@vibecodeqa/cli 0.22.0 → 0.23.0

package/dist/cli.js

@@ -31,17 +31,22 @@ import { computeTrend, formatTrend } from "./trend.js";
 import { gradeFromScore } from "./types.js";
 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
 const VERSION = pkg.version;
-const args = process.argv.slice(2);
-const flags = new Set(args.filter((a) => a.startsWith("--")));
-const cwd = resolve(args.find((a) => !a.startsWith("--")) || ".");
-const outputDir = join(cwd, ".vibe-check");
-const jsonOnly = flags.has("--json");
-const ciMode = flags.has("--ci");
-const skipTests = flags.has("--skip-tests");
-const watchMode = flags.has("--watch");
-const badgeMode = flags.has("--badge");
-const sarifMode = flags.has("--sarif");
-const uploadMode = flags.has("--upload");
+function parseFlags() {
+    const args = process.argv.slice(2);
+    const flags = new Set(args.filter((a) => a.startsWith("--")));
+    const cwd = resolve(args.find((a) => !a.startsWith("--")) || ".");
+    return {
+        cwd,
+        outputDir: join(cwd, ".vibe-check"),
+        jsonOnly: flags.has("--json"),
+        ciMode: flags.has("--ci"),
+        skipTests: flags.has("--skip-tests"),
+        watchMode: flags.has("--watch"),
+        badgeMode: flags.has("--badge"),
+        sarifMode: flags.has("--sarif"),
+        uploadMode: flags.has("--upload"),
+    };
+}
 function color(grade) {
     if (grade === "A")
         return "\x1b[32m";
@@ -49,23 +54,7 @@ function color(grade) {
         return "\x1b[33m";
     return "\x1b[31m";
 }
-async function main() {
-    const start = Date.now();
-    if (!jsonOnly) {
-        console.log("");
-        console.log(`  \x1b[1m\x1b[38;5;141mvcqa\x1b[0m v${VERSION}`);
-        console.log(`  \x1b[2m${cwd}\x1b[0m`);
-        console.log("");
-    }
-    const stack = detectStack(cwd);
-    if (!jsonOnly) {
-        const parts = [stack.language, stack.framework, stack.bundler, stack.testRunner, stack.linter, stack.packageManager].filter((v) => v !== "none" && v !== "unknown");
-        console.log(`  stack: ${parts.join(" + ")}`);
-        console.log("");
-    }
-    const checks = [];
-    const isDart = stack.language === "dart";
-    // All runners grouped by category
+function runChecks(cwd, stack, skipTests, isDart, jsonOnly) {
     const runners = [
         // Foundations
         { name: "structure", fn: () => runStructure(cwd, stack) },
@@ -97,6 +86,7 @@ async function main() {
         { name: "doc-coherence", fn: () => runDocCoherence(cwd) },
         { name: "code-coherence", fn: () => runCodeCoherence(cwd) },
     ];
+    const checks = [];
     for (const runner of runners) {
         if (!jsonOnly)
             process.stdout.write(`  ${runner.name.padEnd(14)}`);
@@ -113,20 +103,9 @@ async function main() {
             console.log(`${c}${label.padEnd(5)}${scoreStr}\x1b[0m  \x1b[2m${result.duration}ms\x1b[0m${issueStr}`);
         }
     }
-    const score = computeScore(checks);
-    const grade = gradeFromScore(score);
-    const duration = Date.now() - start;
-    const totalIssues = checks.reduce((s, c) => s + c.issues.length, 0);
-    const report = {
-        version: VERSION,
-        timestamp: new Date().toISOString(),
-        score,
-        grade,
-        checks,
-        meta: { cwd, node: process.version, duration, stack, ...detectRepoUrl(cwd) },
-    };
-    // Trend comparison (read previous report before overwriting)
-    const trend = computeTrend(report, outputDir);
+    return checks;
+}
+async function writeOutputs(report, outputDir, flags) {
     if (!existsSync(outputDir))
         mkdirSync(outputDir, { recursive: true });
     // Save to history before overwriting current report
@@ -159,58 +138,127 @@ async function main() {
         writeFileSync(join(reportDir, filename), html);
     }
     // Badge SVG
-    if (badgeMode) {
+    if (flags.badgeMode) {
