@vibecodeqa/cli 0.13.0 → 0.14.0

package/dist/runners/standards.js

@@ -1,19 +1,40 @@
 /** Code standards check — naming conventions, anti-patterns, config hygiene. */
-import { readFileSync, readdirSync, statSync } from "node:fs";
+import { readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, extname, join } from "node:path";
 import { gradeFromScore } from "../types.js";
 const CODE_SMELLS = [
-    { name: "console.log", pattern: /\bconsole\.(log|debug|info)\s*\(/, severity: "warning", message: "console.log in production code", exclude: /\/\/ ?ok|eslint-disable|biome-ignore/ },
+    {
+        name: "console.log",
+        pattern: /\bconsole\.(log|debug|info)\s*\(/,
+        severity: "warning",
+        message: "console.log in production code",
+        exclude: /\/\/ ?ok|eslint-disable|biome-ignore/,
+    },
     { name: "var keyword", pattern: /\bvar\s+\w/, severity: "error", message: "Use const/let instead of var" },
     { name: "loose equality", pattern: /[^!=]==[^=]/, severity: "warning", message: "Use === instead of ==", exclude: /['"]use strict['"]/ },
     { name: "eval()", pattern: /\beval\s*\(/, severity: "error", message: "eval() is a security risk — never use it" },
     { name: "new Function()", pattern: /new\s+Function\s*\(/, severity: "error", message: "new Function() is equivalent to eval()" },
-    { name: "innerHTML assignment", pattern: /\.innerHTML\s*=/, severity: "warning", message: "innerHTML is an XSS vector — use textContent or DOM APIs" },
-    { name: "dangerouslySetInnerHTML", pattern: /dangerouslySetInnerHTML/, severity: "error", message: "dangerouslySetInnerHTML bypasses React's XSS protection" },
+    {
+        name: "innerHTML assignment",
+        pattern: /\.innerHTML\s*=/,
+        severity: "warning",
+        message: "innerHTML is an XSS vector — use textContent or DOM APIs",
+    },
+    {
+        name: "dangerouslySetInnerHTML",
+        pattern: /dangerouslySetInnerHTML/,
+        severity: "error",
+        message: "dangerouslySetInnerHTML bypasses React's XSS protection",
+    },
     { name: "document.write", pattern: /document\.write\s*\(/, severity: "error", message: "document.write blocks rendering" },
     { name: "http:// URL", pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1)/, severity: "warning", message: "Non-HTTPS URL — use https://" },
     { name: "TODO/FIXME", pattern: /\b(TODO|FIXME|HACK|XXX)\b/, severity: "warning", message: "Unresolved TODO/FIXME comment" },
-    { name: "magic number", pattern: /(?:timeout|delay|interval|limit|max|min)\s*[:=]\s*\d{4,}(?!\d)/, severity: "warning", message: "Large magic number — consider a named constant" },
+    {
+        name: "magic number",
+        pattern: /(?:timeout|delay|interval|limit|max|min)\s*[:=]\s*\d{4,}(?!\d)/,
+        severity: "warning",
+        message: "Large magic number — consider a named constant",
+    },
 ];
 export function runStandards(cwd, stack) {
     const start = Date.now();
@@ -25,7 +46,9 @@ export function runStandards(cwd, stack) {
         try {
             collectFiles(join(cwd, dir), cwd, files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     // ── File naming conventions ──
     let namingViolations = 0;
@@ -49,7 +72,12 @@ export function runStandards(cwd, stack) {
             // PascalCase .ts file (not a component) — unusual
             // Only flag if it's not a class file
             if (!/export (default )?class /.test(f.content)) {
-                issues.push({ severity: "warning", message: `TS file uses PascalCase but doesn't export a class: ${name}`, file: f.path, rule: "file-naming" });
+                issues.push({
+                    severity: "warning",
+                    message: `TS file uses PascalCase but doesn't export a class: ${name}`,
+                    file: f.path,
+                    rule: "file-naming",
+                });
             }
         }
     }
@@ -71,11 +99,17 @@ export function runStandards(cwd, stack) {
         const lines = f.content.split("\n");
