@vibecheckai/cli 3.5.0 → 3.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (224) hide show
  1. package/bin/registry.js +214 -237
  2. package/bin/runners/cli-utils.js +33 -2
  3. package/bin/runners/context/analyzer.js +52 -1
  4. package/bin/runners/context/generators/cursor.js +2 -49
  5. package/bin/runners/context/git-context.js +3 -1
  6. package/bin/runners/context/team-conventions.js +33 -7
  7. package/bin/runners/lib/analysis-core.js +25 -5
  8. package/bin/runners/lib/analyzers.js +431 -481
  9. package/bin/runners/lib/default-config.js +127 -0
  10. package/bin/runners/lib/doctor/modules/security.js +3 -1
  11. package/bin/runners/lib/engine/ast-cache.js +210 -0
  12. package/bin/runners/lib/engine/auth-extractor.js +211 -0
  13. package/bin/runners/lib/engine/billing-extractor.js +112 -0
  14. package/bin/runners/lib/engine/enforcement-extractor.js +100 -0
  15. package/bin/runners/lib/engine/env-extractor.js +207 -0
  16. package/bin/runners/lib/engine/express-extractor.js +208 -0
  17. package/bin/runners/lib/engine/extractors.js +849 -0
  18. package/bin/runners/lib/engine/index.js +207 -0
  19. package/bin/runners/lib/engine/repo-index.js +514 -0
  20. package/bin/runners/lib/engine/types.js +124 -0
  21. package/bin/runners/lib/engines/accessibility-engine.js +18 -218
  22. package/bin/runners/lib/engines/api-consistency-engine.js +30 -335
  23. package/bin/runners/lib/engines/cross-file-analysis-engine.js +27 -292
  24. package/bin/runners/lib/engines/empty-catch-engine.js +17 -127
  25. package/bin/runners/lib/engines/mock-data-engine.js +10 -53
  26. package/bin/runners/lib/engines/performance-issues-engine.js +36 -176
  27. package/bin/runners/lib/engines/security-vulnerabilities-engine.js +54 -382
  28. package/bin/runners/lib/engines/type-aware-engine.js +39 -263
  29. package/bin/runners/lib/engines/vibecheck-engines/index.js +13 -122
  30. package/bin/runners/lib/engines/vibecheck-engines/lib/ast-cache.js +164 -0
  31. package/bin/runners/lib/engines/vibecheck-engines/lib/code-quality-engine.js +291 -0
  32. package/bin/runners/lib/engines/vibecheck-engines/lib/console-logs-engine.js +83 -0
  33. package/bin/runners/lib/engines/vibecheck-engines/lib/dead-code-engine.js +198 -0
  34. package/bin/runners/lib/engines/vibecheck-engines/lib/deprecated-api-engine.js +275 -0
  35. package/bin/runners/lib/engines/vibecheck-engines/lib/empty-catch-engine.js +167 -0
  36. package/bin/runners/lib/engines/vibecheck-engines/lib/file-filter.js +217 -0
  37. package/bin/runners/lib/engines/vibecheck-engines/lib/hardcoded-secrets-engine.js +73 -373
  38. package/bin/runners/lib/engines/vibecheck-engines/lib/mock-data-engine.js +140 -0
  39. package/bin/runners/lib/engines/vibecheck-engines/lib/parallel-processor.js +164 -0
  40. package/bin/runners/lib/engines/vibecheck-engines/lib/performance-issues-engine.js +234 -0
  41. package/bin/runners/lib/engines/vibecheck-engines/lib/type-aware-engine.js +217 -0
  42. package/bin/runners/lib/engines/vibecheck-engines/lib/unsafe-regex-engine.js +78 -0
  43. package/bin/runners/lib/entitlements-v2.js +73 -97
  44. package/bin/runners/lib/error-handler.js +44 -3
  45. package/bin/runners/lib/error-messages.js +289 -0
  46. package/bin/runners/lib/evidence-pack.js +7 -1
