Built-in Checks

Built-in checks run under devManager.quality.builtin.*. Most use pure Node.js (filesystem + regex) with no extra install; a few call npx or an external CLI when present — those skip gracefully when the tool is absent. All checks are enabled by default.

CLI-based checks (Semgrep, Trivy, Bandit, etc.) have their own page: CLI Tool Checks →.

Dev Environment

Docker Compose

Runs docker compose ps (or docker-compose ps) and checks that every service defined in the Compose file is in running state. Fails when a service is stopped, restarting, or exited.

Setting	Default
`devManager.quality.builtin.dockerComposePs.enabled`	`true`

Port Collisions

Scans package.json scripts, VS Code launch configs, Compose files, and .env* for port numbers. Warns when the same port appears more than once across different contexts.

Setting	Default
`devManager.quality.builtin.portCollisions.enabled`	`true`

Dev Server Health

Sends an HTTP GET to the configured health path on the dev server URL. Fails when the server returns a non-2xx status or does not respond within the timeout.

Setting	Default
`devManager.quality.builtin.devServerHealth.enabled`	`true`
`devManager.quality.builtin.devServerHealth.healthPath`	`"/"`
`devManager.quality.builtin.devServerHealth.timeoutMs`	`2000`

Dev Server Logs

Scans dev server log files for lines matching the error pattern. Warns when matching lines appear.

Setting	Default
`devManager.quality.builtin.devServerLogs.enabled`	`false`

Tasks Drift

Compares devManager.project.servers (defined scripts) with VS Code tasks.json and detects missing or stale task definitions.

Setting	Default
`devManager.quality.builtin.tasksDrift.enabled`	`true`

Linters & Formatters

ESLint

Runs your project’s ESLint config (eslint.config.js, .eslintrc.*) and surfaces code-quality and style violations. Skips when no ESLint config is found.

Setting	Default
`devManager.quality.builtin.eslint.enabled`	`true`
`devManager.quality.builtin.eslint.maxWarnings`	`0`
`devManager.quality.builtin.eslint.path`	`""` (auto)

Biome

Runs biome check when biome.json (or biome.jsonc) is present. Covers linting, formatting, and import sorting in a single pass.

Setting	Default
`devManager.quality.builtin.biome.enabled`	`true`
`devManager.quality.builtin.biome.path`	`""` (auto)

OXLint

Runs the ultra-fast Oxc linter when configured for the repo (.oxlintrc.json or oxlint in package.json scripts). Up to 100× faster than ESLint.

Setting	Default
`devManager.quality.builtin.oxlint.enabled`	`true`
`devManager.quality.builtin.oxlint.path`	`""` (auto)

Prettier

Runs prettier --check on all source files. Fails when any file differs from the Prettier-formatted version. Skips when no Prettier config is found.

Setting	Default
`devManager.quality.builtin.prettierCheck.enabled`	`true`
`devManager.quality.builtin.prettierCheck.path`	`""` (auto)

Stylelint

Runs Stylelint on CSS, SCSS, and Less files using your project config. Skips when no Stylelint config is found.

Setting	Default
`devManager.quality.builtin.stylelint.enabled`	`true`
`devManager.quality.builtin.stylelint.path`	`""` (auto)

TypeScript & JavaScript

Floating Promises

Detects Promise-returning calls that are neither await-ed nor returned nor explicitly handled with .then()/.catch(). A floating promise silently swallows errors.

Setting	Default
`devManager.quality.builtin.floatingPromises.enabled`	`true`

Async/Await Misuse

Detects async callbacks passed to Array.forEach(), .then() without a corresponding .catch(), and discarded Promise.all() / Promise.race() results.

Setting	Default
`devManager.quality.builtin.asyncAwaitMisuse.enabled`	`true`

Error Handling

Detects empty catch {} blocks, catch (e) {} that ignores the error, Python except: pass, and Ruby rescue with no body.

Setting	Default
`devManager.quality.builtin.errorHandling.enabled`	`true`

Return Types

Reports TypeScript functions and methods that lack explicit return type annotations. Configurable warn/fail thresholds.

Setting	Default
`devManager.quality.builtin.returnTypes.enabled`	`true`
`devManager.quality.builtin.returnTypes.warnAt`	`10`
`devManager.quality.builtin.returnTypes.failAt`	`50`

Missing Return Types

Alias check — same purpose as Return Types above but with a different default scope. Reports exported TypeScript functions/methods without explicit return type annotations.

Setting	Default
`devManager.quality.builtin.missingReturnTypes.enabled`	`true`

React Hooks Deps

Checks useEffect, useCallback, useMemo, and useLayoutEffect for missing or extraneous dependency array items. Only runs when react is in package.json.

Setting	Default
`devManager.quality.builtin.reactHooksDeps.enabled`	`true`

React Hook Rules

Detects useEffect / useCallback / useMemo calls that are missing a dependency array entirely (second argument omitted).

Setting	Default
`devManager.quality.builtin.reactHookRules.enabled`	`true`

Dangerous Patterns

Flags inherently dangerous code: eval(), new Function(), innerHTML = assignment, document.write(), and dangerouslySetInnerHTML.

Setting	Default
`devManager.quality.builtin.dangerousPatterns.enabled`	`true`

Insecure HTTP

Flags plain http:// URLs in source files that should be https://. Ignores localhost, test fixtures, and comment-only lines.

Setting	Default
`devManager.quality.builtin.insecureHttp.enabled`	`true`

Import Hygiene

Checks for wildcard import * as usage, inconsistent file extension patterns, and self-imports (import './index' from index.ts).

Setting	Default
`devManager.quality.builtin.importHygiene.enabled`	`true`

Import Cost

Estimates the minified+gzipped size each import adds to the bundle and warns when an individual import exceeds the threshold.