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            if (line.trim().startsWith("//") || line.trim().startsWith("*"))
+            const trimmed = line.trim();
+            if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+                continue;
+            if (/\bpattern\s*:|name:\s*["']|message:\s*["']|description:\s*["']|risk:\s*["']|recommendation:\s*["']/.test(trimmed))
                 continue;
             for (const check of CODE_SMELLS) {
+                // Skip console.log in CLI entry points (intentional output)
+                if (check.name === "console.log" && (f.path.includes("cli.") || f.path.includes("bin/")))
+                    continue;
                 if (check.pattern.test(line)) {
-                    if (check.exclude && check.exclude.test(line))
+                    if (check.exclude?.test(line))
                         continue;
                     smellCount++;
                     issues.push({ severity: check.severity, message: check.message, file: f.path, line: i + 1, rule: check.name });
@@ -94,10 +128,16 @@ export function runStandards(cwd, stack) {
                 if (tsconfig.compilerOptions?.strict === true)
                     strictFound = true;
             }
-            catch { /* no tsconfig */ }
+            catch {
+                /* no tsconfig */
+            }
         }
         if (!strictFound) {
-            issues.push({ severity: "warning", message: "TypeScript strict mode not enabled — add \"strict\": true to tsconfig", rule: "ts-strict" });
+            issues.push({
+                severity: "warning",
+                message: 'TypeScript strict mode not enabled — add "strict": true to tsconfig',
+                rule: "ts-strict",
+            });
         }
     }
     // Tailwind: check for inline styles when TW is available
@@ -111,7 +151,11 @@ export function runStandards(cwd, stack) {
                 inlineStyles += matches.length;
         }
         if (inlineStyles > 10) {
-            issues.push({ severity: "warning", message: `${inlineStyles} inline style objects in TSX — prefer Tailwind classes`, rule: "prefer-tailwind" });
+            issues.push({
+                severity: "warning",
+                message: `${inlineStyles} inline style objects in TSX — prefer Tailwind classes`,
+                rule: "prefer-tailwind",
+            });
         }
     }
     const errors = issues.filter((i) => i.severity === "error").length;
@@ -137,7 +181,7 @@ function collectFiles(dir, cwd, out) {
         else {
             const ext = extname(entry);
             if ([".ts", ".tsx", ".js", ".jsx"].includes(ext) && !entry.includes(".test.") && !entry.includes(".spec.")) {
-                out.push({ path: full.replace(cwd + "/", ""), content: readFileSync(full, "utf-8") });
+                out.push({ path: full.replace(`${cwd}/`, ""), content: readFileSync(full, "utf-8") });
             }
         }
     }

package/dist/runners/structure.js

@@ -1,6 +1,6 @@
 /** Project structure check — does the repo have standard files and conventions? */
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { join, extname } from "node:path";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { extname, join } from "node:path";
 import { gradeFromScore } from "../types.js";
 const EXPECTED_FILES = [
     { name: "package.json", path: "package.json", required: true, description: "Package manifest" },
@@ -54,7 +54,11 @@ export function runStructure(cwd, stack) {
         issues.push({ severity: "error", message: `No test files found (${srcCount} source files with zero tests)`, rule: "no-tests" });
     }
     else if (testRatio < 0.3 && srcCount > 3) {
-        issues.push({ severity: "warning", message: `Low test-to-source ratio: ${testCount} tests for ${srcCount} source files (${Math.round(testRatio * 100)}%)`, rule: "low-test-ratio" });
+        issues.push({
+            severity: "warning",
+            message: `Low test-to-source ratio: ${testCount} tests for ${srcCount} source files (${Math.round(testRatio * 100)}%)`,
+            rule: "low-test-ratio",
+        });
     }