  47. package/bin/runners/lib/finding-id.js +69 -0
  48. package/bin/runners/lib/finding-sorter.js +89 -0
  49. package/bin/runners/lib/html-proof-report.js +700 -350
  50. package/bin/runners/lib/missions/plan.js +6 -46
  51. package/bin/runners/lib/missions/templates.js +0 -232
  52. package/bin/runners/lib/next-action.js +560 -0
  53. package/bin/runners/lib/prerequisites.js +149 -0
  54. package/bin/runners/lib/route-detection.js +137 -68
  55. package/bin/runners/lib/scan-output.js +91 -76
  56. package/bin/runners/lib/scan-runner.js +135 -0
  57. package/bin/runners/lib/schemas/ajv-validator.js +464 -0
  58. package/bin/runners/lib/schemas/error-envelope.schema.json +105 -0
  59. package/bin/runners/lib/schemas/finding-v3.schema.json +151 -0
  60. package/bin/runners/lib/schemas/report-artifact.schema.json +120 -0
  61. package/bin/runners/lib/schemas/run-request.schema.json +108 -0
  62. package/bin/runners/lib/schemas/validator.js +27 -0
  63. package/bin/runners/lib/schemas/verdict.schema.json +140 -0
  64. package/bin/runners/lib/ship-output-enterprise.js +23 -23
  65. package/bin/runners/lib/ship-output.js +75 -31
  66. package/bin/runners/lib/terminal-ui.js +6 -113
  67. package/bin/runners/lib/truth.js +351 -10
  68. package/bin/runners/lib/unified-cli-output.js +430 -603
  69. package/bin/runners/lib/unified-output.js +13 -9
  70. package/bin/runners/runAIAgent.js +10 -5
  71. package/bin/runners/runAgent.js +0 -3
  72. package/bin/runners/runAllowlist.js +389 -0
  73. package/bin/runners/runApprove.js +0 -33
  74. package/bin/runners/runAuth.js +73 -45
  75. package/bin/runners/runCheckpoint.js +51 -11
  76. package/bin/runners/runClassify.js +85 -21
  77. package/bin/runners/runContext.js +0 -3
  78. package/bin/runners/runDoctor.js +41 -28
  79. package/bin/runners/runEvidencePack.js +362 -0
  80. package/bin/runners/runFirewall.js +0 -3
  81. package/bin/runners/runFirewallHook.js +0 -3
  82. package/bin/runners/runFix.js +66 -76
  83. package/bin/runners/runGuard.js +18 -411
  84. package/bin/runners/runInit.js +113 -30
  85. package/bin/runners/runLabs.js +424 -0
  86. package/bin/runners/runMcp.js +19 -25
  87. package/bin/runners/runPolish.js +64 -240
  88. package/bin/runners/runPromptFirewall.js +12 -5
  89. package/bin/runners/runProve.js +57 -22
  90. package/bin/runners/runQuickstart.js +531 -0
  91. package/bin/runners/runReality.js +59 -68
  92. package/bin/runners/runReport.js +38 -33
  93. package/bin/runners/runRuntime.js +8 -5
  94. package/bin/runners/runScan.js +1413 -190
  95. package/bin/runners/runShip.js +113 -719
  96. package/bin/runners/runTruth.js +0 -3
  97. package/bin/runners/runValidate.js +13 -9
  98. package/bin/runners/runWatch.js +23 -14
  99. package/bin/scan.js +6 -1
  100. package/bin/vibecheck.js +204 -185
  101. package/mcp-server/deprecation-middleware.js +282 -0
  102. package/mcp-server/handlers/index.ts +15 -0
  103. package/mcp-server/handlers/tool-handler.ts +554 -0
  104. package/mcp-server/index-v1.js +698 -0
  105. package/mcp-server/index.js +210 -238
  106. package/mcp-server/lib/cache-wrapper.cjs +383 -0
  107. package/mcp-server/lib/error-envelope.js +138 -0
  108. package/mcp-server/lib/executor.ts +499 -0
  109. package/mcp-server/lib/index.ts +19 -0
  110. package/mcp-server/lib/rate-limiter.js +166 -0
