pr-checkmate 4.0.0 → 4.0.1

package/README.md

@@ -78,6 +78,12 @@ claude mcp add --scope user pr-checkmate -- pr-checkmate mcp   # once, for every
 npx pr-checkmate agent-setup                                   # per repository, below
 ```
 
+Then check it: `claude mcp list` shows `pr-checkmate ✔ Connected`; sessions that were already open
+need a restart. `claude` comes from the Claude Code CLI (an editor extension keeps its own copy off
+your `PATH`). To stop Claude Code asking before every call, allow `mcp__pr-checkmate` in
+`permissions.allow`
+([details](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/ai-agents.md#after-installing)).
+
 | Tool | The agent calls it |
 |---|---|
 | `get_rules` | before writing — what blocks a PR, what only warns, your custom rules and banned imports |

package/cspell.json

@@ -1377,6 +1377,7 @@
     "samd",
     "samplerate",
     "sandboxing",
+    "sarif",
     "satoshis",
     "savgol",
     "sbom",

package/dist/cjs/agent/hook.d.ts

@@ -10,7 +10,7 @@ export declare const HOOK_COMMAND = "pr-checkmate hook";
  * @returns the scope to review, or `undefined` when the line commits nothing.
  */
 export declare function commitScopeFor(command: string): ReviewScope | undefined;
-export interface HookVerdict {
+interface HookVerdict {
     /** 2 blocks the tool call, 0 lets it through. */
     exitCode: 0 | 2;
     /** Shown to the model when blocked. */
@@ -35,3 +35,4 @@ export declare const EDIT_CHECKS: readonly string[];
  * @param fallbackCwd Used when the payload carries no directory.
  */
 export declare function evaluateHook(stdin: string, fallbackCwd: string): Promise<HookVerdict>;
+export {};

package/dist/cjs/agent/setup.d.ts

@@ -2,13 +2,13 @@
 export declare function isOnPath(name: string, env?: NodeJS.ProcessEnv): boolean;
 export declare const BLOCK_START = "<!-- pr-checkmate:agent-rules:start -->";
 export declare const BLOCK_END = "<!-- pr-checkmate:agent-rules:end -->";
-export type SetupStatus = 'created' | 'updated' | 'unchanged' | 'skipped';
-export interface SetupAction {
+type SetupStatus = 'created' | 'updated' | 'unchanged' | 'skipped';
+interface SetupAction {
     file: string;
     status: SetupStatus;
     detail: string;
 }
-export interface SetupOptions {
+interface SetupOptions {
     /** Install the commit-gate hook. Default true. */
     hook?: boolean;
     /** Whether the CLI is on PATH. Detected when omitted; injectable for tests. */
@@ -18,3 +18,4 @@ export interface SetupOptions {
 export declare function setupAgent(cwd: string, opts?: SetupOptions): SetupAction[];
 /** Print what changed and the one step the repository cannot do for the user. */
 export declare function reportSetup(actions: SetupAction[]): void;
+export {};

package/dist/cjs/core/checks/git/diff-smell.js

@@ -22,7 +22,9 @@ exports.CODE_SMELLS = [
         view: 'code',
     },
     {
-        pattern: /^\+(?!\+).*\bdebugger\b/,
+        // A statement, not a mention: `debugger` ends the line or follows a `;`, `{`, `}` or `)`.
+        // A regex literal (`/debugger/`) or an object key (`{ debugger: 1 }`) is not one.
+        pattern: /^\+(?!\+)(?:.*[;{})]|\s*)\s*debugger\b\s*;?\s*$/,
         label: 'debugger statement',
         severity: 'warn',
         view: 'code',

package/dist/cjs/core/checks/languages/lint.js

@@ -4,13 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lintCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const index_js_1 = require("../../../config/index.js");
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
+const finding_store_js_1 = require("../../finding-store.js");
 const reuse_js_1 = require("../../install/reuse.js");
 const targets_js_1 = require("../../targets.js");
 const types_js_1 = require("../../types.js");
+const locate_js_1 = require("./locate.js");
+const MAX_LOGGED_PROBLEMS = 50;
 /**
  * Resolve the ESLint binary under the client's `install.reuseLocal` policy.
  *
@@ -36,6 +41,17 @@ async function getESLintMajorVersion(eslintBin) {
         return 8;
     }
 }
+function readProblems(reportFile, cwd) {
+    try {
+        return (0, locate_js_1.parseEslintJson)(node_fs_1.default.readFileSync(reportFile, 'utf-8'), cwd);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        (0, index_js_2.cleanupTempFile)(reportFile);
+    }
+}
 exports.lintCheck = {
     name: 'ESLint',
     phase: 'blocking',
@@ -87,12 +103,23 @@ exports.lintCheck = {
         if (!hasLocal && version < 9 && toolRoots.length > 0) {
             args.push('--resolve-plugins-relative-to', toolRoots[0]);
         }
+        // JSON to a file, not stylish text to the terminal: the file is what lets a
+        // finding name its file, line and rule instead of saying "lint errors found".
+        // The same problems are logged below in a compact form, so nothing is lost.
+        const reportFile = node_path_1.default.join(node_os_1.default.tmpdir(), `pr-checkmate-eslint-${process.pid}-${Date.now()}.json`);
+        args.push('--format', 'json', '--output-file', reportFile);
         const result = await (0, execa_js_1.execa)(process.execPath, [eslintBin, ...args], {
             cwd: ctx.cwd,
             stdio: 'inherit',
             reject: false,
             env: { PR_CHECKMATE_TOOL_ROOTS: toolRoots.join(node_path_1.default.delimiter) },
         });
+        const problems = readProblems(reportFile, ctx.cwd);
+        problems.slice(0, MAX_LOGGED_PROBLEMS).forEach(f => {
+            index_js_2.logger.warn(`[ESLint]: ${f.file}:${f.line ?? 0}  ${f.rule}  ${f.snippet ?? ''}`);
+        });
+        if (result.exitCode === 1)
+            problems.forEach(finding_store_js_1.addFinding);
         if (result.exitCode === 0)
             return (0, types_js_1.pass)();
         // ESLint exits 1 for lint errors and 2 for a fatal error — a config it cannot

package/dist/cjs/core/checks/languages/locate.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from '../../types.js';
+/** `src/a.ts(3,5): error TS2322: Type …` lines of `tsc --pretty false`. */
+export declare function parseTscDiagnostics(output: string): Finding[];
+/** The array `eslint --format json` writes. Anything else yields no findings. */
+export declare function parseEslintJson(raw: string, cwd: string): Finding[];
+/** One path per line, as `prettier --list-different` prints them. */
+export declare function parseListDifferent(stdout: string): Finding[];

package/dist/cjs/core/checks/languages/locate.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTscDiagnostics = parseTscDiagnostics;
+exports.parseEslintJson = parseEslintJson;
+exports.parseListDifferent = parseListDifferent;
+/**
+ * Turn what the language tools print into located findings.
