pr-checkmate 3.0.3 → 3.1.0

package/dist/esm/core/checks/git/custom-rules.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const customRulesCheck: Check;

package/dist/esm/core/checks/git/custom-rules.js

@@ -0,0 +1,106 @@
+import { execa } from '../../../utils/execa.js';
+import { logger, matchesAnyGlob } from '../../../utils/index.js';
+import { listTrackedFiles } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { clientFindingOptions, emptyBuckets, mergeSeverityBuckets, reportSeverityBuckets, scanTrackedFiles, } from '../findings.js';
+/**
+ * Compile the user's `customRules` into ready-to-run matchers. A rule with an
+ * invalid regex is skipped with a warning rather than crashing the run. `g`/`y`
+ * flags are stripped because `.test()` on a sticky/global regex is stateful and
+ * would skip matches across lines.
+ */
+function compileRules(ctx) {
+    const rules = ctx.config.customRules ?? [];
+    const compiled = [];
+    for (const r of rules) {
+        if (!r?.name || !r?.pattern)
+            continue;
+        let re;
+        try {
+            re = new RegExp(r.pattern, (r.flags ?? '').replace(/[gy]/g, ''));
+        }
+        catch (err) {
+            logger.warn(`[Custom Rules]: ⚠️ invalid regex in rule "${r.name}" — skipped\n${err}`);
+            continue;
+        }
+        compiled.push({
+            message: r.message ?? r.name,
+            re,
+            severity: r.severity === 'error' ? 'error' : 'warn',
+            include: r.include,
+            exclude: r.exclude,
+        });
+    }
+    return compiled;
+}
+const PREFIX = 'Custom Rules';
+/** Parse the diff, bucketing rule matches on added lines by severity. */
+function scanDiff(stdout, rules) {
+    var _a;
+    const errors = {};
+    const warnings = {};
+    let file = '';
+    for (const raw of stdout.split('\n')) {
+        if (raw.startsWith('+++ ')) {
+            const p = raw.slice(4).trim();
+            file = p === '/dev/null' ? '' : p.replace(/^b\//, '');
+            continue;
+        }
+        if (!raw.startsWith('+') || raw.startsWith('+++'))
+            continue;
+        if (raw.includes('pr-checkmate-ignore'))
+            continue;
+        const content = raw.slice(1);
+        for (const rule of rules) {
+            if (rule.include && !matchesAnyGlob(file, rule.include))
+                continue;
+            if (rule.exclude && matchesAnyGlob(file, rule.exclude))
+                continue;
+            if (rule.re.test(content)) {
+                const bucket = rule.severity === 'error' ? errors : warnings;
+                (bucket[_a = rule.message] ?? (bucket[_a] = [])).push(`${file}: ${content.trim().substring(0, 100)}`);
+            }
+        }
+    }
+    return { errors, warnings };
+}
+export const customRulesCheck = {
+    name: 'Custom Rules',
+    phase: 'informational',
+    // No `requiresDiff`: a project rule describes what the code should look like,
+    // not what this PR changed (ticket 067). A repo adopting a rule wants to know
+    // where it is already violated.
+    applies(ctx) {
+        return (ctx.config.customRules?.length ?? 0) > 0;
+    },
+    async run(ctx) {
+        const rules = compileRules(ctx);
+        if (rules.length === 0)
+            return pass('no valid custom rules');
+        try {
+            const found = emptyBuckets();
+            const collect = (stdout) => mergeSeverityBuckets(found, scanDiff(stdout, rules));
+            if (ctx.baseSha) {
+                const { stdout } = await execa('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+                collect(stdout);
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                const files = await listTrackedFiles(ctx, ['*'], ['.']);
+                if (files === null)
+                    return skip('git unavailable');
+                await scanTrackedFiles(ctx, files, collect);
+            }
+            // A rule with severity "error" blocks the run (fail), regardless of phase.
+            return reportSeverityBuckets(found.errors, found.warnings, {
+                prefix: PREFIX,
+                errorSummary: n => `${n} error(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                ...clientFindingOptions(ctx),
+            });
+        }
+        catch (err) {
+            logger.warn(`[Custom Rules]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/git/diff-smell.d.ts