  111. package/mcp-server/lib/sandbox.test.ts +519 -0
  112. package/mcp-server/lib/sandbox.ts +395 -0
  113. package/mcp-server/lib/types.ts +267 -0
  114. package/mcp-server/package.json +12 -3
  115. package/mcp-server/registry/tool-registry.js +794 -0
  116. package/mcp-server/registry/tools.json +605 -0
  117. package/mcp-server/registry.test.ts +334 -0
  118. package/mcp-server/tests/tier-gating.test.js +297 -0
  119. package/mcp-server/tier-auth.js +378 -45
  120. package/mcp-server/tools-v3.js +353 -442
  121. package/mcp-server/tsconfig.json +37 -0
  122. package/mcp-server/vibecheck-2.0-tools.js +14 -1
  123. package/package.json +1 -1
  124. package/bin/runners/lib/agent-firewall/learning/learning-engine.js +0 -849
  125. package/bin/runners/lib/audit-logger.js +0 -532
  126. package/bin/runners/lib/authority/authorities/architecture.js +0 -364
  127. package/bin/runners/lib/authority/authorities/compliance.js +0 -341
  128. package/bin/runners/lib/authority/authorities/human.js +0 -343
  129. package/bin/runners/lib/authority/authorities/quality.js +0 -420
  130. package/bin/runners/lib/authority/authorities/security.js +0 -228
  131. package/bin/runners/lib/authority/index.js +0 -293
  132. package/bin/runners/lib/bundle/bundle-intelligence.js +0 -846
  133. package/bin/runners/lib/cli-charts.js +0 -368
  134. package/bin/runners/lib/cli-config-display.js +0 -405
  135. package/bin/runners/lib/cli-demo.js +0 -275
  136. package/bin/runners/lib/cli-errors.js +0 -438
  137. package/bin/runners/lib/cli-help-formatter.js +0 -439
  138. package/bin/runners/lib/cli-interactive-menu.js +0 -509
  139. package/bin/runners/lib/cli-prompts.js +0 -441
  140. package/bin/runners/lib/cli-scan-cards.js +0 -362
  141. package/bin/runners/lib/compliance-reporter.js +0 -710
  142. package/bin/runners/lib/conductor/index.js +0 -671
  143. package/bin/runners/lib/easy/README.md +0 -123
  144. package/bin/runners/lib/easy/index.js +0 -140
  145. package/bin/runners/lib/easy/interactive-wizard.js +0 -788
  146. package/bin/runners/lib/easy/one-click-firewall.js +0 -564
  147. package/bin/runners/lib/easy/zero-config-reality.js +0 -714
  148. package/bin/runners/lib/engines/async-patterns-engine.js +0 -444
  149. package/bin/runners/lib/engines/bundle-size-engine.js +0 -433
  150. package/bin/runners/lib/engines/confidence-scoring.js +0 -276
  151. package/bin/runners/lib/engines/context-detection.js +0 -264
  152. package/bin/runners/lib/engines/database-patterns-engine.js +0 -429
  153. package/bin/runners/lib/engines/duplicate-code-engine.js +0 -354
  154. package/bin/runners/lib/engines/env-variables-engine.js +0 -458
  155. package/bin/runners/lib/engines/error-handling-engine.js +0 -437
  156. package/bin/runners/lib/engines/false-positive-prevention.js +0 -630
  157. package/bin/runners/lib/engines/framework-adapters/index.js +0 -607
  158. package/bin/runners/lib/engines/framework-detection.js +0 -508
  159. package/bin/runners/lib/engines/import-order-engine.js +0 -429
  160. package/bin/runners/lib/engines/naming-conventions-engine.js +0 -544
  161. package/bin/runners/lib/engines/noise-reduction-engine.js +0 -452
  162. package/bin/runners/lib/engines/orchestrator.js +0 -334
  163. package/bin/runners/lib/engines/react-patterns-engine.js +0 -457
