@vibecodeqa/cli 0.13.0 → 0.14.0

package/dist/runners/confusion.js

@@ -17,20 +17,65 @@ import { basename, extname, join } from "node:path";
 import { gradeFromScore } from "../types.js";
 // ── Pattern dictionaries ──
 const SYNONYM_PAIRS = [
-    ["utils", "helpers"], ["util", "helper"],
-    ["types", "interfaces"], ["types", "models"], ["interfaces", "models"],
-    ["constants", "config"], ["constants", "settings"], ["config", "settings"],
-    ["service", "controller"], ["service", "handler"], ["controller", "handler"],
-    ["store", "state"], ["context", "provider"],
+    ["utils", "helpers"],
+    ["util", "helper"],
+    ["types", "interfaces"],
+    ["types", "models"],
+    ["interfaces", "models"],
+    ["constants", "config"],
+    ["constants", "settings"],
+    ["config", "settings"],
+    ["service", "controller"],
+    ["service", "handler"],
+    ["controller", "handler"],
+    ["store", "state"],
+    ["context", "provider"],
 ];
 const GENERIC_NAMES = new Set([
-    "process", "handle", "run", "execute", "do", "perform", "make",
-    "get", "set", "update", "create", "delete", "remove", "add",
-    "data", "result", "item", "value", "info", "temp", "obj",
-    "stuff", "thing", "ret", "val", "res", "output", "input",
-    "response", "request", "payload", "body", "args", "params",
-    "list", "arr", "map", "dict", "collection",
-    "callback", "cb", "fn", "func", "handler",
+    "process",
+    "handle",
+    "run",
+    "execute",
+    "do",
+    "perform",
+    "make",
+    "get",
+    "set",
+    "update",
+    "create",
+    "delete",
+    "remove",
+    "add",
+    "data",
+    "result",
+    "item",
+    "value",
+    "info",
+    "temp",
+    "obj",
+    "stuff",
+    "thing",
+    "ret",
+    "val",
+    "res",
+    "output",
+    "input",
+    "response",
+    "request",
+    "payload",
+    "body",
+    "args",
+    "params",
+    "list",
+    "arr",
+    "map",
+    "dict",
+    "collection",
+    "callback",
+    "cb",
+    "fn",
+    "func",
+    "handler",
 ]);
 const AMBIGUOUS_ABBREVS = {
     auth: "authentication OR authorization",
@@ -58,10 +103,19 @@ export function runConfusion(cwd) {
         try {
             collectFiles(join(cwd, dir), cwd, files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     if (files.length === 0) {
-        return { name: "confusion", score: 100, grade: "A", details: { skipped: true, reason: "no source files" }, issues: [], duration: Date.now() - start };
+        return {
+            name: "confusion",
+            score: 100,
+            grade: "A",
+            details: { skipped: true, reason: "no source files" },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     let fileConfusability = 0;
     let genericNames = 0;
@@ -75,13 +129,23 @@ export function runConfusion(cwd) {
             // Near-identical (Levenshtein ≤ 2)
             if (a !== b && levenshtein(a, b) <= 2) {
                 fileConfusability++;
-                issues.push({ severity: "warning", message: `Similar filenames: ${a} ↔ ${b} (edit distance ${levenshtein(a, b)})`, file: files[i].path, rule: "similar-filename" });
+                issues.push({
+                    severity: "warning",
+                    message: `Similar filenames: ${a} ↔ ${b} (edit distance ${levenshtein(a, b)})`,
+                    file: files[i].path,
+                    rule: "similar-filename",
+                });
             }
             // Synonym pairs
             for (const [s1, s2] of SYNONYM_PAIRS) {
                 if ((a.includes(s1) && b.includes(s2)) || (a.includes(s2) && b.includes(s1))) {
                     fileConfusability++;
-                    issues.push({ severity: "warning", message: `Synonym filenames: ${a} ↔ ${b} (${s1}/${s2} are interchangeable — pick one convention)`, file: files[i].path, rule: "synonym-filename" });
+                    issues.push({
+                        severity: "warning",