@@ -0,0 +1,19 @@
+import { Check } from '../../types.js';
+import { DiffPattern } from '../findings.js';
+/**
+ * Smells that are only smells in live code.
+ *
+ * `view: 'code'` blanks string literals before matching, which is what tells a
+ * `debugger` statement apart from the seven places an ESLint config names the
+ * rule that bans it — `'no-debugger': 'error'` was reported as a leftover
+ * `debugger` in every repo that configures the rule, this one included.
+ * Comment stripping (the default) covers the other half: prose *about* a
+ * `debugger` is not one.
+ */
+export declare const CODE_SMELLS: DiffPattern[];
+/**
+ * Markers that live *in* comments, so this set is scanned with comment handling
+ * off — stripping comments first would leave these patterns nothing to match.
+ */
+export declare const COMMENT_SMELLS: DiffPattern[];
+export declare const diffSmellCheck: Check;

package/dist/esm/core/checks/git/diff-smell.js

@@ -0,0 +1,69 @@
+import { logger } from '../../../utils/index.js';
+import { pass, skip } from '../../types.js';
+import { bucketTotal, emptyBuckets, mergeSeverityBuckets, reportCountedFindings, scanDiffPatterns, reviewLines, } from '../findings.js';
+/**
+ * Smells that are only smells in live code.
+ *
+ * `view: 'code'` blanks string literals before matching, which is what tells a
+ * `debugger` statement apart from the seven places an ESLint config names the
+ * rule that bans it — `'no-debugger': 'error'` was reported as a leftover
+ * `debugger` in every repo that configures the rule, this one included.
+ * Comment stripping (the default) covers the other half: prose *about* a
+ * `debugger` is not one.
+ */
+export const CODE_SMELLS = [
+    {
+        pattern: /^\+(?!\+).*\bconsole\.(log|error|warn|debug|info)\s*\(/,
+        label: 'console.*()',
+        severity: 'warn',
+        view: 'code',
+    },
+    {
+        pattern: /^\+(?!\+).*\bdebugger\b/,
+        label: 'debugger statement',
+        severity: 'warn',
+        view: 'code',
+    },
+];
+/**
+ * Markers that live *in* comments, so this set is scanned with comment handling
+ * off — stripping comments first would leave these patterns nothing to match.
+ */
+export const COMMENT_SMELLS = [
+    { pattern: /^\+\s*\/\/\s*TODO\b/i, label: 'TODO comment', severity: 'warn' },
+    { pattern: /^\+\s*\/\/\s*FIXME\b/i, label: 'FIXME comment', severity: 'warn' },
+    { pattern: /^\+\s*\/\/\s*HACK\b/i, label: 'HACK comment', severity: 'warn' },
+    { pattern: /^\+\s*\/\/\s*XXX\b/i, label: 'XXX marker', severity: 'warn' },
+];
+export const diffSmellCheck = {
+    name: 'Diff Smells',
+    phase: 'informational',
+    // No `requiresDiff`: a leftover `debugger` is leftover whether it arrived in
+    // this PR or an earlier one (ticket 067).
+    applies(ctx) {
+        return ctx.config.diffSmell?.enabled !== false;
+    },
+    async run(ctx) {
+        try {
+            const { ignorePaths } = ctx.config.diffSmell ?? {};
+            const found = emptyBuckets();
+            const reviewed = await reviewLines(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], stdout => {
+                mergeSeverityBuckets(found, scanDiffPatterns(stdout, CODE_SMELLS, { ignorePaths }));
+                mergeSeverityBuckets(found, scanDiffPatterns(stdout, COMMENT_SMELLS, { comments: 'off', ignorePaths }));
+            });
+            // An unreadable file list is not "no smells" (ticket 072). Checked before
+            // the empty-bucket branch below, because that branch is what turned it into
+            // a green row.
+            if (!reviewed)
+                return skip('git unavailable');
+            // Every smell here is declared `warn`, so nothing reaches the error bucket.
+            if (bucketTotal(found.warnings) === 0)
+                return pass();
+            return reportCountedFindings(found.warnings, ctx, { prefix: 'Diff Smells' });
+        }
+        catch (err) {
+            logger.warn(`[Diff Smells]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/git/large-files.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const largeFilesCheck: Check;

