarnings = (0, findings_1.bucketTotal)(warnings);
-            if (totalErrors === 0 && totalWarnings === 0)
-                return (0, types_1.pass)();
-            (0, findings_1.logFindings)(errors, { prefix: PREFIX, isError: true, sampleLimit: 3 });
-            (0, findings_1.logFindings)(warnings, { prefix: PREFIX, sampleLimit: 3 });
-            const parts = [];
-            if (totalErrors > 0)
-                parts.push(`${totalErrors} error(s)`);
-            if (totalWarnings > 0)
-                parts.push(`${totalWarnings} warning(s)`);
-            const summary = parts.join(', ');
+            const found = (0, findings_1.emptyBuckets)();
+            const collect = (stdout) => (0, findings_1.mergeSeverityBuckets)(found, scanDiff(stdout, rules));
+            if (ctx.baseSha) {
+                const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+                collect(stdout);
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], ['.']);
+                await (0, findings_1.scanTrackedFiles)(ctx, files, collect);
+            }
             // A rule with severity "error" blocks the run (fail), regardless of phase.
-            return totalErrors > 0 ? (0, types_1.fail)(summary) : (0, types_1.warn)(summary);
+            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
+                prefix: PREFIX,
+                errorSummary: n => `${n} error(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                ...(0, findings_1.clientFindingOptions)(ctx),
+            });
         }
         catch (err) {
             utils_1.logger.warn(`[Custom Rules]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/git/diff-smell.d.ts

@@ -1,2 +1,19 @@
 import { Check } from '../../types';
+import { DiffPattern } from '../findings';
+/**
+ * Smells that are only smells in live code.
+ *
+ * `view: 'code'` blanks string literals before matching, which is what tells a
+ * `debugger` statement apart from the seven places an ESLint config names the
+ * rule that bans it — `'no-debugger': 'error'` was reported as a leftover
+ * `debugger` in every repo that configures the rule, this one included.
+ * Comment stripping (the default) covers the other half: prose *about* a
+ * `debugger` is not one.
+ */
+export declare const CODE_SMELLS: DiffPattern[];
+/**
+ * Markers that live *in* comments, so this set is scanned with comment handling
+ * off — stripping comments first would leave these patterns nothing to match.
+ */
+export declare const COMMENT_SMELLS: DiffPattern[];
 export declare const diffSmellCheck: Check;