@vibecheckai/cli 3.2.2 → 3.2.4

package/bin/runners/lib/engines/dead-code-engine.js

@@ -0,0 +1,198 @@
+/**
+ * Dead Code Detection Engine
+ * Uses AST analysis to detect:
+ * - Commented out exports
+ * - Unreachable code after return/throw
+ * - if (false) / if (0) blocks
+ * - Block-commented exports
+ */
+
+const parser = require("@babel/parser");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+
+/**
+ * Parse code with error recovery
+ */
+function parseCode(code, filePath = "") {
+  try {
+    return parser.parse(code, {
+      sourceType: "unambiguous",
+      errorRecovery: true,
+      allowReturnOutsideFunction: true,
+      plugins: [
+        "typescript",
+        "jsx",
+        "dynamicImport",
+        "topLevelAwait",
+        "classProperties",
+        "classPrivateProperties",
+        "decorators-legacy",
+        "exportDefaultFrom",
+        "exportNamespaceFrom",
+        "functionBind",
+        "nullishCoalescingOperator",
+        "optionalChaining",
+        "objectRestSpread",
+      ],
+    });
+  } catch (err) {
+    // Return null on parse error - caller handles gracefully
+    return null;
+  }
+}
+
+/**
+ * Get line number from node
+ */
+function getLineNumber(node, code) {
+  if (!node || !node.loc) return 1;
+  return node.loc.start.line;
+}
+
+/**
+ * Check if a comment contains an export statement
+ */
+function commentHasExport(comment) {
+  const text = comment.value || "";
+  return /export\s+(const|function|class|interface|type|enum|default)/.test(text);
+}
+
+/**
+ * Analyze a file for dead code patterns
+ */
+function analyzeDeadCode(code, filePath) {
+  const findings = [];
+  
+  // Skip excluded files
+  if (shouldExcludeFile(filePath)) return findings;
+  
+  const ast = getAST(code, filePath);
+  if (!ast) return findings;
+
+  const lines = code.split("\n");
+  const comments = ast.comments || [];
+
+  // Track commented exports
+  for (const comment of comments) {
+    if (commentHasExport(comment)) {
+      const line = comment.loc.start.line;
+      const isBlockComment = comment.type === "CommentBlock";
+      
+      findings.push({
+        type: isBlockComment ? "block_commented_export" : "commented_export",
+        severity: "WARN",
+        category: "DeadCode",
+        file: filePath,
+        line,
+        column: comment.loc.start.column,
+        title: `${isBlockComment ? "Block-commented" : "Commented"} export found`,
+        message: `Export statement found in ${isBlockComment ? "block" : "line"} comment at line ${line}`,
+        codeSnippet: lines[line - 1]?.trim(),
+        confidence: "high",
+      });
+    }
+  }
+
+  // AST traversal for structural dead code
+  traverse(ast, {
+    // Detect if (false) and if (0) blocks
+    IfStatement(path) {
+      const test = path.node.test;
+      
+      // Check for if (false) or if (0)
+      if (t.isBooleanLiteral(test) && test.value === false) {
+        const line = getLineNumber(path.node, code);
+        findings.push({
+          type: "if_false_block",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line,
+          column: path.node.loc.start.column,
+          title: "if (false) block detected",
+          message: "Code block that will never execute",
+          codeSnippet: lines[line - 1]?.trim(),
+          confidence: "high",
+        });
+      } else if (t.isNumericLiteral(test) && test.value === 0) {
+        const line = getLineNumber(path.node, code);
+        findings.push({
+          type: "if_zero_block",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line,
+          column: path.node.loc.start.column,
+          title: "if (0) block detected",
+          message: "Code block that will never execute",
+          codeSnippet: lines[line - 1]?.trim(),
+          confidence: "high",
+        });
+      }
+    },
+
+    // Detect unreachable code after return
+    ReturnStatement(path) {
+      const nextSibling = path.getNextSibling();
+      if (nextSibling && nextSibling.node) {
+        const returnLine = getLineNumber(path.node, code);
