@ddtcorex/dsh-maestro-review 0.1.0 → 0.1.2

package/src/host/git-worktree-tool.ts

@@ -0,0 +1,130 @@
+import { join, resolve, sep, basename } from 'node:path'
+import { stat, realpath } from 'node:fs/promises'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import type { Context } from '@deepseek-ai/cordis'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import z from '@deepseek-ai/schemastery'
+
+export const name='maestro-git-worktree-tool'
+export const inject=['tools']
+export const Config:z<{rootPath?:string}> = z.object({rootPath:z.string()})
+interface SC{agent?:{session?:{header?:{cwd?:string}}}}
+function workspaceRootFor(c:string|undefined,e:unknown):string{ if(c!==undefined) return c; const cwd=(e as SC|undefined)?.agent?.session?.header?.cwd; return typeof cwd==='string'&&cwd!==''?cwd:process.cwd()}
+async function isInsideRoot(r:string,t:string):Promise<boolean>{
+  const ar=resolve(r); const rs=resolve(ar,t)
+  if(rs!==ar && !rs.startsWith(ar+sep)) return false
+  // For non-existent targets (create), realpath fails — allow if string prefix passes and parent is inside
+  try{ const rr=await realpath(ar); const rt=await realpath(rs); return rt===rr||rt.startsWith(rr+sep)}catch{
+    try{ const rr=await realpath(ar); const parent=resolve(rs,'..'); const rp=await realpath(parent); return rp===rr||rp.startsWith(rr+sep) }catch{ return rs===ar || rs.startsWith(ar+sep) }
+  }
+}
+const SAFE_BRANCH=/^[A-Za-z0-9._\/-]+$/
+const execFileAsync=promisify(execFile)
+async function runGit(cwd:string, args:string[]):Promise<{code:number|null, stdout:string, stderr:string}>{
+  try{
+    const {stdout, stderr}=await execFileAsync('git', args, {cwd, timeout:10000}) as any
+    return {code:0, stdout: String(stdout), stderr: String(stderr)}
+  }catch(e:any){
+    return {code:e.code ?? 1, stdout: e.stdout ?? '', stderr: e.stderr ?? String(e.message)}
+  }
+}
+async function exists(p:string):Promise<boolean>{ try{await stat(p); return true}catch{return false}}
+
+export function apply(ctx:Context, config:{rootPath?:string}={}):void{
+  const configuredRoot=config.rootPath
+  ctx.effect(()=>ctx.tools.register(defineTool({
+    name:'git_worktree',
+    description:'Inspect/create/remove git worktrees deterministically (isolated workspace, branch, submodule guard).',
+    parameters:{
+      op:{type:'string', enum:['inspect','create','remove'], required:true},
+      worktreePath:{type:'string', required:true},
+      branch:{type:'string'},
+      base:{type:'string'},
+    },
+    output:{
+      schema:{
+        type:'object', additionalProperties:true,
+        properties:{
+          op:{type:'string', required:true},
+          exists:{type:'boolean'},
+          isWorktree:{type:'boolean'},
+          created:{type:'boolean'},
+          reason:{type:'string'},
+        }
+      },
+      render:(_a,v)=>[{type:'text', text: JSON.stringify(v,null,2)}],
+    },
+    async execute(args, exec){
+      const op=(args as {op:string}).op
+      const rawPath=(args as {worktreePath:string}).worktreePath
+      const root=workspaceRootFor(configuredRoot, exec)
+      if(!(await isInsideRoot(root, rawPath))) return {text:`Path "${rawPath}" escapes the workspace root.`, truncated:false} as never
+      const worktreePath=resolve(root, rawPath)
+
+      if(op==='inspect'){
+        const ex=await exists(worktreePath)
+        let isWorktree=false, branch:string|null=null, headSha:string|null=null, isClean=true, gitDir:string|null=null, gitCommonDir:string|null=null
+        if(ex){
+          // try git rev-parse
+          const r1=await runGit(worktreePath, ['rev-parse','--git-dir'])
+          const r2=await runGit(worktreePath, ['rev-parse','--git-common-dir'])
+          const r3=await runGit(worktreePath, ['branch','--show-current'])
+          const r4=await runGit(worktreePath, ['rev-parse','HEAD'])
+          const r5=await runGit(worktreePath, ['status','--porcelain'])