Setting	Default
`devManager.quality.builtin.importCost.enabled`	`true`
`devManager.quality.builtin.importCost.warnKb`	`50`
`devManager.quality.builtin.importCost.failKb`	`200`

No Focused Tests

Warns when .only(), fit(), fdescribe(), or test.only() focus modifiers are found in committed test files. Also runs as a live diagnostic on-save.

Setting	Default
`devManager.quality.builtin.noFocusedTests.enabled`	`true`
`devManager.quality.builtin.noFocusedTests.realtime`	`true`
`devManager.quality.builtin.noFocusedTests.precommit`	`false`

tsconfig Sanity

Audits tsconfig.json for missing strict-mode flags (strict, noImplicitAny, strictNullChecks) and important compiler options.

Setting	Default
`devManager.quality.builtin.tsconfigSanity.enabled`	`true`

React & Next.js

Checks JSX, TSX, HTML, Vue, and Svelte files for common accessibility issues: missing alt text on images, empty decorative alt, unlabelled <input>, <button>, and <a> elements.

Setting	Default
`devManager.quality.builtin.a11y.enabled`	`true`

Tailwind Classes

Detects conflicting or duplicate Tailwind CSS utility classes on the same element (e.g. text-sm text-base).

Setting	Default
`devManager.quality.builtin.tailwindClasses.enabled`	`true`

Next.js Boundary

Flags 'use client' modules that import from server-only or use Node.js-only APIs. Only runs when next is in package.json.

Setting	Default
`devManager.quality.builtin.nextjsBoundary.enabled`	`true`

Architecture & Imports

Circular Imports

Detects import cycles in JavaScript/TypeScript projects using dependency-cruiser when available, falling back to a built-in DFS traversal.

Setting	Default
`devManager.quality.builtin.circularImports.enabled`	`true`

Barrel Files

Flags oversized index.ts/js re-export files. Large barrel files force bundlers to include the entire barrel, blocking tree-shaking.

Setting	Default
`devManager.quality.builtin.barrelFiles.enabled`	`true`
`devManager.quality.builtin.barrelFiles.warnAt`	`20`
`devManager.quality.builtin.barrelFiles.failAt`	`50`

Coupling Metrics

Measures afferent (incoming) and efferent (outgoing) coupling for each module and flags architecturally unstable files (high instability ratio).

Setting	Default
`devManager.quality.builtin.couplingMetrics.enabled`	`true`
`devManager.quality.builtin.couplingMetrics.warnAt`	`0.8`

Cross-Layer Imports

Enforces the import allow-list declared in devManager.quality.builtin.projectStructure.layers. Detects forbidden import directions (e.g. ui → database, commands → api).

Setting	Default
`devManager.quality.builtin.crossLayerImports.enabled`	`true`

Component Inventory

Groups similar UI components and hooks by name pattern to surface consolidation opportunities (e.g. five different Button variants).

Setting	Default
`devManager.quality.builtin.componentInventory.enabled`	`true`

Heavy Imports

Detects full-package imports of large libraries that block tree-shaking (import _ from 'lodash', import moment from 'moment'). Suggests named or subpath imports.

Setting	Default
`devManager.quality.builtin.heavyImports.enabled`	`true`

Import Depth

Warns when relative import chains go deeper than the configured limit (e.g. ../../../../utils).

Setting	Default
`devManager.quality.builtin.importDepth.enabled`	`true`
`devManager.quality.builtin.importDepth.warnDepth`	`4`
`devManager.quality.builtin.importDepth.failDepth`	`6`

Code Size & Complexity

Line Count

Warns when source files exceed configurable line-count limits. Also runs as a live diagnostic on-save.

Setting	Default
`devManager.quality.builtin.lineCount.enabled`	`true`
`devManager.quality.builtin.lineCount.realtime`	`true`
`devManager.quality.builtin.lineCount.precommit`	`false`
`devManager.quality.builtin.lineCount.warnLines`	`300`
`devManager.quality.builtin.lineCount.failLines`	`500`

Function Length

Warns when functions or methods exceed configurable line-length limits.

Setting	Default
`devManager.quality.builtin.functionLength.enabled`	`true`
`devManager.quality.builtin.functionLength.warnLines`	`40`
`devManager.quality.builtin.functionLength.failLines`	`80`

Cyclomatic Complexity

Measures cyclomatic complexity per function (number of independent paths through the code) and warns when the score exceeds the limit.

Setting	Default
`devManager.quality.builtin.complexity.enabled`	`true`
`devManager.quality.builtin.complexity.warnScore`	`10`
`devManager.quality.builtin.complexity.failScore`	`20`

File Size

Flags source files that exceed configurable KB size limits. Also runs as a live diagnostic on-save.

Setting	Default
`devManager.quality.builtin.fileSize.enabled`	`true`
`devManager.quality.builtin.fileSize.realtime`	`true`
`devManager.quality.builtin.fileSize.precommit`	`false`
`devManager.quality.builtin.fileSize.warnKb`	`50`
`devManager.quality.builtin.fileSize.failKb`	`200`

Long Lines

Warns when too many lines in a file exceed the column width limit.

Setting	Default
`devManager.quality.builtin.longLines.enabled`	`true`
`devManager.quality.builtin.longLines.maxLength`	`120`
`devManager.quality.builtin.longLines.warnPct`	`5`

Directory Depth

Warns when folder nesting exceeds a configurable depth limit.

Setting	Default
`devManager.quality.builtin.directoryDepth.enabled`	`true`
`devManager.quality.builtin.directoryDepth.warnDepth`	`7`
`devManager.quality.builtin.directoryDepth.failDepth`	`10`

Dependency Count

Warns when a project accumulates too many direct dependencies (not devDependencies) in package.json.

