@eduardbar/drift 1.3.0 → 1.5.0

package/docs/rules-catalog.md

@@ -0,0 +1,49 @@
+# drift rules catalog (current)
+
+Source of truth: `RULE_WEIGHTS` in `src/analyzer.ts`.
+
+This catalog reflects the current repository state and includes all rule IDs currently weighted/scored by drift.
+
+| id | severity | weight | phase/origin | note |
+|---|---|---:|---|---|
+| `large-file` | error | 20 | phase0-basic | file exceeds size threshold |
+| `large-function` | error | 15 | phase0-basic | function exceeds line threshold |
+| `debug-leftover` | warning | 10 | phase0-basic | debug console calls / TODO-like leftovers |
+| `dead-code` | warning | 8 | phase0-basic | unused named imports in file |
+| `duplicate-function-name` | error | 18 | phase0-basic | repeated function names in same file |
+| `comment-contradiction` | warning | 12 | comments rule | comment restates obvious code intent |
+| `no-return-type` | info | 5 | phase0-basic | missing explicit return type |
+| `catch-swallow` | warning | 10 | phase0-basic | empty catch blocks |
+| `magic-number` | info | 3 | magic rule | numeric literals used directly |
+| `any-abuse` | warning | 8 | phase0-basic | explicit `any` usage |
+| `high-complexity` | error | 15 | phase1-complexity | high cyclomatic complexity |
+| `deep-nesting` | warning | 12 | nesting rule | nested control flow too deep |
+| `too-many-params` | warning | 8 | nesting rule | function has too many parameters |
+| `high-coupling` | warning | 10 | coupling rule | too many module dependencies |
+| `promise-style-mix` | warning | 7 | promise rule | mixed async/await and then/catch styles |
+| `unused-export` | warning | 8 | phase2-crossfile | export not imported elsewhere |
+| `dead-file` | warning | 10 | phase2-crossfile | file not imported by project |
+| `unused-dependency` | warning | 6 | phase2-crossfile | package.json dependency unused in sources |
+| `circular-dependency` | error | 14 | phase3-arch | circular import graph edges |
+| `layer-violation` | error | 16 | phase3-arch (config-driven) | invalid import direction across configured layers |
+| `cross-boundary-import` | warning | 10 | phase3-arch (config-driven) | invalid import across configured modules/boundaries |
+| `controller-no-db` | warning | 11 | phase3-configurable | controller imports DB/repository concerns directly |
+| `service-no-http` | warning | 11 | phase3-configurable | service imports/uses HTTP transport concerns |
+| `max-function-lines` | warning | 9 | phase3-configurable | function/method exceeds configured max lines |
+| `over-commented` | info | 4 | phase5-ai | excessive comments heuristic |
+| `hardcoded-config` | warning | 10 | phase5-ai | hardcoded URLs/secrets/config literals |
+| `inconsistent-error-handling` | warning | 8 | phase5-ai | mixed error-handling styles |
+| `unnecessary-abstraction` | warning | 7 | phase5-ai | wrappers/abstractions with little value |
+| `naming-inconsistency` | warning | 6 | phase5-ai | mixed naming conventions |
+| `ai-code-smell` | warning | 12 | analyzer meta-rule | aggregated AI-smell signal from multiple heuristics |
+| `semantic-duplication` | warning | 12 | phase8-semantic | AST fingerprint identifies equivalent functions |
+| `plugin-error` | warning | 4 | plugin diagnostics | plugin load/contract/runtime failure surfaced as issue |
+| `plugin-warning` | info | 0 | plugin diagnostics | non-fatal plugin validation warning |
+| `analysis-skip-max-files` | info | 0 | analysis guardrail diagnostics | file skipped due to `maxFiles` limit |
+| `analysis-skip-file-size` | info | 0 | analysis guardrail diagnostics | file skipped due to `maxFileSizeKb` limit |
+
+## Notes
+
+- Config-driven rules require matching config blocks to execute (`layers`, `modules`/legacy aliases, `architectureRules`).
+- `plugin-*` and `analysis-skip-*` are diagnostic rules emitted as issues and included in scoring with their configured weights.
+- Total rule IDs currently defined: **35**.

package/docs/trust-core-release-checklist.md

@@ -8,7 +8,7 @@ Use this checklist before releasing the trust-core milestone.
 - [x] `npm test`
 - [x] `npx --no-install tsx ./src/cli.ts trust . --base origin/master --markdown`
 - [x] `npx --no-install tsx ./src/cli.ts trust . --base origin/master --json-output drift-trust.json`
-- [x] `npx --no-install tsx ./src/cli.ts trust-gate drift-trust.json --min-trust 40 --max-risk HIGH`
+- [x] `npx --no-install tsx ./src/cli.ts trust-gate drift-trust.json --min-trust 45 --max-risk HIGH`
 - [x] `npx --no-install tsx ./src/cli.ts review --base origin/master --comment`
 
 ## 2) CI workflow validation
@@ -36,16 +36,16 @@ Smoke PR runbook:
 
 Default trust gate for this milestone:
 
-- `--min-trust 40`
+- `--min-trust 45`
 - `--max-risk HIGH`
 
 Checks:
 
-- [x] PR fails when trust score is below 40.
+- [x] PR fails when trust score is below 45.
 - [x] PR fails when merge risk is `CRITICAL`.
-- [x] PR passes when trust score is 40+ and merge risk is `LOW`, `MEDIUM`, or `HIGH`.
+- [x] PR passes when trust score is 45+ and merge risk is `LOW`, `MEDIUM`, or `HIGH`.
 
