swarm-orchestrator 7.0.0-alpha.0

package/dist/src/quality-gates/gates/duplicate-blocks.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run_duplicate_blocks_gate = run_duplicate_blocks_gate;
+const crypto = __importStar(require("crypto"));
+const file_utils_1 = require("../file-utils");
+function normalize_block(lines) {
+    return lines
+        .map(l => l.replace(/\s+$/g, ''))
+        .join('\n')
+        .trim();
+}
+function hash_block(text) {
+    return crypto.createHash('sha1').update(text).digest('hex');
+}
+async function run_duplicate_blocks_gate(ctx, config, maxFileSizeBytes) {
+    const start = Date.now();
+    const issues = [];
+    const exclude = (0, file_utils_1.compile_regexes)(config.excludeFileRegexes);
+    const blocks = new Map();
+    for (const file of ctx.files) {
+        if ((0, file_utils_1.is_excluded_by_regex)(file.relativePath, exclude)) {
+            continue;
+        }
+        const text = (0, file_utils_1.maybe_read_text)(file, maxFileSizeBytes);
+        if (!text) {
+            continue;
+        }
+        // ignore tiny files
+        const lines = text.split('\n');
+        if (lines.length < config.minLines) {
+            continue;
+        }
+        // blocks separated by blank lines (simple and deterministic)
+        let current = null;
+        const flush = () => {
+            if (!current)
+                return;
+            const cleaned = current.lines.filter(l => l.trim() !== '');
+            if (cleaned.length >= config.minLines) {
+                const normalized = normalize_block(cleaned);
+                if (normalized.length > 0) {
+                    const h = hash_block(normalized);
+                    const occ = {
+                        filePath: file.relativePath,
+                        startLine: current.startLine,
+                        lines: cleaned
+                    };
+                    const existing = blocks.get(h) || [];
+                    existing.push(occ);
+                    blocks.set(h, existing);
+                }
+            }
+            current = null;
+        };
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i] ?? '';
+            const isBlank = line.trim() === '';
+            if (isBlank) {
+                flush();
+                continue;
+            }
+            if (!current) {
+                current = { startLine: i + 1, lines: [] };
+            }
+            current.lines.push(line);
+        }
+        flush();
+    }
+    // report duplicates
+    const duplicates = Array.from(blocks.values())
+        .filter(occ => occ.length > config.maxOccurrences);
+    duplicates.sort((a, b) => b.length - a.length);
+    for (const occs of duplicates.slice(0, config.maxFindings)) {
+        const first = occs[0];
+        if (!first)
+            continue;
+        issues.push({
+            message: `duplicate code block (${occs.length} occurrences, ${first.lines.length} lines)`,
+            filePath: first.filePath,
+            line: first.startLine,
+            excerpt: first.lines.slice(0, 6).join('\n') + (first.lines.length > 6 ? '\n…' : ''),
+            hint: 'extract to a shared util/hook/middleware and reuse it'
+        });
+        // add a few more locations
+        for (const extra of occs.slice(1, 3)) {
+            issues.push({
+                message: 'duplicate also appears here',
+                filePath: extra.filePath,
+                line: extra.startLine,
+                excerpt: extra.lines.slice(0, 3).join('\n') + (extra.lines.length > 3 ? '\n…' : ''),
+            });
+        }
+        if (issues.length >= config.maxFindings) {
+            break;
+        }
+    }
+    const durationMs = Date.now() - start;
+    const status = issues.length > 0 ? 'fail' : 'pass';
+    return {
+        id: 'duplicate-blocks',
+        title: 'Duplicate code blocks under control',
+        status,
+        durationMs,
+        issues,
+        stats: {
+            uniqueBlocks: blocks.size,
+            duplicateGroups: duplicates.length,
+            issues: issues.length
+        }
+    };
+}

package/dist/src/quality-gates/gates/hardcoded-config.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run_hardcoded_config_gate = run_hardcoded_config_gate;
+const file_utils_1 = require("../file-utils");
+async function run_hardcoded_config_gate(ctx, config, maxFileSizeBytes) {
+    const start = Date.now();
+    const issues = [];
+    const banned = (0, file_utils_1.compile_regexes)(config.bannedLiteralRegexes);
+    const allowIfContains = (0, file_utils_1.compile_regexes)(config.allowIfFileContainsRegexes);
+    const exclude = (0, file_utils_1.compile_regexes)(config.excludeFileRegexes);
+    for (const file of ctx.files) {
+        if ((0, file_utils_1.is_excluded_by_regex)(file.relativePath, exclude)) {
+            continue;
+        }
+        const text = (0, file_utils_1.maybe_read_text)(file, maxFileSizeBytes);
+        if (!text) {
+            continue;
+        }
+        for (const re of banned) {
