@kevinrabun/judges-cli 3.124.0

package/dist/evaluators/rate-limiting.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeRateLimiting(code: string, language: string): Finding[];

package/dist/evaluators/rate-limiting.js

@@ -0,0 +1,193 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, testCode } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeRateLimiting(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "RATE";
+    const _lang = getLangFamily(language);
+    // No rate limiting middleware (multi-language server detection)
+    const hasRateLimit = /rate.?limit|throttle|express-rate-limit|koa-ratelimit|bottleneck|p-limit|limiter|quota|@RateLimiter|RateLimitMiddleware|rate_limit/gi.test(code);
+    const routeLines = getLangLineNumbers(code, language, LP.HTTP_ROUTE);
+    const hasServerCode = routeLines.length > 0 || testCode(code, /createServer|express\(\)|new\s+Hono/gi);
+    if (hasServerCode && !hasRateLimit && code.split("\n").length > 80) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "No rate limiting on API endpoints",
+            description: "API server has no rate limiting. Any client can make unlimited requests, enabling DDoS attacks, brute-force login attempts, scraping, and resource exhaustion.",
+            recommendation: "Add rate limiting: express-rate-limit (Express), django-ratelimit (Django), @RateLimiter (Spring), tollbooth (Go), governor (Rust).",
+            reference: "OWASP API Security Top 10: API4 — Unrestricted Resource Consumption",
+            suggestedFix: "Add rate limiting: app.use(rateLimit({ windowMs: 15*60*1000, max: 100 })) (Express), @ratelimit (Django), RateLimiter.of() (Spring), tollbooth.NewLimiter() (Go).",
+            confidence: 0.55,
+            isAbsenceBased: true,
+            provenance: "absence-of-pattern",
+        });
+    }
+    // No request body size limit
+    const hasBodyParser = /bodyParser|express\.json|express\.urlencoded|body-parser|app\.use\s*\(\s*express\.json/gi.test(code);
+    const hasBodyLimit = testCode(code, /limit\s*:\s*["'`]\d|maxSize|maxBodySize|maxContentLength|payloadLimit/gi);
+    if (hasBodyParser && !hasBodyLimit) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Request body parser without size limit",
+            description: "Body parser middleware is used without a size limit. Attackers can send arbitrarily large payloads to exhaust server memory.",
+            recommendation: "Configure body parser with a size limit: express.json({ limit: '1mb' }). Set limits appropriate for your use case.",
+            reference: "Express Security Best Practices / OWASP",
+            suggestedFix: "Set body size limit: app.use(express.json({ limit: '1mb' })); app.use(express.urlencoded({ limit: '1mb', extended: true }));",
+            confidence: 0.8,
+        });
+    }
+    // Unbounded query results
+    const unboundedQueryPattern = /db\.find\s*\(\s*(?:\{\s*\}|\))|\.find\s*\(\s*\)/gi;
+    const unboundedLines = getLineNumbers(code, unboundedQueryPattern);
+    if (unboundedLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Unbounded query results without limit",
+            description: `Found ${unboundedLines.length} database query/queries without a limit. A single request could return millions of rows, crashing the server.`,
+            lineNumbers: unboundedLines,
+            recommendation: "Always enforce a maximum result limit: db.find({}).limit(100). Implement pagination and enforce maximum page sizes.",
+            reference: "API Rate Limiting / Database Query Safety",
+            suggestedFix: "Add query limits: db.find({}).limit(100).skip(page * 100); enforce max page size: const limit = Math.min(req.query.limit || 20, 100);",
+            confidence: 0.85,
+        });
+    }
+    // No rate limit headers in responses
+    if (hasServerCode && !hasRateLimit && code.split("\n").length > 40) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No rate limit headers in API responses",
+            description: "API responses don't include standard rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After).",
+            recommendation: "Return rate limit headers on responses so clients can self-throttle. Include Retry-After on 429 responses.",
+            reference: "IETF Rate Limit Headers / RFC 6585",
+            suggestedFix: "Add rate limit headers: res.set({ 'X-RateLimit-Limit': limit, 'X-RateLimit-Remaining': remaining, 'X-RateLimit-Reset': resetTime, 'Retry-After': retrySeconds });",
