@mocoto/mahoraga 0.14.1 → 0.14.3

package/dist/analysts/php/detectors/detector-php-security.js

@@ -10,7 +10,7 @@ function detectSecurityIssues(src, relPath) {
     // Loose comparison (== vs ===) in security-sensitive contexts
     for (const match of scan.matchAll(/(?:if|elseif|while)\s*\([^)]*==[^=][^)]*\)/gi)) {
         const line = lineOf(match.index);
-        const snippet = scan.slice(Math.max(0, (match.index ?? 0) - 40), (match.index ?? 0) + 120);
+        const snippet = scan.slice(Math.max(0, match.index - 40), match.index + 120);
         if (/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)/.test(snippet) || /password|senha|token|auth|login/i.test(snippet)) {
             ocorrencias.push({
                 relPath,
@@ -37,7 +37,7 @@ function detectSecurityIssues(src, relPath) {
     // XSS: echo/print with user input without htmlspecialchars
     for (const match of scan.matchAll(/(?:echo|print)\s+.*\$(?:_GET|_POST|_REQUEST|_COOKIE|_SERVER)/gi)) {
         const line = lineOf(match.index);
-        const before = scan.slice(Math.max(0, (match.index ?? 0) - 120), match.index ?? 0);
+        const before = scan.slice(Math.max(0, match.index - 120), match.index);
         if (!before.includes('htmlspecialchars') && !before.includes('htmlentities') && !before.includes('strip_tags') && !before.includes('filter_var') && !before.includes('esc_html') && !before.includes('e(')) {
             ocorrencias.push({
                 relPath,
@@ -51,7 +51,7 @@ function detectSecurityIssues(src, relPath) {
     }
     // CSRF protection missing
     for (const match of scan.matchAll(/<form[^>]*>/gi)) {
-        const formPos = match.index ?? 0;
+        const formPos = match.index;
         const formTag = match[0];
         const formEnd = scan.indexOf('</form>', formPos);
         const formBlock = scan.slice(formPos, formEnd > 0 ? formEnd + 7 : formPos + 500);
@@ -138,8 +138,8 @@ function detectSecurityIssues(src, relPath) {
         if (/(?:md5|sha1)\s*\(\s*\$.*pass/i.test(scan)) {
             for (const match of scan.matchAll(/(?:md5|sha1)\s*\(/gi)) {
                 const line = lineOf(match.index);
-                const before = scan.slice(Math.max(0, (match.index ?? 0) - 60), match.index ?? 0);
-                if (/pass/i.test(before) || /pass/i.test(scan.slice(match.index ?? 0, (match.index ?? 0) + 80))) {
+                const before = scan.slice(Math.max(0, match.index - 60), match.index);
+                if (/pass/i.test(before) || /pass/i.test(scan.slice(match.index, match.index + 80))) {
                     ocorrencias.push({
                         relPath,
                         mensagem: messages.PhpMensagens.weakPasswordHash,

package/dist/analysts/php/scorers/scorer-php.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
 import { splitLines } from '../../../shared/helpers/index.js';
 import { detectorPhpBestPractices, detectorPhpSecurity } from '../detectors/index.js';
-export async function pontuarPhp(src, relPath) {
+export function pontuarPhp(src, relPath) {
     let score = 0;
     const maxScore = 100;
     const issues = [];
@@ -38,7 +38,7 @@ export async function pontuarPhp(src, relPath) {
     let hasComplex = false;
     let longFns = 0;
     for (const fn of fnMatches) {
-        const bodyStart = (fn.index ?? 0) + (fn[0].length ?? 0);
+        const bodyStart = fn.index + fn[0].length;
         let braceCount = 1;
         let bodyEnd = bodyStart;
         for (let i = bodyStart; i < src.length && braceCount > 0; i++) {

package/dist/analysts/plugins/detector-documentation.js

@@ -173,6 +173,7 @@ function detectarPadroesDocumentacao(src, problemas, relPath) {
     // 2. Tem exportações públicas E
     // 3. Não tem nenhum JSDoc E
     // 4. Não é arquivo de teste/config/setup
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- vars mutated inside forEach closure; TS can't track
     if (isLibraryArquivo && temExportacaoPublica && !temJSDoc && !isInternalArquivo && src.length > 200) {
         // Arquivo grande o suficiente para justificar documentação
         problemas.push({
@@ -239,13 +240,11 @@ function detectarProblemasDocumentacaoAST(ast, problemas) {
 }
 function agruparPorPrioridade(problemas) {
     return problemas.reduce((acc, problema) => {
-        const prioridade = problema.prioridade;
-        if (prioridade) {
-            if (!acc[prioridade]) {
-                acc[prioridade] = [];
-            }
-            acc[prioridade].push(problema);
+        const prioridade = problema.prioridade ?? 'media';
+        if (!(prioridade in acc)) {
+            acc[prioridade] = [];
         }
+        acc[prioridade].push(problema);
         return acc;
     }, {});
 }
@@ -257,6 +256,7 @@ function mapearPrioridadeParaNivel(prioridade) {
         case 'media':
             return 'aviso';
         case 'baixa':
+            return 'info';
         case undefined: {
             throw new Error('Not implemented yet: undefined case');
         }

