@khoavu882/doflow 0.0.0-stage → 2.0.0-beta.3

package/core/shared/skills/do-code-review/expected_outputs/sample_json_clean_quality.json

@@ -0,0 +1,33 @@
+{
+  "file": "assets/sample_json_clean.json",
+  "language": "json",
+  "analysis_kind": "declarative",
+  "metrics": {
+    "lines": {
+      "total": 8,
+      "code": 7,
+      "blank": 1,
+      "comment": 0
+    },
+    "max_depth": 2,
+    "parses": true
+  },
+  "smells": [],
+  "solid_violations": [],
+  "quality_score": 100,
+  "grade": "A",
+  "policy": {
+    "tiers": [
+      "built-in",
+      "review-policy.json"
+    ],
+    "thresholds": {
+      "long_function_lines": 50,
+      "too_many_parameters": 5,
+      "high_complexity": 10,
+      "god_class_methods": 20,
+      "max_imports": 15,
+      "max_declarative_depth": 8
+    }
+  }
+}

package/core/shared/skills/do-code-review/expected_outputs/sample_markdown_clean_quality.json

@@ -0,0 +1 @@
+[]

package/core/shared/skills/do-code-review/expected_outputs/sample_markdown_smells_quality.json

@@ -0,0 +1,16 @@
+[
+  {
+    "file": "assets/sample_markdown_smells.md",
+    "line": 21,
+    "rule": "dangling_reference",
+    "severity": "high",
+    "message": "'references/does-not-exist.md' does not resolve to a real file relative to assets or ../../guidance."
+  },
+  {
+    "file": "assets/sample_markdown_smells.md",
+    "line": 24,
+    "rule": "staleness_marker",
+    "severity": "low",
+    "message": "Possible staleness marker 'deprecated' \u2014 confirm this prose actually asserts the surrounding content is outdated, not a rule/instruction quoting the word as a detection target."
+  }
+]

package/core/shared/skills/do-code-review/expected_outputs/sample_shell_heredoc_quality.json

@@ -0,0 +1,54 @@
+{
+  "file": "assets/sample_shell_heredoc.sh",
+  "language": "shell",
+  "metrics": {
+    "lines": {
+      "total": 39,
+      "code": 28,
+      "blank": 5,
+      "comment": 6
+    },
+    "functions": 3,
+    "classes": 0,
+    "avg_complexity": 3.0
+  },
+  "quality_score": 100,
+  "grade": "A",
+  "smells": [],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "usage",
+      "parameters": 1,
+      "lines": 8,
+      "complexity": 1
+    },
+    {
+      "name": "emit",
+      "parameters": 1,
+      "lines": 10,
+      "complexity": 4
+    },
+    {
+      "name": "unterminated",
+      "parameters": 1,
+      "lines": 10,
+      "complexity": 4
+    }
+  ],
+  "class_details": [],
+  "policy": {
+    "tiers": [
+      "built-in",
+      "review-policy.json"
+    ],
+    "thresholds": {
+      "long_function_lines": 50,
+      "too_many_parameters": 5,
+      "high_complexity": 10,
+      "god_class_methods": 20,
+      "max_imports": 15,
+      "max_declarative_depth": 8
+    }
+  }
+}

package/core/shared/skills/do-code-review/expected_outputs/sample_shell_smells_quality.json

