@vibecheckai/cli 3.5.0 → 3.5.2

package/bin/runners/lib/engines/vibecheck-engines/lib/dead-code-engine.js

@@ -0,0 +1,198 @@
+/**
+ * Dead Code / Unreachable Code Engine
+ * Finds unreachable statements (after return/throw) and obviously dead branches (if(false)).
+ */
+
+const { getAST, parseCode } = require("./ast-cache");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+const { shouldExcludeFile, isTestContext, hasIgnoreDirective } = require("./file-filter");
+
+function isLiteralFalse(test) {
+  return t.isBooleanLiteral(test, { value: false });
+}
+
+function isLiteralTrue(test) {
+  return t.isBooleanLiteral(test, { value: true });
+}
+
+function firstStatementLoc(path) {
+  if (!path?.node?.loc) return null;
+  return path.node.loc.start;
+}
+
+function snippetForLine(lines, line) {
+  return lines[line - 1] ? lines[line - 1].trim() : "";
+}
+
+function pushFinding(findings, { type, severity, category, file, line, column, title, message, codeSnippet, confidence }) {
+  findings.push({
+    type,
+    severity,
+    category,
+    file,
+    line,
+    column,
+    title,
+    message,
+    codeSnippet,
+    confidence,
+  });
+}
+
+function analyzeDeadCode(code, filePath) {
+  const findings = [];
+
+  if (shouldExcludeFile(filePath)) return findings;
+  if (isTestContext(code, filePath)) return findings;
+  if (hasIgnoreDirective(code, "dead-code")) return findings;
+
+  const ast = getAST(code, filePath);
+  if (!ast) return findings;
+
+  const lines = code.split("\n");
+
+  function reportUnreachableAfter(terminatorPath, reason) {
+    // Only meaningful inside a function / program block
+    const fnParent = terminatorPath.getFunctionParent();
+    if (!fnParent) return;
+
+    const next = terminatorPath.getAllNextSiblings();
+    if (!next || next.length === 0) return;
+
+    const first = next.find((p) => p?.node?.loc && !p.isEmptyStatement());
+    if (!first) return;
+
+    const count = next.filter((p) => p?.node?.loc && (p.isStatement?.() || p.isDeclaration?.())).length;
+    const loc = firstStatementLoc(first);
+    if (!loc) return;
+
+    pushFinding(findings, {
+      type: "unreachable_code",
+      severity: "WARN",
+      category: "DeadCode",
+      file: filePath,
+      line: loc.line,
+      column: loc.column,
+      title: "Unreachable code",
+      message: `${count} statement(s) are unreachable after ${reason}.`,
+      codeSnippet: snippetForLine(lines, loc.line),
+      confidence: "high",
+    });
+  }
+
+  traverse(ast, {
+    IfStatement(path) {
+      const test = path.node.test;
+      if (isLiteralFalse(test) && path.node.consequent?.loc) {
+        const loc = path.node.consequent.loc.start;
+        pushFinding(findings, {
+          type: "dead_branch",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line: loc.line,
+          column: loc.column,
+          title: "Dead branch: if(false)",
+          message: "This branch can never execute.",
+          codeSnippet: snippetForLine(lines, loc.line),
+          confidence: "high",
+        });
+      }
+    },
+
+    ConditionalExpression(path) {
+      const test = path.node.test;
+      if (isLiteralFalse(test) && path.node.consequent?.loc) {
+        const loc = path.node.consequent.loc.start;
+        pushFinding(findings, {
+          type: "dead_branch",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line: loc.line,
+          column: loc.column,
+          title: "Dead branch: condition is always false",
+          message: "Ternary consequent can never execute.",
+          codeSnippet: snippetForLine(lines, loc.line),
+          confidence: "high",
+        });
+      } else if (isLiteralTrue(test) && path.node.alternate?.loc) {
+        const loc = path.node.alternate.loc.start;
+        pushFinding(findings, {
+          type: "dead_branch",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line: loc.line,
+          column: loc.column,
+          title: "Dead branch: condition is always true",
+          message: "Ternary alternate can never execute.",
+          codeSnippet: snippetForLine(lines, loc.line),
