code-auditor-mcp 3.4.11 → 3.4.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +2 -2
- package/CHANGELOG.md +119 -1
- package/dist/analyzers/__verify_self_probe.d.ts +2 -0
- package/dist/analyzers/__verify_self_probe.d.ts.map +1 -0
- package/dist/analyzers/__verify_self_probe.js +5 -0
- package/dist/analyzers/__verify_self_probe.js.map +1 -0
- package/dist/analyzers/analyzerUtils.d.ts +34 -1
- package/dist/analyzers/analyzerUtils.d.ts.map +1 -1
- package/dist/analyzers/analyzerUtils.js +61 -22
- package/dist/analyzers/analyzerUtils.js.map +1 -1
- package/dist/analyzers/cross-language/APIContractAnalyzer.d.ts +18 -23
- package/dist/analyzers/cross-language/APIContractAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/cross-language/APIContractAnalyzer.js +198 -186
- package/dist/analyzers/cross-language/APIContractAnalyzer.js.map +1 -1
- package/dist/analyzers/cross-language/DependencyGraphBuilder.d.ts +78 -55
- package/dist/analyzers/cross-language/DependencyGraphBuilder.d.ts.map +1 -1
- package/dist/analyzers/cross-language/DependencyGraphBuilder.js +244 -243
- package/dist/analyzers/cross-language/DependencyGraphBuilder.js.map +1 -1
- package/dist/analyzers/cross-language/SchemaValidator.d.ts +27 -37
- package/dist/analyzers/cross-language/SchemaValidator.d.ts.map +1 -1
- package/dist/analyzers/cross-language/SchemaValidator.js +314 -275
- package/dist/analyzers/cross-language/SchemaValidator.js.map +1 -1
- package/dist/analyzers/crossDomain/CrossDomainAnalyzer.d.ts +17 -46
- package/dist/analyzers/crossDomain/CrossDomainAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/crossDomain/CrossDomainAnalyzer.js +620 -523
- package/dist/analyzers/crossDomain/CrossDomainAnalyzer.js.map +1 -1
- package/dist/analyzers/documentationAnalyzer.d.ts +7 -2
- package/dist/analyzers/documentationAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/documentationAnalyzer.js +259 -198
- package/dist/analyzers/documentationAnalyzer.js.map +1 -1
- package/dist/analyzers/invariantsAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/invariantsAnalyzer.js +59 -46
- package/dist/analyzers/invariantsAnalyzer.js.map +1 -1
- package/dist/analyzers/orm/adapterRegistry.d.ts +10 -0
- package/dist/analyzers/orm/adapterRegistry.d.ts.map +1 -1
- package/dist/analyzers/orm/adapterRegistry.js +10 -0
- package/dist/analyzers/orm/adapterRegistry.js.map +1 -1
- package/dist/analyzers/orm/drizzleAdapter.d.ts +22 -0
- package/dist/analyzers/orm/drizzleAdapter.d.ts.map +1 -1
- package/dist/analyzers/orm/drizzleAdapter.js +42 -44
- package/dist/analyzers/orm/drizzleAdapter.js.map +1 -1
- package/dist/analyzers/orm/prismaAdapter.d.ts +30 -0
- package/dist/analyzers/orm/prismaAdapter.d.ts.map +1 -1
- package/dist/analyzers/orm/prismaAdapter.js +30 -0
- package/dist/analyzers/orm/prismaAdapter.js.map +1 -1
- package/dist/analyzers/provenance.d.ts +72 -2
- package/dist/analyzers/provenance.d.ts.map +1 -1
- package/dist/analyzers/provenance.js +462 -338
- package/dist/analyzers/provenance.js.map +1 -1
- package/dist/analyzers/reactAnalyzer.d.ts +11 -0
- package/dist/analyzers/reactAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/reactAnalyzer.js +188 -125
- package/dist/analyzers/reactAnalyzer.js.map +1 -1
- package/dist/analyzers/ruleRegistry.d.ts +118 -1
- package/dist/analyzers/ruleRegistry.d.ts.map +1 -1
- package/dist/analyzers/ruleRegistry.js +1717 -104
- package/dist/analyzers/ruleRegistry.js.map +1 -1
- package/dist/analyzers/ruleTiming.d.ts +54 -0
- package/dist/analyzers/ruleTiming.d.ts.map +1 -0
- package/dist/analyzers/ruleTiming.js +71 -0
- package/dist/analyzers/ruleTiming.js.map +1 -0