  164. package/bin/runners/lib/engines/vibecheck-engines/lib/ai-hallucination-engine.js +0 -806
  165. package/bin/runners/lib/engines/vibecheck-engines/lib/smart-fix-engine.js +0 -577
  166. package/bin/runners/lib/engines/vibecheck-engines/lib/vibe-score-engine.js +0 -543
  167. package/bin/runners/lib/engines/vibecheck-engines.js +0 -514
  168. package/bin/runners/lib/enhanced-features/index.js +0 -305
  169. package/bin/runners/lib/enhanced-output.js +0 -631
  170. package/bin/runners/lib/enterprise.js +0 -300
  171. package/bin/runners/lib/firewall/command-validator.js +0 -351
  172. package/bin/runners/lib/firewall/config.js +0 -341
  173. package/bin/runners/lib/firewall/content-validator.js +0 -519
  174. package/bin/runners/lib/firewall/index.js +0 -101
  175. package/bin/runners/lib/firewall/path-validator.js +0 -256
  176. package/bin/runners/lib/intelligence/cross-repo-intelligence.js +0 -817
  177. package/bin/runners/lib/mcp-utils.js +0 -425
  178. package/bin/runners/lib/output/index.js +0 -1022
  179. package/bin/runners/lib/policy-engine.js +0 -652
  180. package/bin/runners/lib/polish/autofix/accessibility-fixes.js +0 -333
  181. package/bin/runners/lib/polish/autofix/async-handlers.js +0 -273
  182. package/bin/runners/lib/polish/autofix/dead-code.js +0 -280
  183. package/bin/runners/lib/polish/autofix/imports-optimizer.js +0 -344
  184. package/bin/runners/lib/polish/autofix/index.js +0 -200
  185. package/bin/runners/lib/polish/autofix/remove-consoles.js +0 -209
  186. package/bin/runners/lib/polish/autofix/strengthen-types.js +0 -245
  187. package/bin/runners/lib/polish/backend-checks.js +0 -148
  188. package/bin/runners/lib/polish/documentation-checks.js +0 -111
  189. package/bin/runners/lib/polish/frontend-checks.js +0 -168
  190. package/bin/runners/lib/polish/index.js +0 -71
  191. package/bin/runners/lib/polish/infrastructure-checks.js +0 -131
  192. package/bin/runners/lib/polish/library-detection.js +0 -175
  193. package/bin/runners/lib/polish/performance-checks.js +0 -100
  194. package/bin/runners/lib/polish/security-checks.js +0 -148
  195. package/bin/runners/lib/polish/utils.js +0 -203
  196. package/bin/runners/lib/prompt-builder.js +0 -540
  197. package/bin/runners/lib/proof-certificate.js +0 -634
  198. package/bin/runners/lib/reality/accessibility-audit.js +0 -946
  199. package/bin/runners/lib/reality/api-contract-validator.js +0 -1012
  200. package/bin/runners/lib/reality/chaos-engineering.js +0 -1084
  201. package/bin/runners/lib/reality/performance-tracker.js +0 -1077
  202. package/bin/runners/lib/reality/scenario-generator.js +0 -1404
  203. package/bin/runners/lib/reality/visual-regression.js +0 -852
  204. package/bin/runners/lib/reality-profiler.js +0 -717
  205. package/bin/runners/lib/replay/flight-recorder-viewer.js +0 -1160
  206. package/bin/runners/lib/review/ai-code-review.js +0 -832
  207. package/bin/runners/lib/rules/custom-rule-engine.js +0 -985
  208. package/bin/runners/lib/sbom-generator.js +0 -641
  209. package/bin/runners/lib/scan-output-enhanced.js +0 -512
  210. package/bin/runners/lib/security/owasp-scanner.js +0 -939
  211. package/bin/runners/lib/validators/contract-validator.js +0 -283
  212. package/bin/runners/lib/validators/dead-export-detector.js +0 -279
