@vibecodeqa/cli 0.12.1 → 0.14.0

package/dist/check-meta.js

@@ -153,7 +153,7 @@ export const CHECK_META = {
     },
 };
 export function getCheckMeta(name) {
-    return CHECK_META[name] || {
+    return (CHECK_META[name] || {
         name,
         label: name,
         category: "Other",
@@ -162,5 +162,5 @@ export function getCheckMeta(name) {
         description: "",
         risk: "",
         recommendation: "",
-    };
+    });
 }

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 /** vibe-check — code health scanner for the AI coding era. */
-import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { detectRepoUrl, detectStack } from "./detect.js";
 import { generateHTML } from "./report/html.js";
-import { runComplexity } from "./runners/complexity.js";
 import { runArchitecture } from "./runners/architecture.js";
+import { runComplexity } from "./runners/complexity.js";
 import { runConfusion } from "./runners/confusion.js";
 import { runContext } from "./runners/context.js";
 import { runDependencies } from "./runners/dependencies.js";
@@ -17,8 +17,8 @@ import { runSecurity } from "./runners/security.js";
 import { runStandards } from "./runners/standards.js";
 import { runStructure } from "./runners/structure.js";
 import { runTesting } from "./runners/testing.js";
-import { runTypeCheck } from "./runners/types-check.js";
 import { runTypeSafety } from "./runners/type-safety.js";
+import { runTypeCheck } from "./runners/types-check.js";
 import { computeScore } from "./score.js";
 import { computeTrend, formatTrend } from "./trend.js";
 import { gradeFromScore } from "./types.js";
@@ -43,14 +43,14 @@ async function main() {
     const start = Date.now();
     if (!jsonOnly) {
         console.log("");
-        console.log("  \x1b[1m\x1b[38;5;141mvcqa\x1b[0m v" + VERSION);
-        console.log("  \x1b[2m" + cwd + "\x1b[0m");
+        console.log(`  \x1b[1m\x1b[38;5;141mvcqa\x1b[0m v${VERSION}`);
+        console.log(`  \x1b[2m${cwd}\x1b[0m`);
         console.log("");
     }
     const stack = detectStack(cwd);
     if (!jsonOnly) {
         const parts = [stack.language, stack.framework, stack.bundler, stack.testRunner, stack.linter, stack.packageManager].filter((v) => v !== "none" && v !== "unknown");
-        console.log("  stack: " + parts.join(" + "));
+        console.log(`  stack: ${parts.join(" + ")}`);
         console.log("");
     }
     const checks = [];
@@ -80,14 +80,14 @@ async function main() {
     ];
     for (const runner of runners) {
         if (!jsonOnly)
-            process.stdout.write("  " + runner.name.padEnd(14));
+            process.stdout.write(`  ${runner.name.padEnd(14)}`);
         const result = runner.fn();
         checks.push(result);
         if (!jsonOnly) {
             const skipped = result.details.skipped;
             const c = skipped ? "\x1b[2m" : color(result.grade);
             const label = skipped ? "skip" : result.grade;
-            const scoreStr = skipped ? "—" : result.score + "/100";
+            const scoreStr = skipped ? "—" : `${result.score}/100`;
             const issueStr = result.issues.length > 0 ? `  \x1b[2m${result.issues.length} issues\x1b[0m` : "";
             console.log(`${c}${label.padEnd(5)}${scoreStr}\x1b[0m  \x1b[2m${result.duration}ms\x1b[0m${issueStr}`);
         }
@@ -115,13 +115,17 @@ async function main() {
     const historyFile = join(historyDir, `${report.timestamp.replace(/[:.]/g, "-")}.json`);
     writeFileSync(historyFile, JSON.stringify(report, null, 2));
     // Keep only last 30 history entries
-    const historyFiles = readdirSync(historyDir).filter((f) => f.endsWith(".json")).sort();
+    const historyFiles = readdirSync(historyDir)