+                        message: `Synonym filenames: ${a} ↔ ${b} (${s1}/${s2} are interchangeable — pick one convention)`,
+                        file: files[i].path,
+                        rule: "synonym-filename",
+                    });
                     break;
                 }
             }
@@ -98,13 +162,25 @@ export function runConfusion(cwd) {
             const funcMatch = line.match(/^export\s+(?:async\s+)?function\s+(\w+)/);
             if (funcMatch && GENERIC_NAMES.has(funcMatch[1].toLowerCase())) {
                 genericNames++;
-                issues.push({ severity: "warning", message: `Generic export name: ${funcMatch[1]}() — not descriptive enough for LLM comprehension`, file: f.path, line: i + 1, rule: "generic-name" });
+                issues.push({
+                    severity: "warning",
+                    message: `Generic export name: ${funcMatch[1]}() — not descriptive enough for LLM comprehension`,
+                    file: f.path,
+                    line: i + 1,
+                    rule: "generic-name",
+                });
             }
             // Match standalone variable assignments with generic names
             const varMatch = line.match(/^(?:export\s+)?(?:const|let)\s+(\w+)\s*=/);
             if (varMatch && GENERIC_NAMES.has(varMatch[1].toLowerCase()) && varMatch[1].length <= 6) {
                 genericNames++;
-                issues.push({ severity: "warning", message: `Generic variable: ${varMatch[1]} — use a descriptive name`, file: f.path, line: i + 1, rule: "generic-name" });
+                issues.push({
+                    severity: "warning",
+                    message: `Generic variable: ${varMatch[1]} — use a descriptive name`,
+                    file: f.path,
+                    line: i + 1,
+                    rule: "generic-name",
+                });
             }
         }
     }
@@ -120,7 +196,12 @@ export function runConfusion(cwd) {
     for (const [name, paths] of exportMap) {
         if (paths.length > 1) {
             exportCollisions++;
-            issues.push({ severity: "error", message: `Export collision: "${name}" exported from ${paths.length} files — LLMs may reference the wrong one`, file: paths.join(", "), rule: "export-collision" });
+            issues.push({
+                severity: "error",
+                message: `Export collision: "${name}" exported from ${paths.length} files — LLMs may reference the wrong one`,
+                file: paths.join(", "),
+                rule: "export-collision",
+            });
         }
     }
     // ── 4. Ambiguous abbreviations in filenames and exports ──
@@ -129,7 +210,12 @@ export function runConfusion(cwd) {
         for (const part of nameParts) {
             if (AMBIGUOUS_ABBREVS[part]) {
                 ambiguousAbbrevs++;
-                issues.push({ severity: "warning", message: `Ambiguous abbreviation "${part}" in filename — could mean: ${AMBIGUOUS_ABBREVS[part]}`, file: f.path, rule: "ambiguous-abbreviation" });
+                issues.push({
+                    severity: "warning",
+                    message: `Ambiguous abbreviation "${part}" in filename — could mean: ${AMBIGUOUS_ABBREVS[part]}`,
+                    file: f.path,
+                    rule: "ambiguous-abbreviation",
+                });
             }
         }
     }
@@ -189,7 +275,7 @@ function collectFiles(dir, cwd, out) {
             const ext = extname(entry);
             if ([".ts", ".tsx", ".js", ".jsx"].includes(ext) && !entry.includes(".test.") && !entry.includes(".spec.")) {
                 const content = readFileSync(full, "utf-8");
-                const relPath = full.replace(cwd + "/", "");
+                const relPath = full.replace(`${cwd}/`, "");
                 const base = basename(entry, ext);
                 out.push({ path: relPath, base, content, exports: extractExports(content) });
             }