     // Check package.json has essential scripts
     try {
@@ -65,7 +69,9 @@ export function runStructure(cwd, stack) {
         if (!scripts.build && !scripts.dev)
             issues.push({ severity: "info", message: "No 'build' or 'dev' script in package.json", rule: "no-build-script" });
     }
-    catch { /* no package.json or parse error */ }
+    catch {
+        /* no package.json or parse error */
+    }
     const errors = issues.filter((i) => i.severity === "error").length;
     const warnings = issues.filter((i) => i.severity === "warning").length;
     const score = Math.max(0, Math.min(100, 100 - errors * 15 - warnings * 5));
@@ -73,7 +79,7 @@ export function runStructure(cwd, stack) {
         name: "structure",
         score,
         grade: gradeFromScore(score),
-        details: { found, missing, srcFiles: srcCount, testFiles: testCount, testRatio: Math.round(testRatio * 100) + "%" },
+        details: { found, missing, srcFiles: srcCount, testFiles: testCount, testRatio: `${Math.round(testRatio * 100)}%` },
         issues,
         duration: Date.now() - start,
     };
@@ -84,7 +90,9 @@ function collectAll(cwd, src, test) {
         try {
             walk(join(cwd, dir), src, test);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
 }
 function walk(dir, src, test) {

package/dist/runners/testing.js

@@ -8,7 +8,7 @@
  *   5. Test quality — naming, assertions, mocking patterns, snapshot smell
  *   6. Pyramid balance — right ratio of fast-to-slow tests
  */
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, extname, join } from "node:path";
 import { gradeFromScore } from "../types.js";
 import { run } from "./exec.js";
@@ -36,7 +36,7 @@ function classifyTestFile(relPath, content) {
     return "unit";
 }
 function countPatterns(content) {
-    const assertions = (content.match(/\bexpect\s*\(/g) || []).length + (content.match(/\bassert[\.(]/g) || []).length;
+    const assertions = (content.match(/\bexpect\s*\(/g) || []).length + (content.match(/\bassert[.(]/g) || []).length;
     const mocks = (content.match(/\b(vi\.fn|jest\.fn|vi\.mock|jest\.mock|vi\.spyOn|jest\.spyOn|sinon\.(stub|spy|mock)|\.mockResolvedValue|\.mockReturnValue|\.mockImplementation)\b/g) || []).length;
     const snapshots = (content.match(/\btoMatchSnapshot|toMatchInlineSnapshot\b/g) || []).length;
     const describes = (content.match(/\bdescribe\s*\(/g) || []).length;
@@ -67,10 +67,16 @@ function walkTests(dir, cwd, out) {
         const ext = extname(entry);
         if (![".ts", ".tsx", ".js", ".jsx"].includes(ext))
             continue;
-        if (!entry.includes(".test.") && !entry.includes(".spec.") && !entry.includes(".e2e.") && !entry.includes(".int.") && !dir.includes("__tests__") && !dir.includes("/e2e") && !dir.includes("/test"))
+        if (!entry.includes(".test.") &&
+            !entry.includes(".spec.") &&
+            !entry.includes(".e2e.") &&
+            !entry.includes(".int.") &&
+            !dir.includes("__tests__") &&
+            !dir.includes("/e2e") &&
+            !dir.includes("/test"))
             continue;
         const content = readFileSync(full, "utf-8");
-        const relPath = full.replace(cwd + "/", "");
+        const relPath = full.replace(`${cwd}/`, "");
         const layer = classifyTestFile(relPath, content);
         const patterns = countPatterns(content);
         out.push({
@@ -88,7 +94,9 @@ function findSourceFiles(cwd) {
         try {
             walkSource(join(cwd, dir), cwd, files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     return files;
 }
@@ -103,7 +111,7 @@ function walkSource(dir, cwd, out) {
         else {
             const ext = extname(entry);
             if ([".ts", ".tsx", ".js", ".jsx"].includes(ext) && !entry.includes(".test.") && !entry.includes(".spec.")) {
-                out.push(full.replace(cwd + "/", ""));
+                out.push(full.replace(`${cwd}/`, ""));
             }
         }
     }
@@ -175,7 +183,9 @@ function collectCoverage(cwd, stack) {
                     };
                 }
             }