+            confidence: 0.5,
+            isAbsenceBased: true,
+            provenance: "absence-of-pattern",
+        });
+    }
+    // External API calls without backoff (multi-language)
+    const externalCallLines = getLangLineNumbers(code, language, LP.HTTP_CLIENT);
+    const hasBackoff = /backoff|retry|exponential|setTimeout.*retry|p-retry|cockatiel|polly|tenacity|retrying|Polly\.Handle|@Retry/gi.test(code);
+    if (externalCallLines.length >= 3 && !hasBackoff) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "External API calls without retry/backoff strategy",
+            description: `Found ${externalCallLines.length} external API call(s) without visible retry/backoff logic. Failed requests won't be retried, and rapid retries could get your client rate-limited or banned.`,
+            lineNumbers: externalCallLines.slice(0, 3),
+            recommendation: "Implement exponential backoff with jitter for external API calls. Respect Retry-After headers. Use libraries like p-retry (JS), tenacity (Python), Polly (C#).",
+            reference: "Exponential Backoff / Rate Limiting Best Practices",
+            suggestedFix: "Add retry with backoff: pRetry(() => fetch(url), { retries: 3 }) (JS), @retry(stop=stop_after(3)) (Python), .AddPolicyHandler(GetRetryPolicy()) (C#).",
+            confidence: 0.8,
+        });
+    }
+    // setInterval without bounds (potential DoS on resources)
+    const setIntervalPattern = /setInterval\s*\(/g;
+    const setIntervalLines = getLineNumbers(code, setIntervalPattern);
+    if (setIntervalLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "setInterval without rate control",
+            description: "setInterval runs indefinitely and could generate excessive load. If the interval function is slow, executions can overlap and compound.",
+            lineNumbers: setIntervalLines,
+            recommendation: "Use setTimeout with re-scheduling instead of setInterval to prevent overlap. Add guards to skip execution if the previous run hasn't completed.",
+            reference: "JavaScript Timer Best Practices",
+            suggestedFix: "Replace setInterval with controlled scheduling: async function poll() { await doWork(); setTimeout(poll, interval); } poll(); — prevents overlapping executions.",
+            confidence: 0.75,
+        });
+    }
+    // Auth endpoints without stricter rate limits
+    const authRoutePattern = /(?:post|put)\s*\(\s*['"]\/(?:auth|login|signin|register|signup|password|reset|forgot|token|oauth)/gi;
+    const authRouteLines = getLineNumbers(code, authRoutePattern);
+    const hasRateLimiter = testCode(code, /rateLimit|rateLimiter|rate_limit|throttle/gi);
+    if (authRouteLines.length > 0 && !hasRateLimiter) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Authentication endpoints without rate limiting",
+            description: `Found ${authRouteLines.length} authentication endpoint(s) without visible rate limiting. Auth endpoints are prime targets for brute-force and credential-stuffing attacks.`,
+            lineNumbers: authRouteLines,
+            recommendation: "Apply strict rate limits to auth endpoints (e.g., 5-10 requests/minute per IP). Use progressive delays or CAPTCHA after failed attempts. Consider using 'express-rate-limit' or 'rate-limiter-flexible'.",
+            reference: "OWASP: Brute Force Protection / NIST 800-63B",
+            suggestedFix: "Add auth rate limit: app.use('/auth', rateLimit({ windowMs: 60000, max: 5 })); from 'express-rate-limit'.",
+            confidence: 0.8,
+        });
+    }
+    // File upload without size limit
+    const uploadPattern = /multer\s*\(|upload\s*\.\s*(?:single|array|fields)|formidable|busboy|multipart/gi;
+    const uploadLines = getLineNumbers(code, uploadPattern);
+    const hasUploadLimit = testCode(code, /limits\s*:\s*\{|maxFileSize|fileSizeLimit|maxFiles/gi);
+    if (uploadLines.length > 0 && !hasUploadLimit) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "File upload without size or count limits",
+            description: `Found ${uploadLines.length} file upload handler(s) without visible size limits. Unbounded uploads can exhaust disk space and memory, causing denial of service.`,
+            lineNumbers: uploadLines,
+            recommendation: "Set explicit file size limits (e.g., multer({ limits: { fileSize: 5 * 1024 * 1024 } })). Limit the number of files per request. Validate file types.",