+          confidence: "high",
+        });
+      }
+    },
+
+    WhileStatement(path) {
+      if (isLiteralFalse(path.node.test) && path.node.body?.loc) {
+        const loc = path.node.body.loc.start;
+        pushFinding(findings, {
+          type: "dead_loop",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line: loc.line,
+          column: loc.column,
+          title: "Dead loop: while(false)",
+          message: "Loop body can never execute.",
+          codeSnippet: snippetForLine(lines, loc.line),
+          confidence: "high",
+        });
+      }
+    },
+
+    ForStatement(path) {
+      const test = path.node.test;
+      if (test && isLiteralFalse(test) && path.node.body?.loc) {
+        const loc = path.node.body.loc.start;
+        pushFinding(findings, {
+          type: "dead_loop",
+          severity: "WARN",
+          category: "DeadCode",
+          file: filePath,
+          line: loc.line,
+          column: loc.column,
+          title: "Dead loop: for(; false ;)",
+          message: "Loop body can never execute.",
+          codeSnippet: snippetForLine(lines, loc.line),
+          confidence: "high",
+        });
+      }
+    },
+
+    ReturnStatement(path) {
+      reportUnreachableAfter(path, "return");
+    },
+
+    ThrowStatement(path) {
+      reportUnreachableAfter(path, "throw");
+    },
+
+    // Skip continue/break - these are control flow, not dead code
+    // ContinueStatement(path) {
+    //   reportUnreachableAfter(path, "continue");
+    // },
+
+    // BreakStatement(path) {
+    //   reportUnreachableAfter(path, "break");
+    // },
+  });
+
+  return findings;
+}
+
+module.exports = {
+  analyzeDeadCode,
+  parseCode,
+};

package/bin/runners/lib/engines/vibecheck-engines/lib/deprecated-api-engine.js

@@ -0,0 +1,275 @@
+/**
+ * Deprecated API Engine
+ * Detects use of deprecated APIs and patterns.
+ */
+
+const { getAST, parseCode } = require("./ast-cache");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+const { shouldExcludeFile, isTestContext, hasIgnoreDirective } = require("./file-filter");
+
+const REACT_LIFECYCLE_DEPRECATED = new Set([
+  "componentWillMount",
+  "componentWillReceiveProps",
+  "componentWillUpdate",
+  "UNSAFE_componentWillMount",
+  "UNSAFE_componentWillReceiveProps",
+  "UNSAFE_componentWillUpdate",
+]);
+
+function snippetForLine(lines, line) {
+  return lines[line - 1] ? lines[line - 1].trim() : "";
+}
+
+function push(findings, filePath, loc, title, message, confidence = "med") {
+  findings.push({
+    type: "deprecated_api",
+    severity: "WARN",
+    category: "Deprecated",
+    file: filePath,
+    line: loc?.line || 1,
+    column: loc?.column || 0,
+    title,
+    message,
+    codeSnippet: snippetForLine(linesCache.get(filePath) || [], loc?.line || 1),
+    confidence,
+  });
+}
+
+const linesCache = new Map();
+
+function analyzeDeprecatedApi(code, filePath) {
+  const findings = [];
+
+  if (shouldExcludeFile(filePath)) return findings;
+  if (isTestContext(code, filePath)) return findings;
+  if (hasIgnoreDirective(code, "deprecated-api")) return findings;
+
+  const ast = getAST(code, filePath);
+  if (!ast) return findings;
+
+  const lines = code.split("\n");
+  linesCache.set(filePath, lines);
+
+  traverse(ast, {
+    CallExpression(path) {
+      const callee = path.node.callee;
+      const loc = path.node.loc?.start;
+
+      // obj.substr(...)
+      if (
+        t.isMemberExpression(callee) &&
+        t.isIdentifier(callee.property, { name: "substr" }) &&
+        !callee.computed
+      ) {
+        findings.push({
+          type: "deprecated_api",
+          severity: "WARN",
+          category: "Deprecated",
+          file: filePath,
+          line: loc?.line || 1,
+          column: loc?.column || 0,
+          title: "Deprecated String.prototype.substr()",
+          message: "Use slice() or substring() instead of substr().",
+          codeSnippet: snippetForLine(lines, loc?.line || 1),
+          confidence: "high",
+        });
+      }
+
+      // fs.exists(...)