+          if(r1.code===0) gitDir=r1.stdout.trim()
+          if(r2.code===0) gitCommonDir=r2.stdout.trim()
+          if(r3.code===0) branch=r3.stdout.trim()||null
+          if(r4.code===0) headSha=r4.stdout.trim()||null
+          isClean=r5.stdout.trim()===''
+          // isWorktree if gitDir is file and gitCommonDir differs
+          if(gitDir && gitCommonDir && gitDir!==gitCommonDir) isWorktree=true
+          // fallback: if worktreePath contains .worktrees
+          if(worktreePath.includes('/.worktrees/')) isWorktree=true
+        }
+        return {op:'inspect', exists:ex, branch, headSha, isClean, isWorktree, gitDir, gitCommonDir, untrackedFiles:[], truncated:false, ignored:null} as never
+      }
+      if(op==='create'){
+        const branch=(args as {branch?:string}).branch
+        const base=(args as {base?:string}).base ?? 'HEAD'
+        if(!branch) return {text:'branch required for create', truncated:false} as never
+        if(!SAFE_BRANCH.test(branch) || branch.startsWith('-') || branch.includes('..')) return {text:`invalid branch name "${branch}" — must match ${SAFE_BRANCH.source}`, truncated:false} as never
+        if(branch.includes('--')) return {text:`invalid branch name "${branch}"`, truncated:false} as never
+        // base validate
+        if(base && !SAFE_BRANCH.test(base) && !/^[0-9a-f]{7,40}$/.test(base)) return {text:`invalid base "${base}"`, truncated:false} as never
+        // .gitignore guard: check if worktreePath is ignored
+        const check=await runGit(root, ['check-ignore','-q', worktreePath])
+        const isIgnored=check.code===0
+        if(!isIgnored){
+          return {op:'create', created:false, worktreePath, branch, headSha:'', alreadyExisted:false, reason:'not ignored — add .worktrees to .gitignore'} as never
+        }
+        if(await exists(worktreePath)){
+          return {op:'create', created:false, worktreePath, branch, headSha:'', alreadyExisted:true, reason:'already exists'} as never
+        }
+        const res=await runGit(root, ['worktree','add','--', worktreePath,'-b', branch, base])
+        if(res.code!==0){
+          if(res.stderr.includes('permission denied') || res.stderr.includes('EACCES')){
+            return {op:'create', created:false, worktreePath, branch, headSha:'', alreadyExisted:false, reason:'blocked by sandbox — working in place'} as never
+          }
+          return {op:'create', created:false, worktreePath, branch, headSha:'', alreadyExisted:false, reason: res.stderr.slice(0,500)} as never
+        }
+        const head=await runGit(worktreePath, ['rev-parse','HEAD'])
+        return {op:'create', created:true, worktreePath, branch, headSha: head.stdout.trim(), alreadyExisted:false, reason:null} as never
+      }
+      if(op==='remove'){
+        const ex=await exists(worktreePath)
+        if(!ex) return {op:'remove', removed:false, pruned:false, reason:'not exists', dirtyFiles:[]} as never
+        const status=await runGit(worktreePath, ['status','--porcelain'])
+        const dirtyFiles=status.stdout.trim()? status.stdout.trim().split('\n').slice(0,20):[]
+        if(dirtyFiles.length>0){
+          return {op:'remove', removed:false, pruned:false, reason:'contains modified or untracked files', dirtyFiles} as never
+        }
+        const res=await runGit(root, ['worktree','remove','--', worktreePath])
+        if(res.code!==0) return {op:'remove', removed:false, pruned:false, reason: res.stderr.slice(0,500), dirtyFiles} as never
+        const prune=await runGit(root, ['worktree','prune'])
+        return {op:'remove', removed:true, pruned: prune.code===0, reason:null, dirtyFiles:[]} as never
+      }
+      return {text:`unknown op ${op}`, truncated:false} as never
+    }
+  }), 'git worktree'))
+}

package/src/host/govard-audit-lint-tool.ts

@@ -0,0 +1,153 @@
+import { spawn } from 'node:child_process'