+            reference: "OWASP: Unrestricted File Upload / Multer Limits",
+            suggestedFix: "Set upload limits: const upload = multer({ limits: { fileSize: 5 * 1024 * 1024, files: 5 }, fileFilter: allowedTypes });",
+            confidence: 0.8,
+        });
+    }
+    // Missing 429 status code responses
+    const has429 = testCode(code, /429|Too Many Requests|too_many_requests|RATE_LIMIT|rateLimited/gi);
+    const hasApiEndpoints = testCode(code, /app\.\s*(?:get|post|put|delete|patch)\s*\(|router\.\s*(?:get|post|put|delete|patch)\s*\(/gi);
+    if (hasApiEndpoints && !has429 && !hasRateLimiter) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "API endpoints with no 429 (Too Many Requests) handling",
+            description: "API endpoints found but no 429 status code or rate limiting middleware detected. Without rate limiting responses, clients have no feedback mechanism to back off.",
+            recommendation: "Return 429 status with Retry-After header when rate limits are exceeded. Include rate limit headers (X-RateLimit-Remaining, X-RateLimit-Reset) in all responses.",
+            reference: "RFC 6585: 429 Too Many Requests / IETF Rate Limiting Headers",
+            suggestedFix: "Return 429 responses: if (isRateLimited) { res.status(429).set('Retry-After', '60').json({ error: 'Too many requests', retryAfter: 60 }); }",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // WebSocket connections without limits
+    const wsPattern = /new\s+WebSocket(?:Server)?|wss?\.\s*on\s*\(\s*['"]connection/gi;
+    const wsLines = getLineNumbers(code, wsPattern);
+    const hasWsLimit = testCode(code, /maxPayload|maxConnections|maxClientsCount|perMessageDeflate.*threshold/gi);
+    if (wsLines.length > 0 && !hasWsLimit) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "WebSocket server without connection or message limits",
+            description: `Found ${wsLines.length} WebSocket server setup(s) without visible connection or payload limits. Unbounded WebSocket connections can exhaust server resources.`,
+            lineNumbers: wsLines,
+            recommendation: "Set maxPayload to limit message sizes. Limit concurrent connections per client. Implement message rate limiting per connection. Set idle timeouts.",
+            reference: "ws Package: Connection Limits / WebSocket Security",
+            suggestedFix: "Set WebSocket limits: new WebSocket.Server({ maxPayload: 1024 * 1024, perMessageDeflate: false }); add per-connection message rate tracking.",
+            confidence: 0.8,
+        });
+    }
+    // Recursive/infinite retry without backoff
+    const retryPattern = /retry|retryCount|maxRetries|attempts?\s*[<>]/gi;
+    const retryLines = getLineNumbers(code, retryPattern).filter((ln) => {
+        // Exclude Retry-After HTTP header references — those are response metadata, not retry logic
+        const line = code.split("\n")[ln - 1] || "";
+        return !/Retry-After/i.test(line) && !/retryAfter\s*\(/i.test(line);
+    });
+    const hasBackoffStrategy = testCode(code, /backoff|exponential|delay\s*\*|Math\.pow|jitter|p-retry|axios-retry|retry-axios|got\.retry|ky\.retry/gi);
+    if (retryLines.length > 0 && !hasBackoffStrategy) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Retry logic without exponential backoff",
+            description: `Found ${retryLines.length} retry reference(s) without backoff or delay escalation. Retrying at a fixed rate can overwhelm downstream services and cause cascading failures.`,
+            lineNumbers: retryLines,
+            recommendation: "Use exponential backoff with jitter: delay = baseDelay * Math.pow(2, attempt) + randomJitter. Set a maximum retry count. Use libraries like 'p-retry' or 'axios-retry'.",
+            reference: "AWS Architecture Blog: Exponential Backoff and Jitter",
+            suggestedFix: "Add backoff: import pRetry from 'p-retry'; await pRetry(() => fetchData(), { retries: 3, minTimeout: 1000, factor: 2 });",
+            confidence: 0.8,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/recall-boost.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Recall Booster — Additional detection patterns for weak-recall categories
+ *
+ * This module provides supplementary pattern detection for judge categories
+ * where the deterministic evaluators have recall below 85%. It acts as
+ * a second-pass augmentation applied after the primary evaluator.