+        .filter((f) => f.endsWith(".json"))
+        .sort();
     if (historyFiles.length > 30) {
         for (const old of historyFiles.slice(0, historyFiles.length - 30)) {
             try {
                 unlinkSync(join(historyDir, old));
             }
-            catch { /* ignore */ }
+            catch {
+                /* ignore */
+            }
         }
     }
     writeFileSync(join(outputDir, "report.json"), JSON.stringify(report, null, 2));
@@ -136,8 +140,8 @@ async function main() {
         if (trend)
             console.log(formatTrend(trend));
         console.log("");
-        console.log("  \x1b[2mReport: " + join(outputDir, "report.html") + "\x1b[0m");
-        console.log("  \x1b[2mJSON:   " + join(outputDir, "report.json") + "\x1b[0m");
+        console.log(`  \x1b[2mReport: ${join(outputDir, "report.html")}\x1b[0m`);
+        console.log(`  \x1b[2mJSON:   ${join(outputDir, "report.json")}\x1b[0m`);
         console.log("");
     }
     if (ciMode && score < 60) {
@@ -145,11 +149,13 @@ async function main() {
     }
     if (!jsonOnly && !ciMode && !watchMode) {
         try {
-            const { execSync } = await import("node:child_process");
+            const { execFileSync } = await import("node:child_process");
             const openCmd = process.platform === "darwin" ? "open" : "xdg-open";
-            execSync(`${openCmd} "${join(outputDir, "report.html")}"`, { stdio: "ignore" });
+            execFileSync(openCmd, [join(outputDir, "report.html")], { stdio: "ignore" });
+        }
+        catch {
+            /* failed to open browser */
         }
-        catch { /* failed to open browser */ }
     }
     // Watch mode — re-run on file changes
     if (watchMode) {
@@ -162,15 +168,20 @@ async function main() {
         console.log("  \x1b[2mWatching for changes... (Ctrl+C to stop)\x1b[0m");
         console.log("");
         let debounce = null;
+        let running = false;
         for (const dir of srcDirs) {
             watch(dir, { recursive: true }, (_event, filename) => {
                 if (!filename || filename.includes("node_modules") || filename.includes(".vibe-check"))
                     return;
+                if (running)
+                    return; // prevent concurrent re-runs (M5)
                 if (debounce)
                     clearTimeout(debounce);
-                debounce = setTimeout(() => {
+                debounce = setTimeout(async () => {
+                    running = true;
                     console.log(`  \x1b[2mChanged: ${filename} — re-scanning...\x1b[0m`);
-                    main().catch(() => { });
+                    await main().catch(() => { });
+                    running = false;
                 }, 500);
             });
         }

package/dist/detect.js

@@ -20,33 +20,11 @@ export function detectStack(cwd) {
         : allDeps.react || allDeps.vue
             ? "javascript"
             : "unknown";
-    const framework = allDeps.react
-        ? "react"
-        : allDeps.vue
-            ? "vue"
-            : allDeps.svelte
-                ? "svelte"
-                : "none";
-    const bundler = allDeps.vite
-        ? "vite"
-        : allDeps.webpack
-            ? "webpack"
-            : allDeps.esbuild
-                ? "esbuild"
-                : "none";
+    const framework = allDeps.react ? "react" : allDeps.vue ? "vue" : allDeps.svelte ? "svelte" : "none";
+    const bundler = allDeps.vite ? "vite" : allDeps.webpack ? "webpack" : allDeps.esbuild ? "esbuild" : "none";
     const testRunner = allDeps.vitest ? "vitest" : allDeps.jest ? "jest" : "none";
-    const linter = allDeps["@biomejs/biome"]
-        ? "biome"
-        : allDeps.eslint
