@kevinrabun/judges-cli 3.124.0

package/dist/evaluators/reliability.js

@@ -0,0 +1,245 @@
+import { getLangLineNumbers, getLineNumbers, getLangFamily, isCommentLine, isLikelyCLI, testCode } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeReliability(code, language) {
+    const findings = [];
+    const lines = code.split("\n");
+    const prefix = "REL";
+    let ruleNum = 1;
+    const _lang = getLangFamily(language);
+    // Detect empty catch blocks (multi-language)
+    const emptyCatchLines = getLangLineNumbers(code, language, LP.EMPTY_CATCH);
+    // Suppress when the file has resilience infrastructure (circuit-breaker, retry
+    // wrappers, abort-signal helpers) — empty catches are typically intentional in
+    // those patterns (errors handled at a higher abstraction layer).
+    const hasResilienceInfra = /circuit.?breaker|opossum|cockatiel|retry|backoff|createTimeoutSignal|mergeSignalWithTimeout|createEgressAwareHttpClient|AbortController|AbortSignal\.timeout|withRetry|retryWith|exponentialBackoff/i.test(code);
+    if (emptyCatchLines.length >= 1 && !hasResilienceInfra) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Empty catch block swallows errors",
+            description: "Empty catch blocks silently discard errors, making failures invisible and debugging extremely difficult.",
+            lineNumbers: emptyCatchLines,
+            recommendation: "At minimum, log the error. Ideally, handle it appropriately, rethrow, or propagate to a global error handler.",
+            reference: "Error Handling Best Practices",
+            suggestedFix: "Log in catch blocks: catch (err) { logger.error({ err }, 'Operation failed'); throw err; } — never leave catch blocks empty.",
+            confidence: 0.9,
+        });
+    }
+    // Detect missing timeout on network calls (multi-language)
+    // Check a broader context window (±15 lines) plus file-level AbortController/signal usage
+    const noTimeoutLines = [];
+    const httpClientLines = getLangLineNumbers(code, language, LP.HTTP_CLIENT);
+    const hasFileTimeoutPattern = /AbortController|AbortSignal\.timeout|createTimeoutSignal|mergeSignalWithTimeout|withTimeout|timeoutSignal|signal\s*:\s*\w/i.test(code);
+    httpClientLines.forEach((ln) => {
+        const idx = ln - 1;
+        // Scan ±15 lines (the enclosing function scope) for timeout/signal evidence
+        const ctxStart = Math.max(0, idx - 15);
+        const ctxEnd = Math.min(lines.length, idx + 15);
+        const context = lines
+            .slice(ctxStart, ctxEnd)
+            .filter((l) => !isCommentLine(l))
+            .join("\n");
+        if (!/timeout|AbortController|AbortSignal|signal\s*[,:=]|deadline|Duration|TimeSpan|time\.After/i.test(context) &&
+            !hasFileTimeoutPattern) {
+            noTimeoutLines.push(ln);
+        }
+    });
+    if (noTimeoutLines.length >= 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Network call without timeout",
+            description: "Network calls without timeouts can hang indefinitely, causing resource exhaustion and cascading failures.",
+            lineNumbers: noTimeoutLines,
+            recommendation: "Set explicit timeouts on all network calls. Use AbortController with setTimeout for fetch, or timeout options for HTTP clients.",
+            reference: "Resilience Patterns: Timeout",
+            suggestedFix: "Add timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 5000); fetch(url, { signal: controller.signal });",
+            confidence: 0.8,
+        });
+    }
+    // Detect missing retry logic for transient failures (multi-language)
+    const externalCallLines = getLangLineNumbers(code, language, LP.HTTP_CLIENT).concat(getLangLineNumbers(code, language, LP.DB_QUERY));
+    const hasRetry = testCode(code, /retry|retries|backoff|exponential|tenacity|Polly|resilience4j|backoff::/i);
+    if (externalCallLines.length >= 2 && !hasRetry) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No retry logic for external calls",
+            description: "Multiple external calls detected without retry logic. Transient failures (network blips, rate limits) will cause unnecessary errors.",
