@opensip-cli/checks-typescript 0.1.9 → 0.1.11

package/dist/checks/quality/patterns/toctou-race-condition.js

@@ -1,147 +1,15 @@
-// @fitness-ignore-file file-length-limit -- cohesive single-check module; splitting risks breaking the detector contract
 /**
  * @fileoverview TOCTOU Race Condition Detection Check
  *
  * Detects Time-of-Check-Time-of-Use race conditions where data is read,
  * then updated without passing version/condition for atomic updates.
- *
- * Refinement notes (Wave E lane E6-redo):
- * The original implementation was a regex-only test for the presence of
- * `.get/.find/...` and `.update/.set/...` strings inside the same function
- * body. That broad pattern produced false positives on:
- *   - Local `Map.get` / `Map.set` accumulator idioms (count++ via map).
- *   - In-process cache fields (`this.#cache.get` then `this.#cache.set`)
- *     used as single-threaded coalescing structures.
- *   - Read-only DB functions that build local Maps for grouping
- *     (`db.select(...)` → `new Map().set(...)`).
- *   - Single-statement atomic SQL writes (`tx.execute(sql`UPDATE...`)`).
- *
- * Refinement strategy: classify each `.get/.set/.update/...` call by its
- * receiver. A function only flags as TOCTOU if there is at least one
- * read+update pair on a *non-local* receiver (i.e. not a local Map/Set,
- * not a "Cache"-named field, and not a tx/db where writes are atomic
- * SQL). All-local-receiver patterns are excluded.
  */
-import { defineCheck, getCheckConfig, isTestFile } from '@opensip-cli/fitness';
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
 import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
 import * as ts from 'typescript';
-/** Patterns that indicate proper atomic update handling */
-const ATOMIC_PATTERNS = [
-    /expectedVersion/i,
-    /version\s*:/,
-    /ConditionExpression/,
-    /conditionalUpdate/i,
-    /atomicUpdate/i,
-    /compareAndSwap/i,
-    /optimisticLock/i,
-    /CONCURRENCY SAFE/,
-    // Transaction patterns
-    /transaction/i,
-    /beginTransaction/i,
-    /withTransaction/i,
-    /runInTransaction/i,
-    // Lock patterns
-    /acquireLock/i,
-    /withLock/i,
-    /mutex/i,
-    // Idempotency patterns
-    /idempotent/i,
-    /idempotencyKey/i,
-    // Single-threaded/in-memory safety comments
-    /single-threaded/i,
-    /in-memory/i,
-    /atomic in.*Node/i,
-    // Documented coalescing/event-loop safety patterns commonly used in Node single-threaded code
-    /single-threaded coalesce/i, // explicit coalescing-cache documentation
-    /Node single-threaded/i, // explicit Node single-threaded documentation
-    /event-loop semantics/i, // explicit event-loop atomicity documentation
-];
-/**
- * Paths where TOCTOU is typically not a concern
- * (in-memory caches, rate limiters, local state managers)
- */
-const SAFE_TOCTOU_PATHS = [
-    // In-memory data structures
-    /\/cache\//i,
-    /\/caching\//i,
-    /memory-backend/i,
-    /memory-cache/i,
-    /memory-store/i,
-    /in-memory/i,
-    // Filename conventions — `*-cache.ts` and `*-prefetcher.ts` are
-    // single-threaded coalescing structures by convention (Node event-loop
-    // semantics make the .get-then-.set pattern safe). The path-segment
-    // /cache/ skip above misses files at top of a package's src/ tree.
-    /-cache\.tsx?$/i,
-    /-prefetcher\.tsx?$/i,
-    // Rate limiting (bounded operations)
-    /rate-limit/i,
-    /rate_limit/i,
-    // Local state management
-    /local-storage/i,
-    /local-state/i,
-    /state-manager/i,
-    // CLI/scripts (single user, non-concurrent)
-    // CLI commands use local Map/Set operations that are not shared-state TOCTOU risks.
-    // Server lifecycle TOCTOU issues are better caught by the reentrancy-guard check.
-    /\/cli\//,
-    /\/scripts\//,
-    // Test utilities
-    /\/testing\//,
-    /test-utils/,
-    // Configuration/Registry (startup-time operations)
-    /\/config\//,
-    /\/registry\//,
-    /\/di-registration\//,
-    /\/factories\//,
-    // Route handlers — request-scoped Map/Set ops are not shared-state TOCTOU; route handlers are dominated by Zod.pick/parse and per-request local maps that the regex misreads as TOCTOU.