-            ? "eslint"
-            : "none";
-    const packageManager = has("pnpm-lock.yaml")
-        ? "pnpm"
-        : has("bun.lockb")
-            ? "bun"
-            : has("yarn.lock")
-                ? "yarn"
-                : "npm";
+    const linter = allDeps["@biomejs/biome"] ? "biome" : allDeps.eslint ? "eslint" : "none";
+    const packageManager = has("pnpm-lock.yaml") ? "pnpm" : has("bun.lockb") ? "bun" : has("yarn.lock") ? "yarn" : "npm";
     return { language, framework, bundler, testRunner, linter, packageManager };
 }
 /** Detect GitHub/GitLab repo URL from git remote. */
@@ -55,7 +33,7 @@ export function detectRepoUrl(cwd) {
         const remote = execSync("git remote get-url origin", { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
         const branch = execSync("git branch --show-current", { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim() || "main";
         // Convert SSH to HTTPS
-        let url = remote
+        const url = remote
             .replace(/^git@github\.com:/, "https://github.com/")
             .replace(/^git@gitlab\.com:/, "https://gitlab.com/")
             .replace(/\.git$/, "");

package/dist/fs-utils.js

@@ -1,5 +1,5 @@
 /** Shared filesystem utilities — eliminates duplicate file-walking across runners. */
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, extname, join } from "node:path";
 const SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".vibe-check", "coverage", "test-results", "__pycache__"]);
 const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx"]);
@@ -12,7 +12,9 @@ export function collectSourceFiles(cwd, opts) {
         try {
             walk(join(cwd, dir), cwd, files, opts?.extraExts ? ALL_EXTS : CODE_EXTS);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     if (opts?.includeTests)
         return files;
@@ -53,6 +55,9 @@ function walk(dir, cwd, out, exts) {
         if (SKIP_DIRS.has(entry))
             continue;
         const full = join(dir, entry);
+        // Skip symlinks to prevent traversal attacks (H3)
+        if (lstatSync(full).isSymbolicLink())
+            continue;
         if (statSync(full).isDirectory()) {
             walk(full, cwd, out, exts);
         }
@@ -60,8 +65,11 @@ function walk(dir, cwd, out, exts) {
             const ext = extname(entry);
             if (!exts.has(ext))
                 continue;
+            // Skip files over 1MB to prevent memory issues (M1)
+            if (statSync(full).size > 1_000_000)
+                continue;
             const content = readFileSync(full, "utf-8");
-            const relPath = full.replace(cwd + "/", "");
+            const relPath = full.replace(`${cwd}/`, "");
             const isTest = entry.includes(".test.") || entry.includes(".spec.") || relPath.includes("__tests__");
             out.push({
                 path: relPath,

package/dist/report/html.js

@@ -11,14 +11,14 @@
 import { getCheckMeta } from "../check-meta.js";
 import { generateArchSVG } from "../runners/architecture.js";
 function e(s) {
-    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 /** Make a file path a clickable GitHub link if repoUrl is available. */
 function fileLink(path, line, repoUrl, branch) {
-    const clean = path.split(":")[0]; // strip :line from composite paths
-    if (!repoUrl)
+    const clean = path.split(":")[0];
+    if (!repoUrl || !/^https?:\/\//.test(repoUrl))
         return e(path);
-    const href = `${repoUrl}/blob/${branch}/${clean}${line ? "#L" + line : ""}`;
+    const href = `${repoUrl}/blob/${branch}/${clean}${line ? `#L${line}` : ""}`;
     return `<a href="${e(href)}" target="_blank" rel="noopener" class="flink">${e(path)}</a>`;
 }
 function gc(grade) {