+ *
+ * The three tools disagree on how to say where a problem is, so each gets a small
+ * pure parser here and the checks only decide what to do with the result. Without
+ * these an agent was told "lint errors found" and nothing else.
+ */
+const node_path_1 = __importDefault(require("node:path"));
+const MAX_SNIPPET = 160;
+const TSC_DIAGNOSTIC = /^(.+?)\((\d+),\d+\): error (TS\d+): (.*)$/;
+const clip = (text) => text.length > MAX_SNIPPET ? `${text.slice(0, MAX_SNIPPET - 1)}…` : text;
+/** `src/a.ts(3,5): error TS2322: Type …` lines of `tsc --pretty false`. */
+function parseTscDiagnostics(output) {
+    const found = [];
+    for (const line of output.split('\n')) {
+        const m = TSC_DIAGNOSTIC.exec(line.trim());
+        if (m) {
+            found.push({
+                file: m[1].replace(/\\/g, '/'),
+                line: Number(m[2]),
+                rule: m[3],
+                snippet: clip(m[4]),
+                severity: 'error',
+            });
+        }
+    }
+    return found;
+}
+/** The array `eslint --format json` writes. Anything else yields no findings. */
+function parseEslintJson(raw, cwd) {
+    let report;
+    try {
+        report = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(report))
+        return [];
+    return report.flatMap(file => (file.messages ?? []).map(m => ({
+        file: node_path_1.default.relative(cwd, file.filePath).replace(/\\/g, '/'),
+        ...(m.line !== undefined && { line: m.line }),
+        rule: m.ruleId ?? 'parse-error',
+        snippet: clip(m.message),
+        severity: m.severity === 2 ? 'error' : 'warn',
+    })));
+}
+/** One path per line, as `prettier --list-different` prints them. */
+function parseListDifferent(stdout) {
+    return stdout
+        .split('\n')
+        .map(l => l.trim())
+        .filter(Boolean)
+        .map(file => ({
+        file: file.replace(/\\/g, '/'),
+        rule: 'prettier',
+        snippet: 'not formatted',
+        severity: 'warn',
+    }));
+}

package/dist/cjs/core/checks/languages/prettier.js

@@ -9,8 +9,10 @@ const node_path_1 = __importDefault(require("node:path"));
 const index_js_1 = require("../../../config/index.js");
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_2 = require("../../../utils/index.js");
+const finding_store_js_1 = require("../../finding-store.js");
 const targets_js_1 = require("../../targets.js");
 const types_js_1 = require("../../types.js");
+const locate_js_1 = require("./locate.js");
 function loadUserPrettierConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (!node_fs_1.default.existsSync(configPath))
@@ -59,7 +61,9 @@ exports.prettierCheck = {
             ignorePath = tempIgnore = createTempIgnoreFile(ctx.cwd);
         const hasLocal = (0, index_js_1.hasLocalConfig)(['.prettierrc', '.prettierrc.json', '.prettierrc.js', 'prettier.config.js'], ctx.cwd);
         // write=true → format in place; write=false → report-only (`--check`, never mutates files).
-        const mode = ctx.write ? '--write' : '--check';
+        // `--list-different` names the unformatted files on stdout, which is what lets a
+        // finding point at them; `--check` only says how many there are.
+        const mode = ctx.write ? '--write' : '--list-different';
         let tempConfig = null;
         let args;
         if (hasLocal) {
@@ -73,11 +77,20 @@ exports.prettierCheck = {
         try {
             const result = await (0, execa_js_1.execa)(process.execPath, [prettierBin, ...args], {
                 cwd: ctx.cwd,
-                stdio: 'inherit',
+                ...(ctx.write && { stdio: 'inherit' }),
                 reject: false,
             });
             if (result.exitCode === 0)
                 return (0, types_js_1.pass)();
+            if (!ctx.write) {
+                const unformatted = (0, locate_js_1.parseListDifferent)(String(result.stdout ?? ''));
+                unformatted.forEach(f => {
+                    index_js_2.logger.warn(`[Prettier]: not formatted: ${f.file}`);
+                    (0, finding_store_js_1.addFinding)(f);
+                });
+                if (result.stderr)
+                    index_js_2.logger.warn(String(result.stderr));
+            }
             // In --check mode a non-zero exit means "some files are not formatted".
             return (0, types_js_1.warn)(ctx.write ? 'prettier failed' : 'unformatted files (run with write to fix)');
         }

package/dist/cjs/core/checks/languages/typecheck.js

@@ -8,8 +8,10 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
+const finding_store_js_1 = require("../../finding-store.js");
 const reuse_js_1 = require("../../install/reuse.js");
 const types_js_1 = require("../../types.js");
+const locate_js_1 = require("./locate.js");
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
  * version it was written for; fall back to the compiler bundled with pr-checkmate.
@@ -45,7 +47,7 @@ exports.typecheckCheck = {
             return (0, types_js_1.skip)('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
         }
         const tscBin = resolveTsc(ctx);
-        const result = await (0, execa_js_1.execa)(process.execPath, [tscBin, '--noEmit'], {
+        const result = await (0, execa_js_1.execa)(process.execPath, [tscBin, '--noEmit', '--pretty', 'false'], {
             cwd: ctx.cwd,
             reject: false,
         });
@@ -62,6 +64,7 @@ exports.typecheckCheck = {
             index_js_1.logger.warn(`[TypeScript]: ⚠️ tsc exited ${result.exitCode ?? 'abnormally'} without reporting a type error — treating as a tooling failure, not a type error`);
             return (0, types_js_1.warn)(`tsc failed to run (exit ${result.exitCode ?? 'killed'})`);
         }
+        (0, locate_js_1.parseTscDiagnostics)(output).forEach(finding_store_js_1.addFinding);
         return (0, types_js_1.fail)(`${errorCount} type error(s)`);
     },
 };

package/dist/cjs/core/sarif.d.ts

@@ -6,7 +6,9 @@
  * Only what a consumer can use is written. A failed or warned check that located
  * its problems yields one result per location; one that could not yields a single
  * result with no location, because a finding with nowhere to point is still a
- * finding. Passes and skips are not results.
