fix(core): fix config contract gaps

Author: blaycoder

packages/core/src/rules/index.ts

@@ -2,8 +2,11 @@
  * Built-in rules index.
  *
  * This is the registry of all rules that ship with @sentinel/core.
- * Third-party rules are NOT registered here — they are declared in
- * the user's sentinel.config.ts and passed to the runner directly.
+ * Only built-in rules in BUILT_IN_RULES are executed today — the runner
+ * resolves rule IDs from ScanConfig.rules via this map. Unknown rule IDs
+ * produce a config-warning ScanDiagnostic and are skipped (not executed).
+ *
+ * Custom/third-party rule loading is not yet supported and is future work.
  */
 
 import type { Rule } from '../model/rule.js'

packages/core/src/runner/scanner.test.ts

@@ -186,4 +186,50 @@ describe('scan', () => {
       rmSync(root, { recursive: true, force: true })
     }
   })
+
+  it('respects include patterns and excludes files outside them', async () => {
+    const root = createFixture()
+
+    try {
+      writeScanFixture(root, {
+        'src/in-scope.ts': "fetch('/in')",
+        'lib/out-of-scope.ts': "fetch('/out')",
+      })
+
+      const result = await scan(
+        resolveConfig({
+          rootDir: root,
+          include: ['src/**'],
+          rules: { 'missing-error-handler': 'off', 'no-hardcoded-url': 'off' },
+        }),
+      )
+
+      expect(result.stats.filesScanned).toBe(1)
+      expect(result.apiCalls.some((call) => call.url === '/in')).toBe(true)
+      expect(result.apiCalls.some((call) => call.url === '/out')).toBe(false)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it('discovers and scans .mts files with default include config', async () => {
+    const root = createFixture()
+
+    try {
+      writeScanFixture(root, {
+        'api.mts': "fetch('/mts')",
+      })
+
+      const result = await scan(
+        resolveConfig({
+          rootDir: root,
+          rules: { 'missing-error-handler': 'off', 'no-hardcoded-url': 'off' },
+        }),
+      )
+
+      expect(result.apiCalls.some((call) => call.url === '/mts')).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
 })

packages/core/src/runner/scanner.ts

@@ -92,10 +92,11 @@ export async function scan(config: ScanConfig): Promise<ScanResult> {
   const allApiCalls: ApiCall[] = []
 
   // ── Phase 1: File Discovery ──────────────────────────────────────────────
-  scanLogger.debug('Discovering files', { exclude: config.exclude })
+  scanLogger.debug('Discovering files', { include: config.include, exclude: config.exclude })
 
   const discoveryResult = await scanFiles({
     rootDir: config.rootDir,
+    include: config.include,
     extraIgnore: config.exclude,
     logger: scopedLogger(logger, 'sentinel:scan:files'),
   })

packages/core/src/scan/file-scanner.test.ts

@@ -18,16 +18,24 @@ function makeCapturingLogger(): { logger: Logger; entries: LogEntry[] } {
 
   const logger: Logger = {
     debug(message, meta) {
-      entries.push(meta === undefined ? { level: 'debug', message } : { level: 'debug', message, meta })
+      entries.push(
+        meta === undefined ? { level: 'debug', message } : { level: 'debug', message, meta },
+      )
     },
     info(message, meta) {
-      entries.push(meta === undefined ? { level: 'info', message } : { level: 'info', message, meta })
+      entries.push(
+        meta === undefined ? { level: 'info', message } : { level: 'info', message, meta },
+      )
     },
     warn(message, meta) {
-      entries.push(meta === undefined ? { level: 'warn', message } : { level: 'warn', message, meta })
+      entries.push(
+        meta === undefined ? { level: 'warn', message } : { level: 'warn', message, meta },
+      )
     },
     error(message, meta) {
-      entries.push(meta === undefined ? { level: 'error', message } : { level: 'error', message, meta })
+      entries.push(
+        meta === undefined ? { level: 'error', message } : { level: 'error', message, meta },
+      )
     },
   }
 
