@mocoto/mahoraga 0.14.5 → 0.14.6

package/README.md

@@ -8,15 +8,19 @@ Proveniência e Autoria: Este documento integra o projeto Mahoraga (licença MIT
 
 </div>
 
-<p> Estou ficando desanimado de continuar com esse projeto, caso goste do projeto e queira ajudar pra eu não desanimar entre em contato por esse E-mail: /p>
+<p> Desisti de desistir do projeto, até parece que vou aceitar perder pra vocês ...</p>
+
+<p> caso tenha interesse em ajudar no projeto o E-mail é esse ai em baixo o **lint que me aguarde 😜 </p>
 
 [Gmail](mailto:mocoto.persona@gmail.com)
 
+<h5> Alias!! ignora o sugestoes-00*.json ainda esta em ajustes.</h5>
+
 ## Começar Rápido (30 segundos)
 
 ```bash
 # 1. Instalar
-npm install -g mahoraga
+npm install -g @mocoto/mahoraga
 
 # 2. Analisar seu projeto
 cd meu-projeto
@@ -185,25 +189,16 @@ mahoraga metricas
 
 **Uso global:**
 ```bash
-npm install -g mahoraga
+npm install -g @mocoto/mahoraga
 mahoraga --version
 ```
 
 **Uso local no projeto:**
 ```bash
-npm install --save-dev mahoraga
+npm install --save-dev @mocoto/mahoraga
 npx mahoraga --help
 ```
 
-### Do Repositório
-
-```bash
-git clone https://github.com/o-atoa/mahoraga.git
-cd mahoraga
-npm install
-npm run build
-npm link
-```
 
 ### Docker
 
@@ -612,19 +607,6 @@ mahoraga github-actions gate --threshold 80 --fail-on erro
 
 ---
 
-## Desenvolvimento
-
-### Setup
-
-```bash
-git clone https://github.com/o-atoa/mahoraga.git
-cd mahoraga
-npm install
-npm run build
-npm link
-mahoraga --version
-```
-
 ### Scripts
 
 ```bash
@@ -691,18 +673,6 @@ Dependências de terceiros listadas em [THIRD-PARTY-NOTICES.txt](./THIRD-PARTY-N
 
 ---
 
-<div align="center">
-
-[![npm](https://img.shields.io/badge/npm-mahoraga-CB3837)](https://www.npmjs.com/package/mahoraga)
-[![GitHub](https://img.shields.io/badge/github-blue--diaz/mahoraga-181717)](https://github.com/o-atoa/mahoraga)
-[![Issues](https://img.shields.io/badge/issues-report-FF4500)](https://github.com/o-atoa/mahoraga/issues)
-[![Releases](https://img.shields.io/badge/releases-latest-2ea44f)](https://github.com/o-atoa/mahoraga/releases)
-
-**Feito para os iniciantes** — [Voltar ao topo](#mahoraga)
+**Feito para os iniciantes**
 
 </div>
-# mahoraga
-
-# mahoraga
-# mahoraga
-# mahoraga

package/dist/analysts/detectors/detector-structure.js

@@ -51,7 +51,7 @@ export const detectorEstrutura = {
         const setCaminhos = new Set(caminhos);
         // Detecta contexto geral do projeto para análise inteligente
         const arquivoPrincipal = caminhos?.find(caminho => /package\.json$/.test(caminho)) ?? caminhos[0];
-        const conteudoPrincipal = contexto.arquivos.find(arquivo => arquivo.relPath === arquivoPrincipal)?.content ?? '';
+        const conteudoPrincipal = contexto.arquivos?.find(arquivo => arquivo.relPath === arquivoPrincipal)?.content ?? '';
         const contextoProjeto = detectarContextoProjeto({
             arquivo: arquivoPrincipal,
             conteudo: conteudoPrincipal,

