diffsweep

Sweep your staged changes for the stuff you'll regret pushing. One command, zero config, any language.

diffsweep reads your git diff and flags the universal mistakes that slip into commits — leftover console.log / debugger, focused tests that silently disable the rest of your suite, unresolved merge-conflict markers, hardcoded secrets, stray TODOs and accidental .env files. It exits non-zero when it finds blockers, so it drops straight into a git hook or CI.

npx diffsweep

  diffsweep  ·  staged changes

  checkout.js
    error   :2     Leftover debug statement  (debug-statement)
            console.log('debugging total', items);
  checkout.test.js
    error   :2     Focused test will skip every other test  (focused-test)
            it.only('sums prices', () => {
  config.js
    error   :4     Possible hardcoded GitHub token  (hardcoded-secret)

  4 errors, 2 warnings

Why diffsweep?

Husky, lint-staged and friends are hook runners — you still have to install them, write a config, and wire up every check yourself. diffsweep is the opposite: batteries included, zero config. Run one command and every built-in rule is live, across JavaScript, TypeScript, Python, Go, PHP, Ruby and more. It only ever inspects added lines, so it stays fast and quiet.

• Zero config — no config file, no plugins to choose.
• Language-agnostic — not just a JS linter.
• Private & local — your code never leaves the machine. No network, no telemetry.
• Zero runtime dependencies.
• Hook & CI ready — meaningful exit codes, --json output, one-line install.

Usage

diffsweep                 # staged changes (git diff --cached) — the default
diffsweep --unstaged      # working tree
diffsweep main            # everything on this branch vs main
diffsweep --html          # also write a shareable HTML report
diffsweep --json          # machine-readable output for CI

Install a git hook so you can never forget:

diffsweep --install-hook pre-push     # add --force to overwrite an existing hook

Suppress a single line by adding diffsweep-ignore to it.

Rules

| Rule | Severity | Catches | |------|----------|---------| | debug-statement | error | console.log, debugger, breakpoint(), binding.pry, var_dump, dd() | | focused-test | error | .only, fdescribe, fit — silently skips the rest of the suite | | merge-conflict | error | unresolved <<<<<<< / ======= / >>>>>>> markers | | hardcoded-secret | error | AWS keys, private keys, GitHub/Slack/OpenAI tokens, password = "…" | | skipped-test | warning | .skip, xit, @Ignore | | todo-marker | warning | newly added TODO / FIXME / HACK / XXX | | large-addition | warning | very large or binary additions | | env-file | warning | committing a real .env file |

diffsweep --list prints them all. Filter with --only debug-statement,focused-test or --skip todo-marker. Generated/vendored files (dist/, lockfiles, *.min.js, source maps…) are ignored for line-level rules by default — pass --no-default-ignore to scan them too.

Exit codes

| Code | Meaning | |------|---------| | 0 | clean (or within --max-warnings) | | 1 | blocking findings (any error, or warnings over the threshold) | | 2 | usage / git error |

Use --max-warnings <n> to fail on warnings, or --no-fail to report only.

Pro

The free tier ships every built-in rule. diffsweep Pro adds custom rule packs (--config), team-shared rule sets, baselines and SARIF output for GitHub code scanning.

On the free tier, --config is ignored with a notice (printed to stderr) and the default audit still runs — so a gated flag can never mask findings or hand CI a misleading clean pass.

License

MIT