claude-crap 0.3.6 → 0.3.8

package/src/scanner/runner.ts

@@ -91,6 +91,13 @@ function getScannerCommand(
         nonZeroIsNormal: false,
         outputFile: join(workspaceRoot, "reports", "mutation", "mutation.json"),
       };
+    case "dart_analyze":
+      return {
+        command: "dart",
+        args: ["analyze", "--format=json", "."],
+        timeoutMs: 120_000,
+        nonZeroIsNormal: true, // exits 3 when findings exist
+      };
   }
 }
 
@@ -101,21 +108,24 @@ function getScannerCommand(
  *
  * @param scanner       Which scanner to run.
  * @param workspaceRoot Absolute path to the project root (used as cwd).
+ * @param options       Optional overrides.
  * @returns             A {@link ScannerRunResult} with stdout or file output.
  */
 export function runScanner(
   scanner: KnownScanner,
   workspaceRoot: string,
+  options?: { workingDir?: string },
 ): Promise<ScannerRunResult> {
   const start = Date.now();
-  const cmd = getScannerCommand(scanner, workspaceRoot);
+  const cwd = options?.workingDir ?? workspaceRoot;
+  const cmd = getScannerCommand(scanner, cwd);
 
   return new Promise((resolve) => {
     execFile(
       cmd.command,
       cmd.args,
       {
-        cwd: workspaceRoot,
+        cwd,
         timeout: cmd.timeoutMs,
         maxBuffer: 50 * 1024 * 1024, // 50 MB — large codebases produce verbose output
         env: { ...process.env, FORCE_COLOR: "0" }, // suppress ANSI in output

package/src/schemas/tool-schemas.ts

@@ -181,7 +181,7 @@ export const ingestScannerOutputSchema = {
   properties: {
     scanner: {
       type: "string",
-      enum: ["semgrep", "eslint", "bandit", "stryker"],
+      enum: ["semgrep", "eslint", "bandit", "stryker", "dart_analyze"],
       description: "Identifier of the producing scanner.",
     },
     rawOutput: {

