@vibecheckai/cli 3.5.0 → 3.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (224) hide show
  1. package/bin/registry.js +214 -237
  2. package/bin/runners/cli-utils.js +33 -2
  3. package/bin/runners/context/analyzer.js +52 -1
  4. package/bin/runners/context/generators/cursor.js +2 -49
  5. package/bin/runners/context/git-context.js +3 -1
  6. package/bin/runners/context/team-conventions.js +33 -7
  7. package/bin/runners/lib/analysis-core.js +25 -5
  8. package/bin/runners/lib/analyzers.js +431 -481
  9. package/bin/runners/lib/default-config.js +127 -0
  10. package/bin/runners/lib/doctor/modules/security.js +3 -1
  11. package/bin/runners/lib/engine/ast-cache.js +210 -0
  12. package/bin/runners/lib/engine/auth-extractor.js +211 -0
  13. package/bin/runners/lib/engine/billing-extractor.js +112 -0
  14. package/bin/runners/lib/engine/enforcement-extractor.js +100 -0
  15. package/bin/runners/lib/engine/env-extractor.js +207 -0
  16. package/bin/runners/lib/engine/express-extractor.js +208 -0
  17. package/bin/runners/lib/engine/extractors.js +849 -0
  18. package/bin/runners/lib/engine/index.js +207 -0
  19. package/bin/runners/lib/engine/repo-index.js +514 -0
  20. package/bin/runners/lib/engine/types.js +124 -0
  21. package/bin/runners/lib/engines/accessibility-engine.js +18 -218
  22. package/bin/runners/lib/engines/api-consistency-engine.js +30 -335
  23. package/bin/runners/lib/engines/cross-file-analysis-engine.js +27 -292
  24. package/bin/runners/lib/engines/empty-catch-engine.js +17 -127
  25. package/bin/runners/lib/engines/mock-data-engine.js +10 -53
  26. package/bin/runners/lib/engines/performance-issues-engine.js +36 -176
  27. package/bin/runners/lib/engines/security-vulnerabilities-engine.js +54 -382
  28. package/bin/runners/lib/engines/type-aware-engine.js +39 -263
  29. package/bin/runners/lib/engines/vibecheck-engines/index.js +13 -122
  30. package/bin/runners/lib/engines/vibecheck-engines/lib/ast-cache.js +164 -0
  31. package/bin/runners/lib/engines/vibecheck-engines/lib/code-quality-engine.js +291 -0
  32. package/bin/runners/lib/engines/vibecheck-engines/lib/console-logs-engine.js +83 -0
  33. package/bin/runners/lib/engines/vibecheck-engines/lib/dead-code-engine.js +198 -0
  34. package/bin/runners/lib/engines/vibecheck-engines/lib/deprecated-api-engine.js +275 -0
  35. package/bin/runners/lib/engines/vibecheck-engines/lib/empty-catch-engine.js +167 -0
  36. package/bin/runners/lib/engines/vibecheck-engines/lib/file-filter.js +217 -0
  37. package/bin/runners/lib/engines/vibecheck-engines/lib/hardcoded-secrets-engine.js +73 -373
  38. package/bin/runners/lib/engines/vibecheck-engines/lib/mock-data-engine.js +140 -0
  39. package/bin/runners/lib/engines/vibecheck-engines/lib/parallel-processor.js +164 -0
  40. package/bin/runners/lib/engines/vibecheck-engines/lib/performance-issues-engine.js +234 -0
  41. package/bin/runners/lib/engines/vibecheck-engines/lib/type-aware-engine.js +217 -0
  42. package/bin/runners/lib/engines/vibecheck-engines/lib/unsafe-regex-engine.js +78 -0
  43. package/bin/runners/lib/entitlements-v2.js +73 -97
  44. package/bin/runners/lib/error-handler.js +44 -3
  45. package/bin/runners/lib/error-messages.js +289 -0
  46. package/bin/runners/lib/evidence-pack.js +7 -1
  47. package/bin/runners/lib/finding-id.js +69 -0
  48. package/bin/runners/lib/finding-sorter.js +89 -0
  49. package/bin/runners/lib/html-proof-report.js +700 -350
  50. package/bin/runners/lib/missions/plan.js +6 -46
  51. package/bin/runners/lib/missions/templates.js +0 -232