@@ -83,17 +83,24 @@ export function generateHTML(report) {
     const topNav = topNavItems.map((t) => `<a class="tn" data-page="${t.id}" onclick="go('${t.id}')">${t.label}</a>`).join("");
     // Overview page
     const ringPct = report.score;
-    const barChart = active.sort((a, b) => a.score - b.score).map((c) => {
+    const barChart = active
+        .sort((a, b) => a.score - b.score)
+        .map((c) => {
         return `<div class="brow"><span class="bl">${e(c.name)}</span><div class="bb"><div class="bf" style="width:${c.score}%;background:${gc(c.grade)}"></div></div><span class="bv" style="color:${gc(c.grade)}">${c.grade} ${c.score}</span></div>`;
-    }).join("");
-    const catCards = catScores.map((cs) => {
+    })
+        .join("");
+    const catCards = catScores
+        .map((cs) => {
         const clr = gc(cs.avg >= 90 ? "A" : cs.avg >= 75 ? "B" : cs.avg >= 60 ? "C" : cs.avg >= 40 ? "D" : "F");
-        const mini = cs.checks.map((c) => {
+        const mini = cs.checks
+            .map((c) => {
             const sk = c.details.skipped;
             return `<span class="mc" style="color:${sk ? "#555" : gc(c.grade)}" title="${e(c.name)}: ${sk ? "skip" : c.score}">${sk ? "—" : c.grade}</span>`;
-        }).join("");
+        })
+            .join("");
         return `<div class="cc" onclick="go('${cs.id}')"><div class="cc-s" style="color:${clr}">${cs.avg}</div><div class="cc-l">${cs.label}</div><div class="cc-m">${mini}</div></div>`;
-    }).join("");
+    })
+        .join("");
     const radarSvg = buildRadar(catScores.map((cs) => ({ label: cs.label, score: cs.avg })));
     const overviewPage = `<div id="p-overview" class="page active">
 <div class="dash">
@@ -106,22 +113,31 @@ export function generateHTML(report) {
 <div class="cats">${catCards}</div>
 <h3>All Checks</h3>
 <div class="bars">${barChart}</div>
-<div class="stack">${Object.entries(report.meta.stack).filter(([, v]) => v !== "none" && v !== "unknown").map(([k, v]) => `<span>${k}: <b>${v}</b></span>`).join("")}</div>
+<div class="stack">${Object.entries(report.meta.stack)
+        .filter(([, v]) => v !== "none" && v !== "unknown")
+        .map(([k, v]) => `<span>${k}: <b>${v}</b></span>`)
+        .join("")}</div>
 </div>`;
     // Category pages (with sub-nav tabs for each check)
     let catPages = "";
     for (const cs of catScores) {
-        const subNav = cs.checks.map((c, i) => {
+        const subNav = cs.checks
+            .map((c, i) => {
             const sk = c.details.skipped;
             return `<a class="sn${i === 0 ? " active" : ""}" data-sub="${cs.id}-${c.name}" onclick="sub(this,'${cs.id}')">${e(c.name)} <span style="color:${sk ? "#555" : gc(c.grade)}">${sk ? "—" : c.grade}</span></a>`;
-        }).join("");
-        const subPages = cs.checks.map((c, i) => {
+        })
+            .join("");
+        const subPages = cs.checks
+            .map((c, i) => {
             const meta = getCheckMeta(c.name);
             const sk = c.details.skipped;
-            const detailsFiltered = Object.entries(c.details).filter(([k]) => k !== "skipped" && k !== "reason" && k !== "graph").map(([k, v]) => {
+            const detailsFiltered = Object.entries(c.details)
+                .filter(([k]) => k !== "skipped" && k !== "reason" && k !== "graph")
+                .map(([k, v]) => {
                 const d = Array.isArray(v) ? v.join(", ") : typeof v === "object" ? JSON.stringify(v) : String(v);
                 return `<div class="kv"><span class="k">${e(k)}</span><span class="v">${e(d)}</span></div>`;
-            }).join("");
+            })
+                .join("");
             // Group issues by file
             const byFile = new Map();