Setting	Default
`devManager.quality.builtin.dependencyCount.enabled`	`true`
`devManager.quality.builtin.dependencyCount.warnAt`	`50`
`devManager.quality.builtin.dependencyCount.failAt`	`100`

Parameter Count

Warns when functions or methods declare too many parameters. High parameter counts often indicate a function doing too much — consider grouping arguments into an options object.

Setting	Default
`devManager.quality.builtin.parameterCount.enabled`	`true`
`devManager.quality.builtin.parameterCount.warnAt`	`4`
`devManager.quality.builtin.parameterCount.failAt`	`7`

Type Safety

TypeScript `any` Coverage

Counts TypeScript any usage: explicit : any annotations, casts (as any), and any in generics. Reports the count and the percentage of typed declarations.

Setting	Default
`devManager.quality.builtin.anyCoverage.enabled`	`true`
`devManager.quality.builtin.anyCoverage.warnAt`	`10`
`devManager.quality.builtin.anyCoverage.failAt`	`50`

Type Coverage

Measures overall TypeScript type coverage using type-coverage CLI. Reports the percentage of typed nodes. Skips when type-coverage is not installed.

Setting	Default
`devManager.quality.builtin.typeCoverage.enabled`	`true`
`devManager.quality.builtin.typeCoverage.atLeast`	`80`

JSDoc Coverage

Measures JSDoc comment coverage for exported functions, classes, and interfaces.

Setting	Default
`devManager.quality.builtin.jsdocCoverage.enabled`	`true`
`devManager.quality.builtin.jsdocCoverage.warnAt`	`50`
`devManager.quality.builtin.jsdocCoverage.failAt`	`20`

Type Safety

Detects TypeScript type-escape hatches: as any, @ts-ignore, @ts-expect-error, and similar suppression patterns that weaken static guarantees.

Setting	Default
`devManager.quality.builtin.typeSafety.enabled`	`true`

Non-null Assertions

Warns on overuse of the postfix non-null assertion operator !. Frequent ! usage signals places where actual null guards would be safer.

Setting	Default
`devManager.quality.builtin.nonNullAssertions.enabled`	`true`
`devManager.quality.builtin.nonNullAssertions.warnAt`	`10`

tsconfig Audit

Audits tsconfig.json strictness settings and important compiler flags: strict, noImplicitAny, strictNullChecks, noUncheckedIndexedAccess, exactOptionalPropertyTypes. Suggests enabling flags that improve safety.

Setting	Default
`devManager.quality.builtin.tsConfig.enabled`	`true`

Enum Usage

Flags TypeScript enum declarations that would be safer as const objects or string union types. TypeScript enums have surprising runtime behaviour and emit extra code.

Setting	Default
`devManager.quality.builtin.enumUsage.enabled`	`true`

Broad Types

Detects over-broad TypeScript types that defeat the type system: Record<K, any>, Array<any>, loose object, and bare Function as a parameter or return type.

Setting	Default
`devManager.quality.builtin.broadTypes.enabled`	`true`

Zod Consistency

Detects drift between Zod schemas and the TypeScript types they are supposed to validate. Flags duplicated shape definitions where z.infer<> could be used instead.

Setting	Default
`devManager.quality.builtin.zodConsistency.enabled`	`true`

Zod Any

Detects z.any() fields in Zod schemas. A z.any() field silently allows anything — including malformed input — to pass validation.

Setting	Default
`devManager.quality.builtin.zodAny.enabled`	`true`

ESLint Disable

Counts eslint-disable comments and file-level suppressions. A high count indicates systematic linting bypasses that should be reviewed. Also runs as a live diagnostic on-save.

Setting	Default
`devManager.quality.builtin.eslintDisable.enabled`	`true`
`devManager.quality.builtin.eslintDisable.realtime`	`true`
`devManager.quality.builtin.eslintDisable.precommit`	`false`
`devManager.quality.builtin.eslintDisable.warnAt`	`5`

N+1 Queries

Detects ORM / query patterns that suggest N+1 database round-trips: findOne / .find() calls inside loops, missing include/with clauses on nested relations (Prisma, Drizzle, Sequelize, TypeORM).

Setting	Default
`devManager.quality.builtin.nPlusOne.enabled`	`true`

Edge Runtime Compatibility

Detects Node.js-only APIs (fs, path, crypto, process.env via CJS require) in files that will run on edge / worker runtimes (Cloudflare Workers, Vercel Edge, Deno Deploy).

Setting	Default
`devManager.quality.builtin.edgeCompat.enabled`	`true`

`use client` Boundary

Flags Next.js 'use client' modules that import from server-only or use server-exclusive APIs (database clients, Prisma, Node.js fs/crypto). These imports cause runtime errors that are hard to debug.

Setting	Default
`devManager.quality.builtin.useClientBoundary.enabled`	`true`

Test Quality

Test Ratio

Measures the ratio of test files to source files. Warns when tests are sparse relative to the codebase size.

Setting	Default
`devManager.quality.builtin.testRatio.enabled`	`true`
`devManager.quality.builtin.testRatio.warnAt`	`0.2`

Empty Tests

Detects it(), test(), describe(), def test_, and #[test] blocks that contain no assertions.

Setting	Default
`devManager.quality.builtin.emptyTests.enabled`	`true`

Test Coverage Gaps

Identifies source files with low or no test coverage by scanning for corresponding test files. Does not execute tests — uses file-name heuristics.

Setting	Default
`devManager.quality.builtin.testCoverageGaps.enabled`	`false`
`devManager.quality.builtin.testCoverageGaps.untestedSampleLimit`	`30`

LCOV Coverage

Reads an existing lcov.info or coverage-summary.json (generated by your test runner) and reports line, branch, and function coverage percentages without re-running tests.