package/src/shared/exclusions.ts

@@ -0,0 +1,156 @@
+/**
+ * Centralized file and directory exclusion system.
+ *
+ * Every filesystem walker in the codebase (workspace-walker,
+ * complexity-scanner, dashboard file-detail) imports from this module
+ * instead of maintaining its own `SKIP_DIRS` constant. This
+ * guarantees all subsystems agree on what to exclude.
+ *
+ * User-configurable exclusions from `.claude-crap.json` are layered
+ * on top of the defaults via {@link createExclusionFilter}.
+ *
+ * @module shared/exclusions
+ */
+
+import picomatch from "picomatch";
+
+// ── Default exclusions ──────────────────────────────────────────
+
+/**
+ * Directories excluded by name at any depth. A walker that encounters
+ * a directory entry whose name is in this set should skip the entire
+ * subtree. The set covers package managers, VCS, build outputs for
+ * all major frameworks, language-specific caches, and plugin state.
+ */
+export const DEFAULT_SKIP_DIRS: ReadonlySet<string> = new Set([
+  // Package managers / vendored deps
+  "node_modules",
+  "vendor",
+
+  // Version control
+  ".git",
+
+  // Build outputs (general)
+  "dist",
+  "build",
+  "bundle",
+  "out",
+  "target",
+  "coverage",
+
+  // Framework build outputs
+  ".next",        // Next.js
+  ".nuxt",        // Nuxt 2
+  ".output",      // Nuxt 3
+  ".vercel",      // Vercel
+  ".svelte-kit",  // SvelteKit
+  ".astro",       // Astro
+  ".angular",     // Angular
+  ".turbo",       // Turborepo
+  ".parcel-cache",// Parcel
+  ".expo",        // Expo / React Native
+
+  // Language-specific caches
+  ".venv",
+  "venv",
+  "__pycache__",
+  ".cache",
+  ".dart_tool",   // Dart / Flutter
+  ".gradle",      // Gradle
+
+  // IDE state
+  ".idea",
+
+  // Plugin state
+  ".claude-crap",
+  ".codesight",
+]);
+
+/**
+ * Filename-level glob patterns that match generated or minified files
+ * regardless of which directory they live in. Matched against the
+ * bare filename (not the full path).
+ */
+export const DEFAULT_SKIP_PATTERNS: ReadonlyArray<string> = [
+  "*.min.js",
+  "*.min.css",
+  "*.min.mjs",
+  "*.min.cjs",
+  "*.bundle.js",
+  "*.chunk.js",
+];
+
+// ── Exclusion filter ────────────────────────────────────────────
+
+/**
+ * Stateless, pre-compiled filter that every filesystem walker uses
+ * to decide whether to skip a directory or file.
+ */
+export interface ExclusionFilter {
+  /** Returns `true` when the directory should be skipped entirely. */
+  shouldSkipDir(dirName: string): boolean;
+  /** Returns `true` when the file should be excluded from analysis. */
+  shouldSkipFile(relativePath: string, fileName: string): boolean;
+}
+
+/**
+ * Create an {@link ExclusionFilter} that combines the built-in
+ * defaults with optional user-defined patterns from `.claude-crap.json`.
+ *
+ * User patterns follow `.gitignore`-style conventions:
+ *   - `apps/legacy/`   → trailing `/` means directory exclusion
+ *   - `*.proto.ts`     → glob matched against workspace-relative path
+ *   - `src/generated/**` → path-prefix glob
+ *
+ * Picomatch matchers are compiled once at construction, so per-file
+ * checks are O(1) set lookups plus O(n) matcher calls where n is
+ * the small number of user patterns (typically < 20).
+ *
+ * @param userExclusions Optional patterns from `.claude-crap.json`.
+ */
+export function createExclusionFilter(
+  userExclusions?: ReadonlyArray<string>,
+): ExclusionFilter {
+  // Split user patterns into directory exclusions and file globs
+  const extraDirs = new Set<string>();
+  const fileGlobs: string[] = [];
+
+  for (const pattern of userExclusions ?? []) {
+    if (pattern.endsWith("/")) {
+      // Directory exclusion — strip trailing slash
+      extraDirs.add(pattern.slice(0, -1));
+    } else {
+      fileGlobs.push(pattern);
+    }
+  }
+
+  // Compile filename-level matchers once
+  const defaultFileMatchers = DEFAULT_SKIP_PATTERNS.map((p) =>
+    picomatch(p, { dot: true }),
+  );
+  const userFileMatchers = fileGlobs.map((p) =>
+    picomatch(p, { dot: true }),
+  );
+
+  return {
+    shouldSkipDir(dirName: string): boolean {
+      // Hidden directories are always skipped except .claude-plugin
+      if (dirName.startsWith(".") && dirName !== ".claude-plugin") {
+        return DEFAULT_SKIP_DIRS.has(dirName) || true;
+      }
+      return DEFAULT_SKIP_DIRS.has(dirName) || extraDirs.has(dirName);
+    },
+
+    shouldSkipFile(relativePath: string, fileName: string): boolean {
+      // Check filename against default minified/bundled patterns
+      for (const matcher of defaultFileMatchers) {
+        if (matcher(fileName)) return true;
+      }
+      // Check against user-defined globs (matched on relative path)
+      for (const matcher of userFileMatchers) {
+        if (matcher(relativePath) || matcher(fileName)) return true;
+      }
+      return false;
+    },
+  };
+}

package/src/tests/adapters/dispatch.test.ts

@@ -94,7 +94,7 @@ describe("adaptScannerOutput", () => {
     assert.throws(() => adaptScannerOutput(scanner, {}));
   });
 
-  it("KNOWN_SCANNERS is frozen and contains exactly the four supported names", () => {
-    assert.deepEqual([...KNOWN_SCANNERS].sort(), ["bandit", "eslint", "semgrep", "stryker"]);
+  it("KNOWN_SCANNERS is frozen and contains all supported names", () => {
+    assert.deepEqual([...KNOWN_SCANNERS].sort(), ["bandit", "dart_analyze", "eslint", "semgrep", "stryker"]);
   });
 });

package/src/tests/auto-scan.test.ts

@@ -34,7 +34,7 @@ describe("autoScan", () => {
         outputDir: join(dir, ".claude-crap/reports"),
       });
       const result = await autoScan(dir, store, logger);
-      assert.equal(result.detected.length, 4);
+      assert.equal(result.detected.length, 5);
       assert.ok(result.totalDurationMs >= 0);
       // No scanners available means no results
       // (unless the host has scanner binaries installed)
@@ -129,7 +129,7 @@ describe("autoScan", () => {
       const result = await autoScan(dir, store, logger);
 