package/dist/analysts/plugins/detector-markdown.js

@@ -100,9 +100,9 @@ function mergeWhitelist(base, override, mode) {
     const overrideConfig = override ?? {};
     if (mode === 'replace') {
         return {
-            paths: Array.isArray(overrideConfig.paths) ? overrideConfig.paths : [],
-            patterns: Array.isArray(overrideConfig.patterns) ? overrideConfig.patterns : [],
-            dirs: Array.isArray(overrideConfig.dirs) ? overrideConfig.dirs : []
+            paths: overrideConfig.paths ?? [],
+            patterns: overrideConfig.patterns ?? [],
+            dirs: overrideConfig.dirs ?? []
         };
     }
     const uniq = (arr) => Array.from(new Set(arr.map(String)));
@@ -110,9 +110,9 @@ function mergeWhitelist(base, override, mode) {
     const overridePatterns = Array.isArray(overrideConfig.patterns) ? overrideConfig.patterns : [];
     const overrideDirs = Array.isArray(overrideConfig.dirs) ? overrideConfig.dirs : [];
     return {
-        paths: uniq([...(base.paths || []), ...overridePaths]),
-        patterns: uniq([...(base.patterns || []), ...overridePatterns]),
-        dirs: uniq([...(base.dirs || []), ...overrideDirs])
+        paths: uniq([...base.paths, ...overridePaths]),
+        patterns: uniq([...base.patterns, ...overridePatterns]),
+        dirs: uniq([...base.dirs, ...overrideDirs])
     };
 }
 /**
@@ -263,7 +263,7 @@ export const detectorMarkdown = {
     test: (relPath) => {
         return relPath.toLowerCase().endsWith('.md');
     },
-    aplicar: async (src, relPath, _ast, fullCaminho) => {
+    aplicar: (src, relPath, _ast, fullCaminho) => {
         if (!fullCaminho) {
             log.aviso(getMessages().LicensasMensagens.detectorMarkdownPath.replace('{arquivo}', relPath));
             return [];

package/dist/analysts/python/analysts/analyst-python.js

@@ -67,7 +67,7 @@ export function collectPythonIssues(src, relPath) {
         ocorrencias.push(warn(messages.PythonMensagens.pickleUsage, relPath, line, messages.SeverityNiveis.error));
     }
     for (const match of scan.matchAll(/\byaml\.load\s*\([\s\S]*?\)/gi)) {
-        const text = match[0] ?? '';
+        const text = match[0];
         const hasSafeLoader = /\bLoader\s*=\s*yaml\.(?:SafeLoader|CSafeLoader)\b/.test(text);
         const hasFullLoader = /\bLoader\s*=\s*yaml\.(?:FullLoader|CFullLoader)\b/.test(text);
         const hasExplicitLoader = /\bLoader\s*=/.test(text);
@@ -85,7 +85,7 @@ export function collectPythonIssues(src, relPath) {
         }
     }
     for (const match of scanNoComentarios.matchAll(/\b(?:execute|executemany|executescript)\s*\(\s*f(['"])(?:SELECT|INSERT|UPDATE|DELETE)[\s\S]*?\1/gi)) {
-        const text = match[0] ?? '';
+        const text = match[0];
         if (!/\{[^}]+\}/.test(text)) {
             continue;
         }
@@ -133,9 +133,6 @@ export function collectPythonIssues(src, relPath) {
     }
     // except blocks without logging the exception
     for (const match of src.matchAll(/except\s+(\w+)\s+as\s+(\w+)\s*:((?:[ \t]+.*\n?)*?)(?=\n\S|\n\s*(?:except|else|finally|def|class)|$)/gm)) {
-        if (match[3] === undefined) {
-            continue;
-        }
         const excVar = match[2];
         const block = match[3];
         if (!block || block.trim() === '' || block.trim() === 'pass') {