+            if (!re.test(text)) {
+                continue;
+            }
+            const allowed = allowIfContains.some(a => a.test(text));
+            if (allowed) {
+                continue;
+            }
+            issues.push({
+                message: `hardcoded config candidate matched /${re.source}/`,
+                filePath: file.relativePath,
+                hint: 'move to config/env and reference from code'
+            });
+            if (issues.length >= 50) {
+                break;
+            }
+        }
+        if (issues.length >= 50) {
+            break;
+        }
+    }
+    const durationMs = Date.now() - start;
+    const status = issues.length > 0 ? 'fail' : 'pass';
+    return {
+        id: 'hardcoded-config',
+        title: 'No obvious hardcoded config',
+        status,
+        durationMs,
+        issues,
+        stats: {
+            issues: issues.length
+        }
+    };
+}

package/dist/src/quality-gates/gates/readme-claims.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run_readme_claims_gate = run_readme_claims_gate;
+const file_utils_1 = require("../file-utils");
+function file_matches(fileRelPath, fileRegex) {
+    return fileRegex.test(fileRelPath);
+}
+async function run_readme_claims_gate(ctx, config, maxFileSizeBytes) {
+    const start = Date.now();
+    const issues = [];
+    const readmeFile = ctx.files.find(f => /^readme\.md$/i.test(f.relativePath));
+    if (!readmeFile) {
+        const durationMs = Date.now() - start;
+        return {
+            id: 'readme-claims',
+            title: 'README claims match implementation',
+            status: 'skip',
+            durationMs,
+            issues: [{ message: 'README.md not found, skipping claim checks' }]
+        };
+    }
+    const readmeText = (0, file_utils_1.maybe_read_text)(readmeFile, maxFileSizeBytes) || '';
+    for (const rule of config.claimRules) {
+        const claimRe = new RegExp(rule.readmeRegex, 'i');
+        if (!claimRe.test(readmeText)) {
+            continue;
+        }
+        for (const evidence of rule.requiredEvidence) {
+            const fileRe = new RegExp(evidence.fileRegex, 'i');
+            const contentRe = new RegExp(evidence.contentRegex, 'i');
+            const found = ctx.files.some(f => {
+                if (!file_matches(f.relativePath, fileRe)) {
+                    return false;
+                }
+                const text = f.text;
+                if (!text) {
+                    return false;
+                }
+                return contentRe.test(text);
+            });
+            if (!found) {
+                issues.push({
+                    message: `README claim matched (${rule.id}) but evidence not found: /${contentRe.source}/ in files /${fileRe.source}/`,
+                    filePath: readmeFile.relativePath,
+                    hint: evidence.note || 'either implement it or remove the claim from README'
+                });
+            }
+        }
+    }
+    const durationMs = Date.now() - start;
+    const status = issues.length > 0 ? 'fail' : 'pass';
+    return {
+        id: 'readme-claims',
+        title: 'README claims match implementation',
+        status,
+        durationMs,
+        issues,
+        stats: {
+            issues: issues.length
+        }
+    };
+}

package/dist/src/quality-gates/gates/runtime-checks.js

@@ -0,0 +1,265 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildTestCommand = buildTestCommand;
+exports.buildEslintCommand = buildEslintCommand;
+exports.run_runtime_checks_gate = run_runtime_checks_gate;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Execute a shell command with retry support.
+ * Returns success/failure with captured output. Does not throw.
+ */
+function runCommand(command, cwd, timeoutMs, retries) {
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const stdout = (0, child_process_1.execSync)(command, {
+                cwd,
+                encoding: 'utf-8',
+                timeout: timeoutMs,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                env: { ...process.env, CI: 'true', FORCE_COLOR: '0' }
+            });
+            return { success: true, stdout, stderr: '', command };
+        }
+        catch (err) {
+            const execErr = err;
+            const isLastAttempt = attempt === retries;
+            if (isLastAttempt) {
+                return {
+                    success: false,
+                    stdout: String(execErr.stdout || ''),
+                    stderr: String(execErr.stderr || ''),
+                    command
+                };
+            }
+            // Brief pause before retry (1s, 2s)
+            const delay = (attempt + 1) * 1000;
+            (0, child_process_1.execSync)(`sleep ${delay / 1000}`, { stdio: 'pipe' });
+        }
+    }
+    // Unreachable, but TypeScript needs it
+    return { success: false, stdout: '', stderr: '', command };
+}
+/**
+ * Detect whether the project has a test script in package.json.
