@vibecheckai/cli 3.5.0 → 3.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/registry.js +214 -237
- package/bin/runners/cli-utils.js +33 -2
- package/bin/runners/context/analyzer.js +52 -1
- package/bin/runners/context/generators/cursor.js +2 -49
- package/bin/runners/context/git-context.js +3 -1
- package/bin/runners/context/team-conventions.js +33 -7
- package/bin/runners/lib/analysis-core.js +25 -5
- package/bin/runners/lib/analyzers.js +431 -481
- package/bin/runners/lib/default-config.js +127 -0
- package/bin/runners/lib/doctor/modules/security.js +3 -1
- package/bin/runners/lib/engine/ast-cache.js +210 -0
- package/bin/runners/lib/engine/auth-extractor.js +211 -0
- package/bin/runners/lib/engine/billing-extractor.js +112 -0
- package/bin/runners/lib/engine/enforcement-extractor.js +100 -0
- package/bin/runners/lib/engine/env-extractor.js +207 -0
- package/bin/runners/lib/engine/express-extractor.js +208 -0
- package/bin/runners/lib/engine/extractors.js +849 -0
- package/bin/runners/lib/engine/index.js +207 -0
- package/bin/runners/lib/engine/repo-index.js +514 -0
- package/bin/runners/lib/engine/types.js +124 -0
- package/bin/runners/lib/engines/accessibility-engine.js +18 -218
- package/bin/runners/lib/engines/api-consistency-engine.js +30 -335
- package/bin/runners/lib/engines/cross-file-analysis-engine.js +27 -292
- package/bin/runners/lib/engines/empty-catch-engine.js +17 -127
- package/bin/runners/lib/engines/mock-data-engine.js +10 -53
- package/bin/runners/lib/engines/performance-issues-engine.js +36 -176
- package/bin/runners/lib/engines/security-vulnerabilities-engine.js +54 -382
- package/bin/runners/lib/engines/type-aware-engine.js +39 -263
- package/bin/runners/lib/engines/vibecheck-engines/index.js +13 -122
- package/bin/runners/lib/engines/vibecheck-engines/lib/ast-cache.js +164 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/code-quality-engine.js +291 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/console-logs-engine.js +83 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/dead-code-engine.js +198 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/deprecated-api-engine.js +275 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/empty-catch-engine.js +167 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/file-filter.js +217 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/hardcoded-secrets-engine.js +73 -373
- package/bin/runners/lib/engines/vibecheck-engines/lib/mock-data-engine.js +140 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/parallel-processor.js +164 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/performance-issues-engine.js +234 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/type-aware-engine.js +217 -0
- package/bin/runners/lib/engines/vibecheck-engines/lib/unsafe-regex-engine.js +78 -0
- package/bin/runners/lib/entitlements-v2.js +73 -97
- package/bin/runners/lib/error-handler.js +44 -3
- package/bin/runners/lib/error-messages.js +289 -0
- package/bin/runners/lib/evidence-pack.js +7 -1
- package/bin/runners/lib/finding-id.js +69 -0
- package/bin/runners/lib/finding-sorter.js +89 -0
- package/bin/runners/lib/html-proof-report.js +700 -350
- package/bin/runners/lib/missions/plan.js +6 -46
- package/bin/runners/lib/missions/templates.js +0 -232
- package/bin/runners/lib/next-action.js +560 -0
- package/bin/runners/lib/prerequisites.js +149 -0
- package/bin/runners/lib/route-detection.js +137 -68
- package/bin/runners/lib/scan-output.js +91 -76
- package/bin/runners/lib/scan-runner.js +135 -0
- package/bin/runners/lib/schemas/ajv-validator.js +464 -0
- package/bin/runners/lib/schemas/error-envelope.schema.json +105 -0
- package/bin/runners/lib/schemas/finding-v3.schema.json +151 -0
- package/bin/runners/lib/schemas/report-artifact.schema.json +120 -0
- package/bin/runners/lib/schemas/run-request.schema.json +108 -0
- package/bin/runners/lib/schemas/validator.js +27 -0
- package/bin/runners/lib/schemas/verdict.schema.json +140 -0