package/dist/analysts/react/analysts/analyst-react-hooks.js

@@ -5,8 +5,19 @@ import { messages } from '../../../core/messages/index.js';
 import { createLineLookup } from '../../../shared/helpers/index.js';
 import { criarAnalista, criarOcorrencia } from '../../../types/index.js';
 const disableEnv = process.env.SUKUNA_DISABLE_PLUGIN_REACT_HOOKS === '1';
+const REACT_18_HOOKS = [
+    'useState', 'useEffect', 'useMemo', 'useCallback', 'useRef',
+    'useContext', 'useReducer', 'useLayoutEffect', 'useImperativeHandle',
+    'useDebugValue', 'useDeferredValue', 'useTransition',
+    'useSyncExternalStore', 'useInsertionEffect', 'useId',
+];
+// React 19+ built-in hooks
+const REACT_19_HOOKS = [
+    'use', 'useOptimistic', 'useActionState', 'useFormStatus',
+];
+const ALL_BUILTIN_HOOKS = [...REACT_18_HOOKS, ...REACT_19_HOOKS];
 function hasHooksUsage(src) {
-    return /use(State|Effect|Memo|Callback|Reducer|Ref|LayoutEffect|ImperativeHandle|Transition|DeferredValue|SyncExternalStore|InsertionEffect|Id|DebugValue)/.test(src);
+    return new RegExp(`\\b(?:${ALL_BUILTIN_HOOKS.join('|')})\\b`).test(src);
 }
 function warn(message, relPath, line, nivel = messages.SeverityNiveis.warning) {
     return criarOcorrencia({
@@ -43,9 +54,10 @@ function extractHookCallContent(src, startIndex) {
 function collectHookIssues(src, relPath) {
     const ocorrencias = [];
     const lineOf = createLineLookup(src).lineAt;
+    // Check useEffect/useLayoutEffect for deps
     const effectMatches = [...src.matchAll(/use(Layout)?Effect\s*\(/g)];
     effectMatches.forEach(m => {
-        const hookInicio = m.index ?? 0;
+        const hookInicio = m.index;
         const fullCall = extractHookCallContent(src, hookInicio + m[0].length - 1);
         const hasDepsArg = /,\s*(\[[\s\S]*?\]|\w+)\s*\)$/.test(fullCall);
         const skip = /no-deps-ok|eslint-disable-next-line\s+react-hooks\/exhaustive-deps/i.test(fullCall);
@@ -65,9 +77,10 @@ function collectHookIssues(src, relPath) {
             }
         }
     });
+    // useMemo/useCallback deps check
     const memoMatches = [...src.matchAll(/use(Memo|Callback)\s*\(/g)];
     memoMatches.forEach(m => {
-        const hookInicio = m.index ?? 0;
+        const hookInicio = m.index;
         const fullCall = extractHookCallContent(src, hookInicio + m[0].length - 1);
         const hasDepsArg = /,\s*(\[[\s\S]*?\]|\w+)\s*\)$/.test(fullCall);
         const skip = /no-deps-ok|eslint-disable-next-line\s+react-hooks\/exhaustive-deps/i.test(fullCall);
@@ -76,15 +89,42 @@ function collectHookIssues(src, relPath) {
             ocorrencias.push(warn(messages.ReactHooksMensagens.memoCallbackNoDeps, relPath, line));
         }
     });
+    // Conditional hooks
     const conditionalHooks = [...src.matchAll(/(if|for|while)\s*\([^)]*\)\s*\{[\s\S]{0,160}?use[A-Z][A-Za-z0-9_]*/g)];
     conditionalHooks.forEach(m => {
         const line = lineOf(m.index || 0);
         ocorrencias.push(warn(messages.ReactHooksMensagens.hookInConditional, relPath, line));
     });
+    // React 19: useOptimistic detected
+    for (const match of src.matchAll(/\buseOptimistic\s*\(/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('useOptimistic (React 19) detected', relPath, line, messages.SeverityNiveis.info));
+    }
+    // React 19: useActionState detected
+    for (const match of src.matchAll(/\buseActionState\s*\(/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('useActionState (React 19) detected — verify form action integration', relPath, line, messages.SeverityNiveis.info));
+    }
+    // React 19: useFormStatus detected
+    for (const match of src.matchAll(/\buseFormStatus\s*\(/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('useFormStatus (React 19) detected — access pending form state', relPath, line, messages.SeverityNiveis.info));
+    }
+    // React 19: use() hook — suspends, must be in Suspense boundary
+    for (const match of src.matchAll(/\buse\s*\(/g)) {
+        const line = lineOf(match.index);
+        // Avoid matching "useState", "useEffect", etc.
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime safety for match.index === 0
+        if (src[match.index - 1]?.match(/[a-zA-Z]/)) {
+            continue;
+        }
+        ocorrencias.push(warn('React 19 use() hook detected — must be wrapped in <Suspense> boundary', relPath, line, messages.SeverityNiveis.info));
+    }
+    // Custom hooks naming convention
     const customHooks = [...src.matchAll(/\buse[A-Z][A-Za-z0-9_]*\s*=\s*\(/g)];
     customHooks.forEach(m => {
         const hookName = m[0].replace(/\s*=\s*\(/, '');