+        const nextLine = getLineNumber(nextSibling.node, code);
+        
+        // Check if there's code on the same line or immediately after
+        if (nextLine === returnLine || nextLine === returnLine + 1) {
+          // Make sure it's not just a closing brace
+          if (!t.isBlockStatement(nextSibling.node.parent) || 
+              !t.isExpressionStatement(nextSibling.node)) {
+            findings.push({
+              type: "unreachable_after_return",
+              severity: "WARN",
+              category: "DeadCode",
+              file: filePath,
+              line: nextLine,
+              column: nextSibling.node.loc.start.column,
+              title: "Unreachable code after return statement",
+              message: `Code at line ${nextLine} appears unreachable after return at line ${returnLine}`,
+              codeSnippet: lines[nextLine - 1]?.trim(),
+              confidence: "med",
+            });
+          }
+        }
+      }
+    },
+
+    // Detect unreachable code after throw
+    ThrowStatement(path) {
+      const nextSibling = path.getNextSibling();
+      if (nextSibling && nextSibling.node) {
+        const throwLine = getLineNumber(path.node, code);
+        const nextLine = getLineNumber(nextSibling.node, code);
+        
+        if (nextLine === throwLine || nextLine === throwLine + 1) {
+          if (!t.isBlockStatement(nextSibling.node.parent) || 
+              !t.isExpressionStatement(nextSibling.node)) {
+            findings.push({
+              type: "unreachable_after_throw",
+              severity: "WARN",
+              category: "DeadCode",
+              file: filePath,
+              line: nextLine,
+              column: nextSibling.node.loc.start.column,
+              title: "Unreachable code after throw statement",
+              message: `Code at line ${nextLine} appears unreachable after throw at line ${throwLine}`,
+              codeSnippet: lines[nextLine - 1]?.trim(),
+              confidence: "med",
+            });
+          }
+        }
+      }
+    },
+  });
+
+  return findings;
+}
+
+module.exports = {
+  analyzeDeadCode,
+  parseCode,
+};

package/bin/runners/lib/engines/deprecated-api-engine.js

@@ -0,0 +1,226 @@
+/**
+ * Deprecated API Detection Engine
+ * Uses AST analysis to detect deprecated API usage
+ */
+
+const { getAST, parseCode } = require("./ast-cache");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+const { shouldExcludeFile } = require("./file-filter");
+
+/**
+ * Deprecated API patterns with metadata
+ */
+const DEPRECATED_APIS = [
+  {
+    name: "componentWillMount",
+    type: "react_lifecycle",
+    severity: "WARN",
+    message: "componentWillMount is deprecated in React. Use componentDidMount or useEffect instead.",
+    replacement: "componentDidMount / useEffect",
+  },
+  {
+    name: "componentWillReceiveProps",
+    type: "react_lifecycle",
+    severity: "WARN",
+    message: "componentWillReceiveProps is deprecated. Use getDerivedStateFromProps or componentDidUpdate instead.",
+    replacement: "getDerivedStateFromProps / componentDidUpdate",
+  },
+  {
+    name: "componentWillUpdate",
+    type: "react_lifecycle",
+    severity: "WARN",
+    message: "componentWillUpdate is deprecated. Use getSnapshotBeforeUpdate instead.",
+    replacement: "getSnapshotBeforeUpdate",
+  },
+  {
+    name: "getInitialProps",
+    type: "nextjs_api",
+    severity: "WARN",
+    message: "getInitialProps is legacy Next.js API. Use getServerSideProps or getStaticProps instead.",
+    replacement: "getServerSideProps / getStaticProps",
+  },
+  {
+    name: "substr",
+    type: "string_method",
+    severity: "WARN",
+    message: "String.substr() is deprecated. Use String.slice() instead.",
+    replacement: "String.slice()",
+  },
+  {
+    name: "document.write",
+    type: "dom_api",
+    severity: "WARN",
+    message: "document.write is deprecated and can cause performance issues.",
+    replacement: "DOM manipulation methods",
+  },
+  {
+    name: "new Buffer",