+ *
+ * Categories strengthened (by recall gap analysis):
+ * - hallucination-detection (46.2% → improved)
+ * - ci-cd (41.7% → improved)
+ * - internationalization (42.9% → improved)
+ * - cost-effectiveness (57.1% → improved)
+ * - documentation (63.6% → improved)
+ * - iac-security (66.7% → improved)
+ * - cloud/cloud-readiness (50-73% → improved)
+ */
+import type { Finding } from "../types.js";
+interface BoostResult {
+    findings: Finding[];
+    boostedCategories: string[];
+}
+/**
+ * Apply recall-boosting patterns to detect issues that primary evaluators miss.
+ * Returns additional findings (does not modify existing ones).
+ */
+export declare function applyRecallBoost(code: string, language: string): BoostResult;
+export {};

package/dist/evaluators/recall-boost.js

@@ -0,0 +1,409 @@
+/**
+ * Recall Booster — Additional detection patterns for weak-recall categories
+ *
+ * This module provides supplementary pattern detection for judge categories
+ * where the deterministic evaluators have recall below 85%. It acts as
+ * a second-pass augmentation applied after the primary evaluator.
+ *
+ * Categories strengthened (by recall gap analysis):
+ * - hallucination-detection (46.2% → improved)
+ * - ci-cd (41.7% → improved)
+ * - internationalization (42.9% → improved)
+ * - cost-effectiveness (57.1% → improved)
+ * - documentation (63.6% → improved)
+ * - iac-security (66.7% → improved)
+ * - cloud/cloud-readiness (50-73% → improved)
+ */
+import { getLangFamily } from "./shared.js";
+// ─── Hallucination Detection Extras ──────────────────────────────────────────
+const EXTRA_HALLUCINATION_PATTERNS = [
+    // Python: common hallucinated built-in functions
+    {
+        pattern: /\bstr\.isinteger\s*\(/,
+        title: "Hallucinated Python str.isinteger()",
+        description: "Python str has no isinteger() method. LLMs confuse this with float.is_integer() or str.isdigit().",
+        fix: "Use str.isdigit() for digit check, or float(s).is_integer() for integer check.",
+        languages: ["python"],
+    },
+    {
+        pattern: /\blist\.contains\s*\(/,
+        title: "Hallucinated Python list.contains()",
+        description: "Python lists have no contains() method. Use the `in` operator instead.",
+        fix: "Replace `list.contains(x)` with `x in list`.",
+        languages: ["python"],
+    },
+    {
+        pattern: /\bdict\.has_key\s*\(/,
+        title: "Deprecated/hallucinated dict.has_key()",
+        description: "dict.has_key() was removed in Python 3. LLMs trained on mixed Python 2/3 code still generate it.",
+        fix: "Use `key in dict` instead of `dict.has_key(key)`.",
+        languages: ["python"],
+    },
+    {
+        pattern: /\bimport\s+asyncio\b[\s\S]{0,200}\basyncio\.sleep_ms\s*\(/,
+        title: "Hallucinated asyncio.sleep_ms()",
+        description: "asyncio has no sleep_ms(). LLMs confuse this with asyncio.sleep() which takes seconds.",
+        fix: "Use `await asyncio.sleep(ms / 1000)` for millisecond sleep.",
+        languages: ["python"],
+    },
+    // Node.js: fabricated API patterns
+    {
+        pattern: /\bprocess\.env\.getAll\s*\(/,
+        title: "Hallucinated process.env.getAll()",
+        description: "Node.js process.env has no getAll() method. It's a plain object.",