+            lineNumbers: externalCallLines.slice(0, 5),
+            recommendation: "Implement retry with exponential backoff for transient failures. Use libraries like p-retry, tenacity, Polly, Resilience4j, or backoff crate.",
+            reference: "Resilience Patterns: Retry with Backoff",
+            suggestedFix: "Add retry: import pRetry from 'p-retry'; const result = await pRetry(() => fetchData(), { retries: 3, minTimeout: 1000 });",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Detect single point of failure patterns
+    const singleConnLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/new\s+(?:Client|Connection|Database)\s*\(/i.test(line) && !/pool|Pool/i.test(line)) {
+            singleConnLines.push(i + 1);
+        }
+    });
+    if (singleConnLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Single connection instead of connection pool",
+            description: "Using a single database/service connection creates a single point of failure and limits concurrency.",
+            lineNumbers: singleConnLines,
+            recommendation: "Use connection pooling to improve resilience and throughput. Most database drivers support connection pools.",
+            reference: "Database Connection Management",
+            suggestedFix: "Replace single connection with pool: const pool = new Pool({ max: 10, idleTimeoutMillis: 30000 }); const client = await pool.connect(); try { ... } finally { client.release(); }",
+            confidence: 0.8,
+        });
+    }
+    // Detect unchecked null/undefined access
+    const unsafeAccessLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/\w+\.\w+\.\w+\.\w+/.test(line) && !/\?\./g.test(line) && !/import|require|from\s/i.test(line)) {
+            unsafeAccessLines.push(i + 1);
+        }
+    });
+    if (unsafeAccessLines.length > 5) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Deep property access without null checks",
+            description: "Deeply nested property access without optional chaining or null checks risks TypeError at runtime.",
+            lineNumbers: unsafeAccessLines.slice(0, 5),
+            recommendation: "Use optional chaining (?.) or explicit null checks for deeply nested property access.",
+            reference: "Defensive Programming Practices",
+            suggestedFix: "Use optional chaining: const value = obj?.nested?.deep?.prop ?? defaultValue; — prevents TypeError on null/undefined intermediaries.",
+            confidence: 0.75,
+        });
+    }
+    // Detect process.exit / panic / System.exit (multi-language)
+    const processExitLines = getLangLineNumbers(code, language, LP.PANIC_UNWRAP);
+    if (processExitLines.length > 0 && !isLikelyCLI(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Abrupt process termination detected",
+            description: "Calling process.exit(), panic!(), System.exit(), or os.Exit() prevents graceful shutdown, skips cleanup handlers, and can cause data loss.",
+            lineNumbers: processExitLines,
+            recommendation: "Throw errors or use graceful shutdown patterns instead. Let the process exit naturally after cleanup. Reserve panics for truly unrecoverable situations.",
+            reference: "Graceful Shutdown Patterns",
+            suggestedFix: "Replace process.exit() with graceful shutdown: process.on('SIGTERM', async () => { await server.close(); await db.disconnect(); });",
+            confidence: 0.9,
+        });
+    }
+    // Circuit breaker pattern missing
+    const hasMultipleExternalCalls = externalCallLines.length > 5;
+    const hasCircuitBreaker = testCode(code, /circuit.?breaker|CircuitBreaker|opossum|cockatiel|polly/i);
+    if (hasMultipleExternalCalls && !hasCircuitBreaker) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No circuit breaker for external dependencies",
+            description: "Multiple external calls without circuit breaker protection. A failing dependency can cause cascading failure across your system.",
+            recommendation: "Implement the circuit breaker pattern (opossum, cockatiel, Polly) to fail fast when external dependencies are unhealthy.",
+            reference: "Resilience Patterns: Circuit Breaker (Martin Fowler)",