+ */
+function hasScript(projectRoot, scriptName) {
+    const pkgPath = path.join(projectRoot, 'package.json');
+    if (!fs.existsSync(pkgPath))
+        return false;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        const script = pkg.scripts?.[scriptName];
+        // Treat missing or stub scripts as absent
+        return !!script && !script.includes('no test specified');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Detect whether eslint config exists in the project.
+ */
+function hasEslintConfig(projectRoot) {
+    const candidates = [
+        '.eslintrc',
+        '.eslintrc.js',
+        '.eslintrc.cjs',
+        '.eslintrc.json',
+        '.eslintrc.yml',
+        '.eslintrc.yaml',
+        'eslint.config.js',
+        'eslint.config.mjs',
+        'eslint.config.cjs',
+        'eslint.config.ts'
+    ];
+    for (const name of candidates) {
+        if (fs.existsSync(path.join(projectRoot, name)))
+            return true;
+    }
+    // Check package.json eslintConfig field
+    const pkgPath = path.join(projectRoot, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+            if (pkg.eslintConfig)
+                return true;
+        }
+        catch { /* ignore parse errors */ }
+    }
+    return false;
+}
+/**
+ * Build the test command, appending ignore patterns for orchestrator
+ * artifact directories. Without this, recursive test runners discover
+ * duplicate test files inside runs/worktrees and fail on missing deps
+ * or port collisions.
+ */
+function buildTestCommand(projectRoot) {
+    const pkgPath = path.join(projectRoot, 'package.json');
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        const testScript = pkg.scripts?.test || '';
+        const isJest = testScript.includes('jest') || !!pkg.jest;
+        if (isJest) {
+            return 'npm test -- --testPathIgnorePatterns=runs/ --testPathIgnorePatterns=coverage/';
+        }
+        // Node.js built-in test runner discovers files recursively from cwd.
+        // When the project has conventional test directories, scope discovery
+        // to those directories so orchestrator artifacts are excluded.
+        // Cannot use `npm test -- dir/` because npm rewrites the arg list
+        // into `node dir/` (dropping --test). Use the runner directly.
+        if (testScript.includes('node --test') && !testScript.includes('tests/') && !testScript.includes('test/')) {
+            const testDirs = [];
+            if (fs.existsSync(path.join(projectRoot, 'tests')))
+                testDirs.push("'tests/**/*.test.js'");
+            if (fs.existsSync(path.join(projectRoot, 'test')))
+                testDirs.push("'test/**/*.test.js'");
+            if (testDirs.length > 0) {
+                return `node --test ${testDirs.join(' ')}`;
+            }
+        }
+    }
+    catch { /* fall through to plain npm test */ }
+    return 'npm test';
+}
+/**
+ * Build the ESLint command, scoping to agent-changed files when a baseline
+ * commit is available. Without a baseline, falls back to scanning everything
+ * but excludes common build-output and orchestrator artifact directories.
+ */
+function buildEslintCommand(projectRoot, baseCommit) {
+    const ignoreDirs = ['dist', 'build', 'coverage', 'runs', 'plans',
+        '.next', '.turbo', '.cache', 'proof', '.quickfix', 'node_modules'];
+    if (baseCommit) {
+        try {
+            const diffOutput = (0, child_process_1.execSync)(`git diff --name-only --diff-filter=ACMR ${baseCommit} HEAD`, { cwd: projectRoot, encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+            if (!diffOutput)
+                return null;
+            const lintableExts = /\.(js|ts|jsx|tsx|mjs|cjs)$/i;
+            const changedFiles = diffOutput.split('\n')
+                .filter(f => lintableExts.test(f))
+                .filter(f => !ignoreDirs.some(d => f.startsWith(d + '/')));
+            if (changedFiles.length === 0)
+                return null;
+            // Large diffs: fall back to full scan with directory exclusions
+            if (changedFiles.length > 100) {
+                const ignoreArgs = ignoreDirs.map(d => `--ignore-pattern '${d}/'`).join(' ');
+                return `npx eslint . ${ignoreArgs} --max-warnings=0`;
+            }
+            const fileArgs = changedFiles.map(f => `'${f}'`).join(' ');
+            return `npx eslint ${fileArgs} --max-warnings=0`;
+        }
+        catch {
+            // git diff unavailable; fall through to full scan with ignores
+        }
+    }
+    const ignoreArgs = ignoreDirs.map(d => `--ignore-pattern '${d}/'`).join(' ');
+    return `npx eslint . ${ignoreArgs} --max-warnings=0`;
+}
+/**
+ * Runtime quality gate: executes the project's own test suite, linter,
+ * and security audit to validate the generated code actually works.