+        fix: "Use Object.entries(process.env) to get all environment variables.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /\bJSON\.tryParse\s*\(/,
+        title: "Hallucinated JSON.tryParse()",
+        description: "JavaScript has no JSON.tryParse(). This is a common .NET/C# pattern hallucinated into JS.",
+        fix: "Wrap JSON.parse() in a try/catch block for safe parsing.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /\bArray\.flatten\s*\(/,
+        title: "Hallucinated Array.flatten()",
+        description: "JavaScript Array has no static flatten() method. The instance method is .flat().",
+        fix: "Use `array.flat()` or `array.flat(Infinity)` for deep flattening.",
+        languages: ["javascript", "typescript"],
+    },
+    // Go: common hallucinations
+    {
+        pattern: /\bstrings\.Reverse\s*\(/,
+        title: "Hallucinated strings.Reverse()",
+        description: "Go strings package has no Reverse function. LLMs frequently hallucinate this.",
+        fix: "Implement string reversal manually using rune conversion: []rune(s).",
+        languages: ["go"],
+    },
+    {
+        pattern: /\berrors\.Wrapf?\s*\(/,
+        title: "Hallucinated errors.Wrap()",
+        description: "Go standard errors package has no Wrap function. This was from pkg/errors (deprecated).",
+        fix: 'Use fmt.Errorf("%w", err) for error wrapping (Go 1.13+).',
+        languages: ["go"],
+    },
+    // Rust: hallucinated trait methods
+    {
+        pattern: /\.to_str\(\)\s*\.unwrap\(\)/,
+        title: "Potentially hallucinated .to_str().unwrap() chain",
+        description: "LLMs frequently chain .to_str().unwrap() on types that don't implement to_str(). Verify the type has this method.",
+        fix: "Consider using .to_string() or .as_str() depending on the actual type.",
+        languages: ["rust"],
+    },
+    // Java: hallucinated APIs
+    {
+        pattern: /\bString\.isEmpty\s*\(\s*\w+\s*\)/,
+        title: "Hallucinated static String.isEmpty()",
+        description: "Java String.isEmpty() is an instance method, not static. LLMs sometimes generate static calls.",
+        fix: "Use `str.isEmpty()` as an instance method call.",
+        languages: ["java"],
+    },
+];
+// ─── CI/CD Detection Extras ──────────────────────────────────────────────────
+const EXTRA_CICD_PATTERNS = [
+    {
+        pattern: /\bpipeline\b[\s\S]{0,100}checkout:\s*none/i,
+        title: "Pipeline skips source checkout",
+        description: "CI pipeline configured to skip source checkout. This may indicate a misconfiguration.",
+        languages: ["yaml"],
+    },
+    {
+        pattern: /\bcurl\b[\s\S]{0,50}\|\s*(?:bash|sh)\b/,
+        title: "Piping curl to shell in CI",
+        description: "Downloading and directly executing scripts via curl|bash is a supply-chain risk in CI/CD pipelines.",
+        languages: ["yaml", "bash", "dockerfile"],
+    },
+    {
+        pattern: /\b(?:npm|pip|cargo)\s+install\b[\s\S]{0,30}--no-verify/i,
+        title: "Package install with verification disabled",
+        description: "Installing packages with verification disabled weakens supply-chain integrity in CI.",
+        languages: ["yaml", "bash", "dockerfile"],
+    },
+    {
+        pattern: /\bsudo\s+.*\b(?:chmod\s+777|chmod\s+a\+rwx)\b/,