+    type: "node_api",
+    severity: "WARN",
+    message: "new Buffer() is deprecated due to security concerns. Use Buffer.from() instead.",
+    replacement: "Buffer.from()",
+  },
+  {
+    name: "fs.exists",
+    type: "node_api",
+    severity: "WARN",
+    message: "fs.exists is deprecated. Use fs.access() or fs.stat() instead.",
+    replacement: "fs.access() / fs.stat()",
+  },
+  {
+    name: "__proto__",
+    type: "object_property",
+    severity: "WARN",
+    message: "__proto__ is deprecated. Use Object.getPrototypeOf() or Object.setPrototypeOf() instead.",
+    replacement: "Object.getPrototypeOf() / Object.setPrototypeOf()",
+  },
+];
+
+/**
+ * Check if a member expression matches a deprecated API
+ */
+function isDeprecatedMemberExpression(node, deprecatedApi) {
+  if (!t.isMemberExpression(node)) return false;
+  
+  const property = node.property;
+  if (!t.isIdentifier(property)) return false;
+  
+  return property.name === deprecatedApi.name;
+}
+
+/**
+ * Check if a call expression uses deprecated API
+ */
+function isDeprecatedCall(node, deprecatedApi) {
+  if (!t.isCallExpression(node)) return false;
+  
+  const callee = node.callee;
+  
+  // Check for direct calls like substr()
+  if (t.isMemberExpression(callee)) {
+    return isDeprecatedMemberExpression(callee, deprecatedApi);
+  }
+  
+  // Check for identifier calls like getInitialProps()
+  if (t.isIdentifier(callee) && callee.name === deprecatedApi.name) {
+    return true;
+  }
+  
+  // Check for new Buffer()
+  if (deprecatedApi.name === "new Buffer" && t.isNewExpression(node)) {
+    const callee = node.callee;
+    if (t.isIdentifier(callee) && callee.name === "Buffer") {
+      return true;
+    }
+  }
+  
+  return false;
+}
+
+/**
+ * Check if a property access uses deprecated API
+ */
+function isDeprecatedProperty(node, deprecatedApi) {
+  if (deprecatedApi.name === "__proto__") {
+    return t.isMemberExpression(node) &&
+           t.isIdentifier(node.property) &&
+           node.property.name === "__proto__";
+  }
+  
+  return false;
+}
+
+/**
+ * Analyze a file for deprecated API usage
+ */
+function analyzeDeprecatedApis(code, filePath) {
+  const findings = [];
+  
+  // Skip excluded files
+  if (shouldExcludeFile(filePath)) return findings;
+  
+  const ast = getAST(code, filePath);
+  if (!ast) return findings;
+
+  const lines = code.split("\n");
+
+  for (const deprecatedApi of DEPRECATED_APIS) {
+    traverse(ast, {
+      // Check call expressions
+      CallExpression(path) {
+        if (isDeprecatedCall(path.node, deprecatedApi)) {
+          const line = getLineNumber(path.node, code);
+          findings.push({
+            type: deprecatedApi.type,
+            severity: deprecatedApi.severity,
+            category: "DeprecatedApi",
+            file: filePath,
+            line,
+            column: path.node.loc.start.column,
+            title: `Deprecated API: ${deprecatedApi.name}`,
+            message: deprecatedApi.message,
+            codeSnippet: lines[line - 1]?.trim(),
+            replacement: deprecatedApi.replacement,
+            confidence: "high",
+          });
+        }
+      },
+
+      // Check new expressions (for new Buffer)
+      NewExpression(path) {
+        if (deprecatedApi.name === "new Buffer" && 
+            t.isIdentifier(path.node.callee) && 
+            path.node.callee.name === "Buffer") {
+          const line = getLineNumber(path.node, code);
+          findings.push({
+            type: deprecatedApi.type,
+            severity: deprecatedApi.severity,
+            category: "DeprecatedApi",
+            file: filePath,
+            line,
+            column: path.node.loc.start.column,
+            title: `Deprecated API: ${deprecatedApi.name}`,
+            message: deprecatedApi.message,
+            codeSnippet: lines[line - 1]?.trim(),
+            replacement: deprecatedApi.replacement,
+            confidence: "high",
+          });
+        }
+      },
+
+      // Check member expressions (for __proto__, document.write, etc.)