@@ -0,0 +1,91 @@
+{
+  "file": "assets/sample_shell_smells.sh",
+  "language": "shell",
+  "metrics": {
+    "lines": {
+      "total": 16,
+      "code": 10,
+      "blank": 4,
+      "comment": 2
+    },
+    "functions": 2,
+    "classes": 0,
+    "avg_complexity": 1.0
+  },
+  "quality_score": 50,
+  "grade": "F",
+  "smells": [
+    {
+      "type": "no_error_handling",
+      "severity": "high",
+      "message": "Script has no 'set -e'/'set -u'/'set -o pipefail' \u2014 a failing command is silently ignored and the script continues with bad state",
+      "location": "line 1"
+    },
+    {
+      "type": "unquoted_expansion",
+      "severity": "high",
+      "message": "Unquoted variable expansion in a command that acts on paths \u2014 a value containing spaces or globs will not do what it looks like",
+      "location": "line 5"
+    },
+    {
+      "type": "unchecked_cd",
+      "severity": "medium",
+      "message": "'cd' without '|| exit' or 'set -e' \u2014 the rest of the script runs in the wrong directory if it fails",
+      "location": "line 5"
+    },
+    {
+      "type": "unquoted_expansion",
+      "severity": "high",
+      "message": "Unquoted variable expansion in a command that acts on paths \u2014 a value containing spaces or globs will not do what it looks like",
+      "location": "line 6"
+    },
+    {
+      "type": "unquoted_expansion",
+      "severity": "high",
+      "message": "Unquoted variable expansion in a command that acts on paths \u2014 a value containing spaces or globs will not do what it looks like",
+      "location": "line 7"
+    },
+    {
+      "type": "unchecked_cd",
+      "severity": "medium",
+      "message": "'cd' without '|| exit' or 'set -e' \u2014 the rest of the script runs in the wrong directory if it fails",
+      "location": "line 11"
+    },
+    {
+      "type": "unquoted_expansion",
+      "severity": "high",
+      "message": "Unquoted variable expansion in a command that acts on paths \u2014 a value containing spaces or globs will not do what it looks like",
+      "location": "line 12"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "deploy_release",
+      "parameters": 1,
+      "lines": 5,
+      "complexity": 1
+    },
+    {
+      "name": "rollback",
+      "parameters": 0,
+      "lines": 6,
+      "complexity": 1
+    }
+  ],
+  "class_details": [],
+  "policy": {
+    "tiers": [
+      "built-in",
+      "review-policy.json"
+    ],
+    "thresholds": {
+      "long_function_lines": 50,
+      "too_many_parameters": 5,
+      "high_complexity": 10,
+      "god_class_methods": 20,
+      "max_imports": 15,
+      "max_declarative_depth": 8
+    }
+  }
+}

package/core/shared/skills/do-code-review/expected_outputs/sample_typescript_strings_quality.json

@@ -0,0 +1,60 @@
+{
+  "file": "assets/sample_typescript_strings.ts",
+  "language": "typescript",
+  "metrics": {
+    "lines": {
+      "total": 37,
+      "code": 24,
+      "blank": 6,
+      "comment": 7
+    },
+    "functions": 4,
+    "classes": 0,
+    "avg_complexity": 1.5
+  },
+  "quality_score": 100,
+  "grade": "A",
+  "smells": [],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "has",
+      "parameters": 0,
+      "lines": 4,
+      "complexity": 1
+    },
+    {
+      "name": "describeOutcome",
+      "parameters": 0,
+      "lines": 16,
+      "complexity": 2
+    },
+    {
+      "name": "the",
+      "parameters": 0,
+      "lines": 9,
+      "complexity": 1
+    },
+    {
+      "name": "pick",
+      "parameters": 0,
+      "lines": 4,
+      "complexity": 2
+    }
+  ],
+  "class_details": [],
+  "policy": {
+    "tiers": [
+      "built-in",
+      "review-policy.json"
+    ],
+    "thresholds": {
+      "long_function_lines": 50,
+      "too_many_parameters": 5,
+      "high_complexity": 10,
+      "god_class_methods": 20,
+      "max_imports": 15,
+      "max_declarative_depth": 8
+    }
+  }
+}

package/core/shared/skills/do-code-review/expected_outputs/sample_yaml_smells_quality.json

@@ -0,0 +1,46 @@
+{
+  "file": "assets/sample_yaml_smells.yaml",
+  "language": "yaml",
+  "analysis_kind": "declarative",
+  "metrics": {
+    "lines": {
+      "total": 7,
+      "code": 6,
+      "blank": 1,
+      "comment": 0
+    },
+    "max_depth": 2,
+    "parses": true
+  },
+  "smells": [
+    {
+      "type": "duplicate_key",
+      "severity": "high",
+      "message": "Key 'name' is defined twice at the same level \u2014 the later value silently wins (first seen at line 2)",
+      "location": "line 3"
+    },
+    {
+      "type": "plaintext_secret",
+      "severity": "high",
+      "message": "A credential-shaped key carries a literal value \u2014 secrets belong in a secret store, not in a committed config file",
+      "location": "line 5"
+    }
+  ],
+  "solid_violations": [],
+  "quality_score": 70,
+  "grade": "C",
+  "policy": {
+    "tiers": [
+      "built-in",
+      "review-policy.json"
+    ],
+    "thresholds": {
+      "long_function_lines": 50,
+      "too_many_parameters": 5,
+      "high_complexity": 10,
+      "god_class_methods": 20,
+      "max_imports": 15,
+      "max_declarative_depth": 8
+    }
+  }
+}

