@kevinrabun/judges-cli 3.124.0

package/dist/evaluators/compliance.js

@@ -0,0 +1,329 @@
+import { getLangLineNumbers, getLangFamily, isCommentLine, isIaCTemplate, isLikelyAnalysisCode, testCode, } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeCompliance(code, language) {
+    const findings = [];
+    const lines = code.split("\n");
+    const prefix = "COMP";
+    let ruleNum = 1;
+    const _lang = getLangFamily(language);
+    // Analysis code references PII keywords (email, SSN, passport) in detection
+    // patterns — these are not actual PII fields that need encryption.
+    if (isLikelyAnalysisCode(code))
+        return findings;
+    const isCommentLikeLine = (line) => {
+        const trimmed = line.trim();
+        return (trimmed.startsWith("//") ||
+            trimmed.startsWith("/*") ||
+            trimmed.startsWith("*") ||
+            trimmed.startsWith("#") ||
+            trimmed.startsWith("--"));
+    };
+    // Detect PII handling without encryption
+    const piiFieldLines = [];
+    // File-level check: if the code has compliance infrastructure (age verification,
+    // parental consent, data restriction controls), PII protection is likely handled
+    // at a middleware / wrapper layer rather than inline on every field reference.
+    const hasComplianceInfra = /verifyAgeCompliance|requireParentalConsent|restrictDataCollection|ageCompliance|complianceGuard|dataProtectionOfficer|gdprCompliant|piiProtect|complianceMiddleware|privacyShield|dataClassification/i.test(code);
+    if (!hasComplianceInfra) {
+        lines.forEach((line, i) => {
+            if (isCommentLikeLine(line))
+                return;
+            if (/(?:ssn|social_security|tax_id|passport|national_id|driver_license|ip_address)/i.test(line) &&
+                !/encrypt|hash|mask|redact/i.test(line)) {
+                const context = lines.slice(Math.max(0, i - 4), Math.min(lines.length, i + 5)).join("\n");
+                if (/(?:save|store|insert|persist|write|log|send|post|request|payload|body|db\.)/i.test(context)) {
+                    piiFieldLines.push(i + 1);
+                }
+            }
+        });
+    }
+    if (piiFieldLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "PII field handled without protection",
+            description: "Personally Identifiable Information (SSN, passport, tax ID) must be encrypted at rest and in transit, and masked in logs.",
+            lineNumbers: piiFieldLines,
+            recommendation: "Encrypt PII fields, mask them in logs and UI displays, and ensure they are stored with column-level encryption.",
+            reference: "GDPR Article 32 / CCPA / HIPAA",
+            suggestedFix: "Encrypt PII at rest: const encrypted = crypto.createCipheriv('aes-256-gcm', key, iv).update(piiValue, 'utf8', 'hex'); store only the ciphertext.",
+            confidence: 0.85,
+        });
+    }
+    // Detect missing consent/opt-in checks
+    const trackingLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/analytics|tracking|telemetry|gtag|fbq|pixel|ga\s*\(/i.test(line)) {
+            trackingLines.push(i + 1);
+        }
+    });
+    const hasConsent = testCode(code, /consent|opt.?in|cookie.?banner|gdpr|accept.*cookie/i);
+    if (trackingLines.length > 0 && !hasConsent && !isIaCTemplate(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Tracking/analytics without consent check",
+            description: "Analytics and tracking scripts are loaded without checking for user consent, potentially violating GDPR and ePrivacy regulations.",
+            lineNumbers: trackingLines,
+            recommendation: "Implement a consent management system. Only load tracking scripts after obtaining explicit user consent.",
+            reference: "GDPR Article 6 / ePrivacy Directive",
+            suggestedFix: "Gate tracking behind consent: if (userConsent.analytics) { loadTrackingScripts(); } — use a consent management platform.",
+            confidence: 0.8,
+        });
+    }
+    // Detect data retention issues
+    const storeForeverLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/(?:save|store|insert|persist|write)\s*\(/i.test(line) &&
+            /(?:user|personal|customer|patient|email|phone)/i.test(line)) {
+            const context = lines.slice(Math.max(0, i - 5), Math.min(lines.length, i + 5)).join("\n");
+            if (!/ttl|expir|retention|purge|delete.*after|archive/i.test(context)) {
