pr-checkmate 3.3.0 → 4.0.1

package/dist/cjs/cli.js

@@ -1,13 +1,25 @@
 #!/usr/bin/env node
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const hook_js_1 = require("./agent/hook.js");
+const setup_js_1 = require("./agent/setup.js");
 const loader_js_1 = require("./config/loader.js");
 const commands_js_1 = require("./core/commands.js");
 const index_js_1 = require("./core/index.js");
 const doctor_js_1 = require("./core/install/doctor.js");
 const grype_db_js_1 = require("./core/install/grype-db.js");
+const sarif_js_1 = require("./core/sarif.js");
 const init_js_1 = require("./init.js");
+const serve_js_1 = require("./mcp/serve.js");
+const tools_js_1 = require("./mcp/tools.js");
+const execa_js_1 = require("./utils/execa.js");
 const index_js_2 = require("./utils/index.js");
+const package_version_js_1 = require("./utils/package-version.js");
 const argv = process.argv.slice(2);
 /**
  * Flags are separated from positional arguments so they compose with every command
@@ -54,6 +66,28 @@ function rejectConflictingScope() {
         index_js_2.logger.error('[cli]: "--all" applies only to "install". Did you mean "--full"?');
         process.exit(1);
     }
+    // `mcp` speaks a protocol on stdout and `hook` is invoked by a harness with a
+    // fixed payload: neither has anything to configure from the command line, and a
+    // flag that quietly did nothing would look like it had.
+    if ((cmd === 'mcp' || cmd === 'hook') && flags.length > 0) {
+        index_js_2.logger.error(`[cli]: "${cmd}" takes no flags, got: ${flags.join(', ')}.`);
+        process.exit(1);
+    }
+    // Only a command that runs checks has findings to export; `all`, `precommit` and a
+    // named check do, every other standalone command does not.
+    const runsChecks = !cmd || cmd === 'all' || cmd === 'precommit' || !commands_js_1.STANDALONE_COMMANDS.includes(cmd);
+    if (flags.includes('--sarif') && !runsChecks) {
+        index_js_2.logger.error('[cli]: "--sarif" applies only to commands that run checks.');
+        process.exit(1);
+    }
+    if (flags.includes('--no-hook') && cmd !== 'agent-setup') {
+        index_js_2.logger.error('[cli]: "--no-hook" applies only to "agent-setup".');
+        process.exit(1);
+    }
+    if (flags.includes('--full') && commands_js_1.AGENT_COMMANDS.includes(cmd ?? '')) {
+        index_js_2.logger.error(`[cli]: "${cmd}" reviews nothing on its own, so "--full" has no meaning.`);
+        process.exit(1);
+    }
     if (flags.includes('--full') && commands_js_1.TOOLING_COMMANDS.includes(cmd ?? '')) {
         index_js_2.logger.error(`[cli]: "${cmd}" manages tooling and reviews nothing, so "--full" has no meaning.`);
         process.exit(1);
@@ -75,6 +109,55 @@ function rejectExtraArgs() {
     index_js_2.logger.error(`[cli]: "${cmd}" takes no other arguments, got: ${args.slice(1).join(', ')}. Run them as a separate command.`);
     process.exit(1);
 }
+/**
+ * Write the report as SARIF when `--sarif` was passed. Written before the exit code
+ * is decided, so a failing run still leaves the file a dashboard needs to show why.
+ */
+function writeSarifIfRequested(report) {
+    if (!flags.includes('--sarif'))
+        return;
+    const file = node_path_1.default.resolve(process.cwd(), 'pr-checkmate.sarif');