package/dist/esm/core/checks/git/large-files.js

@@ -0,0 +1,112 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execa } from '../../../utils/execa.js';
+import { logger, matchesAnyGlob } from '../../../utils/index.js';
+import { resolveTargetFiles } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { severityEmitter } from '../findings.js';
+const DEFAULT_MAX_KB = 500;
+/**
+ * Lockfiles are legitimately large and always generated, never accidental — so
+ * they're exempt from the size/binary guard by default (a 600 KB
+ * package-lock.json is normal, not bloat). Their changes are still surfaced by
+ * the Lockfile Drift and Sensitive Files checks. Merged with the client's
+ * `largeFiles.allow`.
+ */
+const LOCKFILE_ALLOW = [
+    '**/package-lock.json',
+    '**/npm-shrinkwrap.json',
+    '**/yarn.lock',
+    '**/pnpm-lock.yaml',
+    '**/bun.lockb',
+    '**/Cargo.lock',
+    '**/poetry.lock',
+    '**/uv.lock',
+    '**/Pipfile.lock',
+    '**/pdm.lock',
+    '**/Gemfile.lock',
+    '**/composer.lock',
+    '**/go.sum',
+    '**/Package.resolved',
+];
+/**
+ * Parse `git diff --numstat` and collect files git reports as binary — those
+ * rows carry `-` in both the additions and deletions columns.
+ */
+function binaryPaths(numstat) {
+    const binary = new Set();
+    for (const line of numstat.split('\n')) {
+        if (!line)
+            continue;
+        const [add, del, ...rest] = line.split('\t');
+        if (add === '-' && del === '-')
+            binary.add(rest.join('\t'));
+    }
+    return binary;
+}
+export const largeFilesCheck = {
+    name: 'Large Files',
+    phase: 'informational',
+    // No `requiresDiff`: a committed 40 MB binary bloats every clone whether it
+    // landed in this PR or two years ago (ticket 067). `resolveTargetFiles` already
+    // falls back to `git ls-files` with no range, so the file list is right either
+    // way; only the binary-detection diff below needed a second path.
+    applies(ctx) {
+        return ctx.config.largeFiles?.enabled !== false;
+    },
+    async run(ctx) {
+        // resolveTargetFiles (not the scoped variant): a bloat guard should catch
+        // large files anywhere in the repo — a root-level asset is exactly the case
+        // a narrowed `sourcePath` would miss — but still skip `ignoreDirs`
+        // (dist/build/vendor), where large generated files are expected.
+        const files = await resolveTargetFiles(ctx, ['*']);
+        if (files === null)
+            return skip('git unavailable');
+        if (files.length === 0)
+            return pass();
+        const maxKb = ctx.config.largeFiles?.maxSizeKb ?? DEFAULT_MAX_KB;
+        const maxBytes = maxKb * 1024;
+        const allow = [...LOCKFILE_ALLOW, ...(ctx.config.largeFiles?.allow ?? [])];
+        if (!ctx.baseSha && ctx.config.run?.fullScanBehaviour === 'skip')
+            return pass();
+        let binary;
+        try {
+            // `--numstat` reports `-\t-` for binary files. With no range there is
+            // nothing to diff, so binary detection falls back to reading the bytes —
+            // the size check is what matters here, and it works either way.
+            const args = ctx.baseSha
+                ? ['diff', '--numstat', '--diff-filter=ACM', ctx.baseSha, ctx.headSha ?? 'HEAD']
+                : null;
+            const { stdout } = args ? await execa('git', args, { cwd: ctx.cwd }) : { stdout: '' };
+            binary = binaryPaths(stdout);
+        }
+        catch (err) {
+            logger.warn(`[Large Files]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+        const findings = [];
+        for (const file of files) {
+            if (matchesAnyGlob(file, allow))
+                continue;
+            let size;
+            try {
+                size = fs.statSync(path.join(ctx.cwd, file)).size;
+            }
+            catch {
+                continue; // renamed/removed between diff and stat — skip
+            }
+            const reasons = [];
+            if (size > maxBytes)
+                reasons.push(`${Math.round(size / 1024)} KB > ${maxKb} KB`);
+            if (binary.has(file))
+                reasons.push('binary');
+            if (reasons.length > 0)
+                findings.push(`${file} (${reasons.join(', ')})`);
+        }
+        if (findings.length === 0)
+            return pass();
+        const sev = severityEmitter(ctx.config.largeFiles?.severity, 'warn');
+        findings.forEach(f => sev.log(`[Large Files]: ${sev.icon} ${f}`));
+        return sev.emit(`${findings.length} large/binary file(s) added`);
+    },
+};

