@chem-x/starter-kit 26.9.28-1234 → 26.10.4-1258

package/cli/audit/ai-slop-detector.js

@@ -73,10 +73,38 @@ const normalizeWords = (text) => {
     .filter((w) => w.length > 1 && !STOP_WORDS.has(w));
 };
 
+// A line-based scan cannot tell a comment from a string that quotes one. Walk the line
+// up to the match and track quote state: if a quote is still open at that offset, the
+// match sits inside a string literal and is describing the pattern, not committing it.
+// Lines that are wholly a comment short-circuit, so apostrophes in prose cannot open a
+// phantom string and suppress a real finding.
+const COMMENT_LINE_START = /^\s*(?:\/\/|#|\*|--)/;
+
+const isInsideStringLiteral = (lineText, matchIndex) => {
+  if (matchIndex <= 0) return false;
+  if (COMMENT_LINE_START.test(lineText)) return false;
+
+  let quote = null;
+  for (let i = 0; i < matchIndex; i += 1) {
+    const ch = lineText[i];
+    if (ch === '\\') {
+      i += 1;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = null;
+    } else if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch;
+    }
+  }
+  return quote !== null;
+};
+
 export const checkSlopTextPatterns = (content, lines, relativePath, violations) => {
   lines.forEach((lineText, idx) => {
     for (const pat of CONVERSATIONAL_PATTERNS) {
-      if (pat.regex.test(lineText)) {
+      const hit = pat.regex.exec(lineText);
+      if (hit && !isInsideStringLiteral(lineText, hit.index)) {
         const meta = RULE_REGISTRY[pat.rule];
         violations.push({
           filePath: relativePath,

package/cli/audit/slop-string-literal.spec.js

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { auditCode } from './rules.js';
+
+const fired = (code, file = 'src/thing.js') =>
+  auditCode(code, file, file).some((v) => v.rule === 'AI_SLOP_LAZY_PLACEHOLDER');
+
+test('slop: real truncation placeholder in a comment still fires', () => {
+  assert.equal(fired('function a() {\n  // ... rest of code\n}\n'), true);
+});
+
+test('slop: trailing truncation comment after code still fires', () => {
+  assert.equal(fired('doThing();  // ... remaining implementation\n'), true);
+});
+
+test('slop: placeholder text inside a double-quoted string does not fire', () => {
+  const code = 'const copy = "Blocks lazy \'// ...rest of code\' truncation placeholders";\n';
+  assert.equal(fired(code), false, 'marketing copy describing the pattern must not be flagged');
+});
+
+test('slop: placeholder text inside a single-quoted string does not fire', () => {
+  const code = "const copy = 'we detect // ... existing code markers';\n";
+  assert.equal(fired(code), false);
+});
+
+test('slop: placeholder inside a template literal does not fire', () => {
+  const code = 'const copy = `catches // ... remaining logic in your diff`;\n';
+  assert.equal(fired(code), false);
+});
+
+test('slop: string-literal guard applies to non-JS languages too', () => {
+  const py = 'DESCRIPTION = "flags // ... rest of code placeholders"\n';
+  assert.equal(fired(py, 'services/detect.py'), false);
+});

package/cli/languages.js

@@ -76,6 +76,14 @@ export const LANGUAGE_DEFINITIONS = {
     parser: 'jvm',
     commentPrefix: '//',
     blockComment: { start: '/*', end: '*/' }
+  },
+  cpp: {
+    id: 'cpp',
+    name: 'C / C++',
+    extensions: new Set(['.c', '.h', '.cpp', '.cc', '.cxx', '.hpp', '.hxx', '.hh', '.inl']),
+    parser: 'cpp',
+    commentPrefix: '//',
+    blockComment: { start: '/*', end: '*/' }
   }
 };
 

