@vibecodeqa/cli 0.41.0 → 0.43.0

package/dist/runners/frontend-health.js

@@ -0,0 +1,206 @@
+/** Frontend health — detects HTML/framework antipatterns in component code.
+ *
+ * Checks:
+ *   1. Conflicting UI frameworks (MUI + Tailwind, Chakra + Tailwind, etc.)
+ *   2. Large/unoptimized images (no width/height, no next/image, large src)
+ *   3. Inconsistent icon systems (mixing lucide + heroicons + fontawesome)
+ *   4. Bundle-heavy imports (entire libraries instead of specific components)
+ *   5. Missing loading states (async data without suspense/skeleton)
+ *   6. Hardcoded strings (potential i18n issues)
+ *   7. Missing meta tags / head management
+ *   8. DOM nesting violations (div in p, button in a)
+ */
+import { getProductionFiles, readDeps } from "../fs-utils.js";
+import { gradeFromScore } from "../types.js";
+// UI framework conflicts
+const UI_FRAMEWORKS = [
+    { name: "MUI", deps: ["@mui/material", "@mui/system", "@material-ui/core"] },
+    { name: "Tailwind", deps: ["tailwindcss"] },
+    { name: "Chakra", deps: ["@chakra-ui/react"] },
+    { name: "Ant Design", deps: ["antd"] },
+    { name: "Bootstrap", deps: ["react-bootstrap", "bootstrap"] },
+    { name: "Mantine", deps: ["@mantine/core"] },
+    { name: "Radix", deps: ["@radix-ui/react-dialog", "@radix-ui/react-dropdown-menu", "@radix-ui/themes"] },
+    { name: "shadcn/ui", deps: ["cmdk", "vaul"] }, // shadcn uses these + Tailwind
+    { name: "DaisyUI", deps: ["daisyui"] },
+];
+// Icon library conflicts
+const ICON_LIBS = [
+    { name: "lucide", patterns: [/from\s+["']lucide-react["']/, /from\s+["']lucide-vue-next["']/] },
+    { name: "heroicons", patterns: [/from\s+["']@heroicons\/react/, /from\s+["']@heroicons\/vue/] },
+    { name: "fontawesome", patterns: [/from\s+["']@fortawesome/, /fa-\w+/] },
+    { name: "phosphor", patterns: [/from\s+["']@phosphor-icons/] },
+    { name: "tabler", patterns: [/from\s+["']@tabler\/icons/] },
+    { name: "react-icons", patterns: [/from\s+["']react-icons\//] },
+    { name: "material-icons", patterns: [/from\s+["']@mui\/icons-material/] },
+    { name: "ionicons", patterns: [/from\s+["']ionicons/, /ion-icon/] },
+];
+// Heavy full-library imports
+const HEAVY_IMPORTS = [
+    { pattern: /import\s+\*\s+as\s+\w+\s+from\s+["']lodash["']/, message: "Import entire lodash — use lodash/specific or lodash-es" },
+    { pattern: /from\s+["']@mui\/icons-material["'](?!\/)/, message: "Import all MUI icons — import specific: @mui/icons-material/Add" },
+    { pattern: /from\s+["']react-icons["'](?!\/)/, message: "Import all react-icons — import specific: react-icons/fi" },
+    { pattern: /from\s+["']antd["']\s*;\s*$/, message: "Import all of antd — destructure: import { Button } from 'antd'" },
+    { pattern: /import\s+(?:moment|dayjs)\s+from/, message: "Date library imported fully — consider tree-shakeable alternative" },
+];
+// DOM nesting violations
+const NESTING_VIOLATIONS = [
+    { parent: "<p", child: "<div", message: "div inside p — invalid HTML nesting" },
+    { parent: "<p", child: "<p", message: "p inside p — invalid HTML nesting" },
+    { parent: "<a", child: "<a", message: "a inside a — nested links are invalid" },
+    { parent: "<button", child: "<button", message: "button inside button — invalid nesting" },
+    { parent: "<a", child: "<button", message: "button inside a — use one or the other" },
+];
+export function runFrontendHealth(cwd) {
+    const start = Date.now();
+    const issues = [];
+    const files = getProductionFiles(cwd);
+    const deps = readDeps(cwd);
+    const componentFiles = files.filter((f) => !f.isTest && /\.(tsx|jsx|vue|svelte)$/.test(f.path));
+    if (componentFiles.length === 0) {
+        return {
+            name: "frontend-health",
+            score: 0,
+            grade: "F",
+            details: { skipped: true, reason: "no component files found" },
+            issues: [],
+            duration: Date.now() - start,
+        };
+    }
+    // 1. Conflicting UI frameworks
+    const activeFrameworks = [];
+    for (const fw of UI_FRAMEWORKS) {
+        if (fw.deps.some((d) => d in deps)) {
+            activeFrameworks.push(fw.name);
+        }
+    }
+    // Tailwind + Radix/shadcn is intentional (shadcn uses Tailwind)
+    const conflicts = activeFrameworks.filter((f) => f !== "Radix" && f !== "shadcn/ui" && f !== "DaisyUI");
+    if (conflicts.length > 1 && !(conflicts.length === 2 && conflicts.includes("Tailwind") && conflicts.includes("shadcn/ui"))) {
+        issues.push({
+            severity: "error",
+            message: `Conflicting UI frameworks: ${conflicts.join(" + ")} — pick one`,
+            rule: "framework-conflict",
+        });
+    }
+    // 2-8. Scan component files
+    const iconLibsUsed = new Set();