+        title: "Overly permissive chmod in CI script",
+        description: "Setting 777 permissions in CI/CD scripts creates security risks on shared runners.",
+        languages: ["yaml", "bash"],
+    },
+];
+// ─── Internationalization Detection Extras ────────────────────────────────────
+const EXTRA_I18N_PATTERNS = [
+    {
+        pattern: /\.toLocaleDateString\s*\(\s*\)/,
+        title: "toLocaleDateString() without explicit locale",
+        description: "Calling toLocaleDateString() without a locale parameter uses the system default, producing inconsistent date formats across environments.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /new\s+Intl\.NumberFormat\s*\(\s*\)/,
+        title: "Intl.NumberFormat without explicit locale",
+        description: "Creating NumberFormat without a locale uses system default, inconsistent across deployments.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /\bcurrency\s*[:=]\s*["'](?:USD|EUR|GBP)["'][\s\S]{0,100}(?:format|display|render)/i,
+        title: "Hardcoded currency code",
+        description: "Currency code is hardcoded rather than derived from user locale or configuration.",
+        languages: ["javascript", "typescript", "python", "java"],
+    },
+    {
+        pattern: /\.(?:trim|split|substring)\([\s\S]{0,30}(?:first|last)\s*name/i,
+        title: "Culturally-biased name parsing",
+        description: "Splitting names into first/last assumes Western naming conventions. Many cultures use single names, family-name-first order, or multiple name components.",
+        languages: ["javascript", "typescript", "python", "java", "csharp"],
+    },
+];
+// ─── Cost-Effectiveness Detection Extras ─────────────────────────────────────
+const EXTRA_COST_PATTERNS = [
+    {
+        pattern: /\bnew\s+Date\(\)[\s\S]{0,30}while\s*\(/,
+        title: "Busy-wait loop with Date() polling",
+        description: "Busy-wait loops waste CPU cycles and increase compute costs. Use async timers instead.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /\bsetInterval\s*\([^,]+,\s*(?:100|50|10|1)\s*\)/,
+        title: "Very frequent interval (≤100ms)",
+        description: "Very frequent setInterval polling wastes CPU/battery. Consider event-driven approaches or longer intervals.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /SELECT\s+\*\s+FROM[\s\S]{0,50}(?:JOIN|,\s*\w+)/i,
+        title: "SELECT * with JOINs",
+        description: "Using SELECT * with JOINs retrieves all columns from all joined tables, significantly increasing data transfer and memory costs.",
+        languages: ["sql", "python", "javascript", "typescript", "java", "csharp"],
+    },
+    {
+        pattern: /\.(?:map|forEach|filter)\s*\([\s\S]{0,100}\.(?:map|forEach|filter)\s*\(/,
+        title: "Nested array iterations",
+        description: "Chained .map/.filter/.forEach calls iterate the array multiple times. Consider combining into a single pass with .reduce().",
+        languages: ["javascript", "typescript"],
+    },
+];
+// ─── IaC Security Extras ─────────────────────────────────────────────────────
+const EXTRA_IAC_PATTERNS = [
+    {
+        pattern: /\bpublic_network_access_enabled\s*=\s*true/i,
+        title: "Public network access enabled on Azure resource",