-    /\/routes\//,
-    // DI composition — fragment graphs construct a per-startup map of providers; not concurrent shared state.
-    /\/di\//,
-    // Schema declarations — Drizzle/Zod schema files are pure declarative builders, no runtime read/update race surface.
-    /\/schema\//,
-    // NOTE: opensip-specific paths (e.g. `/chain-walker/` for audit-chain
-    // walkers) are NOT defaults. They live in opensip's recipe under
-    // `checks.config['toctou-race-condition'].additionalSafeTOCTOUPaths`.
-];
-/**
- * Compile recipe-provided string entries to case-insensitive RegExp values.
- */
-function buildEffectiveSafePaths() {
-    const cfg = getCheckConfig('toctou-race-condition');
-    const extras = (cfg.additionalSafeTOCTOUPaths ?? []).map((src) => new RegExp(src, 'i'));
-    return [...SAFE_TOCTOU_PATHS, ...extras];
-}
-/**
- * Check if a file path is in a safe TOCTOU context. Combines built-in
- * defaults with the recipe-config augmentation.
- */
-function isSafeToctouPath(filePath, safePaths) {
-    return safePaths.some((pattern) => pattern.test(filePath));
-}
-/** Read operation method names */
-const READ_METHODS = new Set([
-    'get',
-    'find',
-    'findOne',
-    'findFirst',
-    'findMany',
-    'getById',
-    'fetch',
-    'load',
-    'read',
-]);
-/** Update operation method names */
-const UPDATE_METHODS = new Set(['update', 'save', 'put', 'set', 'patch', 'modify']);
-/**
- * Check if content has atomic patterns
- */
-function hasAtomicPatterns(content) {
-    return ATOMIC_PATTERNS.some((p) => p.test(content));
-}
-/**
- * Get function name from a function-like node
- */
+import { classifyFunctionCalls } from './toctou-race-condition-classify.js';
+import { collectClassInMemoryFieldNames, collectEnclosingLocalCollectionNames, collectInterfaceCollectionFields, collectLocalCollectionNames, collectLocalObjectCollectionFieldKeys, collectThisCollectionFieldAliases, isFunctionLikeNode, } from './toctou-race-condition-collection.js';
+import { buildEffectiveSafePaths, hasAtomicPatterns, isSafeToctouPath, } from './toctou-race-condition-constants.js';
 function getFunctionNameFromNode(node, sourceFile) {
     if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) {
         return node.name?.getText(sourceFile) ?? 'anonymous';
@@ -154,410 +22,21 @@ function getFunctionNameFromNode(node, sourceFile) {
     }
     return 'anonymous';
 }
-/**
- * Check if node is a function-like node
- */
-function isFunctionLikeNode(node) {
-    return (ts.isFunctionDeclaration(node) ||
-        ts.isMethodDeclaration(node) ||
-        ts.isArrowFunction(node) ||
-        ts.isFunctionExpression(node));
-}
-/**
- * Identify TypeNodes that name an in-memory keyed collection — these are
- * not shared persistent state and read+set on them is not a TOCTOU risk.
- */
-const IN_MEMORY_COLLECTION_TYPE_NAMES = new Set([
-    'Map',
-    'WeakMap',
-    'ReadonlyMap',
-    'Set',
-    'WeakSet',
-    'ReadonlySet',
-]);
-function isInMemoryCollectionTypeNode(typeNode) {
-    if (!typeNode)
-        return false;
-    if (ts.isTypeReferenceNode(typeNode)) {
-        const name = typeNode.typeName;
-        if (ts.isIdentifier(name)) {
-            if (IN_MEMORY_COLLECTION_TYPE_NAMES.has(name.text))
-                return true;
-            // Type names ending in `Cache` (e.g. `SecretsCache`) are an
-            // OpenSIP-wide convention for in-process keyed coalescing
-            // structures. Treating them as local-collection eliminates the
-            // FP class where a service-level `cache: XCache` parameter is
-            // read+written within a function body.
-            if (name.text.endsWith('Cache'))
-                return true;
-        }
-    }
-    return false;
-}
-/**
- * Identify variable initializers that construct an in-memory collection,
- * e.g. `const counts = new Map()`, `new Set<string>()`.
