@aarock1234/slopscan 0.1.0

package/dist/score.js

@@ -0,0 +1,142 @@
+import { z } from 'zod';
+import { findingSchema } from './finding.js';
+import { Axis, Severity, axisValues, severityValues } from './rule.js';
+// the four knobs. everything else about the score follows from these and the findings.
+export const scoringSchema = z
+    .object({
+    // base points per finding by severity
+    points: z
+        .object({
+        [Severity.INFO]: z.number().nonnegative().default(1),
+        [Severity.MINOR]: z.number().nonnegative().default(3),
+        [Severity.MAJOR]: z.number().nonnegative().default(8),
+        [Severity.CRITICAL]: z.number().nonnegative().default(20),
+    })
+        .strict()
+        .prefault({}),
+    // the k-th finding of one rule contributes points * damping^(k-1), so repeats never dominate
+    damping: z.number().min(0).max(1).default(0.5),
+    // points per 100 changed lines at which an axis reaches 63; the curve is 100 * (1 - e^(-density / scale))
+    densityScale: z.number().positive().default(12),
+    axisWeights: z
+        .object({
+        [Axis.IDIOM]: z.number().nonnegative().default(0.25),
+        [Axis.HACKY]: z.number().nonnegative().default(0.4),
+        [Axis.FUTUREPROOF]: z.number().nonnegative().default(0.35),
+    })
+        .strict()
+        .prefault({}),
+    // a floor on changed lines so a three-line diff with one finding is not scored as a disaster
+    minScoredLines: z.number().int().positive().default(50),
+})
+    .strict();
+export const Grade = {
+    A: 'A',
+    B: 'B',
+    C: 'C',
+    D: 'D',
+    F: 'F',
+};
+const gradeValues = Object.values(Grade);
+// upper bound of each band, inclusive
+const GRADE_BANDS = [
+    [10, Grade.A],
+    [25, Grade.B],
+    [45, Grade.C],
+    [70, Grade.D],
+    [100, Grade.F],
+];
+const SEVERITY_RANK = {
+    [Severity.INFO]: 0,
+    [Severity.MINOR]: 1,
+    [Severity.MAJOR]: 2,
+    [Severity.CRITICAL]: 3,
+};
+export const scoredFindingSchema = findingSchema.extend({
+    axis: z.enum(axisValues),
+    severity: z.enum(severityValues),
+    // what this finding added to its axis after damping
+    points: z.number().nonnegative(),
+});
+export const axisScoreSchema = z.object({
+    score: z.number().min(0).max(100),
+    points: z.number().nonnegative(),
+    density: z.number().nonnegative(),
+    findings: z.number().int().nonnegative(),
+});
+export const scoreSchema = z.object({
+    overall: z.number().int().min(0).max(100),
+    grade: z.enum(gradeValues),
+    axes: z.object({
+        [Axis.IDIOM]: axisScoreSchema,
+        [Axis.HACKY]: axisScoreSchema,
+        [Axis.FUTUREPROOF]: axisScoreSchema,
+    }),
+});
+// a score plus the findings that produced it and the size of the diff it was normalized by
+export const scoredSchema = scoreSchema.extend({
+    files: z.number().int().nonnegative(),
+    scoredLines: z.number().int().nonnegative(),
+    // ranked by contribution, then severity, then location
+    findings: z.array(scoredFindingSchema),
+});
+export function score(findings, changes, rules, scoring) {
+    const rulesById = new Map(rules.map(rule => [rule.id, rule]));
+    const scoredLines = changes.reduce((sum, change) => sum + change.scoredLines, 0);
+    const normalizer = Math.max(scoredLines, scoring.minScoredLines) / 100;
+    const scored = dampen(findings, rulesById, scoring).sort(compareByContribution);
+    const axes = Object.fromEntries(axisValues.map(axis => {
+        const own = scored.filter(finding => finding.axis === axis);
+        const points = own.reduce((sum, finding) => sum + finding.points, 0);
+        const density = points / normalizer;
+        return [
+            axis,
+            {
+                score: 100 * (1 - Math.exp(-density / scoring.densityScale)),
+                points,
+                density,
+                findings: own.length,
+            },
+        ];
+    }));
+    const overall = Math.round(axisValues.reduce((sum, axis) => sum + scoring.axisWeights[axis] * axes[axis].score, 0));
+    return {
+        overall,
+        grade: gradeFor(overall),
+        axes,
+        files: changes.length,
+        scoredLines,
+        findings: scored,
+    };
+}
+// groups findings by rule and applies geometric damping within each group, strongest first
+function dampen(findings, rulesById, scoring) {
+    const byRule = Map.groupBy(findings, finding => finding.ruleId);
+    return [...byRule.entries()].flatMap(([ruleId, group]) => {
+        const rule = rulesById.get(ruleId);
+        if (rule === undefined) {
+            throw new Error(`finding references unknown rule ${ruleId}`);
+        }
+        const base = scoring.points[rule.severity];
+        return group
+            .map(finding => ({ ...finding, raw: base * finding.confidence }))
+            .sort((a, b) => b.raw - a.raw)
+            .map(({ raw, ...finding }, index) => ({
+            ...finding,
+            axis: rule.axis,
+            severity: rule.severity,
+            points: raw * scoring.damping ** index,
+        }));
+    });
+}
+function compareByContribution(a, b) {
+    return (b.points - a.points ||
+        SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] ||
+        a.path.localeCompare(b.path) ||
+        a.line - b.line);
+}
+export function gradeFor(overall) {
+    const band = GRADE_BANDS.find(([upper]) => overall <= upper);
+    return band?.[1] ?? Grade.F;
+}
+//# sourceMappingURL=score.js.map