+ *
+ * Skipped checks (missing test script, no eslint config) are not failures.
+ */
+async function run_runtime_checks_gate(projectRoot, config, baseCommit) {
+    const start = Date.now();
+    const id = 'runtime-checks';
+    const title = 'Runtime Checks (tests, lint, audit)';
+    if (!config.enabled) {
+        return { id, title, status: 'skip', durationMs: 0, issues: [] };
+    }
+    const issues = [];
+    const stats = { testsRun: 0, lintRun: 0, auditRun: 0 };
+    // --- npm test ---
+    if (config.runTests) {
+        if (hasScript(projectRoot, 'test')) {
+            // Orchestrator artifacts (runs/, worktrees) can contain duplicate test
+            // files that confuse recursive test runners like Jest. Append ignore
+            // patterns so the gate only evaluates the project's own tests.
+            const testCmd = buildTestCommand(projectRoot);
+            const result = runCommand(testCmd, projectRoot, config.timeoutMs, config.retries);
+            stats.testsRun = 1;
+            if (!result.success) {
+                const excerpt = (result.stderr || result.stdout).split('\n').slice(-15).join('\n').trim();
+                issues.push({
+                    message: '`npm test` failed',
+                    hint: 'Fix failing tests before merge.',
+                    excerpt: excerpt.substring(0, 500)
+                });
+            }
+        }
+    }
+    // --- eslint ---
+    if (config.runLint) {
+        if (hasEslintConfig(projectRoot)) {
+            const eslintCmd = buildEslintCommand(projectRoot, baseCommit);
+            if (eslintCmd) {
+                const result = runCommand(eslintCmd, projectRoot, config.timeoutMs, config.retries);
+                stats.lintRun = 1;
+                if (!result.success) {
+                    const excerpt = (result.stdout || result.stderr).split('\n').slice(0, 20).join('\n').trim();
+                    issues.push({
+                        message: '`npx eslint` reported errors on agent-changed files',
+                        hint: 'Fix lint errors before merge.',
+                        excerpt: excerpt.substring(0, 500)
+                    });
+                }
+            }
+        }
+    }
+    // --- npm audit ---
+    if (config.runAudit) {
+        // npm audit requires a lockfile; skip for projects with no dependencies
+        if (fs.existsSync(path.join(projectRoot, 'package-lock.json'))) {
+            const result = runCommand('npm audit --audit-level=moderate --omit=dev', projectRoot, config.timeoutMs, config.retries);
+            stats.auditRun = 1;
+            if (!result.success) {
+                const excerpt = (result.stdout || result.stderr).split('\n').slice(0, 15).join('\n').trim();
+                issues.push({
+                    message: '`npm audit` found moderate+ vulnerabilities',
+                    hint: 'Run `npm audit fix` or address manually.',
+                    excerpt: excerpt.substring(0, 500)
+                });
+            }
+        }
+    }
+    const durationMs = Date.now() - start;
+    const status = issues.length > 0 ? 'fail' : 'pass';
+    return { id, title, status, durationMs, issues, stats };
+}

package/dist/src/quality-gates/gates/scaffold-defaults.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run_scaffold_defaults_gate = run_scaffold_defaults_gate;
+const file_utils_1 = require("../file-utils");
+// Artifacts that should never be tracked. Each entry maps a file pattern
+// (tested against relativePath) to the gitignore entry that would exclude it.
+// Only flagged when the artifact is actually present in the project file list,
+// so the check produces zero false positives on clean repos.