  52. package/bin/runners/lib/next-action.js +560 -0
  53. package/bin/runners/lib/prerequisites.js +149 -0
  54. package/bin/runners/lib/route-detection.js +137 -68
  55. package/bin/runners/lib/scan-output.js +91 -76
  56. package/bin/runners/lib/scan-runner.js +135 -0
  57. package/bin/runners/lib/schemas/ajv-validator.js +464 -0
  58. package/bin/runners/lib/schemas/error-envelope.schema.json +105 -0
  59. package/bin/runners/lib/schemas/finding-v3.schema.json +151 -0
  60. package/bin/runners/lib/schemas/report-artifact.schema.json +120 -0
  61. package/bin/runners/lib/schemas/run-request.schema.json +108 -0
  62. package/bin/runners/lib/schemas/validator.js +27 -0
  63. package/bin/runners/lib/schemas/verdict.schema.json +140 -0
  64. package/bin/runners/lib/ship-output-enterprise.js +23 -23
  65. package/bin/runners/lib/ship-output.js +75 -31
  66. package/bin/runners/lib/terminal-ui.js +6 -113
  67. package/bin/runners/lib/truth.js +351 -10
  68. package/bin/runners/lib/unified-cli-output.js +430 -603
  69. package/bin/runners/lib/unified-output.js +13 -9
  70. package/bin/runners/runAIAgent.js +10 -5
  71. package/bin/runners/runAgent.js +0 -3
  72. package/bin/runners/runAllowlist.js +389 -0
  73. package/bin/runners/runApprove.js +0 -33
  74. package/bin/runners/runAuth.js +73 -45
  75. package/bin/runners/runCheckpoint.js +51 -11
  76. package/bin/runners/runClassify.js +85 -21
  77. package/bin/runners/runContext.js +0 -3
  78. package/bin/runners/runDoctor.js +41 -28
  79. package/bin/runners/runEvidencePack.js +362 -0
  80. package/bin/runners/runFirewall.js +0 -3
  81. package/bin/runners/runFirewallHook.js +0 -3
  82. package/bin/runners/runFix.js +66 -76
  83. package/bin/runners/runGuard.js +18 -411
  84. package/bin/runners/runInit.js +113 -30
  85. package/bin/runners/runLabs.js +424 -0
  86. package/bin/runners/runMcp.js +19 -25
  87. package/bin/runners/runPolish.js +64 -240
  88. package/bin/runners/runPromptFirewall.js +12 -5
  89. package/bin/runners/runProve.js +57 -22
  90. package/bin/runners/runQuickstart.js +531 -0
  91. package/bin/runners/runReality.js +59 -68
  92. package/bin/runners/runReport.js +38 -33
  93. package/bin/runners/runRuntime.js +8 -5
  94. package/bin/runners/runScan.js +1413 -190
  95. package/bin/runners/runShip.js +113 -719
  96. package/bin/runners/runTruth.js +0 -3
  97. package/bin/runners/runValidate.js +13 -9
  98. package/bin/runners/runWatch.js +23 -14
  99. package/bin/scan.js +6 -1
  100. package/bin/vibecheck.js +204 -185
  101. package/mcp-server/deprecation-middleware.js +282 -0
  102. package/mcp-server/handlers/index.ts +15 -0
  103. package/mcp-server/handlers/tool-handler.ts +554 -0
  104. package/mcp-server/index-v1.js +698 -0
  105. package/mcp-server/index.js +210 -238
  106. package/mcp-server/lib/cache-wrapper.cjs +383 -0
  107. package/mcp-server/lib/error-envelope.js +138 -0
  108. package/mcp-server/lib/executor.ts +499 -0
  109. package/mcp-server/lib/index.ts +19 -0
  110. package/mcp-server/lib/rate-limiter.js +166 -0
  111. package/mcp-server/lib/sandbox.test.ts +519 -0
  112. package/mcp-server/lib/sandbox.ts +395 -0
  113. package/mcp-server/lib/types.ts +267 -0
  114. package/mcp-server/package.json +12 -3
  115. package/mcp-server/registry/tool-registry.js +794 -0
  116. package/mcp-server/registry/tools.json +605 -0
  117. package/mcp-server/registry.test.ts +334 -0
  118. package/mcp-server/tests/tier-gating.test.js +297 -0
  119. package/mcp-server/tier-auth.js +378 -45