Setting	Default
`devManager.quality.builtin.lcovCoverage.enabled`	`true`
`devManager.quality.builtin.lcovCoverage.warnAt`	`70`
`devManager.quality.builtin.lcovCoverage.failAt`	`50`

Code Hygiene

TODO Count

Counts TODO, FIXME, HACK, BUG, XXX, and NOSONAR markers in code comments. Warns when the count exceeds the threshold.

Setting	Default
`devManager.quality.builtin.todoCount.enabled`	`true`
`devManager.quality.builtin.todoCount.warnAt`	`20`
`devManager.quality.builtin.todoCount.failAt`	`50`

Commented-Out Code

Detects large blocks of commented-out source code (multi-line // or /* */ blocks that look like real code rather than explanatory comments).

Setting	Default
`devManager.quality.builtin.commentedCode.enabled`	`true`

Duplicate Files

Detects binary-identical files (same SHA-256 content hash) with different names across the project.

Setting	Default
`devManager.quality.builtin.duplicateFiles.enabled`	`true`

Mixed Indent

Detects files that mix tabs and spaces inconsistently within the same file.

Setting	Default
`devManager.quality.builtin.mixedIndent.enabled`	`true`

Encoding

Detects source files that are not UTF-8 encoded. Non-UTF-8 files cause cross-platform issues and garbled output.

Setting	Default
`devManager.quality.builtin.encoding.enabled`	`true`

Magic Numbers

Detects hardcoded numeric literals that should be extracted into named constants. Ignores common values like 0, 1, -1.

Setting	Default
`devManager.quality.builtin.magicNumbers.enabled`	`true`
`devManager.quality.builtin.magicNumbers.warnAt`	`10`

Debug Leaks

Detects debug statements left in production source files: console.log, print(), debugger, var_dump(), and dd(). Ignores console.error/console.warn.

Setting	Default
`devManager.quality.builtin.debugLeaks.enabled`	`true`

Secret Leaks

Scans source files for patterns matching hardcoded API keys, tokens, passwords, and private keys. Uses entropy analysis and common secret patterns.

Setting	Default
`devManager.quality.builtin.secretLeaks.enabled`	`true`

Gitignore Check

Detects files that are tracked by git but match patterns in .gitignore. These files should be untracked or the .gitignore pattern should be removed.

Setting	Default
`devManager.quality.builtin.gitignoreCheck.enabled`	`true`

Merge Conflict Markers

Detects unresolved git merge conflict markers (<<<<<<<, =======, >>>>>>>) left in source files. These must be resolved before committing. Live diagnostics highlight every marker on-type and on-save with error severity.

Setting	Default
`devManager.quality.builtin.mergeConflictMarker.enabled`	`true`
`devManager.quality.builtin.mergeConflictMarker.realtime`	`true`
`devManager.quality.builtin.mergeConflictMarker.precommit`	`false`

License Header

Verifies that source files (.ts, .tsx, .js, .jsx, .py, .go, .rs, etc.) contain a required license header pattern in the first 30 lines. Only activates when licenseHeader.pattern is configured. Set the pattern to a regex string such as SPDX-License-Identifier or your company copyright notice.

Setting	Default
`devManager.quality.builtin.licenseHeader.enabled`	`true`
`devManager.quality.builtin.licenseHeader.realtime`	`true`
`devManager.quality.builtin.licenseHeader.precommit`	`false`
`devManager.quality.builtin.licenseHeader.pattern`	`""`
`devManager.quality.builtin.licenseHeader.warnThreshold`	`1`
`devManager.quality.builtin.licenseHeader.failThreshold`	`10`

Documentation & Prose

README Check

Checks that README.md exists, is not empty, and contains the required sections: Installation, Usage, Contributing, and License. Also runs as a live diagnostic on-save when a README file is open.

Setting	Default
`devManager.quality.builtin.readmeCheck.enabled`	`true`
`devManager.quality.builtin.readmeCheck.realtime`	`true`
`devManager.quality.builtin.readmeCheck.precommit`	`false`

Changelog Check

Validates that CHANGELOG.md follows the Keep a Changelog format: an ## [Unreleased] section, versioned headings, and standard subsections (Added, Changed, Fixed, etc.). Also runs as a live diagnostic on-save when a CHANGELOG file is open.

Setting	Default
`devManager.quality.builtin.changelogCheck.enabled`	`true`
`devManager.quality.builtin.changelogCheck.realtime`	`true`
`devManager.quality.builtin.changelogCheck.precommit`	`false`

CODEOWNERS Check

Validates .github/CODEOWNERS for correct file paths, valid GitHub usernames/teams, and a catch-all * rule. Also runs as a live diagnostic on-save when CODEOWNERS is open.

Setting	Default
`devManager.quality.builtin.codeownersCheck.enabled`	`true`
`devManager.quality.builtin.codeownersCheck.realtime`	`true`
`devManager.quality.builtin.codeownersCheck.precommit`	`false`

Vale

Runs the Vale prose linter for documentation style consistency. Requires vale in PATH and a .vale.ini config. See CLI Tool Checks → Vale.

i18n Keys

Checks that every translation key referenced in code exists in all configured locale files, and that no locale file contains orphaned keys that are no longer used.

Setting	Default
`devManager.quality.builtin.i18nKeys.enabled`	`true`

Alex

Runs alex to catch insensitive, inconsiderate, or exclusionary language in documentation and code comments. Requires alex in PATH or resolvable via npx.

Setting	Default
`devManager.quality.builtin.alex.enabled`	`true`

Lychee

Checks all hyperlinks in Markdown and HTML files for broken URLs (404, timeout, redirect loops). Requires lychee in PATH.

Setting	Default
`devManager.quality.builtin.lychee.enabled`	`true`

Project Configuration

.env Consistency

Compares .env and .env.example (or .env.sample). Warns when .env.example contains keys absent from .env (developer may be missing a required variable). Fails when .env contains keys absent from .env.example (undocumented secret).