+import { basename, dirname, resolve, sep } from 'node:path'
+import { realpath } from 'node:fs/promises'
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+
+export const name='maestro-govard-audit-lint-tool'
+export const inject=['tools']
+export const Config:z<{rootPath?:string, timeoutMs?:number}> = z.object({rootPath:z.string(), timeoutMs:z.number()})
+
+interface SC{agent?:{session?:{header?:{cwd?:string}}}}
+function workspaceRootFor(c:string|undefined, e:unknown):string{
+  if(c!==undefined) return c
+  const cwd=(e as SC|undefined)?.agent?.session?.header?.cwd
+  return typeof cwd==='string'&&cwd!==''?cwd:process.cwd()
+}
+async function isInsideRoot(r:string,t:string):Promise<boolean>{
+  const ar=resolve(r); const rs=resolve(ar,t)
+  if(rs!==ar && !rs.startsWith(ar+sep)) return false
+  let realRoot:string
+  try{ realRoot=await realpath(ar)}catch{ return true }
+  let existing=rs
+  const pending:string[]=[]
+  while(true){
+    let real:string
+    try{ real=await realpath(existing)}catch(err){
+      if((err as NodeJS.ErrnoException).code!=='ENOENT') return false
+      const parent=dirname(existing)
+      if(parent===existing) return false
+      pending.unshift(basename(existing))
+      existing=parent
+      continue
+    }
+    const realTarget=pending.length>0? resolve(real,...pending):real
+    if(realTarget!==realRoot && !realTarget.startsWith(realRoot+sep)) return false
+    return true
+  }
+}
+export function cleanJson(raw:string):string{
+  return raw.replace(/\n\s*ERROR audit run.*$/s, '').replace(/\s{2,}ERROR audit run.*$/s, '').trimEnd()
+}
+const DEFAULT_TIMEOUT=120000
+
+function run(cmd:string, args:string[], cwd:string, timeoutMs:number):Promise<{code:number|null, stdout:string, stderr:string, timedOut:boolean}>{
+  return new Promise((resolvePromise)=>{
+    const child=spawn(cmd, args, {cwd})
+    let stdout='', stderr=''
+    let timedOut=false
+    const timer=setTimeout(()=>{ timedOut=true; child.kill('SIGKILL') }, timeoutMs)
+    child.stdout?.on('data',(c:Buffer)=> stdout+=c.toString())
+    child.stderr?.on('data',(c:Buffer)=> stderr+=c.toString())
+    child.on('error',(err:Error)=>{ clearTimeout(timer); resolvePromise({code:null, stdout, stderr: err.message, timedOut:false}) })
+    child.on('close',(code)=>{ clearTimeout(timer); resolvePromise({code, stdout, stderr, timedOut}) })
+  })
+}
+
+export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number}={}):void{
+  const configuredRoot=config.rootPath
+  const defaultTimeout=config.timeoutMs ?? DEFAULT_TIMEOUT
+  ctx.effect(()=>ctx.tools.register(defineTool({
+    name:'govard_audit_lint',
+    description:'Run govard audit --checks lint --format json and return structured phpcs/phpstan results. Use before hand-parsing text.',
+    parameters:{
+      worktreePath:{type:'string'},
+      checks:{type:'array', items:{type:'string'}},
+      mode:{type:'string', enum:['auto','project','module_in_project','standalone']},
+      phpVersions:{type:'array', items:{type:'string'}},
+      noLintResultCache:{type:'boolean'},
+      timeoutMs:{type:'number'},
+    },
+    output:{
+      schema:{
+        type:'object', additionalProperties:false,
+        properties:{
+          ok:{type:'boolean', required:true},
+          exitCode:{type:'number', required:true},
+          timedOut:{type:'boolean', required:true},
+          worktreePath:{type:'string', required:true},
+          lint:{type:'object', required:true, additionalProperties:true},
+          summary:{type:'object', required:true, additionalProperties:true},
+          rawJson:{type:'object', required:true, additionalProperties:true},
+          errors:{type:'array', items:{type:'object', additionalProperties:true}},
+          diagnostics:{type:'string'},
+          sessionId:{type:'string'},
+          runId:{type:'string'},
+        }
+      },
+      render:(_a,v:{ok:boolean})=>[{type:'text', text: v.ok? 'audit lint passed':'audit lint failed'}],