  120. package/mcp-server/tools-v3.js +353 -442
  121. package/mcp-server/tsconfig.json +37 -0
  122. package/mcp-server/vibecheck-2.0-tools.js +14 -1
  123. package/package.json +1 -1
  124. package/bin/runners/lib/agent-firewall/learning/learning-engine.js +0 -849
  125. package/bin/runners/lib/audit-logger.js +0 -532
  126. package/bin/runners/lib/authority/authorities/architecture.js +0 -364
  127. package/bin/runners/lib/authority/authorities/compliance.js +0 -341
  128. package/bin/runners/lib/authority/authorities/human.js +0 -343
  129. package/bin/runners/lib/authority/authorities/quality.js +0 -420
  130. package/bin/runners/lib/authority/authorities/security.js +0 -228
  131. package/bin/runners/lib/authority/index.js +0 -293
  132. package/bin/runners/lib/bundle/bundle-intelligence.js +0 -846
  133. package/bin/runners/lib/cli-charts.js +0 -368
  134. package/bin/runners/lib/cli-config-display.js +0 -405
  135. package/bin/runners/lib/cli-demo.js +0 -275
  136. package/bin/runners/lib/cli-errors.js +0 -438
  137. package/bin/runners/lib/cli-help-formatter.js +0 -439
  138. package/bin/runners/lib/cli-interactive-menu.js +0 -509
  139. package/bin/runners/lib/cli-prompts.js +0 -441
  140. package/bin/runners/lib/cli-scan-cards.js +0 -362
  141. package/bin/runners/lib/compliance-reporter.js +0 -710
  142. package/bin/runners/lib/conductor/index.js +0 -671
  143. package/bin/runners/lib/easy/README.md +0 -123
  144. package/bin/runners/lib/easy/index.js +0 -140
  145. package/bin/runners/lib/easy/interactive-wizard.js +0 -788
  146. package/bin/runners/lib/easy/one-click-firewall.js +0 -564
  147. package/bin/runners/lib/easy/zero-config-reality.js +0 -714
  148. package/bin/runners/lib/engines/async-patterns-engine.js +0 -444
  149. package/bin/runners/lib/engines/bundle-size-engine.js +0 -433
  150. package/bin/runners/lib/engines/confidence-scoring.js +0 -276
  151. package/bin/runners/lib/engines/context-detection.js +0 -264
  152. package/bin/runners/lib/engines/database-patterns-engine.js +0 -429
  153. package/bin/runners/lib/engines/duplicate-code-engine.js +0 -354
  154. package/bin/runners/lib/engines/env-variables-engine.js +0 -458
  155. package/bin/runners/lib/engines/error-handling-engine.js +0 -437
  156. package/bin/runners/lib/engines/false-positive-prevention.js +0 -630
  157. package/bin/runners/lib/engines/framework-adapters/index.js +0 -607
  158. package/bin/runners/lib/engines/framework-detection.js +0 -508
  159. package/bin/runners/lib/engines/import-order-engine.js +0 -429
  160. package/bin/runners/lib/engines/naming-conventions-engine.js +0 -544
  161. package/bin/runners/lib/engines/noise-reduction-engine.js +0 -452
  162. package/bin/runners/lib/engines/orchestrator.js +0 -334
  163. package/bin/runners/lib/engines/react-patterns-engine.js +0 -457
  164. package/bin/runners/lib/engines/vibecheck-engines/lib/ai-hallucination-engine.js +0 -806
  165. package/bin/runners/lib/engines/vibecheck-engines/lib/smart-fix-engine.js +0 -577
  166. package/bin/runners/lib/engines/vibecheck-engines/lib/vibe-score-engine.js +0 -543
  167. package/bin/runners/lib/engines/vibecheck-engines.js +0 -514
  168. package/bin/runners/lib/enhanced-features/index.js +0 -305
  169. package/bin/runners/lib/enhanced-output.js +0 -631
  170. package/bin/runners/lib/enterprise.js +0 -300
  171. package/bin/runners/lib/firewall/command-validator.js +0 -351
  172. package/bin/runners/lib/firewall/config.js +0 -341
  173. package/bin/runners/lib/firewall/content-validator.js +0 -519