+      MemberExpression(path) {
+        if (isDeprecatedProperty(path.node, deprecatedApi)) {
+          const line = getLineNumber(path.node, code);
+          findings.push({
+            type: deprecatedApi.type,
+            severity: deprecatedApi.severity,
+            category: "DeprecatedApi",
+            file: filePath,
+            line,
+            column: path.node.loc.start.column,
+            title: `Deprecated API: ${deprecatedApi.name}`,
+            message: deprecatedApi.message,
+            codeSnippet: lines[line - 1]?.trim(),
+            replacement: deprecatedApi.replacement,
+            confidence: "high",
+          });
+        }
+      },
+    });
+  }
+
+  return findings;
+}
+
+function getLineNumber(node, code) {
+  if (!node || !node.loc) return 1;
+  return node.loc.start.line;
+}
+
+module.exports = {
+  analyzeDeprecatedApis,
+  parseCode,
+  DEPRECATED_APIS,
+};

package/bin/runners/lib/engines/empty-catch-engine.js

@@ -0,0 +1,150 @@
+/**
+ * Empty Catch Block Detection Engine
+ * Uses AST analysis to detect empty or effectively empty catch blocks
+ */
+
+const { getAST, parseCode } = require("./ast-cache");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+
+/**
+ * Check if a catch block is effectively empty
+ */
+function isEmptyCatchBlock(block) {
+  if (!t.isBlockStatement(block)) return false;
+  
+  const statements = block.body;
+  if (statements.length === 0) return true;
+  
+  // Check if all statements are just comments or empty expressions
+  for (const stmt of statements) {
+    if (t.isExpressionStatement(stmt)) {
+      // Check if it's just a comment or empty
+      if (stmt.expression && !t.isCallExpression(stmt.expression) && 
+          !t.isAssignmentExpression(stmt.expression)) {
+        continue;
+      }
+    }
+    // If we find any real statement, it's not empty
+    if (!t.isEmptyStatement(stmt)) {
+      return false;
+    }
+  }
+  
+  return true;
+}
+
+/**
+ * Check if catch block only has comments
+ */
+function onlyHasComments(block, code) {
+  if (!t.isBlockStatement(block)) return false;
+  
+  const statements = block.body;
+  if (statements.length === 0) return true;
+  
+  // Get all comments in the block
+  const blockStart = block.loc.start;
+  const blockEnd = block.loc.end;
+  const blockText = code.substring(
+    code.indexOf('\n', code.lastIndexOf('\n', blockStart.index)) + 1,
+    blockEnd.index
+  );
+  
+  // Remove all whitespace and comments
+  const withoutComments = blockText
+    .replace(/\/\/.*$/gm, '')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\s+/g, '')
+    .replace(/[{}]/g, '');
+  
+  return withoutComments.length === 0;
+}
+
+/**
+ * Analyze a file for empty catch blocks
+ */
+function analyzeEmptyCatch(code, filePath) {
+  const findings = [];
+  
+  // Skip excluded files
+  const { shouldExcludeFile } = require("./file-filter");
+  if (shouldExcludeFile(filePath)) return findings;
+  
+  const ast = getAST(code, filePath);
+  if (!ast) return findings;
+
+  const lines = code.split("\n");
+
+  traverse(ast, {
+    CatchClause(path) {
+      const catchNode = path.node;
+      const body = catchNode.body;
+      
+      if (!body) return;
+      
+      // Check if completely empty
+      if (isEmptyCatchBlock(body)) {
+        const line = catchNode.loc.start.line;
+        findings.push({
+          type: "empty_catch",
+          severity: "WARN",
+          category: "EmptyCatch",
+          file: filePath,
+          line,
+          column: catchNode.loc.start.column,
+          title: "Empty catch block",
+          message: "Catch block contains no error handling code",
+          codeSnippet: lines[line - 1]?.trim(),
+          confidence: "high",
+        });
+        return;
+      }
+      
+      // Check if only has comments - but allow console.error/warn and return/throw
+      const statements = body.body || [];
+      const hasRealHandling = statements.some(stmt => {
+        // Allow return statements
+        if (t.isReturnStatement(stmt)) return true;
+        // Allow throw statements
+        if (t.isThrowStatement(stmt)) return true;
