@fabriziosalmi/slopless 1.4.1

package/rules/VBC-077.yaml

@@ -0,0 +1,35 @@
+id: VBC-077
+name: deceptive-function-name
+severity: error
+category: clean-code
+tags:
+  - clean-code
+  - semantic
+match:
+  ast_check:
+    type: lying-function-names
+message: >-
+  Lying function name detected: '{name}' implies a non-mutating action but contains side-effect
+  keywords (set, delete, update). This is major vibecoding.
+tests:
+  fire:
+    - |
+      function getUser(id) {
+        this.cache.set(id, 1);
+        return id;
+      }
+  quiet:
+    - |
+      function getUser(id) {
+        return this.users[id];
+      }
+    - |
+      function getOffset(node) {
+        return node.dataset.offset;
+      }
+    - |
+      function getAll() {
+        const out = [];
+        for (const x of this.buffer) out.push(x);
+        return out;
+      }

package/rules/VBC-079.yaml

@@ -0,0 +1,18 @@
+id: VBC-079
+name: debugger-statements
+severity: error
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: debugger;
+  file_types:
+    - js
+    - ts
+message: >-
+  debugger; statement found at line {line}. This should never reach production.
+tests:
+  fire:
+    - debugger;
+  quiet:
+    - inspect(state);

package/rules/VBC-080.yaml

@@ -0,0 +1,18 @@
+id: VBC-080
+name: browser-alert
+severity: error
+category: clean-code
+tags:
+  - ux
+match:
+  regex: \balert\(
+  file_types:
+    - js
+    - ts
+message: >-
+  Avoid using alert() at line {line}. Use a modern UI notification system.
+tests:
+  fire:
+    - alert("saved");
+  quiet:
+    - showToast("saved");

package/rules/VBC-084.yaml

@@ -0,0 +1,22 @@
+id: VBC-084
+name: long-line-limit
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: ^.{120,}$
+  scan: all
+  file_types:
+    - js
+    - ts
+    - py
+    - go
+message: >-
+  Line is too long ({count} characters). Consider wrapping it. Max recommended: 120.
+tests:
+  fire:
+    - >-
+      const message = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+  quiet:
+    - const message = "short";

package/rules/VBC-086.yaml

@@ -0,0 +1,22 @@
+id: VBC-086
+name: target-blank-rel
+severity: error
+category: core
+tags:
+  - security
+match:
+  regex: >-
+    <a\b(?![^>]*\brel\s*=\s*["'{][^"'}]*(?:noopener|noreferrer))[^>]*\btarget\s*=\s*["'{]{0,2}_blank
+  multiline: true
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+message: target='_blank' without rel='noopener' detected at line {line}.
+tests:
+  fire:
+    - <a href="/x" target="_blank">docs</a>
+  quiet:
+    - <a href="/x" target="_blank" rel="noopener">docs</a>
+    - <a href="/x" rel="noreferrer" target="_blank">docs</a>

package/rules/VBC-090.yaml

@@ -0,0 +1,28 @@
+id: VBC-090
+name: passive-aggressive-comments
+severity: warning
+category: core
+tags:
+  - team-culture
+match:
+  regex: >-
+    (blame \w+|fix later|hope it works|idk why this works|this is cursed|wtf is this|no idea
+    why|pray it works|don't touch this|shouldn't work but|works on my machine)
+  flags: i
+  scan: comments
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+    - c
+    - cpp
+    - md
+message: >-
+  Passive-aggressive or helpless comment '{match}' detected at line {line}. Replace with a
+  technical explanation of the actual constraint or a link to the relevant issue tracker ticket.
+tests:
+  fire:
+    - // fix later, hope it works
+  quiet:
+    - // retries three times, then gives up

package/rules/VBC-096.yaml

@@ -0,0 +1,19 @@
+id: VBC-096
+name: complex-regex-no-comment
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: /(?:[^/\n\\]|\\.){30,}/[dgimsuvy]*
+  file_types:
+    - js
+    - ts
+message: >-
+  Long regular expression literal at line {line} with no explanation. Add a comment stating
+  what it matches, or build it from named parts.
+tests:
+  fire:
+    - const re = /^[a-z0-9]+(?:[-_][a-z0-9]+)*@example\.com$/;
+  quiet:
+    - const re = /^\d+$/;