         const { buildBadge } = await import("./report/svg.js");
-        const badgeSvg = buildBadge(score, grade);
+        const badgeSvg = buildBadge(report.score, report.grade);
         writeFileSync(join(outputDir, "badge.svg"), badgeSvg);
     }
     // SARIF output for GitHub Code Scanning
-    if (sarifMode) {
+    if (flags.sarifMode) {
         const { generateSARIF } = await import("./report/sarif.js");
         writeFileSync(join(outputDir, "report.sarif"), generateSARIF(report));
     }
-    // Upload to VibeCode QA dashboard
-    if (uploadMode) {
-        const repo = report.meta.repoUrl?.replace(/^https:\/\/github\.com\//, "") || cwd.split("/").pop() || "project";
-        const token = process.env.VCQA_TOKEN || "";
-        try {
-            const res = await fetch("https://api.vibecodeqa.online/api/reports", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-                body: JSON.stringify({ repo, report }),
-            });
-            if (res.ok) {
-                const data = (await res.json());
-                if (!jsonOnly)
-                    console.log(`  \x1b[32m\u2713 Uploaded to dashboard\x1b[0m \x1b[2m(${data.totalReports || 1} reports)\x1b[0m`);
-            }
-            else if (!jsonOnly) {
-                console.log(`  \x1b[33m\u26a0 Upload failed: ${res.status}\x1b[0m \x1b[2m(set VCQA_TOKEN env var)\x1b[0m`);
-            }
-        }
-        catch {
-            if (!jsonOnly)
-                console.log(`  \x1b[33m\u26a0 Upload failed (network error)\x1b[0m`);
-        }
-    }
-    if (jsonOnly) {
+}
+function printResults(report, trend, flags, outputDir) {
+    const { score, grade, checks } = report;
+    const totalIssues = checks.reduce((s, c) => s + c.issues.length, 0);
+    if (flags.jsonOnly) {
         console.log(JSON.stringify(report));
     }
     else {
         const gc = color(grade);
         console.log("");
-        console.log(`  ${gc}\x1b[1m${grade}\x1b[0m ${gc}${score}/100\x1b[0m  \x1b[2m${checks.length} checks · ${totalIssues} issues · ${duration}ms\x1b[0m`);
+        console.log(`  ${gc}\x1b[1m${grade}\x1b[0m ${gc}${score}/100\x1b[0m  \x1b[2m${checks.length} checks · ${totalIssues} issues · ${report.meta.duration}ms\x1b[0m`);
         if (trend)
             console.log(formatTrend(trend));
         console.log("");
         console.log(`  \x1b[2mReport: ${join(outputDir, "report/index.html")}\x1b[0m`);
         console.log(`  \x1b[2mJSON:   ${join(outputDir, "report.json")}\x1b[0m`);
-        if (badgeMode)
+        if (flags.badgeMode)
             console.log(`  \x1b[2mBadge:  ${join(outputDir, "badge.svg")}\x1b[0m`);
-        if (sarifMode)
+        if (flags.sarifMode)
             console.log(`  \x1b[2mSARIF:  ${join(outputDir, "report.sarif")}\x1b[0m`);
         console.log("");
     }
+}
+async function handleUpload(report, cwd, jsonOnly) {
+    const repo = report.meta.repoUrl?.replace(/^https:\/\/github\.com\//, "") || cwd.split("/").pop() || "project";
+    const token = process.env.VCQA_TOKEN || "";
+    try {
+        const res = await fetch("https://api.vibecodeqa.online/api/reports", {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify({ repo, report }),
+        });
+        if (res.ok) {
+            const data = (await res.json());
+            if (!jsonOnly)
+                console.log(`  \x1b[32m\u2713 Uploaded to dashboard\x1b[0m \x1b[2m(${data.totalReports || 1} reports)\x1b[0m`);
+        }
+        else if (!jsonOnly) {
+            console.log(`  \x1b[33m\u26a0 Upload failed: ${res.status}\x1b[0m \x1b[2m(set VCQA_TOKEN env var)\x1b[0m`);
+        }
+    }
+    catch {
+        if (!jsonOnly)
+            console.log(`  \x1b[33m\u26a0 Upload failed (network error)\x1b[0m`);
+    }
+}
+async function startWatch(cwd) {
+    const { watch } = await import("node:fs");