- package/dist/analyzers/universal/UniversalConventionsAnalyzer.d.ts +13 -0
- package/dist/analyzers/universal/UniversalConventionsAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalConventionsAnalyzer.js +362 -283
- package/dist/analyzers/universal/UniversalConventionsAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/UniversalDRYAnalyzer.d.ts +26 -68
- package/dist/analyzers/universal/UniversalDRYAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalDRYAnalyzer.js +430 -391
- package/dist/analyzers/universal/UniversalDRYAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/UniversalDataAccessAnalyzer.d.ts +24 -186
- package/dist/analyzers/universal/UniversalDataAccessAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalDataAccessAnalyzer.js +1081 -1061
- package/dist/analyzers/universal/UniversalDataAccessAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/UniversalDocumentationAnalyzer.d.ts +3 -49
- package/dist/analyzers/universal/UniversalDocumentationAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalDocumentationAnalyzer.js +414 -340
- package/dist/analyzers/universal/UniversalDocumentationAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/UniversalSOLIDAnalyzer.d.ts +48 -5
- package/dist/analyzers/universal/UniversalSOLIDAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalSOLIDAnalyzer.js +262 -134
- package/dist/analyzers/universal/UniversalSOLIDAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/UniversalSchemaAnalyzer.d.ts +23 -212
- package/dist/analyzers/universal/UniversalSchemaAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalSchemaAnalyzer.js +139 -1518
- package/dist/analyzers/universal/UniversalSchemaAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/UniversalStylesAnalyzer.d.ts +78 -79
- package/dist/analyzers/universal/UniversalStylesAnalyzer.d.ts.map +1 -1
- package/dist/analyzers/universal/UniversalStylesAnalyzer.js +613 -472
- package/dist/analyzers/universal/UniversalStylesAnalyzer.js.map +1 -1
- package/dist/analyzers/universal/schema/codeAnalysis.d.ts +307 -0
- package/dist/analyzers/universal/schema/codeAnalysis.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/codeAnalysis.js +965 -0
- package/dist/analyzers/universal/schema/codeAnalysis.js.map +1 -0
- package/dist/analyzers/universal/schema/config.d.ts +31 -0
- package/dist/analyzers/universal/schema/config.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/config.js +57 -0
- package/dist/analyzers/universal/schema/config.js.map +1 -0
- package/dist/analyzers/universal/schema/discovery.d.ts +167 -0
- package/dist/analyzers/universal/schema/discovery.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/discovery.js +616 -0
- package/dist/analyzers/universal/schema/discovery.js.map +1 -0
- package/dist/analyzers/universal/schema/jsonSchema.d.ts +27 -0
- package/dist/analyzers/universal/schema/jsonSchema.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/jsonSchema.js +368 -0
- package/dist/analyzers/universal/schema/jsonSchema.js.map +1 -0
- package/dist/analyzers/universal/schema/migrations.d.ts +90 -0
- package/dist/analyzers/universal/schema/migrations.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/migrations.js +238 -0
- package/dist/analyzers/universal/schema/migrations.js.map +1 -0
- package/dist/analyzers/universal/schema/types.d.ts +131 -0
- package/dist/analyzers/universal/schema/types.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/types.js +10 -0
- package/dist/analyzers/universal/schema/types.js.map +1 -0
- package/dist/analyzers/universal/schema/violations.d.ts +44 -0