package/cli/languages.spec.js

@@ -42,3 +42,24 @@ test('languages: resolves language metadata', () => {
   assert.equal(py.id, 'python');
   assert.equal(py.commentPrefix, '#');
 });
+
+test('languages: recognizes C and C++ source extensions', () => {
+  assert.equal(isSourceFile('StreamDecoder.cpp'), true);
+  assert.equal(isSourceFile('StreamDecoder.cc'), true);
+  assert.equal(isSourceFile('StreamDecoder.cxx'), true);
+  assert.equal(isSourceFile('StreamDecoder.hpp'), true);
+  assert.equal(isSourceFile('StreamDecoder.h'), true);
+  assert.equal(isSourceFile('legacy_shim.c'), true);
+});
+
+test('languages: maps C and C++ extensions to the cpp language', () => {
+  assert.equal(getLanguageForFile('StreamDecoder.cpp').id, 'cpp');
+  assert.equal(getLanguageForFile('StreamDecoder.h').id, 'cpp');
+  assert.equal(getLanguageForFile('legacy_shim.c').id, 'cpp');
+  assert.equal(LANGUAGE_DEFINITIONS.cpp.name, 'C / C++');
+});
+
+test('languages: C and C++ are not babel parsable', () => {
+  assert.equal(isBabelParsable('StreamDecoder.cpp'), false);
+  assert.equal(isBabelParsable('StreamDecoder.h'), false);
+});

package/cli/polyglot.spec.js

@@ -109,3 +109,114 @@ func TestDummy(t *testing.T) {
   assert.equal(goViolations.some((v) => v.rule === 'SYNTAX_PARSE_ERROR'), false);
   assert.equal(goViolations.some((v) => v.rule === 'SYNTHETIC_MOCK_DATA'), true);
 });
+
+test('polyglot: extracts C++ classes, structs, functions and includes', () => {
+  const cppCode = `
+#include <memory>
+#include "vendor/codec.h"
+
+namespace audio {
+
+struct FrameHeader {
+    uint32_t size;
+};
+
+enum class Codec { Opus, Flac };
+
+class StreamDecoder : public IDecoder {
+public:
+    bool DecodeFrame(const FrameHeader& header);
+};
+
+bool StreamDecoder::DecodeFrame(const FrameHeader& header) {
+    return header.size > 0;
+}
+
+}  // namespace audio
+`;
+
+  const meta = extractAstMetadata(cppCode, 'src/audio/StreamDecoder.cpp');
+  const names = meta.symbols.map((s) => s.name);
+  assert.ok(names.includes('StreamDecoder'), 'must extract class StreamDecoder');
+  assert.ok(names.includes('FrameHeader'), 'must extract struct FrameHeader');
+  assert.ok(names.includes('Codec'), 'must extract enum class Codec');
+  assert.ok(names.includes('DecodeFrame'), 'must extract method DecodeFrame');
+  assert.ok(meta.imports.some((i) => i.sourceModule === 'vendor/codec.h'), 'must map #include to imports');
+  assert.ok(meta.imports.some((i) => i.sourceModule === 'memory'), 'must map angle-bracket includes');
+});
+
+test('polyglot: audits C++ without Babel syntax errors', () => {
+  const cppCode = `
+#include <string>
+void Connect() {
+    std::string email = "user@example.com";
+}
+`;
+  const violations = auditCode(cppCode, 'src/net/Client.cpp', 'src/net/Client.cpp');
+  assert.equal(violations.some((v) => v.rule === 'SYNTAX_PARSE_ERROR'), false, 'C++ must not trigger Babel SYNTAX_PARSE_ERROR');
+  assert.equal(violations.some((v) => v.rule === 'SYNTHETIC_MOCK_DATA'), true, 'must detect placeholder email in C++');
+});
+
+test('polyglot: extracts Rust items and use imports', () => {
+  const rustCode = `
+use std::sync::Arc;
+
+pub struct Decoder {
+    buffer: Vec<u8>,
+}
+
+pub enum State { Idle, Running }
+
+pub trait Sink {
+    fn write(&self, data: &[u8]);
+}
+
+impl Decoder {
+    pub fn new() -> Self { Decoder { buffer: Vec::new() } }
+}
+`;
+  const meta = extractAstMetadata(rustCode, 'src/decoder.rs');
+  const names = meta.symbols.map((s) => s.name);
+  assert.ok(names.includes('Decoder'), 'must extract pub struct');
+  assert.ok(names.includes('State'), 'must extract pub enum');
+  assert.ok(names.includes('Sink'), 'must extract pub trait');
+  assert.ok(names.includes('new'), 'must extract fn');
+  assert.ok(meta.imports.some((i) => i.sourceModule === 'std::sync::Arc'), 'must map use statements');
+});
+
+test('polyglot: extracts Kotlin declarations and imports', () => {
+  const kotlinCode = `
+import kotlinx.coroutines.flow.Flow
+
+class ConsentRepository(private val api: Api) {
+    fun observe(): Flow<List<Consent>> = api.stream()
+}
+
+data class Consent(val id: String)
+
+object Registry {
+    fun lookup(id: String) = id
+}
+`;
+  const meta = extractAstMetadata(kotlinCode, 'src/main/kotlin/ConsentRepository.kt');
+  const names = meta.symbols.map((s) => s.name);
+  assert.ok(names.includes('ConsentRepository'), 'must extract class');
+  assert.ok(names.includes('Consent'), 'must extract data class');
+  assert.ok(names.includes('Registry'), 'must extract object');
+  assert.ok(names.includes('observe'), 'must extract fun');
+  assert.ok(meta.imports.some((i) => i.sourceModule === 'kotlinx.coroutines.flow.Flow'), 'must map kotlin imports');
+});
+
+test('polyglot: declaration keywords never leak in as symbol names', () => {
+  const cppCode = `
+enum class Codec { Opus, Flac };
+struct Frame { int size; };
+namespace audio { }
+`;
+  const meta = extractAstMetadata(cppCode, 'src/audio/Codec.h');
+  const names = meta.symbols.map((s) => s.name);
+  assert.equal(names.includes('class'), false, 'bare "class" must not be extracted as a symbol');
+  assert.equal(names.includes('struct'), false, 'bare "struct" must not be extracted as a symbol');
+  assert.ok(names.includes('Codec'));
+  assert.ok(names.includes('Frame'));
+});