Setting	Default
`devManager.quality.builtin.envConsistency.enabled`	`true`

.env Linter

Lints .env files for consistency issues: duplicate keys, missing values, invalid syntax, and values that look like secrets stored without quoting.

Setting	Default
`devManager.quality.builtin.dotenvLinter.enabled`	`true`

JSON Schema Validate

For JSON and YAML files that declare a $schema property, validates that the referenced schema URI is syntactically valid and, when pointing to a local file (relative path or file:// URI), that the schema file exists on disk. Detects typos in schema URIs and broken local references — no network requests, no external tools.

Setting	Default
`devManager.quality.builtin.jsonSchemaValidate.enabled`	`true`
`devManager.quality.builtin.jsonSchemaValidate.realtime`	`true`
`devManager.quality.builtin.jsonSchemaValidate.precommit`	`false`

Lockfile Sync

Detects when a lockfile is missing despite a manifest existing, or when the lockfile is older than the manifest by mtime. Covers npm, yarn, pnpm, Cargo, Go modules, Composer, and Poetry.

Setting	Default
`devManager.quality.builtin.lockfileSync.enabled`	`true`

Node Version Consistency

Detects Node.js version mismatches across .nvmrc, .node-version, .tool-versions, package.json engines.node, and Dockerfile FROM node: lines.

Setting	Default
`devManager.quality.builtin.nodeVersionConsistency.enabled`	`true`

Build Freshness

Warns when the build output directory (dist/, build/, out/) is older than source files, suggesting the project is running on a stale build.

Setting	Default
`devManager.quality.builtin.buildFreshness.enabled`	`true`

Monorepo Workspaces

Checks npm/pnpm/yarn workspace configurations for version drift between packages and missing peerDependencies.

Setting	Default
`devManager.quality.builtin.monorepoWorkspaces.enabled`	`true`

package.json Sanity

Validates package.json structure: required fields (name, version), valid scripts, common anti-patterns (missing engines, suspicious preinstall scripts), and malformed JSON.

Setting	Default
`devManager.quality.builtin.packageJsonSanity.enabled`	`true`

Dead Exports

Detects exported functions, types, and constants that are never imported anywhere in the project. Dead exports increase bundle size and confuse consumers.

Setting	Default
`devManager.quality.builtin.deadExports.enabled`	`false`

Stale Feature Flags

Detects feature-flag constants (booleans named IS_*_ENABLED, FEATURE_*, FLAG_*) that have been set to a permanent value for more than the configured number of days, suggesting the flag code-path should be cleaned up.

Setting	Default
`devManager.quality.builtin.staleFlags.enabled`	`false`

Bundle Budget

Checks that per-route or per-chunk JavaScript bundle sizes stay within configured budgets. Uses existing webpack stats or Vite manifests — does not re-build.

Setting	Default
`devManager.quality.builtin.bundleBudget.enabled`	`false`
`devManager.quality.builtin.bundleBudget.warnKb`	`200`
`devManager.quality.builtin.bundleBudget.failKb`	`500`

Architecture DSL

Validates a declarative architecture definition file (.arch.yaml / arch.json) that specifies layer boundaries and module ownership rules. Fails when the repo structure drifts from the declared architecture.

Setting	Default
`devManager.quality.builtin.archDsl.enabled`	`false`

Security

Trojan Source

Detects bidirectional Unicode control characters (RLO, LRO, RLI, LRI, PDI, BIDI) that can make malicious code appear benign to reviewers (CVE-2021-42574).

Setting	Default
`devManager.quality.builtin.trojanSource.enabled`	`true`

Harden Runner Audit

Checks GitHub Actions workflows for missing StepSecurity Harden Runner steps, which prevent exfiltration and unexpected outbound network calls.

Setting	Default
`devManager.quality.builtin.hardenRunnerAudit.enabled`	`true`

SBOM

Generates (or checks for an existing) Software Bill of Materials for all project dependencies and validates it against the configured format (SPDX, CycloneDX).

Setting	Default
`devManager.quality.builtin.sbom.enabled`	`false`

CodeQL (Built-in)

Runs CodeQL queries locally for deep semantic vulnerability analysis. Requires the CodeQL CLI. For the cloud-based CodeQL integration see Cloud Quality Providers → CodeQL.

Setting	Default
`devManager.quality.builtin.codeql.enabled`	`false`

Runs an extended accessibility audit covering WCAG 2.1 AA rules: colour-contrast ratios, focus management, ARIA landmark roles, form labelling, and skip-link presence.

Setting	Default
`devManager.quality.builtin.a11yCheck.enabled`	`true`

GitHub Actions Audit

Audits all .github/workflows/*.yml files for security issues: unpinned action SHAs, pull_request_target abuse, template expression injection (${{ github.event.* }}), and hardcoded secrets.

Setting	Default
`devManager.quality.builtin.actionsAudit.enabled`	`true`

OpenSSF Scorecard

Runs the OpenSSF Scorecard to assess the project’s security posture across 18 dimensions: branch protection, CI tests, code review, dependency updates, etc. Requires scorecard CLI.

Setting	Default
`devManager.quality.builtin.scorecard.enabled`	`false`

Row Level Security

Checks PostgreSQL migration files for tables that are referenced in SELECT/INSERT/UPDATE/DELETE statements but have no ALTER TABLE ... ENABLE ROW LEVEL SECURITY or CREATE POLICY statement. Helps catch RLS gaps before they reach production.

Setting	Default
`devManager.quality.builtin.rlsCheck.enabled`	`true`

Container & Docker

Dockle

Runs Dockle to lint Docker images for CIS Docker Benchmark compliance. Requires dockle in PATH.