+    const srcDirs = ["src", "web/src"].map((d) => join(cwd, d)).filter((d) => existsSync(d));
+    if (srcDirs.length === 0) {
+        console.log("  \x1b[31mNo src/ directory to watch\x1b[0m");
+        process.exit(1);
+    }
+    console.log("  \x1b[2mWatching for changes... (Ctrl+C to stop)\x1b[0m");
+    console.log("");
+    let debounce = null;
+    let running = false;
+    for (const dir of srcDirs) {
+        watch(dir, { recursive: true }, (_event, filename) => {
+            if (!filename || filename.includes("node_modules") || filename.includes(".vibe-check"))
+                return;
+            if (running)
+                return;
+            if (debounce)
+                clearTimeout(debounce);
+            debounce = setTimeout(async () => {
+                running = true;
+                console.log(`  \x1b[2mChanged: ${filename} — re-scanning...\x1b[0m`);
+                await main().catch(() => { });
+                running = false;
+            }, 500);
+        });
+    }
+    // Keep process alive
+    await new Promise(() => { });
+}
+async function main() {
+    const flags = parseFlags();
+    const { cwd, outputDir, jsonOnly, ciMode, skipTests, watchMode } = flags;
+    const start = Date.now();
+    if (!jsonOnly) {
+        console.log("");
+        console.log(`  \x1b[1m\x1b[38;5;141mvcqa\x1b[0m v${VERSION}`);
+        console.log(`  \x1b[2m${cwd}\x1b[0m`);
+        console.log("");
+    }
+    const stack = detectStack(cwd);
+    if (!jsonOnly) {
+        const parts = [stack.language, stack.framework, stack.bundler, stack.testRunner, stack.linter, stack.packageManager].filter((v) => v !== "none" && v !== "unknown");
+        console.log(`  stack: ${parts.join(" + ")}`);
+        console.log("");
+    }
+    const isDart = stack.language === "dart";
+    const checks = runChecks(cwd, stack, skipTests, isDart, jsonOnly);
+    const score = computeScore(checks);
+    const grade = gradeFromScore(score);
+    const duration = Date.now() - start;
+    const report = {
+        version: VERSION,
+        timestamp: new Date().toISOString(),
+        score,
+        grade,
+        checks,
+        meta: { cwd, node: process.version, duration, stack, ...detectRepoUrl(cwd) },
+    };
+    const trend = computeTrend(report, outputDir);
+    await writeOutputs(report, outputDir, flags);
+    printResults(report, trend, flags, outputDir);
+    if (flags.uploadMode) {
+        await handleUpload(report, cwd, jsonOnly);
+    }
     if (ciMode && score < 60) {
         process.exit(1);
     }
@@ -224,36 +272,8 @@ async function main() {
             /* failed to open browser */
         }
     }
-    // Watch mode — re-run on file changes
     if (watchMode) {
-        const { watch } = await import("node:fs");
-        const srcDirs = ["src", "web/src"].map((d) => join(cwd, d)).filter((d) => existsSync(d));
-        if (srcDirs.length === 0) {
-            console.log("  \x1b[31mNo src/ directory to watch\x1b[0m");
-            process.exit(1);
-        }
-        console.log("  \x1b[2mWatching for changes... (Ctrl+C to stop)\x1b[0m");
-        console.log("");
-        let debounce = null;
-        let running = false;
-        for (const dir of srcDirs) {
-            watch(dir, { recursive: true }, (_event, filename) => {
-                if (!filename || filename.includes("node_modules") || filename.includes(".vibe-check"))
-                    return;
-                if (running)
-                    return; // prevent concurrent re-runs (M5)
-                if (debounce)
-                    clearTimeout(debounce);
-                debounce = setTimeout(async () => {
-                    running = true;
-                    console.log(`  \x1b[2mChanged: ${filename} — re-scanning...\x1b[0m`);
-                    await main().catch(() => { });
-                    running = false;