package/core/shared/skills/do-code-review/languages/c.md

@@ -0,0 +1,103 @@
+---
+language: c
+extensions: [".c", ".h"]
+---
+
+# C — Language-Specific Review Notes
+
+Load this file alongside `rules/universal.md`. Universal rules are not repeated here — only C-specific rules and idioms.
+
+---
+
+## PR Analyzer — C Risk Signals
+
+- `printf` / debug `fprintf(stderr, ...)` statements left in production code
+- `// TODO` / `// FIXME` comments near memory management code — high risk
+- Disabled compiler warnings (`#pragma GCC diagnostic ignore`, `-w` flags in Makefile)
+- Hardcoded credentials or keys in source
+- Use of banned functions: `gets`, `strcpy`, `strcat`, `sprintf`, `scanf` without width limits
+
+---
+
+## Code Quality — C Checks
+
+- Functions longer than 50 lines — C functions tend to grow organically and become hard to reason about
+- Missing `NULL` check after `malloc` / `calloc` / `realloc`
+- Return value of functions ignored without explicit `(void)` cast
+- Global mutable state used across translation units without clear ownership
+- Magic numbers without `#define` or `const` — especially sizes and offsets
+- Mixed `malloc`/`free` ownership — unclear which caller is responsible for freeing
+
+---
+
+## Security
+
+- Flag `gets()` — no bounds checking, always a buffer overflow; replace with `fgets()`
+- Flag `strcpy()` / `strcat()` — use `strncpy()` / `strncat()` with explicit size, or `strlcpy()` / `strlcat()`
+- Flag `sprintf()` — use `snprintf()` with explicit buffer size
+- Flag `scanf("%s", buf)` without a width specifier — unbounded read
+- Flag `strlen()` result used as a signed integer — potential truncation on 64-bit
+- Flag user-controlled data used as a format string (`printf(user_input)`) — format string attack
+- Flag integer arithmetic used as array index without bounds check
+- Flag signed integer overflow — undefined behavior in C
+
+---
+
+## Async / Concurrency
+
+- Flag shared global or `static` variables accessed from multiple threads without a mutex or `_Atomic`
+- Flag `pthread_mutex_t` / `sem_t` not initialized before use
+- Flag signal handlers that call non-async-signal-safe functions (`malloc`, `printf`, etc.)
+- Flag `volatile` used as a substitute for proper synchronization — it is not sufficient
+- Flag lock acquisition order inconsistency across call sites — deadlock risk
+
+---
+
+## Resource Management
+
+- Flag every `malloc` / `calloc` / `realloc` path — verify a matching `free` exists on all exit paths
+- Flag `fopen` without a matching `fclose` on all paths including error paths
+- Flag `dup` / `socket` / `open` file descriptors not closed on all paths
+- Flag stack-allocated VLAs (variable-length arrays) of unbounded size — stack overflow risk
+- Flag `realloc` return value assigned directly to the source pointer — leaks on failure
+
+---
+
+## Exception Handling
+
+- Flag ignored return values from `malloc`, `fopen`, `read`, `write`, `close` — all can fail
+- Flag `errno` checked after a function that doesn't set it, or not checked immediately after one that does
+- Flag `perror` / `strerror` as the sole error handling in library code — propagate errors to callers
+- Flag functions that return `-1` on error without documenting which `errno` values are possible
+- Flag `assert()` used for runtime error handling — disabled by `NDEBUG` in production builds
+
+---
+
+## Performance
+
+- Flag `strlen()` called repeatedly on the same string in a loop — cache the result
+- Flag unnecessary copies of large structs passed by value — pass by pointer
+- Flag `memcpy` / `memset` on overlapping regions — use `memmove` for overlapping
+- Flag repeated heap allocations in a tight loop — consider a pool or stack allocation
+- Flag `volatile` on variables not accessed by hardware or signal handlers — prevents optimization
+
+---
+
+## Idioms and Best Practices
+
+### Memory Safety
+- Every pointer must have a clear owner responsible for freeing it — document ownership in comments
+- Set pointers to `NULL` immediately after `free` to catch use-after-free early
+- Prefer `calloc` over `malloc` + `memset` for zero-initialized allocations
+- Use `const` on pointer parameters that the function does not modify
+
+### Defensive Coding
+- Always check `NULL` returns from allocation functions
+- Use `size_t` for sizes and counts — never `int`
+- Prefer `snprintf` and `fgets` over any unbounded string function
+- Compile with `-Wall -Wextra -Werror` and treat warnings as errors
+
+### Portability
+- Do not assume pointer size equals `int` size — use `intptr_t` / `uintptr_t`
+- Do not rely on undefined behavior for performance — use compiler intrinsics instead
+- Use `stdint.h` types (`uint32_t`, `int64_t`) for fixed-width requirements