package/dist/runners/context.js

@@ -27,10 +27,19 @@ export function runContext(cwd) {
         try {
             collectFiles(join(cwd, dir), cwd, files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     if (files.length === 0) {
-        return { name: "context", score: 100, grade: "A", details: { skipped: true, reason: "no source files" }, issues: [], duration: Date.now() - start };
+        return {
+            name: "context",
+            score: 100,
+            grade: "A",
+            details: { skipped: true, reason: "no source files" },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     let highTokenFiles = 0;
     let heavyImportFiles = 0;
@@ -42,7 +51,12 @@ export function runContext(cwd) {
         totalTokens += f.tokens;
         if (f.tokens > MAX_FILE_TOKENS) {
             highTokenFiles++;
-            issues.push({ severity: "warning", message: `~${f.tokens} tokens (>${MAX_FILE_TOKENS}) — large context cost for LLMs`, file: f.path, rule: "high-token-count" });
+            issues.push({
+                severity: "warning",
+                message: `~${f.tokens} tokens (>${MAX_FILE_TOKENS}) — large context cost for LLMs`,
+                file: f.path,
+                rule: "high-token-count",
+            });
         }
     }
     // ── 2. Import count per file ──
@@ -50,7 +64,12 @@ export function runContext(cwd) {
         totalImports += f.imports.length;
         if (f.imports.length > MAX_IMPORTS) {
             heavyImportFiles++;
-            issues.push({ severity: "warning", message: `${f.imports.length} imports (>${MAX_IMPORTS}) — consider splitting or co-locating`, file: f.path, rule: "heavy-imports" });
+            issues.push({
+                severity: "warning",
+                message: `${f.imports.length} imports (>${MAX_IMPORTS}) — consider splitting or co-locating`,
+                file: f.path,
+                rule: "heavy-imports",
+            });
         }
     }
     // ── 3. Circular dependency detection ──
@@ -81,7 +100,12 @@ export function runContext(cwd) {
         const exportCount = (f.content.match(/\bexport\s+/g) || []).length;
         if (f.imports.length > 8 && exportCount <= 1) {
             contextSinks++;
-            issues.push({ severity: "warning", message: `${f.imports.length} imports but only ${exportCount} export — hard to understand in isolation`, file: f.path, rule: "context-sink" });
+            issues.push({
+                severity: "warning",
+                message: `${f.imports.length} imports but only ${exportCount} export — hard to understand in isolation`,
+                file: f.path,
+                rule: "context-sink",
+            });
         }
     }
     // ── Score ──
@@ -141,7 +165,7 @@ function resolveImport(fromPath, importPath) {
             return resolved;
     }
     // Return with .ts as default assumption
-    return resolved + ".ts";
+    return `${resolved}.ts`;
 }
 // ── Cycle detection (DFS) ──
 function findCycles(graph) {
@@ -190,7 +214,7 @@ function collectFiles(dir, cwd, out) {
             const ext = extname(entry);
             if ([".ts", ".tsx", ".js", ".jsx"].includes(ext) && !entry.includes(".test.") && !entry.includes(".spec.")) {
                 const content = readFileSync(full, "utf-8");
-                const relPath = full.replace(cwd + "/", "");
+                const relPath = full.replace(`${cwd}/`, "");
                 const imports = parseImports(content);
                 const tokens = Math.round(content.length / CHARS_PER_TOKEN);
                 out.push({ path: relPath, content, imports, tokens });

package/dist/runners/dependencies.js

@@ -6,12 +6,8 @@ export function runDependencies(cwd, stack) {
     const issues = [];
     const pm = stack.packageManager;
     // Vulnerability audit
-    const auditCmd = pm === "pnpm"
-        ? "pnpm audit --json"
-        : pm === "yarn"
-            ? "yarn audit --json"
-            : "npm audit --json";
-    const auditResult = run(auditCmd + " 2>/dev/null || true", cwd);
+    const auditCmd = pm === "pnpm" ? "pnpm audit --json" : pm === "yarn" ? "yarn audit --json" : "npm audit --json";
+    const auditResult = run(`${auditCmd} 2>/dev/null || true`, cwd);
     let vulnCritical = 0, vulnHigh = 0, vulnModerate = 0, vulnLow = 0;
     try {
         const audit = JSON.parse(auditResult.stdout);
@@ -57,7 +53,7 @@ export function runDependencies(cwd, stack) {
         });
     // Outdated check
     const outdatedCmd = pm === "pnpm" ? "pnpm outdated --json" : "npm outdated --json";
-    const outdatedResult = run(outdatedCmd + " 2>/dev/null || true", cwd);
+    const outdatedResult = run(`${outdatedCmd} 2>/dev/null || true`, cwd);
     let outdatedCount = 0;
     let majorOutdated = 0;
     try {
@@ -81,11 +77,7 @@ export function runDependencies(cwd, stack) {
             message: `${majorOutdated} packages behind by a major version`,
         });
     // Score: -25 per critical, -15 per high, -5 per moderate, -1 per major outdated
-    const score = Math.max(0, Math.min(100, 100 -
-        vulnCritical * 25 -
-        vulnHigh * 15 -
-        vulnModerate * 5 -
-        majorOutdated * 1));
+    const score = Math.max(0, Math.min(100, 100 - vulnCritical * 25 - vulnHigh * 15 - vulnModerate * 5 - majorOutdated * 1));
     return {
         name: "dependencies",
         score,