+        // Allow console.error/warn (logging is acceptable error handling)
+        if (t.isExpressionStatement(stmt) && t.isCallExpression(stmt.expression)) {
+          const callee = stmt.expression.callee;
+          if (t.isMemberExpression(callee) && 
+              t.isIdentifier(callee.object, { name: "console" }) &&
+              t.isIdentifier(callee.property)) {
+            if (["error", "warn"].includes(callee.property.name)) {
+              return true; // This is acceptable error handling
+            }
+          }
+        }
+        return false;
+      });
+      
+      // Only flag if it truly has no handling
+      if (!hasRealHandling && onlyHasComments(body, code)) {
+        const line = catchNode.loc.start.line;
+        findings.push({
+          type: "comment_only_catch",
+          severity: "WARN",
+          category: "EmptyCatch",
+          file: filePath,
+          line,
+          column: catchNode.loc.start.column,
+          title: "Catch block with only comments",
+          message: "Catch block contains only comments, no actual error handling",
+          codeSnippet: lines[line - 1]?.trim(),
+          confidence: "med",
+        });
+      }
+    },
+  });
+
+  return findings;
+}
+
+module.exports = {
+  analyzeEmptyCatch,
+  parseCode,
+};

package/bin/runners/lib/engines/file-filter.js

@@ -0,0 +1,131 @@
+/**
+ * File Filter - Centralized filtering logic to reduce false positives
+ */
+
+/**
+ * Check if file should be excluded from analysis
+ */
+function shouldExcludeFile(filePath) {
+  const excludePatterns = [
+    // Test files
+    /\.test\./i,
+    /\.spec\./i,
+    /__tests__/i,
+    /__mocks__/i,
+    /\/test\//i,
+    /\/tests\//i,
+    /\/e2e\//i,
+    
+    // Config files
+    /\.config\./i,
+    /config\./i,
+    /jest\.config/i,
+    /vitest\.config/i,
+    /vite\.config/i,
+    /next\.config/i,
+    /tailwind\.config/i,
+    /postcss\.config/i,
+    /playwright\.config/i,
+    /webpack\.config/i,
+    /rollup\.config/i,
+    
+    // Build/output directories
+    /\/node_modules\//i,
+    /\/\.next\//i,
+    /\/dist\//i,
+    /\/build\//i,
+    /\/\.turbo\//i,
+    /\/coverage\//i,
+    /\/\.cache\//i,
+    
+    // Scripts and CLI tools (console.log is expected)
+    /\/bin\//i,
+    /\/scripts\//i,
+    /cli\.js$/i,
+    /cli-.*\.js$/i,
+    /scan\.js$/i,
+    /gate\.js$/i,
+    /badge\.js$/i,
+    
+    // Examples and demos
+    /\/examples\//i,
+    /\/demo\//i,
+    /\/demo-repos\//i,
+    /\/showcase\//i,
+    
+    // Documentation
+    /\.md$/i,
+    /\/docs\//i,
+    
+    // Type definitions
+    /\.d\.ts$/i,
+    
+    // MCP server (uses mocks for demos)
+    /\/mcp-server\//i,
+    
+    // Audit/scanner scripts themselves
+    /audit-.*\.js$/i,
+    /scan-.*\.js$/i,
+    /-scanner\./i,
+    /-detector\./i,
+    
+    // Example/template files
+    /\.example$/i,
+    /\.template$/i,
+    /\.env\.example$/i,
+    
+    // Pattern definition files (they define what to detect)
+    /patterns\.ts$/i,
+    /patterns\.js$/i,
+    /secret-patterns\./i,
+    /detection-patterns\./i,
+    
+    // Security suite files (contain pattern definitions)
+    /-suite\.ts$/i,
+    /security-suite\.ts$/i,
+  ];
+  
+  return excludePatterns.some(pattern => pattern.test(filePath));
+}
+
+/**
+ * Check if code is in a test context (even if file isn't excluded)
+ */
+function isTestContext(code, filePath) {
+  // Check for test framework imports
+  const testFrameworks = [
+    /from\s+['"]vitest['"]/i,
+    /from\s+['"]@testing-library/i,
+    /require\s*\(\s*['"]jest['"]/i,
+    /require\s*\(\s*['"]mocha['"]/i,
+    /describe\s*\(/i,
+    /it\s*\(/i,
+    /test\s*\(/i,
+    /expect\s*\(/i,
+  ];
+  
+  return testFrameworks.some(pattern => pattern.test(code));
+}
+
+/**
+ * Check if file is a config/setup file
+ */
+function isConfigFile(filePath) {
+  const configPatterns = [
+    /setup\./i,
+    /config\./i,
+    /\.config\./i,
+    /jest/i,
+    /vitest/i,
+    /eslint/i,
+    /prettier/i,
+  ];
+  
+  return configPatterns.some(pattern => pattern.test(filePath));
+}
+
+module.exports = {
+  shouldExcludeFile,
+  isTestContext,
+  isConfigFile,
+};