Rules

Files that import each other, directly or through a chain. Found with Tarjan's algorithm. Type-only imports are excluded, and so is a Python package whose __init__.py re-exports its own submodules — that loop is idiomatic and resolves lazily.

A lower layer importing a higher one — for example data importing UI.

A layer reaching past its neighbour, such as UI importing the database directly. Only when layerPolicy is 'adjacent'.

One feature reaching into another feature's internals. Requires a feature root, configured or inferred.

An import matching a pair you listed in architecture.forbidden.

An entry point whose transitive import chain is longer than maxImportDepth.

A 'use client' module importing a package that only runs on the server, such as node:fs, pg or nodemailer. Calling a server action is not reported — that is the pattern working as designed.

A file past the configured line budget.

A function longer than maxFunctionLines. Components are excluded.

A React component past its own budget, which is separate because components are legitimately longer.

A function with more independent branches than maxComplexity.

Control flow nested past maxNesting inside a single function.

A long list of positional parameters, which is easy to call wrongly.

A Go package that has grown far past the file budget.

Identical blocks of code appearing in more than one place. Overlapping matches are merged, so a thirty-line copy-paste is one finding rather than two dozen.

An import matching neither a project file nor a declared package. Asset imports such as CSS and images are not reported.

useEffect called with no dependency array, so it re-runs after every render.

The same helper name defined and exported in more than one file.

Two modules implementing the same set of names, reported once rather than once per name. A facade that selects between them is not reported.

A module whose only job is forwarding a call to another module.

A directory that has filled up with small modules each used exactly once.

A file leaning on `any` often enough to lose type coverage.

@ts-ignore, which stays silent even after the underlying error is gone. @ts-expect-error is not reported.

Assertions through any or unknown, which are never verified at runtime.

Plain JavaScript files inside a project set up for TypeScript.

A dependency whose major version moved in this change.

Dependencies added by this change.

A declared runtime dependency nothing imports. Type definitions, linters and build tooling are excluded.

A package declared in both dependencies and devDependencies, so which version wins depends on the package manager.

`except:` blocks that swallow every exception, including KeyboardInterrupt.

Mutable default arguments, evaluated once and shared between calls.

Functions rebinding module-level state with `global`.

A return value discarded with `_`, which in Go is usually a dropped error.