-            catch { /* parse failed */ }
+            catch {
+                /* parse failed */
+            }
         }
     }
     return null;
@@ -184,9 +194,7 @@ function collectCoverage(cwd, stack) {
 function executeTests(cwd, stack) {
     if (stack.testRunner === "none")
         return null;
-    const cmd = stack.testRunner === "vitest"
-        ? "npx vitest run --reporter=json 2>/dev/null || true"
-        : "npx jest --json 2>/dev/null || true";
+    const cmd = stack.testRunner === "vitest" ? "npx vitest run --reporter=json 2>/dev/null || true" : "npx jest --json 2>/dev/null || true";
     const { stdout } = run(cmd, cwd, 120_000);
     try {
         const jsonStart = stdout.indexOf("{");
@@ -199,7 +207,9 @@ function executeTests(cwd, stack) {
             };
         }
     }
-    catch { /* parse failed */ }
+    catch {
+        /* parse failed */
+    }
     return null;
 }
 function analyzeQuality(testFiles) {
@@ -253,10 +263,30 @@ export function runTesting(cwd, stack, skipExec) {
     for (const f of testFiles)
         layers[f.layer].push(f);
     const pyramid = {
-        unit: { present: layers.unit.length > 0, files: layers.unit.length, assertions: layers.unit.reduce((s, f) => s + f.assertions, 0), score: 0 },
-        integration: { present: layers.integration.length > 0, files: layers.integration.length, assertions: layers.integration.reduce((s, f) => s + f.assertions, 0), score: 0 },
-        component: { present: layers.component.length > 0, files: layers.component.length, assertions: layers.component.reduce((s, f) => s + f.assertions, 0), score: 0 },
-        e2e: { present: layers.e2e.length > 0, files: layers.e2e.length, assertions: layers.e2e.reduce((s, f) => s + f.assertions, 0), score: 0 },
+        unit: {
+            present: layers.unit.length > 0,
+            files: layers.unit.length,
+            assertions: layers.unit.reduce((s, f) => s + f.assertions, 0),
+            score: 0,
+        },
+        integration: {
+            present: layers.integration.length > 0,
+            files: layers.integration.length,
+            assertions: layers.integration.reduce((s, f) => s + f.assertions, 0),
+            score: 0,
+        },
+        component: {
+            present: layers.component.length > 0,
+            files: layers.component.length,
+            assertions: layers.component.reduce((s, f) => s + f.assertions, 0),
+            score: 0,
+        },
+        e2e: {
+            present: layers.e2e.length > 0,
+            files: layers.e2e.length,
+            assertions: layers.e2e.reduce((s, f) => s + f.assertions, 0),
+            score: 0,
+        },
     };
     // 3. E2E tool detection
     const e2eTool = detectE2E(cwd);
@@ -267,14 +297,26 @@ export function runTesting(cwd, stack, skipExec) {
         issues.push({ severity: "error", message: "No unit tests found — every project needs unit tests", rule: "no-unit-tests" });
     }
     if (!pyramid.integration.present && srcFiles.length > 5) {
-        issues.push({ severity: "warning", message: "No integration tests — consider testing service boundaries", rule: "no-integration-tests" });
+        issues.push({
+            severity: "warning",
+            message: "No integration tests — consider testing service boundaries",
+            rule: "no-integration-tests",
+        });
     }
     if (needsComponent && !pyramid.component.present) {
-        issues.push({ severity: "warning", message: `${stack.framework} project with no component tests — test your UI components`, rule: "no-component-tests" });
+        issues.push({
+            severity: "warning",
+            message: `${stack.framework} project with no component tests — test your UI components`,
+            rule: "no-component-tests",
+        });
     }
     if (needsE2E && !pyramid.e2e.present) {
         if (e2eTool.tool === "none") {
-            issues.push({ severity: "warning", message: "No E2E test framework (Playwright/Cypress) — critical user flows untested", rule: "no-e2e-framework" });
+            issues.push({
