ai-code-audit 0.1.0

package/dist/rules/ai-specific.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aiSpecificRules = exports.excessiveComments = exports.typeAnyAbuse = exports.incompleteImpl = exports.aiPlaceholder = void 0;
+function findMatches(content, pattern, rule, severity, message, filename) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let match;
+        pattern.lastIndex = 0;
+        while ((match = pattern.exec(line)) !== null) {
+            findings.push({
+                rule,
+                severity,
+                message,
+                file: filename,
+                line: i + 1,
+                column: match.index + 1,
+                snippet: line.trim(),
+            });
+            if (!pattern.global)
+                break;
+        }
+    }
+    return findings;
+}
+exports.aiPlaceholder = {
+    name: 'ai-placeholder',
+    description: 'Detects placeholder text left by AI',
+    severity: 'error',
+    languages: ['javascript', 'typescript', 'python', 'ruby', 'go'],
+    check: (content, filename) => {
+        const patterns = [
+            /\/\/\s*(?:Add|TODO:?\s*add|Implement)\s+(?:your|the)\s+/gi,
+            /\/\/\s*(?:Replace|Update)\s+(?:this|with)\s+/gi,
+            /#\s*(?:Add|TODO:?\s*add|Implement)\s+(?:your|the)\s+/gi,
+            /\/\/\s*\.\.\.\s*(?:rest|more|additional|other)/gi,
+            /\/\*\s*(?:Add|Implement|Your)\s+.*\s+here\s*\*\//gi,
+            /['"](?:your-api-key|YOUR_API_KEY|api-key-here|replace-me|CHANGE_ME)['"]/gi,
+            /(?:example|placeholder|dummy)[@.](?:com|org|io)/gi,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'ai-placeholder', 'error', 'AI placeholder text detected - needs implementation', filename));
+        }
+        return findings;
+    },
+};
+exports.incompleteImpl = {
+    name: 'incomplete-impl',
+    description: 'Detects incomplete implementations',
+    severity: 'warning',
+    languages: ['javascript', 'typescript', 'python'],
+    check: (content, filename) => {
+        const patterns = [
+            /throw\s+new\s+Error\s*\(\s*['"](?:Not\s+implemented|TODO|FIXME)['"]/gi,
+            /raise\s+NotImplementedError/gi,
+            /pass\s*#\s*(?:TODO|FIXME)/gi,
+            /return\s+(?:null|undefined|None)\s*;?\s*\/\/\s*(?:TODO|FIXME)/gi,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'incomplete-impl', 'warning', 'Incomplete implementation detected', filename));
+        }
+        return findings;
+    },
+};
+exports.typeAnyAbuse = {
+    name: 'type-any-abuse',
+    description: 'Detects excessive use of any type',
+    severity: 'warning',
+    languages: ['typescript'],
+    check: (content, filename) => {
+        if (!filename.endsWith('.ts') && !filename.endsWith('.tsx')) {
+            return [];
+        }
+        const pattern = /:\s*any\b/g;
+        const findings = findMatches(content, pattern, 'type-any-abuse', 'warning', 'Unsafe "any" type usage - consider using a specific type', filename);
+        // Only report if there are many instances
+        if (findings.length > 3) {
+            return findings;
+        }
+        return [];
+    },
+};
+exports.excessiveComments = {
+    name: 'excessive-comments',
+    description: 'Detects over-commented obvious code',
+    severity: 'info',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const findings = [];
+        const lines = content.split('\n');
+        let commentLines = 0;
+        let codeLines = 0;
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
+                commentLines++;
+            }
+            else if (trimmed.length > 0) {
+                codeLines++;
+            }
+        }
+        // If comments exceed 50% of code, flag it
+        if (codeLines > 10 && commentLines > codeLines * 0.5) {
+            findings.push({
+                rule: 'excessive-comments',
+                severity: 'info',
+                message: `High comment ratio (${commentLines} comments / ${codeLines} code lines) - may be over-documented`,
+                file: filename,
+                line: 1,
+                column: 1,
+            });
+        }
+        return findings;
+    },
+};
+exports.aiSpecificRules = [
+    exports.aiPlaceholder,
+    exports.incompleteImpl,
+    exports.typeAnyAbuse,
+    exports.excessiveComments,
+];
+//# sourceMappingURL=ai-specific.js.map