package/core/shared/skills/do-code-review/languages/cpp.md

@@ -0,0 +1,103 @@
+---
+language: cpp
+extensions: [".cpp", ".cc", ".cxx", ".hpp", ".hh", ".hxx"]
+---
+
+# C++ — Language-Specific Review Notes
+
+Load this file alongside `rules/universal.md`. Universal rules are not repeated here — only C++-specific rules and idioms.
+
+---
+
+## PR Analyzer — C++ Risk Signals
+
+- Raw `new` / `delete` outside of smart pointer wrappers
+- `reinterpret_cast` — almost always a red flag; require justification
+- Disabled compiler warnings (`#pragma warning(disable:...)`, `-w`)
+- `// TODO` / `// FIXME` near ownership or lifetime code
+- Hardcoded credentials or keys in source
+- Use of deprecated C-style functions: `strcpy`, `sprintf`, `gets`
+
+---
+
+## Code Quality — C++ Checks
+
+- Raw owning pointers (`T*`) used where `unique_ptr` / `shared_ptr` would express ownership
+- `shared_ptr` overused where `unique_ptr` suffices — implies shared ownership unnecessarily
+- `std::endl` used in hot paths — flushes the buffer every call; prefer `'\n'`
+- Implicit conversions between signed and unsigned integers
+- Virtual destructor missing on base classes with virtual methods
+- `catch (...)` swallowing all exceptions without logging or re-throwing
+
+---
+
+## Security
+
+- Flag `reinterpret_cast` on user-controlled data — potential type confusion
+- Flag raw array indexing without bounds check — use `.at()` or assert bounds
+- Flag `std::string` data passed to C APIs without null-termination guarantee — use `.c_str()`
+- Flag hardcoded buffer sizes — derive from `sizeof` or use `std::array<T, N>`
+- Flag `sscanf` / `sprintf` — use `std::istringstream` or `std::format` (C++20)
+- Flag user-controlled data used as a format string
+
+---
+
+## Async / Concurrency
+
+- Flag `std::shared_ptr` accessed from multiple threads — the pointer itself is not thread-safe for write; use `std::atomic<std::shared_ptr<T>>` (C++20) or external locking
+- Flag `std::vector` / `std::map` mutated from multiple threads without a mutex
+- Flag `std::mutex` locked twice in the same thread without `std::recursive_mutex` — deadlock
+- Flag detached threads (`std::thread::detach`) with no lifetime coordination
+- Flag `volatile` used instead of `std::atomic` for inter-thread communication
+
+---
+
+## Resource Management
+
+- Flag raw `new` returning an owning pointer — wrap immediately in `std::make_unique` or `std::make_shared`
+- Flag `delete` called manually outside of a destructor or smart pointer — ownership confusion
+- Flag RAII violations — resources acquired in constructor but not released via destructor
+- Flag `std::ifstream` / `std::ofstream` not checked for open failure before use
+- Flag exceptions thrown from destructors — causes `std::terminate` if thrown during stack unwinding
+
+---
+
+## Exception Handling
+
+- Flag `catch (...)` that swallows exceptions without logging or re-throwing
+- Flag exceptions thrown from destructors — wrap in `try/catch` inside the destructor
+- Flag `noexcept` on functions that can actually throw — causes `std::terminate`
+- Flag exception specifications (`throw(...)`) — deprecated since C++11, removed in C++17
+- Flag using exceptions for control flow in performance-critical paths
+
+---
+
+## Performance
+
+- Flag pass-by-value for non-trivial types where pass-by-const-reference suffices
+- Flag `std::vector::push_back` in a loop without `reserve` when size is known — repeated reallocations
+- Flag `std::map` used where `std::unordered_map` would give O(1) lookup
+- Flag `std::endl` in loops — prefer `'\n'` to avoid repeated buffer flushes
+- Flag unnecessary copies from missing `std::move` on local temporaries being returned or passed
+
+---
+
+## Idioms and Best Practices
+
+### Ownership and Lifetime
+- Prefer `std::unique_ptr` for sole ownership, `std::shared_ptr` only for shared ownership
+- Prefer `std::make_unique` / `std::make_shared` over `new` — exception-safe
+- Use `std::weak_ptr` to break `shared_ptr` cycles
+- Never use raw owning pointers in new code — they are for non-owning observation only
+
+### Modern C++ (17/20)
+- Prefer `std::optional<T>` over sentinel values or nullable pointers for optional returns
+- Prefer `std::variant` over tagged unions
+- Prefer `std::string_view` over `const std::string&` for read-only string parameters
+- Prefer range-based `for` loops over index loops where the index isn't needed
+- Prefer `if constexpr` over `#ifdef` for compile-time branching
+
+### Type Safety
+- Prefer `static_cast` over C-style casts — explicit and auditable
+- Avoid `reinterpret_cast` except in low-level I/O or FFI code with a comment
+- Use `enum class` over plain `enum` to avoid implicit integer conversions