+            suggestedFix: "Add circuit breaker: import CircuitBreaker from 'opossum'; const breaker = new CircuitBreaker(fetchData, { timeout: 3000, errorThresholdPercentage: 50 }); await breaker.fire();",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Missing fallback / degraded mode
+    const criticalCallLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/await\s+(?:fetch|axios|http)/i.test(line)) {
+            const context = lines.slice(i, Math.min(lines.length, i + 10)).join("\n");
+            if (!/fallback|default|cached|stale|degraded/i.test(context) && /catch/i.test(context)) {
+                criticalCallLines.push(i + 1);
+            }
+        }
+    });
+    if (criticalCallLines.length >= 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No fallback for failed external call",
+            description: "External calls catch errors but don't provide fallback values or degraded functionality.",
+            lineNumbers: criticalCallLines,
+            recommendation: "Provide fallback behavior: cached responses, default values, or gracefully degraded features when dependencies fail.",
+            reference: "Resilience Patterns: Fallback / Graceful Degradation",
+            suggestedFix: "Add fallback: try { data = await fetchFromApi(); } catch { data = await cache.get(key) ?? DEFAULT_VALUE; logger.warn('Using fallback data'); }",
+            confidence: 0.8,
+        });
+    }
+    // Missing idempotency for write operations
+    const writeEndpointLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/\.(post|put|patch)\s*\(\s*["'`]/i.test(line) || /app\.post|router\.post/i.test(line)) {
+            writeEndpointLines.push(i + 1);
+        }
+    });
+    const hasIdempotency = testCode(code, /idempoten|idempotency.?key|x-idempotency/i);
+    if (writeEndpointLines.length > 4 && !hasIdempotency) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Write endpoints without idempotency support",
+            description: "POST/PUT endpoints without idempotency keys can cause duplicate operations when clients retry after network failures.",
+            lineNumbers: writeEndpointLines.slice(0, 3),
+            recommendation: "Accept an idempotency key header (Idempotency-Key) and use it to deduplicate write operations.",
+            reference: "API Idempotency / Stripe Idempotency Pattern",
+            suggestedFix: "Add idempotency: const key = req.headers['idempotency-key']; if (key && await cache.has(key)) return res.json(await cache.get(key)); // process then cache result.",
+            confidence: 0.7,
+        });
+    }
+    // Detect HTTP server without graceful shutdown
+    const hasListenCall = testCode(code, /\.listen\s*\(|createServer\s*\(/i);
+    const hasGracefulShutdown = testCode(code, /SIGTERM|SIGINT|graceful.*shutdown|server\.close|httpTerminator|stoppable/i);
+    if (hasListenCall && !hasGracefulShutdown && !isLikelyCLI(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No graceful shutdown handler",
+            description: "Server starts listening but has no SIGTERM/SIGINT handler for graceful shutdown. In-flight requests will be dropped during deployments and scaling events.",
+            recommendation: "Register SIGTERM/SIGINT handlers that stop accepting new connections, drain in-flight requests, close database pools, then exit cleanly.",
+            reference: "12-Factor App: Disposability / Kubernetes Graceful Shutdown",
+            suggestedFix: "Add graceful shutdown: process.on('SIGTERM', () => { server.close(() => { db.end(); process.exit(0); }); setTimeout(() => process.exit(1), 10000); });",
+            confidence: 0.75,
+            lineNumbers: getLineNumbers(code, /\.listen\s*\(|createServer\s*\(/gi).slice(0, 3),
+        });
+    }
+    // Panic/fatal in Go or System.exit in Java (already covered above, remove duplicate)
+    // Skipping REL-010 equivalent since merged into process exit rule above
+    ruleNum++; // keep numbering consistent
+    // Unhandled promise rejection
+    const unhandledPromiseLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/new\s+Promise\s*\(/i.test(line)) {