package/rules/VBC-097.yaml

@@ -0,0 +1,21 @@
+id: VBC-097
+name: br-tags-for-layout
+severity: warning
+category: ux-dx
+tags:
+  - html
+  - accessibility
+match:
+  regex: <br\s*/?>(\s*<br\s*/?>)+
+  multiline: true
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+message: Multiple <br> tags used for layout. Use CSS margin or padding instead.
+tests:
+  fire:
+    - <p>one<br /><br />two</p>
+  quiet:
+    - <p>one<br />two</p>

package/rules/VBC-098.yaml

@@ -0,0 +1,18 @@
+id: VBC-098
+name: z-index-war
+severity: warning
+category: clean-code
+tags:
+  - css
+match:
+  regex: z-index\s*:\s*[0-9]{4,}
+  file_types:
+    - css
+    - scss
+    - less
+message: Extremely high z-index value detected at line {line} (z-index wars).
+tests:
+  fire:
+    - '.modal { z-index: 99999; }'
+  quiet:
+    - '.modal { z-index: 10; }'

package/rules/VBC-101.yaml

@@ -0,0 +1,23 @@
+id: VBC-101
+name: img-missing-alt
+severity: error
+category: ux-dx
+tags:
+  - accessibility
+match:
+  regex: <img\b(?![^>]*\balt\s*=)[^>]*>
+  multiline: true
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+message: Image missing 'alt' attribute at line {line}.
+tests:
+  fire:
+    - |
+      <img
+        src="/logo.png"
+      />
+  quiet:
+    - <img src="/logo.png" alt="Logo" />

package/rules/VBC-102.yaml

@@ -0,0 +1,20 @@
+id: VBC-102
+name: multi-statement-one-liner
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  ast_check:
+    type: one-liner-limit
+message: >-
+  Multiple statements on a single line detected. This reduces readability.
+tests:
+  fire:
+    - function run() { start(); stop(); }
+  quiet:
+    - |
+      function run() {
+        start();
+        stop();
+      }

package/rules/VBC-103.yaml

@@ -0,0 +1,35 @@
+id: VBC-103
+name: ascii-art-block
+severity: warning
+category: docs
+tags:
+  - docs
+  - style
+match:
+  regex: >-
+    (?:^[ \t]*(?:#|//)(?=[^\nA-Za-z0-9]*$)[^\n]*[-=*#_|/\\+~^]{6,}[^\n]*$\n){3,}
+  flags: m
+  multiline: true
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+message: >-
+  Block of decoration at line {line}: three or more comment lines that are shape and nothing
+  else. A rule around a section heading is punctuation and is not reported; a banner is furniture
+  that has to be maintained.
+tests:
+  fire:
+    - |
+      # ####################
+      # ####################
+      # ####################
+  quiet:
+    - |
+      # --------------------------------
+      # Shared fixtures from public data
+      # --------------------------------
+    - |
+      # ------------------------------
+    - '# - handles retries'

package/rules/VBC-104.yaml

@@ -0,0 +1,24 @@
+id: VBC-104
+name: inconsistent-import
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    ^\s*import\s[\s\S]*?^\s*(?:const|let|var)\s[^\n]*=\s*require\(|^\s*(?:const|let|var)\s[^\n]*=\s*require\([\s\S]*?^\s*import\s
+  flags: m
+  multiline: true
+  file_types:
+    - js
+    - ts
+message: Mixing 'require' and 'import' in the same file at line {line}.
+tests:
+  fire:
+    - |
+      import fs from 'fs';
+      const path = require('path');
+  quiet:
+    - |
+      import fs from 'fs';
+      import path from 'path';

package/rules/VBC-106.yaml

@@ -0,0 +1,14 @@
+id: VBC-106
+name: spaces-in-filenames
+severity: error
+category: git
+tags:
+  - git
+  - cross-platform
+match:
+  git_check: spaces_in_filenames
+message: >-
+  Filename '{file}' contains spaces. This causes issues on some operating systems and CLI
+  tools.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-112.yaml