+    node_fs_1.default.writeFileSync(file, `${JSON.stringify((0, sarif_js_1.toSarif)(report, (0, package_version_js_1.packageVersion)()), null, 2)}\n`);
+    index_js_2.logger.info(`[sarif]: wrote ${file}`);
+}
+/** Everything the harness wrote to stdin, as text; empty when stdin is closed or a terminal. */
+async function readStdin() {
+    if (process.stdin.isTTY)
+        return '';
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf-8');
+}
+/**
+ * The commands that serve AI agents. Returns whether `cmd` was one of them (and has
+ * therefore already exited); kept out of the main dispatcher so that one stays
+ * readable as the list of commands grows.
+ *
+ * `mcp` must stay ahead of anything that could print: from here until stdin closes,
+ * stdout carries protocol messages and nothing else.
+ */
+async function runAgentCommand() {
+    if (cmd === 'mcp') {
+        await (0, serve_js_1.serve)((0, tools_js_1.createServerDefinition)());
+        process.exit(0);
+    }
+    if (cmd === 'hook') {
+        // Discarded rather than shown: the harness reads stdout and stderr of a hook
+        // as instructions to the model, so only the verdict may reach either.
+        (0, execa_js_1.isolateInheritedStdio)('discard');
+        index_js_2.logger.setSink({ out: () => undefined, err: () => undefined });
+        const verdict = await (0, hook_js_1.evaluateHook)(await readStdin(), process.cwd());
+        if (verdict.stderr)
+            process.stderr.write(`${verdict.stderr}\n`);
+        process.exit(verdict.exitCode);
+    }
+    if (cmd === 'agent-setup') {
+        (0, setup_js_1.reportSetup)((0, setup_js_1.setupAgent)(process.cwd(), { hook: !flags.includes('--no-hook') }));
+        process.exit(0);
+    }
+    return false;
+}
 void (async () => {
     try {
         rejectUnknownFlags();
@@ -84,6 +167,8 @@ void (async () => {
             await (0, init_js_1.init)();
             process.exit(0);
         }
+        if (await runAgentCommand())
+            return;
         // Tooling management. These run no checks — they prepare, inspect or clean
         // up what the checks need, so they never touch the diff or the reporter.
         if (cmd === 'install') {
@@ -125,12 +210,14 @@ void (async () => {
                 index_js_2.logger.info('');
                 notice.forEach(line => index_js_2.logger.info(line));
             }
+            writeSarifIfRequested(report);
             process.exit(report.ok ? 0 : 1);
         }
         // Local pre-commit: check the staged changes (index vs HEAD), print to
         // stdout, never modify files. Exits non-zero on failure to block the commit.
         if (cmd === 'precommit') {
             const report = await (0, index_js_1.runChecks)({ staged: true, reporter: 'stdout', write: false });
+            writeSarifIfRequested(report);
             process.exit(report.ok ? 0 : 1);
         }
         // Every remaining argument is a check name, so `pr-checkmate lint spellcheck`
@@ -143,6 +230,7 @@ void (async () => {
         }
         const checkNames = [...new Set(args.map(arg => commands_js_1.COMMAND_TO_CHECK[arg]))];
         const report = await (0, index_js_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true, full });
+        writeSarifIfRequested(report);
         process.exit(report.ok ? 0 : 1);
     }
     catch (err) {