+    let unoptimizedImages = 0;
+    let missingLoadingStates = 0;
+    for (const f of componentFiles) {
+        const lines = f.content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmed = line.trim();
+            // Icon libraries used
+            for (const lib of ICON_LIBS) {
+                if (lib.patterns.some((p) => p.test(line))) {
+                    iconLibsUsed.add(lib.name);
+                }
+            }
+            // Heavy imports
+            for (const heavy of HEAVY_IMPORTS) {
+                if (heavy.pattern.test(line)) {
+                    issues.push({
+                        severity: "warning",
+                        message: heavy.message,
+                        file: f.path,
+                        line: i + 1,
+                        rule: "heavy-import",
+                    });
+                }
+            }
+            // Unoptimized images
+            if (/<img\s/.test(trimmed) && !trimmed.includes("next/image") && !trimmed.includes("Image")) {
+                if (!trimmed.includes("width") || !trimmed.includes("height")) {
+                    unoptimizedImages++;
+                    if (unoptimizedImages <= 3) {
+                        issues.push({
+                            severity: "warning",
+                            message: "img without width/height — causes layout shift (use next/image or set dimensions)",
+                            file: f.path,
+                            line: i + 1,
+                            rule: "unoptimized-image",
+                        });
+                    }
+                }
+            }
+            // Large image sources (base64 data URLs in JSX)
+            if (/src\s*=\s*["']data:image\/[^"']{10000}/.test(line)) {
+                issues.push({
+                    severity: "error",
+                    message: "Large base64 image inline — move to a file and import",
+                    file: f.path,
+                    line: i + 1,
+                    rule: "inline-image",
+                });
+            }
+            // DOM nesting violations (heuristic — not a full parser)
+            for (const v of NESTING_VIOLATIONS) {
+                if (trimmed.includes(v.child) && i > 0) {
+                    // Check previous 5 lines for unclosed parent
+                    const context = lines.slice(Math.max(0, i - 5), i).join(" ");
+                    const parentOpens = (context.match(new RegExp(v.parent.replace("<", "<"), "g")) || []).length;
+                    const parentCloses = (context.match(new RegExp(v.parent.replace("<", "</"), "g")) || []).length;
+                    if (parentOpens > parentCloses) {
+                        issues.push({
+                            severity: "warning",
+                            message: v.message,
+                            file: f.path,
+                            line: i + 1,
+                            rule: "dom-nesting",
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+        // Missing loading states (has fetch/useQuery but no loading/skeleton/suspense)
+        if (/\b(fetch|useQuery|useSWR|useEffect.*fetch)\b/.test(f.content)) {
+            if (!/\b(loading|isLoading|Skeleton|Spinner|Suspense|fallback)\b/.test(f.content)) {
+                missingLoadingStates++;
+                if (missingLoadingStates <= 3) {
+                    issues.push({
+                        severity: "info",
+                        message: "Async data fetch without visible loading state",
+                        file: f.path,
+                        rule: "no-loading-state",
+                    });
+                }
+            }
+        }
+    }
+    // Icon system conflicts
+    if (iconLibsUsed.size > 1) {
+        issues.push({
+            severity: "warning",
+            message: `Mixed icon libraries: ${[...iconLibsUsed].join(", ")} — pick one for consistency`,
+            rule: "mixed-icons",
+        });
+    }
+    // Summary issues
+    if (unoptimizedImages > 3) {
+        issues.push({
+            severity: "warning",
+            message: `${unoptimizedImages} images without dimensions — all cause layout shift`,
+            rule: "unoptimized-image",
+        });
+    }
+    // Score
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const score = Math.max(0, 100 - errorCount * 25 - warnCount * 10);
+    return {
+        name: "frontend-health",
+        score,
+        grade: gradeFromScore(score),
+        details: {
+            componentFiles: componentFiles.length,
+            activeFrameworks,
+            iconLibsUsed: [...iconLibsUsed],
+            unoptimizedImages,
+        },
+        issues,
+        duration: Date.now() - start,
+    };
+}

