@archora/core 1.1.0

package/src/analyzer/loadAliases.ts

@@ -0,0 +1,288 @@
+// Загрузка path-aliases из tsconfig (с цепочкой `extends`) и Vite-конфига.
+// Вынесено из `analyze()` для переиспользования в `incrementalAnalyze()` —
+// при пере-сканировании одного файла нам нужен тот же резолвер, что и при
+// полном анализе, иначе разрешение `@/*` сломается на ходу.
+
+import type { FileSource } from './fileSource';
+import type { ProjectRef } from './types';
+import { parseTsconfigPaths, parseViteAliases, type PathAlias } from './resolve';
+
+export async function loadAliases(source: FileSource, project: ProjectRef): Promise<PathAlias[]> {
+  const visited = new Set<string>();
+  const aliases: PathAlias[] = [];
+
+  async function walk(rel: string): Promise<void> {
+    const norm = posixNormalize(rel);
+    if (visited.has(norm)) return;
+    visited.add(norm);
+    let content: string;
+    try {
+      content = await source.read(norm);
+    } catch {
+      return;
+    }
+    const direct = parseTsconfigPaths(content);
+    for (const a of direct) aliases.push(a);
+    const extendsList = parseTsconfigExtends(content);
+    const baseDir = posixDirname(norm);
+    for (const ext of extendsList) {
+      const candidates = ext.startsWith('.')
+        ? [posixJoin(baseDir, ext), posixJoin(baseDir, `${ext}.json`)]
+        : [ext, `${ext}.json`];
+      for (const c of candidates) {
+        if (await source.exists(c)) {
+          await walk(c);
+          break;
+        }
+      }
+    }
+  }
+
+  if (project.tsconfigPath) await walk(project.tsconfigPath);
+
+  for (const a of frameworkDefaultAliases(project.detectedFramework)) aliases.push(a);
+  for (const a of await workspacePackageAliases(source)) aliases.push(a);
+
+  for (const candidate of [
+    'vite.config.ts',
+    'vite.config.js',
+    'vite.config.mts',
+    'vite.config.mjs',
+  ]) {
+    if (await source.exists(candidate)) {
+      try {
+        const content = await source.read(candidate);
+        for (const a of parseViteAliases(content)) aliases.push(a);
+      } catch {
+        /* unreadable config - ignore */
+      }
+      break;
+    }
+  }
+
+  return dedupeAliases(aliases);
+}
+
+async function workspacePackageAliases(source: FileSource): Promise<PathAlias[]> {
+  let files: string[];
+  try {
+    files = await source.list();
+  } catch {
+    return [];
+  }
+  const out: PathAlias[] = [];
+  for (const rel of files) {
+    if (!rel.endsWith('package.json') || rel === 'package.json') continue;
+    let raw: string;
+    try {
+      raw = await source.read(rel);
+    } catch {
+      continue;
+    }
+    const pkg = parsePackageJson(raw);
+    if (!pkg?.name) continue;
+    const dir = posixDirname(rel);
+    const exported = aliasesFromPackageExports(pkg, dir);
+    if (exported.length > 0) {
+      out.push(...exported.map((alias) => ({ ...alias, prefix: `${pkg.name}${alias.prefix}` })));
+    } else {
+      out.push({ prefix: pkg.name, targets: [`${dir}/src`, dir] });
+    }
+  }
+  const rootPkg = await readPackageJson(source, 'package.json');
+  if (rootPkg) out.push(...aliasesFromPackageImports(rootPkg, ''));
+  return out;
+}
+
+interface PackageJsonLite {
+  name?: string;
+  exports?: unknown;
+  imports?: unknown;
+}
+
+async function readPackageJson(source: FileSource, rel: string): Promise<PackageJsonLite | null> {
+  try {
+    return parsePackageJson(await source.read(rel));
+  } catch {
+    return null;
+  }
+}
+
+function parsePackageJson(raw: string): PackageJsonLite | null {
+  try {