Setting	Default
`devManager.quality.builtin.dockle.enabled`	`true`
`devManager.quality.builtin.dockle.path`	`""` (auto)

Grype

Scans container images and filesystems for CVEs using Grype. Requires grype in PATH.

Setting	Default
`devManager.quality.builtin.grype.enabled`	`true`
`devManager.quality.builtin.grype.path`	`""` (auto)
`devManager.quality.builtin.grype.failOnSeverity`	`"HIGH"`

Dive

Analyses Docker image layer efficiency for wasted space using Dive. Requires dive in PATH.

Setting	Default
`devManager.quality.builtin.dive.enabled`	`true`
`devManager.quality.builtin.dive.path`	`""` (auto)
`devManager.quality.builtin.dive.warnPct`	`10`

API & Schema Breaking Changes

OASDiff (OpenAPI)

Detects breaking changes between the current branch’s OpenAPI spec and the base branch using oasdiff. Requires oasdiff in PATH.

Setting	Default
`devManager.quality.builtin.oasdiff.enabled`	`true`
`devManager.quality.builtin.oasdiff.path`	`""` (auto)

GraphQL Inspector

Detects breaking changes in GraphQL schemas between the current branch and the base branch using @graphql-inspector/cli. Requires the package installed.

Setting	Default
`devManager.quality.builtin.graphqlInspector.enabled`	`true`

Buf Breaking (Protobuf)

Detects breaking changes in Protobuf schemas using the buf CLI. Requires buf in PATH.

Setting	Default
`devManager.quality.builtin.bufBreaking.enabled`	`true`
`devManager.quality.builtin.bufBreaking.path`	`""` (auto)

Bundle & Performance

Size Limit

Checks JavaScript/TypeScript bundle sizes against size-limit thresholds configured in package.json. Requires size-limit in devDependencies.

Setting	Default
`devManager.quality.builtin.sizeLimit.enabled`	`true`

Lighthouse CI

Runs Lighthouse CI to measure performance, accessibility, SEO, and best-practice scores. Requires @lhci/cli installed and lighthouserc.* config.

Setting	Default
`devManager.quality.builtin.lighthouseCi.enabled`	`false`
`devManager.quality.builtin.lighthouseCi.path`	`""` (auto)

npm Package Authoring

Are The Types Wrong

Checks npm package exports for TypeScript compatibility issues using Are The Types Wrong (attw). Useful for library authors.

Setting	Default
`devManager.quality.builtin.attw.enabled`	`false`

Publint

Validates package.json exports, main, module, and types fields with publint. Catches common publishing mistakes.

Setting	Default
`devManager.quality.builtin.publint.enabled`	`false`

Lockfile Lint

Validates lockfile format and integrity using lockfile-lint. Warns on non-standard registries and tampered lockfile entries.

Setting	Default
`devManager.quality.builtin.lockfileLint.enabled`	`false`

npm Provenance

Checks that npm packages in the project are published with npm provenance attestation (SLSA build provenance).

Setting	Default
`devManager.quality.builtin.npmProvenance.enabled`	`false`

Syncpack

Checks monorepo package version consistency using syncpack. Detects mismatched version ranges for the same dependency across packages.

Setting	Default
`devManager.quality.builtin.syncpack.enabled`	`false`

Manypkg

Checks monorepo package constraints using manypkg. Enforces consistent dependency ranges across all packages.

Setting	Default
`devManager.quality.builtin.manypkg.enabled`	`false`

CI/CD & Observability

Sentry Source Maps

Verifies that Sentry source maps are uploaded and available for the latest release, ensuring stack traces in production are human-readable.

Setting	Default
`devManager.quality.builtin.sentrySourcemaps.enabled`	`false`

Promptfoo

Runs promptfoo tests to validate LLM prompt behaviour against a test suite. Detects prompt regressions before they reach production. Requires promptfoo installed.

Setting	Default
`devManager.quality.builtin.promptfoo.enabled`	`false`

act

Runs GitHub Actions workflows locally using the act tool to catch workflow errors before pushing. Requires act in PATH and Docker.

Setting	Default
`devManager.quality.builtin.act.enabled`	`false`

Database & Migrations

Prisma Validate

Runs prisma validate to check that your Prisma schema is syntactically correct and referentially consistent. Supports single-file prisma/schema.prisma and multi-file prisma/schema/*.prisma configurations.

Setting	Default
`devManager.quality.builtin.prismaValidate.enabled`	`true`

Check	What it detects
Prisma Validate	`prisma validate` when the Prisma CLI is available
Prisma Migrate Status	Pending / drifted Prisma migrations (needs `DATABASE_URL`)
Drizzle Check	Drizzle schema vs migration consistency
No Manual Migrations	Hand-written or hand-edited migration SQL (Drizzle, Prisma, or Atlas)
Migrations CI Gate	Fails when a migration project has no CI workflow running safety commands

pgTAP Presence

Checks that pgTAP test files (.sql files importing pgtap) exist for projects that use PostgreSQL and have significant migration history. Encourages database-level testing.

Setting	Default
`devManager.quality.builtin.pgtapPresence.enabled`	`false`

Sqruff

Runs the sqruff SQL linter for style and anti-pattern detection. Requires sqruff in PATH.

Setting	Default
`devManager.quality.builtin.sqruff.enabled`	`false`

No Manual Migrations

builtin-noManualMigrations discourages editing migration files by hand. It runs in the full Quality Hub sweep and, when realtime quality is on, re-checks on save and when watched migration/schema files change.

Stack	How it works
Drizzle	Preferred: regenerates migrations in a temp dir and diffs; fallback: `meta/_journal.json` + `drizzle-kit check`.
Prisma	`prisma migrate diff` compares schema to applied migrations. Multi-file schema supported.
Atlas	`atlas migrate validate` — `atlas.sum` checksums must match.
All	When `checkRemoved` is on, scans recent git history for deleted/renamed migration files.