+                storeForeverLines.push(i + 1);
+            }
+        }
+    });
+    if (storeForeverLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Personal data stored without retention policy",
+            description: "Personal data appears to be stored indefinitely without a defined retention period or cleanup mechanism.",
+            lineNumbers: storeForeverLines,
+            recommendation: "Define and implement data retention policies. Set TTLs, schedule purge jobs, or implement right-to-deletion workflows.",
+            reference: "GDPR Article 5(1)(e) Storage Limitation",
+            suggestedFix: "Add TTL to stored data: await db.collection('users').createIndex({ createdAt: 1 }, { expireAfterSeconds: 365 * 24 * 3600 }); or schedule retention purge jobs.",
+            confidence: 0.8,
+        });
+    }
+    // Detect logging of sensitive information (multi-language)
+    const logSensitiveLines = [];
+    const logLineSet = new Set([
+        ...getLangLineNumbers(code, language, LP.CONSOLE_LOG),
+        ...getLangLineNumbers(code, language, LP.STRUCTURED_LOG),
+    ]);
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (logLineSet.has(i + 1) && /(?:password|token|secret|ssn|credit.?card|api.?key|auth)/i.test(line)) {
+            logSensitiveLines.push(i + 1);
+        }
+    });
+    if (logSensitiveLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Sensitive data in log statements",
+            description: "Logging sensitive information (passwords, tokens, SSNs, credit cards) creates compliance violations and security risks.",
+            lineNumbers: logSensitiveLines,
+            recommendation: "Never log sensitive data. Use redaction/masking utilities to sanitize log output. Audit all log statements.",
+            reference: "OWASP Logging Cheat Sheet / PCI DSS Requirement 3",
+            suggestedFix: "Redact sensitive fields before logging: logger.info({ ...data, password: undefined, ssn: '***' }); use a log-redaction middleware.",
+            confidence: 0.9,
+        });
+    }
+    // Detect missing data classification markers (multi-language class/struct detection)
+    const dataModelLines = [];
+    const classDefLineSet = new Set(getLangLineNumbers(code, language, LP.CLASS_DEF));
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        const isClassDef = classDefLineSet.has(i + 1) ||
+            /(?:interface|class|type|schema|model)\s+\w*(?:User|Customer|Patient|Employee|Person)/i.test(line);
+        if (isClassDef && /(?:User|Customer|Patient|Employee|Person)/i.test(line)) {
+            const context = lines.slice(i, Math.min(lines.length, i + 15)).join("\n");
+            if (!/classification|sensitivity|pii|confidential|restricted|public/i.test(context)) {
+                dataModelLines.push(i + 1);
+            }
+        }
+    });
+    if (dataModelLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Data model lacks classification markers",
+            description: "Data models containing personal information should include data classification metadata to guide handling policies.",
+            lineNumbers: dataModelLines,
+            recommendation: "Add data classification comments or decorators (e.g., @PII, @Confidential) to help enforce appropriate handling.",
+            reference: "Data Classification Best Practices",
+            suggestedFix: "Add classification markers: interface User { /** @classification PII */ email: string; /** @classification Public */ displayName: string; }",
+            confidence: 0.75,
+            isAbsenceBased: true,
+        });
+    }
+    // Detect credit card number patterns (PCI DSS)
+    const cardNumberLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLikeLine(line))
+            return;
+        const context = lines.slice(Math.max(0, i - 4), Math.min(lines.length, i + 5)).join("\n");
+        const hasPaymentContext = /(?:payment|billing|checkout|charge|\bcard(?:Number)?\b|\bpan\b|stripe|braintree|authorize|capture|transaction)/i.test(context);
+        const hasOperationalFlow = /(?:store|save|log|send|post|request|payload|body|db\.)/i.test(context);
+        if (/\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b/.test(line) &&
+            hasPaymentContext &&
+            hasOperationalFlow) {
+            cardNumberLines.push(i + 1);
+        }
+        if (/credit.?card|card.?number|ccn|pan\b|cardNumber/i.test(line) &&