package/dist/rules/ai-specific.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-specific.js","sourceRoot":"","sources":["../../src/rules/ai-specific.ts"],"names":[],"mappings":";;;AAEA,SAAS,WAAW,CAClB,OAAe,EACf,OAAe,EACf,IAAY,EACZ,QAAsC,EACtC,OAAe,EACf,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAEtB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,QAAQ;gBACR,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAEY,QAAA,aAAa,GAAS;IACjC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,qCAAqC;IAClD,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,2DAA2D;YAC3D,gDAAgD;YAChD,wDAAwD;YACxD,kDAAkD;YAClD,oDAAoD;YACpD,2EAA2E;YAC3E,mDAAmD;SACpD,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,OAAO,EACP,qDAAqD,EACrD,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,cAAc,GAAS;IAClC,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,uEAAuE;YACvE,+BAA+B;YAC/B,6BAA6B;YAC7B,iEAAiE;SAClE,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,oCAAoC,EACpC,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,YAAY,GAAS;IAChC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,CAAC,YAAY,CAAC;IACzB,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,SAAS,EACT,0DAA0D,EAC1D,QAAQ,CACT,CAAC;QAEF,0CAA0C;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC;AAEW,QAAA,iBAAiB,GAAS;IACrC,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,qCAAqC;IAClD,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpF,YAAY,EAAE,CAAC;YACjB,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,SAAS,EAAE,CAAC;YACd,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,GAAG,EAAE,IAAI,YAAY,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,uBAAuB,YAAY,eAAe,SAAS,uCAAuC;gBAC3G,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE,CAAC;aACV,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,eAAe,GAAW;IACrC,qBAAa;IACb,sBAAc;IACd,oBAAY;IACZ,yBAAiB;CAClB,CAAC"}

package/dist/rules/index.d.ts

@@ -0,0 +1,6 @@
+import { securityRules } from './security.js';
+import { qualityRules } from './quality.js';
+import { aiSpecificRules } from './ai-specific.js';
+import type { Rule } from '../types.js';
+export declare const allRules: Rule[];
+export { securityRules, qualityRules, aiSpecificRules };

package/dist/rules/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aiSpecificRules = exports.qualityRules = exports.securityRules = exports.allRules = void 0;
+const security_js_1 = require("./security.js");
+Object.defineProperty(exports, "securityRules", { enumerable: true, get: function () { return security_js_1.securityRules; } });
+const quality_js_1 = require("./quality.js");
+Object.defineProperty(exports, "qualityRules", { enumerable: true, get: function () { return quality_js_1.qualityRules; } });
+const ai_specific_js_1 = require("./ai-specific.js");
+Object.defineProperty(exports, "aiSpecificRules", { enumerable: true, get: function () { return ai_specific_js_1.aiSpecificRules; } });
+exports.allRules = [
+    ...security_js_1.securityRules,
+    ...quality_js_1.qualityRules,
+    ...ai_specific_js_1.aiSpecificRules,
+];
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":";;;AAAA,+CAA8C;AAWrC,8FAXA,2BAAa,OAWA;AAVtB,6CAA4C;AAUpB,6FAVf,yBAAY,OAUe;AATpC,qDAAmD;AASb,gGAT7B,gCAAe,OAS6B;AANxC,QAAA,QAAQ,GAAW;IAC9B,GAAG,2BAAa;IAChB,GAAG,yBAAY;IACf,GAAG,gCAAe;CACnB,CAAC"}

package/dist/rules/quality.d.ts

@@ -0,0 +1,7 @@
+import type { Rule } from '../types.js';
+export declare const missingErrorHandling: Rule;
+export declare const emptyCatch: Rule;
+export declare const consoleLog: Rule;
+export declare const todoFixme: Rule;
+export declare const deepNesting: Rule;
+export declare const qualityRules: Rule[];