+ * finding. GitHub code scanning displays only results that have a location, so
+ * those one-line summaries reach editors and other viewers, not its alerts.
+ * Passes and skips are not results.
  */
 import type { CheckReport } from './types.js';
 /** Convert a report to a SARIF log object, ready for `JSON.stringify`. */

package/dist/cjs/mcp/dependency.d.ts

@@ -5,7 +5,7 @@ export type Ecosystem = 'npm' | 'pypi';
  * `ok`      — nothing found
  * `unknown` — a lookup failed, so nothing can be said
  */
-export type Verdict = 'avoid' | 'review' | 'ok' | 'unknown';
+type Verdict = 'avoid' | 'review' | 'ok' | 'unknown';
 export interface DependencyReport {
     name: string;
     ecosystem: Ecosystem;
@@ -31,3 +31,4 @@ export declare function checkDependency(name: string, opts?: {
 }): Promise<DependencyReport>;
 /** The report as the text an agent reads. */
 export declare function formatDependency(r: DependencyReport): string;
+export {};

package/dist/cjs/mcp/dependency.js

@@ -168,21 +168,37 @@ const daysSince = (iso) => {
     const t = typeof iso === 'string' ? Date.parse(iso) : NaN;
     return Number.isNaN(t) ? undefined : Math.floor((Date.now() - t) / DAY_MS);
 };
-async function lookupNpm(name, requested, get) {
-    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
-    const res = await get(`https://registry.npmjs.org/${name.replace('/', '%2f')}`);
+/**
+ * Record why a registry answer cannot be used: "no such package" is fatal, an answer
+ * that is missing or unreadable only leaves the report incomplete. Returns `true`
+ * when the lookup should stop; `false` means `res.body` is a JSON object.
+ */
+function rejectRegistryAnswer(out, res, registry) {
     if (res.status === 404) {
         out.fatal = true;
         out.facts.exists = false;
-        out.reasons.push('not on the npm registry — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it');
-        return out;
+        out.reasons.push(`not on ${registry} — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it`);
+        return true;
     }
     if (!res.ok || !isRecord(res.body)) {
         out.incomplete = true;
-        out.reasons.push(`could not read the npm registry (${res.error ?? res.status})`);
-        return out;
+        out.reasons.push(`could not read ${registry} (${res.error ?? res.status})`);
+        return true;
     }
-    const doc = res.body;
+    return false;
+}
+/** Fetch a registry document: a fresh `Collected` plus the JSON object, absent when it cannot be used. */
+async function openRegistry(url, get, registry) {
+    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
+    const res = await get(url);
+    if (rejectRegistryAnswer(out, res, registry))
+        return { out };
+    return { out, doc: res.body };
+}
+async function lookupNpm(name, requested, get) {
+    const { out, doc } = await openRegistry(`https://registry.npmjs.org/${name.replace('/', '%2f')}`, get, 'the npm registry');
+    if (!doc)
+        return out;
     const tags = isRecord(doc['dist-tags']) ? doc['dist-tags'] : {};
     const versions = isRecord(doc.versions) ? doc.versions : {};
     const time = isRecord(doc.time) ? doc.time : {};
@@ -233,21 +249,11 @@ async function lookupNpm(name, requested, get) {
     return out;
 }
 async function lookupPypi(name, requested, get) {
-    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
-    const res = await get(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
-    if (res.status === 404) {
-        out.fatal = true;
-        out.facts.exists = false;
-        out.reasons.push('not on PyPI — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it');
+    const { out, doc } = await openRegistry(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, get, 'PyPI');
+    if (!doc)
         return out;
-    }
-    if (!res.ok || !isRecord(res.body)) {
-        out.incomplete = true;
-        out.reasons.push(`could not read PyPI (${res.error ?? res.status})`);
-        return out;
-    }
-    const info = isRecord(res.body.info) ? res.body.info : {};
-    const releases = isRecord(res.body.releases) ? res.body.releases : {};
+    const info = isRecord(doc.info) ? doc.info : {};
+    const releases = isRecord(doc.releases) ? doc.releases : {};
     out.facts.exists = true;
     if (requested && !(requested in releases)) {
         out.fatal = true;

package/dist/cjs/mcp/protocol.d.ts

@@ -13,15 +13,8 @@
  */
 /** Revisions we can speak, newest first. A client asking for another gets the newest. */
 export declare const SUPPORTED_PROTOCOLS: readonly string[];
-export type JsonRpcId = string | number | null;
-export interface JsonRpcRequest {
-    jsonrpc: '2.0';
-    /** Absent on notifications, which never get an answer. */
-    id?: JsonRpcId;
-    method: string;
-    params?: Record<string, unknown>;
-}
-export interface JsonRpcResponse {
+type JsonRpcId = string | number | null;
+interface JsonRpcResponse {
     jsonrpc: '2.0';
     id: JsonRpcId;
     result?: unknown;
@@ -95,3 +88,4 @@ export declare function negotiateProtocol(requested: unknown): string;
 export declare function handleMessage(server: ServerDefinition, message: unknown): Promise<JsonRpcResponse | null>;
 /** Decode one stdio line. A line that is not JSON gets a parse error, never a crash. */
 export declare function handleLine(server: ServerDefinition, line: string): Promise<JsonRpcResponse | null>;
+export {};

package/dist/cjs/mcp/review.d.ts

@@ -35,7 +35,7 @@ export declare function snapshotWorktree(cwd: string): Promise<{
     baseSha: string;
     headSha: string;
 } | undefined>;
-export interface ReviewOptions {
+interface ReviewOptions {
     /** Directory inside the repository to review. */
     cwd: string;
     scope?: ReviewScope;
@@ -49,7 +49,7 @@ export interface ReviewOptions {
      */
     write?: boolean;
 }
-export interface ReviewOutcome {
+interface ReviewOutcome {
     report: CheckReport;
     scope: ReviewScope;
     /** Files the diff touches; absent for `full`, which has no diff. */
@@ -61,3 +61,4 @@ export interface ReviewOutcome {
 export declare function review(opts: ReviewOptions): Promise<ReviewOutcome>;
 /** Files in the working-tree diff, with a content hash, so a later call can tell what a fixer rewrote. */
 export declare function fingerprintChanges(cwd: string): Promise<Map<string, string>>;
+export {};

package/dist/cjs/mcp/review.js

@@ -144,7 +144,7 @@ async function fingerprintChanges(cwd) {
     });
     for (const name of stdout.split('\n').filter(Boolean)) {
