@kevinrabun/judges 3.23.11 → 3.23.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/CHANGELOG.md +49 -0
  2. package/dist/api.d.ts +2 -0
  3. package/dist/api.d.ts.map +1 -1
  4. package/dist/api.js +2 -0
  5. package/dist/api.js.map +1 -1
  6. package/dist/ast/structural-parser.d.ts.map +1 -1
  7. package/dist/ast/structural-parser.js +148 -3
  8. package/dist/ast/structural-parser.js.map +1 -1
  9. package/dist/auto-tune.d.ts +147 -0
  10. package/dist/auto-tune.d.ts.map +1 -0
  11. package/dist/auto-tune.js +374 -0
  12. package/dist/auto-tune.js.map +1 -0
  13. package/dist/cli.d.ts.map +1 -1
  14. package/dist/cli.js +7 -0
  15. package/dist/cli.js.map +1 -1
  16. package/dist/commands/benchmark-expanded-2.d.ts +13 -0
  17. package/dist/commands/benchmark-expanded-2.d.ts.map +1 -0
  18. package/dist/commands/benchmark-expanded-2.js +5531 -0
  19. package/dist/commands/benchmark-expanded-2.js.map +1 -0
  20. package/dist/commands/benchmark-expanded.d.ts +13 -0
  21. package/dist/commands/benchmark-expanded.d.ts.map +1 -0
  22. package/dist/commands/benchmark-expanded.js +2600 -0
  23. package/dist/commands/benchmark-expanded.js.map +1 -0
  24. package/dist/commands/benchmark.d.ts.map +1 -1
  25. package/dist/commands/benchmark.js +5 -0
  26. package/dist/commands/benchmark.js.map +1 -1
  27. package/dist/commands/feedback.d.ts.map +1 -1
  28. package/dist/commands/feedback.js +13 -0
  29. package/dist/commands/feedback.js.map +1 -1
  30. package/dist/commands/review.d.ts +2 -0
  31. package/dist/commands/review.d.ts.map +1 -1
  32. package/dist/commands/review.js +84 -9
  33. package/dist/commands/review.js.map +1 -1
  34. package/dist/evaluators/accessibility.d.ts.map +1 -1
  35. package/dist/evaluators/accessibility.js +18 -4
  36. package/dist/evaluators/accessibility.js.map +1 -1
  37. package/dist/evaluators/agent-instructions.d.ts.map +1 -1
  38. package/dist/evaluators/agent-instructions.js +52 -1
  39. package/dist/evaluators/agent-instructions.js.map +1 -1
  40. package/dist/evaluators/caching.d.ts.map +1 -1
  41. package/dist/evaluators/caching.js +5 -4
  42. package/dist/evaluators/caching.js.map +1 -1
  43. package/dist/evaluators/ci-cd.d.ts.map +1 -1
  44. package/dist/evaluators/ci-cd.js +23 -0
  45. package/dist/evaluators/ci-cd.js.map +1 -1
  46. package/dist/evaluators/compliance.d.ts.map +1 -1
  47. package/dist/evaluators/compliance.js +5 -1
  48. package/dist/evaluators/compliance.js.map +1 -1
  49. package/dist/evaluators/cybersecurity.d.ts.map +1 -1
  50. package/dist/evaluators/cybersecurity.js +3 -2
  51. package/dist/evaluators/cybersecurity.js.map +1 -1
  52. package/dist/evaluators/false-positive-review.js +25 -20
  53. package/dist/evaluators/false-positive-review.js.map +1 -1
  54. package/dist/evaluators/hallucination-detection.d.ts +3 -0
  55. package/dist/evaluators/hallucination-detection.d.ts.map +1 -0
  56. package/dist/evaluators/hallucination-detection.js +463 -0
  57. package/dist/evaluators/hallucination-detection.js.map +1 -0
  58. package/dist/evaluators/iac-security.d.ts.map +1 -1
  59. package/dist/evaluators/iac-security.js +18 -1
  60. package/dist/evaluators/iac-security.js.map +1 -1
  61. package/dist/evaluators/index.d.ts.map +1 -1
  62. package/dist/evaluators/index.js +18 -6
  63. package/dist/evaluators/index.js.map +1 -1
  64. package/dist/evaluators/maintainability.d.ts.map +1 -1
  65. package/dist/evaluators/maintainability.js +46 -0
  66. package/dist/evaluators/maintainability.js.map +1 -1
  67. package/dist/evaluators/observability.d.ts.map +1 -1
  68. package/dist/evaluators/observability.js +19 -1
  69. package/dist/evaluators/observability.js.map +1 -1
  70. package/dist/evaluators/reliability.d.ts.map +1 -1
  71. package/dist/evaluators/reliability.js +17 -1
  72. package/dist/evaluators/reliability.js.map +1 -1
  73. package/dist/evaluators/scalability.js +1 -1
  74. package/dist/evaluators/scalability.js.map +1 -1
  75. package/dist/evaluators/security.d.ts.map +1 -1
  76. package/dist/evaluators/security.js +16 -14
  77. package/dist/evaluators/security.js.map +1 -1
  78. package/dist/evaluators/shared.d.ts.map +1 -1
  79. package/dist/evaluators/shared.js +15 -3
  80. package/dist/evaluators/shared.js.map +1 -1
  81. package/dist/evaluators/software-practices.d.ts.map +1 -1
  82. package/dist/evaluators/software-practices.js +20 -0
  83. package/dist/evaluators/software-practices.js.map +1 -1
  84. package/dist/evaluators/testing.d.ts.map +1 -1
  85. package/dist/evaluators/testing.js +3 -3
  86. package/dist/evaluators/testing.js.map +1 -1
  87. package/dist/evaluators/ux.d.ts.map +1 -1
  88. package/dist/evaluators/ux.js +10 -2
  89. package/dist/evaluators/ux.js.map +1 -1
  90. package/dist/github-app.d.ts +96 -0
  91. package/dist/github-app.d.ts.map +1 -0
  92. package/dist/github-app.js +541 -0
  93. package/dist/github-app.js.map +1 -0
  94. package/dist/index.js +8 -0
  95. package/dist/index.js.map +1 -1
  96. package/dist/judges/hallucination-detection.d.ts +3 -0
  97. package/dist/judges/hallucination-detection.d.ts.map +1 -0
  98. package/dist/judges/hallucination-detection.js +30 -0
  99. package/dist/judges/hallucination-detection.js.map +1 -0
  100. package/dist/judges/index.d.ts.map +1 -1
  101. package/dist/judges/index.js +4 -0
  102. package/dist/judges/index.js.map +1 -1
  103. package/dist/language-patterns.d.ts.map +1 -1
  104. package/dist/language-patterns.js +4 -1
  105. package/dist/language-patterns.js.map +1 -1
  106. package/package.json +1 -1
  107. package/server.json +3 -3
@@ -0,0 +1,463 @@
1
+ // ─── Hallucinated API / Import Validation ─────────────────────────────────────
2
+ // Detects APIs, imports, methods, and patterns that are commonly hallucinated
3
+ // by AI code generators. These include non-existent standard library functions,
4
+ // fabricated npm/PyPI packages, phantom class methods, and incorrect API
5
+ // signatures that look plausible but don't exist.
6
+ //
7
+ // This evaluator uses a curated registry of known hallucination patterns
8
+ // observed across popular LLMs.
9
+ // ──────────────────────────────────────────────────────────────────────────────
10
+ import { getLangFamily, isCommentLine } from "./shared.js";
11
+ /**
12
+ * Curated registry of APIs, methods, and imports that LLMs frequently
13
+ * hallucinate. Each entry includes the incorrect pattern, an explanation,
14
+ * and the correct alternative.