+        description: "Enabling public network access exposes the resource to the internet. Use private endpoints instead.",
+        languages: ["terraform", "bicep"],
+    },
+    {
+        pattern: /\bingress\b[\s\S]{0,100}\bcidr_blocks\s*=\s*\[\s*["']0\.0\.0\.0\/0["']\s*\]/,
+        title: "Security group allows all inbound traffic (0.0.0.0/0)",
+        description: "Ingress rule allows traffic from any IP. Restrict to specific CIDR ranges.",
+        languages: ["terraform"],
+    },
+    {
+        pattern: /\bsku\b[\s\S]{0,30}(?:Basic|Free)\b/i,
+        title: "Using Basic/Free SKU in production IaC",
+        description: "Basic/Free tier SKUs often lack security features like encryption, private endpoints, and SLA guarantees.",
+        languages: ["terraform", "bicep", "arm"],
+    },
+    {
+        pattern: /\bretention_in_days\s*[:=]\s*(?:0|1|7)\b/,
+        title: "Short log retention period",
+        description: "Log retention of 7 days or less may be insufficient for security investigation and compliance requirements.",
+        languages: ["terraform", "bicep"],
+    },
+];
+// ─── Documentation Detection Extras ──────────────────────────────────────────
+const EXTRA_DOC_PATTERNS = [
+    {
+        pattern: /(?:TODO|FIXME|HACK|XXX|TEMP)\s*[:!]/i,
+        title: "Unresolved TODO/FIXME/HACK comment",
+        description: "Code contains unresolved TODO/FIXME/HACK markers indicating incomplete implementation or known issues.",
+        languages: ["javascript", "typescript", "python", "java", "csharp", "go", "rust", "ruby", "php"],
+    },
+    {
+        pattern: /export\s+(?:default\s+)?(?:function|class|const)\s+\w+[\s\S]{0,50}\{[\s\S]{50,}(?:throw|return|if)\b/,
+        title: "Complex exported function without JSDoc/docstring",
+        description: "Public API function with complex logic lacks documentation. This makes the API hard to use correctly.",
+        languages: ["javascript", "typescript"],
+    },
+];
+// ─── Cloud Readiness Extras ──────────────────────────────────────────────────
+const EXTRA_CLOUD_PATTERNS = [
+    {
+        pattern: /\bfs\.(?:writeFileSync|appendFileSync)\s*\(\s*["']\/(?:tmp|var|data)\//,
+        title: "Writing to local filesystem path",
+        description: "Writing to local filesystem paths (/tmp, /var, /data) is not reliable in containerized or serverless environments. Use object storage or managed databases.",
+        languages: ["javascript", "typescript"],
+    },
+    {
+        pattern: /\bopen\s*\(\s*["']\/(?:tmp|var|data)\//,
+        title: "Writing to local filesystem path",
+        description: "Writing to local filesystem paths is not reliable in cloud/container environments.",
+        languages: ["python"],
+    },
+    {
+        pattern: /\b(?:127\.0\.0\.1|localhost)\b[\s\S]{0,30}(?:connect|host|url|endpoint)/i,
+        title: "Hardcoded localhost reference",
+        description: "Hardcoded localhost/127.0.0.1 references will fail in containerized deployments where services run on separate hosts.",
+        languages: ["javascript", "typescript", "python", "java", "go", "csharp"],
+    },
+];
+/**
+ * Apply recall-boosting patterns to detect issues that primary evaluators miss.
+ * Returns additional findings (does not modify existing ones).