- */
-function isInMemoryCollectionInitializer(init) {
-    if (!init)
-        return false;
-    if (ts.isNewExpression(init) && ts.isIdentifier(init.expression)) {
-        return IN_MEMORY_COLLECTION_TYPE_NAMES.has(init.expression.text);
-    }
-    return false;
-}
-/**
- * Heuristic: a property access like `this.#cache`, `this.headerCache`,
- * `this._cache` is treated as an in-process cache field. The `*Cache`
- * suffix and `_cache` / `#cache` conventions are strong signals that the
- * field is a coalescing in-memory structure (single-threaded Node).
- *
- * This is intentionally narrow: only matches `this.<name>` shapes whose
- * `<name>` has the `Cache` suffix or is exactly `cache`.
- */
-function isInMemoryCacheReceiverText(text) {
-    // strip a leading `#` (private field) and `_` (convention)
-    const normalized = text.replace(/^[#_]/, '');
-    if (normalized === 'cache')
-        return true;
-    if (normalized.endsWith('Cache'))
-        return true;
-    return false;
-}
-/**
- * Collect names of local variables/parameters within a function that
- * refer to in-memory keyed collections (`Map`, `Set`, etc.). Names are
- * matched against the simple receiver of `<name>.get/set/...` calls.
- */
-function collectLocalCollectionNames(node) {
-    const names = new Set();
-    // Parameters typed as Map/Set
-    for (const param of node.parameters) {
-        if (ts.isIdentifier(param.name) && isInMemoryCollectionTypeNode(param.type)) {
-            names.add(param.name.text);
-        }
-    }
-    // Local `const x = new Map()` / `new Set()` declarations anywhere in body.
-    const visit = (n) => {
-        // Don't descend into nested functions — their locals belong to a
-        // different scope.
-        if (n !== node && isFunctionLikeNode(n))
-            return;
-        if (ts.isVariableDeclaration(n) &&
-            ts.isIdentifier(n.name) &&
-            (isInMemoryCollectionInitializer(n.initializer) || isInMemoryCollectionTypeNode(n.type))) {
-            names.add(n.name.text);
-        }
-        ts.forEachChild(n, visit);
-    };
-    if (node.body)
-        visit(node.body);
-    return names;
-}
-/**
- * Collect class-level field names that are initialized to an in-memory
- * collection (`new Map()` / `new Set()`). Used so that `this.#cache`-style
- * access in a method does not look like shared persistent state.
- *
- * Walks up to the containing ClassDeclaration / ClassExpression. Returns
- * the simple field name (no `#` prefix) for matching against
- * `this.<name>.get/set` receivers.
- */
-// eslint-disable-next-line sonarjs/cognitive-complexity -- AST walk over class members: nested type checks reflect the TypeScript AST shape
-function collectClassInMemoryFieldNames(node) {
-    const names = new Set();
-    let cls = node.parent;
-    while (cls && !ts.isClassDeclaration(cls) && !ts.isClassExpression(cls)) {
-        cls = cls.parent;
-    }
-    if (!cls)
-        return names;
-    const classNode = cls;
-    for (const member of classNode.members) {
-        if (ts.isPropertyDeclaration(member)) {
-            const memberName = member.name;
-            let fieldName;
-            if (ts.isIdentifier(memberName)) {
-                fieldName = memberName.text;
-            }
-            else if (ts.isPrivateIdentifier(memberName)) {
-                fieldName = memberName.text.replace(/^#/, '');
-            }
-            if (!fieldName)
-                continue;
-            if (isInMemoryCollectionInitializer(member.initializer) ||
-                isInMemoryCollectionTypeNode(member.type)) {
-                names.add(fieldName);
-            }
-        }
-    }
-    return names;
-}
-/**
- * Index file-local `interface` / `type` declarations to the set of field
- * names whose declared type is an in-memory keyed collection (`Map`/`Set`/…).
- *
- * Used to treat `<stateObj>.<mapField>.get/set(...)` as a *local-collection*
- * access. The "state bag of Maps" pattern — an interface bundling several
- * `Map`/`Set` fields, threaded as a parameter through the steps of an
- * iterative graph / DP algorithm (e.g. Tarjan SCC's `TarjanState`) — is
- * single-threaded in-memory work, not a shared-state read-then-update race.
- * The receiver `state.lowlink` is a *chained* access that the simple-receiver
- * classifier would otherwise treat conservatively as shared.