package/dist/rules/quality.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.qualityRules = exports.deepNesting = exports.todoFixme = exports.consoleLog = exports.emptyCatch = exports.missingErrorHandling = void 0;
+function findMatches(content, pattern, rule, severity, message, filename) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let match;
+        pattern.lastIndex = 0;
+        while ((match = pattern.exec(line)) !== null) {
+            findings.push({
+                rule,
+                severity,
+                message,
+                file: filename,
+                line: i + 1,
+                column: match.index + 1,
+                snippet: line.trim(),
+            });
+            if (!pattern.global)
+                break;
+        }
+    }
+    return findings;
+}
+exports.missingErrorHandling = {
+    name: 'missing-error-handling',
+    description: 'Detects async operations without try/catch',
+    severity: 'warning',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const findings = [];
+        const lines = content.split('\n');
+        // Look for await outside of try blocks
+        let inTry = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (/\btry\s*\{/.test(line))
+                inTry++;
+            if (/\}\s*catch/.test(line))
+                inTry = Math.max(0, inTry - 1);
+            if (inTry === 0 && /\bawait\s+/.test(line)) {
+                // Check if it's in an async function without surrounding try
+                findings.push({
+                    rule: 'missing-error-handling',
+                    severity: 'warning',
+                    message: 'Async operation without error handling',
+                    file: filename,
+                    line: i + 1,
+                    column: line.indexOf('await') + 1,
+                    snippet: line.trim(),
+                });
+            }
+        }
+        return findings;
+    },
+};
+exports.emptyCatch = {
+    name: 'empty-catch',
+    description: 'Detects empty catch blocks that swallow errors',
+    severity: 'warning',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const pattern = /catch\s*\([^)]*\)\s*\{\s*\}/g;
+        return findMatches(content, pattern, 'empty-catch', 'warning', 'Empty catch block swallows errors', filename);
+    },
+};
+exports.consoleLog = {
+    name: 'console-log',
+    description: 'Detects console.log left in code',
+    severity: 'info',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const pattern = /console\.log\s*\(/g;
+        return findMatches(content, pattern, 'console-log', 'info', 'console.log statement found', filename);
+    },
+};
+exports.todoFixme = {
+    name: 'todo-fixme',
+    description: 'Detects TODO/FIXME comments',
+    severity: 'info',
+    languages: ['javascript', 'typescript', 'python', 'ruby', 'go'],
+    check: (content, filename) => {
+        const pattern = /\/\/\s*(?:TODO|FIXME|HACK|XXX|BUG)[\s:]/gi;
+        return findMatches(content, pattern, 'todo-fixme', 'info', 'TODO/FIXME comment found', filename);
+    },
+};
+exports.deepNesting = {
+    name: 'deep-nesting',
+    description: 'Detects deeply nested code (>4 levels)',
+    severity: 'warning',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const findings = [];
+        const lines = content.split('\n');
+        let depth = 0;
+        const MAX_DEPTH = 4;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const opens = (line.match(/\{/g) || []).length;
+            const closes = (line.match(/\}/g) || []).length;
+            depth += opens - closes;
+            if (depth > MAX_DEPTH && opens > 0) {
+                findings.push({
+                    rule: 'deep-nesting',
+                    severity: 'warning',
+                    message: `Code nested ${depth} levels deep (max: ${MAX_DEPTH})`,
+                    file: filename,
+                    line: i + 1,
+                    column: 1,
+                    snippet: line.trim(),
+                });
+            }
+        }
+        return findings;
+    },
+};
+exports.qualityRules = [
+    exports.missingErrorHandling,
+    exports.emptyCatch,
+    exports.consoleLog,
+    exports.todoFixme,
+    exports.deepNesting,
+];
+//# sourceMappingURL=quality.js.map