         const abs = node_path_1.default.join(cwd, name);
-        files.set(name, node_fs_1.default.existsSync(abs) ? (0, node_crypto_1.createHash)('sha1').update(node_fs_1.default.readFileSync(abs)).digest('hex') : '');
+        files.set(name, node_fs_1.default.existsSync(abs) ? (0, node_crypto_1.createHash)('sha256').update(node_fs_1.default.readFileSync(abs)).digest('hex') : '');
     }
     return files;
 }

package/dist/cjs/mcp/tools.js

@@ -288,6 +288,41 @@ const getRules = {
         return serialized(async () => ({ text: await describeRules(cwd) }));
     },
 };
+const SAME_SCOPE_PROPERTY = {
+    type: 'string',
+    enum: [...review_js_1.REVIEW_SCOPES],
+    description: 'Same meaning as in check_changes. Defaults to "worktree".',
+};
+/** The scope a call asks for, or the error to hand back when it is not one we know. */
+function readScope(args) {
+    const scope = args.scope ?? 'worktree';
+    if (review_js_1.REVIEW_SCOPES.includes(scope))
+        return { scope: scope };
+    return {
+        error: {
+            text: `Unknown scope "${String(scope)}". Use one of: ${review_js_1.REVIEW_SCOPES.join(', ')}.`,
+            isError: true,
+        },
+    };
+}
+const SCOPE_ONLY_SCHEMA = {
+    type: 'object',
+    properties: { scope: SAME_SCOPE_PROPERTY, ...CWD_PROPERTY },
+    additionalProperties: false,
+};
+/** Review the repository a call points at and format the outcome for the agent. */
+async function reviewFor(args, scope, extras) {
+    const cwd = await repoFor(args);
+    const outcome = await serialized(() => inDirectory(cwd, () => (0, review_js_1.review)({ cwd, scope, ...extras })));
+    return formatReport(outcome.report, outcome);
+}
+/** A review whose only argument is the scope: `scan_secrets` and `verify`. */
+async function reviewWithScope(args, extras) {
+    const asked = readScope(args);
+    if ('error' in asked)
+        return asked.error;
+    return reviewFor(args, asked.scope, extras);
+}
 const checkChanges = {
     name: 'check_changes',
     description: "Run the repository's pull-request gate on the code you have changed — uncommitted files included, nothing needs to be staged — and return the findings. " +
@@ -315,13 +350,9 @@ const checkChanges = {
         additionalProperties: false,
     },
     async run(args) {
-        const scope = args.scope ?? 'worktree';
-        if (!review_js_1.REVIEW_SCOPES.includes(scope)) {
-            return {
-                text: `Unknown scope "${String(scope)}". Use one of: ${review_js_1.REVIEW_SCOPES.join(', ')}.`,
-                isError: true,
-            };
-        }
+        const asked = readScope(args);
+        if ('error' in asked)
+            return asked.error;
         const requested = Array.isArray(args.checks) ? args.checks.map(String) : [];
         const known = new Set(registry_js_1.REGISTRY.map(c => c.name));
         const only = requested.map(name => commands_js_1.COMMAND_TO_CHECK[name] ?? name);
@@ -334,68 +365,22 @@ const checkChanges = {
                 isError: true,
             };
         }
-        const cwd = await repoFor(args);
-        const outcome = await serialized(() => inDirectory(cwd, () => (0, review_js_1.review)({ cwd, scope: scope, only, deep: args.deep === true })));
-        return formatReport(outcome.report, outcome);
+        return reviewFor(args, asked.scope, { only, deep: args.deep === true });
     },
 };
 const scanSecrets = {
     name: 'scan_secrets',
     description: 'Scan the code you have changed for committed credentials, tokens, private keys and risky additions. Run it before committing configuration, environment or credential files, and whenever a value looks like a secret.',
-    inputSchema: {
-        type: 'object',
-        properties: {
-            scope: {
-                type: 'string',
-                enum: [...review_js_1.REVIEW_SCOPES],
-                description: 'Same meaning as in check_changes. Defaults to "worktree".',
-            },
-            ...CWD_PROPERTY,
-        },
-        additionalProperties: false,
-    },
-    async run(args) {
-        const scope = args.scope ?? 'worktree';
-        if (!review_js_1.REVIEW_SCOPES.includes(scope)) {
-            return {
-                text: `Unknown scope "${String(scope)}". Use one of: ${review_js_1.REVIEW_SCOPES.join(', ')}.`,
-                isError: true,
-            };
-        }
-        const cwd = await repoFor(args);
-        const outcome = await serialized(() => inDirectory(cwd, () => (0, review_js_1.review)({ cwd, scope: scope, only: [...SECRET_CHECKS] })));
-        return formatReport(outcome.report, outcome);
-    },
+    inputSchema: SCOPE_ONLY_SCHEMA,
+    run: args => reviewWithScope(args, { only: [...SECRET_CHECKS] }),
 };
 const verify = {
     name: 'verify',
     description: 'The final gate. Runs every check the pull-request gate runs, the slow ones included (typecheck, dependency audit, spellcheck, dead code), on the code you have changed. ' +
         'Call it once when you believe the work is done and before you tell the user it is finished. ' +
         'check_changes is the quick loop while you work; a clean verify is the closest you can get to knowing CI will agree.',
-    inputSchema: {
-        type: 'object',
-        properties: {
-            scope: {
-                type: 'string',
-                enum: [...review_js_1.REVIEW_SCOPES],
-                description: 'Same meaning as in check_changes. Defaults to "worktree".',
-            },
-            ...CWD_PROPERTY,
-        },
-        additionalProperties: false,
-    },
-    async run(args) {
-        const scope = args.scope ?? 'worktree';
-        if (!review_js_1.REVIEW_SCOPES.includes(scope)) {
-            return {
-                text: `Unknown scope "${String(scope)}". Use one of: ${review_js_1.REVIEW_SCOPES.join(', ')}.`,
-                isError: true,
-            };
-        }
-        const cwd = await repoFor(args);
-        const outcome = await serialized(() => inDirectory(cwd, () => (0, review_js_1.review)({ cwd, scope: scope, deep: true })));
-        return formatReport(outcome.report, outcome);
-    },
+    inputSchema: SCOPE_ONLY_SCHEMA,
+    run: args => reviewWithScope(args, { deep: true }),
 };
 /** The only checks that can rewrite code safely: formatting and lint autofixes. */
 const FIXERS = ['Prettier', 'ESLint'];

package/dist/esm/agent/hook.d.ts

@@ -10,7 +10,7 @@ export declare const HOOK_COMMAND = "pr-checkmate hook";
  * @returns the scope to review, or `undefined` when the line commits nothing.