"devManager.quality.builtin.noManualMigrations.enabled": true,
"devManager.quality.builtin.noManualMigrations.severity": "error",
"devManager.quality.builtin.noManualMigrations.adapters": ["drizzle", "prisma", "atlas"],
"devManager.quality.builtin.noManualMigrations.checkRemoved": true,
"devManager.quality.builtin.noManualMigrations.gitLookback": 50

Migrations CI Gate

Pure Node: fails when a Prisma/Drizzle/Atlas project has no GitHub Actions workflow that runs migration safety commands (prisma migrate diff, drizzle-kit check, atlas migrate validate). Ensures migration validation is enforced in CI.

Setting	Default
`devManager.quality.builtin.migrationsCiGate.enabled`	`true`

Agent Context — User Level

Validates user-level agent context files that apply across all projects on the machine: ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, ~/.cursor/rules/**, ~/.cursor/skills/**, and Gemini global instructions.

Check	What it detects
CLAUDE.md	Oversized or structurally invalid user-level CLAUDE.md
Codex	Oversized or structurally invalid user-level AGENTS.md for Codex
Cursor Rules	Missing/invalid frontmatter in `~/.cursor/rules/*.mdc`
Gemini	Oversized user-level Gemini instruction file
Global Inventory	Counts all agent context files across all platforms
Skills	Validates `~/.cursor/skills/**` SKILL.md files
Total Budget	Combined token budget across all user-level agent files
Cyrillic	Cyrillic text in user instructions (~2.75× token cost)
Secrets in Context	Leaked API keys in user-level context files

"devManager.quality.builtin.agentContextUser.enabled": true

AI Agent Context

Project-scope checks for every file an AI coding agent reads before acting (AGENTS.md, CLAUDE.md, GEMINI.md, .github/copilot-instructions.md, Cursor / Windsurf / Zed rules, slash commands, chatmodes, Anthropic Skills, and @import graphs).

Check	What it detects
Context Budget	Combined token budget across all agent-visible files
Line Count / File Size	Per-file caps for AGENTS.md, CLAUDE.md, copilot-instructions.md
Recommended Sections	Enforces the SnakeFlow 10-section AGENTS.md template
Structure Block Drift	Warns when the managed `<!-- SNAKEFLOW:STRUCTURE -->` block in AGENTS.md has drifted
Import Graph	Rejects `@import` chains deeper than 5 levels or with cycles
Cursor Rules Frontmatter	Validates YAML frontmatter for `.cursor/rules/*.mdc`
CLAUDE.md ↔ AGENTS.md Sync	Flags significant content drift between the two files
Absolute Paths	Machine-specific paths that break on other machines
Secrets in Context	Leaked API keys / tokens inside any agent context file
Cyrillic Outside Code	Cyrillic text in instructions (~2.75× token cost per ACL 2023)
Orphaned / Duplicate Rules	Unreferenced or duplicated rule files across platforms

"devManager.quality.builtin.agentContext.enabled": true

Project Structure

Validates import directions between architectural layers declared in devManager.quality.builtin.projectStructure.layers. Each file belongs to the first layer whose path glob matches; its imports must resolve to layers in canImport.

{
  "name": "auth", "path": "src/auth/**", "canImport": ["utils"],
  "exceptions": [
    { "file": "src/auth/service.ts", "canImport": ["utils", "crypto"] }
  ]
}

Config validation checks for duplicate names, unknown references, and cyclic canImport edges before scanning.

See dependency-cruiser for the complementary CLI-based check.

"devManager.quality.builtin.projectStructure.enabled": true

Security & Reliability

Unsafe DOM

Detects usage of dangerous DOM APIs — dangerouslySetInnerHTML, document.write, innerHTML =, eval(), and new Function() — that can introduce XSS vulnerabilities in JavaScript and TypeScript files. Runs on-type and on-save with a 400 ms debounce.

Setting	Default
`devManager.quality.builtin.unsafeDom.enabled`	`true`
`devManager.quality.builtin.unsafeDom.realtime`	`true`
`devManager.quality.builtin.unsafeDom.precommit`	`false`

Regex DoS

Detects regular expressions with nested quantifiers that can cause catastrophic backtracking (ReDoS). Patterns like (.+)+ or (a*)* can freeze the event loop on adversarial input. Runs on-save for JS/TS files.

Setting	Default
`devManager.quality.builtin.regexDoS.enabled`	`true`
`devManager.quality.builtin.regexDoS.realtime`	`true`
`devManager.quality.builtin.regexDoS.precommit`	`false`

Code Style

Import Sort

Detects import blocks that are out of the expected order: external packages first, then workspace imports, then relative imports. Runs on-save for JS/TS/JSX/TSX files without invoking ESLint.

Setting	Default
`devManager.quality.builtin.importSortDelta.enabled`	`true`
`devManager.quality.builtin.importSortDelta.realtime`	`true`
`devManager.quality.builtin.importSortDelta.precommit`	`false`

Duplicate String Literals

Finds repeated user-facing string literals in JSX/TSX files to nudge i18n extraction. Only strings longer than minLength characters that appear at least minCount times in the same file are flagged. Runs on-save.

Setting	Default
`devManager.quality.builtin.duplicateStringLiteral.enabled`	`true`
`devManager.quality.builtin.duplicateStringLiteral.realtime`	`true`
`devManager.quality.builtin.duplicateStringLiteral.precommit`	`false`
`devManager.quality.builtin.duplicateStringLiteral.minLength`	`10`
`devManager.quality.builtin.duplicateStringLiteral.minCount`	`3`

Shebang Portability

Warns when shell scripts use a non-portable absolute-path shebang (e.g. #!/bin/bash) instead of the portable #!/usr/bin/env bash. Runs on-save for shell script files.