-Calibration evidence from docs-only smoke runs: trust score 49 (PR #11), 46 (PR #12), 41 (PR #13). Gate floor set to 40 to avoid false negatives while still blocking `CRITICAL` risk.
+Calibration evidence from docs-only smoke runs: trust score 49 (PR #11), 46 (PR #12), 41 (PR #13). Gate floor set to 45 to reduce false positives while still blocking weak trust outcomes and `CRITICAL` risk.
 
 ## 4) Narrative and docs acceptance
 
@@ -53,3 +53,35 @@ Calibration evidence from docs-only smoke runs: trust score 49 (PR #11), 46 (PR
 - [x] `package.json` description matches the same positioning.
 - [x] `src/cli.ts` program description matches the same positioning.
 - [x] `ROADMAP.md` no longer contradicts PRD on core vs premium direction.
+
+## 5) SARIF and action v2 readiness
+
+- [x] `scan --format sarif` emits valid SARIF payload with drift rule mapping.
+- [x] `ci --format sarif` emits SARIF without requiring GitHub annotation mode.
+- [x] `diff --format sarif` emits SARIF from `DriftDiff` output.
+- [x] `review --format sarif` emits SARIF from review diff context.
+- [x] `trust --format sarif` emits SARIF based on current trust scan report.
+- [x] CI workflow uploads SARIF artifact in PR runs.
+- [x] Action v2 contracts are aligned with SARIF-capable commands and outputs.
+
+## 6) Trust artifacts and KPI readiness
+
+- [x] Trust command supports split outputs (`--json-output` + selected stdout format).
+- [x] Artifact bundle includes trust JSON, gate result, and trust KPI aggregate.
+- [x] `drift kpi` parses trust artifacts and prints JSON plus optional summary.
+- [x] Trust gate policy behavior documented and calibrated for current milestone.
+
+## 7) Quick smoke runbook (no build)
+
+Run from repository root:
+
+- [x] `node --import tsx ./src/cli.ts scan . --format sarif > .tmp/smoke-scan.sarif`
+- [x] `node --import tsx ./src/cli.ts ci . --format sarif > .tmp/smoke-ci.sarif`
+- [x] `node --import tsx ./src/cli.ts trust . --format sarif > .tmp/smoke-trust.sarif`
+- [x] `node --import tsx ./src/cli.ts review --base HEAD~1 --format sarif > .tmp/smoke-review.sarif`
+
+Validation hints:
+
+- Check each command exits with code `0`.
+- Check each `.sarif` file starts with `{"$schema"` and contains `"runs"`.
+- Keep smoke artifacts out of release commit unless explicitly needed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduardbar/drift",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "AI Code Audit CLI for merge trust in AI-assisted PRs",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,11 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "benchmark": "node --import tsx src/benchmark.ts"
+    "benchmark": "node --import tsx src/benchmark.ts",
+    "smoke:repo": "node ./scripts/smoke-repo.mjs",
+    "check:runtime-policy": "node ./scripts/check-runtime-policy.mjs",
+    "check:docs-drift": "node ./scripts/check-docs-drift.mjs",
+    "check:perf-budget": "node ./scripts/check-performance-budget.mjs"
   },
   "keywords": [
     "vibe-coding",
@@ -27,6 +31,9 @@
   ],
   "author": "eduardbar",
   "license": "MIT",
+  "engines": {
+    "node": "^20.0.0 || ^22.0.0"
+  },
   "homepage": "https://github.com/eduardbar/drift#readme",
   "repository": {
     "type": "git",
@@ -42,9 +49,9 @@
   },
   "devDependencies": {
     "@types/node": "^25.3.0",
-    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/coverage-v8": "^4.1.2",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.2"
   }
 }

package/packages/vscode-drift/src/code-actions.ts

@@ -16,7 +16,7 @@ function buildCatchTodoEdit(document: vscode.TextDocument, line: number): vscode
   const targetLine = document.lineAt(line)
   const baseIndent = targetLine.text.match(/^\s*/)?.[0] ?? ''
   const indent = `${baseIndent}  `
-  edit.insert(document.uri, new vscode.Position(line + 1, 0), `${indent}// TODO: handle error\n`)
+  edit.insert(document.uri, new vscode.Position(line + 1, 0), `${indent}// handle error\n`)
   return edit
 }
 