- package/bin/runners/lib/ship-output-enterprise.js +23 -23
- package/bin/runners/lib/ship-output.js +75 -31
- package/bin/runners/lib/terminal-ui.js +6 -113
- package/bin/runners/lib/truth.js +351 -10
- package/bin/runners/lib/unified-cli-output.js +430 -603
- package/bin/runners/lib/unified-output.js +13 -9
- package/bin/runners/runAIAgent.js +10 -5
- package/bin/runners/runAgent.js +0 -3
- package/bin/runners/runAllowlist.js +389 -0
- package/bin/runners/runApprove.js +0 -33
- package/bin/runners/runAuth.js +73 -45
- package/bin/runners/runCheckpoint.js +51 -11
- package/bin/runners/runClassify.js +85 -21
- package/bin/runners/runContext.js +0 -3
- package/bin/runners/runDoctor.js +41 -28
- package/bin/runners/runEvidencePack.js +362 -0
- package/bin/runners/runFirewall.js +0 -3
- package/bin/runners/runFirewallHook.js +0 -3
- package/bin/runners/runFix.js +66 -76
- package/bin/runners/runGuard.js +18 -411
- package/bin/runners/runInit.js +113 -30
- package/bin/runners/runLabs.js +424 -0
- package/bin/runners/runMcp.js +19 -25
- package/bin/runners/runPolish.js +64 -240
- package/bin/runners/runPromptFirewall.js +12 -5
- package/bin/runners/runProve.js +57 -22
- package/bin/runners/runQuickstart.js +531 -0
- package/bin/runners/runReality.js +59 -68
- package/bin/runners/runReport.js +38 -33
- package/bin/runners/runRuntime.js +8 -5
- package/bin/runners/runScan.js +1413 -190
- package/bin/runners/runShip.js +113 -719
- package/bin/runners/runTruth.js +0 -3
- package/bin/runners/runValidate.js +13 -9
- package/bin/runners/runWatch.js +23 -14
- package/bin/scan.js +6 -1
- package/bin/vibecheck.js +204 -185
- package/mcp-server/deprecation-middleware.js +282 -0
- package/mcp-server/handlers/index.ts +15 -0
- package/mcp-server/handlers/tool-handler.ts +554 -0
- package/mcp-server/index-v1.js +698 -0
- package/mcp-server/index.js +210 -238
- package/mcp-server/lib/cache-wrapper.cjs +383 -0
- package/mcp-server/lib/error-envelope.js +138 -0
- package/mcp-server/lib/executor.ts +499 -0
- package/mcp-server/lib/index.ts +19 -0
- package/mcp-server/lib/rate-limiter.js +166 -0
- package/mcp-server/lib/sandbox.test.ts +519 -0
- package/mcp-server/lib/sandbox.ts +395 -0
- package/mcp-server/lib/types.ts +267 -0
- package/mcp-server/package.json +12 -3
- package/mcp-server/registry/tool-registry.js +794 -0
- package/mcp-server/registry/tools.json +605 -0
- package/mcp-server/registry.test.ts +334 -0
- package/mcp-server/tests/tier-gating.test.js +297 -0
- package/mcp-server/tier-auth.js +378 -45
- package/mcp-server/tools-v3.js +353 -442
- package/mcp-server/tsconfig.json +37 -0
- package/mcp-server/vibecheck-2.0-tools.js +14 -1
- package/package.json +1 -1
- package/bin/runners/lib/agent-firewall/learning/learning-engine.js +0 -849
- package/bin/runners/lib/audit-logger.js +0 -532
- package/bin/runners/lib/authority/authorities/architecture.js +0 -364
- package/bin/runners/lib/authority/authorities/compliance.js +0 -341
- package/bin/runners/lib/authority/authorities/human.js +0 -343
- package/bin/runners/lib/authority/authorities/quality.js +0 -420
- package/bin/runners/lib/authority/authorities/security.js +0 -228
- package/bin/runners/lib/authority/index.js +0 -293
- package/bin/runners/lib/bundle/bundle-intelligence.js +0 -846
- package/bin/runners/lib/cli-charts.js +0 -368
- package/bin/runners/lib/cli-config-display.js +0 -405
- package/bin/runners/lib/cli-demo.js +0 -275
- package/bin/runners/lib/cli-errors.js +0 -438
- package/bin/runners/lib/cli-help-formatter.js +0 -439
- package/bin/runners/lib/cli-interactive-menu.js +0 -509
- package/bin/runners/lib/cli-prompts.js +0 -441
- package/bin/runners/lib/cli-scan-cards.js +0 -362
- package/bin/runners/lib/compliance-reporter.js +0 -710
- package/bin/runners/lib/conductor/index.js +0 -671
- package/bin/runners/lib/easy/README.md +0 -123
- package/bin/runners/lib/easy/index.js +0 -140
- package/bin/runners/lib/easy/interactive-wizard.js +0 -788
- package/bin/runners/lib/easy/one-click-firewall.js +0 -564