- package/dist/analyzers/universal/schema/violations.d.ts.map +1 -0
- package/dist/analyzers/universal/schema/violations.js +54 -0
- package/dist/analyzers/universal/schema/violations.js.map +1 -0
- package/dist/auditRunner.d.ts.map +1 -1
- package/dist/auditRunner.js +101 -39
- package/dist/auditRunner.js.map +1 -1
- package/dist/cli.js +348 -40
- package/dist/cli.js.map +1 -1
- package/dist/config/configLoader.d.ts.map +1 -1
- package/dist/config/configLoader.js +9 -7
- package/dist/config/configLoader.js.map +1 -1
- package/dist/config/defaults.d.ts +12 -3
- package/dist/config/defaults.d.ts.map +1 -1
- package/dist/config/defaults.js +15 -5
- package/dist/config/defaults.js.map +1 -1
- package/dist/config/effectiveConfig.d.ts +75 -0
- package/dist/config/effectiveConfig.d.ts.map +1 -0
- package/dist/config/effectiveConfig.js +213 -0
- package/dist/config/effectiveConfig.js.map +1 -0
- package/dist/config/pathProfiles.d.ts +7 -4
- package/dist/config/pathProfiles.d.ts.map +1 -1
- package/dist/config/pathProfiles.js +8 -10
- package/dist/config/pathProfiles.js.map +1 -1
- package/dist/config/thresholdRationales.d.ts +45 -0
- package/dist/config/thresholdRationales.d.ts.map +1 -0
- package/dist/config/thresholdRationales.js +67 -0
- package/dist/config/thresholdRationales.js.map +1 -0
- package/dist/conventions/conventionMiner.d.ts.map +1 -1
- package/dist/conventions/conventionMiner.js +6 -2
- package/dist/conventions/conventionMiner.js.map +1 -1
- package/dist/enforcement/diffGate.d.ts +55 -0
- package/dist/enforcement/diffGate.d.ts.map +1 -0
- package/dist/enforcement/diffGate.js +136 -0
- package/dist/enforcement/diffGate.js.map +1 -0
- package/dist/enforcement/gate.d.ts +36 -0
- package/dist/enforcement/gate.d.ts.map +1 -0
- package/dist/enforcement/gate.js +72 -0
- package/dist/enforcement/gate.js.map +1 -0
- package/dist/enforcement/suppressions.d.ts +41 -0
- package/dist/enforcement/suppressions.d.ts.map +1 -0
- package/dist/enforcement/suppressions.js +170 -0
- package/dist/enforcement/suppressions.js.map +1 -0
- package/dist/fingerprint.d.ts.map +1 -1
- package/dist/fingerprint.js +4 -1
- package/dist/fingerprint.js.map +1 -1
- package/dist/grammars/tree-sitter-scss.wasm +0 -0
- package/dist/invariants/ruleEngine.d.ts +3 -4
- package/dist/invariants/ruleEngine.d.ts.map +1 -1
- package/dist/invariants/ruleEngine.js +2 -2
- package/dist/invariants/ruleEngine.js.map +1 -1
- package/dist/languages/LanguageOrchestrator.d.ts +14 -0
- package/dist/languages/LanguageOrchestrator.d.ts.map +1 -1
- package/dist/languages/LanguageOrchestrator.js +93 -55
- package/dist/languages/LanguageOrchestrator.js.map +1 -1
- package/dist/languages/LanguageRegistry.d.ts +8 -0
- package/dist/languages/LanguageRegistry.d.ts.map +1 -1
- package/dist/languages/LanguageRegistry.js +8 -0
- package/dist/languages/LanguageRegistry.js.map +1 -1
- package/dist/languages/RuntimeManager.d.ts +82 -60
- package/dist/languages/RuntimeManager.d.ts.map +1 -1
- package/dist/languages/RuntimeManager.js +404 -349
- package/dist/languages/RuntimeManager.js.map +1 -1
- package/dist/languages/UniversalAnalyzer.d.ts +51 -6
- package/dist/languages/UniversalAnalyzer.d.ts.map +1 -1
- package/dist/languages/UniversalAnalyzer.js +127 -88
- package/dist/languages/UniversalAnalyzer.js.map +1 -1
- package/dist/languages/adapterBridge.d.ts +36 -0
- package/dist/languages/adapterBridge.d.ts.map +1 -1
- package/dist/languages/adapterBridge.js +89 -35
- package/dist/languages/adapterBridge.js.map +1 -1
- package/dist/languages/go/GoAdapter.d.ts +66 -23
- package/dist/languages/go/GoAdapter.d.ts.map +1 -1