package/dist/esm/core/checks/git/leftover-debug.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const leftoverDebugCheck: Check;

package/dist/esm/core/checks/git/leftover-debug.js

@@ -0,0 +1,89 @@
+import { logger } from '../../../utils/index.js';
+import { pass, skip } from '../../types.js';
+import { bucketTotal, commentSyntaxFor, reportCountedFindings, reviewLines, stripInlineComment, } from '../findings.js';
+/**
+ * Debug statements for languages NOT already covered by the Diff Smells check
+ * (which handles `console.*`/`debugger` for JS/TS). Kept separate so the two
+ * checks never double-report the same finding in a PR comment.
+ */
+const PYTHON_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bprint\s*\(/, label: 'print()' },
+    { pattern: /^\+(?!\+).*\bpprint\s*\(/, label: 'pprint()' },
+    { pattern: /^\+(?!\+).*\bbreakpoint\s*\(/, label: 'breakpoint()' },
+    { pattern: /^\+(?!\+).*\bpdb\.set_trace\s*\(/, label: 'pdb.set_trace()' },
+];
+const KOTLIN_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bSystem\.(out|err)\.println\s*\(/, label: 'System.out/err.println()' },
+    // Bare println(...), but not the qualified System.out.println above — the
+    // negative lookbehind rejects a preceding `.` or identifier char.
+    { pattern: /^\+(?!\+).*(?<![.\w])println\s*\(/, label: 'println()' },
+];
+/** `+++ b/path/to/file.py` — the header that says which file follows. */
+const DIFF_FILE_HEADER = /^\+\+\+ b\/(.+)$/;
+/**
+ * Bucket added-line matches by label, skipping lines opted out via directive.
+ *
+ * Comment stripping follows the file each hunk belongs to (ticket 059). It
+ * matters here as much as in Diff Security: `#` is a comment in Python but a
+ * private field in Kotlin/Java-adjacent syntax, and this check scans both.
+ */
+function collect(stdout, patterns, findings, mode = 'language') {
+    let syntax = 'both';
+    for (const line of stdout.split('\n')) {
+        const header = DIFF_FILE_HEADER.exec(line);
+        if (header) {
+            syntax = mode === 'language' ? commentSyntaxFor(header[1]) : 'both';
+            continue;
+        }
+        // Honour an inline opt-out in any comment style (`// pr-checkmate-ignore`,
+        // `# pr-checkmate-ignore`).
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        // Match on the comment-stripped line so `# print(x)` in a comment isn't flagged.
+        const scanned = mode === 'off' ? line : stripInlineComment(line, syntax);
+        for (const { pattern, label } of patterns) {
+            if (pattern.test(scanned)) {
+                (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 100));
+            }
+        }
+    }
+}
+export const leftoverDebugCheck = {
+    name: 'Leftover Debug',
+    phase: 'informational',
+    // No `requiresDiff`: a stray `print()` is stray wherever it sits (ticket 067).
+    applies(ctx) {
+        return (ctx.config.leftoverDebug?.enabled !== false &&
+            (ctx.languages.includes('python') || ctx.languages.includes('kotlin')));
+    },
+    async run(ctx) {
+        try {
+            const findings = {};
+            const comments = ctx.config.leftoverDebug?.commentHandling ?? 'language';
+            // One failed language set fails the check — see todo-fixme, same reason.
+            let reviewed = true;
+            if (ctx.languages.includes('python')) {
+                reviewed =
+                    (await reviewLines(ctx, ['*.py'], out => collect(out, PYTHON_PATTERNS, findings, comments))) && reviewed;
+            }
+            if (ctx.languages.includes('kotlin')) {
+                reviewed =
+                    (await reviewLines(ctx, ['*.kt', '*.kts', '*.java'], out => collect(out, KOTLIN_PATTERNS, findings, comments))) && reviewed;
+            }
+            if (!reviewed)
+                return skip('git unavailable');
+            if (bucketTotal(findings) === 0)
+                return pass();
+            // Advisory by default; a repo may promote to a gate via
+            // `leftoverDebug.severity: 'error'`.
+            return reportCountedFindings(findings, ctx, {
+                prefix: 'Leftover Debug',
+                severity: ctx.config.leftoverDebug?.severity,
+            });
+        }
+        catch (err) {
+            logger.warn(`[Leftover Debug]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/git/lockfile-drift.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const lockfileDriftCheck: Check;

