@alexcodeplace/slopgate 0.2.0 → 0.3.1

package/README.md

@@ -23,7 +23,7 @@ A global code-quality / anti-slop gate for Claude Code and git. Engine is shared
   - **diff-shape** — wide commits spanning too many directories (encourages focused changes)
 
 - **Shared regex + AST rule packs** — fast-tier and commit-tier both run these
-  - Convention: `no-stubs`, `ts-suppress`, `as-any`, `raw-hex` (design tokens), `sql-safety`
+  - Convention: `no-stubs`, `ts-suppress`, `as-any`, `no-narration-comments`, `raw-hex` (design tokens), `sql-safety`
   - Security: `live-secrets`, `eval-ban`, `pii-logs`, `weak-hash`
   - Cloudflare boundary: `kv-ban` (plus the opt-in `stack = ["cloudflare"]` pack)
   - Built-in AST rules: empty-catch, unsafe `innerHTML`/`dangerouslySetInnerHTML`, `target="_blank"` without `rel`, `window` access during render
@@ -388,6 +388,7 @@ All are opt-in via the `baseline` array in config. Severity drives the gate thre
 | `no-stubs` | critical | convention | Stub / placeholder / "not implemented" / deferred-work markers |
 | `ts-suppress` | high | convention | `@ts-ignore` / `@ts-expect-error` — suppressing tsc instead of fixing the cause |
 | `as-any` | high | convention | `as any` casts that disable type safety |
+| `no-narration-comments` | high | convention | Comments that narrate a diff/history/removal (`changed from`, `used to`, `no longer needed`, `track later`) instead of explaining a non-obvious constraint |
 | `raw-hex` | high | convention | Hardcoded hex / `rgb()` colors + raw multi-digit `px` — use design tokens |
 | `sql-safety` | critical | convention | `SELECT … FOR UPDATE` with an aggregate (Postgres rejects this at runtime) |
 | `kv-ban` | critical | boundary | Cloudflare KV in read-after-write paths (eventually-consistent) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexcodeplace/slopgate",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "type": "module",
   "description": "Global code-quality / anti-slop gate — engine shared, rules per-project.",
   "license": "MIT",
@@ -22,7 +22,6 @@
     "rules",
     "skills",
     "vendor",
-    "!rules/baseline/fixtures",
     "!bin/slopgate-rs"
   ],
   "engines": {

package/rules/baseline/ast/empty-catch-block-ts.yml

@@ -5,3 +5,6 @@ message: Empty catch block swallows error silently
 note: '{"severity":"high","category":"convention","resolution":"Handle or rethrow. Minimum: log with context (console.error). Comment-only bodies count as empty."}'
 rule:
   pattern: 'try { $A } catch ($E) {}'
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/empty-catch-block-tsx.yml

@@ -5,3 +5,6 @@ message: Empty catch block swallows error silently
 note: '{"severity":"high","category":"convention","resolution":"Handle or rethrow. Minimum: log with context (console.error). Comment-only bodies count as empty."}'
 rule:
   pattern: 'try { $A } catch ($E) {}'
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/inner-html.yml

@@ -6,4 +6,7 @@ note: '{"severity":"high","category":"security","resolution":"Build DOM via safe
 rule:
   any:
     - pattern: $X.innerHTML = $$$
-    - pattern: $X.insertAdjacentHTML($$$)
+    - pattern: $X.insertAdjacentHTML($$$)
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/target-blank-norel.yml

@@ -23,3 +23,6 @@ rule:
             has:
               kind: jsx_attribute
               regex: '^rel='
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/window-in-render.yml

@@ -9,6 +9,8 @@ files:
   - '**/fixtures/src/components/**'
 ignores:
   - '**/features/design-system/**'
+  - '**/*.test.ts'
+  - '**/*.test.tsx'
 rule:
   any:
     - pattern: window.$PROP

package/rules/baseline/fixtures/checker-outputs/depcruise.expected.json

@@ -0,0 +1,5 @@
+[
+  { "rule": "no-circular", "severity": "error", "from": "src/a.ts", "to": "src/b.ts" },
+  { "rule": "no-orphans", "severity": "warn", "from": "src/orphan.ts", "to": "src/orphan.ts" },
+  { "rule": "fyi-only", "severity": "info", "from": "src/ui/page.ts", "to": "src/db/client.ts" }
+]

package/rules/baseline/fixtures/checker-outputs/depcruise.json

@@ -0,0 +1,11 @@
+{
+  "summary": {
+    "violations": [
+      { "type": "cycle", "from": "src/a.ts", "to": "src/b.ts", "rule": { "severity": "error", "name": "no-circular" } },
+      { "type": "module", "from": "src/orphan.ts", "to": "src/orphan.ts", "rule": { "severity": "warn", "name": "no-orphans" } },
+      { "type": "dependency", "from": "src/ui/page.ts", "to": "src/db/client.ts", "rule": { "severity": "info", "name": "fyi-only" } }
+    ],
+    "error": 1, "warn": 1, "info": 1
+  },
+  "modules": []
+}