+            const context = lines.slice(i, Math.min(lines.length, i + 15)).join("\n");
+            if (!/reject|\.catch|try\s*\{/i.test(context)) {
+                unhandledPromiseLines.push(i + 1);
+            }
+        }
+    });
+    if (unhandledPromiseLines.length >= 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "high",
+            title: "Promise without rejection handling",
+            description: "Promises created without reject handlers or .catch() can cause unhandled rejection crashes in Node.js.",
+            lineNumbers: unhandledPromiseLines,
+            recommendation: "Always handle promise rejections with .catch() or try/catch around await. Set up global unhandledRejection handler as safety net.",
+            reference: "Node.js Unhandled Rejections",
+            suggestedFix: "Add rejection handling: new Promise((resolve, reject) => { ... }).catch(err => logger.error(err)); or use try/catch with await.",
+            confidence: 0.8,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/scalability.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeScalability(code: string, language: string): Finding[];

package/dist/evaluators/scalability.js

@@ -0,0 +1,230 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, isIaCTemplate, testCode, getContextWindow, isLikelyAnalysisCode, isLikelyCLI, } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeScalability(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "SCALE";
+    const _lang = getLangFamily(language);
+    const analysisCode = isLikelyAnalysisCode(code);
+    const cliCode = isLikelyCLI(code);
+    // Global mutable state (multi-language)
+    // Only flag variables at module/top-level scope — function-local variables
+    // are GC'd when the function returns and don't create shared state.
+    const candidateLines = getLangLineNumbers(code, language, LP.SHARED_MUTABLE);
+    const lines = code.split("\n");
+    const globalStateLines = [];
+    for (const lineNum of candidateLines) {
+        let braceDepth = 0;
+        for (let i = 0; i < lineNum - 1; i++) {
+            for (const ch of lines[i]) {
+                if (ch === "{")
+                    braceDepth++;
+                else if (ch === "}")
+                    braceDepth--;
+            }
+        }
+        if (braceDepth === 0) {
+            globalStateLines.push(lineNum);
+        }
+    }
+    if (globalStateLines.length >= 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Global mutable state detected",
+            description: "Top-level mutable variables (let/var with object/array initialization) create shared state that prevents safe horizontal scaling across multiple instances.",
+            lineNumbers: globalStateLines,
+            recommendation: "Externalize state to a database, cache (Redis), or message queue. Use const/final/immutable for configuration. Each instance should be stateless.",
+            reference: "12-Factor App: Processes (Factor VI)",
+            suggestedFix: "Replace the top-level mutable variable with a call to an external store (e.g., `await redis.get(key)`) so each instance remains stateless.",
+            confidence: 0.9,
+        });
+    }
+    // In-memory session/store
+    const inMemPattern = /(?:Map|Set|WeakMap|Object\.create)\s*\(\s*\)|sessions?\s*[:=].*\{\}|(?:store|cache|registry)\s*=\s*(?:new\s+Map|\{\}|\[\])|MemoryStore|express-session\s*\(\s*\)/gi;
+    const inMemLines = getLineNumbers(code, inMemPattern);
+    if (inMemLines.length >= 4 && !analysisCode) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "In-memory data store may not scale",
+            description: "Data stored in process memory is lost on restart and not shared across instances. This breaks horizontal scaling where requests may hit different instances.",
+            lineNumbers: inMemLines,
+            recommendation: "Use a distributed store (Redis, Memcached, database) for session data, caches, and shared state.",
+            reference: "Distributed Systems Best Practices",
+            suggestedFix: "Swap the in-memory `Map`/object store for a Redis-backed store (e.g., `new RedisStore(...)`) so data is shared across instances.",