             const noFile = [];
@@ -140,9 +156,8 @@ export function generateHTML(report) {
             for (const [file, issues] of byFile) {
                 issuesHtml += `<div class="fg"><div class="fn">${fl(file)} <span class="fc">${issues.length}</span></div>`;
                 for (const iss of issues) {
-                    const promptText = `Fix this issue in ${e(file)}${iss.line ? ":" + iss.line : ""}\n${iss.severity}: ${e(iss.message)}${iss.rule ? " (" + e(iss.rule) + ")" : ""}\nCheck: ${e(c.name)}`;
-                    const safePrompt = promptText.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n");
-                    issuesHtml += `<div class="ir ${iss.severity}"><span class="is">${iss.severity[0].toUpperCase()}</span>${iss.line ? `<span class="il">${iss.line}</span>` : ""}<span class="im">${e(iss.message)}</span>${iss.rule ? `<span class="iru">${e(iss.rule)}</span>` : ""}<button class="cp-btn" onclick="navigator.clipboard.writeText('${safePrompt}');this.textContent='✓';setTimeout(()=>this.textContent='📋',1000)" title="Copy fix prompt">📋</button></div>`;
+                    const prompt = `Fix this issue in ${file}${iss.line ? `:${iss.line}` : ""}\n${iss.severity}: ${iss.message}${iss.rule ? ` (${iss.rule})` : ""}\nCheck: ${c.name}`;
+                    issuesHtml += `<div class="ir ${iss.severity}"><span class="is">${iss.severity[0].toUpperCase()}</span>${iss.line ? `<span class="il">${iss.line}</span>` : ""}<span class="im">${e(iss.message)}</span>${iss.rule ? `<span class="iru">${e(iss.rule)}</span>` : ""}<button class="cp-btn" data-prompt="${e(prompt)}" title="Copy fix prompt">📋</button></div>`;
                 }
                 issuesHtml += `</div>`;
             }
@@ -154,14 +169,15 @@ export function generateHTML(report) {
                 issuesHtml += `</div>`;
             }
             return `<div class="sp${i === 0 ? " active" : ""}" data-sub="${cs.id}-${c.name}">
-<div class="ch-head"><span class="ch-g" style="color:${sk ? "#555" : gc(c.grade)}">${sk ? "—" : c.grade}</span><div><b>${e(meta.label)}</b><span class="ch-s">${sk ? "skipped" : c.score + "/100"} · weight ${meta.weight}% · ${c.duration}ms · ${c.issues.length} issues</span></div><span class="pri" style="color:${pc(meta.priority)}">${meta.priority}</span></div>
+<div class="ch-head"><span class="ch-g" style="color:${sk ? "#555" : gc(c.grade)}">${sk ? "—" : c.grade}</span><div><b>${e(meta.label)}</b><span class="ch-s">${sk ? "skipped" : `${c.score}/100`} · weight ${meta.weight}% · ${c.duration}ms · ${c.issues.length} issues</span></div><span class="pri" style="color:${pc(meta.priority)}">${meta.priority}</span></div>
 ${meta.description ? `<div class="info-panel"><div class="ip-row"><span class="ip-label">What</span><span>${e(meta.description)}</span></div><div class="ip-row"><span class="ip-label">Risk</span><span>${e(meta.risk)}</span></div><div class="ip-row"><span class="ip-label">Fix</span><span>${e(meta.recommendation)}</span></div></div>` : ""}
 ${sk ? `<p class="skip-r">${e(c.details.reason || "skipped")}</p>` : ""}
 ${c.name === "architecture" && !sk ? `<div class="arch-svg">${generateArchSVG(c.details)}</div>` : ""}
 ${detailsFiltered ? `<div class="kvs">${detailsFiltered}</div>` : ""}
 ${issuesHtml ? `<div class="iss-list">${issuesHtml}</div>` : '<p style="color:var(--muted);font-size:0.8rem;margin-top:1rem">No issues found.</p>'}
 </div>`;
-        }).join("");
+        })
+            .join("");
         const clr = gc(cs.avg >= 90 ? "A" : cs.avg >= 75 ? "B" : cs.avg >= 60 ? "C" : cs.avg >= 40 ? "D" : "F");
         catPages += `<div id="p-${cs.id}" class="page">
