@fabriziosalmi/slopless 1.4.6 → 1.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.4.6",
+  "version": "1.5.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-039.yaml

@@ -5,14 +5,21 @@ category: core
 tags:
   - security
 match:
-  regex: eval\(
+  regex: (?<![.\w])eval\s*\(
   file_types:
     - js
     - ts
+    - py
+    - rb
+    - php
 message: >-
   Use of 'eval()' detected at line {line}. This is a massive security risk.
 tests:
   fire:
     - eval(userInput);
+    - { file: a.py, code: 'result = eval(expr)' }
   quiet:
     - JSON.parse(userInput);
+    # PyTorch puts a model into evaluation mode several times per script.
+    - { file: a.py, code: 'model.eval()' }
+    - { file: a.py, code: 'if is_eval(node): pass' }

package/rules/VBC-049.yaml

@@ -5,15 +5,37 @@ category: clean-code
 tags:
   - clean-code
 match:
-  regex: \b[a-zA-Z0-9_]+\((true|false)\s*,
+  # `store` and `swap` take the value first: `flag.store(false, Ordering::Relaxed)`
+  # is the atomic API, not an opaque flag. `Option(False, "--dry-run", ...)` is a
+  # CLI default followed by the very name that documents it.
+  regex: >-
+    \b(?!(?:store|swap|compare_exchange|compare_and_swap|Option)\b)[a-zA-Z0-9_]+\((true|false|True|False)\s*,
   file_types:
     - js
     - ts
+    - py
+    - go
+    - rs
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/*_test.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
 message: >-
   Magic boolean passed as first argument at line {line}. Use named parameters or a descriptive
   variable.
 tests:
   fire:
     - renderList(true, items);
+    - { file: a.py, code: 'toggle_server(True, port)' }
+    - { file: a.rs, code: 'format_warn(false, "health", msg);' }
   quiet:
     - 'renderList({ compact: true }, items);'
+    # The atomic API takes the value first; the ordering that follows is not a flag.
+    - { file: a.rs, code: 'healthy.store(false, Ordering::Relaxed);' }
+    # A CLI default, followed by the very name that documents it.
+    - { file: a.py, code: 'dry_run: bool = typer.Option(False, "--dry-run")' }

package/rules/VBC-917.yaml

@@ -7,9 +7,17 @@ tags:
   - style
 match:
   regex: \b[A-Z]{3,}\b(?:\s+\b[A-Z]{2,}\b){3,}
+  # In a source file, prose lives in comments. Without this the rule would read
+  # a run of constants as shouting, and miss the comment that actually shouts.
+  scan: comments
   file_types:
     - md
     - txt
+    - py
+    - go
+    - rs
+    - js
+    - ts
 opt_in: true
 message: >-
   Sustained all-caps text at line {line}. Shouting does not add emphasis, it costs readability.

package/rules/VBC-928.yaml

@@ -8,13 +8,18 @@ tags:
 match:
   regex: Lorem ipsum dolor sit amet
   flags: i
-  scan: strings
+  scan: all
   file_types:
     - md
     - txt
     - html
     - js
     - ts
+    - py
+    - go
+    - rs
+    - java
+    - sh
 message: >-
   Placeholder text 'Lorem ipsum' detected at line {line}. Replace with real content before
   committing.