package/dist/runners/docs.js

@@ -1,5 +1,5 @@
 /** Documentation check — README, JSDoc, code comments. */
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { extname, join } from "node:path";
 import { gradeFromScore } from "../types.js";
 export function runDocs(cwd) {
@@ -40,7 +40,9 @@ export function runDocs(cwd) {
         try {
             collectFiles(join(cwd, dir), files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     let totalExports = 0;
     let documentedExports = 0;
@@ -49,7 +51,10 @@ export function runDocs(cwd) {
         const lines = content.split("\n");
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i].trim();
-            if (line.startsWith("export function ") || line.startsWith("export async function ") || line.startsWith("export class ") || line.startsWith("export interface ")) {
+            if (line.startsWith("export function ") ||
+                line.startsWith("export async function ") ||
+                line.startsWith("export class ") ||
+                line.startsWith("export interface ")) {
                 totalExports++;
                 // Check if preceded by a JSDoc or // comment
                 const prevLine = i > 0 ? lines[i - 1].trim() : "";
@@ -63,7 +68,11 @@ export function runDocs(cwd) {
         const pct = Math.round((documentedExports / totalExports) * 100);
         exportDocScore = pct;
         if (pct < 30) {
-            issues.push({ severity: "warning", message: `Only ${pct}% of exports have documentation (${documentedExports}/${totalExports})`, rule: "undocumented-exports" });
+            issues.push({
+                severity: "warning",
+                message: `Only ${pct}% of exports have documentation (${documentedExports}/${totalExports})`,
+                rule: "undocumented-exports",
+            });
         }
     }
     else {
@@ -74,7 +83,12 @@ export function runDocs(cwd) {
         name: "docs",
         score,
         grade: gradeFromScore(score),
-        details: { readmeLines: existsSync(readmePath) ? readFileSync(readmePath, "utf-8").split("\n").length : 0, totalExports, documentedExports, documentedPct: totalExports > 0 ? Math.round((documentedExports / totalExports) * 100) + "%" : "n/a" },
+        details: {
+            readmeLines: existsSync(readmePath) ? readFileSync(readmePath, "utf-8").split("\n").length : 0,
+            totalExports,
+            documentedExports,
+            documentedPct: totalExports > 0 ? `${Math.round((documentedExports / totalExports) * 100)}%` : "n/a",
+        },
         issues,
         duration: Date.now() - start,
     };

package/dist/runners/duplication.js

@@ -13,10 +13,19 @@ export function runDuplication(cwd) {
         try {
             collectFiles(join(cwd, dir), files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     if (files.length < 2) {
-        return { name: "duplication", score: 100, grade: "A", details: { filesScanned: files.length, duplicates: 0 }, issues: [], duration: Date.now() - start };
+        return {
+            name: "duplication",
+            score: 100,
+            grade: "A",
+            details: { filesScanned: files.length, duplicates: 0 },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     // Simple line-based duplicate detection
     // Build a map of normalized line hashes → locations
@@ -24,7 +33,7 @@ export function runDuplication(cwd) {
     let totalSourceLines = 0;
     for (const file of files) {
         const content = readFileSync(file, "utf-8");
-        const relPath = file.replace(cwd + "/", "");
+        const relPath = file.replace(`${cwd}/`, "");
         const lines = content.split("\n");
         totalSourceLines += lines.length;
         for (let i = 0; i <= lines.length - MIN_LINES; i++) {
@@ -77,7 +86,7 @@ export function runDuplication(cwd) {
         name: "duplication",
         score,
         grade: gradeFromScore(score),
-        details: { filesScanned: files.length, totalSourceLines, duplicateBlocks: duplicates.length, duplicationPct: dupPct + "%" },
+        details: { filesScanned: files.length, totalSourceLines, duplicateBlocks: duplicates.length, duplicationPct: `${dupPct}%` },
         issues,
         duration: Date.now() - start,
     };