- package/dist/languages/go/GoAdapter.js +553 -474
- package/dist/languages/go/GoAdapter.js.map +1 -1
- package/dist/languages/tree-sitter/TreeSitterCssAdapter.d.ts +38 -9
- package/dist/languages/tree-sitter/TreeSitterCssAdapter.d.ts.map +1 -1
- package/dist/languages/tree-sitter/TreeSitterCssAdapter.js +111 -74
- package/dist/languages/tree-sitter/TreeSitterCssAdapter.js.map +1 -1
- package/dist/languages/tree-sitter/converter.d.ts +18 -0
- package/dist/languages/tree-sitter/converter.d.ts.map +1 -1
- package/dist/languages/tree-sitter/converter.js +18 -0
- package/dist/languages/tree-sitter/converter.js.map +1 -1
- package/dist/languages/tree-sitter/parser.d.ts +39 -2
- package/dist/languages/tree-sitter/parser.d.ts.map +1 -1
- package/dist/languages/tree-sitter/parser.js +95 -12
- package/dist/languages/tree-sitter/parser.js.map +1 -1
- package/dist/languages/types.d.ts +67 -2
- package/dist/languages/types.d.ts.map +1 -1
- package/dist/languages/typescript/TreeSitterTypeScriptAdapter.d.ts +253 -62
- package/dist/languages/typescript/TreeSitterTypeScriptAdapter.d.ts.map +1 -1
- package/dist/languages/typescript/TreeSitterTypeScriptAdapter.js +1461 -791
- package/dist/languages/typescript/TreeSitterTypeScriptAdapter.js.map +1 -1
- package/dist/mcp-tools/whitelistTools.d.ts +1 -1
- package/dist/mcp-tools-shared.d.ts.map +1 -1
- package/dist/mcp-tools-shared.js +1 -0
- package/dist/mcp-tools-shared.js.map +1 -1
- package/dist/mcpAuditJobs.d.ts.map +1 -1
- package/dist/mcpAuditJobs.js +1 -0
- package/dist/mcpAuditJobs.js.map +1 -1
- package/dist/pipeline.d.ts +30 -1
- package/dist/pipeline.d.ts.map +1 -1
- package/dist/pipeline.js +527 -203
- package/dist/pipeline.js.map +1 -1
- package/dist/pipelineAdapters.d.ts +5 -12
- package/dist/pipelineAdapters.d.ts.map +1 -1
- package/dist/pipelineAdapters.js +175 -100
- package/dist/pipelineAdapters.js.map +1 -1
- package/dist/presets/presets.d.ts +54 -0
- package/dist/presets/presets.d.ts.map +1 -0
- package/dist/presets/presets.js +181 -0
- package/dist/presets/presets.js.map +1 -0
- package/dist/reporting/sarifReportGenerator.d.ts.map +1 -1
- package/dist/reporting/sarifReportGenerator.js +0 -2
- package/dist/reporting/sarifReportGenerator.js.map +1 -1
- package/dist/ruleAliases.d.ts +67 -0
- package/dist/ruleAliases.d.ts.map +1 -0
- package/dist/ruleAliases.js +79 -0
- package/dist/ruleAliases.js.map +1 -0
- package/dist/styles/cssAstExtractor.d.ts +20 -5
- package/dist/styles/cssAstExtractor.d.ts.map +1 -1
- package/dist/styles/cssAstExtractor.js +247 -9
- package/dist/styles/cssAstExtractor.js.map +1 -1
- package/dist/styles/styleIndexer.js +13 -4
- package/dist/styles/styleIndexer.js.map +1 -1
- package/dist/styles/tailwindConfigLoader.d.ts +8 -6
- package/dist/styles/tailwindConfigLoader.d.ts.map +1 -1
- package/dist/styles/tailwindConfigLoader.js +61 -15
- package/dist/styles/tailwindConfigLoader.js.map +1 -1
- package/dist/styles/tailwindUtilityExpander.d.ts.map +1 -1
- package/dist/styles/tailwindUtilityExpander.js +13 -1
- package/dist/styles/tailwindUtilityExpander.js.map +1 -1
- package/dist/types.d.ts +201 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +8 -0
- package/dist/types.js.map +1 -1
- package/package.json +7 -4
- package/plugin/.claude-plugin/plugin.json +1 -1
- package/plugin/hooks/hooks.json +1 -1
- package/plugin/scripts/hook-audit.sh +25 -7
- package/plugin/skills/code-auditor/SKILL.md +5 -5
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"name": "code-auditor",
|
|
11
11
|
"source": "./plugin",
|
|
12
12
|
"description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
|
|
13
|
-
"version": "3.4.