package/dist/analysts/react/analysts/analyst-react-hooks.js

@@ -33,8 +33,63 @@ function extractHookCallContent(src, startIndex) {
     let depth = 0;
     let started = false;
     let content = '';
+    let inSingle = false;
+    let inDouble = false;
+    let inBacktick = false;
+    let escaped = false;
     for (let i = startIndex; i < src.length; i++) {
         const char = src[i];
+        if (escaped) {
+            escaped = false;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (char === '\\' && (inSingle || inDouble || inBacktick)) {
+            escaped = true;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (inSingle) {
+            if (char === "'")
+                inSingle = false;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (inDouble) {
+            if (char === '"')
+                inDouble = false;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (inBacktick) {
+            if (char === '`')
+                inBacktick = false;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (char === "'") {
+            inSingle = true;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (char === '"') {
+            inDouble = true;
+            if (started)
+                content += char;
+            continue;
+        }
+        if (char === '`') {
+            inBacktick = true;
+            if (started)
+                content += char;
+            continue;
+        }
         if (char === '(') {
             depth++;
             started = true;
@@ -59,7 +114,22 @@ function collectHookIssues(src, relPath) {
     effectMatches.forEach(m => {
         const hookInicio = m.index;
         const fullCall = extractHookCallContent(src, hookInicio + m[0].length - 1);
-        const hasDepsArg = /,\s*(\[[\s\S]*?\]|\w+)\s*\)$/.test(fullCall);
+        // More robust deps detection: find the last comma followed by an array or identifier before the closing paren
+        const hasDepsArg = (() => {
+            // Find the last ')' (closing paren of the full call)
+            const lastClosing = fullCall.lastIndexOf(')');
+            if (lastClosing === -1)
+                return false;
+            const beforeClosing = fullCall.slice(0, lastClosing);
+            // Find the last '[' or identifier before the closing paren
+            const arrayMatch = beforeClosing.match(/,\s*(\[[\s\S]*?\])\s*$/);
+            if (arrayMatch)
+                return true;
+            const identMatch = beforeClosing.match(/,\s*(\w+)\s*$/);
+            if (identMatch)
+                return true;
+            return false;
+        })();
         const skip = /no-deps-ok|eslint-disable-next-line\s+react-hooks\/exhaustive-deps/i.test(fullCall);
         if (!hasDepsArg && !skip) {
             const line = lineOf(hookInicio);
@@ -89,10 +159,18 @@ function collectHookIssues(src, relPath) {
             ocorrencias.push(warn(messages.ReactHooksMensagens.memoCallbackNoDeps, relPath, line));
         }
     });
-    // Conditional hooks
-    const conditionalHooks = [...src.matchAll(/(if|for|while)\s*\([^)]*\)\s*\{[\s\S]{0,160}?use[A-Z][A-Za-z0-9_]*/g)];
+    // Conditional hooks — only flag when a hook call is directly inside a conditional block,
+    // not when the conditional is inside a hook callback (e.g. cleanup inside useEffect).
+    // The regex matches: if/for/while (...) { ... useXxx ... } but limits the match scope
+    // to avoid matching conditionals that appear inside hook callbacks.
+    const conditionalHooks = [...src.matchAll(/(?:^|(?<=[\n;]))\s*(if|for|while)\s*\([^)]*\)\s*\{[\s\S]{0,160}?use[A-Z][A-Za-z0-9_]*/g)];
     conditionalHooks.forEach(m => {
         const line = lineOf(m.index || 0);
+        // Heuristic: skip if the 'if' keyword is preceded by a closing paren or brace at the same indentation,
+        // which suggests it's inside a callback body rather than at the component top level.
+        const pre = src.slice(Math.max(0, (m.index ?? 0) - 80), m.index ?? 0);
+        if (/=>\s*$|\)\s*=>\s*$|\)\s*\{[\s\S]{0,40}$/.test(pre))
+            return;
         ocorrencias.push(warn(messages.ReactHooksMensagens.hookInConditional, relPath, line));
     });
     // React 19: useOptimistic detected
@@ -127,7 +205,7 @@ function collectHookIssues(src, relPath) {
         if (!ALL_BUILTIN_HOOKS.includes(hookName)) {
             if (/^use[A-Z]/.test(hookName)) {
                 const line = lineOf(m.index || 0);
-                ocorrencias.push(warn(`Custom hook '${hookName}' - verify naming follows useXxx convention`, relPath, line));
+                ocorrencias.push(warn(`Custom hook '${hookName}' - verify naming follows useXxx convention`, relPath, line, messages.SeverityNiveis.info));
             }
         }
     });
@@ -182,7 +260,26 @@ function parseHooksWithBabel(src, relPath) {
         const isMemoLike = (name) => name === 'useMemo' || name === 'useCallback';
         const isAnyHook = (name) => /^use[A-Z0-9_]/.test(name) || name === 'use';
         const inConditionalOrLoop = (path) => {
-            return Boolean(path.findParent(p => p.isIfStatement() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isSwitchStatement() || p.isConditionalExpression()));
+            // Only consider conditionals/loops in the SAME function scope, not inside nested callbacks.
+            // Stop climbing at the nearest function boundary to avoid false positives when
+            // a hook is used inside a callback that happens to be in a conditional context.
+            let current = path;
+            while (current) {
+                const parent = current.findParent(p => p.isIfStatement() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isSwitchStatement() || p.isConditionalExpression());
+                if (parent)
+                    return true;
+                // Climb to the nearest function boundary; stop if we hit one
+                const fnBoundary = current.findParent(p => p.isFunction());
+                if (!fnBoundary)
+                    break;
+                // If the fnBoundary is the component function itself, we've exhausted this scope
+                // Check if there's a conditional ABOVE this function boundary
+                const aboveFn = fnBoundary.findParent(p => p.isIfStatement() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isSwitchStatement() || p.isConditionalExpression());
+                if (aboveFn)
+                    return true;
+                break;
+            }
+            return false;
         };
         const getIdentifiersInNode = (node) => {
             const ids = new Set();
@@ -329,7 +426,7 @@ function parseHooksWithBabel(src, relPath) {
                         }
                     }
                     if (isAnyHook(name) && !isEffectLike(name) && !isMemoLike(name) && name !== 'useState' && name !== 'useRef' && name !== 'useContext' && name !== 'useReducer' && name !== 'useDebugValue' && name !== 'useId' && name !== 'useOptimistic' && name !== 'useActionState' && name !== 'useFormStatus' && name !== 'use') {
-                        pushOnce(warn(`Custom hook '${name}' usage detected`, relPath, locLine));
+                        pushOnce(warn(`Custom hook '${name}' usage detected`, relPath, locLine, messages.SeverityNiveis.info));
                     }
                 }
                 catch {