+    const json = JSON.parse(raw) as { name?: unknown; exports?: unknown; imports?: unknown };
+    return {
+      ...(typeof json.name === 'string' && json.name.length > 0 ? { name: json.name } : {}),
+      ...(json.exports !== undefined ? { exports: json.exports } : {}),
+      ...(json.imports !== undefined ? { imports: json.imports } : {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function aliasesFromPackageExports(pkg: PackageJsonLite, dir: string): PathAlias[] {
+  if (pkg.exports === undefined) return [];
+  const out: PathAlias[] = [];
+  if (typeof pkg.exports === 'string') {
+    out.push({ prefix: '', targets: [posixJoin(dir, pkg.exports)], exact: true });
+    return out;
+  }
+  if (!pkg.exports || typeof pkg.exports !== 'object' || Array.isArray(pkg.exports)) return [];
+  if (isConditionalExportsObject(pkg.exports)) {
+    const targets = pickPackageTargets(pkg.exports);
+    const mapped = targets
+      .filter((target) => !target.includes('*'))
+      .map((target) => posixJoin(dir, target));
+    if (mapped.length > 0) out.push({ prefix: '', targets: mapped, exact: true });
+    return out;
+  }
+  for (const [subpath, value] of Object.entries(pkg.exports as Record<string, unknown>)) {
+    if (!subpath.startsWith('.')) continue;
+    const targets = pickPackageTargets(value);
+    if (targets.length === 0) continue;
+    const wildcard = wildcardAlias(subpath, targets, dir);
+    if (wildcard) {
+      out.push(wildcard);
+      continue;
+    }
+    const suffix = subpath === '.' ? '' : subpath.slice(1);
+    if (suffix.includes('*')) continue;
+    const mapped = targets
+      .filter((target) => !target.includes('*'))
+      .map((target) => posixJoin(dir, target));
+    if (mapped.length === 0) continue;
+    out.push({ prefix: suffix, targets: mapped, exact: true });
+  }
+  return out;
+}
+
+function isConditionalExportsObject(value: unknown): boolean {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  return Object.keys(value).some((key) => ['types', 'import', 'require', 'default'].includes(key));
+}
+
+function aliasesFromPackageImports(pkg: PackageJsonLite, dir: string): PathAlias[] {
+  if (!pkg.imports || typeof pkg.imports !== 'object' || Array.isArray(pkg.imports)) return [];
+  const out: PathAlias[] = [];
+  for (const [key, value] of Object.entries(pkg.imports as Record<string, unknown>)) {
+    if (!key.startsWith('#')) continue;
+    const targets = pickPackageTargets(value);
+    const wildcard = wildcardAlias(key, targets, dir);
+    if (wildcard) {
+      out.push(wildcard);
+      continue;
+    }
+    if (key.includes('*')) continue;
+    const mapped = targets
+      .filter((target) => !target.includes('*'))
+      .map((target) => posixJoin(dir, target));
+    if (mapped.length === 0) continue;
+    out.push({ prefix: key, targets: mapped, exact: true });
+  }
+  return out;
+}
+
+function wildcardAlias(key: string, targets: readonly string[], dir: string): PathAlias | null {
+  if (!key.includes('*')) return null;
+  const mapped = targets
+    .filter((target) => target.includes('*'))
+    .map((target) => posixJoin(dir, beforeStar(stripPackageTargetPrefix(target))));
+  if (mapped.length === 0) return null;
+  const prefix = beforeStar(key === './*' ? '' : key.startsWith('.') ? key.slice(1) : key);
+  if (!prefix) return null;
+  return { prefix, targets: mapped };
+}
+
+function beforeStar(value: string): string {
+  const head = value.slice(0, value.indexOf('*'));
+  return head.replace(/\/+$/u, '');
+}
+
+function pickPackageTargets(value: unknown): string[] {