package/dist/runners/lint.js

@@ -11,11 +11,7 @@ export function runLint(cwd, stack) {
             const diagnostics = data.diagnostics || [];
             for (const d of diagnostics) {
                 issues.push({
-                    severity: d.severity === "error"
-                        ? "error"
-                        : d.severity === "warning"
-                            ? "warning"
-                            : "info",
+                    severity: d.severity === "error" ? "error" : d.severity === "warning" ? "warning" : "info",
                     message: d.description || d.message || "lint issue",
                     file: d.location?.path,
                     line: d.location?.span?.start?.line,
@@ -27,9 +23,9 @@ export function runLint(cwd, stack) {
             // biome may not output valid JSON on some errors — count from summary
             const errors = stdout.match(/Found (\d+) error/)?.[1] || "0";
             const warnings = stdout.match(/Found (\d+) warning/)?.[1] || "0";
-            for (let i = 0; i < parseInt(errors); i++)
+            for (let i = 0; i < parseInt(errors, 10); i++)
                 issues.push({ severity: "error", message: "lint error" });
-            for (let i = 0; i < parseInt(warnings); i++)
+            for (let i = 0; i < parseInt(warnings, 10); i++)
                 issues.push({ severity: "warning", message: "lint warning" });
         }
     }

package/dist/runners/secrets.js

@@ -39,7 +39,7 @@ export function runSecrets(cwd) {
     collectFiles(cwd, files);
     for (const file of files) {
         const content = readFileSync(file, "utf-8");
-        const relPath = file.replace(cwd + "/", "");
+        const relPath = file.replace(`${cwd}/`, "");
         const lines = content.split("\n");
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
@@ -74,14 +74,7 @@ export function runSecrets(cwd) {
 }
 function collectFiles(dir, out) {
     for (const entry of readdirSync(dir)) {
-        if ([
-            "node_modules",
-            "dist",
-            ".git",
-            ".vibe-check",
-            "coverage",
-            "test-results",
-        ].includes(entry))
+        if (["node_modules", "dist", ".git", ".vibe-check", "coverage", "test-results"].includes(entry))
             continue;
         const full = join(dir, entry);
         const stat = statSync(full);
@@ -90,17 +83,7 @@ function collectFiles(dir, out) {
         }
         else {
             const ext = extname(entry);
-            if ([
-                ".ts",
-                ".tsx",
-                ".js",
-                ".jsx",
-                ".json",
-                ".env",
-                ".yaml",
-                ".yml",
-                ".toml",
-            ].includes(ext)) {
+            if ([".ts", ".tsx", ".js", ".jsx", ".json", ".env", ".yaml", ".yml", ".toml"].includes(ext)) {
                 out.push(full);
             }
         }