package/dist/analysts/react/analysts/analyst-react.js

@@ -38,6 +38,11 @@ function collectReactIssues(src, relPath) {
     // dangerouslySetInnerHTML
     for (const match of src.matchAll(/dangerouslySetInnerHTML/gi)) {
         const line = lineOf(match.index);
+        // Skip if this is a <script type="speculationrules"> element — dangerouslySetInnerHTML
+        // is required for Speculation Rules API (no children allowed, only innerHTML).
+        const lineContent = src.split('\n')[line - 1] ?? '';
+        if (/speculationrules/.test(lineContent))
+            continue;
         ocorrencias.push(warn(messages.ReactMensagens.dangerouslySetInnerHTML, relPath, line));
     }
     // <img> sem alt
@@ -233,6 +238,13 @@ function parseReactWithBabel(scan, relPath) {
                         }
                     }
                     if (findAttr(attrs, 'dangerouslySetInnerHTML')) {
+                        // Skip if this is a <script type="speculationrules"> — dangerouslySetInnerHTML
+                        // is required for Speculation Rules API (no children, only innerHTML).
+                        if (tag.toLowerCase() === 'script') {
+                            const typeAttr = findAttr(attrs, 'type');
+                            if (typeAttr && /speculationrules/i.test(normalizeStringValue(typeAttr.value)))
+                                return;
+                        }
                         pushOnce(warn(messages.ReactMensagens.dangerouslySetInnerHTML, relPath, locLine));
                     }
                     // Inline Styles