+  if (typeof value === 'string') return [stripPackageTargetPrefix(value)];
+  if (Array.isArray(value)) {
+    const out: string[] = [];
+    for (const item of value) {
+      out.push(...pickPackageTargets(item));
+    }
+    return dedupeStrings(out);
+  }
+  if (!value || typeof value !== 'object') return [];
+  const conditions = value as Record<string, unknown>;
+  const out: string[] = [];
+  for (const key of ['types', 'import', 'require', 'default']) {
+    out.push(...pickPackageTargets(conditions[key]));
+  }
+  return dedupeStrings(out);
+}
+
+function stripPackageTargetPrefix(target: string): string {
+  return target.replace(/^\.\//u, '');
+}
+
+function dedupeStrings(values: readonly string[]): string[] {
+  return [...new Set(values)];
+}
+
+function frameworkDefaultAliases(framework: ProjectRef['detectedFramework']): PathAlias[] {
+  if (framework === 'svelte') {
+    return [{ prefix: '$lib', targets: ['src/lib'] }];
+  }
+  if (framework === 'nuxt') {
+    return [
+      { prefix: '~', targets: [''] },
+      { prefix: '@', targets: [''] },
+      { prefix: '~~', targets: [''] },
+      { prefix: '@@', targets: [''] },
+    ];
+  }
+  return [];
+}
+
+function parseTsconfigExtends(content: string): string[] {
+  try {
+    const stripped = content.replace(/\/\*[\s\S]*?\*\//gu, '').replace(/\/\/[^\n]*/gu, '');
+    const json = JSON.parse(stripped) as { extends?: string | string[] };
+    if (!json.extends) return [];
+    return Array.isArray(json.extends) ? json.extends : [json.extends];
+  } catch {
+    return [];
+  }
+}
+
+function dedupeAliases(list: PathAlias[]): PathAlias[] {
+  const seen = new Set<string>();
+  const out: PathAlias[] = [];
+  for (const a of list) {
+    const key = `${a.prefix}\u0001${a.exact === true ? 'exact' : 'prefix'}\u0001${a.targets.join('|')}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(a);
+  }
+  return out.sort((a, b) => b.prefix.length - a.prefix.length || Number(b.exact) - Number(a.exact));
+}
+
+function posixNormalize(p: string): string {
+  return p.replace(/\\/gu, '/').replace(/\/+/gu, '/');
+}
+
+function posixDirname(p: string): string {
+  const i = p.lastIndexOf('/');
+  return i === -1 ? '' : p.slice(0, i);
+}
+
+function posixJoin(a: string, b: string): string {
+  const segments = `${a}/${b}`.split('/');
+  const out: string[] = [];
+  for (const s of segments) {
+    if (s === '' || s === '.') continue;
+    if (s === '..') {
+      if (out.length > 0 && out[out.length - 1] !== '..') out.pop();
+      else out.push('..');
+      continue;
+    }
+    out.push(s);
+  }
+  return out.join('/');
+}

package/src/analyzer/memoryRisk.ts

@@ -0,0 +1,345 @@
+import ts from 'typescript';
+import type { FileSource } from './fileSource';
+import type { DetectedFramework, MemoryRiskFinding, MemoryRiskKind, ModuleNode } from './types';
+
+export interface DetectMemoryRisksInput {
+  source: FileSource;
+  modules: readonly ModuleNode[];
+  framework: DetectedFramework;
+}
+
+interface RiskPattern {
+  kind: MemoryRiskKind;
+  acquire: string;
+  cleanup: string;
+  testAcquire(node: ts.Node): boolean;
+  testCleanup(node: ts.Node): boolean;
+}
+
+interface RiskContext {
+  module: ModuleNode;
+  framework: DetectedFramework;
+  sourceFile: ts.SourceFile;
+}
+
+const PATTERNS: readonly RiskPattern[] = [
+  {
+    kind: 'event-listener-cleanup',
+    acquire: 'addEventListener',
+    cleanup: 'removeEventListener',
+    testAcquire: isNamedCall('addEventListener'),
+    testCleanup: isNamedCall('removeEventListener'),
+  },
+  {
+    kind: 'timer-cleanup',