package/dist/runners/git-hygiene.d.ts

@@ -0,0 +1,3 @@
+/** Git hygiene — checks commit quality, large files, and repo health. */
+import type { CheckResult } from "../types.js";
+export declare function runGitHygiene(cwd: string): CheckResult;

package/dist/runners/git-hygiene.js

@@ -0,0 +1,125 @@
+/** Git hygiene — checks commit quality, large files, and repo health. */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { getProductionFiles } from "../fs-utils.js";
+import { gradeFromScore } from "../types.js";
+import { run } from "./exec.js";
+export function runGitHygiene(cwd) {
+    const start = Date.now();
+    const issues = [];
+    if (!existsSync(join(cwd, ".git"))) {
+        return {
+            name: "git-hygiene",
+            score: 0,
+            grade: "F",
+            details: { skipped: true, reason: "not a git repository" },
+            issues: [],
+            duration: Date.now() - start,
+        };
+    }
+    // 1. Check for merge conflict markers in source files
+    const files = getProductionFiles(cwd);
+    for (const f of files) {
+        const lines = f.content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            if (/^<{7}\s|^={7}$|^>{7}\s/.test(lines[i])) {
+                issues.push({
+                    severity: "error",
+                    message: "Merge conflict marker found",
+                    file: f.path,
+                    line: i + 1,
+                    rule: "merge-conflict",
+                });
+                break; // one per file is enough
+            }
+        }
+    }
+    // 2. Check recent commit message quality (last 20 commits)
+    const { stdout: logOutput, ok: logOk } = run("git log --oneline -20 --format='%s' 2>/dev/null", cwd, 10_000);
+    if (logOk && logOutput.trim()) {
+        const messages = logOutput.trim().split("\n").filter(Boolean);
+        let poorMessages = 0;
+        for (const msg of messages) {
+            const trimmed = msg.trim().replace(/^'|'$/g, "");
+            // Flag very short or generic commit messages
+            if (trimmed.length < 5 || /^(fix|update|change|wip|test|stuff|asdf|temp|\.+)$/i.test(trimmed)) {
+                poorMessages++;
+            }
+        }
+        if (messages.length > 0) {
+            const poorRatio = poorMessages / messages.length;
+            if (poorRatio > 0.5) {
+                issues.push({
+                    severity: "warning",
+                    message: `${poorMessages}/${messages.length} recent commits have low-quality messages`,
+                    rule: "poor-commit-messages",
+                });
+            }
+        }
+    }
+    // 3. Check for large files tracked in git
+    const { stdout: lsOutput, ok: lsOk } = run("git ls-files -z 2>/dev/null | xargs -0 -I{} sh -c 'wc -c < \"{}\" | tr -d \" \" | xargs -I@ echo @\\t{}' 2>/dev/null | sort -rn | head -5", cwd, 15_000);
+    if (lsOk && lsOutput.trim()) {
+        for (const line of lsOutput.trim().split("\n")) {
+            const parts = line.split("\t");
+            if (parts.length < 2)
+                continue;
+            const size = parseInt(parts[0], 10);
+            const file = parts[1];
+            if (size > 5_000_000) { // 5MB
+                issues.push({
+                    severity: "warning",
+                    message: `Large file tracked in git: ${file} (${(size / 1_000_000).toFixed(1)}MB) — consider Git LFS`,
+                    file,
+                    rule: "large-file",
+                });
+            }
+        }
+    }
+    // 4. Check for committed binary files
+    const binaryExts = new Set([".zip", ".tar", ".gz", ".jar", ".war", ".exe", ".dll", ".so", ".dylib", ".bin", ".dat", ".sqlite", ".db"]);
+    const { stdout: allFiles } = run("git ls-files 2>/dev/null", cwd, 10_000);
+    if (allFiles) {
+        for (const file of allFiles.trim().split("\n")) {
+            const ext = file.slice(file.lastIndexOf(".")).toLowerCase();
+            if (binaryExts.has(ext)) {
+                issues.push({
+                    severity: "warning",
+                    message: `Binary file tracked in git: ${file} — use .gitignore or Git LFS`,
+                    file,
+                    rule: "binary-in-git",
+                });
+            }
+        }
+    }
+    // 5. Check .gitignore completeness
+    if (existsSync(join(cwd, ".gitignore"))) {
+        const gitignore = require("node:fs").readFileSync(join(cwd, ".gitignore"), "utf-8");
+        const missing = [];
+        if (!gitignore.includes("node_modules") && existsSync(join(cwd, "package.json")))
+            missing.push("node_modules");
+        if (!gitignore.includes(".env") && existsSync(join(cwd, ".env")))
+            missing.push(".env");
+        if (!gitignore.includes("dist") && !gitignore.includes("build"))
+            missing.push("dist/build");
+        if (missing.length > 0) {
+            issues.push({
+                severity: "warning",
+                message: `.gitignore missing common entries: ${missing.join(", ")}`,
+                file: ".gitignore",
+                rule: "gitignore-incomplete",
+            });
+        }
+    }
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const score = Math.max(0, 100 - errorCount * 30 - warnCount * 10);
+    return {
+        name: "git-hygiene",
+        score,
+        grade: gradeFromScore(score),
+        details: { commitCount: logOutput?.trim().split("\n").length || 0 },
+        issues,
+        duration: Date.now() - start,
+    };
+}