package/dist/esm/core/checks/git/lockfile-drift.js

@@ -0,0 +1,114 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execa } from '../../../utils/execa.js';
+import { logger } from '../../../utils/index.js';
+import { excludeClientPaths } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { severityEmitter } from '../findings.js';
+/**
+ * Manifest → its lockfile(s). A change to the manifest's dependency set without
+ * a corresponding lockfile update is drift: CI resolves versions the author
+ * never locked. Matched by basename so monorepo sub-packages work too.
+ */
+const LOCK_PAIRS = [
+    { manifest: 'package.json', locks: ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'] },
+    { manifest: 'pyproject.toml', locks: ['poetry.lock', 'uv.lock'] },
+    { manifest: 'requirements.in', locks: ['requirements.txt'] },
+    { manifest: 'go.mod', locks: ['go.sum'] },
+    { manifest: 'Cargo.toml', locks: ['Cargo.lock'] },
+    { manifest: 'Gemfile', locks: ['Gemfile.lock'] },
+];
+const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+/** Extract only the dependency sections of a parsed package.json, or `{}`. */
+function extractDeps(raw) {
+    try {
+        const json = JSON.parse(raw);
+        const deps = {};
+        for (const key of DEP_KEYS)
+            if (json[key])
+                deps[key] = json[key];
+        return deps;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * True when a package.json's dependency sections differ between base and head.
+ * Guards against false positives from `version`/`scripts`-only edits that don't
+ * need a lockfile refresh. A newly added manifest (no base version) counts as
+ * changed. Other ecosystems have no zero-dependency parser here, so they trigger
+ * on any manifest change.
+ */
+async function packageDepsChanged(ctx, manifestPath, base) {
+    let headDeps = {};
+    try {
+        headDeps = extractDeps(fs.readFileSync(path.join(ctx.cwd, manifestPath), 'utf-8'));
+    }
+    catch {
+        // Head file unreadable (e.g. deleted) — treat as changed so it surfaces.
+        return true;
+    }
+    const { stdout, exitCode } = await execa('git', ['show', `${base}:${manifestPath}`], {
+        cwd: ctx.cwd,
+        reject: false,
+    });
+    const baseDeps = exitCode === 0 ? extractDeps(stdout) : {};
+    return JSON.stringify(headDeps) !== JSON.stringify(baseDeps);
+}
+export const lockfileDriftCheck = {
+    name: 'Lockfile Drift',
+    phase: 'informational',
+    requiresDiff: true,
+    applies(ctx) {
+        return ctx.config.lockfileDrift?.enabled !== false;
+    },
+    async run(ctx) {
+        try {
+            // Raw name-only diff — manifests/locks live at the repo root, outside any
+            // configured `sourcePath`, so this deliberately does NOT scope (same as
+            // the Sensitive Files guard). Scoping would hide the very files we check.
+            //
+            // `excludePaths` is still applied, below: not scoping is an argument about
+            // WHERE these files live, not a licence to ignore a client who named one
+            // (ticket 080). A vendored sub-project's lockfile is a real case.
+            const { stdout } = await execa('git', [
+                'diff',
+                '--name-only',
+                '--diff-filter=ACMRD',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+            ], { cwd: ctx.cwd });
+            const changed = new Set(excludeClientPaths(stdout.split('\n').filter(Boolean), ctx.cwd));
+            const warnings = [];
+            for (const changedPath of changed) {
+                const pair = LOCK_PAIRS.find(p => p.manifest === path.basename(changedPath));
+                if (!pair)
+                    continue;
+                // For package.json, only flag when the dependency set actually changed.
+                if (pair.manifest === 'package.json') {
+                    if (!(await packageDepsChanged(ctx, changedPath, ctx.baseSha)))
+                        continue;
+                }
+                const dir = path.dirname(changedPath);
+                const lockPath = (lock) => (dir === '.' ? lock : `${dir}/${lock}`);
+                const presentLocks = pair.locks.filter(lock => fs.existsSync(path.join(ctx.cwd, lockPath(lock))));
+                if (presentLocks.length === 0)
+                    continue; // no lockfile committed → nothing to drift
+                const anyLockChanged = presentLocks.some(lock => changed.has(lockPath(lock)));
+                if (!anyLockChanged) {
+                    warnings.push(`${changedPath} changed but ${presentLocks.join(' / ')} not updated`);
+                }
+            }
+            if (warnings.length === 0)
+                return pass();
+            const sev = severityEmitter(ctx.config.lockfileDrift?.severity, 'warn');
+            warnings.forEach(w => sev.log(`[Lockfile Drift]: ${sev.icon} ${w}`));
+            return sev.emit(`${warnings.length} manifest(s) changed without a lockfile update`);
+        }
+        catch (err) {
+            logger.warn(`[Lockfile Drift]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/git/merge-conflict.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const mergeConflictCheck: Check;