  213. package/bin/runners/lib/validators/dep-audit.js +0 -245
  214. package/bin/runners/lib/validators/env-validator.js +0 -319
  215. package/bin/runners/lib/validators/index.js +0 -120
  216. package/bin/runners/lib/validators/license-checker.js +0 -252
  217. package/bin/runners/lib/validators/route-validator.js +0 -290
  218. package/bin/runners/runAuthority.js +0 -528
  219. package/bin/runners/runConductor.js +0 -772
  220. package/bin/runners/runContainer.js +0 -366
  221. package/bin/runners/runEasy.js +0 -410
  222. package/bin/runners/runIaC.js +0 -372
  223. package/bin/runners/runVibe.js +0 -791
  224. package/mcp-server/tools.js +0 -495
@@ -1,444 +0,0 @@
1
- /**
2
- * Async Patterns Engine
3
- * Detects:
4
- * - Unhandled promise rejections
5
- * - Missing await keywords
6
- * - Promise anti-patterns
7
- * - Race conditions
8
- * - Sequential await when parallel is better
9
- * - Floating promises
10
- * - async/await misuse
11
- */
12
-
13
- const { getAST } = require("./ast-cache");
14
- const traverse = require("@babel/traverse").default;
15
- const t = require("@babel/types");
16
- const { shouldExcludeFile, isTestContext, hasIgnoreDirective } = require("./file-filter");
17
-
18
- function snippetForLine(lines, line) {
19
- return lines[line - 1] ? lines[line - 1].trim() : "";
20
- }
21
-
22
- /**
23
- * Check if a node is a promise-returning call
24
- */
25
- function isPromiseReturning(node) {
26
- if (!t.isCallExpression(node)) return false;
27
-
28
- const callee = node.callee;
29
-
30
- // Promise constructor
31
- if (t.isNewExpression(node) && t.isIdentifier(node.callee, { name: "Promise" })) {
32
- return true;
33
- }
34
-
35
- // Promise.resolve, Promise.reject, Promise.all, etc.
36
- if (t.isMemberExpression(callee) && t.isIdentifier(callee.object, { name: "Promise" })) {
37
- return true;
38
- }
39
-
40
- // Common async methods
41
- if (t.isMemberExpression(callee) && t.isIdentifier(callee.property)) {
42
- const methodName = callee.property.name;
43
- const asyncMethods = ["fetch", "then", "catch", "finally", "json", "text", "blob"];
44
- if (asyncMethods.includes(methodName)) return true;
45
- }
46
-
47
- // fetch()
48
- if (t.isIdentifier(callee, { name: "fetch" })) return true;
49
-
50
- // axios(), axios.get(), etc.
51
- if (t.isIdentifier(callee, { name: "axios" })) return true;
52
- if (t.isMemberExpression(callee) && t.isIdentifier(callee.object, { name: "axios" })) {
53
- return true;
54
- }
55
-
56
- return false;
57
- }
58
-
59
- /**
60
- * Check if expression is awaited or has .then/.catch
61
- */
62
- function isHandled(path) {
63
- const parent = path.parentPath;
64
-
65
- // Awaited
66
- if (parent.isAwaitExpression()) return true;
67
-
68
- // Has .then or .catch
69
- if (parent.isMemberExpression() && t.isIdentifier(parent.node.property)) {
70
- const prop = parent.node.property.name;
71
- if (prop === "then" || prop === "catch" || prop === "finally") return true;
72
- }
73
-
74
- // Returned
75
- if (parent.isReturnStatement()) return true;
76
-
77
- // Assigned to variable (might be handled later)
78
- if (parent.isVariableDeclarator()) return true;
79
-
80
- // Passed as argument (callback)
81
- if (parent.isCallExpression()) return true;
82
-
83
- // Part of Promise.all, Promise.race, etc.
