pr-checkmate 3.3.0 → 4.0.0

package/dist/esm/utils/execa.js

@@ -1,3 +1,42 @@
+/**
+ * Whether children that would inherit our standard streams are kept off them.
+ *
+ * A few checks run a tool with `stdio: 'inherit'` so its output reaches the
+ * terminal. That is right for the CLI and fatal for the MCP server, whose stdout
+ * *is* the protocol: gitleaks printing its banner there is a line that is not
+ * JSON, and the client drops the connection. Swapping `process.stdout.write`
+ * cannot help, because an inherited descriptor never passes through it — so the
+ * redirection has to happen where the child is spawned.
+ */
+let childOutput = null;
+/**
+ * Keep children that would inherit our streams off them, and stop them sharing
+ * stdin. `stderr` (the MCP server) keeps their output as the server's log;
+ * `discard` (the commit hook) drops it, because a hook's stderr is read by the
+ * model and tool banners are not what it needs to hear. No other command is affected.
+ */
+export function isolateInheritedStdio(output = 'stderr') {
+    childOutput = output === 'stderr' ? 2 : 'ignore';
+}
+/** Redirect inherited stdout/stderr per {@link isolateInheritedStdio}; stdin is never ours to give away. */
+function isolated(options) {
+    if (childOutput === null || !options)
+        return options;
+    const { stdio } = options;
+    if (stdio === 'inherit')
+        return { ...options, stdio: ['ignore', childOutput, childOutput] };
+    if (Array.isArray(stdio)) {
+        const next = stdio.map((entry, fd) => {
+            if (fd === 0 && entry === 'inherit')
+                return 'ignore';
+            if ((fd === 1 || fd === 2) && entry === 'inherit')
+                return childOutput;
+            return entry;
+        });
+        return { ...options, stdio: next };
+    }
+    return options;
+}
 /**
  * Run a command via execa, loading the module lazily on first call.
  *
@@ -6,5 +45,5 @@
  */
 export async function execa(file, args, options) {
     const { execa: run } = await import('execa');
-    return (await run(file, args, options));
+    return (await run(file, args, isolated(options)));
 }

package/dist/esm/utils/result-collector.d.ts

@@ -1,8 +1,24 @@
 export type CheckStatus = 'pass' | 'warn' | 'fail' | 'skip';
+/**
+ * One thing a check found, with where it is. Optional on every result: only the
+ * checks that can say where report it, and a result without any is not an error —
+ * it just has a summary and no location.
+ */
+export interface Finding {
+    file: string;
+    /** 1-based line in the file as it will be committed. */
+    line?: number;
+    /** Which rule or pattern matched, as the check names it. */
+    rule: string;
+    /** The offending text, shortened. Never a secret: scanners that find those leave it out. */
+    snippet?: string;
+    severity: 'error' | 'warn';
+}
 export interface CheckResult {
     name: string;
     status: CheckStatus;
     details?: string;
+    findings?: Finding[];
 }
 /**
  *
@@ -12,7 +28,7 @@ export declare class ResultCollector {
     /**
      *
      */
-    register(name: string, status: CheckStatus, details?: string): void;
+    register(name: string, status: CheckStatus, details?: string, findings?: Finding[]): void;
     /**
      *
      */

package/dist/esm/utils/result-collector.js

@@ -8,9 +8,14 @@ export class ResultCollector {
     /**
      *
      */
-    register(name, status, details) {
+    register(name, status, details, findings) {
         const idx = this.results.findIndex(r => r.name === name);
-        const entry = { name, status, ...(details && { details }) };
+        const entry = {
+            name,
+            status,
+            ...(details && { details }),
+            ...(findings && findings.length > 0 && { findings }),
+        };
         if (idx >= 0) {
             this.results[idx] = entry;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "3.3.0",
+    "version": "4.0.0",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -9,7 +9,11 @@
         "eslint",
         "prettier",
         "code-quality",
-        "automation"
+        "automation",
+        "mcp",
+        "model-context-protocol",
+        "ai-agents",
+        "claude-code"
     ],
     "main": "./dist/cjs/index.js",
     "module": "./dist/esm/index.js",

package/pr-checkmate.schema.json

@@ -309,6 +309,41 @@
     "dockerfileSecurity": {
       "$ref": "#/$defs/toggleIgnorePaths"
     },
+    "agentInstructions": {
+      "$ref": "#/$defs/toggleIgnorePaths"
+    },
+    "mcp": {
+      "type": "object",
+      "description": "What the pr-checkmate MCP server offers an AI agent working in this project. Changes apply to the agent's next request.",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "false turns the server off for this project: it still connects, but offers no tools, resources or prompts. Default true."
+        },
+        "disabledTools": {
+          "type": "array",
+          "description": "Tools to hide from the agent.",
+          "items": {
+            "enum": [
+              "get_rules",
+              "check_changes",
+              "apply_fixes",
+              "scan_secrets",
+              "check_dependency",
+              "suggest_config",
+              "write_config",
+              "explain_config",
+              "verify"
+            ]
+          }
+        },
+        "readOnly": {
+          "type": "boolean",
+          "description": "Hide the tools that write files (apply_fixes, write_config), so the agent can only read and report. Default false."
+        }
+      }
+    },
     "migrationSafety": {
       "$ref": "#/$defs/toggleSeverity"
     },

package/src/config/pr-checkmate.schema.json

@@ -309,6 +309,41 @@
     "dockerfileSecurity": {
       "$ref": "#/$defs/toggleIgnorePaths"
     },
+    "agentInstructions": {
+      "$ref": "#/$defs/toggleIgnorePaths"
+    },
+    "mcp": {
+      "type": "object",
+      "description": "What the pr-checkmate MCP server offers an AI agent working in this project. Changes apply to the agent's next request.",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "false turns the server off for this project: it still connects, but offers no tools, resources or prompts. Default true."
+        },
+        "disabledTools": {
+          "type": "array",
+          "description": "Tools to hide from the agent.",
+          "items": {
+            "enum": [
+              "get_rules",
+              "check_changes",
+              "apply_fixes",
+              "scan_secrets",
+              "check_dependency",
+              "suggest_config",
+              "write_config",
+              "explain_config",
+              "verify"
+            ]
+          }
+        },
+        "readOnly": {
+          "type": "boolean",
+          "description": "Hide the tools that write files (apply_fixes, write_config), so the agent can only read and report. Default false."
+        }
+      }
+    },
     "migrationSafety": {
       "$ref": "#/$defs/toggleSeverity"
     },