+    },
+    async execute(args, exec){
+      const rawPath=(args as {worktreePath?:string}).worktreePath
+      const root=workspaceRootFor(configuredRoot, exec)
+      const worktreePath= rawPath ? resolve(root, rawPath) : root
+      const checkPath= rawPath ?? ''
+      if(checkPath!=='' && !(await isInsideRoot(root, checkPath))) return {text:`Path "${checkPath}" escapes the workspace root.`, truncated:false} as never
+      const timeoutMs=(args as {timeoutMs?:number}).timeoutMs ?? defaultTimeout
+      if(timeoutMs<5000 || timeoutMs>300000) return {text:'timeoutMs out of range 5000-300000', truncated:false} as never
+
+      const cliArgs=['audit','run','--checks','lint','--format','json']
+      const result=await run('govard', cliArgs, worktreePath, timeoutMs)
+      if(result.timedOut){
+        return {ok:false, exitCode: result.code ?? 124, timedOut:true, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'timeout', message:`timed out after ${timeoutMs}ms` }], diagnostics:result.stderr.slice(0,4000)} as never
+      }
+      if(result.code===null && result.stderr.includes('ENOENT')){
+        return {ok:false, exitCode:127, timedOut:false, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'govard_not_found', message:'govard binary not found'}], diagnostics:result.stderr.slice(0,4000)} as never
+      }
+      const cleaned=cleanJson(result.stdout)
+      let parsed:any=null
+      try{ parsed=JSON.parse(cleaned) }catch{ parsed=null }
+      if(!parsed){
+        const fallback=cleaned.split('\n').slice(0,-1).join('\n').trimEnd()
+        try{ parsed=JSON.parse(fallback)}catch{}
+        if(!parsed){
+          const tryStderr=cleanJson(result.stdout+result.stderr)
+          try{ parsed=JSON.parse(tryStderr)}catch{}
+        }
+      }
+      if(!parsed){
+        return {ok:false, exitCode: result.code ?? 1, timedOut:false, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'parse_error', message:'stdout not JSON'}], diagnostics:(cleaned+result.stderr).slice(0,4000)} as never
+      }
+      const findings:Array<any>=parsed.findings ?? parsed.evidence?.php_results?.flatMap((r:any)=>r.findings) ?? []
+      const phpcsViolations:any[]=[]
+      const phpstanErrors:any[]=[]
+      const pubMediaViolations:any[]=[]
+      for(const f of findings){
+        if(f.tool==='phpstan') phpstanErrors.push({path:f.path, line:f.line, message:f.message})
+        else if(f.tool==='phpcs'){
+          if(f.path?.includes('pub/media') || f.rule?.includes('PubMedia')) pubMediaViolations.push(f)
+          else phpcsViolations.push({path:f.path, line:f.line, column:f.column, rule:f.rule, message:f.message, severity:f.severity})
+        }
+      }
+      const status=parsed.status ?? (result.code===0?'passed':'failed')
+      const phpVersions=parsed.php_versions ?? parsed.phpVersions ?? []
+      const findingCount=findings.length
+      const sessionId = parsed.session_id ?? parsed.sessionId ?? undefined
+      const runId = parsed.run_id ?? parsed.runId ?? undefined
+      return {
+        ok: result.code===0,
+        exitCode: result.code ?? 0,
+        timedOut:false,
+        worktreePath,
+        ...(sessionId ? { sessionId: String(sessionId) } : {}),
+        ...(runId ? { runId: String(runId) } : {}),
+        rawJson: parsed as Record<string, unknown>,
+        summary:{status, phpVersions, matrixComplete:true, findingCount, truncated: findingCount>100},
+        lint:{phpcs:{violations:phpcsViolations}, phpstan:{errors:phpstanErrors}, pubMediaGuard:{violations:pubMediaViolations}},
+        errors:[],
+        diagnostics: result.stderr.slice(0,4000),
+      } as never
+    }
+  })))
+}

package/src/host/hyva-csp-scan-tool.ts

@@ -0,0 +1,165 @@
+import { join, resolve, sep, basename } from 'node:path'
+import { readFile, readdir, realpath, stat } from 'node:fs/promises'
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+