package/dist/runners/html-quality.d.ts

@@ -0,0 +1,8 @@
+/** HTML quality — checks static HTML sites for meta tags, images, links, a11y, performance, SEO, security.
+ *
+ * Activates when the project has .html files. Works alongside framework checks —
+ * catches issues in static sites, landing pages, and docs that framework-specific
+ * checks miss entirely.
+ */
+import type { CheckResult } from "../types.js";
+export declare function runHtmlQuality(cwd: string): CheckResult;

package/dist/runners/html-quality.js

@@ -0,0 +1,203 @@
+/** HTML quality — checks static HTML sites for meta tags, images, links, a11y, performance, SEO, security.
+ *
+ * Activates when the project has .html files. Works alongside framework checks —
+ * catches issues in static sites, landing pages, and docs that framework-specific
+ * checks miss entirely.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { gradeFromScore } from "../types.js";
+const SKIP_DIRS = new Set(["node_modules", ".git", ".vibe-check", "dist", "build", "coverage", ".next", ".nuxt"]);
+export function runHtmlQuality(cwd) {
+    const start = Date.now();
+    const issues = [];
+    const htmlFiles = collectHtmlFiles(cwd);
+    if (htmlFiles.length === 0) {
+        return {
+            name: "html-quality",
+            score: 0,
+            grade: "F",
+            details: { skipped: true, reason: "no HTML files found" },
+            issues: [],
+            duration: Date.now() - start,
+        };
+    }
+    const allLinks = new Set();
+    const titles = new Map();
+    for (const file of htmlFiles) {
+        const relPath = relative(cwd, file);
+        let content;
+        try {
+            content = readFileSync(file, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        // ── Meta tags ──
+        if (content.includes("<head")) {
+            if (!/<title[^>]*>/.test(content)) {
+                issues.push({ severity: "error", message: "Missing <title> tag", file: relPath, rule: "missing-title" });
+            }
+            else {
+                const titleMatch = content.match(/<title[^>]*>([^<]*)<\/title>/i);
+                if (titleMatch) {
+                    const title = titleMatch[1].trim();
+                    if (title.length < 10) {
+                        issues.push({ severity: "warning", message: `Title too short: "${title}" — aim for 30-60 characters`, file: relPath, rule: "short-title" });
+                    }
+                    const existing = titles.get(title) || [];
+                    existing.push(relPath);
+                    titles.set(title, existing);
+                }
+            }
+            if (!/<meta\s[^>]*name=["']description["']/i.test(content)) {
+                issues.push({ severity: "warning", message: "Missing meta description", file: relPath, rule: "missing-description" });
+            }
+            if (!/<meta\s[^>]*name=["']viewport["']/i.test(content)) {
+                issues.push({ severity: "error", message: "Missing viewport meta — page won't be mobile-responsive", file: relPath, rule: "missing-viewport" });
+            }
+            if (!/<meta\s[^>]*charset/i.test(content)) {
+                issues.push({ severity: "warning", message: "Missing charset declaration", file: relPath, rule: "missing-charset" });
+            }
+            if (!/<meta\s[^>]*property=["']og:title["']/i.test(content)) {