  */
 export declare function commitScopeFor(command: string): ReviewScope | undefined;
-export interface HookVerdict {
+interface HookVerdict {
     /** 2 blocks the tool call, 0 lets it through. */
     exitCode: 0 | 2;
     /** Shown to the model when blocked. */
@@ -35,3 +35,4 @@ export declare const EDIT_CHECKS: readonly string[];
  * @param fallbackCwd Used when the payload carries no directory.
  */
 export declare function evaluateHook(stdin: string, fallbackCwd: string): Promise<HookVerdict>;
+export {};

package/dist/esm/agent/setup.d.ts

@@ -2,13 +2,13 @@
 export declare function isOnPath(name: string, env?: NodeJS.ProcessEnv): boolean;
 export declare const BLOCK_START = "<!-- pr-checkmate:agent-rules:start -->";
 export declare const BLOCK_END = "<!-- pr-checkmate:agent-rules:end -->";
-export type SetupStatus = 'created' | 'updated' | 'unchanged' | 'skipped';
-export interface SetupAction {
+type SetupStatus = 'created' | 'updated' | 'unchanged' | 'skipped';
+interface SetupAction {
     file: string;
     status: SetupStatus;
     detail: string;
 }
-export interface SetupOptions {
+interface SetupOptions {
     /** Install the commit-gate hook. Default true. */
     hook?: boolean;
     /** Whether the CLI is on PATH. Detected when omitted; injectable for tests. */
@@ -18,3 +18,4 @@ export interface SetupOptions {
 export declare function setupAgent(cwd: string, opts?: SetupOptions): SetupAction[];
 /** Print what changed and the one step the repository cannot do for the user. */
 export declare function reportSetup(actions: SetupAction[]): void;
+export {};

package/dist/esm/core/checks/git/diff-smell.js

@@ -19,7 +19,9 @@ export const CODE_SMELLS = [
         view: 'code',
     },
     {
-        pattern: /^\+(?!\+).*\bdebugger\b/,
+        // A statement, not a mention: `debugger` ends the line or follows a `;`, `{`, `}` or `)`.
+        // A regex literal (`/debugger/`) or an object key (`{ debugger: 1 }`) is not one.
+        pattern: /^\+(?!\+)(?:.*[;{})]|\s*)\s*debugger\b\s*;?\s*$/,
         label: 'debugger statement',
         severity: 'warn',
         view: 'code',

package/dist/esm/core/checks/languages/lint.js

@@ -1,10 +1,15 @@
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { getPackageConfigPath, getSourcePaths, hasLocalConfig, IGNORE_PATTERNS, } from '../../../config/index.js';
 import { execa } from '../../../utils/execa.js';
-import { logger, registeredToolPaths, resolvePackageBin } from '../../../utils/index.js';
+import { cleanupTempFile, logger, registeredToolPaths, resolvePackageBin, } from '../../../utils/index.js';
+import { addFinding } from '../../finding-store.js';
 import { clientToolPaths } from '../../install/reuse.js';
 import { resolveScopedTargetFiles } from '../../targets.js';
 import { fail, pass, skip, warn } from '../../types.js';
+import { parseEslintJson } from './locate.js';
+const MAX_LOGGED_PROBLEMS = 50;
 /**
  * Resolve the ESLint binary under the client's `install.reuseLocal` policy.
  *
@@ -30,6 +35,17 @@ async function getESLintMajorVersion(eslintBin) {
         return 8;
     }
 }
+function readProblems(reportFile, cwd) {
+    try {
+        return parseEslintJson(fs.readFileSync(reportFile, 'utf-8'), cwd);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        cleanupTempFile(reportFile);
+    }
+}
 export const lintCheck = {
     name: 'ESLint',
     phase: 'blocking',
@@ -81,12 +97,23 @@ export const lintCheck = {
         if (!hasLocal && version < 9 && toolRoots.length > 0) {
             args.push('--resolve-plugins-relative-to', toolRoots[0]);
         }
+        // JSON to a file, not stylish text to the terminal: the file is what lets a
+        // finding name its file, line and rule instead of saying "lint errors found".
+        // The same problems are logged below in a compact form, so nothing is lost.
+        const reportFile = path.join(os.tmpdir(), `pr-checkmate-eslint-${process.pid}-${Date.now()}.json`);
+        args.push('--format', 'json', '--output-file', reportFile);
         const result = await execa(process.execPath, [eslintBin, ...args], {
             cwd: ctx.cwd,
             stdio: 'inherit',
             reject: false,
             env: { PR_CHECKMATE_TOOL_ROOTS: toolRoots.join(path.delimiter) },
         });
+        const problems = readProblems(reportFile, ctx.cwd);
+        problems.slice(0, MAX_LOGGED_PROBLEMS).forEach(f => {
+            logger.warn(`[ESLint]: ${f.file}:${f.line ?? 0}  ${f.rule}  ${f.snippet ?? ''}`);
+        });
+        if (result.exitCode === 1)
+            problems.forEach(addFinding);
         if (result.exitCode === 0)
             return pass();
         // ESLint exits 1 for lint errors and 2 for a fatal error — a config it cannot

package/dist/esm/core/checks/languages/locate.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from '../../types.js';
+/** `src/a.ts(3,5): error TS2322: Type …` lines of `tsc --pretty false`. */
+export declare function parseTscDiagnostics(output: string): Finding[];
+/** The array `eslint --format json` writes. Anything else yields no findings. */
+export declare function parseEslintJson(raw: string, cwd: string): Finding[];
+/** One path per line, as `prettier --list-different` prints them. */
+export declare function parseListDifferent(stdout: string): Finding[];

package/dist/esm/core/checks/languages/locate.js

@@ -0,0 +1,60 @@
+/**
+ * Turn what the language tools print into located findings.