- package/bin/runners/lib/easy/zero-config-reality.js +0 -714
- package/bin/runners/lib/engines/async-patterns-engine.js +0 -444
- package/bin/runners/lib/engines/bundle-size-engine.js +0 -433
- package/bin/runners/lib/engines/confidence-scoring.js +0 -276
- package/bin/runners/lib/engines/context-detection.js +0 -264
- package/bin/runners/lib/engines/database-patterns-engine.js +0 -429
- package/bin/runners/lib/engines/duplicate-code-engine.js +0 -354
- package/bin/runners/lib/engines/env-variables-engine.js +0 -458
- package/bin/runners/lib/engines/error-handling-engine.js +0 -437
- package/bin/runners/lib/engines/false-positive-prevention.js +0 -630
- package/bin/runners/lib/engines/framework-adapters/index.js +0 -607
- package/bin/runners/lib/engines/framework-detection.js +0 -508
- package/bin/runners/lib/engines/import-order-engine.js +0 -429
- package/bin/runners/lib/engines/naming-conventions-engine.js +0 -544
- package/bin/runners/lib/engines/noise-reduction-engine.js +0 -452
- package/bin/runners/lib/engines/orchestrator.js +0 -334
- package/bin/runners/lib/engines/react-patterns-engine.js +0 -457
- package/bin/runners/lib/engines/vibecheck-engines/lib/ai-hallucination-engine.js +0 -806
- package/bin/runners/lib/engines/vibecheck-engines/lib/smart-fix-engine.js +0 -577
- package/bin/runners/lib/engines/vibecheck-engines/lib/vibe-score-engine.js +0 -543
- package/bin/runners/lib/engines/vibecheck-engines.js +0 -514
- package/bin/runners/lib/enhanced-features/index.js +0 -305
- package/bin/runners/lib/enhanced-output.js +0 -631
- package/bin/runners/lib/enterprise.js +0 -300
- package/bin/runners/lib/firewall/command-validator.js +0 -351
- package/bin/runners/lib/firewall/config.js +0 -341
- package/bin/runners/lib/firewall/content-validator.js +0 -519
- package/bin/runners/lib/firewall/index.js +0 -101
- package/bin/runners/lib/firewall/path-validator.js +0 -256
- package/bin/runners/lib/intelligence/cross-repo-intelligence.js +0 -817
- package/bin/runners/lib/mcp-utils.js +0 -425
- package/bin/runners/lib/output/index.js +0 -1022
- package/bin/runners/lib/policy-engine.js +0 -652
- package/bin/runners/lib/polish/autofix/accessibility-fixes.js +0 -333
- package/bin/runners/lib/polish/autofix/async-handlers.js +0 -273
- package/bin/runners/lib/polish/autofix/dead-code.js +0 -280
- package/bin/runners/lib/polish/autofix/imports-optimizer.js +0 -344
- package/bin/runners/lib/polish/autofix/index.js +0 -200
- package/bin/runners/lib/polish/autofix/remove-consoles.js +0 -209
- package/bin/runners/lib/polish/autofix/strengthen-types.js +0 -245
- package/bin/runners/lib/polish/backend-checks.js +0 -148
- package/bin/runners/lib/polish/documentation-checks.js +0 -111
- package/bin/runners/lib/polish/frontend-checks.js +0 -168
- package/bin/runners/lib/polish/index.js +0 -71
- package/bin/runners/lib/polish/infrastructure-checks.js +0 -131
- package/bin/runners/lib/polish/library-detection.js +0 -175
- package/bin/runners/lib/polish/performance-checks.js +0 -100
- package/bin/runners/lib/polish/security-checks.js +0 -148
- package/bin/runners/lib/polish/utils.js +0 -203
- package/bin/runners/lib/prompt-builder.js +0 -540
- package/bin/runners/lib/proof-certificate.js +0 -634
- package/bin/runners/lib/reality/accessibility-audit.js +0 -946
- package/bin/runners/lib/reality/api-contract-validator.js +0 -1012
- package/bin/runners/lib/reality/chaos-engineering.js +0 -1084
- package/bin/runners/lib/reality/performance-tracker.js +0 -1077
- package/bin/runners/lib/reality/scenario-generator.js +0 -1404
- package/bin/runners/lib/reality/visual-regression.js +0 -852
- package/bin/runners/lib/reality-profiler.js +0 -717
- package/bin/runners/lib/replay/flight-recorder-viewer.js +0 -1160
- package/bin/runners/lib/review/ai-code-review.js +0 -832
- package/bin/runners/lib/rules/custom-rule-engine.js +0 -985
- package/bin/runners/lib/sbom-generator.js +0 -641
- package/bin/runners/lib/scan-output-enhanced.js +0 -512