package/dist/cjs/config/constants.d.ts

@@ -95,6 +95,7 @@ export declare const SOURCE_EXTENSIONS: {
     json: string[];
     all: string[];
 };
+export declare const AGENT_SETUP_COMMAND = "npx pr-checkmate agent-setup";
 export declare const DEFAULT_COMMANDS: {
     'npx pr-checkmate init': string;
     'npx pr-checkmate all': string;
@@ -109,6 +110,7 @@ export declare const DEFAULT_COMMANDS: {
     'npx pr-checkmate diff-smell': string;
     'npx pr-checkmate pr-body': string;
     'npx pr-checkmate duplicate': string;
+    "npx pr-checkmate agent-setup": string;
 };
 /**
  * Packages allow-listed for the license check by default.

package/dist/cjs/config/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KNOWN_CONFIG_KEYS = exports.documentation = exports.FULL_CONFIG_URL = exports.DOCS_URL = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.GENERATED_DOC_FILES = exports.DIFF_SECURITY_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.TEST_PATH_GLOBS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
+exports.KNOWN_CONFIG_KEYS = exports.documentation = exports.FULL_CONFIG_URL = exports.DOCS_URL = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.AGENT_SETUP_COMMAND = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.GENERATED_DOC_FILES = exports.DIFF_SECURITY_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.TEST_PATH_GLOBS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
 /**
  * Build output, dependency, tooling, and report directories that are never
  * product code. Every check excludes them by directory-name segment match (see
@@ -228,6 +228,7 @@ exports.SOURCE_EXTENSIONS = {
     json: ['.json'],
     all: ['.ts', '.tsx', '.js', '.jsx', '.json', '.md', '.mdx'],
 };
+exports.AGENT_SETUP_COMMAND = 'npx pr-checkmate agent-setup';
 exports.DEFAULT_COMMANDS = {
     'npx pr-checkmate init': 'Create pr-checkmate.json and the CI workflow (first-run setup)',
     'npx pr-checkmate all': 'Run all checks over the changes — the PR diff in CI, your branch changes locally',
@@ -242,6 +243,7 @@ exports.DEFAULT_COMMANDS = {
     'npx pr-checkmate diff-smell': 'Scan git diff for code smells',
     'npx pr-checkmate pr-body': 'Validate PR description',
     'npx pr-checkmate duplicate': 'Detect duplicate code blocks (jscpd)',
+    [exports.AGENT_SETUP_COMMAND]: 'Connect your AI agent: MCP server, rules for it and edit hooks (writes .mcp.json)',
 };
 /**
  * Packages allow-listed for the license check by default.
@@ -323,6 +325,8 @@ exports.KNOWN_CONFIG_KEYS = new Set([
     'diffSecurity',
     'workflowSecurity',
     'dockerfileSecurity',
+    'agentInstructions',
+    'mcp',
     'sensitiveFileGuard',
     'migrationSafety',
     // dependencies

package/dist/cjs/config/pr-checkmate.template.json

@@ -97,6 +97,16 @@
     "enabled": true,
     "ignore": []
   },
+  "agentInstructions": {
+    "enabled": true,
+    "ignore": []
+  },
+  "//mcp": "What the MCP server offers an AI agent here. 'enabled': false turns it off; 'disabledTools' hides tools by name; 'readOnly' hides the ones that write files. Applies from the agent's next request.",
+  "mcp": {
+    "enabled": true,
+    "disabledTools": [],
+    "readOnly": false
+  },
   "//sensitiveFileGuard": "Flags .env files, private keys, CI config and lockfiles. 'ignorePaths' excuses ONE file by glob (a .pem test fixture); 'ignore' silences a whole CATEGORY and would excuse the next real key too — reach for ignorePaths first.",
   "sensitiveFileGuard": {
     "enabled": true,