package/rules/baseline/fixtures/checker-outputs/jscpd.expected.json

@@ -0,0 +1,3 @@
+[
+  { "firstFile": "src/features/a.ts", "firstStart": 10, "firstEnd": 27, "secondFile": "src/features/b.ts", "secondStart": 40, "secondEnd": 57, "lines": 18 }
+]

package/rules/baseline/fixtures/checker-outputs/jscpd.json

@@ -0,0 +1,13 @@
+{
+  "duplicates": [
+    {
+      "format": "typescript",
+      "lines": 18,
+      "tokens": 120,
+      "firstFile": { "name": "src/features/a.ts", "start": 10, "end": 27, "startLoc": { "line": 10, "column": 1 }, "endLoc": { "line": 27, "column": 2 } },
+      "secondFile": { "name": "src/features/b.ts", "start": 40, "end": 57, "startLoc": { "line": 40, "column": 1 }, "endLoc": { "line": 57, "column": 2 } },
+      "fragment": "function dup() { /* body */ }"
+    }
+  ],
+  "statistics": {}
+}

package/rules/baseline/fixtures/checker-outputs/knip.expected.json

@@ -0,0 +1,6 @@
+[
+  { "type": "files", "file": "src/orphan.ts", "line": 1, "name": "src/orphan.ts" },
+  { "type": "exports", "file": "src/util.ts", "line": 14, "name": "unusedHelper" },
+  { "type": "types", "file": "src/util.ts", "line": 2, "name": "UnusedType" },
+  { "type": "dependencies", "file": "package.json", "line": 12, "name": "left-pad" }
+]

package/rules/baseline/fixtures/checker-outputs/knip.json

@@ -0,0 +1,31 @@
+{
+  "files": ["src/orphan.ts"],
+  "issues": [
+    {
+      "file": "src/util.ts",
+      "dependencies": [],
+      "devDependencies": [],
+      "optionalPeerDependencies": [],
+      "unlisted": [],
+      "binaries": [],
+      "unresolved": [],
+      "exports": [{ "name": "unusedHelper", "line": 14, "col": 14, "pos": 300 }],
+      "types": [{ "name": "UnusedType", "line": 2, "col": 13, "pos": 30 }],
+      "enumMembers": {},
+      "duplicates": []
+    },
+    {
+      "file": "package.json",
+      "dependencies": [{ "name": "left-pad", "line": 12, "col": 6, "pos": 200 }],
+      "devDependencies": [],
+      "optionalPeerDependencies": [],
+      "unlisted": [],
+      "binaries": [],
+      "unresolved": [],
+      "exports": [],
+      "types": [],
+      "enumMembers": {},
+      "duplicates": []
+    }
+  ]
+}

package/rules/baseline/fixtures/checker-outputs/tsc.expected.json

@@ -0,0 +1,5 @@
+[
+  { "file": "src/a.ts", "line": 12, "code": "TS2322", "message": "Type 'string' is not assignable to type 'number'." },
+  { "file": "src/b.tsx", "line": 3, "code": "TS2304", "message": "Cannot find name 'foo'." },
+  { "file": "src/long.ts", "line": 7, "code": "TS2345", "message": "Argument of type '{ a: string; }' is not assignable to parameter of type 'Opts'. Property 'b' is missing in type '{ a: string; }' but required in type 'Opts'." }
+]

package/rules/baseline/fixtures/checker-outputs/tsc.txt

@@ -0,0 +1,4 @@
+src/a.ts(12,5): error TS2322: Type 'string' is not assignable to type 'number'.
+src/b.tsx(3,1): error TS2304: Cannot find name 'foo'.
+src/long.ts(7,9): error TS2345: Argument of type '{ a: string; }' is not assignable to parameter of type 'Opts'.
+  Property 'b' is missing in type '{ a: string; }' but required in type 'Opts'.

package/rules/baseline/fixtures/checker-outputs/type-coverage.expected.json

@@ -0,0 +1,5 @@
+[
+  { "file": "src/api/handler.ts", "line": 42, "name": "data" },
+  { "file": "src/api/handler.ts", "line": 55, "name": "response" },
+  { "file": "src/legacy/blob.ts", "line": 7, "name": "payload" }
+]

package/rules/baseline/fixtures/checker-outputs/type-coverage.txt

@@ -0,0 +1,5 @@
+/repo/src/api/handler.ts:42:18: data
+/repo/src/api/handler.ts:55:3: response
+src/legacy/blob.ts:7:10: payload
+2912 / 2930 99.38%
+type-coverage success.