15
+ */
16
+ const HALLUCINATED_PATTERNS = [
17
+ // ── Node.js / JavaScript ──────────────────────────────────────────────
18
+ // fs.readFileAsync doesn't exist — it's fs.promises.readFile
19
+ {
20
+ pattern: /\bfs\.readFileAsync\s*\(/,
21
+ hallucinated: "fs.readFileAsync()",
22
+ reason: "Node.js fs module has no readFileAsync. This is a common LLM hallucination.",
23
+ fix: "Use fs.promises.readFile() or util.promisify(fs.readFile)().",
24
+ languages: ["javascript", "typescript"],
25
+ },
26
+ // fs.writeFileAsync
27
+ {
28
+ pattern: /\bfs\.writeFileAsync\s*\(/,
29
+ hallucinated: "fs.writeFileAsync()",
30
+ reason: "Node.js fs module has no writeFileAsync.",
31
+ fix: "Use fs.promises.writeFile() or util.promisify(fs.writeFile)().",
32
+ languages: ["javascript", "typescript"],
33
+ },
34
+ // Array.prototype.flat doesn't take a callback (confusing flat with flatMap)
35
+ {
36
+ pattern: /\.flat\s*\(\s*(?:function|\([^)]*\)\s*=>|[a-zA-Z_]\w*\s*=>)/,
37
+ hallucinated: ".flat(callback)",
38
+ reason: "Array.flat() does not accept a callback — it only takes an optional depth number. LLMs confuse it with Array.flatMap().",
39
+ fix: "Use .flatMap(callback) to both map and flatten, or .map(callback).flat() for two steps.",
40
+ languages: ["javascript", "typescript"],
41
+ },
42
+ // Object.hasOwn is correct, but LLMs sometimes generate Object.hasOwnKey
43
+ {
44
+ pattern: /\bObject\.hasOwnKey\s*\(/,
45
+ hallucinated: "Object.hasOwnKey()",
46
+ reason: "Object.hasOwnKey() does not exist. LLMs conflate hasOwn() and hasOwnProperty().",
47
+ fix: "Use Object.hasOwn(obj, key) (ES2022+) or Object.prototype.hasOwnProperty.call(obj, key).",
48
+ languages: ["javascript", "typescript"],
49
+ },
50
+ // Promise.allResolved — doesn't exist, LLMs conflate allSettled
51
+ {
52
+ pattern: /\bPromise\.allResolved\s*\(/,
53
+ hallucinated: "Promise.allResolved()",
54
+ reason: "Promise.allResolved() does not exist. LLMs confuse it with Promise.allSettled().",
55
+ fix: "Use Promise.allSettled() to wait for all promises regardless of outcome.",
56
+ languages: ["javascript", "typescript"],
57
+ },
58
+ // String.prototype.contains — doesn't exist, it's includes
59
+ {
60
+ pattern: /(?<!\w)['"`]\w*['"`]\.contains\s*\(|\.contains\s*\(\s*['"`]/,
61
+ hallucinated: "String.contains()",
62
+ reason: "JavaScript strings have no .contains() method. LLMs port this from Java/Kotlin.",
63
+ fix: "Use .includes() instead of .contains().",
64
+ languages: ["javascript", "typescript"],
65
+ },
66
+ // fetch().body.json() — incorrect, it's fetch().then(r => r.json())
67
+ {
68
+ pattern: /\bfetch\s*\([^)]*\)\s*\.body\.json\s*\(/,
69
+ hallucinated: "fetch().body.json()",
70
+ reason: "The fetch() Response has .json() on the Response, not on .body.",
71
+ fix: "Use const res = await fetch(url); const data = await res.json();",
72
+ languages: ["javascript", "typescript"],
73
+ },
74
+ // console.debug is real, but console.log.error is hallucinated
75
+ {
76
+ pattern: /\bconsole\.log\.error\s*\(/,
77
+ hallucinated: "console.log.error()",
78
+ reason: "console.log.error() does not exist. console.log and console.error are separate methods.",
79
+ fix: "Use console.error() for error output.",
80
+ languages: ["javascript", "typescript"],
81
+ },
82
+ // require().default — common hallucination for CJS
83
+ {
84
+ pattern: /\brequire\s*\([^)]+\)\.default\s*\(/,
85
+ hallucinated: "require('module').default()",
86
+ reason: "CommonJS modules typically don't have a .default export. This pattern is an LLM conflation of ESM default imports with CJS require().",
87
+ fix: "Use const mod = require('module'); mod() directly, or switch to ESM: import mod from 'module';",
88
+ languages: ["javascript", "typescript"],
89
+ },
90
+ // ── Python ────────────────────────────────────────────────────────────
91
+ // os.exec doesn't exist — it's os.system or subprocess
92
+ {
93
+ pattern: /\bos\.exec\s*\(/,
94
+ hallucinated: "os.exec()",
95
+ reason: "Python's os module has no exec() function. LLMs hallucinate this from other languages.",
96
+ fix: "Use subprocess.run() for command execution, or os.system() for simple cases.",
97
+ languages: ["python"],
98
+ },
99
+ // string.format() used as a global function
100
+ {
101
+ pattern: /\bstring\.format\s*\(/,
102
+ hallucinated: "string.format()",
103
+ reason: "Python has no global string.format() function. LLMs confuse this with str.format() method or the string module.",
104
+ fix: 'Use "template {}".format(value) or f"template {value}" (f-strings).',
105
+ languages: ["python"],
106
+ },
107
+ // json.parse — doesn't exist, it's json.loads
108
+ {
109
+ pattern: /\bjson\.parse\s*\(/,
110
+ hallucinated: "json.parse()",
111
+ reason: "Python's json module has json.loads() and json.load(), not json.parse(). This is a JavaScript API hallucinated into Python.",
112
+ fix: "Use json.loads(string) for strings or json.load(file) for file objects.",
113
+ languages: ["python"],
114
+ },
115
+ // json.stringify — doesn't exist, it's json.dumps
116
+ {
117
+ pattern: /\bjson\.stringify\s*\(/,
118
+ hallucinated: "json.stringify()",
119
+ reason: "Python's json module has json.dumps() and json.dump(), not json.stringify(). This is a JavaScript API hallucinated into Python.",
120
+ fix: "Use json.dumps(obj) for strings or json.dump(obj, file) for file output.",
121
+ languages: ["python"],
122
+ },
123
+ // list.push — doesn't exist, it's list.append
124
+ {
125
+ pattern: /\b\w+\.push\s*\(/,
126
+ hallucinated: "list.push()",
127
+ reason: "Python lists have no .push() method. LLMs port this from JavaScript's Array.push().",
128
+ fix: "Use .append(item) for single items or .extend(items) for iterables.",
129
+ languages: ["python"],
130
+ },
131
+ // dict.containsKey — doesn't exist, it's `key in dict`
132
+ {
133
+ pattern: /\b\w+\.containsKey\s*\(/,
134
+ hallucinated: "dict.containsKey()",
135
+ reason: "Python dicts have no .containsKey() method. LLMs hallucinate this from Java Maps.",
136
+ fix: "Use the `in` operator: if key in my_dict:",
137
+ languages: ["python"],
138
+ },
139
+ // string.isEmpty() — doesn't exist
140
+ {
141
+ pattern: /\b\w+\.isEmpty\s*\(\s*\)/,
142
+ hallucinated: "str.isEmpty()",
143
+ reason: "Python strings have no .isEmpty() method. LLMs hallucinate this from Java/Kotlin.",
144
+ fix: "Use `if not my_string:` or `if len(my_string) == 0:`.",
145
+ languages: ["python"],
146
+ },
147
+ // asyncio.sleep used without await
148
+ {
149
+ pattern: /(?<!\bawait\s)asyncio\.sleep\s*\(/,
150
+ hallucinated: "asyncio.sleep() without await",
151
+ reason: "asyncio.sleep() is a coroutine and must be awaited. Without await, it creates but never executes the coroutine.",
152
+ fix: "Use await asyncio.sleep(seconds).",
153
+ languages: ["python"],
154
+ },
155
+ // requests.get().data — doesn't exist, it's .text or .json()
156
+ {
157
+ pattern: /\brequests\.(?:get|post|put|delete|patch)\s*\([^)]*\)\.data\b/,
158
+ hallucinated: "requests.get().data",
159
+ reason: "The requests library Response has .text, .json(), .content — not .data. LLMs confuse this with axios.",
160
+ fix: "Use response.json() for parsed JSON or response.text for raw text.",
161
+ languages: ["python"],
162
+ },
163
+ // ── Go ────────────────────────────────────────────────────────────────
164
+ // strings.Contains with wrong case
165
+ {
166
+ pattern: /\bstrings\.contains\s*\(/,
167
+ hallucinated: "strings.contains()",
168
+ reason: "Go's strings package uses strings.Contains() (capital C). LLMs often use lowercase.",
169
+ fix: "Use strings.Contains(s, substr) with capital C.",
170
+ languages: ["go"],
171
+ },
172
+ // fmt.Println returning an error check that's never needed
173
+ {
174
+ pattern: /\berr\s*:?=\s*fmt\.Println\s*\(/,
175
+ hallucinated: "err := fmt.Println()",
176
+ reason: "While fmt.Println technically returns (n int, err error), checking its error is virtually never done and adds noise. LLMs generate this overly cautious pattern.",
177
+ fix: "Just call fmt.Println() without error checking. Reserve error handling for I/O and network operations.",
178
+ languages: ["go"],
179
+ },
180
+ // slice.append — wrong, it's append(slice, ...)