@@ -185,12 +193,33 @@ describe('scanFiles', () => {
 
       expect(result.value).toHaveLength(0)
       expect(
-        entries.some(
-          (e) => e.level === 'info' && e.message === 'No matching source files found',
-        ),
+        entries.some((e) => e.level === 'info' && e.message === 'No matching source files found'),
       ).toBe(true)
     } finally {
       rmSync(root, { recursive: true, force: true })
     }
   })
+
+  it('discovers .mts and .cts source files', async () => {
+    const root = createFixture()
+
+    try {
+      writeFileSync(join(root, 'app.mts'), 'export {}')
+      writeFileSync(join(root, 'app.cts'), 'export {}')
+
+      const result = await scanFiles({ rootDir: root })
+
+      expect(result.ok).toBe(true)
+      if (!result.ok) return
+
+      expect(result.value).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ relativePath: 'app.mts', extension: '.mts' }),
+          expect.objectContaining({ relativePath: 'app.cts', extension: '.cts' }),
+        ]),
+      )
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
 })

packages/core/src/scan/file-scanner.ts

@@ -32,6 +32,11 @@ export interface ScannedFile {
 export interface FileScannerOptions {
   /** Root directory to scan (must exist and be a directory). */
   readonly rootDir: string
+  /**
+   * Glob patterns a file must match at least one of to be included.
+   * When omitted or empty, all discovered source extensions are included.
+   */
+  readonly include?: readonly string[]
   /** Additional glob patterns to exclude (merged with defaults). */
   readonly extraIgnore?: readonly string[]
   /** When true (default), merge patterns from .gitignore files found during walk. */
@@ -52,7 +57,7 @@ export class FileScannerError extends Error {
 
 // ─── Constants ────────────────────────────────────────────────────────────────
 
-const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])
+const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts'])
 
 const DEFAULT_IGNORED_DIRS = new Set([
   'node_modules',
@@ -68,7 +73,10 @@ const DEFAULT_IGNORED_DIRS = new Set([
 // ─── Public API ───────────────────────────────────────────────────────────────
 
 /**
- * Recursively discover .ts, .tsx, .js, and .jsx files under rootDir.
+ * Recursively discover .ts, .tsx, .js, .jsx, .mts, and .cts files under rootDir.
+ *
+ * When `include` patterns are provided, a file must match at least one to be
+ * returned. Exclude patterns reject files that match any ignore glob.
  *
  * Non-fatal errors (permission denied on a subdirectory) warn and continue.
  * Fatal errors (root unreadable) return err().
@@ -80,10 +88,19 @@ export async function scanFiles(
   const logger = options.logger ?? noopLogger
   const respectGitignore = options.respectGitignore !== false
   const ignorePatterns = [...(options.extraIgnore ?? [])]
+  const includePatterns = [...(options.include ?? [])]
 
   try {
     const files: ScannedFile[] = []
-    await walkDir(rootDir, rootDir, ignorePatterns, respectGitignore, logger, files)
+    await walkDir(
+      rootDir,
+      rootDir,
+      ignorePatterns,
+      includePatterns,
+      respectGitignore,
+      logger,
+      files,
+    )
 
     if (files.length === 0) {
       logger.info('No matching source files found', { rootDir })
@@ -101,6 +118,7 @@ async function walkDir(
   dir: string,
   rootDir: string,
   ignorePatterns: readonly string[],
+  includePatterns: readonly string[],
   respectGitignore: boolean,
   logger: Logger,
   accumulator: ScannedFile[],
@@ -146,7 +164,15 @@ async function walkDir(
     if (entry.isDirectory()) {
       if (DEFAULT_IGNORED_DIRS.has(entry.name)) continue
       if (isIgnoredPath(relativePath, localIgnorePatterns, true)) continue
-      await walkDir(absolutePath, rootDir, localIgnorePatterns, respectGitignore, logger, accumulator)
+      await walkDir(
+        absolutePath,
+        rootDir,
+        localIgnorePatterns,
+        includePatterns,
+        respectGitignore,
+        logger,
+        accumulator,
+      )
       continue
     }
 
@@ -155,6 +181,7 @@ async function walkDir(
 
     const extension = extname(relativePath).toLowerCase()
     if (!SOURCE_EXTENSIONS.has(extension)) continue
+    if (!isIncludedPath(relativePath, includePatterns)) continue
 
     accumulator.push({
       absolutePath,
@@ -190,6 +217,11 @@ function isIgnoredPath(
   return false
 }
 
+function isIncludedPath(relativePath: string, includePatterns: readonly string[]): boolean {
+  if (includePatterns.length === 0) return true
+  return matchesAnyGlob(relativePath, includePatterns)
+}
+
 function normalizeRelativePath(path: string): string {
   return path.replace(/\\/g, '/')
 }