+      if (
+        t.isMemberExpression(callee) &&
+        t.isIdentifier(callee.object, { name: "fs" }) &&
+        t.isIdentifier(callee.property, { name: "exists" }) &&
+        !callee.computed
+      ) {
+        findings.push({
+          type: "deprecated_api",
+          severity: "WARN",
+          category: "Deprecated",
+          file: filePath,
+          line: loc?.line || 1,
+          column: loc?.column || 0,
+          title: "Deprecated fs.exists()",
+          message: "Use fs.access() / fs.promises.access() instead of fs.exists().",
+          codeSnippet: snippetForLine(lines, loc?.line || 1),
+          confidence: "high",
+        });
+      }
+
+      // document.write(...)
+      if (
+        t.isMemberExpression(callee) &&
+        t.isIdentifier(callee.object, { name: "document" }) &&
+        t.isIdentifier(callee.property, { name: "write" }) &&
+        !callee.computed
+      ) {
+        findings.push({
+          type: "deprecated_api",
+          severity: "WARN",
+          category: "Deprecated",
+          file: filePath,
+          line: loc?.line || 1,
+          column: loc?.column || 0,
+          title: "document.write is discouraged",
+          message: "Avoid document.write(). Prefer DOM APIs or framework rendering.",
+          codeSnippet: snippetForLine(lines, loc?.line || 1),
+          confidence: "high",
+        });
+      }
+
+      // Buffer(...) as function
+      if (t.isIdentifier(callee, { name: "Buffer" })) {
+        findings.push({
+          type: "deprecated_api",
+          severity: "WARN",
+          category: "Deprecated",
+          file: filePath,
+          line: loc?.line || 1,
+          column: loc?.column || 0,
+          title: "Deprecated Buffer() constructor",
+          message: "Use Buffer.from() / Buffer.alloc() instead of Buffer().",
+          codeSnippet: snippetForLine(lines, loc?.line || 1),
+          confidence: "high",
+        });
+      }
+    },
+
+    NewExpression(path) {
+      const callee = path.node.callee;
+      const loc = path.node.loc?.start;
+
+      // new Buffer(...)
+      if (t.isIdentifier(callee, { name: "Buffer" })) {
+        findings.push({
+          type: "deprecated_api",
+          severity: "WARN",
+          category: "Deprecated",
+          file: filePath,
+          line: loc?.line || 1,
+          column: loc?.column || 0,
+          title: "Deprecated new Buffer()",
+          message: "Use Buffer.from() / Buffer.alloc() instead of new Buffer().",
+          codeSnippet: snippetForLine(lines, loc?.line || 1),
+          confidence: "high",
+        });
+      }
+    },
+
+    MemberExpression(path) {
+      const loc = path.node.loc?.start;
+      const prop = path.node.property;
+
+      // __proto__ access (either computed or not)
+      const isProto =
+        (!path.node.computed && t.isIdentifier(prop, { name: "__proto__" })) ||
+        (path.node.computed && t.isStringLiteral(prop, { value: "__proto__" }));
+      if (isProto) {
+        findings.push({
+          type: "deprecated_api",
+          severity: "WARN",
+          category: "Deprecated",
+          file: filePath,
+          line: loc?.line || 1,
+          column: loc?.column || 0,
+          title: "Avoid __proto__",
+          message: "Avoid using __proto__. Prefer Object.getPrototypeOf / Object.setPrototypeOf.",