- package/bin/runners/lib/security/owasp-scanner.js +0 -939
- package/bin/runners/lib/validators/contract-validator.js +0 -283
- package/bin/runners/lib/validators/dead-export-detector.js +0 -279
- package/bin/runners/lib/validators/dep-audit.js +0 -245
- package/bin/runners/lib/validators/env-validator.js +0 -319
- package/bin/runners/lib/validators/index.js +0 -120
- package/bin/runners/lib/validators/license-checker.js +0 -252
- package/bin/runners/lib/validators/route-validator.js +0 -290
- package/bin/runners/runAuthority.js +0 -528
- package/bin/runners/runConductor.js +0 -772
- package/bin/runners/runContainer.js +0 -366
- package/bin/runners/runEasy.js +0 -410
- package/bin/runners/runIaC.js +0 -372
- package/bin/runners/runVibe.js +0 -791
- package/mcp-server/tools.js +0 -495
|
@@ -1,444 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Async Patterns Engine
|
|
3
|
-
* Detects:
|
|
4
|
-
* - Unhandled promise rejections
|
|
5
|
-
* - Missing await keywords
|
|
6
|
-
* - Promise anti-patterns
|
|
7
|
-
* - Race conditions
|
|
8
|
-
* - Sequential await when parallel is better
|
|
9
|
-
* - Floating promises
|
|
10
|
-
* - async/await misuse
|
|
11
|
-
*/
|
|
12
|
-
|
|
13
|
-
const { getAST } = require("./ast-cache");
|
|
14
|
-
const traverse = require("@babel/traverse").default;
|
|
15
|
-
const t = require("@babel/types");
|
|
16
|
-
const { shouldExcludeFile, isTestContext, hasIgnoreDirective } = require("./file-filter");
|
|
17
|
-
|
|
18
|
-
function snippetForLine(lines, line) {
|
|
19
|
-
return lines[line - 1] ? lines[line - 1].trim() : "";
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
/**
|
|
23
|
-
* Check if a node is a promise-returning call
|
|
24
|
-
*/
|
|
25
|
-
function isPromiseReturning(node) {
|
|
26
|
-
if (!t.isCallExpression(node)) return false;
|
|
27
|
-
|
|
28
|
-
const callee = node.callee;
|
|
29
|
-
|
|
30
|
-
// Promise constructor
|
|
31
|
-
if (t.isNewExpression(node) && t.isIdentifier(node.callee, { name: "Promise" })) {
|
|
32
|
-
return true;
|
|
33
|
-
}
|
|
34
|
-
|
|
35
|
-
// Promise.resolve, Promise.reject, Promise.all, etc.
|
|
36
|
-
if (t.isMemberExpression(callee) && t.isIdentifier(callee.object, { name: "Promise" })) {
|
|
37
|
-
return true;
|
|
38
|
-
}
|
|
39
|
-
|
|
40
|
-
// Common async methods
|
|
41
|
-
if (t.isMemberExpression(callee) && t.isIdentifier(callee.property)) {
|
|
42
|
-
const methodName = callee.property.name;
|
|
43
|
-
const asyncMethods = ["fetch", "then", "catch", "finally", "json", "text", "blob"];
|
|
44
|
-
if (asyncMethods.includes(methodName)) return true;
|
|
45
|
-
}
|
|
46
|
-
|
|
47
|
-
// fetch()
|
|
48
|
-
if (t.isIdentifier(callee, { name: "fetch" })) return true;
|
|
49
|
-
|
|
50
|
-
// axios(), axios.get(), etc.
|
|
51
|
-
if (t.isIdentifier(callee, { name: "axios" })) return true;
|
|
52
|
-
if (t.isMemberExpression(callee) && t.isIdentifier(callee.object, { name: "axios" })) {
|
|
53
|
-
return true;
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
return false;
|
|
57
|
-
}
|
|
58
|
-
|
|
59
|
-
/**
|
|
60
|
-
* Check if expression is awaited or has .then/.catch
|
|
61
|
-
*/
|
|
62
|
-
function isHandled(path) {
|
|
63
|
-
const parent = path.parentPath;
|
|
64
|
-
|
|
65
|
-
// Awaited
|
|
66
|
-
if (parent.isAwaitExpression()) return true;
|
|
67
|
-
|
|
68
|
-
// Has .then or .catch
|
|
69
|
-
if (parent.isMemberExpression() && t.isIdentifier(parent.node.property)) {
|
|
70
|
-
const prop = parent.node.property.name;
|
|
71
|
-
if (prop === "then" || prop === "catch" || prop === "finally") return true;
|
|
72
|
-
}
|
|
73
|
-
|
|
74
|
-
// Returned
|
|
75
|
-
if (parent.isReturnStatement()) return true;
|
|
76
|
-
|
|
77
|
-
// Assigned to variable (might be handled later)
|
|
78
|
-
if (parent.isVariableDeclarator()) return true;
|
|
79
|
-
|
|
80
|
-
// Passed as argument (callback)
|
|
81
|
-
if (parent.isCallExpression()) return true;
|
|
82
|
-
|
|
83
|
-
// Part of Promise.all, Promise.race, etc.