package/dist/esm/core/checks/git/merge-conflict.js

@@ -0,0 +1,117 @@
+import { getSourcePaths } from '../../../config/index.js';
+import { execa } from '../../../utils/execa.js';
+import { logger } from '../../../utils/index.js';
+import { resolveScopedTargetFiles } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { scanTrackedFiles, severityEmitter } from '../findings.js';
+/**
+ * Git conflict markers, matched against the content of an added diff line
+ * (the leading `+` already stripped). Each is exactly seven characters at the
+ * start of the line, optionally followed by a space + branch/ref label
+ * (`=======` stands alone). `|||||||` is the diff3 base-section marker.
+ */
+const MARKER_START = /^<{7}(?: |$)/;
+const MARKER_BASE = /^\|{7}(?: |$)/;
+const MARKER_SEP = /^={7}$/;
+const MARKER_END = /^>{7}(?: |$)/;
+/** An angle marker (`<<<<<<<` / `>>>>>>>`) is unambiguous on its own. */
+function isAngleMarker(content) {
+    return MARKER_START.test(content) || MARKER_END.test(content);
+}
+/**
+ * Parse a `git diff --unified=0` and return every added line that looks like a
+ * conflict marker, tracking the file and new-file line number for reporting.
+ */
+function scanDiff(diff) {
+    const hits = [];
+    let file = '';
+    let newLine = 0;
+    for (const raw of diff.split('\n')) {
+        if (raw.startsWith('+++ ')) {
+            // `+++ b/path` (or `+++ /dev/null` for deletions). Strip the `b/` prefix.
+            const path = raw.slice(4).trim();
+            file = path === '/dev/null' ? '' : path.replace(/^b\//, '');
+            continue;
+        }
+        if (raw.startsWith('---'))
+            continue; // old-file header, never a content line
+        if (raw.startsWith('@@')) {
+            // @@ -oldStart,oldLen +newStart,newLen @@ — reset the new-file counter.
+            const m = /\+(\d+)/.exec(raw);
+            newLine = m ? Number(m[1]) : 0;
+            continue;
+        }
+        if (raw.startsWith('+')) {
+            const content = raw.slice(1);
+            if (file &&
+                (isAngleMarker(content) || MARKER_BASE.test(content) || MARKER_SEP.test(content))) {
+                hits.push({ file, line: newLine, angle: isAngleMarker(content) });
+            }
+            newLine += 1;
+        }
+        // Removed (`-`) lines don't advance the new-file counter; with --unified=0
+        // there are no context lines to account for.
+    }
+    return hits;
+}
+/**
+ * Keep every angle/base marker, but a bare `=======` only counts when the same
+ * file also carries an angle marker. A standalone `=======` is a legitimate
+ * markdown setext-heading underline; requiring a bracketing `<<<<<<<`/`>>>>>>>`