+            !/mask|redact|encrypt|hash|tokenize|\*{4}/i.test(line) &&
+            hasPaymentContext &&
+            hasOperationalFlow) {
+            cardNumberLines.push(i + 1);
+        }
+    });
+    if (cardNumberLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Credit card data handling detected",
+            description: "Credit card numbers must never be stored in plain text. PCI DSS requires tokenization, encryption, or use of a payment processor.",
+            lineNumbers: [...new Set(cardNumberLines)],
+            recommendation: "Use a PCI-compliant payment processor (Stripe, Braintree). Never store, log, or transmit raw card numbers. Tokenize immediately.",
+            reference: "PCI DSS Requirement 3: Protect Stored Cardholder Data",
+            suggestedFix: "Replace raw card handling with tokenization: const { id } = await stripe.tokens.create({ card }); store only the token, never the card number.",
+            confidence: 0.85,
+        });
+    }
+    // Detect HIPAA-relevant health data
+    const healthDataLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/(?:diagnosis|medical_record|health_condition|prescription|treatment|patient_id|medical_history|lab_result)/i.test(line) &&
+            !/encrypt|hipaa|protected|phi\b/i.test(line)) {
+            healthDataLines.push(i + 1);
+        }
+    });
+    if (healthDataLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Protected Health Information without HIPAA safeguards",
+            description: "Health-related data fields detected without encryption or HIPAA compliance markers. PHI requires special handling under HIPAA.",
+            lineNumbers: healthDataLines,
+            recommendation: "Encrypt PHI at rest and in transit. Implement access controls, audit logging, and ensure BAA with cloud providers.",
+            reference: "HIPAA Security Rule / 45 CFR Part 164",
+            suggestedFix: "Encrypt PHI with AES-256-GCM and add access control: if (!user.roles.includes('healthcare_provider')) throw new ForbiddenError();",
+            confidence: 0.85,
+        });
+    }
+    // Detect right-to-delete / data erasure gaps
+    const deleteEndpointExists = testCode(code, /delete.*user|erase.*data|remove.*account|right.?to.?delete|gdpr.*delete|data.?erasure/i);
+    const storesUserData = testCode(code, /(?:save|create|insert)\s*\(.*(?:user|customer|profile|account)/i);
+    if (storesUserData && !deleteEndpointExists) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No data deletion/erasure capability detected",
+            description: "User data is stored but no deletion mechanism exists. GDPR and CCPA require the ability to delete personal data on request.",
+            recommendation: "Implement a user data deletion endpoint that cascades across all storage systems (DB, cache, backups, third parties).",
+            reference: "GDPR Article 17: Right to Erasure / CCPA Right to Delete",
+            suggestedFix: "Add deletion endpoint: app.delete('/api/users/:id/data', auth, async (req, res) => { await deleteUserData(req.params.id); res.status(204).end(); });",
+            confidence: 0.7,
+        });
+    }
+    // Detect cookie handling without SameSite/Secure flags
+    const cookieLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/set-cookie|setCookie|cookie\s*\(/i.test(line) && !/sameSite|secure|httpOnly/i.test(line)) {
+            cookieLines.push(i + 1);
+        }
+    });
+    if (cookieLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Cookies set without security flags",
+            description: "Cookies are set without SameSite, Secure, or HttpOnly flags, which may violate security compliance standards.",
+            lineNumbers: cookieLines,
+            recommendation: "Set Secure, HttpOnly, and SameSite=Strict on sensitive cookies. Review cookie consent requirements per jurisdiction.",
+            reference: "OWASP Cookie Security / ePrivacy Directive",
+            suggestedFix: "Set secure cookie flags: res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'strict', maxAge: 3600000 });",
+            confidence: 0.8,
+        });
+    }
+    // Detect age verification gaps
+    const ageRelatedLines = [];
+    // Skip for HTML/markup files — privacy policy text mentioning age/COPPA/children
+    // is legal disclosure, not an age-input data flow requiring verification logic.