+ *
+ * The three tools disagree on how to say where a problem is, so each gets a small
+ * pure parser here and the checks only decide what to do with the result. Without
+ * these an agent was told "lint errors found" and nothing else.
+ */
+import path from 'node:path';
+const MAX_SNIPPET = 160;
+const TSC_DIAGNOSTIC = /^(.+?)\((\d+),\d+\): error (TS\d+): (.*)$/;
+const clip = (text) => text.length > MAX_SNIPPET ? `${text.slice(0, MAX_SNIPPET - 1)}…` : text;
+/** `src/a.ts(3,5): error TS2322: Type …` lines of `tsc --pretty false`. */
+export function parseTscDiagnostics(output) {
+    const found = [];
+    for (const line of output.split('\n')) {
+        const m = TSC_DIAGNOSTIC.exec(line.trim());
+        if (m) {
+            found.push({
+                file: m[1].replace(/\\/g, '/'),
+                line: Number(m[2]),
+                rule: m[3],
+                snippet: clip(m[4]),
+                severity: 'error',
+            });
+        }
+    }
+    return found;
+}
+/** The array `eslint --format json` writes. Anything else yields no findings. */
+export function parseEslintJson(raw, cwd) {
+    let report;
+    try {
+        report = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(report))
+        return [];
+    return report.flatMap(file => (file.messages ?? []).map(m => ({
+        file: path.relative(cwd, file.filePath).replace(/\\/g, '/'),
+        ...(m.line !== undefined && { line: m.line }),
+        rule: m.ruleId ?? 'parse-error',
+        snippet: clip(m.message),
+        severity: m.severity === 2 ? 'error' : 'warn',
+    })));
+}
+/** One path per line, as `prettier --list-different` prints them. */
+export function parseListDifferent(stdout) {
+    return stdout
+        .split('\n')
+        .map(l => l.trim())
+        .filter(Boolean)
+        .map(file => ({
+        file: file.replace(/\\/g, '/'),
+        rule: 'prettier',
+        snippet: 'not formatted',
+        severity: 'warn',
+    }));
+}

package/dist/esm/core/checks/languages/prettier.js

@@ -3,8 +3,10 @@ import path from 'node:path';
 import { getPackageConfigPath, getSourcePaths, hasLocalConfig, IGNORE_PATTERNS, } from '../../../config/index.js';
 import { execa } from '../../../utils/execa.js';
 import { cleanupTempFile, logger, resolvePackageBin } from '../../../utils/index.js';
+import { addFinding } from '../../finding-store.js';
 import { resolveScopedTargetFiles } from '../../targets.js';
 import { pass, skip, warn } from '../../types.js';
+import { parseListDifferent } from './locate.js';
 function loadUserPrettierConfig(cwd) {
     const configPath = path.join(cwd, 'pr-checkmate.json');
     if (!fs.existsSync(configPath))
@@ -53,7 +55,9 @@ export const prettierCheck = {
             ignorePath = tempIgnore = createTempIgnoreFile(ctx.cwd);
         const hasLocal = hasLocalConfig(['.prettierrc', '.prettierrc.json', '.prettierrc.js', 'prettier.config.js'], ctx.cwd);
         // write=true → format in place; write=false → report-only (`--check`, never mutates files).
-        const mode = ctx.write ? '--write' : '--check';
+        // `--list-different` names the unformatted files on stdout, which is what lets a
+        // finding point at them; `--check` only says how many there are.
+        const mode = ctx.write ? '--write' : '--list-different';
         let tempConfig = null;
         let args;
         if (hasLocal) {
@@ -67,11 +71,20 @@ export const prettierCheck = {
         try {
             const result = await execa(process.execPath, [prettierBin, ...args], {
                 cwd: ctx.cwd,
-                stdio: 'inherit',
+                ...(ctx.write && { stdio: 'inherit' }),
                 reject: false,
             });
             if (result.exitCode === 0)
                 return pass();
+            if (!ctx.write) {
+                const unformatted = parseListDifferent(String(result.stdout ?? ''));
+                unformatted.forEach(f => {
+                    logger.warn(`[Prettier]: not formatted: ${f.file}`);
+                    addFinding(f);
+                });
+                if (result.stderr)
+                    logger.warn(String(result.stderr));
+            }
             // In --check mode a non-zero exit means "some files are not formatted".
             return warn(ctx.write ? 'prettier failed' : 'unformatted files (run with write to fix)');
         }

package/dist/esm/core/checks/languages/typecheck.js

@@ -2,8 +2,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execa } from '../../../utils/execa.js';
 import { logger, resolvePackageBin } from '../../../utils/index.js';
+import { addFinding } from '../../finding-store.js';
 import { clientToolPaths } from '../../install/reuse.js';
 import { fail, pass, skip, warn } from '../../types.js';
+import { parseTscDiagnostics } from './locate.js';
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
  * version it was written for; fall back to the compiler bundled with pr-checkmate.
@@ -39,7 +41,7 @@ export const typecheckCheck = {
             return skip('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
         }
         const tscBin = resolveTsc(ctx);
-        const result = await execa(process.execPath, [tscBin, '--noEmit'], {
+        const result = await execa(process.execPath, [tscBin, '--noEmit', '--pretty', 'false'], {
             cwd: ctx.cwd,
             reject: false,
         });
@@ -56,6 +58,7 @@ export const typecheckCheck = {
             logger.warn(`[TypeScript]: ⚠️ tsc exited ${result.exitCode ?? 'abnormally'} without reporting a type error — treating as a tooling failure, not a type error`);
             return warn(`tsc failed to run (exit ${result.exitCode ?? 'killed'})`);
         }
+        parseTscDiagnostics(output).forEach(addFinding);
         return fail(`${errorCount} type error(s)`);
     },
 };

package/dist/esm/core/sarif.d.ts

@@ -6,7 +6,9 @@
  * Only what a consumer can use is written. A failed or warned check that located
  * its problems yields one result per location; one that could not yields a single
  * result with no location, because a finding with nowhere to point is still a
- * finding. Passes and skips are not results.
+ * finding. GitHub code scanning displays only results that have a location, so
+ * those one-line summaries reach editors and other viewers, not its alerts.
+ * Passes and skips are not results.