+          codeSnippet: snippetForLine(lines, loc?.line || 1),
+          confidence: "high",
+        });
+      }
+    },
+
+    ClassMethod(path) {
+      const key = path.node.key;
+      if (!t.isIdentifier(key)) return;
+      if (!REACT_LIFECYCLE_DEPRECATED.has(key.name)) return;
+
+      const loc = path.node.loc?.start;
+      findings.push({
+        type: "deprecated_api",
+        severity: "WARN",
+        category: "Deprecated",
+        file: filePath,
+        line: loc?.line || 1,
+        column: loc?.column || 0,
+        title: `Deprecated React lifecycle: ${key.name}`,
+        message: "This lifecycle method is legacy. Prefer componentDidMount/update or hooks.",
+        codeSnippet: snippetForLine(lines, loc?.line || 1),
+        confidence: "med",
+      });
+    },
+
+    ObjectMethod(path) {
+      const key = path.node.key;
+      if (!t.isIdentifier(key)) return;
+      if (!REACT_LIFECYCLE_DEPRECATED.has(key.name)) return;
+
+      const loc = path.node.loc?.start;
+      findings.push({
+        type: "deprecated_api",
+        severity: "WARN",
+        category: "Deprecated",
+        file: filePath,
+        line: loc?.line || 1,
+        column: loc?.column || 0,
+        title: `Deprecated method: ${key.name}`,
+        message: "This method name matches deprecated React lifecycle patterns.",
+        codeSnippet: snippetForLine(lines, loc?.line || 1),
+        confidence: "low",
+      });
+    },
+
+    AssignmentExpression(path) {
+      // Component.getInitialProps = async () => {}
+      if (!t.isMemberExpression(path.node.left)) return;
+      const prop = path.node.left.property;
+      if (path.node.left.computed) return;
+      if (!t.isIdentifier(prop, { name: "getInitialProps" })) return;
+
+      const loc = path.node.loc?.start;
+      findings.push({
+        type: "deprecated_api",
+        severity: "WARN",
+        category: "Deprecated",
+        file: filePath,
+        line: loc?.line || 1,
+        column: loc?.column || 0,
+        title: "Next.js getInitialProps is legacy",
+        message: "Prefer getServerSideProps/getStaticProps or the App Router data fetching.",
+        codeSnippet: snippetForLine(lines, loc?.line || 1),
+        confidence: "med",
+      });
+    },
+
+    ObjectProperty(path) {
+      // { getInitialProps: ... }
+      const key = path.node.key;
+      const isKey =
+        (t.isIdentifier(key) && key.name === "getInitialProps") ||
+        (t.isStringLiteral(key) && key.value === "getInitialProps");
+      if (!isKey) return;
+
+      const loc = path.node.loc?.start;
+      findings.push({
+        type: "deprecated_api",
+        severity: "WARN",
+        category: "Deprecated",
+        file: filePath,
+        line: loc?.line || 1,
+        column: loc?.column || 0,
+        title: "Next.js getInitialProps is legacy",
+        message: "Prefer getServerSideProps/getStaticProps or App Router data fetching.",
+        codeSnippet: snippetForLine(lines, loc?.line || 1),
+        confidence: "low",
+      });
+    },
+  });
+
+  return findings;
+}
+
+module.exports = {
+  analyzeDeprecatedApi,
+  parseCode,
+};

package/bin/runners/lib/engines/vibecheck-engines/lib/empty-catch-engine.js

@@ -0,0 +1,167 @@
+/**
+ * Empty Catch Engine
+ * Flags catch blocks that swallow errors without handling/reporting/rethrowing.