package/core/shared/skills/do-code-review/languages/csharp.md

@@ -0,0 +1,97 @@
+---
+language: csharp
+extensions: [".cs", ".csx", ".razor", ".cshtml"]
+---
+
+# C# / .NET — Language-Specific Review Notes
+
+Load this file alongside `rules/universal.md`. Universal rules are not repeated here — only C#-specific rules and idioms.
+
+---
+
+## PR Analyzer — C# Risk Signals
+
+- `#pragma warning disable` and `[SuppressMessage]` — verify they are justified
+- `unsafe { }` blocks — require explicit sign-off
+- Null-forgiving operator (`!`) used broadly without justification
+- `dynamic` used outside of interop scenarios
+- Hardcoded connection strings in source files
+
+---
+
+## Code Quality — C# Checks
+
+- `async void` methods (except event handlers)
+- `Task` returned but not awaited
+- `IDisposable` objects not in `using` / `using var`
+- Bare `catch { }` or `catch (Exception e) { }` swallowing silently
+- Nullable reference types feature disabled at project level
+
+---
+
+## Security
+
+- Flag raw string interpolation in SQL queries — require parameterized queries (`SqlCommand`) or EF Core
+- Flag missing `[ValidateAntiForgeryToken]` on state-changing controller actions
+- Flag user-controlled data passed to `Process.Start()` or `File` APIs without validation
+- Flag hardcoded connection strings — require `appsettings.json` + secrets management
+- Flag `[AllowAnonymous]` on endpoints that should be protected
+
+---
+
+## Async / Await
+
+- Flag `async void` methods outside of event handlers — cannot be awaited and swallow exceptions
+- Flag `.Result`, `.Wait()`, or `.GetAwaiter().GetResult()` on `Task` — causes deadlocks in ASP.NET contexts
+- Flag missing `ConfigureAwait(false)` in library (non-application) code
+- Flag `Task.Run()` wrapping synchronous code inside ASP.NET request handlers unnecessarily
+- Flag `CancellationToken` not threaded through to downstream async calls
+
+---
+
+## Resource Management
+
+- Flag `IDisposable` objects (`SqlConnection`, `HttpClient`, `FileStream`, etc.) not wrapped in `using` / `using var`
+- Flag `HttpClient` instantiated with `new` inside a method — use `IHttpClientFactory` or a shared static instance to avoid socket exhaustion
+- Flag `DbContext` registered as a singleton in DI — it must be scoped
+- Flag `MemoryStream` / `MemoryCache` growing unboundedly without eviction policy
+
+---
+
+## Exception Handling
+
+- Flag `catch { }` or `catch (Exception) { }` with no logging or re-throw — silent swallow
+- Flag `catch (Exception e) { throw e; }` — resets the stack trace; use `throw;` instead
+- Flag catching `Exception` when a specific type (`IOException`, `HttpRequestException`) is appropriate
+- Flag exception filters (`when`) used for side effects that suppress the exception
+- Flag exceptions used for control flow in hot paths — use `Try*` pattern methods instead
+
+---
+
+## Performance
+
+- Flag `.ToList()` / `.ToArray()` on `IQueryable` before filtering — forces all rows into memory; filter server-side first
+- Flag `string` concatenation in loops — use `StringBuilder`
+- Flag `Enumerable.Count()` on `IQueryable` when only an existence check is needed — use `Any()`
+- Flag `await` in a loop where `Task.WhenAll()` would parallelize the work
+- Flag synchronous file or network I/O in an `async` method — use the async overload
+
+---
+
+## Idioms and Best Practices
+
+### Null Safety
+- Ensure `<Nullable>enable</Nullable>` is set in the project file
+- Flag excessive use of `!` (null-forgiving) without a comment explaining why
+- Prefer `is null` / `is not null` over `== null` for null checks
+
+### LINQ
+- Flag `First()` where `FirstOrDefault()` is safer
+- Flag complex LINQ chains that would be clearer as explicit loops
+
+### Modern C# (10+)
+- Prefer `record` types for immutable data carriers
+- Prefer `switch` expressions over `switch` statements where a value is returned
+- Prefer primary constructors (C# 12) for simple dependency injection
+- Prefer file-scoped namespaces (`namespace Foo;`) over block-scoped
+- Prefer `is` pattern matching over explicit casts