-        if (!/^(useState|useEffect|useMemo|useCallback|useRef|useContext|useReducer|useLayoutEffect|useImperativeHandle|useDebugValue|useDeferredValue|useTransition|useSyncExternalStore|useInsertionEffect|useId)$/.test(hookName)) {
+        if (!ALL_BUILTIN_HOOKS.includes(hookName)) {
             if (/^use[A-Z]/.test(hookName)) {
                 const line = lineOf(m.index || 0);
                 ocorrencias.push(warn(`Custom hook '${hookName}' - verify naming follows useXxx convention`, relPath, line));
@@ -106,7 +146,7 @@ function parseHooksWithBabel(src, relPath) {
         if (isJsxLike) {
             plugins.unshift('jsx');
         }
-        const ast = babelParse(src, { sourceType: 'unambiguous', errorRecovery: true, plugins });
+        const ast = babelParse(src, { sourceType: 'unambiguous', errorRecovery: true, plugins: plugins });
         const out = [];
         const seen = new Set();
         const pushOnce = (m) => {
@@ -120,7 +160,12 @@ function parseHooksWithBabel(src, relPath) {
         const declaredRefs = new Set();
         const isHookCallee = (callee) => {
             if (t.isIdentifier(callee)) {
-                return { name: callee.name };
+                const name = callee.name;
+                // React 19: use() is a special case (not prefixed with use but still a hook)
+                if (name === 'use') {
+                    return { name };
+                }
+                return /^use[A-Z0-9_]/.test(name) ? { name } : null;
             }
             if (t.isMemberExpression(callee)) {
                 const obj = callee.object;
@@ -135,7 +180,7 @@ function parseHooksWithBabel(src, relPath) {
         };
         const isEffectLike = (name) => name === 'useEffect' || name === 'useLayoutEffect' || name === 'useInsertionEffect';
         const isMemoLike = (name) => name === 'useMemo' || name === 'useCallback';
-        const isAnyHook = (name) => /^use[A-Z0-9_]/.test(name);
+        const isAnyHook = (name) => /^use[A-Z0-9_]/.test(name) || name === 'use';
         const inConditionalOrLoop = (path) => {
             return Boolean(path.findParent(p => p.isIfStatement() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isSwitchStatement() || p.isConditionalExpression()));
         };
@@ -207,6 +252,18 @@ function parseHooksWithBabel(src, relPath) {
                             }
                         }
                     }
+                    // React 19: use() hook should be in Suspense boundary
+                    if (name === 'use') {
+                        pushOnce(warn('React 19 use() hook — ensure wrapped in <Suspense> boundary', relPath, locLine));
+                    }
+                    // React 19: useOptimistic should have reducer function
+                    if (name === 'useOptimistic' && path.node.arguments.length < 2) {
+                        pushOnce(warn('useOptimistic expects initial state and update function (React 19)', relPath, locLine));
+                    }
+                    // React 19: useActionState should have form action
+                    if (name === 'useActionState') {
+                        pushOnce(warn('useActionState (React 19) — verify form action handler', relPath, locLine));
+                    }
                     if (isEffectLike(name) && path.node.arguments.length >= 2) {
                         const callback = path.node.arguments[0];
                         const deps = path.node.arguments[1];
@@ -271,7 +328,7 @@ function parseHooksWithBabel(src, relPath) {
                             }
                         }
                     }
-                    if (isAnyHook(name) && !isEffectLike(name) && !isMemoLike(name) && name !== 'useState' && name !== 'useRef' && name !== 'useContext' && name !== 'useReducer' && name !== 'useDebugValue' && name !== 'useId') {
+                    if (isAnyHook(name) && !isEffectLike(name) && !isMemoLike(name) && name !== 'useState' && name !== 'useRef' && name !== 'useContext' && name !== 'useReducer' && name !== 'useDebugValue' && name !== 'useId' && name !== 'useOptimistic' && name !== 'useActionState' && name !== 'useFormStatus' && name !== 'use') {
                         pushOnce(warn(`Custom hook '${name}' usage detected`, relPath, locLine));
                     }
                 }
@@ -290,7 +347,7 @@ function parseHooksWithBabel(src, relPath) {
 export const analistaReactHooks = criarAnalista({
     nome: 'analista-react-hooks',
     categoria: 'framework',
-    descricao: 'Heurísticas de Hooks com análise de dependências (sem ESLint).',
+    descricao: 'Heurísticas de Hooks (React 18/19) com análise de dependências.',
     global: false,
     test: (relPath) => /\.(jsx|tsx|js|ts)$/i.test(relPath),
     aplicar: (src, relPath) => {