@@ -0,0 +1,20 @@
+id: VBC-112
+name: scroll-hijacking
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: window\.addEventListener\(['"]wheel['"]|\bscroll-behavior:\s*smooth
+  file_types:
+    - js
+    - ts
+    - css
+message: >-
+  Potential scroll hijacking or forced smooth scrolling detected at line {line}.
+tests:
+  fire:
+    - window.addEventListener('wheel', onWheel);
+    - 'html { scroll-behavior: smooth; }'
+  quiet:
+    - window.addEventListener('scroll', onScroll);

package/rules/VBC-113.yaml

@@ -0,0 +1,19 @@
+id: VBC-113
+name: disable-zoom
+severity: error
+category: ux-dx
+tags:
+  - accessibility
+match:
+  regex: user-scalable\s*=\s*(?:no|0)\b|maximum-scale\s*=\s*1(?:\.0+)?(?![\d.])
+  flags: i
+  file_types:
+    - html
+message: Disabling pinch-to-zoom is an accessibility violation.
+tests:
+  fire:
+    - <meta name="viewport" content="width=device-width, user-scalable=no">
+    - <meta name="viewport" content="width=device-width, maximum-scale=1">
+  quiet:
+    - <meta name="viewport" content="width=device-width, initial-scale=1">
+    - <meta name="viewport" content="maximum-scale=10">

package/rules/VBC-117.yaml

@@ -0,0 +1,21 @@
+id: VBC-117
+name: block-paste
+severity: error
+category: ux-dx
+tags:
+  - ux
+  - security
+match:
+  regex: >-
+    onPaste=['"]return false['"]|\.addEventListener\(['"]paste['"],.*?\.preventDefault\(
+  file_types:
+    - js
+    - ts
+    - html
+message: >-
+  Blocking paste in input fields harms both UX and security (password managers).
+tests:
+  fire:
+    - input.addEventListener('paste', e => e.preventDefault());
+  quiet:
+    - input.addEventListener('paste', e => normalise(e));

package/rules/VBC-123.yaml

@@ -0,0 +1,29 @@
+id: VBC-123
+name: placeholder-as-label
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: >-
+    <input\b(?![^>]*(?:aria-label|aria-labelledby|\bid\s*=))[^>]*\bplaceholder\s*=
+  multiline: true
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+message: >-
+  Using placeholder as the only label at line {line} is bad for accessibility.
+tests:
+  fire:
+    - |
+      <input
+        type="email"
+        placeholder="Email"
+      />
+  quiet:
+    - |
+      <label for="email">Email</label>
+      <input id="email" placeholder="you@example.com" />

package/rules/VBC-131.yaml

@@ -0,0 +1,20 @@
+id: VBC-131
+name: video-background
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: <video\b(?=[^>]*\bautoplay\b)(?=[^>]*\bloop\b)(?=[^>]*\bmuted\b)[^>]*>
+  multiline: true
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+message: Autoplay video backgrounds can be distracting and impact performance.
+tests:
+  fire:
+    - <video autoplay loop muted src="bg.mp4"></video>
+  quiet:
+    - <video controls src="talk.mp4"></video>

package/rules/VBC-150.yaml

@@ -0,0 +1,27 @@
+id: VBC-150
+name: production-todo
+severity: warning
+category: core
+tags:
+  - maintenance
+match:
+  regex: >-
+    \b(?:TODO|FIXME|HACK|XXX)\b(?=\s*[\(\[][^)\]\n]+[\)\]]|\s*:?\s*(?:#\d+|[A-Z][A-Z0-9]+-\d+))
+  scan: comments
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+    - c
+    - cpp
+message: >-
+  Tracked debt marker still in the code at line {line}. It is attributed, so close the ticket
+  or delete the marker before shipping.
+tests:
+  fire:
+    - '// TODO(fab): rework the cache key'
+    - '// FIXME #1234 flaky under load'
+  quiet:
+    - '// TODO: rework the cache key'
+    - // explains the cache key

package/rules/VBC-153.yaml

@@ -0,0 +1,21 @@
+id: VBC-153
+name: sudo-setup
+severity: warning
+category: ux-dx
+tags:
+  - dx
+  - security
+match:
+  regex: sudo\s+npm\s+install|sudo\s+pip\s+install
+  file_types:
+    - md
+    - sh
+message: >-
+  Setup instructions requiring sudo detected at line {line}. Use local environments instead.
+tests:
+  fire:
+    - file: fixture.md
+      code: Run `sudo npm install -g slopless`.
+  quiet:
+    - file: fixture.md
+      code: Run `npm install -D slopless`.