- */
-function collectInterfaceCollectionFields(sourceFile) {
-    const byType = new Map();
-    const fieldsFrom = (members) => {
-        const fields = new Set();
-        for (const member of members) {
-            if (ts.isPropertySignature(member) &&
-                ts.isIdentifier(member.name) &&
-                isInMemoryCollectionTypeNode(member.type)) {
-                fields.add(member.name.text);
-            }
-        }
-        return fields;
-    };
-    for (const stmt of sourceFile.statements) {
-        if (ts.isInterfaceDeclaration(stmt)) {
-            const fields = fieldsFrom(stmt.members);
-            if (fields.size > 0)
-                byType.set(stmt.name.text, fields);
-        }
-        else if (ts.isTypeAliasDeclaration(stmt) && ts.isTypeLiteralNode(stmt.type)) {
-            const fields = fieldsFrom(stmt.type.members);
-            if (fields.size > 0)
-                byType.set(stmt.name.text, fields);
-        }
-    }
-    return byType;
-}
-/**
- * Collect `<receiver>.<field>` keys for parameters/locals whose declared type
- * is a file-local interface/type that declares `Map`/`Set` fields. Those
- * `<obj>.<field>` accesses behave like local collections (see
- * {@link collectInterfaceCollectionFields}).
- */
-function collectLocalObjectCollectionFieldKeys(node, interfaceCollectionFields) {
-    const keys = new Set();
-    const addFor = (name, typeNode) => {
-        if (!typeNode || !ts.isTypeReferenceNode(typeNode))
-            return;
-        if (!ts.isIdentifier(typeNode.typeName))
-            return;
-        const fields = interfaceCollectionFields.get(typeNode.typeName.text);
-        if (!fields)
-            return;
-        for (const field of fields)
-            keys.add(`${name}.${field}`);
-    };
-    for (const param of node.parameters) {
-        if (ts.isIdentifier(param.name))
-            addFor(param.name.text, param.type);
-    }
-    const visit = (n) => {
-        if (n !== node && isFunctionLikeNode(n))
-            return;
-        if (ts.isVariableDeclaration(n) && ts.isIdentifier(n.name))
-            addFor(n.name.text, n.type);
-        ts.forEachChild(n, visit);
-    };
-    if (node.body)
-        visit(node.body);
-    return keys;
-}
-/** Call-site classification kinds — narrow string literal alias set. */
-const KIND_READ_SHARED = 'read-shared';
-const KIND_UPDATE_SHARED = 'update-shared';
-const KIND_READ_LOCAL = 'read-local';
-const KIND_UPDATE_LOCAL = 'update-local';
-/**
- * Return true if a call expression is `<tx-or-db>.execute(sql\`...\`)`
- * with a single SQL statement — those writes are atomic at the DB layer
- * (single statement, no separate read-then-update window).
- */
-function isAtomicSqlExecute(call) {
-    if (!ts.isPropertyAccessExpression(call.expression))
-        return false;
-    if (call.expression.name.text !== 'execute')
-        return false;
-    const arg = call.arguments[0];
-    if (!arg)
-        return false;
-    if (ts.isTaggedTemplateExpression(arg) && // `sql\`...\``
-        ts.isIdentifier(arg.tag) &&
-        arg.tag.text === 'sql')
-        return true;
-    return false;
-}
-/**
- * Drizzle-style ORM writes. `db.update(table)`, `db.insert(table)`,
- * `db.delete(table)` each produce a single atomic SQL statement when
- * awaited — they are not separate-read-then-update sequences.
- *
- * We treat these as `atomic-sql-write` so the function is not flagged
- * unless there is an *actual* read-then-update on a shared receiver
- * elsewhere.
- */
-const DRIZZLE_ATOMIC_WRITE_METHODS = new Set(['update', 'insert', 'delete']);
-function isDrizzleAtomicWrite(call) {
-    if (!ts.isPropertyAccessExpression(call.expression))
-        return false;
-    const methodName = call.expression.name.text;
-    if (!DRIZZLE_ATOMIC_WRITE_METHODS.has(methodName))
-        return false;
-    // Heuristic: receiver looks like a db/tx (named `db`, `tx`, ends in `Db`/`Tx`).