package/dist/analysts/react/analysts/analyst-react.js

@@ -79,6 +79,50 @@ function collectReactIssues(src, relPath) {
             ocorrencias.push(warn(messages.ReactMensagens.locationHrefRedirect, relPath, line));
         }
     }
+    // React 19: <form action={...}>
+    for (const match of src.matchAll(/<form[^>]*>/gi)) {
+        const hasAction = /\saction\s*=\s*\{/.test(match[0]);
+        if (hasAction) {
+            const line = lineOf(match.index);
+            ocorrencias.push(warn('React 19 form action detected', relPath, line, messages.SeverityNiveis.info));
+        }
+    }
+    // React 19: use() hook (called at top level in render)
+    for (const match of src.matchAll(/\bconst\s+\w+\s*=\s*use\s*\(/g)) {
+        const line = lineOf(match.index);
+        if (!/use[A-Z]/.test(match[0])) {
+            ocorrencias.push(warn('React 19 use() hook detected — ensure wrapped in Suspense boundary', relPath, line, messages.SeverityNiveis.info));
+        }
+    }
+    // 'use client' / 'use server' directives
+    if (/^['"]use (client|server)['"];/m.test(src)) {
+        ocorrencias.push(warn('Server Component directive detected', relPath, 1, messages.SeverityNiveis.info));
+    }
+    if (!/^['"]use client['"];/m.test(src) && /useState|useEffect|useContext|onClick/.test(src)) {
+        // This file uses client-side features without 'use client'
+        const hasClientFeatures = /useState|useEffect|useContext|onClick/.test(src);
+        if (hasClientFeatures) {
+            const firstLine = src.split('\n')[0]?.trim() ?? '';
+            if (firstLine.startsWith('import')) {
+                ocorrencias.push(warn('File uses client-side features (hooks/events) but missing \'use client\' directive (React 19 Server Components)', relPath, 1, messages.SeverityNiveis.suggestion));
+            }
+        }
+    }
+    // React 19: forwardRef deprecation
+    for (const match of src.matchAll(/\bforwardRef\s*\(/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('forwardRef is deprecated in React 19 — pass ref as a regular prop instead', relPath, line, messages.SeverityNiveis.suggestion));
+    }
+    // React 19: React.FC / React.FunctionComponent / React.VoidFunctionComponent
+    for (const match of src.matchAll(/\bReact\.(FC|FunctionComponent|VoidFunctionComponent)\b/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(`React.${match[1]} is deprecated in React 19 — type props directly: (props: Props) => JSX.Element`, relPath, line, messages.SeverityNiveis.suggestion));
+    }
+    // React 19: defaultProps
+    for (const match of src.matchAll(/\.defaultProps\s*=\s*\{/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('defaultProps is deprecated in React 19 — use default parameter values instead', relPath, line, messages.SeverityNiveis.suggestion));
+    }
     return ocorrencias;
 }
 function normalizeStringValue(valor) {
@@ -92,7 +136,7 @@ function attrsToFlatList(attrs) {
         return [];
     }
     return attrs.filter(isBabelNode).filter((arquivo) => textoTitulo.isJSXAttribute(arquivo)).filter(arquivo => textoTitulo.isJSXIdentifier(arquivo.name)).map(arquivo => {
-        const name = String(arquivo.name.name);
+        const name = arquivo.name.name;
         let value;
         if (!arquivo.value) {
             value = null;
@@ -141,7 +185,7 @@ function parseReactWithBabel(scan, relPath) {
         const ast = babelParse(scan, {
             sourceType: 'unambiguous',
             errorRecovery: true,
-            plugins
+            plugins: plugins
         });
         const ocorrencias = [];
         const seen = new Set();