       const scannerNames = result.detected.map((d) => d.scanner).sort();
-      assert.deepEqual(scannerNames, ["bandit", "eslint", "semgrep", "stryker"]);
+      assert.deepEqual(scannerNames, ["bandit", "dart_analyze", "eslint", "semgrep", "stryker"]);
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }

package/src/tests/complexity-scanner.test.ts

@@ -0,0 +1,263 @@
+/**
+ * Unit tests for the cyclomatic complexity scanner.
+ *
+ * These tests verify that the scanner walks a workspace, analyzes source
+ * files with tree-sitter, and emits SARIF findings for functions whose
+ * cyclomatic complexity exceeds the configured threshold.
+ *
+ * @module tests/complexity-scanner.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import pino from "pino";
+
+import { scanComplexity } from "../scanner/complexity-scanner.js";
+import { TreeSitterEngine } from "../ast/tree-sitter-engine.js";
+import { SarifStore } from "../sarif/sarif-store.js";
+
+const logger = pino({ level: "silent" });
+
+function makeTmpDir(): string {
+  return mkdtempSync(join(tmpdir(), "crap-complexity-"));
+}
+
+/** Simple function: CC = 1 (straight-line). */
+const SIMPLE_TS = `
+export function greet(name: string): string {
+  return "hello " + name;
+}
+`;
+
+/** Function with CC = 5: 4 if-branches + 1 baseline. */
+const COMPLEX_TS = `
+export function classify(x: number): string {
+  if (x < 0) return "negative";
+  if (x === 0) return "zero";
+  if (x < 10) return "small";
+  if (x < 100) return "medium";
+  return "large";
+}
+`;
+
+/**
+ * Extremely complex function: many branches to push CC well above 30.
+ * Each if/else-if adds +1, plus boolean operators.
+ */
+const EXTREME_TS = `
+export function extremelyComplex(a: number, b: number, c: number): string {
+  if (a > 0) { return "a1"; }
+  if (a > 1) { return "a2"; }
+  if (a > 2) { return "a3"; }
+  if (a > 3) { return "a4"; }
+  if (a > 4) { return "a5"; }
+  if (a > 5) { return "a6"; }
+  if (a > 6) { return "a7"; }
+  if (a > 7) { return "a8"; }
+  if (a > 8) { return "a9"; }
+  if (a > 9) { return "a10"; }
+  if (b > 0) { return "b1"; }
+  if (b > 1) { return "b2"; }
+  if (b > 2) { return "b3"; }
+  if (b > 3) { return "b4"; }
+  if (b > 4) { return "b5"; }
+  if (b > 5) { return "b6"; }
+  if (b > 6) { return "b7"; }
+  if (b > 7) { return "b8"; }
+  if (b > 8) { return "b9"; }
+  if (b > 9) { return "b10"; }
+  if (c > 0) { return "c1"; }
+  if (c > 1) { return "c2"; }
+  if (c > 2) { return "c3"; }
+  if (c > 3) { return "c4"; }
+  if (c > 4) { return "c5"; }
+  if (c > 5) { return "c6"; }
+  if (c > 6) { return "c7"; }
+  if (c > 7) { return "c8"; }
+  if (c > 8) { return "c9"; }
+  if (c > 9) { return "c10"; }
+  return "default";
+}
+`;
+
+describe("scanComplexity", () => {
+  const engine = new TreeSitterEngine();
+
+  it("returns zero violations for an empty workspace", async () => {
+    const dir = makeTmpDir();
+    try {
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 15 }, logger,
+      );
+      assert.equal(result.violations, 0);
+      assert.equal(result.filesScanned, 0);
+      assert.equal(result.functionsAnalyzed, 0);
+      assert.ok(result.durationMs >= 0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("finds no violations when all functions are below threshold", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "simple.ts"), SIMPLE_TS);
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 15 }, logger,
+      );
+      assert.equal(result.violations, 0);
+      assert.equal(result.filesScanned, 1);
+      assert.ok(result.functionsAnalyzed >= 1);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("flags functions above cyclomaticMax as warnings", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "complex.ts"), COMPLEX_TS);