-    const receiver = call.expression.expression;
-    if (ts.isIdentifier(receiver)) {
-        const r = receiver.text;
-        if (r === 'db' || r === 'tx' || /Db$|Tx$/.test(r))
-            return true;
-    }
-    return false;
-}
-/**
- * Get the simple receiver name from a call expression like
- * `<receiver>.method(...)`. For `this.<name>.method(...)` returns
- * `this.<name>` collapsed; for `<id>.method(...)` returns `<id>`.
- * Returns null if the receiver isn't a simple identifier or this-property.
- */
-function getReceiverName(call) {
-    if (!ts.isPropertyAccessExpression(call.expression))
-        return null;
-    const receiver = call.expression.expression;
-    if (ts.isIdentifier(receiver)) {
-        return { name: receiver.text, isThisField: false };
-    }
-    if (ts.isPropertyAccessExpression(receiver) &&
-        receiver.expression.kind === ts.SyntaxKind.ThisKeyword) {
-        return { name: receiver.name.text, isThisField: true };
-    }
-    // `<id>.<field>.method()` — a dotted receiver key (e.g. `state.lowlink`).
-    // Keying per `<id>.<field>` is strictly more precise than the old
-    // "deep chain → unknown receiver" fallback: a read on `x.a` and an update
-    // on `x.b` no longer collide, and it lets the classifier match a
-    // state-object's Map/Set field against the local-collection key set.
-    if (ts.isPropertyAccessExpression(receiver) && ts.isIdentifier(receiver.expression)) {
-        return { name: `${receiver.expression.text}.${receiver.name.text}`, isThisField: false };
-    }
-    return null;
-}
-/**
- * Classify a single call expression for TOCTOU purposes.
- */
-function classifyCall(call, ctx) {
-    // First, atomic SQL writes anywhere short-circuit.
-    if (isAtomicSqlExecute(call))
-        return { kind: 'atomic-sql-write' };
-    if (isDrizzleAtomicWrite(call))
-        return { kind: 'atomic-sql-write' };
-    if (!ts.isPropertyAccessExpression(call.expression))
-        return { kind: 'unrelated' };
-    const methodName = call.expression.name.text;
-    const isRead = READ_METHODS.has(methodName);
-    const isUpdate = UPDATE_METHODS.has(methodName);
-    if (!isRead && !isUpdate)
-        return { kind: 'unrelated' };
-    const receiver = getReceiverName(call);
-    if (!receiver) {
-        // chained / non-simple receiver — treat as shared
-        return { kind: isRead ? KIND_READ_SHARED : KIND_UPDATE_SHARED };
-    }
-    if (isLocalReceiver(receiver, ctx)) {
-        return { kind: isRead ? KIND_READ_LOCAL : KIND_UPDATE_LOCAL };
-    }
-    return { kind: isRead ? KIND_READ_SHARED : KIND_UPDATE_SHARED };
-}
-/**
- * Decide whether a classified receiver refers to a local in-memory collection
- * (so reads/updates on it are not shared-state TOCTOU). Covers: local
- * `Map`/`Set` names, the `<stateObj>.<mapField>` "state bag" key, `this.<cache>`
- * class fields, and the `cache`-named convention.
- */
-function isLocalReceiver(receiver, ctx) {
-    if (receiver.isThisField) {
-        return ctx.classCacheFields.has(receiver.name) || isInMemoryCacheReceiverText(receiver.name);
-    }
-    return (ctx.localCollections.has(receiver.name) ||
-        // `<stateObj>.<mapField>` dotted key resolved to a file-local interface/
-        // type whose field is a Map/Set — the "state bag" pattern.
-        ctx.localObjectCollectionKeys.has(receiver.name) ||
-        // bare `cache` / `<X>Cache` naming convention.
-        isInMemoryCacheReceiverText(receiver.name));
-}
-/**
- * Walk a function body and classify every call expression.
- *
- * Tracks reads and updates *per receiver* — TOCTOU is fundamentally
- * read-X-then-update-X on the same shared object. A function with a
- * read on receiver A and an update on receiver B is not a TOCTOU.
- */
-/* eslint-disable sonarjs/cognitive-complexity -- TOCTOU classifier and its inner AST visitor: branches reflect AST node taxonomy; flatter shape would hide the read/update pairing logic */
-function classifyFunctionCalls(node, localCollections, classCacheFields, localObjectCollectionKeys) {
-    const ctx = { localCollections, classCacheFields, localObjectCollectionKeys };
-    // receiver-key → { read, update }. Receiver-key is `<name>` for plain
-    // identifiers and `this.<name>` for this-field accesses.