+    acquire: 'setInterval',
+    cleanup: 'clearInterval',
+    testAcquire: isNamedCall('setInterval'),
+    testCleanup: isNamedCall('clearInterval'),
+  },
+  {
+    kind: 'timer-cleanup',
+    acquire: 'setTimeout',
+    cleanup: 'clearTimeout',
+    testAcquire: isNamedCall('setTimeout'),
+    testCleanup: isNamedCall('clearTimeout'),
+  },
+  {
+    kind: 'observer-cleanup',
+    acquire: 'observer',
+    cleanup: 'disconnect',
+    testAcquire: isObserverCreation,
+    testCleanup: isNamedCall('disconnect'),
+  },
+  {
+    kind: 'object-url-cleanup',
+    acquire: 'createObjectURL',
+    cleanup: 'revokeObjectURL',
+    testAcquire: isNamedCall('createObjectURL'),
+    testCleanup: isNamedCall('revokeObjectURL'),
+  },
+  {
+    kind: 'subscription-cleanup',
+    acquire: 'subscribe',
+    cleanup: 'unsubscribe or stop handle',
+    testAcquire: isNamedCall('subscribe'),
+    testCleanup: isSubscriptionCleanup,
+  },
+];
+
+export async function detectMemoryRisks(
+  input: DetectMemoryRisksInput,
+): Promise<MemoryRiskFinding[]> {
+  const findings: MemoryRiskFinding[] = [];
+  for (const module of input.modules) {
+    if (module.runtime === 'server') continue;
+    const code = await readSource(input.source, module.id);
+    if (code === null) continue;
+    const script = scriptContent(module.id, code);
+    if (script.trim().length === 0) continue;
+    const sourceFile = ts.createSourceFile(
+      module.id,
+      script,
+      ts.ScriptTarget.Latest,
+      false,
+      scriptKindFor(module.id),
+    );
+    const context: RiskContext = {
+      module,
+      framework: input.framework,
+      sourceFile,
+    };
+    findings.push(...detectInModule(context));
+  }
+  return dedupeFindings(findings);
+}
+
+function detectInModule(context: RiskContext): MemoryRiskFinding[] {
+  if (context.framework === 'react' || context.framework === 'next') {
+    return detectReactRisks(context);
+  }
+  if (context.framework === 'vue' || context.framework === 'nuxt') {
+    return detectVueRisks(context);
+  }
+  if (context.framework === 'svelte') return detectSvelteRisks(context);
+  return detectGenericRisks(context);
+}
+
+function detectReactRisks(context: RiskContext): MemoryRiskFinding[] {
+  const findings: MemoryRiskFinding[] = [];
+  visit(context.sourceFile, (node) => {
+    if (!ts.isCallExpression(node) || !isIdentifierCall(node, 'useEffect')) return;
+    const callback = node.arguments[0];
+    if (!callback || !isFunctionLike(callback)) return;
+    const body = callback.body;
+    if (!ts.isBlock(body)) return;
+    const cleanup = returnedCleanup(body);
+    findings.push(...findMissingCleanup(context, body, cleanup, 'high'));
+  });
+  return findings;
+}
+
+function detectVueRisks(context: RiskContext): MemoryRiskFinding[] {
+  const findings: MemoryRiskFinding[] = [];
+  const unmountedCleanups = collectLifecycleCleanups(context.sourceFile, 'onUnmounted');
+  visit(context.sourceFile, (node) => {
+    if (!ts.isCallExpression(node) || !isIdentifierCall(node, 'onMounted')) return;
+    const callback = node.arguments[0];
+    if (!callback || !isFunctionLike(callback)) return;
+    const body = callback.body;
+    if (!ts.isBlock(body)) return;
+    findings.push(...findMissingCleanupInAny(context, body, unmountedCleanups, 'high'));
+  });
+  return findings;
+}
+
+function detectSvelteRisks(context: RiskContext): MemoryRiskFinding[] {
+  const findings: MemoryRiskFinding[] = [];
+  visit(context.sourceFile, (node) => {
+    if (!ts.isCallExpression(node) || !isIdentifierCall(node, 'onMount')) return;