package/dist/rules/quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.js","sourceRoot":"","sources":["../../src/rules/quality.ts"],"names":[],"mappings":";;;AAEA,SAAS,WAAW,CAClB,OAAe,EACf,OAAe,EACf,IAAY,EACZ,QAAsC,EACtC,OAAe,EACf,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAEtB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,QAAQ;gBACR,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAEY,QAAA,oBAAoB,GAAS;IACxC,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,uCAAuC;QACvC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEtB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,EAAE,CAAC;YACrC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAE5D,IAAI,KAAK,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,wBAAwB;oBAC9B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,wCAAwC;oBACjD,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,UAAU,GAAS;IAC9B,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC/C,OAAO,WAAW,CAChB,OAAO,EACP,OAAO,EACP,aAAa,EACb,SAAS,EACT,mCAAmC,EACnC,QAAQ,CACT,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,UAAU,GAAS;IAC9B,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,kCAAkC;IAC/C,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACrC,OAAO,WAAW,CAChB,OAAO,EACP,OAAO,EACP,aAAa,EACb,MAAM,EACN,6BAA6B,EAC7B,QAAQ,CACT,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,SAAS,GAAS;IAC7B,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,6BAA6B;IAC1C,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,2CAA2C,CAAC;QAC5D,OAAO,WAAW,CAChB,OAAO,EACP,OAAO,EACP,YAAY,EACZ,MAAM,EACN,0BAA0B,EAC1B,QAAQ,CACT,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,WAAW,GAAS;IAC/B,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,SAAS,GAAG,CAAC,CAAC;QAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAEhD,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC;YAExB,IAAI,KAAK,GAAG,SAAS,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,eAAe,KAAK,sBAAsB,SAAS,GAAG;oBAC/D,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,YAAY,GAAW;IAClC,4BAAoB;IACpB,kBAAU;IACV,kBAAU;IACV,iBAAS;IACT,mBAAW;CACZ,CAAC"}

package/dist/rules/security.d.ts

@@ -0,0 +1,8 @@
+import type { Rule } from '../types.js';
+export declare const sqlInjection: Rule;
+export declare const commandInjection: Rule;
+export declare const hardcodedSecret: Rule;
+export declare const unsafeEval: Rule;
+export declare const pathTraversal: Rule;
+export declare const xssRisk: Rule;
+export declare const securityRules: Rule[];