84
- if (parent.isArrayExpression()) {
85
- const grandparent = parent.parentPath;
86
- if (grandparent.isCallExpression()) {
87
- const callee = grandparent.node.callee;
88
- if (t.isMemberExpression(callee) && t.isIdentifier(callee.object, { name: "Promise" })) {
89
- return true;
90
- }
91
- }
92
- }
93
-
94
- return false;
95
- }
96
-
97
- /**
98
- * Check if inside an async function
99
- */
100
- function isInAsyncFunction(path) {
101
- const fnParent = path.getFunctionParent();
102
- return fnParent && fnParent.node.async;
103
- }
104
-
105
- /**
106
- * Analyze async patterns
107
- */
108
- function analyzeAsyncPatterns(code, filePath) {
109
- const findings = [];
110
-
111
- if (shouldExcludeFile(filePath)) return findings;
112
- if (isTestContext(code, filePath)) return findings;
113
- if (hasIgnoreDirective(code, "async-patterns")) return findings;
114
-
115
- const ast = getAST(code, filePath);
116
- if (!ast) return findings;
117
-
118
- const lines = code.split("\n");
119
-
120
- // Track sequential awaits that could be parallel
121
- const sequentialAwaits = new Map(); // fnPath -> [{ line, varName }]
122
-
123
- traverse(ast, {
124
- // Check for floating promises (unhandled)
125
- CallExpression(path) {
126
- const node = path.node;
127
- const loc = node.loc?.start;
128
- if (!loc) return;
129
-
130
- if (isPromiseReturning(node) && !isHandled(path)) {
131
- // Check if it's an expression statement (standalone call)
132
- if (path.parentPath.isExpressionStatement()) {
133
- findings.push({
134
- type: "floating_promise",
135
- severity: "WARN",
136
- category: "AsyncPatterns",
137
- file: filePath,
138
- line: loc.line,
139
- column: loc.column,
140
- title: "Floating promise (unhandled)",
141
- message: "Promise returned but not awaited or handled. Errors may be silently swallowed.",
142
- codeSnippet: snippetForLine(lines, loc.line),
143
- confidence: "high",
144
- fixHint: "Add 'await' or '.catch()' to handle potential errors",
145
- });
146
- }
147
- }
148
- },
149
-
150
- // Check for await in non-async function
151
- AwaitExpression(path) {
152
- const node = path.node;
153
- const loc = node.loc?.start;
154
- if (!loc) return;
155
-
156
- if (!isInAsyncFunction(path)) {
157
- // This would be a syntax error, but might slip through in some cases
158
- findings.push({
159
- type: "await_outside_async",
160
- severity: "BLOCK",
161
- category: "AsyncPatterns",
162
- file: filePath,
163
- line: loc.line,
164
- column: loc.column,
165
- title: "await outside async function",
166
- message: "await can only be used inside async functions.",
167
- codeSnippet: snippetForLine(lines, loc.line),
168
- confidence: "high",
169
- fixHint: "Make the containing function async",
170
- });
171
- }
172
-
173
- // Track for sequential await detection
174
- const fnParent = path.getFunctionParent();
175
- if (fnParent) {
176
- if (!sequentialAwaits.has(fnParent)) {
177
- sequentialAwaits.set(fnParent, []);
178
- }
179
-
180
- // Check if it's a variable declaration
181
- const parent = path.parentPath;
182
- if (parent.isVariableDeclarator() && t.isIdentifier(parent.node.id)) {
183
- sequentialAwaits.get(fnParent).push({
184
- line: loc.line,
185
- varName: parent.node.id.name,
186
- argument: path.node.argument,
187
- });
188
- }
189
- }
190
- },
191
-
192
- // Check for Promise constructor anti-patterns
193
- NewExpression(path) {
194
- const node = path.node;
195
- const loc = node.loc?.start;
196
- if (!loc) return;
197
-
198
- if (t.isIdentifier(node.callee, { name: "Promise" })) {
199
- const executor = node.arguments[0];
200
-
201
- if (t.isArrowFunctionExpression(executor) || t.isFunctionExpression(executor)) {
202