package/dist/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../src/score.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGvE,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC5B,MAAM,CAAC;IACP,sCAAsC;IACtC,MAAM,EAAE,CAAC;SACP,MAAM,CAAC;QACP,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACzD,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,EAAE,CAAC;IACd,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9C,0GAA0G;IAC1G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,WAAW,EAAE,CAAC;SACZ,MAAM,CAAC;QACP,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC1D,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,EAAE,CAAC;IACd,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAIX,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;CACG,CAAC;AAIX,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAwB,CAAC;AAEhE,sCAAsC;AACtC,MAAM,WAAW,GAA0C;IAC1D,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACb,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACb,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACb,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACb,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;CACd,CAAC;AAEF,MAAM,aAAa,GAAuC;IACzD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAClB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,eAAe;QAC7B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,eAAe;QAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,eAAe;KACnC,CAAC;CACF,CAAC,CAAC;AAIH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,uDAAuD;IACvD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACtC,CAAC,CAAC;AAIH,MAAM,UAAU,KAAK,CACpB,QAA4B,EAC5B,OAA0B,EAC1B,KAAsB,EACtB,OAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,GAAG,CAAC;IAEvE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAEhF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC9B,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;QAEpC,OAAO;YACN,IAAI;YACJ;gBACC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC5D,MAAM;gBACN,OAAO;gBACP,QAAQ,EAAE,GAAG,CAAC,MAAM;aACpB;SACD,CAAC;IACH,CAAC,CAAC,CACyB,CAAC;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEpH,OAAO;QACN,OAAO;QACP,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;QACxB,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,WAAW;QACX,QAAQ,EAAE,MAAM;KAChB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CAAC,QAA4B,EAAE,SAA4B,EAAE,OAAgB;IAC3F,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhE,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,OAAO,KAAK;aACV,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;aAChE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;aAC7B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACrC,GAAG,OAAO;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK;SACtC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAgB,EAAE,CAAgB;IAChE,OAAO,CACN,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QACnB,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;IAE7D,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/shared/concurrency.d.ts