package/dist/runners/security.js

@@ -1,33 +1,123 @@
 /** Security analysis — beyond secrets, checks for vulnerable code patterns. */
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { extname, join } from "node:path";
 import { gradeFromScore } from "../types.js";
 const PATTERNS = [
     // XSS
-    { name: "innerHTML", pattern: /\.innerHTML\s*=/, severity: "warning", message: "XSS: innerHTML assignment — use textContent or DOM APIs", cwe: "CWE-79" },
-    { name: "dangerouslySetInnerHTML", pattern: /dangerouslySetInnerHTML/, severity: "error", message: "XSS: dangerouslySetInnerHTML bypasses React protection", cwe: "CWE-79" },
-    { name: "document.write", pattern: /document\.write\s*\(/, severity: "error", message: "XSS: document.write is dangerous", cwe: "CWE-79" },
+    {
+        name: "innerHTML",
+        pattern: /\.innerHTML\s*=/,
+        severity: "warning",
+        message: "XSS: innerHTML assignment — use textContent or DOM APIs",
+        cwe: "CWE-79",
+    },
+    {
+        name: "dangerouslySetInnerHTML",
+        pattern: /dangerouslySetInnerHTML/,
+        severity: "error",
+        message: "XSS: dangerouslySetInnerHTML bypasses React protection",
+        cwe: "CWE-79",
+    },
+    {
+        name: "document.write",
+        pattern: /document\.write\s*\(/,
+        severity: "error",
+        message: "XSS: document.write is dangerous",
+        cwe: "CWE-79",
+    },
     { name: "outerHTML", pattern: /\.outerHTML\s*=/, severity: "warning", message: "XSS: outerHTML assignment", cwe: "CWE-79" },
-    { name: "insertAdjacentHTML", pattern: /\.insertAdjacentHTML\s*\(/, severity: "warning", message: "XSS: insertAdjacentHTML with user data", cwe: "CWE-79" },
+    {
+        name: "insertAdjacentHTML",
+        pattern: /\.insertAdjacentHTML\s*\(/,
+        severity: "warning",
+        message: "XSS: insertAdjacentHTML with user data",
+        cwe: "CWE-79",
+    },
     // Injection
     { name: "eval", pattern: /\beval\s*\(/, severity: "error", message: "Injection: eval() executes arbitrary code", cwe: "CWE-94" },
-    { name: "new Function", pattern: /new\s+Function\s*\(/, severity: "error", message: "Injection: new Function() is equivalent to eval()", cwe: "CWE-94" },
-    { name: "child_process.exec", pattern: /\bexec(?:Sync)?\s*\((?!.*\{[^}]*encoding)/, severity: "warning", message: "Command injection risk: prefer execFile with argument array", cwe: "CWE-78" },
-    { name: "template literal in SQL", pattern: /(?:query|prepare|execute)\s*\(\s*`[^`]*\$\{/, severity: "error", message: "SQL injection: use parameterized queries instead of template literals", cwe: "CWE-89" },
+    {
+        name: "new Function",
+        pattern: /new\s+Function\s*\(/,
+        severity: "error",
+        message: "Injection: new Function() is equivalent to eval()",
+        cwe: "CWE-94",
+    },
+    {
+        name: "child_process.exec",
+        pattern: /\bexec(?:Sync)?\s*\((?!.*\{[^}]*encoding)/,
+        severity: "warning",
+        message: "Command injection risk: prefer execFile with argument array",
+        cwe: "CWE-78",
+    },
+    {
+        name: "template literal in SQL",
+        pattern: /(?:query|prepare|execute)\s*\(\s*`[^`]*\$\{/,
+        severity: "error",
+        message: "SQL injection: use parameterized queries instead of template literals",
+        cwe: "CWE-89",
+    },
     // Crypto
-    { name: "Math.random for security", pattern: /Math\.random\s*\(\).*(?:token|secret|key|password|nonce|salt)/i, severity: "error", message: "Weak randomness: use crypto.randomUUID() or crypto.getRandomValues()", cwe: "CWE-330" },
-    { name: "MD5/SHA1", pattern: /\b(?:md5|sha1|SHA1|MD5)\b/, severity: "warning", message: "Weak hash: MD5/SHA1 are broken — use SHA-256+", cwe: "CWE-328" },
+    {
+        name: "Math.random for security",
+        pattern: /Math\.random\s*\(\).*(?:token|secret|key|password|nonce|salt)/i,
+        severity: "error",
+        message: "Weak randomness: use crypto.randomUUID() or crypto.getRandomValues()",
+        cwe: "CWE-330",
+    },
+    {
+        name: "MD5/SHA1",
+        pattern: /\b(?:md5|sha1|SHA1|MD5)\b/,
+        severity: "warning",
+        message: "Weak hash: MD5/SHA1 are broken — use SHA-256+",
+        cwe: "CWE-328",
+    },
     // Prototype pollution