181
+ {
182
+ pattern: /\b\w+\.append\s*\(/,
183
+ hallucinated: "slice.append()",
184
+ reason: "Go uses the built-in append() function, not a method on slices. LLMs hallucinate OOP-style method calls.",
185
+ fix: "Use slice = append(slice, element) as a built-in function.",
186
+ languages: ["go"],
187
+ },
188
+ // http.HandleFunc on a ServeMux with wrong signature
189
+ {
190
+ pattern: /\bmux\.HandleFunc\s*\([^,]+,\s*func\s*\(\s*\w+\s+http\.Request\b/,
191
+ hallucinated: "func(w http.Request)",
192
+ reason: "http.Handler functions receive *http.Request (pointer), not http.Request (value). LLMs omit the pointer.",
193
+ fix: "Use func(w http.ResponseWriter, r *http.Request) with *http.Request.",
194
+ languages: ["go"],
195
+ },
196
+ // ── Java ──────────────────────────────────────────────────────────────
197
+ // String.isEmpty() is real, but LLMs sometimes generate String.blank()
198
+ {
199
+ pattern: /\.blank\s*\(\s*\)/,
200
+ hallucinated: ".blank()",
201
+ reason: "Java has .isBlank() (Java 11+), not .blank(). LLMs truncate the method name.",
202
+ fix: "Use .isBlank() for whitespace-only check or .isEmpty() for zero-length check.",
203
+ languages: ["java"],
204
+ },
205
+ // Arrays.asList().add — this returns a fixed-size list, add throws
206
+ {
207
+ pattern: /\bArrays\.asList\s*\([^)]*\)\s*\.add\s*\(/,
208
+ hallucinated: "Arrays.asList().add()",
209
+ reason: "Arrays.asList() returns a fixed-size list backed by the array. Calling .add() throws UnsupportedOperationException at runtime.",
210
+ fix: "Use new ArrayList<>(Arrays.asList(...)) to get a mutable list, or use List.of() if immutability is intended.",
211
+ languages: ["java"],
212
+ },
213
+ // System.println — doesn't exist
214
+ {
215
+ pattern: /\bSystem\.println\s*\(/,
216
+ hallucinated: "System.println()",
217
+ reason: "Java has System.out.println(), not System.println(). LLMs sometimes skip the .out part.",
218
+ fix: "Use System.out.println() for console output.",
219
+ languages: ["java"],
220
+ },
221
+ // ── Rust ──────────────────────────────────────────────────────────────
222
+ // .len() on an iterator — iterators don't have .len()
223
+ {
224
+ pattern: /\.iter\s*\(\s*\)\s*\.len\s*\(\s*\)/,
225
+ hallucinated: ".iter().len()",
226
+ reason: "Rust iterators don't have .len(). Only the original collection has .len(). LLMs generate this when they mean .count() or the collection's .len().",
227
+ fix: "Use .count() on the iterator (consumes it), or call .len() directly on the collection.",
228
+ languages: ["rust"],
229
+ },
230
+ // String.new() — doesn't exist, it's String::new()
231
+ {
232
+ pattern: /\bString\.new\s*\(\s*\)/,
233
+ hallucinated: "String.new()",
234
+ reason: "Rust uses :: for associated functions, not dots. String::new() is correct.",
235
+ fix: 'Use String::new() or String::from("...").',
236
+ languages: ["rust"],
237
+ },
238
+ // ── C# ────────────────────────────────────────────────────────────────
239
+ // Console.PrintLine — doesn't exist, it's Console.WriteLine
240
+ {
241
+ pattern: /\bConsole\.PrintLine\s*\(/,
242
+ hallucinated: "Console.PrintLine()",
243
+ reason: "C# has Console.WriteLine(), not Console.PrintLine(). LLMs conflate print/write terminology.",
244
+ fix: "Use Console.WriteLine() for output with newline.",
245
+ languages: ["csharp"],
246
+ },
247
+ // string.IsEmpty — doesn't exist, it's String.IsNullOrEmpty
248
+ {
249
+ pattern: /\.IsEmpty\s*\(\s*\)/,
250
+ hallucinated: ".IsEmpty()",
251
+ reason: "C# strings have no .IsEmpty() instance method. LLMs hallucinate it from Java or Kotlin.",
252
+ fix: "Use string.IsNullOrEmpty(s) or string.IsNullOrWhiteSpace(s) as static methods.",
253
+ languages: ["csharp"],
254
+ },
255
+ // ── PHP ───────────────────────────────────────────────────────────────
256
+ // array.push — PHP uses array_push() not OOP .push()
257
+ {
258
+ pattern: /\$\w+->push\s*\(/,
259
+ hallucinated: "$array->push()",
260
+ reason: "PHP arrays don't have a ->push() method. LLMs hallucinate OOP-style array methods from JavaScript.",
261
+ fix: "Use array_push($array, $value) or $array[] = $value.",
262
+ languages: ["php"],
263
+ },
264
+ // string.length — PHP uses strlen()
265
+ {
266
+ pattern: /\$\w+->length\b/,
267
+ hallucinated: "$string->length",
268
+ reason: "PHP strings have no ->length property. LLMs hallucinate from JavaScript.",
269
+ fix: "Use strlen($string) for byte length or mb_strlen($string) for character length.",
270
+ languages: ["php"],
271
+ },
272
+ // ── Ruby ──────────────────────────────────────────────────────────────
273
+ // Array.new.add — Ruby uses push or <<, not add
274
+ {
275
+ pattern: /\.\badd\s*\([^)]*\)\s*$/m,
276
+ hallucinated: "array.add()",
277
+ reason: "Ruby arrays have no .add() method. LLMs hallucinate this from Java/C#.",
278
+ fix: "Use .push(item) or the << operator: array << item.",
279
+ languages: ["ruby"],
280
+ },
281
+ // ── Kotlin ────────────────────────────────────────────────────────────
282
+ // println formatting: println("x = %d", x) — Kotlin println doesn't support formats
283
+ {
284
+ pattern: /\bprintln\s*\(\s*"[^"]*%[dsfx]/,
285
+ hallucinated: 'println("format %d", val)',
286
+ reason: "Kotlin's println() does not support printf-style formatting. LLMs confuse it with C/Java printf.",
287
+ fix: 'Use string templates: println("x = $x") or println("x = ${expression}").',
288
+ languages: ["kotlin"],
289
+ },
290
+ // ── Swift ─────────────────────────────────────────────────────────────
291
+ // Array.count() as a method — it's a property
292
+ {
293
+ pattern: /\.count\s*\(\s*\)/,
294
+ hallucinated: ".count()",
295
+ reason: "Swift's .count is a property, not a method. Calling .count() is a compile error.",
296
+ fix: "Use .count without parentheses: array.count.",
297
+ languages: ["swift"],
298
+ },
299
+ // ── Cross-language ────────────────────────────────────────────────────
300
+ // Fabricated npm packages — common hallucinated package names