|
|
13
|
+
"version": "3.4.13",
|
|
14
14
|
"author": {
|
|
15
15
|
"name": "Ben Hammond"
|
|
16
16
|
},
|
|
@@ -23,5 +23,5 @@
|
|
|
23
23
|
]
|
|
24
24
|
}
|
|
25
25
|
],
|
|
26
|
-
"version": "3.4.
|
|
26
|
+
"version": "3.4.12"
|
|
27
27
|
}
|
package/CHANGELOG.md
CHANGED
|
@@ -2,7 +2,125 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to the Code Auditor MCP project.
|
|
4
4
|
|
|
5
|
-
## [3.4.
|
|
5
|
+
## [3.4.13] — 2026-08-16
|
|
6
|
+
|
|
7
|
+
### Memory — streaming pipeline + `tree.delete()` (Spec 30/31/32)
|
|
8
|
+
- Streaming parse pipeline with per-file `tree.delete()`: peak heapUsed
|
|
9
|
+
2.6 GB → 1.2 GB on the recall-protocol corpus.
|
|
10
|
+
- Three raw-content facts (file-sources / schema-sql / schema-json) eliminated —
|
|
11
|
+
the arena no longer retains full source text.
|
|
12
|
+
- Oversized-SQL skip and WASM abort recovery.
|
|
13
|
+
- Post-`gc()` RSS on twenty (23,649 files): 2,423 MB → 1,285 MB; heapUsed after
|
|
14
|
+
`gc()` flat at 71 MB (no JS-object leak).
|
|
15
|
+
|
|
16
|
+
### Schema precision fixes (Spec 33/34)
|
|
17
|
+
- `UniversalSchemaAnalyzer` split into `schema/` submodules; table-catalog
|
|
18
|
+
registry (Tier 2) with provenance tracking.
|
|
19
|
+
- Taint-aware `sql-injection` (`isAllDynamicPartsSafe`) + parameterized-query skip.
|
|
20
|
+
- `interface-segregation` `hasMethodMembers` guard — data-shape records (GraphQL
|
|
21
|
+
types, `HTMLElementTagNameMap`, config/DTO bags) no longer flagged.
|
|
22
|
+
- `open-closed` `BUILTIN_TYPES` expansion.
|
|
23
|
+
- Documentation de-dup: public methods reported once as `method-documentation`,
|
|
24
|
+
no longer double-reported as `function-documentation`.
|
|
25
|
+
- `dependency-inversion` import-count signal removed (importing ≠ instantiating);
|
|
26
|
+
the "directly instantiates" signal is retained.
|
|
27
|
+
|
|
28
|
+
### Self-audit to zero + pipeline hardening (Spec 35)
|
|
29
|
+
- `verify:self` gate on the production scope (`analyzers/` + `languages/`) at
|
|
30
|
+
zero scoped violations, with a live zero-assertion.
|
|
31
|
+
- `isSafe*` parameter cluster collapsed into a `SafetyContext` object.
|
|
32
|
+
- A2: tree dispose runs on the throw path (`finally`), fault-injection tested.
|
|
33
|
+
- A3: every `catch` in the parse→loop span enumerated; none swallow silently.
|
|
34
|
+
- `verify:dist` self-contained (`npm pack` first); hook unset-variable guard.
|
|
35
|
+
|
|
36
|
+
### Enforcement + finding contract (Spec 36/37)
|
|
37
|
+
- Rules carry a resolution (the next action), not just a problem; rule metadata
|
|
38
|
+
as a contract; rules ship with their tests.
|
|
39
|
+
- Binary gate: new findings block, existing ones don't; suppressions decay.
|
|
40
|
+
- `verify:gate-budget` enforces a 300 ms gate wall-clock budget.
|
|
41
|
+
|
|
42
|
+
### Operations (Spec 38)
|
|
43
|
+
- `--print-config`; per-rule timing; shareable presets (d1, drizzle, typeorm,
|
|
44
|
+
prisma, plain-pg, knex); rule-ID alias map.
|
|
45
|
+
|
|
46
|
+
### Release verification
|
|
47
|
+
- Twenty 26,987 → 19,353 decomposed exactly (five named precision fixes, zero
|
|
48
|
+
residual); knex re-pinned at 434, blitz at 917.