+                issues.push({ severity: "info", message: "Missing Open Graph tags (og:title, og:description) — social sharing will look plain", file: relPath, rule: "missing-og" });
+            }
+            if (!/<link\s[^>]*rel=["']canonical["']/i.test(content)) {
+                issues.push({ severity: "info", message: "Missing canonical link — may cause duplicate content issues", file: relPath, rule: "missing-canonical" });
+            }
+            if (!/<link\s[^>]*rel=["']icon["']/i.test(content) && !/<link\s[^>]*rel=["']shortcut icon["']/i.test(content)) {
+                issues.push({ severity: "info", message: "Missing favicon", file: relPath, rule: "missing-favicon" });
+            }
+        }
+        // ── HTML lang ──
+        if (/<html[\s>]/.test(content) && !/<html\s[^>]*lang=/i.test(content)) {
+            issues.push({ severity: "warning", message: "Missing lang attribute on <html> — screen readers need this", file: relPath, rule: "missing-lang" });
+        }
+        // ── Images ──
+        const imgRegex = /<img\s[^>]*>/gi;
+        let imgMatch;
+        while ((imgMatch = imgRegex.exec(content)) !== null) {
+            const tag = imgMatch[0];
+            const line = content.slice(0, imgMatch.index).split("\n").length;
+            if (!/alt\s*=/i.test(tag)) {
+                issues.push({ severity: "error", message: "Image missing alt attribute", file: relPath, line, rule: "img-no-alt" });
+            }
+            if (!/(?:width|height)\s*=/i.test(tag)) {
+                issues.push({ severity: "warning", message: "Image missing width/height — causes layout shift", file: relPath, line, rule: "img-no-dimensions" });
+            }
+            if (!/loading\s*=/i.test(tag)) {
+                issues.push({ severity: "info", message: "Image missing loading=\"lazy\" — add for below-fold images", file: relPath, line, rule: "img-no-lazy" });
+            }
+        }
+        // ── Links ──
+        const linkRegex = /<a\s[^>]*href=["']([^"']+)["'][^>]*>/gi;
+        let linkMatch;
+        while ((linkMatch = linkRegex.exec(content)) !== null) {
+            const href = linkMatch[1];
+            const tag = linkMatch[0];
+            const line = content.slice(0, linkMatch.index).split("\n").length;
+            // HTTP links on what should be HTTPS
+            if (href.startsWith("http://") && !href.includes("localhost")) {
+                issues.push({ severity: "warning", message: `HTTP link: ${href} — use HTTPS`, file: relPath, line, rule: "http-link" });
+            }
+            // External links without rel=noopener
+            if (href.startsWith("http") && /target\s*=\s*["']_blank["']/i.test(tag) && !/rel\s*=\s*["'][^"']*noopener/i.test(tag)) {
+                issues.push({ severity: "warning", message: "External link with target=\"_blank\" missing rel=\"noopener\"", file: relPath, line, rule: "missing-noopener" });
+            }
+            // Collect internal links for broken link check
+            if (!href.startsWith("http") && !href.startsWith("mailto:") && !href.startsWith("#") && !href.startsWith("javascript:")) {
+                allLinks.add(join(cwd, href.split("#")[0].split("?")[0]));
+            }
+        }
+        // ── Heading hierarchy ──
+        const headings = [];
+        const headingRegex = /<h(\d)/gi;
+        let hMatch;
+        while ((hMatch = headingRegex.exec(content)) !== null) {
+            headings.push(parseInt(hMatch[1], 10));
+        }
+        for (let i = 1; i < headings.length; i++) {