|
|
84
|
-
if (parent.isArrayExpression()) {
|
|
85
|
-
const grandparent = parent.parentPath;
|
|
86
|
-
if (grandparent.isCallExpression()) {
|
|
87
|
-
const callee = grandparent.node.callee;
|
|
88
|
-
if (t.isMemberExpression(callee) && t.isIdentifier(callee.object, { name: "Promise" })) {
|
|
89
|
-
return true;
|
|
90
|
-
}
|
|
91
|
-
}
|
|
92
|
-
}
|
|
93
|
-
|
|
94
|
-
return false;
|
|
95
|
-
}
|
|
96
|
-
|
|
97
|
-
/**
|
|
98
|
-
* Check if inside an async function
|
|
99
|
-
*/
|
|
100
|
-
function isInAsyncFunction(path) {
|
|
101
|
-
const fnParent = path.getFunctionParent();
|
|
102
|
-
return fnParent && fnParent.node.async;
|
|
103
|
-
}
|
|
104
|
-
|
|
105
|
-
/**
|
|
106
|
-
* Analyze async patterns
|
|
107
|
-
*/
|
|
108
|
-
function analyzeAsyncPatterns(code, filePath) {
|
|
109
|
-
const findings = [];
|
|
110
|
-
|
|
111
|
-
if (shouldExcludeFile(filePath)) return findings;
|
|
112
|
-
if (isTestContext(code, filePath)) return findings;
|
|
113
|
-
if (hasIgnoreDirective(code, "async-patterns")) return findings;
|
|
114
|
-
|
|
115
|
-
const ast = getAST(code, filePath);
|
|
116
|
-
if (!ast) return findings;
|
|
117
|
-
|
|
118
|
-
const lines = code.split("\n");
|
|
119
|
-
|
|
120
|
-
// Track sequential awaits that could be parallel
|
|
121
|
-
const sequentialAwaits = new Map(); // fnPath -> [{ line, varName }]
|
|
122
|
-
|
|
123
|
-
traverse(ast, {
|
|
124
|
-
// Check for floating promises (unhandled)
|
|
125
|
-
CallExpression(path) {
|
|
126
|
-
const node = path.node;
|
|
127
|
-
const loc = node.loc?.start;
|
|
128
|
-
if (!loc) return;
|
|
129
|
-
|
|
130
|
-
if (isPromiseReturning(node) && !isHandled(path)) {
|
|
131
|
-
// Check if it's an expression statement (standalone call)
|
|
132
|
-
if (path.parentPath.isExpressionStatement()) {
|
|
133
|
-
findings.push({
|
|
134
|
-
type: "floating_promise",
|
|
135
|
-
severity: "WARN",
|
|
136
|
-
category: "AsyncPatterns",
|
|
137
|
-
file: filePath,
|
|
138
|
-
line: loc.line,
|
|
139
|
-
column: loc.column,
|
|
140
|
-
title: "Floating promise (unhandled)",
|
|
141
|
-
message: "Promise returned but not awaited or handled. Errors may be silently swallowed.",
|
|
142
|
-
codeSnippet: snippetForLine(lines, loc.line),
|
|
143
|
-
confidence: "high",
|
|
144
|
-
fixHint: "Add 'await' or '.catch()' to handle potential errors",
|
|
145
|
-
});
|
|
146
|
-
}
|
|
147
|
-
}
|
|
148
|
-
},
|
|
149
|
-
|
|
150
|
-
// Check for await in non-async function
|
|
151
|
-
AwaitExpression(path) {
|
|
152
|
-
const node = path.node;
|
|
153
|
-
const loc = node.loc?.start;
|
|
154
|
-
if (!loc) return;
|
|
155
|
-
|
|
156
|
-
if (!isInAsyncFunction(path)) {
|
|
157
|
-
// This would be a syntax error, but might slip through in some cases
|
|
158
|
-
findings.push({
|
|
159
|
-
type: "await_outside_async",
|
|
160
|
-
severity: "BLOCK",
|
|
161
|
-
category: "AsyncPatterns",
|
|
162
|
-
file: filePath,
|
|
163
|
-
line: loc.line,
|
|
164
|
-
column: loc.column,
|
|
165
|
-
title: "await outside async function",
|
|
166
|
-
message: "await can only be used inside async functions.",
|
|
167
|
-
codeSnippet: snippetForLine(lines, loc.line),
|
|
168
|
-
confidence: "high",
|
|
169
|
-
fixHint: "Make the containing function async",
|
|
170
|
-
});
|
|
171
|
-
}
|
|
172
|
-
|
|
173
|
-