+    const callback = node.arguments[0];
+    if (!callback || !isFunctionLike(callback)) return;
+    const body = callback.body;
+    if (!ts.isBlock(body)) return;
+    const cleanup = returnedCleanup(body);
+    findings.push(...findMissingCleanup(context, body, cleanup, 'high'));
+  });
+  return findings;
+}
+
+function detectGenericRisks(context: RiskContext): MemoryRiskFinding[] {
+  return findMissingCleanup(context, context.sourceFile, context.sourceFile, 'medium');
+}
+
+function findMissingCleanup(
+  context: RiskContext,
+  acquireRoot: ts.Node,
+  cleanupRoot: ts.Node | undefined,
+  confidence: MemoryRiskFinding['confidence'],
+): MemoryRiskFinding[] {
+  const findings: MemoryRiskFinding[] = [];
+  for (const pattern of PATTERNS) {
+    const acquire = findFirst(acquireRoot, pattern.testAcquire);
+    if (!acquire) continue;
+    const hasCleanup = cleanupRoot ? hasNode(cleanupRoot, pattern.testCleanup) : false;
+    if (hasCleanup) continue;
+    findings.push(buildFinding(context, pattern, acquire, confidence));
+  }
+  return findings;
+}
+
+function findMissingCleanupInAny(
+  context: RiskContext,
+  acquireRoot: ts.Node,
+  cleanupRoots: readonly ts.Node[],
+  confidence: MemoryRiskFinding['confidence'],
+): MemoryRiskFinding[] {
+  const findings: MemoryRiskFinding[] = [];
+  for (const pattern of PATTERNS) {
+    const acquire = findFirst(acquireRoot, pattern.testAcquire);
+    if (!acquire) continue;
+    const hasCleanup = cleanupRoots.some((root) => hasNode(root, pattern.testCleanup));
+    if (hasCleanup) continue;
+    findings.push(buildFinding(context, pattern, acquire, confidence));
+  }
+  return findings;
+}
+
+function buildFinding(
+  context: RiskContext,
+  pattern: RiskPattern,
+  node: ts.Node,
+  confidence: MemoryRiskFinding['confidence'],
+): MemoryRiskFinding {
+  const line =
+    context.sourceFile.getLineAndCharacterOfPosition(node.getStart(context.sourceFile)).line + 1;
+  return {
+    id: `memory:${pattern.kind}:${context.module.id}:${line}`,
+    kind: pattern.kind,
+    moduleId: context.module.id,
+    framework: context.framework,
+    severity: 'medium',
+    confidence,
+    evidence: [
+      {
+        message: `${pattern.acquire} has no visible ${pattern.cleanup} cleanup`,
+        line,
+        acquire: pattern.acquire,
+        expectedCleanup: pattern.cleanup,
+      },
+    ],
+    remediation: remediationFor(pattern.kind),
+  };
+}
+
+function returnedCleanup(block: ts.Block): ts.Node | undefined {
+  for (const statement of block.statements) {
+    if (!ts.isReturnStatement(statement) || !statement.expression) continue;
+    return statement.expression;
+  }
+  return undefined;
+}
+
+function collectLifecycleCleanups(sourceFile: ts.SourceFile, name: string): ts.Node[] {
+  const nodes: ts.Node[] = [];
+  visit(sourceFile, (node) => {
+    if (!ts.isCallExpression(node) || !isIdentifierCall(node, name)) return;
+    const callback = node.arguments[0];
+    if (callback && isFunctionLike(callback)) nodes.push(callback.body);
+  });
+  return nodes;
+}
+
+function visit(node: ts.Node, cb: (node: ts.Node) => void): void {
+  cb(node);
+  ts.forEachChild(node, (child) => visit(child, cb));
+}
+
+function findFirst(root: ts.Node, predicate: (node: ts.Node) => boolean): ts.Node | undefined {
+  let found: ts.Node | undefined;
+  visit(root, (node) => {
+    if (!found && predicate(node)) found = node;
+  });
+  return found;
+}
+
+function hasNode(root: ts.Node, predicate: (node: ts.Node) => boolean): boolean {
+  return findFirst(root, predicate) !== undefined;