+    const isMarkup = /^\s*<(!DOCTYPE|html|head|body|meta|link|div|section|p\b|span|a\b|h[1-6])/im.test(code);
+    // Skip for IaC templates (Bicep, Terraform, ARM) — infrastructure declarations
+    // contain no age-related user data or input fields requiring verification.
+    const iacTemplate = isIaCTemplate(code);
+    if (!isMarkup && !iacTemplate) {
+        lines.forEach((line, i) => {
+            if (isCommentLine(line))
+                return;
+            // Use word-bounded \bage(?![a-z]) to avoid matching 'age' inside common
+            // words like package, page, image, storage, manage, etc.
+            if (/(?:\bage(?![a-z])|date.?of.?birth|\bdob\b|birthdate|birth_date|\bminor\b|\bchild(?:ren)?\b|under.?13|under.?16|\bcoppa\b)/i.test(line)) {
+                // Skip lines where 'age' appears in cache/TTL/HTTP-header context
+                // (e.g., cache_age, max-age, staleness age, "age" in logging about
+                // cache freshness).  Only applies when the sole trigger is \bage.
+                // Check a ±3 line context window since a variable like `age = ...`
+                // may be on a different line from the `cache` reference.
+                if (/\bage(?![a-z])/i.test(line) &&
+                    !/date.?of.?birth|\bdob\b|birthdate|birth_date|\bminor\b|\bchild(?:ren)?\b|under.?13|under.?16|\bcoppa\b/i.test(line)) {
+                    const ageContext = lines.slice(Math.max(0, i - 3), Math.min(lines.length, i + 4)).join("\n");
+                    if (/cache|\bttl\b|max.?age|stale|freshness|expir.*\bage|\bage.*expir|header/i.test(ageContext)) {
+                        return;
+                    }
+                }
+                ageRelatedLines.push(i + 1);
+            }
+        });
+    }
+    const hasAgeVerification = /age.?verif|age.?check|age.?gate|is.?minor|is.?adult|minimum.?age|verifyAge|ageCompliance|requireParentalConsent|restrictDataCollection/i.test(code);
+    // If age-consent middleware and explicit minor-data restrictions are present, downgrade severity
+    const hasAgeConsentMiddleware = /ageConsent(?:Middleware)?|parentalConsent(?:Middleware)?|coppaMiddleware|minorDataRestrict|childProtection(?:Guard|Middleware)|verifyMinorConsent|ageGate(?:Middleware)?/i.test(code);
+    const ageRuleSeverity = hasAgeConsentMiddleware ? "low" : "medium";
+    if (ageRelatedLines.length > 0 && !hasAgeVerification) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: ageRuleSeverity,
+            title: "Age-related data without verification mechanism",
+            description: "Code references age or date of birth but has no age verification mechanism. COPPA, GDPR (under 16), and other laws require special handling for minors.",
+            lineNumbers: ageRelatedLines.slice(0, 5),
+            recommendation: "Implement age verification and parental consent flows for users under the applicable age threshold.",
+            reference: "COPPA / GDPR Article 8 / Age Appropriate Design Code",
+            suggestedFix: "Add age verification: if (calculateAge(user.dob) < 13) { requireParentalConsent(user.id); restrictDataCollection(); }",
+            confidence: 0.8,
+        });
+    }
+    // Detect audit trail gaps for regulated operations
+    const regulatedOpLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        // Skip attribute/annotation lines (e.g., [Authorize], @Authorize) — these are access control, not operations
+        if (/^\s*[[@]/.test(line))
+            return;
+        if (/(?:transfer|payment|withdrawal|approve|certify|attest)\s*[=(]/i.test(line) ||
+            /DELETE\s+FROM/i.test(line) ||
+            /UPDATE\s+\w+\s+SET\s+(?:role|permission|privilege|access_level)/i.test(line) ||
+            /UPDATE\s+system_config/i.test(line) ||
+            /app\.\s*(?:delete|put)\s*\(\s*["'`][^"'`]*\/admin/i.test(line)) {
+            regulatedOpLines.push(i + 1);
+        }
+    });
+    const hasAuditTrail = testCode(code, /audit|auditLog|audit_log|audit_trail|compliance_log/i);
+    if (regulatedOpLines.length > 0 && !hasAuditTrail) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "high",
+            title: "Regulated operations without audit trail",