package/dist/analysts/react/detectors/detector-react-best-practices.js

@@ -23,6 +23,9 @@ export const detectorReactBestPractices = {
         linhas.forEach((linha, index) => {
             const numeroLinha = index + 1;
             if (/dangerouslySetInnerHTML/.test(linha)) {
+                // Skip <script type="speculationrules"> — dangerouslySetInnerHTML is required
+                if (/speculationrules/i.test(linha))
+                    return;
                 ocorrencias.push(warn('react-dangerous-html', D.dangerousHtml, relPath, numeroLinha, D.dangerousHtmlSugestao, 'erro'));
             }
             if (/onClick=|onSubmit=|onChange=|onMouseOver=/.test(linha) && /{[^}]*=>/.test(linha)) {
@@ -101,7 +104,27 @@ function detectWithBabel(src, relPath) {
                 }
                 const locLine = path.node.loc?.start.line;
                 if (isHookName(name)) {
-                    const parent = path.findParent(p => p.isIfStatement() || p.isConditionalExpression() || p.isLogicalExpression() || p.isSwitchStatement() || p.isSwitchCase() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isLoop());
+                    // Only flag hooks inside conditionals in the SAME function scope.
+                    // Stop climbing at function boundaries (callbacks, event handlers, etc.)
+                    // to avoid false positives when a conditional is inside a hook callback.
+                    const parent = (() => {
+                        let currentPath = path;
+                        while (currentPath) {
+                            const found = currentPath.findParent(p => p.isIfStatement() || p.isConditionalExpression() || p.isLogicalExpression() || p.isSwitchStatement() || p.isSwitchCase() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isLoop());
+                            if (found)
+                                return found;
+                            // Stop at function boundaries
+                            const fnBoundary = currentPath.findParent(p => p.isFunction());
+                            if (!fnBoundary)
+                                return null;
+                            // Check above the function boundary
+                            const aboveFn = fnBoundary.findParent(p => p.isIfStatement() || p.isConditionalExpression() || p.isLogicalExpression() || p.isSwitchStatement() || p.isSwitchCase() || p.isForStatement() || p.isWhileStatement() || p.isDoWhileStatement() || p.isLoop());
+                            if (aboveFn)
+                                return aboveFn;
+                            return null;
+                        }
+                        return null;
+                    })();
                     if (parent) {
                         pushOnce(warn('react-hook-conditional', D.hookConditionalCall, relPath, locLine, D.hookConditionalCallSugestao, 'erro'));
                     }

package/dist/analysts/tailwind/analysts/analyst-tailwind.js

@@ -311,8 +311,11 @@ function propertyKey(token) {
             re: /^max-h(?:-|\[)/,
             key: 'max-h'
         }, {
-            re: /^(top|left|right|bottom)(?:-|\[)/,
-            key: 'position'
+            re: /^(top|bottom)(?:-|\[)/,
+            key: 'position-y'
+        }, {
+            re: /^(left|right)(?:-|\[)/,
+            key: 'position-x'
         }, {
             re: /^field-sizing(?:-|\[)/,
             key: 'field-sizing'