+            confidence: 0.85,
+        });
+    }
+    // Synchronous blocking in hot paths (multi-language)
+    // Only match known blocking APIs — not arbitrary functions that end in "Sync"
+    const blockingPattern = /(?:readFileSync|writeFileSync|readSync|writeSync|execSync|execFileSync|spawnSync|accessSync|statSync|lstatSync|readdirSync|mkdirSync|rmdirSync|unlinkSync|renameSync|copyFileSync|openSync|closeSync|appendFileSync|existsSync|realpathSync|chmodSync|chownSync|linkSync|symlinkSync|ftruncateSync|truncateSync|createReadStream|createWriteStream|pbkdf2Sync|scryptSync|randomFillSync|hashSync|compareSync|genSaltSync)\s*\(|Thread\.sleep\s*\(|time\.sleep\s*\(|threading\.Event\(\)\.wait|Task\.Delay.*\.Wait\(\)|\.Result\b|std::thread::sleep|tokio::task::block_in_place/gi;
+    const rawBlockingLines = getLineNumbers(code, blockingPattern);
+    // Exclude lines containing 'await' — those are async and non-blocking
+    const blockingLines = rawBlockingLines.filter((ln) => {
+        const ctx = getContextWindow(lines, ln, 1);
+        return !/\bawait\b/i.test(ctx);
+    });
+    if (blockingLines.length > 0 && !cliCode) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Synchronous blocking operation",
+            description: "Blocking/synchronous operations in the request path limit concurrency and throughput. Under load, this creates a bottleneck that prevents scaling.",
+            lineNumbers: blockingLines,
+            recommendation: "Use asynchronous alternatives (async/await, promises, non-blocking I/O). Move long-running work to background queues.",
+            reference: "Reactive & Non-Blocking Architecture Patterns",
+            suggestedFix: "Replace the synchronous call with its async counterpart (e.g., `fs.readFileSync` → `await fs.promises.readFile`) to avoid blocking the event loop.",
+            confidence: 0.9,
+        });
+    }
+    // No timeout on external calls (multi-language)
+    const fetchLines = getLangLineNumbers(code, language, LP.HTTP_CLIENT);
+    const hasTimeout = testCode(code, /timeout|Timeout|deadline|AbortController|Duration|TimeSpan|time\.After/gi);
+    if (fetchLines.length > 0 && !hasTimeout) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "External calls without timeout",
+            description: "HTTP/API calls without timeouts can hang indefinitely, consuming resources and cascading failures through the system when downstream services are slow.",
+            lineNumbers: fetchLines,
+            recommendation: "Set explicit timeouts on all external calls (e.g., 5-30 seconds). Implement circuit breakers (e.g., using libraries like cockatiel or opossum) for critical dependencies.",
+            reference: "Release It! — Stability Patterns",
+            suggestedFix: "Add a timeout option to the HTTP call (e.g., `fetch(url, { signal: AbortSignal.timeout(5000) })`) to prevent indefinite hangs.",
+            confidence: 0.7,
+        });
+    }
+    // Single-threaded heavy computation
+    // Detect nested loops, known CPU-intensive operations, and blocking patterns
+    // Use [^)]* instead of .* to avoid O(n²) backtracking between wildcards and \)
+    const heavyCompPattern = /(?:for|while)\s*\([^)]*(?:length|size|count)[^)]*\)[\s\S]{0,200}(?:for|while)\s*\(/gi;
+    const cpuIntensiveOps = /crypto\.pbkdf2Sync|crypto\.scryptSync|bcrypt\.hashSync|JSON\.parse\s*\(\s*JSON\.stringify|structuredClone|zlib\.[^a-z]*Sync|(?:sort|reduce|map|filter)\s*\([^)]*(?:sort|reduce|map|filter)\s*\(/gi;
+    const hasNestedLoops = testCode(code, heavyCompPattern);
+    const cpuOpsLines = getLineNumbers(code, cpuIntensiveOps);
+    if (hasNestedLoops || cpuOpsLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "CPU-intensive computation may block scaling",
+            description: `Detected ${hasNestedLoops ? "nested loops" : ""}${hasNestedLoops && cpuOpsLines.length > 0 ? " and " : ""}${cpuOpsLines.length > 0 ? `${cpuOpsLines.length} synchronous/heavy operation(s)` : ""}. Heavy computation on the main thread blocks the event loop (Node.js) or consumes thread pool capacity.`,
+            lineNumbers: cpuOpsLines.length > 0 ? cpuOpsLines : undefined,