package/dist/cjs/core/checks/findings.js

@@ -23,6 +23,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_js_1 = require("../../utils/execa.js");
 const index_js_1 = require("../../utils/index.js");
+const finding_store_js_1 = require("../finding-store.js");
 const targets_js_1 = require("../targets.js");
 const types_js_1 = require("../types.js");
 /**
@@ -391,6 +392,8 @@ exports.DEFAULT_DATAFLOW_WINDOW = 10;
 const CROSS_LINE_SQL_LABEL = 'Interpolated value reaches a query (SQL injection risk, cross-line)';
 /** `@@ ... @@` — a new hunk, and the boundary taint never crosses. */
 const DIFF_HUNK_HEADER = /^@@ /;
+/** The first line of the new side of a hunk: `@@ -3,2 +10,4 @@` → 10. */
+const HUNK_NEW_START = /^@@ -\d+(?:,\d+)? \+(\d+)/;
 /**
  * Whether this line hands `name` to a query sink.
  *
@@ -464,6 +467,9 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
     const mode = opts.comments ?? 'language';
     const ignorePaths = opts.ignorePaths ?? [];
     let syntax = 'both';
+    // Where the walk is, for findings that need to say so.
+    let file = '';
+    let newLine = 0;
     // Block comments span lines, so the state belongs to the walk, not to one line.
     let inBlockComment = false;
     // Whole files can be excluded by glob; the flag persists until the next header.
@@ -474,6 +480,7 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
     for (const line of stdout.split('\n')) {
         const header = DIFF_FILE_HEADER.exec(line);
         if (header) {
+            file = header[1];
             syntax = mode === 'language' ? commentSyntaxFor(header[1]) : 'both';
             inBlockComment = false;
             skippingFile = ignorePaths.length > 0 && (0, index_js_1.matchesAnyGlob)(header[1], ignorePaths);
@@ -482,9 +489,15 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
         }
         // Checked before the `+` filter below, which a hunk header does not satisfy.
         if (DIFF_HUNK_HEADER.test(line)) {
+            newLine = Number(HUNK_NEW_START.exec(line)?.[1] ?? 0);
             taint.reset();
             continue;
         }
+        // Counted before any skip: an ignored or excluded line still occupies a line
+        // number in the file, and the ones after it must not shift.
+        const lineNo = newLine;
+        if (line.startsWith('+'))
+            newLine++;
         if (skippingFile)
             continue;
         // Only added lines carry block-comment state: a `-` line is code being
@@ -496,18 +509,28 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
         const prepared = uncomment(line, { mode, syntax, inBlockComment });
         inBlockComment = prepared.inBlockComment;
         const asCode = stripStringLiterals(prepared.text);
-        for (const { pattern, label, severity, view } of patterns) {
-            if (pattern.test(view === 'code' ? asCode : prepared.text)) {
-                const bucket = severity === 'error' ? errors : warnings;
-                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, SAMPLE_MAX_LENGTH));
-            }
-        }
+        const where = { file, line: lineNo };
+        recordMatches(patterns, { text: prepared.text, asCode }, line, where, { errors, warnings });
         if (taint.inspect(prepared.text, asCode)) {
-            (warnings[CROSS_LINE_SQL_LABEL] ?? (warnings[CROSS_LINE_SQL_LABEL] = [])).push(line.slice(1).trim().substring(0, SAMPLE_MAX_LENGTH));
+            record(warnings, CROSS_LINE_SQL_LABEL, line, where);
         }
     }
     return { errors, warnings };
 }
+/** File one added line under `label` and remember where it was, for findings that say so. */
+function record(bucket, label, line, where) {
+    const sample = line.slice(1).trim().substring(0, SAMPLE_MAX_LENGTH);
+    (bucket[label] ?? (bucket[label] = [])).push(sample);
+    (0, finding_store_js_1.noteLocation)(label, sample, where.file, where.line);
+}
+/** File every pattern that matches one prepared line under its own label and severity. */
+function recordMatches(patterns, view, line, where, into) {
+    for (const { pattern, label, severity, view: wants } of patterns) {
+        if (pattern.test(wants === 'code' ? view.asCode : view.text)) {
+            record(severity === 'error' ? into.errors : into.warnings, label, line, where);
+        }
+    }
+}
 /**
  * Reduce one added line to what should be matched against: block comments
  * blanked (carrying the open state on), then the trailing line comment removed.
@@ -598,6 +621,7 @@ function bucketTotal(bucket) {
  */
 function reportCountedFindings(findings, ctx, opts) {
     const sev = severityEmitter(opts.severity, opts.fallback ?? 'warn');
+    (0, finding_store_js_1.fileFindings)(findings, sev.icon === '❌' ? 'error' : 'warn');
     logFindings(findings, {
         prefix: opts.prefix,
         sampleLimit: opts.sampleLimit ?? ctx.config.log?.sampleLimit ?? 3,
@@ -702,6 +726,8 @@ function reportSeverityBuckets(errorsIn, warningsIn, opts) {
     const ignore = opts.ignore ?? [];
     const filed = applyOverrides(dropIgnored(errorsIn, ignore), dropIgnored(warningsIn, ignore), opts.severityOverrides ?? {});
     const { errors, warnings } = filed;
+    (0, finding_store_js_1.fileFindings)(errors, 'error');
+    (0, finding_store_js_1.fileFindings)(warnings, 'warn');
     const totalErrors = bucketTotal(errors);
     const totalWarnings = bucketTotal(warnings);
     if (totalErrors === 0 && totalWarnings === 0)

package/dist/cjs/core/checks/git/diff-smell.js

@@ -22,7 +22,9 @@ exports.CODE_SMELLS = [
         view: 'code',
     },
     {
-        pattern: /^\+(?!\+).*\bdebugger\b/,
+        // A statement, not a mention: `debugger` ends the line or follows a `;`, `{`, `}` or `)`.
+        // A regex literal (`/debugger/`) or an object key (`{ debugger: 1 }`) is not one.
+        pattern: /^\+(?!\+)(?:.*[;{})]|\s*)\s*debugger\b\s*;?\s*$/,
         label: 'debugger statement',
         severity: 'warn',
         view: 'code',

package/dist/cjs/core/checks/git/large-files.d.ts

@@ -1,2 +1,3 @@
 import { Check } from '../../types.js';
+export declare const DEFAULT_MAX_KB = 500;
 export declare const largeFilesCheck: Check;