+            description: "Financial or approval operations detected without audit logging. SOX, SOC2, and financial regulations require complete audit trails.",
+            lineNumbers: regulatedOpLines.slice(0, 5),
+            recommendation: "Implement immutable audit logging for all regulated operations. Log who, what, when, and the outcome.",
+            reference: "SOX Compliance / SOC2 Trust Criteria",
+            suggestedFix: "Add audit logging: auditLog.append({ actor: req.user.id, action: 'approve', resource, timestamp: new Date(), outcome: 'success' });",
+            confidence: 0.7,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/concurrency.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeConcurrency(code: string, language: string): Finding[];

package/dist/evaluators/concurrency.js

@@ -0,0 +1,307 @@
+import { getLangLineNumbers, getLangFamily, isCommentLine, testCode } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeConcurrency(code, language) {
+    const findings = [];
+    const lines = code.split("\n");
+    const prefix = "CONC";
+    let ruleNum = 1;
+    const _lang = getLangFamily(language);
+    // Detect unbounded Promise.all
+    const promiseAllLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/Promise\.all\s*\(\s*\w+\.map/i.test(line)) {
+            const context = lines.slice(Math.max(0, i - 3), Math.min(lines.length, i + 5)).join("\n");
+            if (!/chunk|batch|limit|throttle|pLimit|p-limit|concurrency|pool/i.test(context)) {
+                promiseAllLines.push(i + 1);
+            }
+        }
+    });
+    if (promiseAllLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Unbounded Promise.all with dynamic array",
+            description: "Using Promise.all with a mapped array without concurrency limits can overwhelm resources (database connections, API rate limits, memory).",
+            lineNumbers: promiseAllLines,
+            recommendation: "Use a concurrency limiter (p-limit, p-map with concurrency option) or batch the operations. Consider Promise.allSettled for fault tolerance.",
+            reference: "Node.js Concurrency Patterns",
+            suggestedFix: "Replace `Promise.all(items.map(fn))` with `pMap(items, fn, { concurrency: 5 })` using the `p-map` library, or chunk the array and process batches sequentially.",
+            confidence: 0.8,
+        });
+    }
+    // Detect shared mutable state (multi-language)
+    const globalMutableLines = [];
+    const sharedMutableLines = getLangLineNumbers(code, language, LP.SHARED_MUTABLE);
+    sharedMutableLines.forEach((ln) => {
+        const idx = ln - 1;
+        const declLine = lines[idx];
+        // Skip declarations inside function/method bodies (indented code is local, not shared)
+        const leadingSpaces = declLine.match(/^(\s*)/)?.[1]?.length ?? 0;
+        if (leadingSpaces > 0)
+            return;
+        const restOfFile = lines.slice(idx + 1).join("\n");
+        const varName = declLine.trim().match(/(?:let|var|static\s+mut|static\s+(?:Lazy|Once))\s+(\w+)/)?.[1];
+        if (varName &&
+            /async\s|\.then\s*\(|await|tokio|Task\.|Thread|goroutine|go\s+func/i.test(restOfFile) &&
+            new RegExp(`\\b${varName}\\b`).test(restOfFile)) {
+            globalMutableLines.push(ln);
+        }
+    });
+    if (globalMutableLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Shared mutable state in async context",
+            description: "Module-level mutable variables accessed from async functions can cause race conditions and data corruption.",
+            lineNumbers: globalMutableLines,
+            recommendation: "Use request-scoped/context-scoped state, atomic operations, or proper synchronization mechanisms instead of shared mutable variables.",
+            reference: "Concurrency: Shared State Hazards",
+            suggestedFix: "Move the mutable variable into a request-scoped context (e.g., pass it as a function parameter or store it in `AsyncLocalStorage`) instead of using a module-level `let`.",
+            confidence: 0.8,
+        });
+    }
+    // ── Go: Unsynchronized map in HTTP handler context ──
+    if (_lang === "go") {
+        const goMapLines = [];
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Detect package-level map declarations (var cache = make(map[...]) or var cache map[...])