package/dist/analysts/react/corrections/correction-react.js

@@ -19,7 +19,7 @@ export function detectarCorrecoesReact(src, _relPath) {
             correcoes.push({
                 tipo: 'react-dangerous-html',
                 original: linha.trim(),
-                sugerido: '// Use: <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />',
+                sugerido: '// SEGURANCA: Use DOMPurify.sanitize() antes de dangerouslySetInnerHTML\n// <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />',
                 linha: numeroLinha,
                 confianca: 90
             });
@@ -87,6 +87,46 @@ export function detectarCorrecoesReact(src, _relPath) {
                 confianca: 50
             });
         }
+        // React 19: forwardRef replacement
+        if (/\bforwardRef\s*\(/.test(linha)) {
+            correcoes.push({
+                tipo: 'react-forwardref-to-prop',
+                original: linha.trim(),
+                sugerido: '// React 19: passe ref como prop em vez de forwardRef\n// Ex: function MeuComponente({ ref, ...props }) { ... }',
+                linha: numeroLinha,
+                confianca: 85
+            });
+        }
+        // React 19: React.FC replacement
+        if (/\bReact\.(FC|FunctionComponent)\s*</.test(linha)) {
+            correcoes.push({
+                tipo: 'react-fc-to-direct-type',
+                original: linha.trim(),
+                sugerido: '// React 19: tipagem direta de props\n// Ex: function MeuComponente({ prop1, prop2 }: Props)',
+                linha: numeroLinha,
+                confianca: 85
+            });
+        }
+        // React 19: defaultProps replacement
+        if (/\.defaultProps\s*=/.test(linha)) {
+            correcoes.push({
+                tipo: 'react-default-props-to-params',
+                original: linha.trim(),
+                sugerido: '// React 19: use default parameter values\n// Ex: function MeuComponente({ prop = valor })',
+                linha: numeroLinha,
+                confianca: 90
+            });
+        }
+        // React 19: 'use client' directive missing
+        if (/^\s*import\s+/.test(linha) && /useState|useEffect|onClick/.test(linha)) {
+            correcoes.push({
+                tipo: 'react-use-client-missing',
+                original: linha.trim(),
+                sugerido: `'use client';\n\n${linha.trim()}`,
+                linha: numeroLinha,
+                confianca: 70
+            });
+        }
     });
     return correcoes;
 }

package/dist/analysts/react/detectors/detector-react-best-practices.js

@@ -66,7 +66,7 @@ function detectWithBabel(src, relPath) {
     try {
         const plugins = ['decorators-legacy', 'classProperties', 'classPrivateProperties', 'classPrivateMethods', 'optionalChaining', 'nullishCoalescingOperator', 'topLevelAwait', 'importAttributes', 'jsx'];
         plugins.unshift('typescript');
-        const ast = babelParse(src, { sourceType: 'unambiguous', errorRecovery: true, plugins });
+        const ast = babelParse(src, { sourceType: 'unambiguous', errorRecovery: true, plugins: plugins });
         const out = [];
         const seen = new Set();
         const pushOnce = (o) => {
@@ -78,7 +78,7 @@ function detectWithBabel(src, relPath) {
             out.push(o);
         };
         const _lineOf = createLineLookup(src).lineAt;
-        const isHookName = (name) => /^use[A-Z0-9_]/.test(name) || name === 'useEffect' || name === 'useLayoutEffect' || name === 'useMemo' || name === 'useCallback' || name === 'useState' || name === 'useReducer' || name === 'useRef' || name === 'useContext' || name === 'useImperativeHandle' || name === 'useInsertionEffect' || name === 'useDebugValue' || name === 'useDeferredValue' || name === 'useTransition' || name === 'useSyncExternalStore' || name === 'useId';
+        const isHookName = (name) => /^use[A-Z0-9_]/.test(name);
         const declaredVars = new Set();
         const visitor = {
             VariableDeclarator(path) {
@@ -134,7 +134,7 @@ function detectWithBabel(src, relPath) {
                     }
                     if (name === 'useEffect' || name === 'useLayoutEffect' || name === 'useInsertionEffect') {
                         const bodyArg = node.arguments[0];
-                        if (bodyArg && (t.isFunctionExpression(bodyArg) || t.isArrowFunctionExpression(bodyArg)) && bodyArg.body && t.isBlockStatement(bodyArg.body)) {
+                        if ((t.isFunctionExpression(bodyArg) || t.isArrowFunctionExpression(bodyArg)) && t.isBlockStatement(bodyArg.body)) {
                             const bodyStmts = bodyArg.body.body;
                             const hasCleanup = bodyStmts.some(stmt => t.isReturnStatement(stmt) && stmt.argument && (t.isFunctionExpression(stmt.argument) || t.isArrowFunctionExpression(stmt.argument)));
                             const hasSubscriptions = /\b(subscribe|addEventListener|on\()/.test(src.slice(bodyArg.start ?? 0, bodyArg.end ?? 0));
@@ -174,7 +174,7 @@ function detectWithBabel(src, relPath) {
                                 }
                                 return false;
                             });
-                            if (stateCalls.length > 1 && depsArg && t.isArrayExpression(depsArg)) {
+                            if (stateCalls.length > 1) {
                                 pushOnce(warn('react-infinite-loop', D.infiniteLoopPattern, relPath, locLine, D.infiniteLoopPatternSugestao, 'aviso'));
                             }
                         }
@@ -273,7 +273,7 @@ function detectWithBabel(src, relPath) {
                 }
                 const fragmentParent = path.findParent(p => p.isJSXFragment());
                 if (fragmentParent?.isJSXFragment()) {
-                    const children = fragmentParent.node.children.filter(c => !t.isJSXText(c) || (c.value.trim() ?? '') !== '') ?? [];
+                    const children = fragmentParent.node.children.filter(c => !t.isJSXText(c) || c.value.trim() !== '');
                     if (children.length <= 1) {
                         pushOnce(warn('react-unnecessary-fragment', D.unnecessaryFragment, relPath, locLine, undefined, 'info'));
                     }