+            if (headings[i] > headings[i - 1] + 1) {
+                issues.push({
+                    severity: "warning",
+                    message: `Heading hierarchy skip: h${headings[i - 1]} → h${headings[i]} (should be h${headings[i - 1] + 1})`,
+                    file: relPath,
+                    rule: "heading-skip",
+                });
+                break;
+            }
+        }
+        // ── Performance ──
+        // Render-blocking scripts (script in head without async/defer)
+        const headContent = content.match(/<head[^>]*>([\s\S]*?)<\/head>/i)?.[1] || "";
+        const scriptInHead = /<script\s[^>]*src=["'][^"']+["'][^>]*>/gi;
+        let scriptMatch;
+        while ((scriptMatch = scriptInHead.exec(headContent)) !== null) {
+            const tag = scriptMatch[0];
+            if (!/\b(?:async|defer|type=["']module["'])\b/i.test(tag)) {
+                issues.push({ severity: "warning", message: "Render-blocking script in <head> — add async or defer", file: relPath, rule: "render-blocking" });
+            }
+        }
+        // ── Security ──
+        // Mixed content (http:// resources on a page)
+        if (/<(?:img|script|link|iframe)\s[^>]*(?:src|href)=["']http:\/\/(?!localhost)/i.test(content)) {
+            issues.push({ severity: "warning", message: "Mixed content: HTTP resource on page — use HTTPS", file: relPath, rule: "mixed-content" });
+        }
+    }
+    // ── Cross-file checks ──
+    // Broken internal links
+    for (const link of allLinks) {
+        if (!existsSync(link)) {
+            const relLink = relative(cwd, link);
+            issues.push({ severity: "warning", message: `Broken internal link: ${relLink}`, rule: "broken-link" });
+        }
+    }
+    // Duplicate titles
+    for (const [title, files] of titles) {
+        if (files.length > 1) {
+            issues.push({ severity: "warning", message: `Duplicate title "${title}" in ${files.length} files — each page should have a unique title`, rule: "duplicate-title" });
+        }
+    }
+    // SEO files
+    if (!existsSync(join(cwd, "robots.txt"))) {
+        issues.push({ severity: "info", message: "Missing robots.txt", rule: "missing-robots" });
+    }
+    if (!existsSync(join(cwd, "sitemap.xml"))) {
+        issues.push({ severity: "info", message: "Missing sitemap.xml", rule: "missing-sitemap" });
+    }
+    // Score
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const score = Math.max(0, 100 - errorCount * 15 - warnCount * 5);
+    return {
+        name: "html-quality",
+        score,
+        grade: gradeFromScore(score),
+        details: { htmlFiles: htmlFiles.length },
+        issues,
+        duration: Date.now() - start,
+    };
+}
+function collectHtmlFiles(cwd, subdir = "") {
+    const files = [];
+    const dir = subdir ? join(cwd, subdir) : cwd;
+    try {
+        for (const entry of readdirSync(dir)) {
+            if (SKIP_DIRS.has(entry))
+                continue;
+            const full = join(dir, entry);
+            try {
+                const stat = statSync(full);
+                if (stat.isDirectory()) {
+                    files.push(...collectHtmlFiles(cwd, subdir ? join(subdir, entry) : entry));
+                }
+                else if (entry.endsWith(".html") || entry.endsWith(".htm")) {
+                    files.push(full);
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    catch { /* skip */ }
+    return files;
+}