  174. package/bin/runners/lib/firewall/index.js +0 -101
  175. package/bin/runners/lib/firewall/path-validator.js +0 -256
  176. package/bin/runners/lib/intelligence/cross-repo-intelligence.js +0 -817
  177. package/bin/runners/lib/mcp-utils.js +0 -425
  178. package/bin/runners/lib/output/index.js +0 -1022
  179. package/bin/runners/lib/policy-engine.js +0 -652
  180. package/bin/runners/lib/polish/autofix/accessibility-fixes.js +0 -333
  181. package/bin/runners/lib/polish/autofix/async-handlers.js +0 -273
  182. package/bin/runners/lib/polish/autofix/dead-code.js +0 -280
  183. package/bin/runners/lib/polish/autofix/imports-optimizer.js +0 -344
  184. package/bin/runners/lib/polish/autofix/index.js +0 -200
  185. package/bin/runners/lib/polish/autofix/remove-consoles.js +0 -209
  186. package/bin/runners/lib/polish/autofix/strengthen-types.js +0 -245
  187. package/bin/runners/lib/polish/backend-checks.js +0 -148
  188. package/bin/runners/lib/polish/documentation-checks.js +0 -111
  189. package/bin/runners/lib/polish/frontend-checks.js +0 -168
  190. package/bin/runners/lib/polish/index.js +0 -71
  191. package/bin/runners/lib/polish/infrastructure-checks.js +0 -131
  192. package/bin/runners/lib/polish/library-detection.js +0 -175
  193. package/bin/runners/lib/polish/performance-checks.js +0 -100
  194. package/bin/runners/lib/polish/security-checks.js +0 -148
  195. package/bin/runners/lib/polish/utils.js +0 -203
  196. package/bin/runners/lib/prompt-builder.js +0 -540
  197. package/bin/runners/lib/proof-certificate.js +0 -634
  198. package/bin/runners/lib/reality/accessibility-audit.js +0 -946
  199. package/bin/runners/lib/reality/api-contract-validator.js +0 -1012
  200. package/bin/runners/lib/reality/chaos-engineering.js +0 -1084
  201. package/bin/runners/lib/reality/performance-tracker.js +0 -1077
  202. package/bin/runners/lib/reality/scenario-generator.js +0 -1404
  203. package/bin/runners/lib/reality/visual-regression.js +0 -852
  204. package/bin/runners/lib/reality-profiler.js +0 -717
  205. package/bin/runners/lib/replay/flight-recorder-viewer.js +0 -1160
  206. package/bin/runners/lib/review/ai-code-review.js +0 -832
  207. package/bin/runners/lib/rules/custom-rule-engine.js +0 -985
  208. package/bin/runners/lib/sbom-generator.js +0 -641
  209. package/bin/runners/lib/scan-output-enhanced.js +0 -512
  210. package/bin/runners/lib/security/owasp-scanner.js +0 -939
  211. package/bin/runners/lib/validators/contract-validator.js +0 -283
  212. package/bin/runners/lib/validators/dead-export-detector.js +0 -279
  213. package/bin/runners/lib/validators/dep-audit.js +0 -245
  214. package/bin/runners/lib/validators/env-validator.js +0 -319
  215. package/bin/runners/lib/validators/index.js +0 -120
  216. package/bin/runners/lib/validators/license-checker.js +0 -252
  217. package/bin/runners/lib/validators/route-validator.js +0 -290
  218. package/bin/runners/runAuthority.js +0 -528
  219. package/bin/runners/runConductor.js +0 -772
  220. package/bin/runners/runContainer.js +0 -366
  221. package/bin/runners/runEasy.js +0 -410
  222. package/bin/runners/runIaC.js +0 -372
  223. package/bin/runners/runVibe.js +0 -791
  224. package/mcp-server/tools.js +0 -495
@@ -1,457 +0,0 @@
1
- /**
2
- * React Patterns Engine
3
- * Detects:
4
- * - Missing key props in lists
5
- * - Array index as key
6
- * - Direct state mutation
7
- * - Missing dependency arrays in hooks
8
- * - Stale closure issues
9
- * - Conditional hook calls
10
- * - Props spreading issues
11