-    const perReceiver = new Map();
-    let hasReadOnUnknownReceiver = false;
-    let hasUpdateOnUnknownReceiver = false;
-    const visit = (n) => {
-        if (n !== node && isFunctionLikeNode(n))
-            return;
-        if (ts.isCallExpression(n)) {
-            const cls = classifyCall(n, ctx);
-            if (cls.kind === 'read-shared' || cls.kind === 'update-shared') {
-                const recv = getReceiverName(n);
-                if (recv) {
-                    const key = recv.isThisField ? `this.${recv.name}` : recv.name;
-                    let entry = perReceiver.get(key);
-                    if (!entry) {
-                        entry = { read: false, update: false };
-                        perReceiver.set(key, entry);
-                    }
-                    if (cls.kind === 'read-shared')
-                        entry.read = true;
-                    else
-                        entry.update = true;
-                }
-                else {
-                    if (cls.kind === 'read-shared')
-                        hasReadOnUnknownReceiver = true;
-                    else
-                        hasUpdateOnUnknownReceiver = true;
-                }
-            }
-        }
-        ts.forEachChild(n, visit);
-    };
-    if (node.body)
-        visit(node.body);
-    for (const entry of perReceiver.values()) {
-        if (entry.read && entry.update) {
-            return { hasSharedReadAndUpdateOnSameReceiver: true };
-        }
-    }
-    // Conservative fallback: if we have unknown-receiver reads paired with
-    // unknown-receiver updates, treat as shared (chained / dynamic call).
-    if (hasReadOnUnknownReceiver && hasUpdateOnUnknownReceiver) {
-        return { hasSharedReadAndUpdateOnSameReceiver: true };
-    }
-    return { hasSharedReadAndUpdateOnSameReceiver: false };
-}
-/**
- * Check a function for TOCTOU patterns
- */
 function checkFunctionForToctou(options) {
     const { node, sourceFile, interfaceCollectionFields } = options;
     if (!node.body)
         return null;
-    // Atomic-comment escape hatch retained from the regex implementation —
-    // a function (or its surrounding scope) that documents single-threaded
-    // / coalescing semantics is treated as safe.
     const funcText = node.getText(sourceFile);
     if (hasAtomicPatterns(funcText))
         return null;
     const localCollections = collectLocalCollectionNames(node);
+    for (const name of collectEnclosingLocalCollectionNames(node)) {
+        localCollections.add(name);
+    }
     const classCacheFields = collectClassInMemoryFieldNames(node);
+    for (const alias of collectThisCollectionFieldAliases(node, classCacheFields)) {
+        localCollections.add(alias);
+    }
     const localObjectCollectionKeys = collectLocalObjectCollectionFieldKeys(node, interfaceCollectionFields);
     const { hasSharedReadAndUpdateOnSameReceiver } = classifyFunctionCalls(node, localCollections, classCacheFields, localObjectCollectionKeys);
     if (!hasSharedReadAndUpdateOnSameReceiver)
@@ -580,13 +59,10 @@ function checkFunctionForToctou(options) {
  */
 export function analyzeFileForToctou(filePath, content) {
     const violations = [];
-    // Skip files in safe TOCTOU paths (caches, rate limiters, CLI, etc.).
-    // Merge built-in defaults with recipe config once per file.
     const safePaths = buildEffectiveSafePaths();
     if (isSafeToctouPath(filePath, safePaths)) {
         return violations;
     }
-    // Skip if the whole file documents atomic / single-threaded semantics.