package/dist/cjs/core/checks/git/large-files.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.largeFilesCheck = void 0;
+exports.largeFilesCheck = exports.DEFAULT_MAX_KB = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_js_1 = require("../../../utils/execa.js");
@@ -11,7 +11,7 @@ const index_js_1 = require("../../../utils/index.js");
 const targets_js_1 = require("../../targets.js");
 const types_js_1 = require("../../types.js");
 const findings_js_1 = require("../findings.js");
-const DEFAULT_MAX_KB = 500;
+exports.DEFAULT_MAX_KB = 500;
 /**
  * Lockfiles are legitimately large and always generated, never accidental — so
  * they're exempt from the size/binary guard by default (a 600 KB
@@ -70,7 +70,7 @@ exports.largeFilesCheck = {
             return (0, types_js_1.skip)('git unavailable');
         if (files.length === 0)
             return (0, types_js_1.pass)();
-        const maxKb = ctx.config.largeFiles?.maxSizeKb ?? DEFAULT_MAX_KB;
+        const maxKb = ctx.config.largeFiles?.maxSizeKb ?? exports.DEFAULT_MAX_KB;
         const maxBytes = maxKb * 1024;
         const allow = [...LOCKFILE_ALLOW, ...(ctx.config.largeFiles?.allow ?? [])];
         if (!ctx.baseSha && ctx.config.run?.fullScanBehaviour === 'skip')

package/dist/cjs/core/checks/languages/lint.js

@@ -4,13 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lintCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const index_js_1 = require("../../../config/index.js");
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
+const finding_store_js_1 = require("../../finding-store.js");
 const reuse_js_1 = require("../../install/reuse.js");
 const targets_js_1 = require("../../targets.js");
 const types_js_1 = require("../../types.js");
+const locate_js_1 = require("./locate.js");
+const MAX_LOGGED_PROBLEMS = 50;
 /**
  * Resolve the ESLint binary under the client's `install.reuseLocal` policy.
  *
@@ -36,6 +41,17 @@ async function getESLintMajorVersion(eslintBin) {
         return 8;
     }
 }
+function readProblems(reportFile, cwd) {
+    try {
+        return (0, locate_js_1.parseEslintJson)(node_fs_1.default.readFileSync(reportFile, 'utf-8'), cwd);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        (0, index_js_2.cleanupTempFile)(reportFile);
+    }
+}
 exports.lintCheck = {
     name: 'ESLint',
     phase: 'blocking',
@@ -87,12 +103,23 @@ exports.lintCheck = {
         if (!hasLocal && version < 9 && toolRoots.length > 0) {
             args.push('--resolve-plugins-relative-to', toolRoots[0]);
         }
+        // JSON to a file, not stylish text to the terminal: the file is what lets a
+        // finding name its file, line and rule instead of saying "lint errors found".
+        // The same problems are logged below in a compact form, so nothing is lost.
+        const reportFile = node_path_1.default.join(node_os_1.default.tmpdir(), `pr-checkmate-eslint-${process.pid}-${Date.now()}.json`);
+        args.push('--format', 'json', '--output-file', reportFile);
         const result = await (0, execa_js_1.execa)(process.execPath, [eslintBin, ...args], {
             cwd: ctx.cwd,
             stdio: 'inherit',
             reject: false,
             env: { PR_CHECKMATE_TOOL_ROOTS: toolRoots.join(node_path_1.default.delimiter) },
         });
+        const problems = readProblems(reportFile, ctx.cwd);
+        problems.slice(0, MAX_LOGGED_PROBLEMS).forEach(f => {
+            index_js_2.logger.warn(`[ESLint]: ${f.file}:${f.line ?? 0}  ${f.rule}  ${f.snippet ?? ''}`);
+        });
+        if (result.exitCode === 1)
+            problems.forEach(finding_store_js_1.addFinding);
         if (result.exitCode === 0)
             return (0, types_js_1.pass)();
         // ESLint exits 1 for lint errors and 2 for a fatal error — a config it cannot