package/cli/reader-polyglot.spec.js

@@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { generateAstOutline } from './reader.js';
+
+const CPP = `
+#include <memory>
+namespace audio {
+struct FrameHeader { uint32_t size; };
+class StreamDecoder : public IDecoder {
+public:
+    bool DecodeFrame(const FrameHeader& header);
+};
+}
+`;
+
+const PY = `
+import os
+
+class ConsentService:
+    def revoke(self, user_id):
+        return True
+
+def helper(x):
+    return x
+`;
+
+test('outline: renders C++ declarations instead of an empty header', () => {
+  const out = generateAstOutline(CPP, 'src/audio/StreamDecoder.cpp');
+  const body = out.split('\n').filter((l) => !l.startsWith('// Outline:'));
+  assert.ok(body.length > 0, `expected symbols, got only the header:\n${out}`);
+  assert.ok(out.includes('StreamDecoder'), `expected StreamDecoder in:\n${out}`);
+  assert.ok(out.includes('FrameHeader'), `expected FrameHeader in:\n${out}`);
+});
+
+test('outline: renders Python declarations instead of an empty header', () => {
+  const out = generateAstOutline(PY, 'services/consent.py');
+  const body = out.split('\n').filter((l) => !l.startsWith('// Outline:'));
+  assert.ok(body.length > 0, `expected symbols, got only the header:\n${out}`);
+  assert.ok(out.includes('ConsentService'), `expected ConsentService in:\n${out}`);
+});
+
+test('outline: still renders JavaScript exports unchanged', () => {
+  const js = `export const FOO = 1;\nexport function bar(a) { return a; }\n`;
+  const out = generateAstOutline(js, 'cli/thing.js');
+  assert.ok(out.includes('FOO'), out);
+  assert.ok(out.includes('bar'), out);
+});