Setting	Default
`devManager.quality.builtin.shebangPortability.enabled`	`true`
`devManager.quality.builtin.shebangPortability.realtime`	`true`
`devManager.quality.builtin.shebangPortability.precommit`	`false`

Language Manifests

Cargo.toml Sanity

Validates Rust Cargo.toml manifests for the required [package] section and essential fields: name, version, and edition. Analogous to the Package JSON Sanity check for Rust projects. Runs on-save.

Setting	Default
`devManager.quality.builtin.cargoToml.enabled`	`true`
`devManager.quality.builtin.cargoToml.realtime`	`true`
`devManager.quality.builtin.cargoToml.precommit`	`false`

pyproject.toml Sanity

Validates Python pyproject.toml manifests for a required [project] section (PEP 517/518) or [tool.poetry] section (Poetry). Runs on-save.

Setting	Default
`devManager.quality.builtin.pyProject.enabled`	`true`
`devManager.quality.builtin.pyProject.realtime`	`true`
`devManager.quality.builtin.pyProject.precommit`	`false`

Git & Versioning

Git LFS Pointer

Detects binary files that are Git LFS pointer files instead of actual content. A pointer file starts with version https://git-lfs.github.com/spec/v1. Run git lfs pull to fetch the real content. Runs on-save.

Setting	Default
`devManager.quality.builtin.gitLfsPointer.enabled`	`true`
`devManager.quality.builtin.gitLfsPointer.realtime`	`true`
`devManager.quality.builtin.gitLfsPointer.precommit`	`false`

Branch Behind Main

Checks how many commits the current branch is behind the remote main branch using git rev-list --count HEAD..origin/<mainBranch>. Runs as a workspace-level interval check every 5 minutes and warns to rebase when the branch falls too far behind.

Setting	Default
`devManager.quality.builtin.branchBehindMain.enabled`	`true`
`devManager.quality.builtin.branchBehindMain.realtime`	`true`
`devManager.quality.builtin.branchBehindMain.precommit`	`false`
`devManager.quality.builtin.branchBehindMain.mainBranch`	`"main"`
`devManager.quality.builtin.branchBehindMain.warnAt`	`10`
`devManager.quality.builtin.branchBehindMain.failAt`	`50`

Runtime / Infra

Pre-bind Port Check

Detects when dev server ports mentioned in package.json scripts are already occupied before the server starts. Runs every 10 seconds as a workspace interval check and watches package.json for changes. Complements the existing Port Collisions check.

Setting	Default
`devManager.quality.builtin.prebindPort.enabled`	`true`
`devManager.quality.builtin.prebindPort.realtime`	`true`
`devManager.quality.builtin.prebindPort.precommit`	`false`

Docker Resource Alert

Monitors running Docker containers using docker stats --no-stream and warns when CPU or memory usage exceeds the configured thresholds. Watches docker-compose.yml / compose.yml for changes and polls every 30 seconds.

Setting	Default
`devManager.quality.builtin.dockerResourceAlert.enabled`	`true`
`devManager.quality.builtin.dockerResourceAlert.realtime`	`true`
`devManager.quality.builtin.dockerResourceAlert.precommit`	`false`
`devManager.quality.builtin.dockerResourceAlert.cpu`	`80`
`devManager.quality.builtin.dockerResourceAlert.mem`	`90`

Configuring Thresholds

Every built-in check supports enabled. Most numeric checks support warnAt/failAt (or warnLines/failLines/warnDepth/etc.):

"devManager.quality.builtin.lineCount.warnLines": 300,
"devManager.quality.builtin.lineCount.failLines": 500,
"devManager.quality.builtin.complexity.warnScore": 10,
"devManager.quality.builtin.complexity.failScore": 20,
"devManager.quality.builtin.dependencyCount.warnAt": 50,
"devManager.quality.builtin.dependencyCount.failAt": 100

To disable a check entirely:

"devManager.quality.builtin.magicNumbers.enabled": false

The TypeScript Check (tscCheck) runs npx tsc --noEmit — see CLI Tool Checks →.

Built-in Checks

Dev Environment

Docker Compose

Port Collisions

Dev Server Health

Dev Server Logs

Tasks Drift

Linters & Formatters

ESLint

Biome

OXLint

Prettier

Stylelint

TypeScript & JavaScript

Floating Promises

Async/Await Misuse

Error Handling

Return Types

Missing Return Types

React Hooks Deps

React Hook Rules

Dangerous Patterns

Insecure HTTP

Import Hygiene

Import Cost

No Focused Tests

tsconfig Sanity

React & Next.js

Accessibility

Tailwind Classes

Next.js Boundary

Architecture & Imports

Circular Imports

Barrel Files

Coupling Metrics

Cross-Layer Imports

Component Inventory

Heavy Imports

Import Depth

Code Size & Complexity

Line Count

Function Length

Cyclomatic Complexity

File Size

Long Lines

Directory Depth

Dependency Count

Parameter Count

Type Safety

TypeScript any Coverage

Type Coverage

JSDoc Coverage

Type Safety

Non-null Assertions

tsconfig Audit

Enum Usage

Broad Types

Zod Consistency

Zod Any

ESLint Disable

N+1 Queries

Edge Runtime Compatibility

use client Boundary

Test Quality

Test Ratio

Empty Tests

Test Coverage Gaps

LCOV Coverage

Code Hygiene

TODO Count

Commented-Out Code

Duplicate Files

Mixed Indent

Encoding

Magic Numbers

Debug Leaks

Secret Leaks

Gitignore Check

Merge Conflict Markers

License Header

TypeScript `any` Coverage

`use client` Boundary