+            if (/^\s*var\s+\w+\s*=\s*make\s*\(\s*map\b/.test(line) || /^\s*var\s+\w+\s+map\[/.test(line)) {
+                const varName = line.match(/var\s+(\w+)/)?.[1];
+                if (!varName)
+                    continue;
+                const restOfFile = lines.slice(i + 1).join("\n");
+                // Check if accessed from HTTP handler, goroutine context, or exported functions
+                const hasHttpHandler = /func\s+\w+\s*\(\s*\w+\s+http\.ResponseWriter/.test(restOfFile);
+                const hasGoroutine = /\bgo\s+func\b/.test(restOfFile);
+                // Exported functions (capitalized names) on package-level maps are
+                // callable from any goroutine — inherently concurrent.
+                const hasExportedAccessor = new RegExp(`func\\s+[A-Z]\\w*\\s*\\([^)]*\\)[^{]*\\{[^}]*\\b${varName}\\b`, "s").test(restOfFile);
+                const hasMutex = /sync\.(RW)?Mutex|sync\.Map/.test(code);
+                if ((hasHttpHandler || hasGoroutine || hasExportedAccessor) &&
+                    !hasMutex &&
+                    new RegExp(`\\b${varName}\\b`).test(restOfFile)) {
+                    goMapLines.push(i + 1);
+                }
+            }
+        }
+        if (goMapLines.length > 0) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "critical",
+                title: "Unsynchronized map access in concurrent context",
+                description: "Go maps are not safe for concurrent use. Accessing a package-level map from HTTP handlers (which run concurrently) causes data races and potential panics.",
+                lineNumbers: goMapLines,
+                recommendation: "Use sync.RWMutex to guard map access, or replace with sync.Map for simple key-value caching. For high-concurrency cases, consider sharded maps.",
+                reference: "Go Race Detector / Go Maps in Action",
+                suggestedFix: "Protect map access with a mutex: var mu sync.RWMutex; mu.RLock(); v := cache[key]; mu.RUnlock(); or use sync.Map instead.",
+                confidence: 0.9,
+            });
+        }
+    }
+    // Detect missing await
+    const missingAwaitLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        // Detect promise-returning calls without await in async context
+        if (/^\s*\w+\.(save|update|delete|insert|remove|send|post|put|fetch)\s*\(/i.test(line) &&
+            !/await|return|\.then|\.catch/i.test(line)) {
+            // Check if we're in an async function
+            const prevCode = lines.slice(Math.max(0, i - 20), i).join("\n");
+            if (/async\s+(?:function|\(|=>)/i.test(prevCode)) {
+                missingAwaitLines.push(i + 1);
+            }
+        }
+    });
+    if (missingAwaitLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Potentially missing await on async operation",
+            description: "Async operations without await fire-and-forget, meaning errors are silently lost and operations may not complete before the response is sent.",
+            lineNumbers: missingAwaitLines,
+            recommendation: "Add await to async operations, or explicitly handle the returned promise with .catch(). Use ESLint's no-floating-promises rule.",
+            reference: "Async/Await Error Handling",
+            suggestedFix: "Prepend `await` to the async call (e.g., `await db.save(entity)`) and enable the `@typescript-eslint/no-floating-promises` lint rule to catch future occurrences.",
+            confidence: 0.8,
+        });
+    }
+    // Detect async operations in loops without understanding of ordering
+    const awaitInLoopLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/for\s*\(|for\s+await|while\s*\(/.test(line)) {
+            const loopBody = lines.slice(i + 1, Math.min(lines.length, i + 15)).join("\n");
+            const awaitCount = (loopBody.match(/await\s/g) || []).length;
+            if (awaitCount > 0) {
+                awaitInLoopLines.push(i + 1);
+            }
+        }
+    });
+    if (awaitInLoopLines.length >= 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Sequential await in loop",