301
+ {
302
+ pattern: /\bfrom\s+['"](?:easy-jwt|simple-crypto|auto-sanitize|quick-hash|fast-validate|node-security-utils|express-secure|react-safe-render|mongo-safe|api-guard|auth-helper|crypto-utils|secure-config|safe-eval|node-encrypt)['"]/,
303
+ hallucinated: "Non-existent npm package import",
304
+ reason: "This import references a package name commonly hallucinated by LLMs. The package either doesn't exist on npm or is a name-squatted stub.",
305
+ fix: "Verify the package exists on npmjs.com. Use established alternatives: jose/jsonwebtoken for JWT, crypto for hashing, express-validator for validation, helmet for security headers.",
306
+ languages: ["javascript", "typescript"],
307
+ },
308
+ // Fabricated Python packages
309
+ {
310
+ pattern: /^\s*(?:from|import)\s+(?:easy_jwt|simple_crypto|auto_sanitize|quick_hash|fast_validate|python_security|django_secure|flask_safe|mongo_safe|api_guard|auth_helper|crypto_utils|secure_config|safe_eval|py_encrypt)\b/,
311
+ hallucinated: "Non-existent Python package import",
312
+ reason: "This import references a package name commonly hallucinated by LLMs. The package likely doesn't exist on PyPI.",
313
+ fix: "Verify the package exists on pypi.org. Use established alternatives: PyJWT for JWT, cryptography for crypto, flask-wtf for validation.",
314
+ languages: ["python"],
315
+ },
316
+ ];
317
+ // ─── Suspicious Import Patterns ─────────────────────────────────────────────
318
+ /**
319
+ * Detect imports that follow LLM hallucination patterns:
320
+ * - Importing from packages that combine too-generic words
321
+ * - Importing non-existent submodules from known packages
322
+ * - Using fabricated utility function names
323
+ */
324
+ const SUSPICIOUS_SUBMODULE_PATTERNS = [
325
+ // React doesn't have these exports
326
+ {
327
+ parent: /\bfrom\s+['"]react['"]/,
328
+ invalidChild: /\b(?:useRequest|useFetch|useAPI|useAuth|useSocket|useAxios|useDatabase)\b/,
329
+ reason: "React does not export these hooks. They may come from third-party libraries (e.g., SWR, React Query, use-http) but LLMs often hallucinate them as built-in React hooks.",
330
+ languages: ["javascript", "typescript"],
331
+ },
332
+ // Express doesn't export these
333
+ {
334
+ parent: /\bfrom\s+['"]express['"]/,
335
+ invalidChild: /\b(?:validate|sanitize|authenticate|authorize|rateLimit|cors|helmet|csrf)\b/,
336
+ reason: "Express does not export these functions. They are separate middleware packages (express-validator, cors, helmet, csurf, express-rate-limit).",
337
+ languages: ["javascript", "typescript"],
338
+ },
339
+ // Flask doesn't export these
340
+ {
341
+ parent: /\bfrom\s+flask\s+import\b/,
342
+ invalidChild: /\b(?:validate|sanitize|authenticate|login_required|cors|csrf_protect|rate_limit)\b/,
343
+ reason: "Flask does not export these directly. They come from extensions: flask-login, flask-cors, flask-wtf, flask-limiter.",
344
+ languages: ["python"],
345
+ },
346
+ ];
347
+ // ─── Main Analyzer ──────────────────────────────────────────────────────────
348
+ export function analyzeHallucinationDetection(code, language) {
349
+ const findings = [];
350
+ const lines = code.split("\n");
351
+ let ruleNum = 1;
352
+ const prefix = "HALLU";
353
+ const lang = getLangFamily(language);
354
+ // 1. Check against known hallucinated API patterns
355
+ for (const hp of HALLUCINATED_PATTERNS) {
356
+ if (!hp.languages.includes(lang))
357
+ continue;
358
+ const affectedLines = [];
359
+ for (let i = 0; i < lines.length; i++) {
360
+ if (isCommentLine(lines[i]))
361
+ continue;
362
+ if (hp.pattern.test(lines[i])) {
363
+ affectedLines.push(i + 1);
364
+ }
365
+ }
366
+ if (affectedLines.length > 0) {
367
+ findings.push({
368
+ ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
369
+ severity: "high",
370
+ title: `Hallucinated API: ${hp.hallucinated}`,
371
+ description: hp.reason,
372
+ lineNumbers: affectedLines,
373
+ recommendation: hp.fix,
374
+ reference: "AI Code Safety — Hallucinated API Detection",
375
+ confidence: 0.85,
376
+ provenance: "regex-pattern-match",
377
+ });
378
+ }
379
+ }
380
+ // 2. Check for suspicious submodule imports
381
+ for (const sp of SUSPICIOUS_SUBMODULE_PATTERNS) {
382
+ if (!sp.languages.includes(lang))
383
+ continue;
384
+ for (let i = 0; i < lines.length; i++) {
385
+ if (isCommentLine(lines[i]))
386
+ continue;
387
+ if (sp.parent.test(lines[i]) && sp.invalidChild.test(lines[i])) {
388
+ findings.push({
389
+ ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
390
+ severity: "high",
391
+ title: "Hallucinated import — non-existent export from known package",
392
+ description: sp.reason,
393
+ lineNumbers: [i + 1],
394
+ recommendation: "Verify the import exists in the package's documentation. Install the correct third-party package instead.",
395
+ reference: "AI Code Safety — Hallucinated Import Detection",
396
+ confidence: 0.8,
397
+ provenance: "regex-pattern-match",
398
+ });
399
+ }
400
+ }
401
+ }
402
+ // 3. Detect common phantom method chains
403
+ // LLMs generate plausible-looking but non-existent method chains
404
+ if (lang === "javascript" || lang === "typescript") {
405
+ for (let i = 0; i < lines.length; i++) {
406
+ if (isCommentLine(lines[i]))
407
+ continue;
408
+ const line = lines[i];
409
+ // Promise.resolve().delay() — Bluebird API hallucinated into native Promise
410
+ if (/\bPromise\.resolve\s*\([^)]*\)\s*\.delay\s*\(/.test(line)) {
411
+ findings.push({
412
+ ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
413
+ severity: "high",
414
+ title: "Hallucinated API: Promise.resolve().delay()",
415
+ description: "Native Promises have no .delay() method. LLMs hallucinate this from the Bluebird library.",
416
+ lineNumbers: [i + 1],
417
+ recommendation: "Use: await new Promise(resolve => setTimeout(resolve, ms));",
418
+ reference: "AI Code Safety — Hallucinated API Detection",
419
+ confidence: 0.9,
420
+ provenance: "regex-pattern-match",
421