- * - Missing error boundaries
12
- * - useEffect cleanup issues
13
- * - Excessive re-renders
14
- */
15
-
16
- const { getAST } = require("./ast-cache");
17
- const traverse = require("@babel/traverse").default;
18
- const t = require("@babel/types");
19
- const { shouldExcludeFile, isTestContext, hasIgnoreDirective } = require("./file-filter");
20
-
21
- function snippetForLine(lines, line) {
22
- return lines[line - 1] ? lines[line - 1].trim() : "";
23
- }
24
-
25
- /**
26
- * Check if inside a React component or hook
27
- */
28
- function isInReactContext(path) {
29
- const fnParent = path.getFunctionParent();
30
- if (!fnParent) return false;
31
-
32
- const fnNode = fnParent.node;
33
- let fnName = "";
34
-
35
- if (fnNode.id?.name) {
36
- fnName = fnNode.id.name;
37
- } else if (fnParent.parentPath?.isVariableDeclarator()) {
38
- fnName = fnParent.parentPath.node.id?.name || "";
39
- }
40
-
41
- // Check if component (PascalCase) or hook (useXxx)
42
- return /^[A-Z]/.test(fnName) || /^use[A-Z]/.test(fnName);
43
- }
44
-
45
- /**
46
- * Check if inside a loop
47
- */
48
- function isInLoop(path) {
49
- return !!path.findParent(p =>
50
- p.isForStatement() ||
51
- p.isForInStatement() ||
52
- p.isForOfStatement() ||
53
- p.isWhileStatement() ||
54
- p.isDoWhileStatement()
55
- );
56
- }
57
-
58
- /**
59
- * Check if inside a conditional
60
- */
61
- function isInConditional(path) {
62
- return !!path.findParent(p =>
63
- p.isIfStatement() ||
64
- p.isConditionalExpression() ||
65
- p.isSwitchStatement() ||
66
- (p.isLogicalExpression() && (p.node.operator === "&&" || p.node.operator === "||"))
67
- );
68
- }
69
-
70
- /**
71
- * Get variable name from setState pattern
72
- */
73
- function getStateVarFromSetter(setterName) {
74
- if (setterName.startsWith("set") && setterName.length > 3) {
75
- const varName = setterName.slice(3);
76
- return varName.charAt(0).toLowerCase() + varName.slice(1);
77
- }
78
- return null;
79
- }
80
-
81
- /**
82
- * Analyze React patterns
83
- */
84
- function analyzeReactPatterns(code, filePath) {
85
- const findings = [];
86
-
87
- if (shouldExcludeFile(filePath)) return findings;
88
- if (isTestContext(code, filePath)) return findings;
89
- if (hasIgnoreDirective(code, "react-patterns")) return findings;
90
-
91
- // Only analyze React files
92
- if (!/\.(tsx|jsx)$/.test(filePath)) return findings;
93
-
94
- const ast = getAST(code, filePath);
95
- if (!ast) return findings;
96
-
97
- const lines = code.split("\n");
98
-
99
- // Track useState variables
100
- const stateVars = new Map(); // varName -> setterName
101
- const setterToVar = new Map(); // setterName -> varName
102
-
103
- // Track hooks order violations
104
- const hookCalls = [];
105
- let hasConditionalHook = false;
106
- let hasLoopHook = false;
107
-
108
- traverse(ast, {
109
- // Detect missing key prop in JSX arrays
110
- JSXElement(path) {
111
- const node = path.node;
112
-
113
- // Check if inside map/forEach
114
- const callParent = path.findParent(p =>
115
- p.isCallExpression() &&
116
- t.isMemberExpression(p.node.callee) &&
117
- t.isIdentifier(p.node.callee.property) &&
118
- ["map", "forEach", "filter", "reduce"].includes(p.node.callee.property.name)
119
- );
120
-
121
- if (callParent) {
122
- // Check if this JSX element has a key prop
123
- const hasKey = node.openingElement.attributes.some(attr =>
124
- t.isJSXAttribute(attr) &&
125
- t.isJSXIdentifier(attr.name, { name: "key" })
126
- );
127
-
128
- if (!hasKey) {
129
- const loc = node.loc?.start;
130
- if (loc) {