// Track for sequential await detection
|
|
174
|
-
const fnParent = path.getFunctionParent();
|
|
175
|
-
if (fnParent) {
|
|
176
|
-
if (!sequentialAwaits.has(fnParent)) {
|
|
177
|
-
sequentialAwaits.set(fnParent, []);
|
|
178
|
-
}
|
|
179
|
-
|
|
180
|
-
// Check if it's a variable declaration
|
|
181
|
-
const parent = path.parentPath;
|
|
182
|
-
if (parent.isVariableDeclarator() && t.isIdentifier(parent.node.id)) {
|
|
183
|
-
sequentialAwaits.get(fnParent).push({
|
|
184
|
-
line: loc.line,
|
|
185
|
-
varName: parent.node.id.name,
|
|
186
|
-
argument: path.node.argument,
|
|
187
|
-
});
|
|
188
|
-
}
|
|
189
|
-
}
|
|
190
|
-
},
|
|
191
|
-
|
|
192
|
-
// Check for Promise constructor anti-patterns
|
|
193
|
-
NewExpression(path) {
|
|
194
|
-
const node = path.node;
|
|
195
|
-
const loc = node.loc?.start;
|
|
196
|
-
if (!loc) return;
|
|
197
|
-
|
|
198
|
-
if (t.isIdentifier(node.callee, { name: "Promise" })) {
|
|
199
|
-
const executor = node.arguments[0];
|
|
200
|
-
|
|
201
|
-
if (t.isArrowFunctionExpression(executor) || t.isFunctionExpression(executor)) {
|
|
202
|
-
// Check for async executor (anti-pattern)
|
|
203
|
-
if (executor.async) {
|
|
204
|
-
findings.push({
|
|
205
|
-
type: "async_promise_executor",
|
|
206
|
-
severity: "WARN",
|
|
207
|
-
category: "AsyncPatterns",
|
|
208
|
-
file: filePath,
|
|
209
|
-
line: loc.line,
|
|
210
|
-
column: loc.column,
|
|
211
|
-
title: "Async function as Promise executor",
|
|
212
|
-
message: "Using async function as Promise executor can lead to unhandled rejections.",
|
|
213
|
-
codeSnippet: snippetForLine(lines, loc.line),
|
|
214
|
-
confidence: "high",
|
|
215
|
-
fixHint: "Remove async from executor or restructure to avoid Promise constructor",
|
|
216
|
-
});
|
|
217
|
-
}
|
|
218
|
-
|
|
219
|
-
// Check for return statement in executor (doesn't work as expected)
|
|
220
|
-
let hasReturn = false;
|
|
221
|
-
traverse(executor.body, {
|
|
222
|
-
ReturnStatement(innerPath) {
|
|
223
|
-
// Ignore nested functions
|
|
224
|
-
if (innerPath.getFunctionParent() === path) return;
|
|
225
|
-
hasReturn = true;
|
|
226
|
-
},
|
|
227
|
-
noScope: true,
|
|
228
|
-
}, path.scope);
|
|
229
|
-
|
|
230
|
-
if (hasReturn) {
|
|
231
|
-
findings.push({
|
|
232
|
-
type: "promise_executor_return",
|
|
233
|
-
severity: "INFO",
|
|
234
|
-
category: "AsyncPatterns",
|
|
235
|
-
file: filePath,
|
|
236
|
-
line: loc.line,
|
|
237
|
-
column: loc.column,
|
|
238
|
-
title: "Return in Promise executor",
|
|
239
|
-
message: "Return value in Promise executor is ignored. Use resolve() instead.",
|
|
240
|
-
codeSnippet: snippetForLine(lines, loc.line),
|
|
241
|
-
confidence: "med",
|
|
242
|
-
fixHint: "Use resolve(value) instead of return value",
|
|
243
|
-
});
|
|
244
|
-
}
|
|
245
|
-
}
|
|
246
|
-
}
|
|
247
|
-
},
|
|
248
|
-
|
|
249
|
-
// Check for .then() in async function (prefer await)
|
|
250
|
-
MemberExpression(path) {
|
|
251
|
-
const node = path.node;
|
|
252
|
-
const loc = node.loc?.start;
|
|
253
|
-
if (!loc) return;
|
|
254
|
-
|
|
255
|
-
if (t.isIdentifier(node.property, { name: "then" }) && isInAsyncFunction(path)) {
|
|
256
|
-
// Check if it's being called
|
|
257
|
-
if (path.parentPath.isCallExpression() && path.parentPath.node.callee === node) {
|
|
258
|
-
findings.push({
|
|
259
|
-