package/dist/analysts/react/scorers/scorer-react.js

@@ -6,8 +6,43 @@ export function pontuarReact(src, _relPath) {
     const issues = [];
     const strengths = [];
     const srcCompleto = src;
+    // React 19 patterns: forwardRef deprecation, React.FC, Server Components
+    const hasForwardRef = /\bforwardRef\s*\(/.test(srcCompleto);
+    if (hasForwardRef) {
+        issues.push('forwardRef é deprecated no React 19 — passe ref como prop direta');
+    }
+    else {
+        score += 3;
+        strengths.push('Sem forwardRef (estilo React 19)');
+    }
+    const hasReactFC = /\bReact\.(FC|FunctionComponent)\b/.test(srcCompleto);
+    if (hasReactFC) {
+        issues.push('React.FC/FunctionComponent é deprecated no React 19');
+    }
+    else {
+        score += 2;
+        strengths.push('Sem React.FC (tipagem direta de props)');
+    }
+    const hasUseClient = /^['"]use client['"];/m.test(srcCompleto);
+    const hasServerFeatures = /useState|useEffect|useContext|onClick/.test(srcCompleto);
+    if (hasServerFeatures && !hasUseClient) {
+        const firstLine = srcCompleto.split('\n')[0]?.trim() ?? '';
+        if (firstLine.startsWith('import')) {
+            issues.push('Componente usa hooks/eventos sem diretiva \'use client\' (React 19)');
+            score = Math.max(0, score - 3);
+        }
+    }
+    else if (hasUseClient) {
+        score += 3;
+        strengths.push('Diretiva \'use client\' presente (React 19)');
+    }
+    const hasFormAction = /<form[^>]*\saction\s*=/.test(srcCompleto);
+    if (hasFormAction) {
+        strengths.push('Uso de form action (React 19)');
+        score += 2;
+    }
     // Hooks usage & compliance (20 pontos)
-    const usaHooks = /use(State|Effect|Memo|Callback|Reducer|Ref|Context|LayoutEffect|ImperativeHandle|Transition|DeferredValue|SyncExternalStore|InsertionEffect|Id)/.test(srcCompleto);
+    const usaHooks = /use(State|Effect|Memo|Callback|Reducer|Ref|Context|LayoutEffect|ImperativeHandle|Transition|DeferredValue|SyncExternalStore|InsertionEffect|Id|Optimistic|ActionState|FormStatus)|\buse\s*\(/.test(srcCompleto);
     let hookPontos = 0;
     if (usaHooks) {
         hookPontos = 10;

package/dist/analysts/registry/autodiscovery.js

@@ -13,8 +13,8 @@ function extrairEntradasDeModulo(mod) {
     const out = [];
     const candidates = [];
     candidates.push(metrica.default);
-    if (Array.isArray(metrica.analistas)) {
-        candidates.push(...metrica.analistas);
+    if (Array.isArray((metrica).analistas)) {
+        candidates.push(...(metrica).analistas);
     }
     // Coleta exportações nomeadas que pareçam analista/técnica
     for (const valor of Object.values(metrica)) {