@@ -0,0 +1,5 @@
+export type ConcurrencyOptions = {
+    concurrency?: number;
+    signal?: AbortSignal;
+};
+export declare function mapConcurrent<T, R>(items: readonly T[], mapper: (item: T) => Promise<R>, options?: ConcurrencyOptions): Promise<R[]>;

package/dist/shared/concurrency.js

@@ -0,0 +1,17 @@
+import pLimit from 'p-limit';
+const DEFAULT_CONCURRENCY = 4;
+// maps items concurrently with a sliding window limit.
+// fails fast: one rejection rejects the entire batch.
+export async function mapConcurrent(items, mapper, options = {}) {
+    const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+        throw new Error('concurrency must be a positive integer');
+    }
+    const limit = pLimit(concurrency);
+    const tasks = items.map(item => limit(() => {
+        options.signal?.throwIfAborted();
+        return mapper(item);
+    }));
+    return Promise.all(tasks);
+}
+//# sourceMappingURL=concurrency.js.map

package/dist/shared/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../../src/shared/concurrency.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,uDAAuD;AACvD,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,KAAmB,EACnB,MAA+B,EAC/B,UAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAE/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC9B,KAAK,CAAC,GAAG,EAAE;QACV,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAEjC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CACF,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/shared/env.d.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+export declare const LogLevel: {
+    readonly DEBUG: "debug";
+    readonly INFO: "info";
+    readonly WARN: "warn";
+    readonly ERROR: "error";
+    readonly SILENT: "silent";
+};
+export type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];
+declare const envSchema: z.ZodObject<{
+    OPENAI_API_KEY: z.ZodOptional<z.ZodString>;
+    OPENROUTER_API_KEY: z.ZodOptional<z.ZodString>;
+    LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
+        error: "error";
+        info: "info";
+        debug: "debug";
+        warn: "warn";
+        silent: "silent";
+    }>>;
+}, z.core.$strip>;
+export type Env = z.infer<typeof envSchema>;
+export declare const env: {
+    LOG_LEVEL: "error" | "info" | "debug" | "warn" | "silent";
+    OPENAI_API_KEY?: string | undefined;
+    OPENROUTER_API_KEY?: string | undefined;
+};
+export {};

package/dist/shared/env.js

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { ConfigError } from './errors.js';
+export const LogLevel = {
+    DEBUG: 'debug',
+    INFO: 'info',
+    WARN: 'warn',
+    ERROR: 'error',
+    SILENT: 'silent',
+};
+const logLevelValues = Object.values(LogLevel);
+// provider keys are optional here: a scan without the judge needs none,
+// and the judge asks for the one it needs with a clear error at use time.
+const envSchema = z.object({
+    OPENAI_API_KEY: z.string().min(1).optional(),
+    OPENROUTER_API_KEY: z.string().min(1).optional(),
+    LOG_LEVEL: z.enum(logLevelValues).default(LogLevel.INFO),
+});
+function parseEnv() {
+    // a copied .env.example leaves keys blank; blank means unset, not "the empty string"
+    const present = Object.fromEntries(Object.entries(process.env).filter(([, value]) => value));
+    const result = envSchema.safeParse(present);
+    if (result.success) {
+        return result.data;
+    }
+    const issues = result.error.issues.map(issue => ` - ${issue.path.join('.')}: ${issue.message}`);
+    throw new ConfigError(['invalid environment variables:', ...issues].join('\n'));
+}
+export const env = parseEnv();
+//# sourceMappingURL=env.js.map

package/dist/shared/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/shared/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACvB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;CACP,CAAC;AAIX,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAA8B,CAAC;AAE5E,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;CACxD,CAAC,CAAC;AAIH,SAAS,QAAQ;IAChB,qFAAqF;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAEhG,MAAM,IAAI,WAAW,CAAC,CAAC,gCAAgC,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC"}

package/dist/shared/errors.d.ts

@@ -0,0 +1,18 @@
+type ErrorOptions = {
+    cause?: unknown;
+};
+export declare class SlopscanError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string, options?: ErrorOptions);
+}
+export declare class ConfigError extends SlopscanError {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class RuleError extends SlopscanError {
+    readonly rulePath: string;
+    constructor(rulePath: string, message: string, options?: ErrorOptions);
+}
+export declare class GitError extends SlopscanError {
+    constructor(message: string, options?: ErrorOptions);
+}
+export {};