  */
 import type { CheckReport } from './types.js';
 /** Convert a report to a SARIF log object, ready for `JSON.stringify`. */

package/dist/esm/mcp/dependency.d.ts

@@ -5,7 +5,7 @@ export type Ecosystem = 'npm' | 'pypi';
  * `ok`      — nothing found
  * `unknown` — a lookup failed, so nothing can be said
  */
-export type Verdict = 'avoid' | 'review' | 'ok' | 'unknown';
+type Verdict = 'avoid' | 'review' | 'ok' | 'unknown';
 export interface DependencyReport {
     name: string;
     ecosystem: Ecosystem;
@@ -31,3 +31,4 @@ export declare function checkDependency(name: string, opts?: {
 }): Promise<DependencyReport>;
 /** The report as the text an agent reads. */
 export declare function formatDependency(r: DependencyReport): string;
+export {};

package/dist/esm/mcp/dependency.js

@@ -163,21 +163,37 @@ const daysSince = (iso) => {
     const t = typeof iso === 'string' ? Date.parse(iso) : NaN;
     return Number.isNaN(t) ? undefined : Math.floor((Date.now() - t) / DAY_MS);
 };
-async function lookupNpm(name, requested, get) {
-    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
-    const res = await get(`https://registry.npmjs.org/${name.replace('/', '%2f')}`);
+/**
+ * Record why a registry answer cannot be used: "no such package" is fatal, an answer
+ * that is missing or unreadable only leaves the report incomplete. Returns `true`
+ * when the lookup should stop; `false` means `res.body` is a JSON object.
+ */
+function rejectRegistryAnswer(out, res, registry) {
     if (res.status === 404) {
         out.fatal = true;
         out.facts.exists = false;
-        out.reasons.push('not on the npm registry — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it');
-        return out;
+        out.reasons.push(`not on ${registry} — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it`);
+        return true;
     }
     if (!res.ok || !isRecord(res.body)) {
         out.incomplete = true;
-        out.reasons.push(`could not read the npm registry (${res.error ?? res.status})`);
-        return out;
+        out.reasons.push(`could not read ${registry} (${res.error ?? res.status})`);
+        return true;
     }
-    const doc = res.body;
+    return false;
+}
+/** Fetch a registry document: a fresh `Collected` plus the JSON object, absent when it cannot be used. */
+async function openRegistry(url, get, registry) {
+    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
+    const res = await get(url);
+    if (rejectRegistryAnswer(out, res, registry))
+        return { out };
+    return { out, doc: res.body };
+}
+async function lookupNpm(name, requested, get) {
+    const { out, doc } = await openRegistry(`https://registry.npmjs.org/${name.replace('/', '%2f')}`, get, 'the npm registry');
+    if (!doc)
+        return out;
     const tags = isRecord(doc['dist-tags']) ? doc['dist-tags'] : {};
     const versions = isRecord(doc.versions) ? doc.versions : {};
     const time = isRecord(doc.time) ? doc.time : {};
@@ -228,21 +244,11 @@ async function lookupNpm(name, requested, get) {
     return out;
 }
 async function lookupPypi(name, requested, get) {
-    const out = { reasons: [], facts: {}, fatal: false, incomplete: false };
-    const res = await get(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
-    if (res.status === 404) {
-        out.fatal = true;
-        out.facts.exists = false;
-        out.reasons.push('not on PyPI — a name that sounds right but does not exist is how hallucinated packages get squatted; do not add it');
+    const { out, doc } = await openRegistry(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, get, 'PyPI');
+    if (!doc)
         return out;
-    }
-    if (!res.ok || !isRecord(res.body)) {
-        out.incomplete = true;
-        out.reasons.push(`could not read PyPI (${res.error ?? res.status})`);
-        return out;
-    }
-    const info = isRecord(res.body.info) ? res.body.info : {};
-    const releases = isRecord(res.body.releases) ? res.body.releases : {};
+    const info = isRecord(doc.info) ? doc.info : {};
+    const releases = isRecord(doc.releases) ? doc.releases : {};
     out.facts.exists = true;
     if (requested && !(requested in releases)) {
         out.fatal = true;

package/dist/esm/mcp/protocol.d.ts

@@ -13,15 +13,8 @@
  */
 /** Revisions we can speak, newest first. A client asking for another gets the newest. */
 export declare const SUPPORTED_PROTOCOLS: readonly string[];
-export type JsonRpcId = string | number | null;
-export interface JsonRpcRequest {
-    jsonrpc: '2.0';
-    /** Absent on notifications, which never get an answer. */
-    id?: JsonRpcId;
-    method: string;
-    params?: Record<string, unknown>;
-}
-export interface JsonRpcResponse {
+type JsonRpcId = string | number | null;
+interface JsonRpcResponse {
     jsonrpc: '2.0';
     id: JsonRpcId;
     result?: unknown;
@@ -95,3 +88,4 @@ export declare function negotiateProtocol(requested: unknown): string;
 export declare function handleMessage(server: ServerDefinition, message: unknown): Promise<JsonRpcResponse | null>;
 /** Decode one stdio line. A line that is not JSON gets a parse error, never a crash. */
 export declare function handleLine(server: ServerDefinition, line: string): Promise<JsonRpcResponse | null>;
+export {};

package/dist/esm/mcp/review.d.ts

@@ -35,7 +35,7 @@ export declare function snapshotWorktree(cwd: string): Promise<{
     baseSha: string;
     headSha: string;
 } | undefined>;
-export interface ReviewOptions {
+interface ReviewOptions {
     /** Directory inside the repository to review. */
     cwd: string;
     scope?: ReviewScope;
@@ -49,7 +49,7 @@ export interface ReviewOptions {
      */
     write?: boolean;
 }
-export interface ReviewOutcome {
+interface ReviewOutcome {
     report: CheckReport;
     scope: ReviewScope;
     /** Files the diff touches; absent for `full`, which has no diff. */
@@ -61,3 +61,4 @@ export interface ReviewOutcome {
 export declare function review(opts: ReviewOptions): Promise<ReviewOutcome>;
 /** Files in the working-tree diff, with a content hash, so a later call can tell what a fixer rewrote. */
 export declare function fingerprintChanges(cwd: string): Promise<Map<string, string>>;
+export {};

package/dist/esm/mcp/review.js

@@ -133,7 +133,7 @@ export async function fingerprintChanges(cwd) {
     });
     for (const name of stdout.split('\n').filter(Boolean)) {
         const abs = path.join(cwd, name);
-        files.set(name, fs.existsSync(abs) ? createHash('sha1').update(fs.readFileSync(abs)).digest('hex') : '');