package/dist/core/utils/exec-safe.js

@@ -2,19 +2,37 @@
 import { execSync } from 'node:child_process';
 import { config } from '../config/index.js';
 import { getMessages } from '../messages/index.js';
+// Expressão regular para detectar shell metacharacters perigosos
+// que permitiriam injeção de comandos adicionais.
+// Bloqueia: ; | & ` $() ${} <> \n
+const SHELL_INJECTION_RE = /[;|&`]|\$[({]|\${|>|<|\\n/;
+/**
+ * Valida que o comando não contém caracteres de injeção shell.
+ * @param cmd - Comando a validar
+ * @throws Error se o comando contiver padrões perigosos
+ */
+function validarComando(cmd) {
+    if (SHELL_INJECTION_RE.test(cmd)) {
+        throw new Error(`Comando rejeitado por segurança: contém caracteres de injeção shell.`);
+    }
+}
+function verificarSafeMode() {
+    if (config.SAFE_MODE && !config.ALLOW_EXEC) {
+        throw new Error(getMessages().ExecSafeMensagens.safeModeBloqueado);
+    }
+}
 /**
  * Executa um comando shell de forma segura.
  * Bloqueia a execução quando SAFE_MODE está ativo e ALLOW_EXEC não está habilitado.
+ * Também valida o comando contra injeção shell mesmo quando a execução é permitida.
  * @param cmd - Comando shell a executar
  * @param opts - Opções do execSync do Node.js
  * @returns Buffer ou string com a saída do comando
- * @throws Error se SAFE_MODE estiver ativo sem ALLOW_EXEC
+ * @throws Error se SAFE_MODE estiver ativo sem ALLOW_EXEC ou se o comando for inválido
  */
 export function executarShellSeguro(cmd, opts = {}) {
-    // only block if SAFE_MODE is explicitly true and ALLOW_EXEC is falsy
-    if (config.SAFE_MODE && !config.ALLOW_EXEC) {
-        throw new Error(getMessages().ExecSafeMensagens.safeModeBloqueado);
-    }
+    validarComando(cmd);
+    verificarSafeMode();
     return execSync(cmd, opts);
 }
 /**

package/dist/node.loader.js

@@ -197,7 +197,6 @@ const aliases = {
     "@reports": "./src/reports/index",
     "@reports/compliance": "./src/reports/compliance/index",
     "@scripts": "./src/scripts/index",
-    "@sdk": "./src/sdk/index",
     "@shared": "./src/shared/index",
     "@shared/data-processing": "./src/shared/data-processing/index",
     "@shared/formatters": "./src/shared/formatters/index",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mocoto/mahoraga",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "type": "module",
   "description": "C.L.I modular para análise, diagnóstico e manutenção de projetos JavaScript/TypeScript e multi-stack leve",
   "author": "rei macaco",

package/dist/index.js

@@ -1,2 +0,0 @@
-// SPDX-License-Identifier: MIT
-export { analyzeFile, analyzeProject } from './sdk/analyzer.js';