+ });
422
+ }
423
+ // Map.prototype.contains — should be .has
424
+ if (/\bnew Map\b/.test(code) && /\.contains\s*\(/.test(line)) {
425
+ findings.push({
426
+ ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
427
+ severity: "medium",
428
+ title: "Possible hallucinated API: Map.contains()",
429
+ description: "JavaScript Maps use .has() not .contains(). LLMs often hallucinate Java's Map.containsKey().",
430
+ lineNumbers: [i + 1],
431
+ recommendation: "Use map.has(key) to check for key existence.",
432
+ reference: "AI Code Safety — Hallucinated API Detection",
433
+ confidence: 0.7,
434
+ provenance: "regex-pattern-match",
435
+ });
436
+ }
437
+ }
438
+ }
439
+ // 4. Detect incorrect async patterns — common hallucination
440
+ if (lang === "javascript" || lang === "typescript") {
441
+ for (let i = 0; i < lines.length; i++) {
442
+ if (isCommentLine(lines[i]))
443
+ continue;
444
+ const line = lines[i];
445
+ // new Promise(async (resolve, reject) => { ... }) — anti-pattern
446
+ if (/new\s+Promise\s*\(\s*async\s/.test(line)) {
447
+ findings.push({
448
+ ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
449
+ severity: "medium",
450
+ title: "Anti-pattern: async function inside Promise constructor",
451
+ description: "Wrapping an async function inside new Promise() is an anti-pattern commonly generated by LLMs. Errors thrown in the async executor won't reject the promise, leading to unhandled rejections and swallowed errors.",
452
+ lineNumbers: [i + 1],
453
+ recommendation: "Remove the Promise wrapper — async functions already return Promises. Just use: async function name() { ... }",
454
+ reference: "AI Code Safety — Hallucinated Pattern Detection",
455
+ confidence: 0.85,
456
+ provenance: "regex-pattern-match",
457
+ });
458
+ }
459
+ }
460
+ }
461
+ return findings;
462
+ }
463
+ //# sourceMappingURL=hallucination-detection.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"hallucination-detection.js","sourceRoot":"","sources":["../../src/evaluators/hallucination-detection.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,kDAAkD;AAClD,EAAE;AACF,yEAAyE;AACzE,gCAAgC;AAChC,iFAAiF;AAGjF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAiB3D;;;;GAIG;AACH,MAAM,qBAAqB,GAA0B;IACnD,yEAAyE;IAEzE,6DAA6D;IAC7D;QACE,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,6EAA6E;QACrF,GAAG,EAAE,8DAA8D;QACnE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,oBAAoB;IACpB;QACE,OAAO,EAAE,2BAA2B;QACpC,YAAY,EAAE,qBAAqB;QACnC,MAAM,EAAE,0CAA0C;QAClD,GAAG,EAAE,gEAAgE;QACrE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,6EAA6E;IAC7E;QACE,OAAO,EAAE,6DAA6D;QACtE,YAAY,EAAE,iBAAiB;QAC/B,MAAM,EACJ,yHAAyH;QAC3H,GAAG,EAAE,yFAAyF;QAC9F,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,yEAAyE;IACzE;QACE,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,iFAAiF;QACzF,GAAG,EAAE,0FAA0F;QAC/F,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,gEAAgE;IAChE;QACE,OAAO,EAAE,6BAA6B;QACtC,YAAY,EAAE,uBAAuB;QACrC,MAAM,EAAE,kFAAkF;QAC1F,GAAG,EAAE,0EAA0E;QAC/E,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,2DAA2D;IAC3D;QACE,OAAO,EAAE,6DAA6D;QACtE,YAAY,EAAE,mBAAmB;QACjC,MAAM,EAAE,iFAAiF;QACzF,GAAG,EAAE,yCAAyC;QAC9C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,oEAAoE;IACpE;QACE,OAAO,EAAE,yCAAyC;QAClD,YAAY,EAAE,qBAAqB;QACnC,MAAM,EAAE,iEAAiE;QACzE,GAAG,EAAE,kEAAkE;QACvE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,+DAA+D;IAC/D;QACE,OAAO,EAAE,4BAA4B;QACrC,YAAY,EAAE,qBAAqB;QACnC,MAAM,EAAE,yFAAyF;QACjG,GAAG,EAAE,uCAAuC;QAC5C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,oDAAoD;IACpD;QACE,OAAO,EAAE,qCAAqC;QAC9C,YAAY,EAAE,6BAA6B;QAC3C,MAAM,EACJ,uIAAuI;QACzI,GAAG,EAAE,gGAAgG;QACrG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IAED,yEAAyE;IAEzE,uDAAuD;IACvD;QACE,OAAO,EAAE,iBAAiB;QAC1B,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,wFAAwF;QAChG,GAAG,EAAE,8EAA8E;QACnF,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,4CAA4C;IAC5C;QACE,OAAO,EAAE,uBAAuB;QAChC,YAAY,EAAE,iBAAiB;QAC/B,MAAM,EACJ,iHAAiH;QACnH,GAAG,EAAE,qEAAqE;QAC1E,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,8CAA8C;IAC9C;QACE,OAAO,EAAE,oBAAoB;QAC7B,YAAY,EAAE,cAAc;QAC5B,MAAM,EACJ,6HAA6H;QAC/H,GAAG,EAAE,yEAAyE;QAC9E,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,kDAAkD;IAClD;QACE,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE,kBAAkB;QAChC,MAAM,EACJ,iIAAiI;QACnI,GAAG,EAAE,0EAA0E;QAC/E,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,8CAA8C;IAC9C;QACE,OAAO,EAAE,kBAAkB;QAC3B,YAAY,EAAE,aAAa;QAC3B,MAAM,EAAE,qFAAqF;QAC7F,GAAG,EAAE,qEAAqE;QAC1E,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,uDAAuD;IACvD;QACE,OAAO,EAAE,yBAAyB;QAClC,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,mFAAmF;QAC3F,GAAG,EAAE,2CAA2C;QAChD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,mCAAmC;IACnC;QACE,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,eAAe;QAC7B,MAAM,EAAE,mFAAmF;QAC3F,GAAG,EAAE,uDAAuD;QAC5D,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,mCAAmC;IACnC;QACE,OAAO,EAAE,mCAAmC;QAC5C,YAAY,EAAE,+BAA+B;QAC7C,MAAM,EACJ,iHAAiH;QACnH,GAAG,EAAE,mCAAmC;QACxC,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,6DAA6D;IAC7D;QACE,OAAO,EAAE,+DAA+D;QACxE,YAAY,EAAE,qBAAqB;QACnC,MAAM,EAAE,uGAAuG;QAC/G,GAAG,EAAE,oEAAoE;QACzE,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IAED,yEAAyE;IAEzE,mCAAmC;IACnC;QACE,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,qFAAqF;QAC7F,GAAG,EAAE,iDAAiD;QACtD,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD,2DAA2D;IAC3D;QACE,OAAO,EAAE,iCAAiC;QAC1C,YAAY,EAAE,sBAAsB;QACpC,MAAM,EACJ,kKAAkK;QACpK,GAAG,EAAE,wGAAwG;QAC7G,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD,gDAAgD;IAChD;QACE,OAAO,EAAE,oBAAoB;QAC7B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,0GAA0G;QAClH,GAAG,EAAE,4DAA4D;QACjE,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD,qDAAqD;IACrD;QACE,OAAO,EAAE,kEAAkE;QAC3E,YAAY,EAAE,sBAAsB;QACpC,MAAM,EAAE,0GAA0G;QAClH,GAAG,EAAE,sEAAsE;QAC3E,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