+        files.set(name, fs.existsSync(abs) ? createHash('sha256').update(fs.readFileSync(abs)).digest('hex') : '');
     }
     return files;
 }

package/dist/esm/mcp/tools.js

@@ -281,6 +281,41 @@ const getRules = {
         return serialized(async () => ({ text: await describeRules(cwd) }));
     },
 };
+const SAME_SCOPE_PROPERTY = {
+    type: 'string',
+    enum: [...REVIEW_SCOPES],
+    description: 'Same meaning as in check_changes. Defaults to "worktree".',
+};
+/** The scope a call asks for, or the error to hand back when it is not one we know. */
+function readScope(args) {
+    const scope = args.scope ?? 'worktree';
+    if (REVIEW_SCOPES.includes(scope))
+        return { scope: scope };
+    return {
+        error: {
+            text: `Unknown scope "${String(scope)}". Use one of: ${REVIEW_SCOPES.join(', ')}.`,
+            isError: true,
+        },
+    };
+}
+const SCOPE_ONLY_SCHEMA = {
+    type: 'object',
+    properties: { scope: SAME_SCOPE_PROPERTY, ...CWD_PROPERTY },
+    additionalProperties: false,
+};
+/** Review the repository a call points at and format the outcome for the agent. */
+async function reviewFor(args, scope, extras) {
+    const cwd = await repoFor(args);
+    const outcome = await serialized(() => inDirectory(cwd, () => review({ cwd, scope, ...extras })));
+    return formatReport(outcome.report, outcome);
+}
+/** A review whose only argument is the scope: `scan_secrets` and `verify`. */
+async function reviewWithScope(args, extras) {
+    const asked = readScope(args);
+    if ('error' in asked)
+        return asked.error;
+    return reviewFor(args, asked.scope, extras);
+}
 const checkChanges = {
     name: 'check_changes',
     description: "Run the repository's pull-request gate on the code you have changed — uncommitted files included, nothing needs to be staged — and return the findings. " +
@@ -308,13 +343,9 @@ const checkChanges = {
         additionalProperties: false,
     },
     async run(args) {
-        const scope = args.scope ?? 'worktree';
-        if (!REVIEW_SCOPES.includes(scope)) {
-            return {
-                text: `Unknown scope "${String(scope)}". Use one of: ${REVIEW_SCOPES.join(', ')}.`,
-                isError: true,
-            };
-        }
+        const asked = readScope(args);
+        if ('error' in asked)
+            return asked.error;
         const requested = Array.isArray(args.checks) ? args.checks.map(String) : [];
         const known = new Set(REGISTRY.map(c => c.name));
         const only = requested.map(name => COMMAND_TO_CHECK[name] ?? name);
@@ -327,68 +358,22 @@ const checkChanges = {
                 isError: true,
             };
         }
-        const cwd = await repoFor(args);
-        const outcome = await serialized(() => inDirectory(cwd, () => review({ cwd, scope: scope, only, deep: args.deep === true })));
-        return formatReport(outcome.report, outcome);
+        return reviewFor(args, asked.scope, { only, deep: args.deep === true });
     },
 };
 const scanSecrets = {
     name: 'scan_secrets',
     description: 'Scan the code you have changed for committed credentials, tokens, private keys and risky additions. Run it before committing configuration, environment or credential files, and whenever a value looks like a secret.',
-    inputSchema: {
-        type: 'object',
-        properties: {
-            scope: {
-                type: 'string',
-                enum: [...REVIEW_SCOPES],
-                description: 'Same meaning as in check_changes. Defaults to "worktree".',
-            },
-            ...CWD_PROPERTY,
-        },
-        additionalProperties: false,
-    },
-    async run(args) {
-        const scope = args.scope ?? 'worktree';
-        if (!REVIEW_SCOPES.includes(scope)) {
-            return {
-                text: `Unknown scope "${String(scope)}". Use one of: ${REVIEW_SCOPES.join(', ')}.`,
-                isError: true,
-            };
-        }
-        const cwd = await repoFor(args);
-        const outcome = await serialized(() => inDirectory(cwd, () => review({ cwd, scope: scope, only: [...SECRET_CHECKS] })));
-        return formatReport(outcome.report, outcome);
-    },
+    inputSchema: SCOPE_ONLY_SCHEMA,
+    run: args => reviewWithScope(args, { only: [...SECRET_CHECKS] }),
 };
 const verify = {
     name: 'verify',
     description: 'The final gate. Runs every check the pull-request gate runs, the slow ones included (typecheck, dependency audit, spellcheck, dead code), on the code you have changed. ' +
         'Call it once when you believe the work is done and before you tell the user it is finished. ' +
         'check_changes is the quick loop while you work; a clean verify is the closest you can get to knowing CI will agree.',
-    inputSchema: {
-        type: 'object',
-        properties: {
-            scope: {
-                type: 'string',
-                enum: [...REVIEW_SCOPES],
-                description: 'Same meaning as in check_changes. Defaults to "worktree".',
-            },
-            ...CWD_PROPERTY,
-        },
-        additionalProperties: false,
-    },
-    async run(args) {
-        const scope = args.scope ?? 'worktree';
-        if (!REVIEW_SCOPES.includes(scope)) {
-            return {
-                text: `Unknown scope "${String(scope)}". Use one of: ${REVIEW_SCOPES.join(', ')}.`,
-                isError: true,
-            };
-        }
-        const cwd = await repoFor(args);
-        const outcome = await serialized(() => inDirectory(cwd, () => review({ cwd, scope: scope, deep: true })));
-        return formatReport(outcome.report, outcome);
-    },
+    inputSchema: SCOPE_ONLY_SCHEMA,
+    run: args => reviewWithScope(args, { deep: true }),
 };
 /** The only checks that can rewrite code safely: formatting and lint autofixes. */
 const FIXERS = ['Prettier', 'ESLint'];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "4.0.0",
+    "version": "4.0.1",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -80,7 +80,7 @@
     },
     "homepage": "https://github.com/Mybono/pr_checkmate_public#readme",
     "author": "Artur Polishchuk",
-    "license": "SEE LICENSE IN LICENSE",
+    "license": "LicenseRef-PR-Checkmate-Proprietary",
     "dependencies": {
         "execa": "^9.6.0",
         "gitleaks-secret-scanner-fixed": "3.0.4",

package/src/config/cspell.json

@@ -1377,6 +1377,7 @@
     "samd",
     "samplerate",
     "sandboxing",
+    "sarif",
     "satoshis",
     "savgol",
     "sbom",