|
|
49
|
+
|
|
50
|
+
## [3.4.12] — 2026-08-10
|
|
51
|
+
|
|
52
|
+
### Accuracy fix — `unknown-table` silently off when configuring `schemas`
|
|
53
|
+
|
|
54
|
+
The pipeline schema reducer (`createSchemaReducer`) built its known-tables catalog
|
|
55
|
+
from `schemaConfig.knownTables` (a flat `string[]`) only. It did not read
|
|
56
|
+
`schemaConfig.schemas` — the documented, structured `{name, tables}` shape that
|
|
57
|
+
the standalone `UniversalSchemaAnalyzer.analyze()` path uses. A user who configured
|
|
58
|
+
only `schemas` in `.codeauditor.json` got `knownTables.size === 0`, triggering the
|
|
59
|
+
fail-open gate, and `unknown-table` violations silently never fired.
|
|
60
|
+
|
|
61
|
+
**Fix**: `createSchemaReducer` now flattens `schemaConfig.schemas` into the catalog
|
|
62
|
+
the same way the standalone analyzer does, so both config shapes work in both code
|
|
63
|
+
paths.
|
|
64
|
+
|
|
65
|
+
### Fixture corpus — 7 known-answer regression guard suites
|
|
66
|
+
|
|
67
|
+
Systematic fixture corpus: small projects with known-answer inputs and exact
|
|
68
|
+
violation-count assertions. Each suite copies to a temp dir and runs cold
|
|
69
|
+
through the real CLI — no mocks between config and report.
|
|
70
|
+
|
|
71
|
+
| Suite | Directory | What it guards |
|
|
72
|
+
|-------|-----------|---------------|
|
|
73
|
+
| Invariant rules | `tests/fixtures/invariant-rules/` | All 5 rule kinds: import-ban, naming, call-constraint, module-boundary, ast-pattern |
|
|
74
|
+
| Data-access rules | `tests/fixtures/data-access-rules/` | unfiltered-query, loop-query, missing-org-filter, complex-query; pool.length non-DB receiver guard |
|
|
75
|
+
| SQL FP guards | `tests/fixtures/sql-fp-guards/` | 10 safe-pattern files (prepare-bind, escapeSql, wrapper-bind, etc.) + 1 true positive; 15 documented acknowledged FPs |
|
|
76
|
+
| Conventions | `tests/fixtures/conventions/` | export-shape majority-rule detection (named-majority vs all-named) |
|
|
77
|
+
| Cross-domain | `tests/fixtures/cross-domain/` | written-never-read on INSERT-only table, transaction-boundary on multi-table write |
|
|
78
|
+
| SQL CTE | `tests/fixtures/sql-cte/` | CTE names excluded from table references; inner tables extracted |
|
|
79
|
+
| SQL subquery | `tests/fixtures/sql-subquery-alias/` | Subquery aliases excluded; column alias near-miss guard |
|
|
80
|
+
|
|
81
|
+
### Other fixes
|
|
82
|
+
- **`dbWrapperNames` passthrough**: schema-code visitor config wasn't forwarding
|
|
83
|
+
`dbWrapperNames`, so locally-defined wrapper functions weren't recognized in
|
|
84
|
+
the pipeline path (only the standalone analyzer saw them).
|
|
85
|
+
- **Non-DB `pool` receiver guard**: `pool.length` on array variables is no longer
|
|
86
|
+
mistaken for a database pool operation.
|
|
87
|
+
- **SQL CTE / subquery-alias parser regression guards** (v3.4.8 regression): CTE
|
|
88
|
+
names and subquery aliases correctly excluded from table reference extraction.
|
|
89
|
+
Confirmed via integration tests.
|
|
90
|
+
|
|
91
|
+
### Open
|
|
92
|
+
- **15 documented `sql-injection-risk` false positives**: each mechanism named
|
|
93
|
+
in `docs/sql-injection-fp-defect.md`. The FP-guard fixture tests use
|
|
94
|
+
`toBeLessThanOrEqual(currentCount)` assertions — improvements drop the count
|
|
95
|
+
without breaking; regressions that spike it are caught.