IAED,yEAAyE;IAEzE,uEAAuE;IACvE;QACE,OAAO,EAAE,mBAAmB;QAC5B,YAAY,EAAE,UAAU;QACxB,MAAM,EAAE,8EAA8E;QACtF,GAAG,EAAE,+EAA+E;QACpF,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB;IACD,mEAAmE;IACnE;QACE,OAAO,EAAE,2CAA2C;QACpD,YAAY,EAAE,uBAAuB;QACrC,MAAM,EACJ,gIAAgI;QAClI,GAAG,EAAE,8GAA8G;QACnH,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB;IACD,iCAAiC;IACjC;QACE,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE,kBAAkB;QAChC,MAAM,EAAE,yFAAyF;QACjG,GAAG,EAAE,8CAA8C;QACnD,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB;IAED,yEAAyE;IAEzE,sDAAsD;IACtD;QACE,OAAO,EAAE,oCAAoC;QAC7C,YAAY,EAAE,eAAe;QAC7B,MAAM,EACJ,mJAAmJ;QACrJ,GAAG,EAAE,wFAAwF;QAC7F,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB;IACD,mDAAmD;IACnD;QACE,OAAO,EAAE,yBAAyB;QAClC,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,4EAA4E;QACpF,GAAG,EAAE,2CAA2C;QAChD,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB;IAED,yEAAyE;IAEzE,4DAA4D;IAC5D;QACE,OAAO,EAAE,2BAA2B;QACpC,YAAY,EAAE,qBAAqB;QACnC,MAAM,EAAE,6FAA6F;QACrG,GAAG,EAAE,kDAAkD;QACvD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,4DAA4D;IAC5D;QACE,OAAO,EAAE,qBAAqB;QAC9B,YAAY,EAAE,YAAY;QAC1B,MAAM,EAAE,yFAAyF;QACjG,GAAG,EAAE,gFAAgF;QACrF,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IAED,yEAAyE;IAEzE,qDAAqD;IACrD;QACE,OAAO,EAAE,kBAAkB;QAC3B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,oGAAoG;QAC5G,GAAG,EAAE,sDAAsD;QAC3D,SAAS,EAAE,CAAC,KAAK,CAAC;KACnB;IACD,oCAAoC;IACpC;QACE,OAAO,EAAE,iBAAiB;QAC1B,YAAY,EAAE,iBAAiB;QAC/B,MAAM,EAAE,0EAA0E;QAClF,GAAG,EAAE,iFAAiF;QACtF,SAAS,EAAE,CAAC,KAAK,CAAC;KACnB;IAED,yEAAyE;IAEzE,gDAAgD;IAChD;QACE,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,aAAa;QAC3B,MAAM,EAAE,wEAAwE;QAChF,GAAG,EAAE,oDAAoD;QACzD,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB;IAED,yEAAyE;IAEzE,oFAAoF;IACpF;QACE,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,2BAA2B;QACzC,MAAM,EAAE,kGAAkG;QAC1G,GAAG,EAAE,0EAA0E;QAC/E,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IAED,yEAAyE;IAEzE,8CAA8C;IAC9C;QACE,OAAO,EAAE,mBAAmB;QAC5B,YAAY,EAAE,UAAU;QACxB,MAAM,EAAE,kFAAkF;QAC1F,GAAG,EAAE,8CAA8C;QACnD,SAAS,EAAE,CAAC,OAAO,CAAC;KACrB;IAED,yEAAyE;IAEzE,8DAA8D;IAC9D;QACE,OAAO,EACL,4NAA4N;QAC9N,YAAY,EAAE,iCAAiC;QAC/C,MAAM,EACJ,0IAA0I;QAC5I,GAAG,EAAE,qLAAqL;QAC1L,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,6BAA6B;IAC7B;QACE,OAAO,EACL,qNAAqN;QACvN,YAAY,EAAE,oCAAoC;QAClD,MAAM,EACJ,gHAAgH;QAClH,GAAG,EAAE,wIAAwI;QAC7I,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC;AAEF,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,6BAA6B,GAK9B;IACH,mCAAmC;IACnC;QACE,MAAM,EAAE,wBAAwB;QAChC,YAAY,EAAE,2EAA2E;QACzF,MAAM,EACJ,yKAAyK;QAC3K,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,+BAA+B;IAC/B;QACE,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,6EAA6E;QAC3F,MAAM,EACJ,8IAA8I;QAChJ,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACxC;IACD,6BAA6B;IAC7B;QACE,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,oFAAoF;QAClG,MAAM,EACJ,qHAAqH;QACvH,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC;AAEF,+EAA+E;AAE/E,MAAM,UAAU,6BAA6B,CAAC,IAAY,EAAE,QAAgB;IAC1E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,mDAAmD;IACnD,KAAK,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE3C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,qBAAqB,EAAE,CAAC,YAAY,EAAE;gBAC7C,WAAW,EAAE,EAAE,CAAC,MAAM;gBACtB,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,EAAE,CAAC,GAAG;gBACtB,SAAS,EAAE,6CAA6C;gBACxD,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,KAAK,MAAM,EAAE,IAAI,6BAA6B,EAAE,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACzD,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,8DAA8D;oBACrE,WAAW,EAAE,EAAE,CAAC,MAAM;oBACtB,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;oBACpB,cAAc,EACZ,2GAA2G;oBAC7G,SAAS,EAAE,gDAAgD;oBAC3D,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,qBAAqB;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,iEAAiE;IACjE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEtB,4EAA4E;YAC5E,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACzD,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,6CAA6C;oBACpD,WAAW,EAAE,2FAA2F;oBACxG,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;oBACpB,cAAc,EAAE,6DAA6D;oBAC7E,SAAS,EAAE,6CAA6C;oBACxD,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,qBAAqB;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,0CAA0C;YAC1C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACzD,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,2CAA2C;oBAClD,WAAW,EAAE,8FAA8F;oBAC3G,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;oBACpB,cAAc,EAAE,8CAA8C;oBAC9D,SAAS,EAAE,6CAA6C;oBACxD,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,qBAAqB;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEtB,iEAAiE;YACjE,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACzD,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,yDAAyD;oBAChE,WAAW,EACT,oNAAoN;oBACtN,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;oBACpB,cAAc,EACZ,+GAA+G;oBACjH,SAAS,EAAE,iDAAiD;oBAC5D,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,qBAAqB;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"iac-security.d.ts","sourceRoot":"","sources":["../../src/evaluators/iac-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA4X5E"}
1
+ {"version":3,"file":"iac-security.d.ts","sourceRoot":"","sources":["../../src/evaluators/iac-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA0Y5E"}
@@ -103,7 +103,24 @@ export function analyzeIacSecurity(code, language) {
103
103
  });
104
104
  }
105
105
  // ── IAC-005: Overly permissive network rules ──────────────────────────
106
- const openNetLines = getLangLineNumbers(code, language, LP.IAC_OPEN_NETWORK);
106
+ const openNetLinesRaw = getLangLineNumbers(code, language, LP.IAC_OPEN_NETWORK);
107
+ // Filter out egress rules — allowing all outbound traffic (0.0.0.0/0)
108
+ // in egress blocks is standard practice and not a security concern.