 <div class="cat-head"><span style="color:${clr};font-size:1.8rem;font-weight:900">${cs.avg}</span><span style="color:${clr}">/100</span><span style="color:var(--muted);margin-left:0.5rem">${cs.label}</span></div>
@@ -172,10 +188,13 @@ ${subPages}
     }
     // All Issues page
     const allIssues = allChecks.flatMap((c) => c.issues.map((i) => ({ check: c.name, ...i })));
-    const issueRows = allIssues.slice(0, 200).map((i) => {
+    const issueRows = allIssues
+        .slice(0, 200)
+        .map((i) => {
         const loc = i.file ? fl(i.file.split(":")[0], i.line) : "";
         return `<tr class="${i.severity}"><td class="is2">${i.severity[0].toUpperCase()}</td><td class="ic2">${e(i.check)}</td><td class="il2">${loc}</td><td>${e(i.message)}</td><td class="iru2">${e(i.rule || "")}</td></tr>`;
-    }).join("");
+    })
+        .join("");
     const issuesPage = `<div id="p-issues" class="page">
 <h2>All Issues <span style="color:var(--muted);font-weight:400">${totalIssues}</span></h2>
 <div class="isf">${allIssues.filter((i) => i.severity === "error").length} errors · ${allIssues.filter((i) => i.severity === "warning").length} warnings</div>
@@ -183,23 +202,24 @@ ${subPages}
 ${allIssues.length > 200 ? `<p style="color:var(--muted);text-align:center;margin-top:1rem">Showing 200 of ${allIssues.length}</p>` : ""}
 </div>`;
     // File heatmap page
-    const fileRows = topFiles.map((f) => {
+    const fileRows = topFiles
+        .map((f) => {
         const pct = Math.min(100, f.total * 5);
         return `<div class="fr"><span class="ff">${fl(f.file)}</span><div class="fb"><div class="fbf" style="width:${pct}%;background:${f.errors > 0 ? "var(--fail)" : "var(--warn)"}"></div></div><span class="fv">${f.errors}E ${f.warnings}W</span><span class="fcs">${f.checks.join(", ")}</span></div>`;
-    }).join("");
+    })
+        .join("");
     const filesPage = `<div id="p-files" class="page">
 <h2>File Heatmap</h2>
 <p style="color:var(--muted);font-size:0.78rem;margin-bottom:1rem">Top ${topFiles.length} files by total issues across all checks</p>
 ${fileRows || '<p style="color:var(--muted)">No file-level issues found.</p>'}
 </div>`;
     // Codebase heatmap — each file = row of pixels, color = issue density
-    const heatmapFiles = [...fileIssues.entries()]
-        .sort((a, b) => b[1].errors + b[1].warnings - a[1].errors - a[1].warnings)
-        .slice(0, 30);
+    const heatmapFiles = [...fileIssues.entries()].sort((a, b) => b[1].errors + b[1].warnings - a[1].errors - a[1].warnings).slice(0, 30);
     let heatmapHtml = "";
     if (heatmapFiles.length > 0) {
         const maxIssues = Math.max(...heatmapFiles.map(([, d]) => d.errors + d.warnings));
-        heatmapHtml = heatmapFiles.map(([file, d]) => {
+        heatmapHtml = heatmapFiles
+            .map(([file, d]) => {
             const total = d.errors + d.warnings;
             const intensity = maxIssues > 0 ? total / maxIssues : 0;
             const r = Math.round(239 * intensity); // red channel
@@ -208,7 +228,8 @@ ${fileRows || '<p style="color:var(--muted)">No file-level issues found.</p>'}
             const barW = Math.max(4, Math.round(intensity * 200));
             const checks = [...d.checks].join(", ");
             return `<div class="hm-row"><span class="hm-name">${fl(file)}</span><div class="hm-bar" style="width:${barW}px;background:${color}" title="${total} issues (${checks})"></div><span class="hm-count">${d.errors}E ${d.warnings}W</span></div>`;
-        }).join("");
+        })
+            .join("");
     }
     const heatmapPage = `<div id="p-heatmap" class="page">
 <h2>Code Heatmap</h2>
@@ -360,14 +381,18 @@ h3{font-size:0.85rem;color:var(--muted);text-transform:uppercase;letter-spacing:
 
 <aside class="side">