package/dist/shared/errors.js

@@ -0,0 +1,26 @@
+export class SlopscanError extends Error {
+    code;
+    constructor(message, code, options) {
+        super(message, options);
+        this.name = this.constructor.name;
+        this.code = code;
+    }
+}
+export class ConfigError extends SlopscanError {
+    constructor(message, options) {
+        super(message, 'CONFIG', options);
+    }
+}
+export class RuleError extends SlopscanError {
+    rulePath;
+    constructor(rulePath, message, options) {
+        super(`${rulePath}: ${message}`, 'RULE', options);
+        this.rulePath = rulePath;
+    }
+}
+export class GitError extends SlopscanError {
+    constructor(message, options) {
+        super(message, 'GIT', options);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/shared/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC9B,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,IAAY,EAAE,OAAsB;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED,MAAM,OAAO,WAAY,SAAQ,aAAa;IAC7C,YAAY,OAAe,EAAE,OAAsB;QAClD,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;CACD;AAED,MAAM,OAAO,SAAU,SAAQ,aAAa;IAClC,QAAQ,CAAS;IAE1B,YAAY,QAAgB,EAAE,OAAe,EAAE,OAAsB;QACpE,KAAK,CAAC,GAAG,QAAQ,KAAK,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;CACD;AAED,MAAM,OAAO,QAAS,SAAQ,aAAa;IAC1C,YAAY,OAAe,EAAE,OAAsB;QAClD,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;CACD"}

package/dist/shared/log.d.ts

@@ -0,0 +1,2 @@
+import pino from 'pino';
+export declare const logger: pino.Logger<never, boolean>;

package/dist/shared/log.js

@@ -0,0 +1,18 @@
+import pino from 'pino';
+import { env } from './env.js';
+const STDERR_FD = 2;
+// logs go to stderr so stdout stays clean for machine-readable report output.
+// pretty-print only when a human is watching.
+export const logger = process.stderr.isTTY
+    ? pino({
+        level: env.LOG_LEVEL,
+        transport: {
+            target: 'pino-pretty',
+            options: {
+                destination: STDERR_FD,
+                translateTime: 'SYS:standard',
+            },
+        },
+    })
+    : pino({ level: env.LOG_LEVEL }, pino.destination(STDERR_FD));
+//# sourceMappingURL=log.js.map

package/dist/shared/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/shared/log.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,8EAA8E;AAC9E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK;IACzC,CAAC,CAAC,IAAI,CAAC;QACL,KAAK,EAAE,GAAG,CAAC,SAAS;QACpB,SAAS,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACR,WAAW,EAAE,SAAS;gBACtB,aAAa,EAAE,cAAc;aAC7B;SACD;KACD,CAAC;IACH,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC"}

package/dist/shared/paths.d.ts

@@ -0,0 +1,3 @@
+export declare const PACKAGE_ROOT: string;
+export declare const RULES_DIR: string;
+export declare const PROMPTS_DIR: string;

package/dist/shared/paths.js

@@ -0,0 +1,6 @@
+import { resolve } from 'node:path';
+// src/shared and dist/shared sit at the same depth, so the package root is two levels up either way.
+export const PACKAGE_ROOT = resolve(import.meta.dirname, '..', '..');
+export const RULES_DIR = resolve(PACKAGE_ROOT, 'rules');
+export const PROMPTS_DIR = resolve(PACKAGE_ROOT, 'prompts');
+//# sourceMappingURL=paths.js.map

package/dist/shared/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/shared/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC"}

package/dist/shared/prompts.d.ts

@@ -0,0 +1,3 @@
+type PromptVars = Record<string, string>;
+export declare function loadPrompt(name: string, vars?: PromptVars): string;
+export {};

package/dist/shared/prompts.js

@@ -0,0 +1,34 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { PROMPTS_DIR } from './paths.js';
+const DIRECTIVE_PATTERN = /\{\{([A-Z][A-Z0-9_]*)\}\}/g;
+const templateCache = new Map();
+function readTemplate(name) {
+    const cached = templateCache.get(name);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const content = readFileSync(join(PROMPTS_DIR, `${name}.md`), 'utf-8');
+    templateCache.set(name, content);
+    return content;
+}
+// loads prompts/{name}.md and resolves {{DIRECTIVE}} placeholders.
+// throws on unresolved directives and on unused variables so drift is caught at the call site.
+export function loadPrompt(name, vars = {}) {
+    const template = readTemplate(name);
+    const usedVars = new Set();
+    const content = template.replace(DIRECTIVE_PATTERN, (_match, key) => {
+        const value = vars[key];
+        if (value === undefined) {
+            throw new Error(`unresolved directive {{${key}}} in prompt "${name}"`);
+        }
+        usedVars.add(key);
+        return value;
+    });
+    const unusedVars = Object.keys(vars).filter(key => !usedVars.has(key));
+    if (unusedVars.length > 0) {
+        throw new Error(`unused vars passed to prompt "${name}": ${unusedVars.join(', ')}`);
+    }
+    return content;
+}
+//# sourceMappingURL=prompts.js.map