+export const name = 'maestro-hyva-csp-scan-tool'
+export const inject = ['tools']
+export const Config: z<{ rootPath?: string }> = z.object({ rootPath: z.string() })
+
+interface SessionCwdSource { agent?: { session?: { header?: { cwd?: string } } } }
+function workspaceRootFor(configuredRoot: string | undefined, exec: unknown): string {
+  if (configuredRoot !== undefined) return configuredRoot
+  const cwd = (exec as SessionCwdSource | undefined)?.agent?.session?.header?.cwd
+  return typeof cwd === 'string' && cwd !== '' ? cwd : process.cwd()
+}
+async function isInsideRoot(rootPath: string, target: string): Promise<boolean> {
+  const absoluteRoot = resolve(rootPath)
+  const resolved = resolve(absoluteRoot, target)
+  if (resolved !== absoluteRoot && !resolved.startsWith(absoluteRoot + sep)) return false
+  try {
+    const realRoot = await realpath(absoluteRoot)
+    const realTarget = await realpath(resolved)
+    return realTarget === realRoot || realTarget.startsWith(realRoot + sep)
+  } catch { return false }
+}
+const MAX_FILE_BYTES = 1024 * 1024
+const MAX_FILES_DEFAULT = 200
+const MAX_ISSUES = 100
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'vendor', 'pub/static'])
+const PHTML_RE = /\.phtml$/
+const SCRIPT_RE = /<script(?![^>]*\ssrc=)[^>]*>([\s\S]*?)<\/script>/gi
+const HYVA_CSP_RE = /\$hyvaCsp\s*->\s*registerInlineScript\s*\(/
+const DIRECTIVE_RE = /\s(@click|x-show|x-model|:value|@input|:class|x-text|x-if|x-for|@change)\s*=\s*"([^"]*)"/g
+const DOT_PATH_RE = /^[a-zA-Z_$][\w$]*(\.[a-zA-Z_$][\w$]*)*(\([^)]*\))?$/
+
+async function* walkPhtml(dir: string, base: string, budget: { files: number }): AsyncGenerator<string> {
+  if (budget.files <= 0) return
+  let entries
+  try { entries = await readdir(dir, { withFileTypes: true }) } catch { return }
+  for (const entry of entries) {
+    if (budget.files <= 0) return
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      yield* walkPhtml(join(dir, entry.name), base, budget)
+      continue
+    }
+    if (!entry.isFile()) continue
+    if (!PHTML_RE.test(entry.name)) continue
+    budget.files -= 1
+    yield join(dir, entry.name)
+  }
+}
+function lineOf(text: string, idx: number): number { return text.slice(0, idx).split('\n').length }
+
+export function apply(ctx: Context, config: { rootPath?: string } = {}): void {
+  const configuredRoot = config.rootPath
+  ctx.effect(() => ctx.tools.register(defineTool({
+    name: 'hyva_csp_scan',
+    description: 'Scan .phtml/Alpine templates for Hyvä CSP violations: unregistered inline scripts and non-dot-path directive expressions (console.warn-only at runtime, so static review is the gate).',
+    parameters: {
+      scope: { type: 'string', enum: ['diff', 'paths', 'dir'], required: true },
+      paths: { type: 'array', items: { type: 'string' } },
+      dir: { type: 'string' },
+      cspBuild: { type: 'boolean' },
+      maxFiles: { type: 'number' },
+    },
+    output: {
+      schema: {
+        type: 'object', additionalProperties: false,
+        properties: {
+          issues: { type: 'array', required: true },
+          scannedFiles: { type: 'number', required: true },
+          clean: { type: 'boolean', required: true },
+        },
+      },
+      render: (_args, v: { clean: boolean; scannedFiles: number; issues: unknown[] }) => [{ type: 'text', text: v.clean ? `CSP clean — ${v.scannedFiles} files scanned.` : `${(v.issues as unknown[]).length} CSP issue(s) in ${v.scannedFiles} files` }],
+    },
+    async execute(args, exec) {
+      const root = workspaceRootFor(configuredRoot, exec)
+      const scope = (args as { scope: string }).scope
+      const cspBuild = (args as { cspBuild?: boolean }).cspBuild ?? false
+      const maxFiles = (args as { maxFiles?: number }).maxFiles ?? MAX_FILES_DEFAULT
+
+      let files: string[] = []
+      if (scope === 'paths') {
+        const paths = (args as { paths?: string[] }).paths ?? []