+ */
+export function applyRecallBoost(code, language) {
+    const lang = getLangFamily(language);
+    const findings = [];
+    const boostedCategories = [];
+    const lines = code.split("\n");
+    function getMatchLines(pattern) {
+        const matched = [];
+        for (let i = 0; i < lines.length; i++) {
+            if (pattern.test(lines[i]))
+                matched.push(i + 1);
+            pattern.lastIndex = 0;
+        }
+        return matched;
+    }
+    // Hallucination boost
+    let halluNum = 900;
+    for (const p of EXTRA_HALLUCINATION_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        const matchLines = getMatchLines(p.pattern);
+        if (matchLines.length > 0) {
+            if (!boostedCategories.includes("hallucination-detection"))
+                boostedCategories.push("hallucination-detection");
+            findings.push({
+                ruleId: `HALLU-${String(halluNum++).padStart(3, "0")}`,
+                severity: "high",
+                title: p.title,
+                description: p.description,
+                lineNumbers: matchLines,
+                recommendation: p.fix,
+                reference: "AI Code Generation: Hallucinated API Detection",
+                confidence: 0.85,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    // CI/CD boost
+    let cicdNum = 900;
+    for (const p of EXTRA_CICD_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        if (p.pattern.test(code)) {
+            if (!boostedCategories.includes("ci-cd"))
+                boostedCategories.push("ci-cd");
+            findings.push({
+                ruleId: `CICD-${String(cicdNum++).padStart(3, "0")}`,
+                severity: "medium",
+                title: p.title,
+                description: p.description,
+                lineNumbers: getMatchLines(p.pattern),
+                recommendation: "Review and remediate this CI/CD configuration issue.",
+                confidence: 0.75,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    // I18N boost
+    let i18nNum = 900;
+    for (const p of EXTRA_I18N_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        const matchLines = getMatchLines(p.pattern);
+        if (matchLines.length > 0) {
+            if (!boostedCategories.includes("internationalization"))
+                boostedCategories.push("internationalization");
+            findings.push({
+                ruleId: `I18N-${String(i18nNum++).padStart(3, "0")}`,
+                severity: "medium",
+                title: p.title,
+                description: p.description,
+                lineNumbers: matchLines,
+                recommendation: "Ensure locale-awareness for international users.",
+                confidence: 0.7,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    // Cost-effectiveness boost
+    let costNum = 900;
+    for (const p of EXTRA_COST_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        if (p.pattern.test(code)) {
+            if (!boostedCategories.includes("cost-effectiveness"))
+                boostedCategories.push("cost-effectiveness");
+            findings.push({
+                ruleId: `COST-${String(costNum++).padStart(3, "0")}`,
+                severity: "medium",
+                title: p.title,
+                description: p.description,
+                lineNumbers: getMatchLines(p.pattern),
+                recommendation: "Consider more cost-efficient alternatives.",
+                confidence: 0.75,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    // IaC security boost
+    let iacNum = 900;
+    for (const p of EXTRA_IAC_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        if (p.pattern.test(code)) {
+            if (!boostedCategories.includes("iac-security"))
+                boostedCategories.push("iac-security");
+            findings.push({
+                ruleId: `IAC-${String(iacNum++).padStart(3, "0")}`,
+                severity: "high",
+                title: p.title,
+                description: p.description,
+                lineNumbers: getMatchLines(p.pattern),
+                recommendation: "Apply infrastructure security best practices.",
+                confidence: 0.8,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    // Documentation boost
+    let docNum = 900;
+    for (const p of EXTRA_DOC_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        if (p.pattern.test(code)) {
+            if (!boostedCategories.includes("documentation"))
+                boostedCategories.push("documentation");
+            findings.push({
+                ruleId: `DOC-${String(docNum++).padStart(3, "0")}`,
+                severity: "low",
+                title: p.title,
+                description: p.description,
+                lineNumbers: getMatchLines(p.pattern),
+                recommendation: "Improve documentation for maintainability.",
+                confidence: 0.7,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    // Cloud readiness boost
+    let cloudNum = 900;
+    for (const p of EXTRA_CLOUD_PATTERNS) {
+        if (!p.languages.includes(lang))
+            continue;
+        if (p.pattern.test(code)) {
+            if (!boostedCategories.includes("cloud-readiness"))
+                boostedCategories.push("cloud-readiness");
+            findings.push({
+                ruleId: `CLOUD-${String(cloudNum++).padStart(3, "0")}`,
+                severity: "medium",
+                title: p.title,
+                description: p.description,
+                lineNumbers: getMatchLines(p.pattern),
+                recommendation: "Design for cloud-native deployment.",
+                confidence: 0.75,
+                provenance: "regex-pattern-match",
+            });
+        }
+    }
+    return { findings, boostedCategories };
+}

package/dist/evaluators/reliability.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeReliability(code: string, language: string): Finding[];