package/cli/reader.js

@@ -4,6 +4,8 @@ import { parse } from '@babel/parser';
 import traverseModule from '@babel/traverse';
 import { ANSI } from './theme.js';
 import { resolveSafePath } from './path-scope.js';
+import { isBabelParsable } from './languages.js';
+import { extractAstMetadata } from './search-ast.js';
 
 import {
   stripCodeComments,
@@ -34,6 +36,12 @@ const traverse = traverseModule.default || traverseModule;
  * @param {string} filePath File path for parser context.
  * @returns {string} Compressed structural outline.
  */
+const OUTLINE_KIND_LABELS = {
+  class: 'class',
+  function: 'function',
+  symbol: 'symbol'
+};
+
 export const generateAstOutline = (code, filePath) => {
   const isVue = filePath.endsWith('.vue');
   const isSvelte = filePath.endsWith('.svelte');
@@ -52,6 +60,21 @@ export const generateAstOutline = (code, filePath) => {
   const lines = [];
   lines.push(`// Outline: ${filePath}`);
 
+  // Babel cannot parse C/C++, Python, Go, Rust, Java, C# or Kotlin. It also does not
+  // throw on them, because errorRecovery swallows the failure and yields an empty AST,
+  // so the catch-block fallback below never fires for these files. Route them to the
+  // polyglot extractor instead.
+  if (!isBabelParsable(filePath)) {
+    const meta = extractAstMetadata(scriptContent, filePath);
+    const seen = new Set();
+    for (const sym of meta.symbols) {
+      if (!sym?.name || seen.has(sym.name)) continue;
+      seen.add(sym.name);
+      lines.push(`${OUTLINE_KIND_LABELS[sym.kind] || 'symbol'} ${sym.name}`);
+    }
+    return lines.join('\n');
+  }
+
   try {
     const ast = parse(scriptContent, {
       sourceType: 'module',

package/cli/search-ast.js

@@ -21,6 +21,17 @@ export const resolveArchitectureTier = (relativePath) => {
   return 'utility';
 };
 
+const CPP_NON_DECLARATION_KEYWORDS = new Set([
+  'if', 'for', 'while', 'switch', 'catch', 'return', 'sizeof', 'else', 'do', 'throw', 'new', 'delete'
+]);
+
+// Declaration keywords are never symbol names. Guards cross-language regex overlap,
+// e.g. the Rust `enum` pattern matching C++ `enum class Codec` and capturing `class`.
+const RESERVED_SYMBOL_NAMES = new Set([
+  'class', 'struct', 'enum', 'union', 'interface', 'object', 'fun', 'trait', 'impl', 'mod',
+  'namespace', 'typename', 'template', 'public', 'private', 'protected', 'static', 'const'
+]);
+
 const extractRegexFallback = (content, filePath = '') => {
   const symbols = [];
   const imports = [];
@@ -47,6 +58,49 @@ const extractRegexFallback = (content, filePath = '') => {
     symbols.push({ name: m[1], kind: 'function', isExport: true, startLine: 1, endLine: 1, signature: '' });
   }
 