package/dist/shared/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/shared/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAIvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,SAAS,YAAY,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACvE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEjC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAmB,EAAE;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAW,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,iBAAiB,IAAI,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElB,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/package.json

@@ -0,0 +1,79 @@
+{
+	"name": "@aarock1234/slopscan",
+	"version": "0.1.0",
+	"description": "scores a git diff for slop: hacky, non-idiomatic, non-future-proof code",
+	"keywords": [
+		"code-review",
+		"lint",
+		"typescript",
+		"go",
+		"ast-grep",
+		"llm",
+		"github-action"
+	],
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/aarock1234/slopscan.git"
+	},
+	"homepage": "https://github.com/aarock1234/slopscan#readme",
+	"bugs": "https://github.com/aarock1234/slopscan/issues",
+	"type": "module",
+	"engines": {
+		"node": ">=24"
+	},
+	"packageManager": "pnpm@12.4.1",
+	"bin": {
+		"slopscan": "dist/cli.js"
+	},
+	"files": [
+		"dist",
+		"rules",
+		"prompts",
+		"SKILL.md"
+	],
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"dev": "node --env-file-if-exists=.env --import tsx src/cli.ts",
+		"build": "tsc -p tsconfig.build.json",
+		"lint": "eslint .",
+		"lint:fix": "eslint . --fix",
+		"format": "prettier --write .",
+		"format:check": "prettier --check .",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"typecheck": "tsc --noEmit",
+		"check": "concurrently \"pnpm typecheck\" \"pnpm lint\" \"pnpm format:check\" \"pnpm test\"",
+		"script": "node --env-file-if-exists=.env --import tsx",
+		"clean": "rm -rf dist coverage *.tsbuildinfo",
+		"prepublishOnly": "pnpm check && pnpm build"
+	},
+	"dependencies": {
+		"@ai-sdk/openai": "^4.0.71",
+		"@ast-grep/lang-go": "^0.0.6",
+		"@ast-grep/napi": "^0.45.3",
+		"@openrouter/ai-sdk-provider": "^3.1.0",
+		"ai": "^7.0.107",
+		"gray-matter": "^4.0.3",
+		"p-limit": "^7.3.3",
+		"picocolors": "^1.1.1",
+		"pino": "^10.3.1",
+		"pino-pretty": "^13.1.3",
+		"yaml": "^2.9.1",
+		"zod": "^4.6.5"
+	},
+	"devDependencies": {
+		"@eslint/js": "^10.0.1",
+		"@types/node": "^26.6.2",
+		"concurrently": "^10.0.5",
+		"eslint": "^10.11.0",
+		"jiti": "^2.7.0",
+		"prettier": "^3.9.8",
+		"tsx": "^4.23.13",
+		"typescript": "^6.0.3",
+		"typescript-eslint": "^8.70.0",
+		"vitest": "^5.0.1"
+	}
+}