131
- findings.push({
132
- type: "missing_key",
133
- severity: "WARN",
134
- category: "ReactPatterns",
135
- file: filePath,
136
- line: loc.line,
137
- column: loc.column,
138
- title: "Missing 'key' prop in list item",
139
- message: "Each child in a list should have a unique 'key' prop.",
140
- codeSnippet: snippetForLine(lines, loc.line),
141
- confidence: "high",
142
- fixHint: "Add key={uniqueId} to the JSX element",
143
- });
144
- }
145
- }
146
- }
147
- },
148
-
149
- // Detect array index as key
150
- JSXAttribute(path) {
151
- const node = path.node;
152
-
153
- if (t.isJSXIdentifier(node.name, { name: "key" })) {
154
- const value = node.value;
155
-
156
- // Check for key={index} or key={i}
157
- if (t.isJSXExpressionContainer(value)) {
158
- const expr = value.expression;
159
-
160
- // Direct index variable
161
- if (t.isIdentifier(expr) &&
162
- (expr.name === "index" || expr.name === "i" || expr.name === "idx")) {
163
-
164
- const loc = node.loc?.start;
165
- if (loc) {
166
- findings.push({
167
- type: "index_as_key",
168
- severity: "WARN",
169
- category: "ReactPatterns",
170
- file: filePath,
171
- line: loc.line,
172
- column: loc.column,
173
- title: "Array index used as key",
174
- message: "Using array index as key can cause issues with list reordering and component state.",
175
- codeSnippet: snippetForLine(lines, loc.line),
176
- confidence: "high",
177
- fixHint: "Use a unique identifier from your data as key",
178
- });
179
- }
180
- }
181
- }
182
- }
183
- },
184
-
185
- // Track useState calls
186
- CallExpression(path) {
187
- const node = path.node;
188
- const callee = node.callee;
189
- const loc = node.loc?.start;
190
-
191
- // Track useState
192
- if (t.isIdentifier(callee, { name: "useState" })) {
193
- const varDecl = path.findParent(p => p.isVariableDeclarator());
194
- if (varDecl && t.isArrayPattern(varDecl.node.id)) {
195
- const [stateVar, setterVar] = varDecl.node.id.elements;
196
- if (t.isIdentifier(stateVar) && t.isIdentifier(setterVar)) {
197
- stateVars.set(stateVar.name, setterVar.name);
198
- setterToVar.set(setterVar.name, stateVar.name);
199
- }
200
- }
201
-
202
- // Track for conditional/loop detection
203
- if (isInReactContext(path)) {
204
- hookCalls.push({ name: "useState", loc, path });
205
-
206
- if (isInConditional(path)) {
207
- hasConditionalHook = true;
208
- if (loc) {
209
- findings.push({
210
- type: "conditional_hook",
211
- severity: "BLOCK",
212
- category: "ReactPatterns",
213
- file: filePath,
214
- line: loc.line,
215
- column: loc.column,
216
- title: "Hook called conditionally",
217
- message: "Hooks must be called in the same order every render. Don't call hooks inside conditions.",
218
- codeSnippet: snippetForLine(lines, loc.line),
219
- confidence: "high",
220
- fixHint: "Move hook call to top level of component",
221
- });
222
- }
223
- }
224
-
225
- if (isInLoop(path)) {
226
- hasLoopHook = true;
227
- if (loc) {
228
- findings.push({
229
- type: "hook_in_loop",
230
- severity: "BLOCK",
231
- category: "ReactPatterns",
232
- file: filePath,
233
- line: loc.line,
234
- column: loc.column,
235
- title: "Hook called inside loop",
236
- message: "Hooks must be called in the same order every render. Don't call hooks inside loops.",
237
- codeSnippet: snippetForLine(lines, loc.line),
238
- confidence: "high",
239
- fixHint: "Move hook call to top level of component",
240
- });
241
- }
242
- }
243
- }
244
- }
245
-
246
- // Track other hooks
247
- if (t.isIdentifier(callee) && /^use[A-Z]/.test(callee.name)) {