package/dist/rules/security.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityRules = exports.xssRisk = exports.pathTraversal = exports.unsafeEval = exports.hardcodedSecret = exports.commandInjection = exports.sqlInjection = void 0;
+function findMatches(content, pattern, rule, severity, message, filename) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let match;
+        // Reset regex for global patterns
+        pattern.lastIndex = 0;
+        while ((match = pattern.exec(line)) !== null) {
+            findings.push({
+                rule,
+                severity,
+                message,
+                file: filename,
+                line: i + 1,
+                column: match.index + 1,
+                snippet: line.trim(),
+            });
+            // Prevent infinite loop for non-global regex
+            if (!pattern.global)
+                break;
+        }
+    }
+    return findings;
+}
+exports.sqlInjection = {
+    name: 'sql-injection',
+    description: 'Detects SQL queries with string interpolation',
+    severity: 'error',
+    languages: ['javascript', 'typescript', 'python'],
+    check: (content, filename) => {
+        const patterns = [
+            // Template literals in SQL
+            /(?:query|execute|sql)\s*\(\s*`[^`]*\$\{/gi,
+            // String concatenation in SQL
+            /(?:query|execute|sql)\s*\(\s*['"][^'"]*['"]\s*\+/gi,
+            // Python f-strings in SQL
+            /(?:execute|cursor\.execute)\s*\(\s*f['"][^'"]*\{/gi,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'sql-injection', 'error', 'SQL injection risk: query uses string interpolation', filename));
+        }
+        return findings;
+    },
+};
+exports.commandInjection = {
+    name: 'command-injection',
+    description: 'Detects shell commands with unsanitized input',
+    severity: 'error',
+    languages: ['javascript', 'typescript', 'python'],
+    check: (content, filename) => {
+        const patterns = [
+            // exec with template literal
+            /(?:exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/gi,
+            // exec with concatenation
+            /(?:exec|execSync|spawn|spawnSync)\s*\(\s*['"][^'"]*['"]\s*\+/gi,
+            // Python subprocess with f-string
+            /subprocess\.(?:run|call|Popen)\s*\(\s*f['"][^'"]*\{/gi,
+            // shell=True in Python
+            /subprocess\.(?:run|call|Popen)\s*\([^)]*shell\s*=\s*True/gi,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'command-injection', 'error', 'Command injection risk: shell command with unsanitized input', filename));
+        }
+        return findings;
+    },
+};
+exports.hardcodedSecret = {
+    name: 'hardcoded-secret',
+    description: 'Detects hardcoded API keys, passwords, tokens',
+    severity: 'error',
+    languages: ['javascript', 'typescript', 'python', 'ruby', 'go'],
+    check: (content, filename) => {
+        const patterns = [
+            // API keys
+            /(?:api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9_\-]{20,}['"]/gi,
+            // AWS keys
+            /(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}/g,
+            // Generic secrets
+            /(?:password|passwd|pwd|secret|token)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+            // Bearer tokens
+            /['"]Bearer\s+[a-zA-Z0-9_\-\.]+['"]/g,
+            // Private keys
+            /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/g,
+            // GitHub tokens
+            /gh[pousr]_[A-Za-z0-9_]{36,}/g,
+            // Slack tokens
+            /xox[baprs]-[A-Za-z0-9-]+/g,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'hardcoded-secret', 'error', 'Hardcoded secret detected', filename));
+        }
+        return findings;
+    },
+};
+exports.unsafeEval = {
+    name: 'unsafe-eval',
+    description: 'Detects use of eval() or Function()',
+    severity: 'error',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const patterns = [
+            /\beval\s*\(/g,
+            /new\s+Function\s*\(/g,
+            /setTimeout\s*\(\s*['"`]/g,
+            /setInterval\s*\(\s*['"`]/g,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'unsafe-eval', 'error', 'Unsafe eval() or Function() usage detected', filename));
+        }
+        return findings;
+    },
+};
+exports.pathTraversal = {
+    name: 'path-traversal',
+    description: 'Detects unsanitized file path operations',
+    severity: 'error',
+    languages: ['javascript', 'typescript', 'python'],
+    check: (content, filename) => {
+        const patterns = [
+            // Direct path concatenation
+            /(?:readFile|writeFile|unlink|rmdir|mkdir)(?:Sync)?\s*\(\s*(?:req\.|request\.|params\.|query\.)/gi,
+            // Python path with user input
+            /open\s*\(\s*(?:request\.|args\.|kwargs\.)/gi,
+            // Path join with user input
+            /path\.join\s*\([^)]*(?:req\.|request\.|params\.|query\.)/gi,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'path-traversal', 'error', 'Path traversal risk: file operation with user input', filename));
+        }
+        return findings;
+    },
+};
+exports.xssRisk = {
+    name: 'xss-risk',
+    description: 'Detects potential XSS in HTML generation',
+    severity: 'warning',
+    languages: ['javascript', 'typescript'],
+    check: (content, filename) => {
+        const patterns = [
+            // innerHTML with variable
+            /\.innerHTML\s*=\s*[^'"]/g,
+            // document.write
+            /document\.write\s*\(/g,
+            // dangerouslySetInnerHTML
+            /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g,
+        ];
+        const findings = [];
+        for (const pattern of patterns) {
+            findings.push(...findMatches(content, pattern, 'xss-risk', 'warning', 'Potential XSS risk: unsafe HTML manipulation', filename));
+        }
+        return findings;
+    },
+};
+exports.securityRules = [
+    exports.sqlInjection,
+    exports.commandInjection,
+    exports.hardcodedSecret,
+    exports.unsafeEval,
+    exports.pathTraversal,
+    exports.xssRisk,
+];
+//# sourceMappingURL=security.js.map