-    { name: "Object.assign from user input", pattern: /Object\.assign\s*\(\s*\{\s*\}\s*,\s*(?:req|request|body|params|query)/, severity: "warning", message: "Prototype pollution risk: validate/sanitize before Object.assign", cwe: "CWE-1321" },
-    { name: "spread from user input", pattern: /\{\s*\.\.\.(?:req|request|body|params|query)\./, severity: "warning", message: "Prototype pollution: spreading unvalidated user input", cwe: "CWE-1321" },
+    {
+        name: "Object.assign from user input",
+        pattern: /Object\.assign\s*\(\s*\{\s*\}\s*,\s*(?:req|request|body|params|query)/,
+        severity: "warning",
+        message: "Prototype pollution risk: validate/sanitize before Object.assign",
+        cwe: "CWE-1321",
+    },
+    {
+        name: "spread from user input",
+        pattern: /\{\s*\.\.\.(?:req|request|body|params|query)\./,
+        severity: "warning",
+        message: "Prototype pollution: spreading unvalidated user input",
+        cwe: "CWE-1321",
+    },
     // Path traversal
-    { name: "path traversal", pattern: /(?:readFile|writeFile|access|stat)(?:Sync)?\s*\([^)]*(?:req|request|body|params|query)/, severity: "warning", message: "Path traversal: validate file paths from user input", cwe: "CWE-22" },
+    {
+        name: "path traversal",
+        pattern: /(?:readFile|writeFile|access|stat)(?:Sync)?\s*\([^)]*(?:req|request|body|params|query)/,
+        severity: "warning",
+        message: "Path traversal: validate file paths from user input",
+        cwe: "CWE-22",
+    },
     // SSRF
-    { name: "fetch with user URL", pattern: /fetch\s*\(\s*(?:req|request|body|params|query)\.(?:url|href|target)/, severity: "warning", message: "SSRF: validate URLs before fetching user-supplied targets", cwe: "CWE-918" },
+    {
+        name: "fetch with user URL",
+        pattern: /fetch\s*\(\s*(?:req|request|body|params|query)\.(?:url|href|target)/,
+        severity: "warning",
+        message: "SSRF: validate URLs before fetching user-supplied targets",
+        cwe: "CWE-918",
+    },
     // Sensitive data
-    { name: "password in URL", pattern: /(?:password|secret|token|key)=[^&\s'"]+/i, severity: "warning", message: "Sensitive data in URL query string", cwe: "CWE-598" },
+    {
+        name: "password in URL",
+        pattern: /(?:password|secret|token|key)=[^&\s'"]+/i,
+        severity: "warning",
+        message: "Sensitive data in URL query string",
+        cwe: "CWE-598",
+    },
     // Missing security headers (in response construction)
-    { name: "no-cache header missing", pattern: /new Response\([^)]*\{[^}]*["']Set-Cookie["']/, severity: "warning", message: "Set-Cookie without Cache-Control: no-store", cwe: "CWE-525" },
+    {
+        name: "no-cache header missing",
+        pattern: /new Response\([^)]*\{[^}]*["']Set-Cookie["']/,
+        severity: "warning",
+        message: "Set-Cookie without Cache-Control: no-store",
+        cwe: "CWE-525",
+    },
 ];
 export function runSecurity(cwd) {
     const start = Date.now();
@@ -38,21 +128,33 @@ export function runSecurity(cwd) {
         try {
             collectFiles(join(cwd, dir), files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     if (files.length === 0) {
-        return { name: "security", score: 100, grade: "A", details: { skipped: true, reason: "no source files" }, issues: [], duration: Date.now() - start };
+        return {
+            name: "security",
+            score: 100,
+            grade: "A",
+            details: { skipped: true, reason: "no source files" },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     const cwePrefixes = new Set();
     for (const file of files) {
         const content = readFileSync(file, "utf-8");
-        const relPath = file.replace(cwd + "/", "");
+        const relPath = file.replace(`${cwd}/`, "");
         const lines = content.split("\n");
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             const trimmed = line.trim();
             if (trimmed.startsWith("//") || trimmed.startsWith("*"))
                 continue;
+            // Skip pattern/config definition lines (prevents false positives on own code)
+            if (/\bpattern\s*:|name:\s*["']|message:\s*["']|description:\s*["']|risk:\s*["']|recommendation:\s*["']/.test(trimmed))
+                continue;
             for (const p of PATTERNS) {
                 if (p.pattern.test(line)) {
                     issues.push({