109
+ const iacLines = code.split("\n");
110
+ const openNetLines = openNetLinesRaw.filter((ln) => {
111
+ // Look backwards from the flagged line for an enclosing egress block
112
+ for (let j = ln - 2; j >= 0 && j >= ln - 15; j--) {
113
+ const prev = iacLines[j]?.trim();
114
+ if (!prev)
115
+ continue;
116
+ if (/^egress\s*\{/i.test(prev) || prev === "egress {")
117
+ return false;
118
+ // Stop searching if we hit another block type
119
+ if (/^(?:ingress|resource|data)\s*[\s{("]/i.test(prev))
120
+ break;
121
+ }
122
+ return true;
123
+ });
107
124
  if (openNetLines.length > 0) {
108
125
  findings.push({
109
126
  ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
@@ -1 +1 @@
1
- {"version":3,"file":"iac-security.js","sourceRoot":"","sources":["../../src/evaluators/iac-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,kCAAkC;IAClC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErC,yEAAyE;IACzE,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACnF,yEAAyE;IACzE,oEAAoE;IACpE,yCAAyC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,4DAA4D;QAC5D,MAAM,QAAQ,GACZ,kJAAkJ,CAAC,IAAI,CACrJ,IAAI,CACL,CAAC;QACJ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;QACtE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,0CAA0C;YACjD,WAAW,EACT,qKAAqK;YACvK,WAAW,EAAE,WAAW;YACxB,cAAc,EACZ,mMAAmM;YACrM,SAAS,EAAE,mCAAmC;YAC9C,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,6GAA6G;gBAC/G,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,iHAAiH;oBACnH,CAAC,CAAC,mHAAmH;YAC3H,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACtF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,yKAAyK;YAC3K,WAAW,EAAE,eAAe;YAC5B,cAAc,EACZ,qKAAqK;YACvK,SAAS,EAAE,6CAA6C;YACxD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,uEAAuE;oBACzE,CAAC,CAAC,yEAAyE;YACjF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EACT,oLAAoL;YACtL,WAAW,EAAE,UAAU;YACvB,cAAc,EACZ,kHAAkH;YACpH,SAAS,EAAE,oDAAoD;YAC/D,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,qEAAqE;YAC7E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EACT,sJAAsJ;YACxJ,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EACZ,sJAAsJ;YACxJ,SAAS,EAAE,qDAAqD;YAChE,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,iFAAiF;YACzF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC7E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yDAAyD;YAChE,WAAW,EACT,2LAA2L;YAC7L,WAAW,EAAE,YAAY;YACzB,cAAc,EACZ,iKAAiK;YACnK,SAAS,EAAE,wCAAwC;YACnD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,sFAAsF;oBACxF,CAAC,CAAC,+DAA+D;YACvE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EACT,oLAAoL;YACtL,WAAW,EAAE,QAAQ;YACrB,cAAc,EACZ,yKAAyK;YAC3K,SAAS,EAAE,6CAA6C;YACxD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,wGAAwG;gBAC1G,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,mFAAmF;oBACrF,CAAC,CAAC,4DAA4D;YACpE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAChF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gCAAgC;YACvC,WAAW,EACT,gLAAgL;YAClL,WAAW,EAAE,YAAY;YACzB,cAAc,EACZ,6JAA6J;YAC/J,SAAS,EAAE,qCAAqC;YAChD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,uGAAuG;oBACzG,CAAC,CAAC,+FAA+F;YACvG,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACpF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,kLAAkL;YACpL,WAAW,EAAE,aAAa;YAC1B,cAAc,EACZ,2LAA2L;YAC7L,SAAS,EAAE,sCAAsC;YACjD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,wGAAwG;gBAC1G,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,+GAA+G;oBACjH,CAAC,CAAC,gGAAgG;YACxG,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACzF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EACT,uJAAuJ;YACzJ,WAAW,EAAE,oBAAoB;YACjC,cAAc,EACZ,qHAAqH;YACvH,SAAS,EAAE,6CAA6C;YACxD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,gEAAgE;gBAClE,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,6BAA6B;oBAC/B,CAAC,CAAC,+BAA+B;YACvC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAC9E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EACT,yJAAyJ;YAC3J,WAAW,EAAE,WAAW;YACxB,cAAc,EACZ,uJAAuJ;YACzJ,SAAS,EAAE,kCAAkC;YAC7C,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,8EAA8E;oBAChF,CAAC,CAAC,mEAAmE;YAC3E,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,sFAAsF;QACtF,uEAAuE;QACvE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,sEAAsE,CAAC,CAAC;QACnH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,sCAAsC;gBAC7C,WAAW,EACT,mIAAmI;gBACrI,cAAc,EACZ,4KAA4K;gBAC9K,SAAS,EAAE,uCAAuC;gBAClD,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/D,IAAI,WAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,kCAAkC;gBACzC,WAAW,EACT,yJAAyJ;gBAC3J,WAAW,EAAE,aAAa;gBAC1B,cAAc,EACZ,8GAA8G;gBAChH,SAAS,EAAE,wDAAwD;gBACnE,YAAY,EACV,2GAA2G;gBAC7G,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EACT,6HAA6H;gBAC/H,WAAW,EAAE,cAAc;gBAC3B,cAAc,EACZ,uHAAuH;gBACzH,SAAS,EAAE,wCAAwC;gBACnD,YAAY,EACV,4IAA4I;gBAC9I,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxF,0EAA0E;gBAC1E,uEAAuE;gBACvE,0DAA0D;gBAC1D,IAAI,0FAA0F,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1G,SAAS;gBACX,CAAC;gBACD,4CAA4C;gBAC5C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACzD,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,iDAAiD;wBACxD,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,2KAA2K;wBAClN,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;wBACpB,cAAc,EAAE,4EAA4E;wBAC5F,SAAS,EAAE,yCAAyC;wBACpD,YAAY,EAAE,2EAA2E,IAAI,CAAC,IAAI,EAAE,KAAK;wBACzG,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,oFAAoF;QACpF,MAAM,kBAAkB,GACtB,uGAAuG,CAAC;QAC1G,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC/C,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACvD,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,iDAAiD;gBACxD,WAAW,EACT,0KAA0K;gBAC5K,WAAW,EAAE,QAAQ;gBACrB,cAAc,EACZ,+IAA+I;gBACjJ,SAAS,EAAE,gDAAgD;gBAC3D,YAAY,EACV,8IAA8I;gBAChJ,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
1
+ {"version":3,"file":"iac-security.js","sourceRoot":"","sources":["../../src/evaluators/iac-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,kCAAkC;IAClC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErC,yEAAyE;IACzE,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACnF,yEAAyE;IACzE,oEAAoE;IACpE,yCAAyC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,4DAA4D;QAC5D,MAAM,QAAQ,GACZ,kJAAkJ,CAAC,IAAI,CACrJ,IAAI,CACL,CAAC;QACJ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;QACtE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,0CAA0C;YACjD,WAAW,EACT,qKAAqK;YACvK,WAAW,EAAE,WAAW;YACxB,cAAc,EACZ,mMAAmM;YACrM,SAAS,EAAE,mCAAmC;YAC9C,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,6GAA6G;gBAC/G,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,iHAAiH;oBACnH,CAAC,CAAC,mHAAmH;YAC3H,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACtF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,yKAAyK;YAC3K,WAAW,EAAE,eAAe;YAC5B,cAAc,EACZ,qKAAqK;YACvK,SAAS,EAAE,6CAA6C;YACxD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,uEAAuE;oBACzE,CAAC,CAAC,yEAAyE;YACjF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EACT,oLAAoL;YACtL,WAAW,EAAE,UAAU;YACvB,cAAc,EACZ,kHAAkH;YACpH,SAAS,EAAE,oDAAoD;YAC/D,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,qEAAqE;YAC7E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EACT,sJAAsJ;YACxJ,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EACZ,sJAAsJ;YACxJ,SAAS,EAAE,qDAAqD;YAChE,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,iFAAiF;YACzF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAChF,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACjD,qEAAqE;QACrE,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YACpE,8CAA8C;YAC9C,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yDAAyD;YAChE,WAAW,EACT,2LAA2L;YAC7L,WAAW,EAAE,YAAY;YACzB,cAAc,EACZ,iKAAiK;YACnK,SAAS,EAAE,wCAAwC;YACnD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,sFAAsF;oBACxF,CAAC,CAAC,+DAA+D;YACvE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EACT,oLAAoL;YACtL,WAAW,EAAE,QAAQ;YACrB,cAAc,EACZ,yKAAyK;YAC3K,SAAS,EAAE,6CAA6C;YACxD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,wGAAwG;gBAC1G,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,mFAAmF;oBACrF,