package/rules/baseline/fixtures/src/canary.tsx

@@ -0,0 +1,25 @@
+// Fixture for slopgate self-test. Contains deliberate canary tokens.
+// no-stubs SHOULD match stub markers (not bare placeholder UI/i18n tokens):
+// placeholder for now
+// TODO: implement later
+// not implemented
+export const x = __SLOPGATE_AST_CANARY__;
+// negative: must NOT match no-stubs — placeholder={...}, placeholder: class, i18n keys
+const _neg = <input placeholder={t('x')} className="placeholder:text-ink" />;
+const _titleKey = admin.incidents.titlePlaceholder;
+const namePlaceholder = 1;
+// ts-suppress SHOULD match @ts-* only (not eslint-disable):
+// @ts-ignore
+/* eslint-disable zync/no-raw-html-in-pages */
+// changed from foo to bar
+function bad(el: HTMLElement) { el.innerHTML = '<b>hi</b>'; }
+// live-secrets canary:
+const _sk = "sk_live_aaaaaaaaaaaa";
+// eval-ban canary:
+// eval(userCode);  — commented to avoid actual eval in fixture
+const _evalStr = 'eval(userCode)';
+// pii-logs canary:
+console.log(user.phone, user.email);
+// weak-hash canary:
+// createHash('md5') — weak hash
+const _wh = "createHash('md5').update(data)";

package/rules/baseline/fixtures/src/components/window-in-render.tsx

@@ -0,0 +1,4 @@
+export function Loc() {
+  const href = window.location.href;
+  return <span>{href}</span>;
+}

package/rules/baseline/fixtures/src/empty-catch.ts

@@ -0,0 +1,3 @@
+export function swallow(fn: () => void) {
+  try { fn(); } catch (e) {}
+}

package/rules/baseline/fixtures/src/empty-catch.tsx

@@ -0,0 +1,4 @@
+export function Swallow({ fn }: { fn: () => void }) {
+  try { fn(); } catch (e) {}
+  return <div />;
+}

package/rules/baseline/fixtures/src/target-blank.tsx

@@ -0,0 +1,3 @@
+export function Link() {
+  return <a target="_blank" href="https://example.com">x</a>;
+}

package/rules/baseline/fixtures/src/ux-ast.tsx

@@ -0,0 +1,43 @@
+// Fixtures for the UX module ast rules. Each construct below must trigger
+// exactly the rule named in its comment (selftest asserts every yml fires).
+// Parsed syntactically by ast-grep — no imports / type-checking involved.
+
+// triggers ux-div-onclick — onClick on a non-semantic element, no role
+export const ClickyDiv = () => <div onClick={onThing}>Open</div>;
+
+// triggers ux-img-no-dimensions — <img> with alt but no width/height
+export const Hero = () => <img src="/hero.png" alt="hero" />;
+
+// triggers ux-img-no-alt — <img> with dimensions but no alt
+export const NoAlt = () => <img src="/x.png" width={32} height={32} />;
+
+// triggers ux-anchor-no-href — <a onClick> with no href
+export const FakeLink = () => <a onClick={onThing}>go</a>;
+
+// triggers ux-button-no-type — <button> with no explicit type
+export const BareButton = () => <button onClick={onThing}>Save</button>;
+
+// triggers ux-media-no-dimensions — <iframe> with no width/height
+export const Embed = () => <iframe src="/player" />;
+
+// triggers ux-async-onclick-no-disable — async onClick, no disabled (type set so
+// it does NOT also trip ux-button-no-type)
+export const AsyncSave = () => <button type="button" onClick={async () => save()}>Save</button>;
+
+// triggers ux-modal-no-close — Dialog with no onClose/onDismiss/onOpenChange
+export const Sheet = ({ open }) => <Dialog open={open}>body</Dialog>;
+
+// negative: all of these are correct and must NOT trigger anything
+export const Ok = () => (
+  <>
+    <button type="button" onClick={onThing}>Open</button>
+    <button type="button" disabled onClick={async () => save()}>Save</button>
+    <a href="/page" onClick={onThing}>real link</a>
+    <img src="/ok.png" alt="ok" width={320} height={200} />
+    <Dialog open onOpenChange={onThing}>ok</Dialog>
+  </>
+);
+
+function onThing() {}
+function save() {}
+declare const Dialog: (props: Record<string, unknown>) => unknown;

package/rules/baseline/selftest.config.toml

@@ -6,7 +6,8 @@
 roots = ["rules/baseline/fixtures/src"]
 exts = [".ts", ".tsx"]
 skipDirs = ["node_modules"]
-baseline = ["no-stubs", "ts-suppress", "as-any", "raw-hex", "kv-ban", "live-secrets", "eval-ban", "pii-logs", "weak-hash", "sql-safety"]
+baseline = ["no-stubs", "ts-suppress", "as-any", "no-narration-comments", "markers", "raw-hex", "kv-ban", "live-secrets", "eval-ban", "pii-logs", "weak-hash", "sql-safety"]
+stack = ["debug"]
 rules = []
 suppressions = "./fixtures/suppressions.json"
 fixtures = "./fixtures"