+            recommendation: "Offload CPU-intensive work to worker threads, a job queue (Bull, Celery), or a dedicated compute service. Use async variants of crypto operations (pbkdf2, scrypt). Consider WebAssembly for hot-path computation.",
+            reference: "Node.js Worker Threads / Job Queue Patterns",
+            suggestedFix: "Move the heavy computation into a worker thread or use the async variant (e.g., `crypto.pbkdf2` instead of `crypto.pbkdf2Sync`) to keep the main thread free.",
+            confidence: 0.8,
+        });
+    }
+    // No rate limiting detected
+    const hasRateLimit = testCode(code, /rate.?limit|throttle|limiter|RateLimit/gi);
+    const iacTemplate = isIaCTemplate(code);
+    if (!hasRateLimit && fetchLines.length > 5 && !iacTemplate) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "info",
+            title: "No rate limiting detected",
+            description: "No rate limiting or throttling mechanism is visible. Without rate limiting, the system is vulnerable to being overwhelmed by traffic spikes or abuse.",
+            recommendation: "Implement rate limiting at the API gateway or application level. Consider token bucket or sliding window algorithms. Use libraries like express-rate-limit or a cloud-native solution.",
+            reference: "API Security & Scalability Best Practices",
+            suggestedFix: "Add a rate-limiting middleware (e.g., `app.use(rateLimit({ windowMs: 60000, max: 100 }))`) to protect endpoints from traffic spikes.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // File-based locking / local mutex
+    const fileLockPattern = /flock\s*\(|lockfile|\.lock\s*\(|FileLock|fcntl\.flock|Mutex\s*\(\s*\)|new\s+Semaphore/gi;
+    const fileLockLines = getLineNumbers(code, fileLockPattern);
+    if (fileLockLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Local file/process locking won't work at scale",
+            description: "File-based locks and process-local mutexes only work on a single machine. In a multi-instance deployment, they cannot coordinate across instances.",
+            lineNumbers: fileLockLines,
+            recommendation: "Use distributed locks (Redis SETNX/Redlock, ZooKeeper, etcd) or database-level locking for cross-instance coordination.",
+            reference: "Distributed Locking Patterns",
+            suggestedFix: "Replace the local file/mutex lock with a distributed lock (e.g., Redlock via `await redlock.acquire([resource], ttl)`) for cross-instance safety.",
+            confidence: 0.9,
+        });
+    }
+    // Sticky session / session affinity assumptions
+    const stickySessionPattern = /session\s*\{|express-session|SessionMiddleware|sticky|affinity/gi;
+    const stickySessionLines = getLineNumbers(code, stickySessionPattern);
+    const hasExternalSession = testCode(code, /redis|memcached|dynamodb|MongoStore|connect-redis|connect-mongo/gi);
+    if (stickySessionLines.length > 0 && !hasExternalSession) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Session storage may require sticky sessions",
+            description: "In-process session storage requires sticky sessions (session affinity), which limits load balancer flexibility and complicates rolling deployments.",
+            lineNumbers: stickySessionLines,
+            recommendation: "Use an external session store (Redis, DynamoDB, database) so any instance can serve any request. This enables zero-downtime deployments.",
+            reference: "Scalable Session Management",
+            suggestedFix: "Configure the session middleware to use an external store (e.g., `session({ store: new RedisStore({ client }) })`) instead of the default in-memory store.",
+            confidence: 0.75,
+        });
+    }
+    // Hardcoded thread/worker pool sizes
+    const hardcodedPoolPattern = /(?:pool|workers|threads|maxWorkers|poolSize|max_workers)\s*[:=]\s*\d+/gi;
+    const hardcodedPoolLines = getLineNumbers(code, hardcodedPoolPattern);
+    if (hardcodedPoolLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Hardcoded thread/worker pool size",