package/schemas/drift-ai-output.v1.json

@@ -0,0 +1,162 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "schemas/drift-ai-output.v1.json",
+  "title": "drift ai output v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "toolVersion",
+    "summary",
+    "files_suspected",
+    "priority_order",
+    "maintenance_risk",
+    "quality",
+    "context_for_ai"
+  ],
+  "properties": {
+    "$schema": {
+      "const": "schemas/drift-ai-output.v1.json"
+    },
+    "toolVersion": {
+      "type": "string"
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "score",
+        "grade",
+        "total_issues",
+        "files_affected",
+        "files_clean",
+        "ai_likelihood",
+        "ai_code_smell_score"
+      ],
+      "properties": {
+        "score": { "type": "number" },
+        "grade": { "type": "string" },
+        "total_issues": { "type": "number" },
+        "files_affected": { "type": "number" },
+        "files_clean": { "type": "number" },
+        "ai_likelihood": { "type": "number" },
+        "ai_code_smell_score": { "type": "number" }
+      }
+    },
+    "files_suspected": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "ai_likelihood", "triggers"],
+        "properties": {
+          "path": { "type": "string" },
+          "ai_likelihood": { "type": "number" },
+          "triggers": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        }
+      }
+    },
+    "priority_order": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["rank", "file", "line", "rule", "severity", "message", "snippet", "fix_suggestion", "effort"],
+        "properties": {
+          "rank": { "type": "number" },
+          "file": { "type": "string" },
+          "line": { "type": "number" },
+          "rule": { "type": "string" },
+          "severity": { "type": "string" },
+          "message": { "type": "string" },
+          "snippet": { "type": "string" },
+          "fix_suggestion": { "type": "string" },
+          "effort": { "enum": ["low", "medium", "high"] }
+        }
+      }
+    },
+    "maintenance_risk": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["score", "level", "hotspots", "signals"],
+      "properties": {
+        "score": { "type": "number" },
+        "level": { "enum": ["low", "medium", "high", "critical"] },
+        "hotspots": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "file",
+              "driftScore",
+              "complexityIssues",
+              "hasNearbyTests",
+              "changeFrequency",
+              "risk",
+              "reasons"
+            ],
+            "properties": {
+              "file": { "type": "string" },
+              "driftScore": { "type": "number" },
+              "complexityIssues": { "type": "number" },
+              "hasNearbyTests": { "type": "boolean" },
+              "changeFrequency": { "type": "number" },
+              "risk": { "type": "number" },
+              "reasons": {
+                "type": "array",
+                "items": { "type": "string" }
+              }
+            }
+          }
+        },
+        "signals": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["highComplexityFiles", "filesWithoutNearbyTests", "frequentChangeFiles"],
+          "properties": {
+            "highComplexityFiles": { "type": "number" },
+            "filesWithoutNearbyTests": { "type": "number" },
+            "frequentChangeFiles": { "type": "number" }
+          }
+        }
+      }
+    },
+    "quality": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["overall", "dimensions"],
+      "properties": {
+        "overall": { "type": "number" },
+        "dimensions": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["architecture", "complexity", "ai-patterns", "testing"],
+          "properties": {
+            "architecture": { "type": "number" },
+            "complexity": { "type": "number" },
+            "ai-patterns": { "type": "number" },
+            "testing": { "type": "number" }
+          }
+        }
+      }
+    },
+    "context_for_ai": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["project_type", "scan_path", "rules_detected", "recommended_action"],
+      "properties": {
+        "project_type": { "type": "string" },
+        "scan_path": { "type": "string" },
+        "rules_detected": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "recommended_action": { "type": "string" }
+      }
+    }
+  }
+}

package/schemas/drift-doctor.v1.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "schemas/drift-doctor.v1.json",
+  "title": "drift doctor v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "toolVersion",
+    "targetPath",
+    "node",
+    "project"
+  ],
+  "properties": {
+    "$schema": {
+      "const": "schemas/drift-doctor.v1.json"
+    },
+    "toolVersion": {
+      "type": "string"
+    },
+    "targetPath": {
+      "type": "string"
+    },
+    "node": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "major", "supported"],
+      "properties": {
+        "version": { "type": "string" },
+        "major": { "type": "number" },
+        "supported": { "type": "boolean" }
+      }
+    },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "packageJsonFound",
+        "esm",
+        "tsconfigFound",
+        "sourceFilesCount",
+        "lowMemorySuggested",
+        "driftConfigFile"
+      ],
+      "properties": {
+        "packageJsonFound": { "type": "boolean" },
+        "esm": { "type": "boolean" },
+        "tsconfigFound": { "type": "boolean" },
+        "sourceFilesCount": { "type": "number" },
+        "lowMemorySuggested": { "type": "boolean" },
+        "driftConfigFile": {
+          "type": ["string", "null"]
+        }
+      }
+    }
+  }
+}