-                }, 500);
-            });
-        }
-        // Keep process alive
-        await new Promise(() => { });
+        await startWatch(cwd);
     }
 }
 main().catch((err) => {

package/dist/runners/best-practices.js

@@ -13,21 +13,10 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { readDeps } from "../fs-utils.js";
 import { gradeFromScore } from "../types.js";
-export function runBestPractices(cwd) {
-    const start = Date.now();
+function checkCICD(cwd, has, read) {
     const issues = [];
     let practices = 0;
     let followed = 0;
-    const has = (f) => existsSync(join(cwd, f));
-    const read = (f) => {
-        try {
-            return readFileSync(join(cwd, f), "utf-8");
-        }
-        catch {
-            return "";
-        }
-    };
-    // ── 1. CI/CD Best Practices ──
     // Check for GitHub Actions workflows
     const hasWorkflows = has(".github/workflows");
     practices++;
@@ -99,7 +88,12 @@ export function runBestPractices(cwd) {
             rule: "no-ci",
         });
     }
-    // ── 2. Supply Chain ──
+    return { practices, followed, issues };
+}
+function checkSupplyChain(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // Lockfile committed
     practices++;
     const hasLockfile = has("pnpm-lock.yaml") || has("package-lock.json") || has("yarn.lock") || has("bun.lockb") || has("pubspec.lock");
@@ -136,7 +130,12 @@ export function runBestPractices(cwd) {
             });
         }
     }
-    // ── 3. Repo Hygiene ──
+    return { practices, followed, issues };
+}
+function checkRepoHygiene(has) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // SECURITY.md or security policy
     practices++;
     if (has("SECURITY.md") || has(".github/SECURITY.md")) {
@@ -165,7 +164,12 @@ export function runBestPractices(cwd) {
             rule: "contributing-guide",
         });
     }
-    // ── 4. Developer Experience ──
+    return { practices, followed, issues };
+}
+function checkDevExperience(cwd, has) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // .env.example
     practices++;
     const hasEnvFiles = has(".env") || has(".env.local") || has(".env.development");
@@ -204,7 +208,12 @@ export function runBestPractices(cwd) {
             rule: "automated-deps",
         });
     }
-    // ── 5. Code Quality Tooling ──
+    return { practices, followed, issues };
+}
+function checkCodeQualityTooling(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // Linter configured
     practices++;
     if (has("biome.json") ||
@@ -247,7 +256,13 @@ export function runBestPractices(cwd) {
             rule: "ts-strict-mode",
         });
     }
-    // ── 6. Testing Best Practices ──
+    return { practices, followed, issues };
+}
+function checkTesting(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const pkg = read("package.json");
     // Test script exists
     practices++;
     if (pkg.includes('"test"') || has("pubspec.yaml")) {
@@ -268,7 +283,12 @@ export function runBestPractices(cwd) {
             rule: "coverage-config",
         });
     }
-    // ── 7. Docker / Deployment ──
+    return { practices, followed, issues };
+}
+function checkDocker(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // Dockerfile best practices (if Docker is used)
     if (has("Dockerfile") || has("docker-compose.yml") || has("docker-compose.yaml")) {
         practices++;
@@ -315,7 +335,13 @@ export function runBestPractices(cwd) {
             });
         }
     }
-    // ── 8. Git Practices ──
+    return { practices, followed, issues };
+}
+function checkGitPractices(cwd, has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const deps = readDeps(cwd);
     // .gitignore is comprehensive
     practices++;
     const gitignore = read(".gitignore");
@@ -344,7 +370,13 @@ export function runBestPractices(cwd) {