+ * in the file avoids that false positive while still catching real conflicts.
+ */
+function filterHits(hits) {
+    const filesWithAngle = new Set(hits.filter(h => h.angle).map(h => h.file));
+    return hits.filter(h => h.angle || filesWithAngle.has(h.file));
+}
+export const mergeConflictCheck = {
+    name: 'Merge Conflict',
+    phase: 'blocking',
+    // No `requiresDiff`: a committed conflict marker is broken code whether it
+    // arrived in this PR or survived an earlier bad merge (ticket 067). This is
+    // the check most worth running over a whole repository, since a marker that
+    // slipped through once stays there silently.
+    applies(ctx) {
+        return ctx.config.mergeConflict?.enabled !== false;
+    },
+    async run(ctx) {
+        // Resolve the scoped file set the canonical way (delta-aware, honouring the
+        // client's `ignoreDirs` and `sourcePath`), then diff only those files for
+        // content. `['*']` matches every path since conflicts are language-agnostic;
+        // scoping still keeps build/vendor/report dirs out, like every other check.
+        const files = await resolveScopedTargetFiles(ctx, ['*'], getSourcePaths(ctx.cwd));
+        if (files === null)
+            return skip('git unavailable');
+        if (files.length === 0)
+            return pass();
+        try {
+            const hits = [];
+            if (ctx.baseSha) {
+                const { stdout } = await execa('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...files], { cwd: ctx.cwd });
+                hits.push(...scanDiff(stdout));
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                await scanTrackedFiles(ctx, files, asDiff => hits.push(...scanDiff(asDiff)));
+            }
+            const found = filterHits(hits);
+            if (found.length === 0)
+                return pass();
+            // Conflict markers are a hard error by default; a repo may downgrade to
+            // `warn` via `mergeConflict.severity`.
+            const sev = severityEmitter(ctx.config.mergeConflict?.severity, 'error');
+            for (const h of found) {
+                sev.log(`[Merge Conflict]: ${sev.icon} ${h.file}:${h.line}`);
+            }
+            const sample = found
+                .slice(0, 5)
+                .map(h => `${h.file}:${h.line}`)
+                .join(', ');
+            const more = found.length > 5 ? ` (+${found.length - 5} more)` : '';
+            return sev.emit(` unresolved conflict marker(s): ${sample}${more}`);
+        }
+        catch (err) {
+            logger.warn(`[Merge Conflict]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/git/missing-tests.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const missingTestsCheck: Check;