package/dist/analysts/rust/analysts/analyst-best-practices.js

@@ -32,7 +32,7 @@ function collectBestPractices(src, relPath) {
     // Excessive function length
     const funcBlocks = src.matchAll(/(?:^|\n)\s*fn\s+\w+.*?\{/gs);
     for (const funcBlock of funcBlocks) {
-        const startIdx = (funcBlock.index ?? 0) + (funcBlock[0].length ?? 0);
+        const startIdx = funcBlock.index + funcBlock[0].length;
         let braceCount = 1;
         let endIdx = startIdx;
         for (let i = startIdx; i < src.length && braceCount > 0; i++) {
@@ -47,7 +47,7 @@ function collectBestPractices(src, relPath) {
         const funcBody = src.slice(startIdx, endIdx);
         const funcLines = funcBody.split('\n').length;
         if (funcLines > 80) {
-            const line = lineOf(funcBlock.index ?? 0);
+            const line = lineOf(funcBlock.index);
             ocorrencias.push(warn(messages.RustMensagens.longFunction, relPath, line));
         }
     }
@@ -64,12 +64,51 @@ function collectBestPractices(src, relPath) {
         }
         declaredVars.add(varName);
     }
+    // Vec::push in a loop without pre-allocation
+    for (const match of scan.matchAll(/for\s+(\w+)\s+in\s+(\w+)\.iter\(\)\s*\{[\s\S]{0,200}results\.push\(/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('Collection built with push() in loop; consider using .map().collect() or Iterator adapters', relPath, line, messages.SeverityNiveis.suggestion));
+    }
+    // Use of as_ptr_range / as_mut_ptr_range (Rust 1.77+)
+    for (const match of scan.matchAll(/\.as_(ptr|mut_ptr)_range\(\)/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(`.${match[1]}_range() used (Rust 1.77+)`, relPath, line, messages.SeverityNiveis.info));
+    }
+    // Option::unwrap_or_else(|| ...) -> unwrap_or(...) when argument is constant
+    for (const match of scan.matchAll(/\.unwrap_or_else\(\s*\|\|\s*(\w+)::(\w+)\s*\)/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(`.unwrap_or_else(|| ...) with constant default; consider .unwrap_or(...) (Rust 1.78+)`, relPath, line, messages.SeverityNiveis.suggestion));
+    }
+    // use of assert!(expr.is_some()) -> assert!(expr.is_some()) is fine, but check for unwrap after
+    for (const match of scan.matchAll(/if\s+(\w+)\.is_some\(\)\s*\{[\s\S]{0,100}(\w+)\.unwrap\(\)/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn('Guard with .is_some() followed by .unwrap(); use if let Some(x) = ... instead', relPath, line, messages.SeverityNiveis.suggestion));
+    }
+    // use of format!("literal {var}") without explicit capture (Rust 1.80+)
+    for (const match of scan.matchAll(/format!\(["']([^"']*\{(\w+)\}[^"']*)["'],\s*\2\s*\)/g)) {
+        const line = lineOf(match.index);
+        const varName = match[2];
+        ocorrencias.push(warn(`format!("...{${varName}}...", ${varName}) can be simplified to format!("...{${varName}}...") using implicit capture (Rust 1.80+)`, relPath, line, messages.SeverityNiveis.suggestion));
+    }
+    // detect assert!(matches!(expr, pattern)) pattern -> suggest assert_matches!
+    for (const match of scan.matchAll(/assert!\(matches!\(([^,]+),\s*([^)]+)\)\s*\)/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(`assert!(matches!(${match[1]}, ${match[2]})) — consider assert_matches!(${match[1]}, ${match[2]}) (nightly Rust 1.81+)`, relPath, line, messages.SeverityNiveis.info));
+    }
+    // detect Vec<_>::new() -> Vec::new() (type inference)
+    // detect .into_iter() -> .iter()/iter_mut() when not consuming
+    for (const match of scan.matchAll(/\.into_iter\(\)\.(map|filter|for_each)/g)) {
+        const line = lineOf(match.index);
+        if (!src.slice(0, match.index).includes('.collect')) {
+            ocorrencias.push(warn('.into_iter() used but not consuming; consider .iter() for read-only iteration', relPath, line, messages.SeverityNiveis.suggestion));
+        }
+    }
     return ocorrencias;
 }
 export const analistaRustBoasPraticas = criarAnalista({
     nome: 'analista-rust-boas-praticas',
     categoria: 'boas-praticas',
-    descricao: 'Detecta desvios de boas práticas em código Rust.',
+    descricao: 'Detecta desvios de boas práticas Rust (edition 2024, Rust 1.80+).',
     global: false,
     test: (relPath) => /\.(rs)$/i.test(relPath),
     aplicar: (src, relPath) => {

package/dist/analysts/rust/analysts/analyst-memory.js

@@ -20,7 +20,7 @@ function collectMemoryIssues(src, relPath) {
     // Vec without with_capacity
     for (const match of scan.matchAll(/(\w+)\.push\(/g)) {
         const line = lineOf(match.index);
-        const varName = match[1] ?? '';
+        const varName = match[1];
         const declMatch = new RegExp(`let\\s+mut\\s+${varName}\\s*:\\s*Vec|<|=\\s*Vec::new\\(\\)`, 'i');
         if (declMatch.test(scan.slice(0, match.index))) {
             ocorrencias.push(warn(messages.RustMensagens.vecWithoutCapacity, relPath, line, messages.SeverityNiveis.suggestion));
@@ -29,7 +29,7 @@ function collectMemoryIssues(src, relPath) {
     // read_line without trimming
     for (const match of scan.matchAll(/(\w+)\.read_line\(&mut\s+(\w+)\)/g)) {
         const line = lineOf(match.index);
-        const varName = match[2] ?? '';
+        const varName = match[2];
         const snippet = src.slice(match.index, match.index + 200);
         if (!snippet.includes(`${varName}.trim()`) && !snippet.includes(`${varName}.trim_end()`)) {
             ocorrencias.push(warn(messages.RustMensagens.noTrimOnInput, relPath, line));