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      // Set threshold to 3 so the CC=5 function triggers
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 3 }, logger,
+      );
+      assert.equal(result.violations, 1);
+
+      // Verify the finding is in the SARIF store
+      const findings = store.list();
+      const complexityFindings = findings.filter(
+        (f) => f.ruleId === "complexity/cyclomatic-max",
+      );
+      assert.equal(complexityFindings.length, 1);
+      assert.equal(complexityFindings[0]!.level, "warning");
+      assert.equal(complexityFindings[0]!.sourceTool, "complexity");
+      assert.ok(complexityFindings[0]!.message.includes("classify"));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("emits error level for functions at >= 2x threshold", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "extreme.ts"), EXTREME_TS);
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      // threshold=15, CC=31 → 31 >= 30 (2x15) → error
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 15 }, logger,
+      );
+      assert.equal(result.violations, 1);
+
+      const findings = store.list();
+      const complexityFindings = findings.filter(
+        (f) => f.ruleId === "complexity/cyclomatic-max",
+      );
+      assert.equal(complexityFindings.length, 1);
+      assert.equal(complexityFindings[0]!.level, "error");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("skips directories in SKIP_DIRS", async () => {
+    const dir = makeTmpDir();
+    try {
+      // Put a complex file inside node_modules — should be skipped
+      const nmDir = join(dir, "node_modules", "pkg");
+      mkdirSync(nmDir, { recursive: true });
+      writeFileSync(join(nmDir, "index.ts"), COMPLEX_TS);
+
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 3 }, logger,
+      );
+      assert.equal(result.filesScanned, 0);
+      assert.equal(result.violations, 0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("skips unsupported file extensions", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "data.json"), '{"key": "value"}');
+      writeFileSync(join(dir, "readme.md"), "# Hello");
+      writeFileSync(join(dir, "styles.css"), "body {}");
+
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 15 }, logger,
+      );
+      assert.equal(result.filesScanned, 0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("respects custom cyclomaticMax threshold", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "complex.ts"), COMPLEX_TS);
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      // CC=5, threshold=10 → no violation
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 10 }, logger,
+      );
+      assert.equal(result.violations, 0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("sets effortMinutes and cyclomaticComplexity in finding properties", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "complex.ts"), COMPLEX_TS);
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await scanComplexity(
+        dir, engine, store, { cyclomaticMax: 3 }, logger,
+      );
+      assert.equal(result.violations, 1);
+
+      const findings = store.list();
+      const finding = findings.find((f) => f.ruleId === "complexity/cyclomatic-max");
+      assert.ok(finding);
+      assert.equal(typeof finding.properties?.effortMinutes, "number");
+      assert.ok((finding.properties?.effortMinutes as number) > 0);
+      assert.equal(typeof finding.properties?.cyclomaticComplexity, "number");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/tests/exclusions.test.ts