- // Check for async executor (anti-pattern)
203
- if (executor.async) {
204
- findings.push({
205
- type: "async_promise_executor",
206
- severity: "WARN",
207
- category: "AsyncPatterns",
208
- file: filePath,
209
- line: loc.line,
210
- column: loc.column,
211
- title: "Async function as Promise executor",
212
- message: "Using async function as Promise executor can lead to unhandled rejections.",
213
- codeSnippet: snippetForLine(lines, loc.line),
214
- confidence: "high",
215
- fixHint: "Remove async from executor or restructure to avoid Promise constructor",
216
- });
217
- }
218
-
219
- // Check for return statement in executor (doesn't work as expected)
220
- let hasReturn = false;
221
- traverse(executor.body, {
222
- ReturnStatement(innerPath) {
223
- // Ignore nested functions
224
- if (innerPath.getFunctionParent() === path) return;
225
- hasReturn = true;
226
- },
227
- noScope: true,
228
- }, path.scope);
229
-
230
- if (hasReturn) {
231
- findings.push({
232
- type: "promise_executor_return",
233
- severity: "INFO",
234
- category: "AsyncPatterns",
235
- file: filePath,
236
- line: loc.line,
237
- column: loc.column,
238
- title: "Return in Promise executor",
239
- message: "Return value in Promise executor is ignored. Use resolve() instead.",
240
- codeSnippet: snippetForLine(lines, loc.line),
241
- confidence: "med",
242
- fixHint: "Use resolve(value) instead of return value",
243
- });
244
- }
245
- }
246
- }
247
- },
248
-
249
- // Check for .then() in async function (prefer await)
250
- MemberExpression(path) {
251
- const node = path.node;
252
- const loc = node.loc?.start;
253
- if (!loc) return;
254
-
255
- if (t.isIdentifier(node.property, { name: "then" }) && isInAsyncFunction(path)) {
256
- // Check if it's being called
257
- if (path.parentPath.isCallExpression() && path.parentPath.node.callee === node) {
258
- findings.push({
259
- type: "then_in_async",
260
- severity: "INFO",
261
- category: "AsyncPatterns",
262
- file: filePath,
263
- line: loc.line,
264
- column: loc.column,
265
- title: ".then() in async function",
266
- message: "Consider using await instead of .then() in async functions for cleaner code.",
267
- codeSnippet: snippetForLine(lines, loc.line),
268
- confidence: "low",
269
- fixHint: "const result = await promise; instead of promise.then(result => ...)",
270
- });
271
- }
272
- }
273
- },
274
-
275
- // Check for Promise.all with await in loop (should be batched)
276
- ForStatement(path) {
277
- checkAwaitInLoop(path, findings, filePath, lines);
278
- },
279
- ForInStatement(path) {
280
- checkAwaitInLoop(path, findings, filePath, lines);
281
- },
282
- ForOfStatement(path) {
283
- checkAwaitInLoop(path, findings, filePath, lines);
284
- },
285
- WhileStatement(path) {
286
- checkAwaitInLoop(path, findings, filePath, lines);
287
- },
288
-
289
- // Check for missing error handling
290
- TryStatement(path) {
291
- const node = path.node;
292
- const loc = node.loc?.start;
293
- if (!loc) return;
294
-
295
- // Check if try block has await but catch is empty
296
- let hasAwait = false;
297
- path.traverse({
298
- AwaitExpression() {
299
- hasAwait = true;
300
- },
301
- });
302
-
303
- if (hasAwait && node.handler) {
304
- const catchBody = node.handler.body;
305
- if (t.isBlockStatement(catchBody) && catchBody.body.length === 0) {
306
- findings.push({
307
- type: "empty_async_catch",
308
- severity: "WARN",
309
- category: "AsyncPatterns",
310
- file: filePath,
311
- line: node.handler.loc?.start.line || loc.line,
312
- column: 0,
313
- title: "Empty catch block for async operation",
314
- message: "Async operation errors are being silently swallowed.",
315
- codeSnippet: snippetForLine(lines, node.handler.loc?.start.line || loc.line),