+                severity: "warning",
+                message: "No E2E test framework (Playwright/Cypress) — critical user flows untested",
+                rule: "no-e2e-framework",
+            });
         }
         else if (!e2eTool.configured) {
             issues.push({ severity: "info", message: `${e2eTool.tool} installed but not configured`, rule: "e2e-not-configured" });
@@ -285,7 +327,7 @@ export function runTesting(cwd, stack, skipExec) {
     }
     // 5. File pairing analysis
     const pairing = computePairing(srcFiles, testFiles);
-    const pairingPct = srcFiles.length > 0 ? Math.round(((pairing.paired) / Math.max(1, srcFiles.length - countUntestable(srcFiles))) * 100) : 100;
+    const pairingPct = srcFiles.length > 0 ? Math.round((pairing.paired / Math.max(1, srcFiles.length - countUntestable(srcFiles))) * 100) : 100;
     if (pairingPct < 30) {
         issues.push({ severity: "warning", message: `Only ${pairingPct}% of source files have matching test files`, rule: "low-test-pairing" });
     }
@@ -299,13 +341,25 @@ export function runTesting(cwd, stack, skipExec) {
     // 6. Test quality analysis
     const quality = analyzeQuality(testFiles);
     if (quality.avgAssertionsPerTest < 1) {
-        issues.push({ severity: "warning", message: `Low assertion density: ${quality.avgAssertionsPerTest} assertions/test (aim for 2+)`, rule: "low-assertions" });
+        issues.push({
+            severity: "warning",
+            message: `Low assertion density: ${quality.avgAssertionsPerTest} assertions/test (aim for 2+)`,
+            rule: "low-assertions",
+        });
     }
     if (quality.mockRatio > 0.5) {
-        issues.push({ severity: "warning", message: `High mock ratio: ${quality.mockRatio} mocks per assertion — tests may not reflect real behavior`, rule: "over-mocked" });
+        issues.push({
+            severity: "warning",
+            message: `High mock ratio: ${quality.mockRatio} mocks per assertion — tests may not reflect real behavior`,
+            rule: "over-mocked",
+        });
     }
     if (quality.snapshotRatio > 0.3) {
-        issues.push({ severity: "warning", message: `${Math.round(quality.snapshotRatio * 100)}% of assertions are snapshots — brittle, prefer explicit assertions`, rule: "snapshot-heavy" });
+        issues.push({
+            severity: "warning",
+            message: `${Math.round(quality.snapshotRatio * 100)}% of assertions are snapshots — brittle, prefer explicit assertions`,
+            rule: "snapshot-heavy",
+        });
     }
     // 7. Execute tests + collect coverage (unless --skip-tests)
     let execution = null;
@@ -321,17 +375,30 @@ export function runTesting(cwd, stack, skipExec) {
         }
         if (coverage) {
             if (coverage.branches < 50) {
-                issues.push({ severity: "warning", message: `Branch coverage ${coverage.branches}% — below 50% threshold`, rule: "low-branch-coverage" });
+                issues.push({
+                    severity: "warning",
+                    message: `Branch coverage ${coverage.branches}% — below 50% threshold`,
+                    rule: "low-branch-coverage",
+                });
             }
             if (coverage.statements < 60) {
-                issues.push({ severity: "warning", message: `Statement coverage ${coverage.statements}% — below 60% threshold`, rule: "low-statement-coverage" });
+                issues.push({
+                    severity: "warning",
+                    message: `Statement coverage ${coverage.statements}% — below 60% threshold`,
+                    rule: "low-statement-coverage",
+                });
             }
         }
     }
     // 8. Compute composite score
     let score = 0;
     // Pyramid presence (30 points)
-    const layerCount = [pyramid.unit.present, pyramid.integration.present, pyramid.component.present && needsComponent, pyramid.e2e.present && needsE2E].filter(Boolean).length;
+    const layerCount = [
+        pyramid.unit.present,
+        pyramid.integration.present,
+        pyramid.component.present && needsComponent,