package/prompts/judge.md

@@ -0,0 +1,37 @@
+# Slop judge
+
+You review one changed source file against a fixed list of rules and report violations. The rules cover code
+that is hacky, non-idiomatic, or hard to change later. You are not reviewing correctness, performance, or taste
+outside the rules.
+
+## What you receive
+
+The file's path and language, then the changed regions of the file at its current version. Each line carries a
+gutter: a line number, and `+` when this change added or modified that line. Unmarked lines are context that
+someone else wrote earlier.
+
+## What you report
+
+A list of findings. Each finding names exactly one rule by id, the line number where it starts, a verbatim quote
+of the offending code, a one-line message, and a confidence from 0 to 1.
+
+Hard constraints:
+
+- Report only on `+` lines. A problem on an unmarked line is not this change's fault.
+- Use only the rule ids listed below. Never invent a rule.
+- `quote` is copied character for character from the file, starting on the reported line. It may span a few
+  lines. If you cannot quote it, do not report it.
+- `message` is lowercase, specific to this occurrence, and says what to do instead. No filler.
+- `confidence` is your honest probability that a careful reviewer would agree. Under 0.6 means you should not
+  report it at all.
+- Some rules ask for a `symbol`: the name of the function, type, or variable the finding is about. Provide it
+  exactly as written in the code. Set it to null for rules that do not ask.
+- Prefer few precise findings over many vague ones. A clean file yields an empty list.
+
+## Rules already checked mechanically
+
+These rule ids are enforced by a syntax matcher and are not yours to report: {{HANDLED_BY_AST}}
+
+## Rules to judge
+
+{{RULES}}

package/rules/any/futureproof/abstraction/pass-through-wrapper.md

@@ -0,0 +1,70 @@
+---
+severity: minor
+detect: judge
+confirm: callCount
+falsePositives:
+    - a method that exists to satisfy an interface or adapt one signature to another
+    - a wrapper that is the package's public surface over an internal or third-party dependency, so callers do not import the dependency
+    - a wrapper that adds something, such as a default argument, a conversion, error context, logging, or caching
+    - functions with several callers, where the shared name is the point
+---
+
+## Why
+
+A function whose whole body forwards its arguments to another call adds a name, a file jump, and a signature to keep in sync, without adding a decision. The reader now has to open it to learn it does nothing, and the next change has to update two signatures. Call the target directly, or make the wrapper earn its name by doing something the callers should not repeat.
+
+## Message
+
+pass-through wrapper forwards its arguments unchanged; call the target directly
+
+## Bad
+
+```ts
+// BAD: forwards every argument and adds nothing
+async function findUser(id: string): Promise<User | undefined> {
+	return userRepo.findById(id);
+}
+
+export async function profile(id: string): Promise<Profile> {
+	const user = await findUser(id);
+
+	return toProfile(user);
+}
+```
+
+```go
+// BAD: forwards every argument and adds nothing
+func (s *Service) findUser(ctx context.Context, id string) (User, error) {
+	return s.repo.FindByID(ctx, id)
+}
+
+func (s *Service) Profile(ctx context.Context, id string) (Profile, error) {
+	user, err := s.findUser(ctx, id)
+	if err != nil {
+		return Profile{}, fmt.Errorf("finding user: %w", err)
+	}
+
+	return toProfile(user), nil
+}
+```
+
+## Good
+
+```ts
+export async function profile(id: string): Promise<Profile> {
+	const user = await userRepo.findById(id);
+
+	return toProfile(user);
+}
+```
+
+```go
+func (s *Service) Profile(ctx context.Context, id string) (Profile, error) {
+	user, err := s.repo.FindByID(ctx, id)
+	if err != nil {
+		return Profile{}, fmt.Errorf("finding user: %w", err)
+	}
+
+	return toProfile(user), nil
+}
+```

package/rules/any/futureproof/abstraction/single-caller-helper.md

@@ -0,0 +1,38 @@
+---
+severity: minor
+detect: judge
+confirm: callCount
+falsePositives:
+    - a function extracted so it can be unit tested in isolation
+    - a function that names a non-obvious step even though it is called once
+    - exported functions, which may have callers outside this repository
+---
+
+## Why
+
+Pulling three lines into a helper that is called from exactly one place adds a name to learn and a jump to follow without removing any duplication. The reader now holds two locations in their head instead of one. Extract when there is a second caller or when the name carries real meaning; otherwise keep the code where it is used.
+
+## Message
+
+single-use helper adds indirection without removing duplication
+
+## Bad
+
+```ts
+// BAD: a pass-through with one caller
+function getUserName(user: User): string {
+	return user.name;
+}
+
+export function greet(user: User): string {
+	return `hello ${getUserName(user)}`;
+}
+```
+
+## Good
+
+```ts
+export function greet(user: User): string {
+	return `hello ${user.name}`;
+}
+```