248
- if (isInReactContext(path)) {
249
- hookCalls.push({ name: callee.name, loc, path });
250
-
251
- if (isInConditional(path) && !hasConditionalHook) {
252
- hasConditionalHook = true;
253
- if (loc) {
254
- findings.push({
255
- type: "conditional_hook",
256
- severity: "BLOCK",
257
- category: "ReactPatterns",
258
- file: filePath,
259
- line: loc.line,
260
- column: loc.column,
261
- title: `Hook '${callee.name}' called conditionally`,
262
- message: "Hooks must be called in the same order every render.",
263
- codeSnippet: snippetForLine(lines, loc.line),
264
- confidence: "high",
265
- fixHint: "Move hook call to top level of component",
266
- });
267
- }
268
- }
269
- }
270
- }
271
-
272
- // Check useEffect for missing dependencies
273
- if (t.isIdentifier(callee, { name: "useEffect" }) ||
274
- t.isIdentifier(callee, { name: "useLayoutEffect" }) ||
275
- t.isIdentifier(callee, { name: "useCallback" }) ||
276
- t.isIdentifier(callee, { name: "useMemo" })) {
277
-
278
- const args = node.arguments;
279
-
280
- // Check for missing dependency array
281
- if (args.length === 1 && callee.name === "useEffect") {
282
- if (loc) {
283
- findings.push({
284
- type: "missing_deps_array",
285
- severity: "WARN",
286
- category: "ReactPatterns",
287
- file: filePath,
288
- line: loc.line,
289
- column: loc.column,
290
- title: "useEffect without dependency array",
291
- message: "useEffect without dependency array runs on every render. Add [] for mount-only or specify dependencies.",
292
- codeSnippet: snippetForLine(lines, loc.line),
293
- confidence: "med",
294
- fixHint: "Add dependency array: useEffect(() => { ... }, [])",
295
- });
296
- }
297
- }
298
-
299
- // Check for empty dependency array with external references
300
- if (args.length === 2 && t.isArrayExpression(args[1]) && args[1].elements.length === 0) {
301
- // Check if callback uses external variables
302
- const callback = args[0];
303
- if (t.isArrowFunctionExpression(callback) || t.isFunctionExpression(callback)) {
304
- const usedVars = new Set();
305
-
306
- traverse(callback.body, {
307
- Identifier(innerPath) {
308
- // Skip if it's a declaration
309
- if (innerPath.isBindingIdentifier()) return;
310
- // Skip property names
311
- if (innerPath.parentPath.isMemberExpression() &&
312
- innerPath.key === "property" &&
313
- !innerPath.parentPath.node.computed) return;
314
-
315
- usedVars.add(innerPath.node.name);
316
- },
317
- noScope: true,
318
- }, path.scope);
319
-
320
- // Check if any state variables are used
321
- const stateUsed = [];
322
- for (const [stateVar, _] of stateVars) {
323
- if (usedVars.has(stateVar)) {
324
- stateUsed.push(stateVar);
325
- }
326
- }
327
-
328
- if (stateUsed.length > 0) {
329
- if (loc) {
330
- findings.push({
331
- type: "stale_closure",
332
- severity: "WARN",
333
- category: "ReactPatterns",
334
- file: filePath,
335
- line: loc.line,
336
- column: loc.column,
337
- title: "Possible stale closure",
338
- message: `Effect uses state [${stateUsed.join(", ")}] but has empty deps. Values may be stale.`,
339
- codeSnippet: snippetForLine(lines, loc.line),
340
- confidence: "med",
341
- fixHint: `Add dependencies: [${stateUsed.join(", ")}]`,
342
- });
343
- }
344
- }
345
- }
346
- }
347
- }
348
- },
349
-
350
- // Detect direct state mutation
351
- AssignmentExpression(path) {
352
- const node = path.node;
353
- const left = node.left;
354
- const loc = node.loc?.start;
355
-
356
- if (!loc) return;
357
-
358
- // Check for state.x = ... or state[x] = ...