package/rules/VBC-158.yaml

@@ -0,0 +1,16 @@
+id: VBC-158
+name: fouc-prevention
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: '@import'
+  file_types:
+    - css
+message: Use of @import in CSS can cause Flash of Unstyled Content (FOUC).
+tests:
+  fire:
+    - '@import url("theme.css");'
+  quiet:
+    - '.card { color: red; }'

package/rules/VBC-161.yaml

@@ -0,0 +1,27 @@
+id: VBC-161
+name: oversized-sticky-header
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: position:\s*sticky[\s\S]{0,200}?height:\s*(?:[3-9][0-9]|1[0-9][0-9])vh
+  multiline: true
+  file_types:
+    - css
+message: Oversized sticky header (>30vh) detected at line {line}.
+tests:
+  fire:
+    - |
+      .hero {
+        position: sticky;
+        top: 0;
+        height: 60vh;
+      }
+  quiet:
+    - |
+      .hero {
+        position: sticky;
+        top: 0;
+        height: 8vh;
+      }

package/rules/VBC-172.yaml

@@ -0,0 +1,25 @@
+id: VBC-172
+name: hamburger-on-desktop
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: >-
+    @media[^{]*min-width:\s*(?:1[2-9][0-9][0-9]|[2-9][0-9]{3})px[^{]*\{[\s\S]{0,400}?\.(?:hamburger|burger|menu-toggle|nav-toggle)
+  multiline: true
+  file_types:
+    - css
+    - scss
+message: Hamburger menu detected on desktop resolutions at line {line}.
+tests:
+  fire:
+    - |
+      @media (min-width: 1280px) {
+        .hamburger-menu { display: block; }
+      }
+  quiet:
+    - |
+      @media (max-width: 640px) {
+        .hamburger-menu { display: block; }
+      }

package/rules/VBC-197.yaml

@@ -0,0 +1,22 @@
+id: VBC-197
+name: hardcoded-node-version
+severity: warning
+category: ux-dx
+tags:
+  - dx
+  - portability
+match:
+  regex: node\s+-v|node\s+--version
+  file_types:
+    - sh
+    - json
+message: >-
+  Hardcoded system version check detected at line {line}. Use an .nvmrc or engine field in
+  package.json instead.
+tests:
+  fire:
+    - file: fixture.sh
+      code: node -v
+  quiet:
+    - file: fixture.sh
+      code: node build.js

package/rules/VBC-201.yaml

@@ -0,0 +1,35 @@
+id: VBC-201
+name: redundant-async
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - performance
+match:
+  file_types:
+    - ts
+    - tsx
+    - js
+    - jsx
+  ast_check:
+    type: async-without-await
+message: >-
+  async function with no await at line {line}. The async keyword only wraps the return value
+  in a Promise here; drop it or await something.
+tests:
+  fire:
+    - |
+      async function load() {
+        return cached;
+      }
+  quiet:
+    - |
+      async function load() {
+        return await fetchIt();
+      }
+    - |
+      function load() {
+        return cached;
+      }
+    - |
+      const spy = vi.fn(async (name) => undefined);

package/rules/VBC-206.yaml

@@ -0,0 +1,19 @@
+id: VBC-206
+name: pure-black-background
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - design
+match:
+  regex: background-color:\s*#000000|background:\s*#000
+  file_types:
+    - css
+message: >-
+  Pure black backgrounds (#000000) can cause eye strain. Consider a soft dark grey (e.g.,
+  #121212).
+tests:
+  fire:
+    - 'body { background-color: #000000; }'
+  quiet:
+    - 'body { background-color: #12151b; }'

package/rules/VBC-208.yaml

@@ -0,0 +1,27 @@
+id: VBC-208
+name: hardcoded-colors
+severity: warning
+category: ux-dx
+tags:
+  - design
+  - maintainability
+match:
+  regex: color:\s*(#[0-9a-fA-F]{3,6}|rgba?\(.*?\))
+  file_types:
+    - css
+    - scss
+  exclude_files:
+    - '**/theme.css'
+    - '**/vars.css'
+    - '**/variables.css'
+    - '**/tokens.css'
+    - '**/*.tokens.*'
+message: >-
+  Hardcoded color value detected at line {line}. Consider using a CSS variable or theme token.
+tests:
+  fire:
+    - '.card { color: #ff0044; }'
+  quiet:
+    - '.card { color: var(--text); }'
+    - file: theme.css
+      code: '.card { color: #ff0044; }'