package/dist/rules/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/rules/security.ts"],"names":[],"mappings":";;;AAEA,SAAS,WAAW,CAClB,OAAe,EACf,OAAe,EACf,IAAY,EACZ,QAAsC,EACtC,OAAe,EACf,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC;QAEV,kCAAkC;QAClC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAEtB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,QAAQ;gBACR,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;aACrB,CAAC,CAAC;YAEH,6CAA6C;YAC7C,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAEY,QAAA,YAAY,GAAS;IAChC,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,+CAA+C;IAC5D,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,2BAA2B;YAC3B,2CAA2C;YAC3C,8BAA8B;YAC9B,oDAAoD;YACpD,0BAA0B;YAC1B,oDAAoD;SACrD,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,eAAe,EACf,OAAO,EACP,qDAAqD,EACrD,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,gBAAgB,GAAS;IACpC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,+CAA+C;IAC5D,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,6BAA6B;YAC7B,uDAAuD;YACvD,0BAA0B;YAC1B,gEAAgE;YAChE,kCAAkC;YAClC,uDAAuD;YACvD,uBAAuB;YACvB,4DAA4D;SAC7D,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,mBAAmB,EACnB,OAAO,EACP,8DAA8D,EAC9D,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,eAAe,GAAS;IACnC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,+CAA+C;IAC5D,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,WAAW;YACX,+DAA+D;YAC/D,WAAW;YACX,sCAAsC;YACtC,kBAAkB;YAClB,mEAAmE;YACnE,gBAAgB;YAChB,qCAAqC;YACrC,eAAe;YACf,6CAA6C;YAC7C,gBAAgB;YAChB,8BAA8B;YAC9B,eAAe;YACf,2BAA2B;SAC5B,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,OAAO,EACP,2BAA2B,EAC3B,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,UAAU,GAAS;IAC9B,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,qCAAqC;IAClD,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,cAAc;YACd,sBAAsB;YACtB,0BAA0B;YAC1B,2BAA2B;SAC5B,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,aAAa,EACb,OAAO,EACP,4CAA4C,EAC5C,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,aAAa,GAAS;IACjC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,4BAA4B;YAC5B,kGAAkG;YAClG,8BAA8B;YAC9B,6CAA6C;YAC7C,4BAA4B;YAC5B,4DAA4D;SAC7D,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,OAAO,EACP,qDAAqD,EACrD,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,OAAO,GAAS;IAC3B,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG;YACf,0BAA0B;YAC1B,0BAA0B;YAC1B,iBAAiB;YACjB,uBAAuB;YACvB,0BAA0B;YAC1B,qDAAqD;SACtD,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,OAAO,EACP,OAAO,EACP,UAAU,EACV,SAAS,EACT,8CAA8C,EAC9C,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEW,QAAA,aAAa,GAAW;IACnC,oBAAY;IACZ,wBAAgB;IAChB,uBAAe;IACf,kBAAU;IACV,qBAAa;IACb,eAAO;CACR,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,29 @@
+export type Severity = 'info' | 'warning' | 'error';
+export interface Finding {
+    rule: string;
+    severity: Severity;
+    message: string;
+    file: string;
+    line: number;
+    column: number;
+    snippet?: string;
+}
+export interface Rule {
+    name: string;
+    description: string;
+    severity: Severity;
+    languages: string[];
+    check: (content: string, filename: string) => Finding[];
+}
+export interface Config {
+    rules: Record<string, Severity | 'off'>;
+    ignore: string[];
+    languages: string[];
+}
+export interface AuditResult {
+    findings: Finding[];
+    filesScanned: number;
+    errorCount: number;
+    warningCount: number;
+    infoCount: number;
+}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "ai-code-audit",
+  "version": "0.1.0",
+  "description": "Security and quality linter for AI-generated code",
+  "main": "dist/index.js",
+  "bin": {
+    "ai-code-audit": "dist/cli.js",
+    "aca": "dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/cli.js",
+    "test": "node --test",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "ai",
+    "security",
+    "lint",
+    "audit",
+    "code-review",
+    "owasp"
+  ],
+  "author": "Josh Duffy",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/joshduffy/ai-code-audit.git"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.3.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}