359
- if (t.isMemberExpression(left)) {
360
- const objName = t.isIdentifier(left.object) ? left.object.name : null;
361
-
362
- if (objName && stateVars.has(objName)) {
363
- findings.push({
364
- type: "direct_state_mutation",
365
- severity: "WARN",
366
- category: "ReactPatterns",
367
- file: filePath,
368
- line: loc.line,
369
- column: loc.column,
370
- title: `Direct mutation of state '${objName}'`,
371
- message: "Don't mutate state directly. Use the setter function instead.",
372
- codeSnippet: snippetForLine(lines, loc.line),
373
- confidence: "high",
374
- fixHint: `Use ${stateVars.get(objName)}(prev => ({ ...prev, ... }))`,
375
- });
376
- }
377
- }
378
- },
379
-
380
- // Check for array/object methods that mutate state directly
381
- MemberExpression(path) {
382
- const node = path.node;
383
- const loc = node.loc?.start;
384
-
385
- if (!loc) return;
386
-
387
- // Methods that mutate arrays
388
- const mutatingMethods = ["push", "pop", "shift", "unshift", "splice", "sort", "reverse", "fill"];
389
-
390
- if (t.isIdentifier(node.property) && mutatingMethods.includes(node.property.name)) {
391
- const objName = t.isIdentifier(node.object) ? node.object.name : null;
392
-
393
- if (objName && stateVars.has(objName)) {
394
- // Check if it's being called
395
- if (path.parentPath.isCallExpression() && path.parentPath.node.callee === node) {
396
- findings.push({
397
- type: "mutating_state_array",
398
- severity: "WARN",
399
- category: "ReactPatterns",
400
- file: filePath,
401
- line: loc.line,
402
- column: loc.column,
403
- title: `Mutating state array with '${node.property.name}'`,
404
- message: `${node.property.name}() mutates the array. Create a new array instead.`,
405
- codeSnippet: snippetForLine(lines, loc.line),
406
- confidence: "high",
407
- fixHint: "Use spread: setArr([...arr, newItem]) or filter/map",
408
- });
409
- }
410
- }
411
- }
412
- },
413
-
414
- // Check for props spreading anti-pattern
415
- JSXSpreadAttribute(path) {
416
- const node = path.node;
417
- const loc = node.loc?.start;
418
-
419
- if (!loc) return;
420
-
421
- // Check if spreading props directly to DOM element
422
- const jsxElement = path.findParent(p => p.isJSXElement());
423
- if (jsxElement) {
424
- const elementName = jsxElement.node.openingElement.name;
425
-
426
- // Check if it's a DOM element (lowercase)
427
- if (t.isJSXIdentifier(elementName) && /^[a-z]/.test(elementName.name)) {
428
- findings.push({
429
- type: "props_spreading_dom",
430
- severity: "INFO",
431
- category: "ReactPatterns",
432
- file: filePath,
433
- line: loc.line,
434
- column: loc.column,
435
- title: "Props spreading to DOM element",
436
- message: "Spreading props to DOM elements can pass invalid attributes.",
437
- codeSnippet: snippetForLine(lines, loc.line),
438
- confidence: "low",
439
- fixHint: "Explicitly list props or filter before spreading",
440
- });
441
- }
442
- }
443
- },
444
-
445
- // Check for missing displayName on components
446
- // (useful for debugging in React DevTools)
447
- });
448
-
449
- return findings;
450
- }
451
-
452
- module.exports = {
453
- analyzeReactPatterns,
454
- isInReactContext,
455
- isInConditional,
456
- isInLoop,
457
- };