@@ -0,0 +1,117 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  DEFAULT_SKIP_DIRS,
+  DEFAULT_SKIP_PATTERNS,
+  createExclusionFilter,
+} from "../shared/exclusions.js";
+
+describe("DEFAULT_SKIP_DIRS", () => {
+  it("includes core directories", () => {
+    for (const dir of ["node_modules", ".git", "dist", "build", "bundle", "out", "target", "coverage", "vendor"]) {
+      assert.ok(DEFAULT_SKIP_DIRS.has(dir), `missing: ${dir}`);
+    }
+  });
+
+  it("includes framework build outputs", () => {
+    for (const dir of [".next", ".nuxt", ".output", ".vercel", ".svelte-kit", ".astro", ".angular", ".turbo", ".parcel-cache", ".expo"]) {
+      assert.ok(DEFAULT_SKIP_DIRS.has(dir), `missing: ${dir}`);
+    }
+  });
+
+  it("includes language-specific caches", () => {
+    for (const dir of [".venv", "venv", "__pycache__", ".cache", ".dart_tool", ".gradle"]) {
+      assert.ok(DEFAULT_SKIP_DIRS.has(dir), `missing: ${dir}`);
+    }
+  });
+
+  it("includes plugin state dirs", () => {
+    for (const dir of [".claude-crap", ".codesight"]) {
+      assert.ok(DEFAULT_SKIP_DIRS.has(dir), `missing: ${dir}`);
+    }
+  });
+});
+
+describe("DEFAULT_SKIP_PATTERNS", () => {
+  it("includes minified and bundled file patterns", () => {
+    const patterns = new Set(DEFAULT_SKIP_PATTERNS);
+    assert.ok(patterns.has("*.min.js"));
+    assert.ok(patterns.has("*.min.css"));
+    assert.ok(patterns.has("*.bundle.js"));
+    assert.ok(patterns.has("*.chunk.js"));
+  });
+});
+
+describe("createExclusionFilter", () => {
+  describe("shouldSkipDir", () => {
+    it("skips default directories", () => {
+      const filter = createExclusionFilter();
+      assert.equal(filter.shouldSkipDir("node_modules"), true);
+      assert.equal(filter.shouldSkipDir("dist"), true);
+      assert.equal(filter.shouldSkipDir("bundle"), true);
+      assert.equal(filter.shouldSkipDir(".next"), true);
+      assert.equal(filter.shouldSkipDir(".dart_tool"), true);
+    });
+
+    it("allows normal directories", () => {
+      const filter = createExclusionFilter();
+      assert.equal(filter.shouldSkipDir("src"), false);
+      assert.equal(filter.shouldSkipDir("lib"), false);
+      assert.equal(filter.shouldSkipDir("apps"), false);
+    });
+
+    it("skips hidden directories except .claude-plugin", () => {
+      const filter = createExclusionFilter();
+      assert.equal(filter.shouldSkipDir(".hidden"), true);
+      assert.equal(filter.shouldSkipDir(".secret"), true);
+      assert.equal(filter.shouldSkipDir(".claude-plugin"), false);
+    });
+
+    it("respects user directory exclusions with trailing slash", () => {
+      const filter = createExclusionFilter(["legacy/", "generated/"]);
+      assert.equal(filter.shouldSkipDir("legacy"), true);
+      assert.equal(filter.shouldSkipDir("generated"), true);
+      assert.equal(filter.shouldSkipDir("src"), false);
+    });
+  });
+
+  describe("shouldSkipFile", () => {
+    it("skips default minified patterns", () => {
+      const filter = createExclusionFilter();
+      assert.equal(filter.shouldSkipFile("lib/app.min.js", "app.min.js"), true);
+      assert.equal(filter.shouldSkipFile("styles/main.min.css", "main.min.css"), true);
+      assert.equal(filter.shouldSkipFile("lib/vendor.bundle.js", "vendor.bundle.js"), true);
+      assert.equal(filter.shouldSkipFile("lib/0.chunk.js", "0.chunk.js"), true);
+    });
+
+    it("allows normal source files", () => {
+      const filter = createExclusionFilter();
+      assert.equal(filter.shouldSkipFile("src/index.ts", "index.ts"), false);
+      assert.equal(filter.shouldSkipFile("lib/utils.js", "utils.js"), false);
+    });
+
+    it("applies user glob patterns to filenames", () => {
+      const filter = createExclusionFilter(["*.proto.ts"]);
+      assert.equal(filter.shouldSkipFile("src/api/service.proto.ts", "service.proto.ts"), true);
+      assert.equal(filter.shouldSkipFile("src/api/service.ts", "service.ts"), false);
+    });
+
+    it("applies user glob patterns to relative paths", () => {
+      const filter = createExclusionFilter(["src/generated/**"]);
+      assert.equal(filter.shouldSkipFile("src/generated/types.ts", "types.ts"), true);
+      assert.equal(filter.shouldSkipFile("src/real/types.ts", "types.ts"), false);
+    });
+
+    it("works with empty user exclusions", () => {
+      const filter = createExclusionFilter([]);
+      assert.equal(filter.shouldSkipFile("src/index.ts", "index.ts"), false);
+      assert.equal(filter.shouldSkipFile("lib/app.min.js", "app.min.js"), true);
+    });
+
+    it("works with undefined user exclusions", () => {
+      const filter = createExclusionFilter();
+      assert.equal(filter.shouldSkipFile("src/index.ts", "index.ts"), false);
+    });
+  });
+});