+        for (const p of paths) {
+          if (!(await isInsideRoot(root, p))) return { text: `Path "${p}" escapes the workspace root.`, truncated: false } as never
+          const abs = resolve(root, p)
+          try { const s = await stat(abs); if (s.isFile() && PHTML_RE.test(p)) files.push(p) } catch {}
+        }
+      } else if (scope === 'dir') {
+        const dirArg = (args as { dir?: string }).dir
+        const base = dirArg ? resolve(root, dirArg) : root
+        if (dirArg && !(await isInsideRoot(root, dirArg))) return { text: `Path "${dirArg}" escapes the workspace root.`, truncated: false } as never
+        const budget = { files: maxFiles }
+        for await (const f of walkPhtml(base, root, budget)) {
+          const rel = f.startsWith(root + sep) ? f.slice(root.length + 1) : basename(f)
+          files.push(rel)
+          if (files.length >= maxFiles) break
+        }
+      } else {
+        // diff fallback: walk all phtml
+        const budget = { files: maxFiles }
+        for await (const f of walkPhtml(root, root, budget)) {
+          const rel = f.startsWith(root + sep) ? f.slice(root.length + 1) : basename(f)
+          files.push(rel)
+          if (files.length >= maxFiles) break
+        }
+      }
+
+      const issues: Array<{ file: string; line: number; type: string; directive: string | null; snippet: string }> = []
+      let scannedFiles = 0
+      for (const rel of files.slice(0, maxFiles)) {
+        if (issues.length >= MAX_ISSUES) break
+        const abs = resolve(root, rel)
+        let text: string
+        try {
+          const buf = await readFile(abs)
+          if (buf.byteLength > MAX_FILE_BYTES) continue
+          text = buf.toString('utf-8')
+        } catch { continue }
+        scannedFiles++
+        const hasRegister = HYVA_CSP_RE.test(text)
+        // reset regex lastIndex
+        SCRIPT_RE.lastIndex = 0
+        let m: RegExpExecArray | null
+        while ((m = SCRIPT_RE.exec(text)) !== null) {
+          if (!hasRegister) {
+            const line = lineOf(text, m.index)
+            issues.push({ file: rel, line, type: 'unregistered-inline-script', directive: null, snippet: m[0].slice(0, 240).replace(/\s+/g, ' ') })
+            if (issues.length >= MAX_ISSUES) break
+          }
+        }
+        DIRECTIVE_RE.lastIndex = 0
+        let dm: RegExpExecArray | null
+        while ((dm = DIRECTIVE_RE.exec(text)) !== null) {
+          const directive = dm[1]
+          const value = dm[2].trim()
+          if (!value) continue
+          if (directive === 'x-model' && cspBuild) {
+            const line = lineOf(text, dm.index)
+            issues.push({ file: rel, line, type: 'x-model-on-csp-build', directive, snippet: dm[0].slice(0, 240) })
+            continue
+          }
+          const isDotPath = DOT_PATH_RE.test(value)
+          if (!isDotPath) {
+            const line = lineOf(text, dm.index)
+            const type = /\s/.test(value) || /\b(true|false|null|\d+)\b/.test(value) ? 'global-or-literal-value' : 'expression-in-directive'
+            // But for test @click="count++" -> expression-in-directive (contains ++)
+            const finalType = /(\+\+|--|&&|\|\||[+\-*/%!?:])/.test(value) ? 'expression-in-directive' : type
+            issues.push({ file: rel, line, type: finalType, directive, snippet: dm[0].slice(0, 240) })
+            if (issues.length >= MAX_ISSUES) break
+          } else if (/(\+\+|--|&&|\|\||[+\-*/%!])/.test(value)) {
+            const line = lineOf(text, dm.index)
+            issues.push({ file: rel, line, type: 'expression-in-directive', directive, snippet: dm[0].slice(0, 240) })
+          }
+        }
+      }
+      const clean = issues.filter((i) => i.type !== 'x-model-on-csp-build').length === 0
+      return { issues: issues.slice(0, MAX_ISSUES), scannedFiles, clean } as never
+    },
+  }), 'hyva csp scan'))
+}