+const GITIGNORE_ARTIFACT_RULES = [
+    { filePattern: /^\.coverage$/, gitignoreEntry: '.coverage', hint: 'pytest coverage data binary' },
+    { filePattern: /\.pyc$/, gitignoreEntry: '*.pyc', hint: 'compiled Python bytecode' },
+    { filePattern: /(^|\/)__pycache__\//, gitignoreEntry: '__pycache__/', hint: 'Python bytecode cache directory' },
+    { filePattern: /^\.env$/, gitignoreEntry: '.env', hint: 'environment secrets file' },
+    { filePattern: /(^|\/)node_modules\//, gitignoreEntry: 'node_modules/', hint: 'npm dependency tree' },
+    { filePattern: /^dist\//, gitignoreEntry: 'dist/', hint: 'build output directory' },
+    { filePattern: /^\.DS_Store$/, gitignoreEntry: '.DS_Store', hint: 'macOS Finder metadata' },
+    { filePattern: /^Thumbs\.db$/, gitignoreEntry: 'Thumbs.db', hint: 'Windows thumbnail cache' },
+    { filePattern: /\.sqlite3?$/, gitignoreEntry: '*.sqlite3', hint: 'SQLite database file (should not be tracked)' },
+];
+async function run_scaffold_defaults_gate(ctx, config, maxFileSizeBytes) {
+    const start = Date.now();
+    const issues = [];
+    const bannedTitle = config.bannedTitleRegexes.map(r => new RegExp(r, 'i'));
+    const bannedReadme = config.bannedReadmeRegexes.map(r => new RegExp(r, 'i'));
+    const bannedFiles = new Set(config.bannedFiles);
+    // banned files present
+    for (const file of ctx.files) {
+        if (bannedFiles.has(file.relativePath)) {
+            issues.push({
+                message: `scaffold default file present: ${file.relativePath}`,
+                filePath: file.relativePath,
+                hint: 'delete it or replace with project-specific asset'
+            });
+        }
+    }
+    // index.html title defaults
+    const indexHtml = ctx.files.find(f => f.relativePath === 'index.html');
+    if (indexHtml) {
+        const text = (0, file_utils_1.maybe_read_text)(indexHtml, maxFileSizeBytes) || '';
+        const titleMatch = text.match(/<title>([^<]+)<\/title>/i);
+        if (titleMatch && titleMatch[1]) {
+            const title = titleMatch[1].trim();
+            for (const re of bannedTitle) {
+                if (re.test(title)) {
+                    issues.push({
+                        message: `scaffold default HTML title: "${title}"`,
+                        filePath: indexHtml.relativePath,
+                        excerpt: title,
+                        hint: 'set a real product/app name'
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    // README defaults
+    const readme = ctx.files.find(f => /^readme\.md$/i.test(f.relativePath));
+    if (readme) {
+        const text = (0, file_utils_1.maybe_read_text)(readme, maxFileSizeBytes) || '';
+        for (const re of bannedReadme) {
+            if (re.test(text)) {
+                issues.push({
+                    message: `scaffold default README content matched /${re.source}/`,
+                    filePath: readme.relativePath,
+                    hint: 'replace scaffold docs with project-specific README'
+                });
+            }
+        }
+    }
+    // Gitignore completeness: when .gitignore exists, check that tracked files
+    // don't include artifacts that should be excluded. Only flags artifacts
+    // actually present in the project, not hypothetical ones.
+    const gitignore = ctx.files.find(f => f.relativePath === '.gitignore');
+    if (gitignore) {
+        const gitignoreText = (0, file_utils_1.maybe_read_text)(gitignore, maxFileSizeBytes) || '';
+        const gitignoreLines = gitignoreText.split('\n').map(l => l.trim());
+        for (const rule of GITIGNORE_ARTIFACT_RULES) {
+            const artifactPresent = ctx.files.some(f => rule.filePattern.test(f.relativePath));
+            if (!artifactPresent)
+                continue;
+            // Check whether gitignore already covers this artifact.
+            // Simple substring match on the entry (e.g. ".coverage" appears in a line).
+            // Not full gitignore glob semantics, but catches standard entries.
+            const covered = gitignoreLines.some(line => line === rule.gitignoreEntry ||
+                line === '/' + rule.gitignoreEntry ||
+                (rule.gitignoreEntry.startsWith('*') && line === rule.gitignoreEntry));
+            if (!covered) {
+                issues.push({
+                    message: `tracked artifact should be in .gitignore: ${rule.gitignoreEntry}`,
+                    filePath: '.gitignore',
+                    hint: rule.hint,
+                });
+            }
+        }
+    }
+    const durationMs = Date.now() - start;
+    const status = issues.length > 0 ? 'fail' : 'pass';
+    return {
+        id: 'scaffold-defaults',
+        title: 'Scaffold defaults removed',
+        status,
+        durationMs,
+        issues,
+        stats: {
+            issues: issues.length
+        }
+    };
+}