+        pyramid.e2e.present && needsE2E,
+    ].filter(Boolean).length;
     const expectedLayers = 1 + (srcFiles.length > 5 ? 1 : 0) + (needsComponent ? 1 : 0) + (needsE2E ? 1 : 0);
     const pyramidScore = expectedLayers > 0 ? Math.round((layerCount / expectedLayers) * 30) : 30;
     score += pyramidScore;
@@ -376,18 +443,20 @@ export function runTesting(cwd, stack, skipExec) {
                 component: pyramid.component.files,
                 e2e: pyramid.e2e.files,
             },
-            layersPresent: layerCount + "/" + expectedLayers,
+            layersPresent: `${layerCount}/${expectedLayers}`,
             e2eTool: e2eTool.tool,
             testFiles: testFiles.length,
             srcFiles: srcFiles.length,
-            pairing: pairingPct + "%",
+            pairing: `${pairingPct}%`,
             quality: {
                 assertionsPerTest: quality.avgAssertionsPerTest,
                 mockRatio: quality.mockRatio,
                 snapshotRatio: quality.snapshotRatio,
             },
             ...(execution ? { passed: execution.passed, failed: execution.failed, total: execution.total } : {}),
-            ...(coverage ? { coverage: { stmts: coverage.statements, branches: coverage.branches, lines: coverage.lines, fns: coverage.functions } } : {}),
+            ...(coverage
+                ? { coverage: { stmts: coverage.statements, branches: coverage.branches, lines: coverage.lines, fns: coverage.functions } }
+                : {}),
         },
         issues,
         duration: Date.now() - start,

package/dist/runners/type-safety.js

@@ -21,18 +21,31 @@ export function runTypeSafety(cwd) {
         try {
             collectFiles(join(cwd, dir), files);
         }
-        catch { /* dir doesn't exist */ }
+        catch {
+            /* dir doesn't exist */
+        }
     }
     if (files.length === 0) {
-        return { name: "type-safety", score: 100, grade: "A", details: { skipped: true, reason: "no source files" }, issues: [], duration: Date.now() - start };
+        return {
+            name: "type-safety",
+            score: 100,
+            grade: "A",
+            details: { skipped: true, reason: "no source files" },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     for (const file of files) {
         const content = readFileSync(file, "utf-8");
-        const relPath = file.replace(cwd + "/", "");
+        const relPath = file.replace(`${cwd}/`, "");
         const lines = content.split("\n");
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            if (line.trim().startsWith("//"))
+            const trimmed = line.trim();
+            if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+                continue;
+            // Skip pattern definition lines (prevents false positives when scanning own code)
+            if (/\bpattern\s*:|name:\s*["']|message:\s*["']|description:\s*["']|risk:\s*["']|recommendation:\s*["']/.test(trimmed))
                 continue;
             for (const p of PATTERNS) {
                 const matches = line.match(p.pattern);

package/dist/runners/types-check.js

@@ -6,8 +6,7 @@ import { run } from "./exec.js";
 export function runTypeCheck(cwd) {
     const start = Date.now();
     const issues = [];
-    if (!existsSync(join(cwd, "tsconfig.json")) &&
-        !existsSync(join(cwd, "tsconfig.app.json"))) {
+    if (!existsSync(join(cwd, "tsconfig.json")) && !existsSync(join(cwd, "tsconfig.app.json"))) {
         return {
             name: "types",
             score: 0,
@@ -25,7 +24,7 @@ export function runTypeCheck(cwd) {
             issues.push({
                 severity: "error",
                 file: match[1],
-                line: parseInt(match[2]),
+                line: parseInt(match[2], 10),
                 rule: match[3],
                 message: match[4],
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibecodeqa/cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Code health scanner for the AI coding era. 15 checks, zero config, full report.",
   "type": "module",
   "bin": {