             rule: "conventional-commits",
         });
     }
-    // ── 9. Monitoring & Observability ──
+    return { practices, followed, issues };
+}
+function checkMonitoring(cwd) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const deps = readDeps(cwd);
     // Error tracking (Sentry, Bugsnag, etc.) — only for apps/servers, not CLI tools
     const isApp = deps.react || deps.vue || deps.svelte || deps.express || deps.fastify || deps.hono || deps.next || deps.nuxt;
     if (isApp) {
@@ -360,7 +392,14 @@ export function runBestPractices(cwd) {
             });
         }
     }
-    // ── 10. API & Configuration ──
+    return { practices, followed, issues };
+}
+function checkAPIConfig(cwd, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const deps = readDeps(cwd);
+    const pkg = read("package.json");
     // Environment validation (zod, joi, envalid)
     practices++;
     if (deps.zod || deps.joi || deps.envalid || deps["@t3-oss/env-core"] || deps["@t3-oss/env-nextjs"]) {
@@ -379,6 +418,39 @@ export function runBestPractices(cwd) {
             followed++;
         }
     }
+    return { practices, followed, issues };
+}
+export function runBestPractices(cwd) {
+    const start = Date.now();
+    const has = (f) => existsSync(join(cwd, f));
+    const read = (f) => {
+        try {
+            return readFileSync(join(cwd, f), "utf-8");
+        }
+        catch {
+            return "";
+        }
+    };
+    const categories = [
+        checkCICD(cwd, has, read),
+        checkSupplyChain(has, read),
+        checkRepoHygiene(has),
+        checkDevExperience(cwd, has),
+        checkCodeQualityTooling(has, read),
+        checkTesting(has, read),
+        checkDocker(has, read),
+        checkGitPractices(cwd, has, read),
+        checkMonitoring(cwd),
+        checkAPIConfig(cwd, read),
+    ];
+    let practices = 0;
+    let followed = 0;
+    const issues = [];
+    for (const cat of categories) {
+        practices += cat.practices;
+        followed += cat.followed;
+        issues.push(...cat.issues);
+    }
     // ── Score ──
     const pct = practices > 0 ? Math.round((followed / practices) * 100) : 100;
     const score = pct;

package/dist/runners/standards.js

@@ -28,7 +28,7 @@ const CODE_SMELLS = [
         message: "dangerouslySetInnerHTML bypasses React's XSS protection",
     },
     { name: "document.write", pattern: /document\.write\s*\(/, severity: "error", message: "document.write blocks rendering" },
-    { name: "http:// URL", pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1)/, severity: "warning", message: "Non-HTTPS URL — use https://" },
+    { name: "http:// URL", pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1|www\.w3\.org|schemas?\.)/, severity: "warning", message: "Non-HTTPS URL — use https://" },
     { name: "TODO/FIXME", pattern: /\b(TODO|FIXME|HACK|XXX)\b/, severity: "warning", message: "Unresolved TODO/FIXME comment" },
     {
         name: "magic number",
@@ -96,6 +96,9 @@ export function runStandards(cwd, stack) {
                 continue;
             if (/\bpattern\s*:|name:\s*["']|message:\s*["']|description:\s*["']|risk:\s*["']|recommendation:\s*["']/.test(trimmed))
                 continue;
+            // Skip string-only lines (check-meta descriptions, inline scripts)
+            if (/^\s*["'`].*["'`][,;]?\s*$/.test(line))
+                continue;
             for (const check of CODE_SMELLS) {
                 // Skip console.log in CLI entry points (intentional output)
                 if (check.name === "console.log" && (f.path.includes("cli.") || f.path.includes("bin/")))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibecodeqa/cli",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Code health scanner for the AI coding era. 21 checks, zero config, full report.",
   "type": "module",
   "bin": {