package/dist/cjs/core/checks/languages/locate.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from '../../types.js';
+/** `src/a.ts(3,5): error TS2322: Type …` lines of `tsc --pretty false`. */
+export declare function parseTscDiagnostics(output: string): Finding[];
+/** The array `eslint --format json` writes. Anything else yields no findings. */
+export declare function parseEslintJson(raw: string, cwd: string): Finding[];
+/** One path per line, as `prettier --list-different` prints them. */
+export declare function parseListDifferent(stdout: string): Finding[];

package/dist/cjs/core/checks/languages/locate.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTscDiagnostics = parseTscDiagnostics;
+exports.parseEslintJson = parseEslintJson;
+exports.parseListDifferent = parseListDifferent;
+/**
+ * Turn what the language tools print into located findings.
+ *
+ * The three tools disagree on how to say where a problem is, so each gets a small
+ * pure parser here and the checks only decide what to do with the result. Without
+ * these an agent was told "lint errors found" and nothing else.
+ */
+const node_path_1 = __importDefault(require("node:path"));
+const MAX_SNIPPET = 160;
+const TSC_DIAGNOSTIC = /^(.+?)\((\d+),\d+\): error (TS\d+): (.*)$/;
+const clip = (text) => text.length > MAX_SNIPPET ? `${text.slice(0, MAX_SNIPPET - 1)}…` : text;
+/** `src/a.ts(3,5): error TS2322: Type …` lines of `tsc --pretty false`. */
+function parseTscDiagnostics(output) {
+    const found = [];
+    for (const line of output.split('\n')) {
+        const m = TSC_DIAGNOSTIC.exec(line.trim());
+        if (m) {
+            found.push({
+                file: m[1].replace(/\\/g, '/'),
+                line: Number(m[2]),
+                rule: m[3],
+                snippet: clip(m[4]),
+                severity: 'error',
+            });
+        }
+    }
+    return found;
+}
+/** The array `eslint --format json` writes. Anything else yields no findings. */
+function parseEslintJson(raw, cwd) {
+    let report;
+    try {
+        report = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(report))
+        return [];
+    return report.flatMap(file => (file.messages ?? []).map(m => ({
+        file: node_path_1.default.relative(cwd, file.filePath).replace(/\\/g, '/'),
+        ...(m.line !== undefined && { line: m.line }),
+        rule: m.ruleId ?? 'parse-error',
+        snippet: clip(m.message),
+        severity: m.severity === 2 ? 'error' : 'warn',
+    })));
+}
+/** One path per line, as `prettier --list-different` prints them. */
+function parseListDifferent(stdout) {
+    return stdout
+        .split('\n')
+        .map(l => l.trim())
+        .filter(Boolean)
+        .map(file => ({
+        file: file.replace(/\\/g, '/'),
+        rule: 'prettier',
+        snippet: 'not formatted',
+        severity: 'warn',
+    }));
+}

package/dist/cjs/core/checks/languages/prettier.js

@@ -9,8 +9,10 @@ const node_path_1 = __importDefault(require("node:path"));
 const index_js_1 = require("../../../config/index.js");
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
+const finding_store_js_1 = require("../../finding-store.js");
 const targets_js_1 = require("../../targets.js");
 const types_js_1 = require("../../types.js");
+const locate_js_1 = require("./locate.js");
 function loadUserPrettierConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (!node_fs_1.default.existsSync(configPath))
@@ -59,7 +61,9 @@ exports.prettierCheck = {
             ignorePath = tempIgnore = createTempIgnoreFile(ctx.cwd);
         const hasLocal = (0, index_js_1.hasLocalConfig)(['.prettierrc', '.prettierrc.json', '.prettierrc.js', 'prettier.config.js'], ctx.cwd);
         // write=true → format in place; write=false → report-only (`--check`, never mutates files).
-        const mode = ctx.write ? '--write' : '--check';
+        // `--list-different` names the unformatted files on stdout, which is what lets a
+        // finding point at them; `--check` only says how many there are.
+        const mode = ctx.write ? '--write' : '--list-different';
         let tempConfig = null;
         let args;
         if (hasLocal) {
@@ -73,11 +77,20 @@ exports.prettierCheck = {
         try {
             const result = await (0, execa_js_1.execa)(process.execPath, [prettierBin, ...args], {
                 cwd: ctx.cwd,
-                stdio: 'inherit',
+                ...(ctx.write && { stdio: 'inherit' }),
                 reject: false,
             });
             if (result.exitCode === 0)
                 return (0, types_js_1.pass)();
+            if (!ctx.write) {
+                const unformatted = (0, locate_js_1.parseListDifferent)(String(result.stdout ?? ''));
+                unformatted.forEach(f => {
+                    index_js_2.logger.warn(`[Prettier]: not formatted: ${f.file}`);
+                    (0, finding_store_js_1.addFinding)(f);
+                });
+                if (result.stderr)
+                    index_js_2.logger.warn(String(result.stderr));
+            }
             // In --check mode a non-zero exit means "some files are not formatted".
             return (0, types_js_1.warn)(ctx.write ? 'prettier failed' : 'unformatted files (run with write to fix)');
         }