+}
+
+function isFunctionLike(node: ts.Node): node is ts.ArrowFunction | ts.FunctionExpression {
+  return ts.isArrowFunction(node) || ts.isFunctionExpression(node);
+}
+
+function isNamedCall(name: string): (node: ts.Node) => boolean {
+  return (node) => ts.isCallExpression(node) && callName(node.expression) === name;
+}
+
+function isIdentifierCall(node: ts.CallExpression, name: string): boolean {
+  return ts.isIdentifier(node.expression) && node.expression.text === name;
+}
+
+function isObserverCreation(node: ts.Node): boolean {
+  if (!ts.isNewExpression(node)) return false;
+  if (!ts.isIdentifier(node.expression)) return false;
+  return ['IntersectionObserver', 'MutationObserver', 'ResizeObserver'].includes(
+    node.expression.text,
+  );
+}
+
+function isSubscriptionCleanup(node: ts.Node): boolean {
+  if (!ts.isCallExpression(node)) return false;
+  const name = callName(node.expression);
+  return name === 'unsubscribe' || name === 'stop';
+}
+
+function callName(expression: ts.Expression): string | null {
+  if (ts.isIdentifier(expression)) return expression.text;
+  if (ts.isPropertyAccessExpression(expression)) return expression.name.text;
+  return null;
+}
+
+function remediationFor(kind: MemoryRiskKind): string {
+  switch (kind) {
+    case 'event-listener-cleanup':
+      return 'Remove the listener from the matching component teardown lifecycle.';
+    case 'timer-cleanup':
+      return 'Keep the timer handle and clear it during teardown.';
+    case 'observer-cleanup':
+      return 'Disconnect the observer during teardown.';
+    case 'object-url-cleanup':
+      return 'Revoke created object URLs after the preview or download is no longer needed.';
+    case 'subscription-cleanup':
+      return 'Store the unsubscribe handle and call it during teardown.';
+  }
+}
+
+function dedupeFindings(findings: readonly MemoryRiskFinding[]): MemoryRiskFinding[] {
+  const seen = new Set<string>();
+  const out: MemoryRiskFinding[] = [];
+  for (const finding of findings) {
+    if (seen.has(finding.id)) continue;
+    seen.add(finding.id);
+    out.push(finding);
+  }
+  return out;
+}
+
+async function readSource(source: FileSource, moduleId: string): Promise<string | null> {
+  try {
+    return await source.read(moduleId);
+  } catch {
+    return null;
+  }
+}
+
+function scriptContent(moduleId: string, content: string): string {
+  if (moduleId.endsWith('.vue') || moduleId.endsWith('.svelte')) {
+    const blocks: string[] = [];
+    const lower = content.toLowerCase();
+    let offset = 0;
+    while (offset < content.length) {
+      const openStart = lower.indexOf('<script', offset);
+      if (openStart === -1) break;
+      const openEnd = lower.indexOf('>', openStart + '<script'.length);
+      if (openEnd === -1) break;
+      const closeStart = lower.indexOf('</script', openEnd + 1);
+      if (closeStart === -1) break;
+      const closeEnd = lower.indexOf('>', closeStart + '</script'.length);
+      const block = content.slice(openEnd + 1, closeStart);
+      if (block) blocks.push(block);
+      offset = closeEnd === -1 ? closeStart + '</script'.length : closeEnd + 1;
+    }
+    return blocks.join('\n');
+  }
+  return content;
+}
+
+function scriptKindFor(moduleId: string): ts.ScriptKind {
+  if (moduleId.endsWith('.tsx')) return ts.ScriptKind.TSX;
+  if (moduleId.endsWith('.jsx')) return ts.ScriptKind.JSX;
+  if (moduleId.endsWith('.js') || moduleId.endsWith('.mjs') || moduleId.endsWith('.cjs')) {
+    return ts.ScriptKind.JS;
+  }
+  return ts.ScriptKind.TS;
+}