   <div class="side-section">Score<div class="side-score" style="color:${gc(report.grade)}">${report.grade} ${report.score}</div></div>
-  ${catScores.map((cs) => {
+  ${catScores
+        .map((cs) => {
         const clr = gc(cs.avg >= 90 ? "A" : cs.avg >= 75 ? "B" : cs.avg >= 60 ? "C" : cs.avg >= 40 ? "D" : "F");
-        return `<div class="side-section"><a class="side-cat" onclick="go('${cs.id}')">${cs.label} <span style="color:${clr}">${cs.avg}</span></a>${cs.checks.map((c) => {
+        return `<div class="side-section"><a class="side-cat" onclick="go('${cs.id}')">${cs.label} <span style="color:${clr}">${cs.avg}</span></a>${cs.checks
+            .map((c) => {
             const sk = c.details.skipped;
             const meta = getCheckMeta(c.name);
             return `<a class="side-check" onclick="go('${cs.id}')" title="${e(meta.label)}"><span style="color:${sk ? "#555" : gc(c.grade)}">${sk ? "—" : c.grade}</span> ${e(meta.label)}</a>`;
-        }).join("")}</div>`;
-    }).join("")}
+        })
+            .join("")}</div>`;
+    })
+        .join("")}
 </aside>
 <div class="content">
   ${overviewPage}
@@ -390,6 +415,13 @@ function sub(el,cat){
   el.classList.add('active');
   document.querySelectorAll('#p-'+cat+' .sp').forEach(s=>{s.classList.toggle('active',s.dataset.sub===id)});
 }
+// Copy-prompt buttons — read from data-attribute (no inline JS with user data)
+document.addEventListener('click',function(ev){
+  var btn=ev.target.closest('.cp-btn');
+  if(!btn)return;
+  navigator.clipboard.writeText(btn.dataset.prompt||'');
+  btn.textContent='\\u2713';setTimeout(function(){btn.textContent='\\ud83d\\udccb'},1000);
+});
 // Init: show overview
 document.querySelector('.tn').classList.add('active');
 </script>
@@ -411,7 +443,9 @@ function buildRadar(items) {
     let grid = "";
     for (const pct of [25, 50, 75, 100]) {
         const rr = (pct / 100) * r;
-        const pts = items.map((_, i) => `${cx + rr * Math.cos(i * step - Math.PI / 2)},${cy + rr * Math.sin(i * step - Math.PI / 2)}`).join(" ");
+        const pts = items
+            .map((_, i) => `${cx + rr * Math.cos(i * step - Math.PI / 2)},${cy + rr * Math.sin(i * step - Math.PI / 2)}`)
+            .join(" ");
         grid += `<polygon points="${pts}" fill="none" stroke="#1e1e24" stroke-width="0.7"/>`;
     }
     let axes = "";
@@ -422,11 +456,13 @@ function buildRadar(items) {
         const ly = cy + (r + 16) * Math.sin(a);
         axes += `<text x="${lx}" y="${ly}" text-anchor="middle" dominant-baseline="middle" fill="#6b7280" font-size="9" font-weight="600">${items[i].label}</text>`;
     }
-    const dataPts = items.map((c, i) => {
+    const dataPts = items
+        .map((c, i) => {
         const a = i * step - Math.PI / 2;
         const rr = (c.score / 100) * r;
         return `${cx + rr * Math.cos(a)},${cy + rr * Math.sin(a)}`;
-    }).join(" ");
+    })
+        .join(" ");
     let dots = "";
     for (let i = 0; i < n; i++) {
         const a = i * step - Math.PI / 2;

package/dist/runners/architecture.js

@@ -10,14 +10,21 @@
  *   7. SVG architecture diagram
  */
 import { basename, dirname, extname } from "node:path";
-import { gradeFromScore } from "../types.js";
 import { getProductionFiles } from "../fs-utils.js";
+import { gradeFromScore } from "../types.js";
 export function runArchitecture(cwd) {
     const start = Date.now();
     const issues = [];
     const files = getProductionFiles(cwd);
     if (files.length < 2) {
-        return { name: "architecture", score: 100, grade: "A", details: { skipped: true, reason: "fewer than 2 source files" }, issues: [], duration: Date.now() - start };
+        return {
+            name: "architecture",
+            score: 100,
+            grade: "A",