+            description: "Using await inside a loop processes items sequentially. If operations are independent, this unnecessarily serializes them.",
+            lineNumbers: awaitInLoopLines,
+            recommendation: "For independent operations, collect promises and use Promise.all() (with concurrency limits). Keep sequential only if order matters.",
+            reference: "Async Patterns: Parallel vs Sequential",
+            suggestedFix: "Refactor the loop body to build an array of promises and resolve them with `await Promise.all(promises)` (or `pMap` for bounded concurrency) outside the loop.",
+            confidence: 0.8,
+        });
+    }
+    // Detect setInterval without cleanup
+    const setIntervalLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/setInterval\s*\(/i.test(line)) {
+            setIntervalLines.push(i + 1);
+        }
+    });
+    const hasClearInterval = testCode(code, /clearInterval/i);
+    if (setIntervalLines.length > 0 && !hasClearInterval) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "setInterval without clearInterval",
+            description: "Intervals without cleanup continue running after the component/module is no longer needed, causing memory leaks and unexpected behavior.",
+            lineNumbers: setIntervalLines,
+            recommendation: "Store the interval ID and call clearInterval in cleanup/unmount/dispose handlers.",
+            reference: "Resource Cleanup Patterns",
+            suggestedFix: "Assign the return value to a variable (`const intervalId = setInterval(...)`) and call `clearInterval(intervalId)` in the component's cleanup or `process.on('SIGTERM')` handler.",
+            confidence: 0.7,
+        });
+    }
+    // Detect race condition patterns with read-modify-write
+    const readModifyWriteLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/await\s+\w+\.(get|find|read|load)\s*\(/i.test(line)) {
+            const nextLines = lines.slice(i + 1, Math.min(lines.length, i + 10)).join("\n");
+            if (/await\s+\w+\.(save|update|set|write|put)\s*\(/i.test(nextLines)) {
+                readModifyWriteLines.push(i + 1);
+            }
+        }
+    });
+    if (readModifyWriteLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Potential read-modify-write race condition",
+            description: "Reading a value, modifying it, and writing it back without atomicity can cause lost updates when concurrent operations overlap.",
+            lineNumbers: readModifyWriteLines,
+            recommendation: "Use atomic operations (findOneAndUpdate, INCR), optimistic locking (version field), or database transactions.",
+            reference: "Race Conditions / Optimistic Concurrency Control",
+            suggestedFix: "Replace the separate read-then-write with an atomic operation such as `db.collection.findOneAndUpdate({ _id }, { $inc: { count: 1 } })` or wrap both calls in a database transaction.",
+            confidence: 0.8,
+        });
+    }
+    // Detect worker/thread creation without pool (multi-language)
+    const workerLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/new\s+Worker\s*\(|new\s+Thread\s*\(|threading\.Thread\s*\(|Thread\.start|std::thread::spawn|thread::spawn|go\s+func|Task\.Run|Task\.Factory/i.test(line)) {
+            workerLines.push(i + 1);
+        }
+    });
+    const hasPool = /pool|WorkerPool|ThreadPool|threadpool|ExecutorService|rayon|tokio::spawn|goroutine.*pool|semaphore|signal\.Notify|Shutdown|SIGTERM|SIGINT|graceful/i.test(code);
+    if (workerLines.length > 0 && !hasPool) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Worker/thread creation without pooling",
+            description: "Creating new workers or threads per request is expensive and can exhaust system resources under load.",
+            lineNumbers: workerLines,
+            recommendation: "Use a worker/thread pool with a bounded size. Reuse workers for subsequent tasks.",
+            reference: "Thread Pool Pattern / Worker Pools",
+            suggestedFix: "Create a fixed-size pool (e.g., `new Piscina({ maxThreads: 4 })` in Node.js or `Executors.newFixedThreadPool(4)` in Java) and submit tasks to it instead of spawning new threads.",