316
- confidence: "high",
317
- fixHint: "Log or re-throw the error in the catch block",
318
- });
319
- }
320
- }
321
- },
322
- });
323
-
324
- // Analyze sequential awaits
325
- for (const [fnPath, awaits] of sequentialAwaits) {
326
- if (awaits.length < 2) continue;
327
-
328
- // Check for independent awaits that could be parallel
329
- // This is a heuristic - we look for awaits that don't depend on each other
330
- const independentGroups = findIndependentAwaits(awaits, code);
331
-
332
- for (const group of independentGroups) {
333
- if (group.length >= 2) {
334
- const firstLine = group[0].line;
335
- const varNames = group.map(a => a.varName).join(", ");
336
-
337
- findings.push({
338
- type: "sequential_await",
339
- severity: "INFO",
340
- category: "AsyncPatterns",
341
- file: filePath,
342
- line: firstLine,
343
- column: 0,
344
- title: `Sequential awaits could be parallel`,
345
- message: `Variables [${varNames}] are awaited sequentially but appear independent. Consider Promise.all().`,
346
- codeSnippet: snippetForLine(lines, firstLine),
347
- confidence: "low",
348
- fixHint: `const [${varNames}] = await Promise.all([...])`,
349
- });
350
- }
351
- }
352
- }
353
-
354
- return findings;
355
- }
356
-
357
- /**
358
- * Check for await in loop
359
- */
360
- function checkAwaitInLoop(path, findings, filePath, lines) {
361
- const node = path.node;
362
- const loc = node.loc?.start;
363
- if (!loc) return;
364
-
365
- let awaitCount = 0;
366
- let firstAwaitLine = null;
367
-
368
- path.traverse({
369
- AwaitExpression(innerPath) {
370
- // Skip nested functions
371
- const fnParent = innerPath.getFunctionParent();
372
- if (fnParent !== path.getFunctionParent()) return;
373
-
374
- awaitCount++;
375
- if (!firstAwaitLine) {
376
- firstAwaitLine = innerPath.node.loc?.start.line;
377
- }
378
- },
379
- });
380
-
381
- if (awaitCount > 0) {
382
- findings.push({
383
- type: "await_in_loop",
384
- severity: "INFO",
385
- category: "AsyncPatterns",
386
- file: filePath,
387
- line: firstAwaitLine || loc.line,
388
- column: 0,
389
- title: "await inside loop",
390
- message: `Found ${awaitCount} await(s) in loop. Consider Promise.all() for parallel execution if operations are independent.`,
391
- codeSnippet: snippetForLine(lines, firstAwaitLine || loc.line),
392
- confidence: "low",
393
- fixHint: "const results = await Promise.all(items.map(async item => ...))",
394
- });
395
- }
396
- }
397
-
398
- /**
399
- * Find groups of independent awaits
400
- * This is a simple heuristic - checks if variables reference each other
401
- */
402
- function findIndependentAwaits(awaits, code) {
403
- const groups = [];
404
- const used = new Set();
405
-
406
- for (let i = 0; i < awaits.length; i++) {
407
- if (used.has(i)) continue;
408
-
409
- const group = [awaits[i]];
410
- used.add(i);
411
-
412
- for (let j = i + 1; j < awaits.length; j++) {
413
- if (used.has(j)) continue;
414
-
415
- // Check if awaits[j] depends on any previous result
416
- const prevVars = group.map(a => a.varName);
417
- const awaitCode = code.substring(
418
- awaits[j].argument?.start || 0,
419
- awaits[j].argument?.end || 0
420
- );
421
-
422
- // Simple check: does the await reference previous variables?
423
- const dependsOnPrev = prevVars.some(v =>
424
- new RegExp(`\\b${v}\\b`).test(awaitCode)
425
- );
426
-
427
- if (!dependsOnPrev) {
428
- group.push(awaits[j]);
429
- used.add(j);
430
- }
431
- }
432
-
433
- groups.push(group);
434
- }
435
-
436
- return groups.filter(g => g.length >= 2);
437
- }
438
-
439
- module.exports = {
440
- analyzeAsyncPatterns,
441
- isPromiseReturning,
442
- isHandled,
443
- isInAsyncFunction,
444
- };