+ */
+
+const { getAST, parseCode } = require("./ast-cache");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+const { shouldExcludeFile, isTestContext, hasIgnoreDirective } = require("./file-filter");
+
+function stripCommentsAndWhitespace(text) {
+  if (!text) return "";
+  // remove /* */ and // comments
+  const noBlock = text.replace(/\/\*[\s\S]*?\*\//g, "");
+  const noLine = noBlock.replace(/\/\/.*$/gm, "");
+  return noLine.replace(/\s+/g, "");
+}
+
+function getCodeSlice(code, node) {
+  if (!node || typeof node.start !== "number" || typeof node.end !== "number") return "";
+  return code.slice(node.start, node.end);
+}
+
+function isAllowedCallExpression(callPath) {
+  const callee = callPath.node.callee;
+
+  // console.error / console.warn
+  if (
+    t.isMemberExpression(callee) &&
+    t.isIdentifier(callee.object, { name: "console" }) &&
+    t.isIdentifier(callee.property) &&
+    ["error", "warn"].includes(callee.property.name)
+  ) {
+    return true;
+  }
+
+  // logger.error / log.error / this.logger.error
+  if (t.isMemberExpression(callee) && t.isIdentifier(callee.property, { name: "error" })) {
+    return true;
+  }
+
+  // Sentry.captureException / captureException / reportError
+  if (t.isIdentifier(callee) && ["captureException", "reportError"].includes(callee.name)) return true;
+
+  if (
+    t.isMemberExpression(callee) &&
+    t.isIdentifier(callee.object, { name: "Sentry" }) &&
+    t.isIdentifier(callee.property, { name: "captureException" })
+  ) {
+    return true;
+  }
+
+  return false;
+}
+
+function catchHasMeaningfulHandling(catchPath) {
+  let ok = false;
+
+  catchPath.traverse({
+    // stop on nested functions
+    Function(inner) {
+      inner.skip();
+    },
+
+    ThrowStatement() {
+      ok = true;
+    },
+
+    ReturnStatement() {
+      // Returning from catch isn't always "handling", but it's at least an explicit behavior.
+      ok = true;
+    },
+
+    CallExpression(p) {
+      if (isAllowedCallExpression(p)) ok = true;
+    },
+  });
+
+  return ok;
+}
+
+function analyzeEmptyCatch(code, filePath) {
+  const findings = [];
+
+  if (shouldExcludeFile(filePath)) return findings;
+  if (isTestContext(code, filePath)) return findings;
+  if (hasIgnoreDirective(code, "empty-catch")) return findings;
+
+  const ast = getAST(code, filePath);
+  if (!ast) return findings;
+
+  const lines = code.split("\n");
+
+  traverse(ast, {
+    CatchClause(path) {
+      const body = path.node.body;
+      if (!body || !body.loc) return;
+
+      const hasStatements = Array.isArray(body.body) && body.body.length > 0;
+
+      // detect comment-only or empty
+      const rawBlock = getCodeSlice(code, body);
+      const stripped = stripCommentsAndWhitespace(rawBlock.replace(/^\{/, "").replace(/\}$/, ""));
+      const isEmptyOrCommentOnly = stripped.length === 0;
+
+      if (!hasStatements && isEmptyOrCommentOnly) {
+        const line = body.loc.start.line;
+        findings.push({
+          type: "empty_catch",
+          severity: "WARN",
+          category: "CodeQuality",
+          file: filePath,
+          line,
+          column: body.loc.start.column,
+          title: "Empty catch block",
+          message: "Catch block swallows errors. Add logging/reporting or rethrow.",
+          codeSnippet: lines[line - 1]?.trim(),
+          confidence: "high",
+        });
+        return;
+      }
+
+      // Even if it has statements, it may still be useless (e.g., only a comment, or empty statements)
+      if (isEmptyOrCommentOnly) {
+        const line = body.loc.start.line;
+        findings.push({
+          type: "empty_catch",
+          severity: "WARN",
+          category: "CodeQuality",
+          file: filePath,
+          line,
+          column: body.loc.start.column,
+          title: "Catch block has no executable handling",
+          message: "Catch block contains no executable statements. Add handling or rethrow.",
+          codeSnippet: lines[line - 1]?.trim(),
+          confidence: "high",
+        });
+        return;
+      }
+
+      // If it does something meaningful (log, report, throw, return), don't flag.
+      if (catchHasMeaningfulHandling(path)) return;
+
+      // Otherwise, treat as weak handling (e.g., assignment, empty statement, etc.)
+      const line = body.loc.start.line;
+      findings.push({
+        type: "weak_catch",
+        severity: "WARN",
+        category: "CodeQuality",
+        file: filePath,
+        line,
+        column: body.loc.start.column,
+        title: "Catch block likely swallows errors",
+        message: "Catch block does not rethrow or log/report the error.",
+        codeSnippet: lines[line - 1]?.trim(),
+        confidence: "med",
+      });
+    },
+  });
+
+  return findings;
+}
+
+module.exports = {
+  analyzeEmptyCatch,
+  parseCode,
+};