package/dist/sdk/analyzer.js

@@ -1,88 +0,0 @@
-// SPDX-License-Identifier: MIT
-import path from 'node:path';
-import { executarInquisicao, scanRepository } from '../core/execution/index.js';
-import { decifrarSintaxe } from '../core/parsing/index.js';
-import { asTecnicas } from '../types/index.js';
-const EXTENSOES_COM_AST = new Set([
-    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
-    '.css', '.scss', '.html', '.xml', '.svg',
-    '.py', '.go', '.rs', '.php', '.sh',
-    '.yaml', '.yml', '.json',
-]);
-function extensaoRelevante(relPath) {
-    const ext = path.extname(relPath).toLowerCase();
-    return EXTENSOES_COM_AST.has(ext);
-}
-async function carregarTecnicas() {
-    const { registroAnalistas } = await import('../analysts/registry/index.js');
-    return asTecnicas(registroAnalistas);
-}
-function tecnicasParaArquivo(tecnicas, relPath) {
-    return tecnicas.filter(t => {
-        if (t.global) {
-            return false;
-        }
-        if (!t.test) {
-            return extensaoRelevante(relPath);
-        }
-        return t.test(relPath);
-    });
-}
-const AST_SENTINEL = {};
-export async function analyzeFile(filePath, content, baseDir) {
-    const inicio = performance.now();
-    const relPath = baseDir ? path.relative(baseDir, filePath) : path.basename(filePath);
-    if (!extensaoRelevante(relPath)) {
-        return { ocorrencias: [], arquivo: relPath, tempoMs: 0 };
-    }
-    const ext = path.extname(filePath).toLowerCase();
-    const parsed = await decifrarSintaxe(content, ext, { relPath });
-    const ast = parsed ? AST_SENTINEL : null;
-    const tecnicas = await carregarTecnicas();
-    const tecnicasFile = tecnicasParaArquivo(tecnicas, relPath);
-    if (tecnicasFile.length === 0) {
-        return { ocorrencias: [], arquivo: relPath, tempoMs: performance.now() - inicio };
-    }
-    const ocorrencias = [];
-    for (const tecnica of tecnicasFile) {
-        try {
-            const resultado = await tecnica.aplicar(content, relPath, ast, filePath);
-            if (Array.isArray(resultado)) {
-                ocorrencias.push(...resultado);
-            }
-            else if (resultado) {
-                ocorrencias.push(resultado);
-            }
-        }
-        catch {
-            // Silencia erros por analista
-        }
-    }
-    return {
-        ocorrencias,
-        arquivo: relPath,
-        tempoMs: performance.now() - inicio,
-    };
-}
-export async function analyzeProject(projectDir, opts) {
-    const inicio = performance.now();
-    const fileEntries = await scanRepository(projectDir, {
-        includeContent: true,
-    });
-    const entries = Object.values(fileEntries);
-    const fileEntriesComAst = entries.map(f => ({ ...f, ast: undefined }));
-    let filteredEntries = fileEntriesComAst;
-    if (opts?.fast) {
-        filteredEntries = fileEntriesComAst.filter(fe => {
-            const rel = fe.relPath || '';
-            return !rel.includes('node_modules') && !rel.includes('.test.') && !rel.includes('.spec.');
-        });
-    }
-    const tecnicas = await carregarTecnicas();
-    const resultadoExecucao = await executarInquisicao(filteredEntries, tecnicas, projectDir, null, { verbose: false, compact: true, fast: opts?.fast });
-    return {
-        ocorrencias: resultadoExecucao.ocorrencias,
-        totalArquivos: entries.length,
-        tempoMs: performance.now() - inicio,
-    };
-}

package/dist/sdk/index.js

@@ -1,2 +0,0 @@
-export { analyzeFile, analyzeProject } from './analyzer.js';
-export { MahoragaSDK } from './sdk-legacy.js';

package/dist/sdk/sdk-legacy.js

@@ -1,36 +0,0 @@
-// SPDX-License-Identifier: MIT
-import { analistaGithubActions, analistaGithubActionsGlobal, registrarDetectorGithubActions } from '../analysts/github-actions/index.js';
-/**
- * Mahoraga SDK Principal
- * Fornece acesso programático aos analistas e sistema de plugins
- */
-export const MahoragaSDK = {
-    /**
-     * Analisa um conteúdo de workflow individual
-     */
-    async analisarGithubActions(conteudo, relPath = '.github/workflows/main.yml') {
-        try {
-            const res = await analistaGithubActions.aplicar(conteudo, relPath, null, undefined, undefined);
-            return Array.isArray(res) ? res : [];
-        }
-        catch {
-            return [];
-        }
-    },
-    /**
-     * Analisa um repositório completo (Contexto global)
-     */
-    async analisarRepositorio(contexto) {
-        try {
-            const res = await analistaGithubActionsGlobal.aplicar('', '', null, undefined, contexto);
-            return Array.isArray(res) ? res : [];
-        }
-        catch {
-            return [];
-        }
-    },
-    /**
-     * Registra um novo plugin de detector
-     */
-    registrarDetector: registrarDetectorGithubActions
-};

package/dist/types/sdk/analyzer.js

@@ -1 +0,0 @@
-export {};

package/dist/types/sdk/index.js

@@ -1 +0,0 @@
-export * from './analyzer.js';