+  const cppTypeMatches = content.matchAll(/\b(?:class|struct|union|enum(?:\s+class)?)\s+([A-Za-z_][A-Za-z0-9_]*)/g);
+  for (const m of cppTypeMatches) {
+    if (!RESERVED_SYMBOL_NAMES.has(m[1])) {
+      symbols.push({ name: m[1], kind: 'class', isExport: true, startLine: 1, endLine: 1, signature: '' });
+    }
+  }
+
+  const cppQualifiedMatches = content.matchAll(/\b[A-Za-z_][A-Za-z0-9_]*\s*::\s*([A-Za-z_~][A-Za-z0-9_]*)\s*\(/g);
+  for (const m of cppQualifiedMatches) {
+    symbols.push({ name: m[1], kind: 'function', isExport: true, startLine: 1, endLine: 1, signature: '' });
+  }
+
+  const cppDeclMatches = content.matchAll(/^[ \t]*(?:[A-Za-z_][A-Za-z0-9_:<>,*& \t]*?)\s+\*?([A-Za-z_][A-Za-z0-9_]*)\s*\([^)]*\)\s*(?:const\s*)?[;{]/gm);
+  for (const m of cppDeclMatches) {
+    if (!CPP_NON_DECLARATION_KEYWORDS.has(m[1])) {
+      symbols.push({ name: m[1], kind: 'function', isExport: true, startLine: 1, endLine: 1, signature: '' });
+    }
+  }
+
+  const rustMatches = content.matchAll(/\b(?:pub\s+)?(?:struct|enum|trait|impl|mod|fn)\s+([A-Za-z_][A-Za-z0-9_]*)/g);
+  for (const m of rustMatches) {
+    if (!RESERVED_SYMBOL_NAMES.has(m[1])) {
+      symbols.push({ name: m[1], kind: 'symbol', isExport: true, startLine: 1, endLine: 1, signature: '' });
+    }
+  }
+
+  const kotlinMatches = content.matchAll(/\b(?:data\s+|sealed\s+|open\s+|abstract\s+|inner\s+)?(?:class|object|interface|fun)\s+([A-Za-z_][A-Za-z0-9_]*)/g);
+  for (const m of kotlinMatches) {
+    if (!RESERVED_SYMBOL_NAMES.has(m[1])) {
+      symbols.push({ name: m[1], kind: 'symbol', isExport: true, startLine: 1, endLine: 1, signature: '' });
+    }
+  }
+
+  const cppIncludes = content.matchAll(/#include\s*[<"]([^>"]+)[>"]/g);
+  for (const m of cppIncludes) {
+    imports.push({ importedSymbol: '*', sourceModule: m[1], line: 1 });
+  }
+
+  const rustUses = content.matchAll(/\buse\s+([A-Za-z_][A-Za-z0-9_]*(?:::[A-Za-z_][A-Za-z0-9_]*)+)/g);
+  for (const m of rustUses) {
+    imports.push({ importedSymbol: '*', sourceModule: m[1], line: 1 });
+  }
+
   const csImports = content.matchAll(/using\s+([A-Za-z0-9_.]+);/g);
   for (const m of csImports) {
     imports.push({ importedSymbol: '*', sourceModule: m[1], line: 1 });

package/cli/search.js

@@ -36,6 +36,7 @@ import {
 import { runGenerateWizard } from './generator.js';
 import { runMutatorCli } from './mutators.js';
 import { toColumnar } from './columnar.js';
+import { resolveTargetDir } from './path-scope.js';
 import { ANSI } from './theme.js';
 
 export { toColumnar, fromColumnar } from './columnar.js';
@@ -207,7 +208,7 @@ const formatTierBadge = (tier) => {
   return map[tier] || `${ANSI.DIM}[${tier}]${ANSI.RESET}`;
 };
 
-export { resolveTargetDir } from './path-scope.js';
+export { resolveTargetDir };
 
 export const printSearchHelp = () => {
   const BOLD = '\x1b[1m';

package/cli/search.spec.js

@@ -277,3 +277,18 @@ test('hybrid search: natural language "toggle a task item" ranks useTaskListCont
   } catch {}
 });
 
+
+test('runSearch: resolveTargetDir is bound in module scope, not only re-exported', async () => {
+  const { runSearch } = await import('./search.js');
+  let caught = null;
+  try {
+    await runSearch(['__chemx_nonexistent_symbol__'], false);
+  } catch (err) {
+    caught = err;
+  }
+  assert.equal(
+    caught instanceof ReferenceError,
+    false,
+    `runSearch threw a ReferenceError: ${caught && caught.message}`
+  );
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chem-x/starter-kit",
-  "version": "26.9.28-1234",
+  "version": "26.10.4-1258",
   "description": "Chemical X Protocol: Private drop-in architecture starter kit and capsule generator",
   "type": "module",
   "bin": {