type: "then_in_async",
|
|
260
|
-
severity: "INFO",
|
|
261
|
-
category: "AsyncPatterns",
|
|
262
|
-
file: filePath,
|
|
263
|
-
line: loc.line,
|
|
264
|
-
column: loc.column,
|
|
265
|
-
title: ".then() in async function",
|
|
266
|
-
message: "Consider using await instead of .then() in async functions for cleaner code.",
|
|
267
|
-
codeSnippet: snippetForLine(lines, loc.line),
|
|
268
|
-
confidence: "low",
|
|
269
|
-
fixHint: "const result = await promise; instead of promise.then(result => ...)",
|
|
270
|
-
});
|
|
271
|
-
}
|
|
272
|
-
}
|
|
273
|
-
},
|
|
274
|
-
|
|
275
|
-
// Check for Promise.all with await in loop (should be batched)
|
|
276
|
-
ForStatement(path) {
|
|
277
|
-
checkAwaitInLoop(path, findings, filePath, lines);
|
|
278
|
-
},
|
|
279
|
-
ForInStatement(path) {
|
|
280
|
-
checkAwaitInLoop(path, findings, filePath, lines);
|
|
281
|
-
},
|
|
282
|
-
ForOfStatement(path) {
|
|
283
|
-
checkAwaitInLoop(path, findings, filePath, lines);
|
|
284
|
-
},
|
|
285
|
-
WhileStatement(path) {
|
|
286
|
-
checkAwaitInLoop(path, findings, filePath, lines);
|
|
287
|
-
},
|
|
288
|
-
|
|
289
|
-
// Check for missing error handling
|
|
290
|
-
TryStatement(path) {
|
|
291
|
-
const node = path.node;
|
|
292
|
-
const loc = node.loc?.start;
|
|
293
|
-
if (!loc) return;
|
|
294
|
-
|
|
295
|
-
// Check if try block has await but catch is empty
|
|
296
|
-
let hasAwait = false;
|
|
297
|
-
path.traverse({
|
|
298
|
-
AwaitExpression() {
|
|
299
|
-
hasAwait = true;
|
|
300
|
-
},
|
|
301
|
-
});
|
|
302
|
-
|
|
303
|
-
if (hasAwait && node.handler) {
|
|
304
|
-
const catchBody = node.handler.body;
|
|
305
|
-
if (t.isBlockStatement(catchBody) && catchBody.body.length === 0) {
|
|
306
|
-
findings.push({
|
|
307
|
-
type: "empty_async_catch",
|
|
308
|
-
severity: "WARN",
|
|
309
|
-
category: "AsyncPatterns",
|
|
310
|
-
file: filePath,
|
|
311
|
-
line: node.handler.loc?.start.line || loc.line,
|
|
312
|
-
column: 0,
|
|
313
|
-
title: "Empty catch block for async operation",
|
|
314
|
-
message: "Async operation errors are being silently swallowed.",
|
|
315
|
-
codeSnippet: snippetForLine(lines, node.handler.loc?.start.line || loc.line),
|
|
316
|
-
confidence: "high",
|
|
317
|
-
fixHint: "Log or re-throw the error in the catch block",
|
|
318
|
-
});
|
|
319
|
-
}
|
|
320
|
-
}
|
|
321
|
-
},
|
|
322
|
-
});
|
|
323
|
-
|
|
324
|
-
// Analyze sequential awaits
|
|
325
|
-
for (const [fnPath, awaits] of sequentialAwaits) {
|
|
326
|
-
if (awaits.length < 2) continue;
|
|
327
|
-
|
|
328
|
-
// Check for independent awaits that could be parallel
|
|
329
|
-
// This is a heuristic - we look for awaits that don't depend on each other
|
|
330
|
-
const independentGroups = findIndependentAwaits(awaits, code);
|
|
331
|
-
|
|
332
|
-
for (const group of independentGroups) {
|
|
333
|
-
if (group.length >= 2) {
|
|
334
|
-
const firstLine = group[0].line;
|
|
335
|
-
const varNames = group.map(a => a.varName).join(", ");
|
|
336
|
-
|
|
337
|
-
findings.push({
|
|
338
|
-
type: "sequential_await",
|
|
339
|
-
severity: "INFO",
|
|
340
|
-
category: "AsyncPatterns",
|
|
341
|
-
file: filePath,
|
|
342
|
-
line: firstLine,
|
|
343
|
-
column: 0,
|
|
344
|
-
title: `Sequential awaits could be parallel`,
|
|
345
|
-