CAAC,CAAC,4DAA4D;YACpE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAChF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gCAAgC;YACvC,WAAW,EACT,gLAAgL;YAClL,WAAW,EAAE,YAAY;YACzB,cAAc,EACZ,6JAA6J;YAC/J,SAAS,EAAE,qCAAqC;YAChD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,uGAAuG;oBACzG,CAAC,CAAC,+FAA+F;YACvG,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACpF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,kLAAkL;YACpL,WAAW,EAAE,aAAa;YAC1B,cAAc,EACZ,2LAA2L;YAC7L,SAAS,EAAE,sCAAsC;YACjD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,wGAAwG;gBAC1G,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,+GAA+G;oBACjH,CAAC,CAAC,gGAAgG;YACxG,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACzF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EACT,uJAAuJ;YACzJ,WAAW,EAAE,oBAAoB;YACjC,cAAc,EACZ,qHAAqH;YACvH,SAAS,EAAE,6CAA6C;YACxD,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,gEAAgE;gBAClE,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,6BAA6B;oBAC/B,CAAC,CAAC,+BAA+B;YACvC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAC9E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EACT,yJAAyJ;YAC3J,WAAW,EAAE,WAAW;YACxB,cAAc,EACZ,uJAAuJ;YACzJ,SAAS,EAAE,kCAAkC;YAC7C,YAAY,EACV,IAAI,KAAK,WAAW;gBAClB,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAC,8EAA8E;oBAChF,CAAC,CAAC,mEAAmE;YAC3E,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,sFAAsF;QACtF,uEAAuE;QACvE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,sEAAsE,CAAC,CAAC;QACnH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,sCAAsC;gBAC7C,WAAW,EACT,mIAAmI;gBACrI,cAAc,EACZ,4KAA4K;gBAC9K,SAAS,EAAE,uCAAuC;gBAClD,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/D,IAAI,WAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,kCAAkC;gBACzC,WAAW,EACT,yJAAyJ;gBAC3J,WAAW,EAAE,aAAa;gBAC1B,cAAc,EACZ,8GAA8G;gBAChH,SAAS,EAAE,wDAAwD;gBACnE,YAAY,EACV,2GAA2G;gBAC7G,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EACT,6HAA6H;gBAC/H,WAAW,EAAE,cAAc;gBAC3B,cAAc,EACZ,uHAAuH;gBACzH,SAAS,EAAE,wCAAwC;gBACnD,YAAY,EACV,4IAA4I;gBAC9I,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxF,0EAA0E;gBAC1E,uEAAuE;gBACvE,0DAA0D;gBAC1D,IAAI,0FAA0F,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1G,SAAS;gBACX,CAAC;gBACD,4CAA4C;gBAC5C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACzD,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,iDAAiD;wBACxD,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,2KAA2K;wBAClN,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;wBACpB,cAAc,EAAE,4EAA4E;wBAC5F,SAAS,EAAE,yCAAyC;wBACpD,YAAY,EAAE,2EAA2E,IAAI,CAAC,IAAI,EAAE,KAAK;wBACzG,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,oFAAoF;QACpF,MAAM,kBAAkB,GACtB,uGAAuG,CAAC;QAC1G,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC/C,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACvD,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,iDAAiD;gBACxD,WAAW,EACT,0KAA0K;gBAC5K,WAAW,EAAE,QAAQ;gBACrB,cAAc,EACZ,+IAA+I;gBACjJ,SAAS,EAAE,gDAAgD;gBAC3D,YAAY,EACV,8IAA8I;gBAChJ,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evaluators/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EACX,OAAO,EAGP,kBAAkB,EAClB,YAAY,EAEZ,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,iBAAiB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAKzD,OAAO,EAKL,uBAAuB,EACvB,0BAA0B,EAK3B,MAAM,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,mBAAmB,CAAC;AAUhF,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAAC;IACzC,wFAAwF;IACxF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,sFAAsF;IACtF,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B;AAQD,iFAAiF;AACjF,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAoSD;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA0DrG;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAEpF;AAqBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,eAAe,CA6EjB;AA+BD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,eAAe,CA2JjB;AAMD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,cAAc,CAIhB;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,WAAW,CAqBb;AAGD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,EAAE,qBAAqB,IAAI,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAKnF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,GACnD,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAE3C;AAID,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evaluators/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EACX,OAAO,EAGP,kBAAkB,EAClB,YAAY,EAEZ,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,iBAAiB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAKzD,OAAO,EAKL,uBAAuB,EACvB,0BAA0B,EAK3B,MAAM,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,mBAAmB,CAAC;AAYhF,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAAC;IACzC,wFAAwF;IACxF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,sFAAsF;IACtF,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B;AAQD,iFAAiF;AACjF,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAoSD;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA0DrG;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAEpF;AAqBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,eAAe,CA6EjB;AA+BD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,eAAe,CAoKjB;AAMD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,cAAc,CAIhB;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,WAAW,CAqBb;AAGD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,EAAE,qBAAqB,IAAI,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAKnF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,GACnD,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAE3C;AAID,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
@@ -14,6 +14,8 @@ import { enrichWithPatches } from "../patches/index.js";
14
14
  import { crossEvaluatorDedup, severityRank } from "../dedup.js";
15
15
  import { filterFalsePositiveHeuristics } from "./false-positive-review.js";
16
16
  import { calibrateFindings, loadCalibrationProfile } from "../calibration.js";
17
+ import { applyAutoTune } from "../auto-tune.js";
18
+ import { loadFeedbackStore } from "../commands/feedback.js";
17
19
  // ── AST-aware post-processing ───────────────────────────────────────────────
18
20
  // ── Module-level caches for AST/taint results ───────────────────────────────
19
21
  const astStructureCache = new LRUCache(256);
@@ -513,16 +515,26 @@ export function evaluateWithTribunal(code, language, context, options) {
513
515
  const dedupedFindings = crossEvaluatorDedup(rawFindings);
514
516
  const { filtered: fpFiltered } = filterFalsePositiveHeuristics(dedupedFindings, code, language, enrichedOptions?.filePath);
515
517
  const configFiltered = applyConfig(fpFiltered, options?.config);
516
- // ── Feedback-driven confidence calibration ──
517
- // When options.calibrate is set, load the feedback store and adjust
518
- // confidence scores based on historical FP rates.
518
+ // ── Feedback-driven confidence calibration & auto-tuning ──
519
+ // When options.calibrate is set, load the feedback store and apply:
520
+ // 1. Auto-suppression of rules with FP rate ≥ 80%
521
+ // 2. Severity downgrade for rules with FP rate 50-80%
522
+ // 3. Confidence calibration based on historical FP rates
519
523
  let calibrated = configFiltered;
520
524
  if (enrichedOptions.calibrate) {
521
525
  try {
522
526
  const calOpts = typeof enrichedOptions.calibrate === "object" ? enrichedOptions.calibrate : undefined;
523
- const profile = loadCalibrationProfile(calOpts);
524
- if (profile.isActive) {
525
- calibrated = calibrateFindings(calibrated, profile, calOpts);
527
+ const feedbackStore = loadFeedbackStore(calOpts?.feedbackPath);
528
+ if (feedbackStore.entries.length > 0) {
529
+ const tuned = applyAutoTune(calibrated, feedbackStore);
530
+ calibrated = tuned.findings;
531
+ }
532
+ else {
533
+ // No feedback data — try plain calibration profile
534
+ const profile = loadCalibrationProfile(calOpts);
535
+ if (profile.isActive) {
536
+ calibrated = calibrateFindings(calibrated, profile, calOpts);
537
+ }
526
538
  }
527
539
  }
528
540
  catch {