+            description: "Hardcoded pool sizes may not be optimal across different deployment environments (dev machine vs. production container with different CPU/memory).",
+            lineNumbers: hardcodedPoolLines,
+            recommendation: "Configure pool sizes via environment variables or derive from available resources (os.cpus().length). Allow runtime tuning.",
+            reference: "Resource Configuration Best Practices",
+            suggestedFix: "Replace the hardcoded pool size with a configurable value (e.g., `parseInt(process.env.POOL_SIZE) || os.cpus().length`) to adapt to each environment.",
+            confidence: 0.85,
+        });
+    }
+    // No circuit breaker pattern
+    const hasCircuitBreaker = testCode(code, /circuit.?breaker|opossum|cockatiel|polly|resilience4j|hystrix|CircuitBreaker/gi);
+    const hasMultipleExternalCalls = fetchLines.length > 4;
+    if (hasMultipleExternalCalls && !hasCircuitBreaker && !iacTemplate) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No circuit breaker for external dependencies",
+            description: "Multiple external service calls detected without circuit breaker protection. A failing dependency can cascade and bring down the entire system.",
+            recommendation: "Implement circuit breakers (opossum, cockatiel, Resilience4j, Polly) to fail fast when dependencies are down. Configure fallbacks.",
+            reference: "Release It! — Circuit Breaker Pattern",
+            suggestedFix: "Wrap external service calls with a circuit breaker (e.g., `const breaker = new CircuitBreaker(callFn, { timeout: 3000 }); await breaker.fire()`).",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Monolithic query / large payload assembly
+    const largePayloadPattern = /JSON\.stringify\s*\(.*\bdata\b|res\.json\s*\(\s*\{[\s\S]{0,50}\.findAll|\.aggregate\s*\(\s*\[[\s\S]{200,}/gi;
+    if (testCode(code, largePayloadPattern)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Potentially large response payload",
+            description: "Large response payloads increase serialization time, network transfer, and client memory usage. This limits throughput at scale.",
+            recommendation: "Implement pagination, field filtering (sparse fieldsets), or streaming for large responses. Consider GraphQL for client-driven field selection.",
+            reference: "API Scalability Patterns",
+            suggestedFix: "Add pagination parameters (e.g., `?page=1&limit=50`) and return only the requested slice instead of the full dataset.",
+            confidence: 0.8,
+        });
+    }
+    // WebSocket without connection limits
+    const wsPattern = /WebSocket|ws\s*\(|socket\.io|Socket\s*\(|socketserver/gi;
+    const wsLines = getLineNumbers(code, wsPattern);
+    const hasWsLimit = testCode(code, /maxPayload|maxConnections|connectionLimit|max_connections/gi);
+    if (wsLines.length > 0 && !hasWsLimit) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "medium",
+            title: "WebSocket without connection limits",
+            description: "WebSocket servers without connection/payload limits are vulnerable to resource exhaustion from too many connections or oversized messages.",
+            lineNumbers: wsLines,
+            recommendation: "Set maxPayload size, maximum connection limits, and implement connection throttling. Use a WebSocket gateway for production scale.",
+            reference: "WebSocket Security & Scalability",
+            suggestedFix: "Pass connection limits when creating the WebSocket server (e.g., `new WebSocketServer({ maxPayload: 1048576, maxConnections: 1000 })`).",
+            confidence: 0.75,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/security.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from "../types.js";
+/**
+ * General Security Posture evaluator.
+ *
+ * Produces SEC-prefixed findings for broad security anti-patterns:
+ * insecure data flows, weak cryptography, missing security controls,
+ * and unsafe code patterns across all supported languages.
+ *
+ * Complements domain-specific judges (CYBER, AUTH, DATA) by providing
+ * a holistic security assessment.
+ */
+export declare function analyzeSecurity(code: string, language: string): Finding[];