     if (hasAtomicPatterns(content)) {
         return violations;
     }
@@ -628,9 +104,8 @@ export const toctouRaceCondition = defineCheck({
     tags: ['quality', 'performance', 'best-practices'],
     fileTypes: ['ts'],
     // @fitness-ignore-next-line no-hardcoded-timeouts -- framework default for fitness check execution
-    timeout: 180_000, // 3 minutes - analyzes read-then-update patterns
+    timeout: 180_000,
     analyze(content, filePath) {
-        // Skip test files — TOCTOU patterns in tests are low-risk
         if (isTestFile(filePath))
             return [];
         return analyzeFileForToctou(filePath, content);

package/dist/checks/quality/patterns/toctou-race-condition.js.map

@@ -1 +1 @@
-{"version":3,"file":"toctou-race-condition.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition.ts"],"names":[],"mappings":"AAAA,yHAAyH;AACzH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAejC,2DAA2D;AAC3D,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,aAAa;IACb,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,uBAAuB;IACvB,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,WAAW;IACX,QAAQ;IACR,uBAAuB;IACvB,aAAa;IACb,iBAAiB;IACjB,4CAA4C;IAC5C,kBAAkB;IAClB,YAAY;IACZ,kBAAkB;IAClB,8FAA8F;IAC9F,2BAA2B,EAAE,0CAA0C;IACvE,uBAAuB,EAAE,8CAA8C;IACvE,uBAAuB,EAAE,8CAA8C;CACxE,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,4BAA4B;IAC5B,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,YAAY;IACZ,gEAAgE;IAChE,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,gBAAgB;IAChB,qBAAqB;IACrB,qCAAqC;IACrC,aAAa;IACb,aAAa;IACb,yBAAyB;IACzB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,4CAA4C;IAC5C,oFAAoF;IACpF,kFAAkF;IAClF,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,mDAAmD;IACnD,YAAY;IACZ,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,wLAAwL;IACxL,YAAY;IACZ,0GAA0G;IAC1G,QAAQ;IACR,qHAAqH;IACrH,YAAY;IACZ,sEAAsE;IACtE,iEAAiE;IACjE,sEAAsE;CACvE,CAAC;AAEF;;GAEG;AACH,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,cAAc,CAAe,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,SAA4B;IACtE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kCAAkC;AAClC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,KAAK;IACL,MAAM;IACN,SAAS;IACT,WAAW;IACX,UAAU;IACV,SAAS;IACT,OAAO;IACP,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpF;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAWD;;GAEG;AACH,SAAS,uBAAuB,CAAC,IAAsB,EAAE,UAAyB;IAChF,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC;IACvD,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,OAAO,CACL,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC9B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC5B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QACxB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,KAAK;IACL,SAAS;IACT,aAAa;IACb,KAAK;IACL,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,4BAA4B,CAAC,QAAiC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC/B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,4DAA4D;YAC5D,0DAA0D;YAC1D,+DAA+D;YAC/D,8DAA8D;YAC9D,uCAAuC;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAC,IAA+B;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAAC,IAAY;IAC/C,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,IAAsB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,8BAA8B;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,iEAAiE;QACjE,mBAAmB;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IACE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC3B,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACvB,CAAC,+BAA+B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACxF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,4IAA4I;AAC5I,SAAS,8BAA8B,CAAC,IAAsB;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,GAAG,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAC/B,IAAI,SAA6B,CAAC;YAClC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;YAC9B,CAAC;iBAAM,IAAI,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,IACE,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC;gBACnD,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,EACzC,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gCAAgC,CAAC,UAAyB;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,OAAqC,EAAe,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IACE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC5B,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,EACzC,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,qCAAqC,CAC5C,IAAsB,EACtB,yBAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAQ,EAAE;QACvE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAChD,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAChD,MAAM,kBAAkB,GAAG,eAAwB,CAAC;AACpD,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,iBAAiB,GAAG,cAAuB,CAAC;AAalD;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IACjD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IACE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,eAAe;QACrD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK;QAEtB,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,IAAuB;IACnD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAuB;IAC9C,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,IACE,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QACvC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,0EAA0E;IAC1E,kEAAkE;IAClE,0EAA0E;IAC1E,iEAAiE;IACjE,qEAAqE;IACrE,IAAI,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,IAAuB,EACvB,GAIC;IAED,mDAAmD;IACnD,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAClE,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAEpE,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,kDAAkD;QAClD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAgD,EAChD,GAIC;IAED,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CACL,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvC,yEAAyE;QACzE,2DAA2D;QAC3D,GAAG,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChD,+CAA+C;QAC/C,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,4LAA4L;AAC5L,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,gBAA6B,EAC7B,gBAA6B,EAC7B,yBAAsC;IAEtC,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9E,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,IAAI,wBAAwB,GAAG,KAAK,CAAC;IACrC,IAAI,0BAA0B,GAAG,KAAK,CAAC;IAEvC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC/D,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACjC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;wBACvC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC9B,CAAC;oBACD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;wBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;;wBAC7C,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;wBAAE,wBAAwB,GAAG,IAAI,CAAC;;wBAC3D,0BAA0B,GAAG,IAAI,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,wBAAwB,IAAI,0BAA0B,EAAE,CAAC;QAC3D,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC;AAaD;;GAEG;AACH,SAAS,sBAAsB,CAAC,OAAsC;IACpE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE5B,uEAAuE;IACvE,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,yBAAyB,GAAG,qCAAqC,CACrE,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACF,MAAM,EAAE,oCAAoC,EAAE,GAAG,qBAAqB,CACpE,IAAI,EACJ,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IAEF,IAAI,CAAC,oCAAoC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE3D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS,GAAG,CAAC;QACrB,OAAO,EAAE,aAAa,QAAQ,0DAA0D;QACxF,QAAQ,EAAE,SAAS;QACnB,UAAU,EACR,0JAA0J;QAC5J,KAAK,EAAE,QAAQ;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,yBAAyB,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC1F,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE;;;;;;iCAMc;IAC/B,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC;IAClD,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,mGAAmG;IACnG,OAAO,EAAE,OAAO,EAAE,iDAAiD;IAEnE,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,0DAA0D;QAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"toctou-race-condition.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,iCAAiC,EACjC,kBAAkB,GAEnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sCAAsC,CAAC;AAE9C,SAAS,uBAAuB,CAAC,IAAsB,EAAE,UAAyB;IAChF,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC;IACvD,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAQD,SAAS,sBAAsB,CAAC,OAAsC;IACpE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,oCAAoC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,iCAAiC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC9E,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,yBAAyB,GAAG,qCAAqC,CACrE,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACF,MAAM,EAAE,oCAAoC,EAAE,GAAG,qBAAqB,CACpE,IAAI,EACJ,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IAEF,IAAI,CAAC,oCAAoC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE3D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS,GAAG,CAAC;QACrB,OAAO,EAAE,aAAa,QAAQ,0DAA0D;QACxF,QAAQ,EAAE,SAAS;QACnB,UAAU,EACR,0JAA0J;QAC5J,KAAK,EAAE,QAAQ;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,yBAAyB,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC1F,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE;;;;;;iCAMc;IAC/B,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC;IAClD,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,mGAAmG;IACnG,OAAO,EAAE,OAAO;IAEhB,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/unused-config-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unused-config-options.d.ts","sourceRoot":"","sources":["../../../src/checks/quality/unused-config-options.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AA0PH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sCA2B9B,CAAC"}
+{"version":3,"file":"unused-config-options.d.ts","sourceRoot":"","sources":["../../../src/checks/quality/unused-config-options.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAwPH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sCA0B9B,CAAC"}

package/dist/checks/quality/unused-config-options.js

@@ -1,4 +1,3 @@
-// @fitness-ignore-file toctou-race-condition -- TOCTOU acceptable in this non-concurrent context
 // @fitness-ignore-file unused-config-options -- Config options reserved for future use or environment-specific
 /**
  * @fileoverview Unused Configuration Options Check
@@ -135,7 +134,6 @@ async function collectConfigProperties(files) {
         if (shouldExcludePath(filePath) || !isConfigFilePath(filePath))
             continue;
         try {
-            // @fitness-ignore-next-line performance-anti-patterns -- sequential file reading to control memory; FileAccessor is lazy
             const props = await extractConfigPropertiesFromFile(filePath, files);
             configProperties.push(...props);
             /* v8 ignore next 1 -- defensive catch: parse failures already handled */
@@ -159,7 +157,6 @@ async function countPropertyAccesses(files) {
     const accessCounts = new Map();
     for (const filePath of files.paths) {
         try {
-            // @fitness-ignore-next-line performance-anti-patterns -- sequential file reading to control memory; FileAccessor is lazy
             const content = await files.read(filePath);
             const sourceFile = getSharedSourceFile(filePath, content);
             /* v8 ignore next -- defensive guard */
@@ -236,7 +233,6 @@ export const unusedConfigOptions = defineCheck({
     tags: ['quality', 'code-quality', 'maintainability'],
     fileTypes: ['ts', 'tsx'],
     async analyzeAll(files) {
-        // @fitness-ignore-next-line async-waterfall-detection -- Both scan all files independently; parallelizing would double peak memory by loading file contents twice concurrently
         const configProperties = await collectConfigProperties(files);
         const accessCounts = await countPropertyAccesses(files);
         return findUnusedProperties(configProperties, accessCounts);