package/dist/runners/memory-safety.d.ts

@@ -0,0 +1,3 @@
+/** Memory safety — detects resource leak patterns in TypeScript/JavaScript. */
+import type { CheckResult } from "../types.js";
+export declare function runMemorySafety(cwd: string): CheckResult;

package/dist/runners/memory-safety.js

@@ -0,0 +1,114 @@
+/** Memory safety — detects resource leak patterns in TypeScript/JavaScript. */
+import { getProductionFiles } from "../fs-utils.js";
+import { gradeFromScore } from "../types.js";
+const PATTERNS = [
+    {
+        name: "setInterval-no-clear",
+        pattern: /\bsetInterval\s*\(/g,
+        severity: "warning",
+        message: "setInterval without clearInterval — potential memory leak",
+        rule: "interval-leak",
+    },
+    {
+        name: "addEventListener-no-remove",
+        pattern: /\.addEventListener\s*\(/g,
+        severity: "warning",
+        message: "addEventListener without removeEventListener — may leak if component unmounts",
+        rule: "listener-leak",
+    },
+    {
+        name: "global-var-assignment",
+        pattern: /(?:^|\n)\s*(?:window|globalThis|global)\.\w+\s*=/g,
+        severity: "warning",
+        message: "Global variable assignment — pollutes global scope, hard to garbage collect",
+        rule: "global-pollution",
+    },
+    {
+        name: "new-without-cleanup",
+        pattern: /new\s+(?:MutationObserver|IntersectionObserver|ResizeObserver|PerformanceObserver)\s*\(/g,
+        severity: "warning",
+        message: "Observer created — ensure .disconnect() is called on cleanup",
+        rule: "observer-leak",
+    },
+    {
+        name: "websocket-no-close",
+        pattern: /new\s+WebSocket\s*\(/g,
+        severity: "warning",
+        message: "WebSocket opened — ensure .close() is called on cleanup",
+        rule: "websocket-leak",
+    },
+    {
+        name: "event-emitter-leak",
+        pattern: /\.on\s*\(\s*['"`]/g,
+        severity: "warning",
+        message: "Event listener registered — ensure .off() or .removeListener() on cleanup",
+        rule: "emitter-leak",
+    },
+];
+export function runMemorySafety(cwd) {
+    const start = Date.now();
+    const issues = [];
+    const files = getProductionFiles(cwd);
+    for (const f of files) {
+        if (f.isTest)
+            continue;
+        const lines = f.content.split("\n");
+        for (const pat of PATTERNS) {
+            // Check if the file has the pattern
+            const matches = f.content.match(pat.pattern);
+            if (!matches)
+                continue;
+            // For interval/listener leaks, check if cleanup exists in the same file
+            if (pat.rule === "interval-leak") {
+                if (f.content.includes("clearInterval"))
+                    continue;
+            }
+            if (pat.rule === "listener-leak") {
+                if (f.content.includes("removeEventListener"))
+                    continue;
+            }
+            if (pat.rule === "observer-leak") {
+                if (f.content.includes(".disconnect()"))
+                    continue;
+            }
+            if (pat.rule === "websocket-leak") {
+                if (f.content.includes(".close()"))
+                    continue;
+            }
+            if (pat.rule === "emitter-leak") {
+                // Skip if .off or .removeListener or .removeAllListeners in same file
+                if (f.content.includes(".off(") || f.content.includes(".removeListener(") || f.content.includes(".removeAllListeners("))
+                    continue;
+                // Skip Node.js event emitter patterns (server.on, app.on, router.on)
+                if (/\b(?:server|app|router|express|fastify|hono)\b/.test(f.content))
+                    continue;
+            }
+            // Find first occurrence line number
+            for (let i = 0; i < lines.length; i++) {
+                if (pat.pattern.test(lines[i])) {
+                    pat.pattern.lastIndex = 0; // reset regex
+                    issues.push({
+                        severity: pat.severity,
+                        message: pat.message,
+                        file: f.path,
+                        line: i + 1,
+                        rule: pat.rule,
+                    });
+                    break; // one per file per pattern
+                }
+            }
+        }
+    }
+    const totalFiles = files.filter((f) => !f.isTest).length;
+    const affectedFiles = new Set(issues.map((i) => i.file)).size;
+    const ratio = totalFiles > 0 ? affectedFiles / totalFiles : 0;
+    const score = Math.round(Math.max(0, 100 - ratio * 200));
+    return {
+        name: "memory-safety",
+        score,
+        grade: gradeFromScore(score),
+        details: { totalFiles, affectedFiles, patterns: issues.length },
+        issues,
+        duration: Date.now() - start,
+    };
+}