package/dist/cjs/core/checks/languages/typecheck.js

@@ -8,8 +8,10 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
+const finding_store_js_1 = require("../../finding-store.js");
 const reuse_js_1 = require("../../install/reuse.js");
 const types_js_1 = require("../../types.js");
+const locate_js_1 = require("./locate.js");
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
  * version it was written for; fall back to the compiler bundled with pr-checkmate.
@@ -45,7 +47,7 @@ exports.typecheckCheck = {
             return (0, types_js_1.skip)('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
         }
         const tscBin = resolveTsc(ctx);
-        const result = await (0, execa_js_1.execa)(process.execPath, [tscBin, '--noEmit'], {
+        const result = await (0, execa_js_1.execa)(process.execPath, [tscBin, '--noEmit', '--pretty', 'false'], {
             cwd: ctx.cwd,
             reject: false,
         });
@@ -62,6 +64,7 @@ exports.typecheckCheck = {
             index_js_1.logger.warn(`[TypeScript]: ⚠️ tsc exited ${result.exitCode ?? 'abnormally'} without reporting a type error — treating as a tooling failure, not a type error`);
             return (0, types_js_1.warn)(`tsc failed to run (exit ${result.exitCode ?? 'killed'})`);
         }
+        (0, locate_js_1.parseTscDiagnostics)(output).forEach(finding_store_js_1.addFinding);
         return (0, types_js_1.fail)(`${errorCount} type error(s)`);
     },
 };

package/dist/cjs/core/checks/pr/pr-size-check.d.ts

@@ -1,2 +1,4 @@
 import { Check } from '../../types.js';
+export declare const DEFAULT_MAX_FILES = 50;
+export declare const DEFAULT_MAX_LINES = 1000;
 export declare const prSizeCheck: Check;

package/dist/cjs/core/checks/pr/pr-size-check.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.prSizeCheck = void 0;
+exports.prSizeCheck = exports.DEFAULT_MAX_LINES = exports.DEFAULT_MAX_FILES = void 0;
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
 const types_js_1 = require("../../types.js");
-const DEFAULT_MAX_FILES = 50;
-const DEFAULT_MAX_LINES = 1000;
+exports.DEFAULT_MAX_FILES = 50;
+exports.DEFAULT_MAX_LINES = 1000;
 exports.prSizeCheck = {
     name: 'PR Size',
     phase: 'informational',
@@ -14,8 +14,8 @@ exports.prSizeCheck = {
         return ctx.config.prSize?.enabled !== false;
     },
     async run(ctx) {
-        const maxFiles = ctx.config.prSize?.maxFiles ?? DEFAULT_MAX_FILES;
-        const maxLines = ctx.config.prSize?.maxLines ?? DEFAULT_MAX_LINES;
+        const maxFiles = ctx.config.prSize?.maxFiles ?? exports.DEFAULT_MAX_FILES;
+        const maxLines = ctx.config.prSize?.maxLines ?? exports.DEFAULT_MAX_LINES;
         try {
             const { stdout } = await (0, execa_js_1.execa)('git', ['diff', '--shortstat', ctx.baseSha, ctx.headSha ?? 'HEAD'], {
                 cwd: ctx.cwd,

package/dist/cjs/core/checks/security/agent-instructions.d.ts

@@ -0,0 +1,4 @@
+import { Check } from '../../types.js';
+import { DiffPattern } from '../findings.js';
+export declare const AGENT_PATTERNS: DiffPattern[];
+export declare const agentInstructionsCheck: Check;