+            confidence: 0.7,
+        });
+    }
+    // Detect callback-based async mixed with promises
+    const mixedAsyncLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/function\s*\(\s*(?:err|error)\s*,\s*(?:data|result|res)\s*\)/i.test(line)) {
+            const context = lines.slice(Math.max(0, i - 10), i).join("\n");
+            if (/async\s|Promise|\.then\s*\(/i.test(context)) {
+                mixedAsyncLines.push(i + 1);
+            }
+        }
+    });
+    if (mixedAsyncLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Mixed callback and promise async patterns",
+            description: "Mixing callbacks with promises/async-await in the same code path is error-prone and makes error handling inconsistent.",
+            lineNumbers: mixedAsyncLines,
+            recommendation: "Standardize on async/await. Wrap callback-based APIs with util.promisify() or manual Promise wrappers.",
+            reference: "Node.js util.promisify / Async Patterns",
+            suggestedFix: "Wrap the callback API with `const asyncFn = util.promisify(callbackFn)` and then call it with `await asyncFn(...)` to unify the async style.",
+            confidence: 0.8,
+        });
+    }
+    // Detect mutex/lock-free concurrent data access (multi-language)
+    const concurrentDataLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/(?:Map|Set|Array|Object|HashMap|Vec|Dictionary|List)\s*(?:\(|<|::new)/i.test(line) &&
+            /shared|global|cache|store|registry|static/i.test(line)) {
+            const restOfFile = lines.slice(i + 1).join("\n");
+            if (/async\s|Promise|\.then\s*\(|Thread|goroutine|go\s+func|tokio|Task\./i.test(restOfFile) &&
+                !/mutex|Mutex|lock|Lock|semaphore|Semaphore|synchronized|atomic|Atomic|RwLock|sync\.Map|ConcurrentDictionary|ConcurrentHashMap/i.test(restOfFile)) {
+                concurrentDataLines.push(i + 1);
+            }
+        }
+    });
+    if (concurrentDataLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Shared data structure without synchronization",
+            description: "Data structures labeled as shared/global/cache are used in async contexts without any synchronization mechanism.",
+            lineNumbers: concurrentDataLines,
+            recommendation: "Use ConcurrentHashMap (Java), sync.Map or Mutex (Go), Mutex/RwLock (Rust), ConcurrentDictionary (C#), or atomic operations. In Node.js, consider request-scoped state.",
+            reference: "Concurrent Data Access Patterns",
+            suggestedFix: "Replace the plain collection with a thread-safe alternative (e.g., `new ConcurrentHashMap<>()` in Java, `sync.Map{}` in Go) or guard access with a `Mutex`/`RwLock`.",
+            confidence: 0.8,
+        });
+    }
+    // Detect deadlock-prone patterns (nested locks/awaits)
+    const nestedAwaitLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/await\s+.*lock|acquire\s*\(/i.test(line)) {
+            const innerBlock = lines.slice(i + 1, Math.min(lines.length, i + 20)).join("\n");
+            if (/await\s+.*lock|acquire\s*\(/i.test(innerBlock)) {
+                nestedAwaitLines.push(i + 1);
+            }
+        }
+    });
+    if (nestedAwaitLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Potential deadlock: nested lock acquisition",
+            description: "Acquiring locks inside other lock scopes can cause deadlocks when two operations acquire locks in different orders.",
+            lineNumbers: nestedAwaitLines,
+            recommendation: "Acquire locks in a consistent order, use lock-free algorithms, or use a single coarser lock. Add deadlock detection/timeouts.",
+            reference: "Deadlock Prevention / Lock Ordering",
+            suggestedFix: "Enforce a global lock-ordering convention (e.g., always acquire lock A before lock B) or merge the nested locks into a single lock scope to eliminate the deadlock window.",
+            confidence: 0.8,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/configuration-management.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeConfigurationManagement(code: string, language: string): Finding[];