message: `Variables [${varNames}] are awaited sequentially but appear independent. Consider Promise.all().`,
|
|
346
|
-
codeSnippet: snippetForLine(lines, firstLine),
|
|
347
|
-
confidence: "low",
|
|
348
|
-
fixHint: `const [${varNames}] = await Promise.all([...])`,
|
|
349
|
-
});
|
|
350
|
-
}
|
|
351
|
-
}
|
|
352
|
-
}
|
|
353
|
-
|
|
354
|
-
return findings;
|
|
355
|
-
}
|
|
356
|
-
|
|
357
|
-
/**
|
|
358
|
-
* Check for await in loop
|
|
359
|
-
*/
|
|
360
|
-
function checkAwaitInLoop(path, findings, filePath, lines) {
|
|
361
|
-
const node = path.node;
|
|
362
|
-
const loc = node.loc?.start;
|
|
363
|
-
if (!loc) return;
|
|
364
|
-
|
|
365
|
-
let awaitCount = 0;
|
|
366
|
-
let firstAwaitLine = null;
|
|
367
|
-
|
|
368
|
-
path.traverse({
|
|
369
|
-
AwaitExpression(innerPath) {
|
|
370
|
-
// Skip nested functions
|
|
371
|
-
const fnParent = innerPath.getFunctionParent();
|
|
372
|
-
if (fnParent !== path.getFunctionParent()) return;
|
|
373
|
-
|
|
374
|
-
awaitCount++;
|
|
375
|
-
if (!firstAwaitLine) {
|
|
376
|
-
firstAwaitLine = innerPath.node.loc?.start.line;
|
|
377
|
-
}
|
|
378
|
-
},
|
|
379
|
-
});
|
|
380
|
-
|
|
381
|
-
if (awaitCount > 0) {
|
|
382
|
-
findings.push({
|
|
383
|
-
type: "await_in_loop",
|
|
384
|
-
severity: "INFO",
|
|
385
|
-
category: "AsyncPatterns",
|
|
386
|
-
file: filePath,
|
|
387
|
-
line: firstAwaitLine || loc.line,
|
|
388
|
-
column: 0,
|
|
389
|
-
title: "await inside loop",
|
|
390
|
-
message: `Found ${awaitCount} await(s) in loop. Consider Promise.all() for parallel execution if operations are independent.`,
|
|
391
|
-
codeSnippet: snippetForLine(lines, firstAwaitLine || loc.line),
|
|
392
|
-
confidence: "low",
|
|
393
|
-
fixHint: "const results = await Promise.all(items.map(async item => ...))",
|
|
394
|
-
});
|
|
395
|
-
}
|
|
396
|
-
}
|
|
397
|
-
|
|
398
|
-
/**
|
|
399
|
-
* Find groups of independent awaits
|
|
400
|
-
* This is a simple heuristic - checks if variables reference each other
|
|
401
|
-
*/
|
|
402
|
-
function findIndependentAwaits(awaits, code) {
|
|
403
|
-
const groups = [];
|
|
404
|
-
const used = new Set();
|
|
405
|
-
|
|
406
|
-
for (let i = 0; i < awaits.length; i++) {
|
|
407
|
-
if (used.has(i)) continue;
|
|
408
|
-
|
|
409
|
-
const group = [awaits[i]];
|
|
410
|
-
used.add(i);
|
|
411
|
-
|
|
412
|
-
for (let j = i + 1; j < awaits.length; j++) {
|
|
413
|
-
if (used.has(j)) continue;
|
|
414
|
-
|
|
415
|
-
// Check if awaits[j] depends on any previous result
|
|
416
|
-
const prevVars = group.map(a => a.varName);
|
|
417
|
-
const awaitCode = code.substring(
|
|
418
|
-
awaits[j].argument?.start || 0,
|
|
419
|
-
awaits[j].argument?.end || 0
|
|
420
|
-
);
|
|
421
|
-
|
|
422
|
-
// Simple check: does the await reference previous variables?
|
|
423
|
-
const dependsOnPrev = prevVars.some(v =>
|
|
424
|
-
new RegExp(`\\b${v}\\b`).test(awaitCode)
|
|
425
|
-
);
|
|
426
|
-
|
|
427
|
-
if (!dependsOnPrev) {
|
|
428
|
-
group.push(awaits[j]);
|
|
429
|
-
used.add(j);
|
|
430
|
-
}
|
|
431
|
-
}
|
|
432
|
-
|
|
433
|
-
groups.push(group);
|
|
434
|
-
}
|
|
435
|
-
|
|
436
|
-
return groups.filter(g => g.length >= 2);
|
|
437
|
-
}
|
|
438
|
-
|
|
439
|
-
module.exports = {
|
|
440
|
-
analyzeAsyncPatterns,
|
|
441
|
-
isPromiseReturning,
|
|
442
|
-
isHandled,
|
|
443
|
-
isInAsyncFunction,
|
|
444
|
-
};
|