+            details: { skipped: true, reason: "fewer than 2 source files" },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     const graph = buildGraph(files);
     // ── Circular dependencies ──
@@ -34,7 +41,12 @@ export function runArchitecture(cwd) {
     for (const [path, node] of graph.nodes) {
         if (node.importedBy.length >= threshold) {
             godModules.push(path);
-            issues.push({ severity: "warning", message: `God module: imported by ${node.importedBy.length}/${files.length} files — consider splitting`, file: path, rule: "god-module" });
+            issues.push({
+                severity: "warning",
+                message: `God module: imported by ${node.importedBy.length}/${files.length} files — consider splitting`,
+                file: path,
+                rule: "god-module",
+            });
         }
     }
     // ── Orphan files (not imported by anyone) ──
@@ -52,7 +64,12 @@ export function runArchitecture(cwd) {
     for (const [path, node] of graph.nodes) {
         if (node.imports.length > 10) {
             highFanOut++;
-            issues.push({ severity: "warning", message: `High fan-out: imports ${node.imports.length} modules — hard to test in isolation`, file: path, rule: "high-fan-out" });
+            issues.push({
+                severity: "warning",
+                message: `High fan-out: imports ${node.imports.length} modules — hard to test in isolation`,
+                file: path,
+                rule: "high-fan-out",
+            });
         }
     }
     // ── High fan-in + fan-out (connector files) ──
@@ -60,7 +77,12 @@ export function runArchitecture(cwd) {
     for (const [path, node] of graph.nodes) {
         if (node.imports.length > 5 && node.importedBy.length > 5) {
             connectors++;
-            issues.push({ severity: "warning", message: `Connector: ${node.imports.length} imports, ${node.importedBy.length} importers — high coupling`, file: path, rule: "connector-module" });
+            issues.push({
+                severity: "warning",
+                message: `Connector: ${node.imports.length} imports, ${node.importedBy.length} importers — high coupling`,
+                file: path,
+                rule: "connector-module",
+            });
         }
     }
     // ── Score ──
@@ -152,8 +174,8 @@ function resolveImport(fromPath, importPath, knownFiles) {
     }
     // Try index
     for (const ext of [".ts", ".tsx"]) {
-        if (knownFiles.has(resolved + "/index" + ext))
-            return resolved + "/index" + ext;
+        if (knownFiles.has(`${resolved}/index${ext}`))
+            return `${resolved}/index${ext}`;
     }
     return null;
 }

package/dist/runners/complexity.js

@@ -28,7 +28,7 @@ export function runComplexity(cwd) {
         const lines = content.split("\n");
         totalLines += lines.length;
         // Simple heuristic: find function boundaries and measure complexity
-        const funcs = extractFunctions(content, file.replace(cwd + "/", ""));
+        const funcs = extractFunctions(content, file.replace(`${cwd}/`, ""));
         for (const f of funcs) {
             functions.push(f);
             if (f.lines > MAX_FUNCTION_LINES) {
@@ -79,9 +79,7 @@ function collectFiles(dir, out) {
         }
         else {
             const ext = extname(entry);
-            if ((ext === ".ts" || ext === ".tsx" || ext === ".js" || ext === ".jsx") &&
-                !entry.includes(".test.") &&
-                !entry.includes(".spec.")) {
+            if ((ext === ".ts" || ext === ".tsx" || ext === ".js" || ext === ".jsx") && !entry.includes(".test.") && !entry.includes(".spec.")) {
                 out.push(full);
             }
         }