|
|
96
|
+
|
|
97
|
+
### Adjudication release — Spec 26 findings confirmed
|
|
98
|
+
|
|
99
|
+
All Spec 26 findings adjudicated against recall-protocol cold run (119 styles,
|
|
100
|
+
116 conventions, 1256 data-access). No code changes — every finding verified
|
|
101
|
+
individually.
|
|
102
|
+
|
|
103
|
+
#### Styles (frosted-prism.css delta)
|
|
104
|
+
- 9 token-bypass REAL: `#06131c` vs `--active-ink` (token consumed in 8 selectors)
|
|
105
|
+
- 4 token-bypass RULE BUG: `#fff` vs `--health-base` (cross-file discovery without semantic scoping — `#fff` is universal color used for Discord/YouTube elements unrelated to health bars)
|
|
106
|
+
- 15 declaration-set-similarity REAL: verified every pair (5-11/11 declarations identical)
|
|
107
|
+
- 1 z-index-sprawl REAL: 10 distinct z-index values in one file
|
|
108
|
+
- Failure construct identified: one-liner `@keyframes {...{...}...}` with nested braces immediately followed by `@media {...}` — `{[^}]*}` regex matches first nested `}`, confusing brace-counting state machine
|
|
109
|
+
|
|
110
|
+
#### SQL injection (18 survivors)
|
|
111
|
+
- 2 REAL: hero-data-agent.ts:232, :241 — `opts.gameMode` (RPC user input) interpolated into `.exec()` SQL with only quote-escaping
|
|
112
|
+
- 1 RULE BUG: store.ts:422 — `table` is fixed internal literal (documented)
|
|
113
|
+
- 15 FALSE POSITIVES: all `.prepare()` calls interpolate compile-time constants (OFFICIAL_HEROES_SQL, EFFECT_FLAGS, CATALOG_SOURCES_SQL, allowlist-guarded values)
|
|
114
|
+
- Zero SQL-keyword receiver false positives (confirmed)
|
|
115
|
+
|
|
116
|
+
#### Conventions
|
|
117
|
+
- +1 export-shape: AdminModerationShell.tsx uses `export default` in 97%-named directory (AST `extractExports` correctly identified)
|
|
118
|
+
|
|
119
|
+
#### Recall-protocol tickets
|
|
120
|
+
- generation_queue: 8 unknown-table violations, table dropped in migration 0198
|
|
121
|
+
- hero-data-agent.ts: user-input interpolation into `.exec()` SQL
|
|
122
|
+
|
|
123
|
+
## [3.4.11] — 2026-08-07
|
|
6
124
|
|
|
7
125
|
### Spec 26: Consume the ASTs We Already Produce
|
|
8
126
|
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"__verify_self_probe.d.ts","sourceRoot":"","sources":["../../src/analyzers/__verify_self_probe.ts"],"names":[],"mappings":"AACA,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAC1C,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GACzC,MAAM,CAER"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"__verify_self_probe.js","sourceRoot":"","sources":["../../src/analyzers/__verify_self_probe.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAC9B,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,CAAS,EAC1C,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,CAAS;IAE1C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}
|
|
@@ -14,17 +14,34 @@ export type FileAnalyzerFunction = (filePath: string, ast: AST, config: any, sou
|
|
|
14
14
|
* Progress reporter function
|
|
15
15
|
*/
|
|
16
16
|
export type ProgressReporter = (current: number, total: number, file: string) => void;
|
|
17
|
+
/**
|
|
18
|
+
* Bundled optional inputs for processFiles: `config` and the progress reporter
|
|
19
|
+
* travel together so the exported signature stays under the parameter cap.
|
|
20
|
+
*/
|
|
21
|
+
export interface ProcessFilesOptions {
|
|
22
|
+
config?: any;
|
|
23
|
+
progressReporter?: ProgressReporter;
|
|
24
|
+
}
|
|
17
25
|
/**
|
|
18
26
|
* Standard file processing function
|
|
19
27
|
* Handles file reading, parsing, error handling, and progress reporting
|
|
28
|
+
* @param files
|
|
29
|
+
* @param analyzeFile
|
|
30
|
+
* @param analyzerName
|
|
31
|
+
* @param options
|
|
32
|
+
* @returns
|
|
20
33
|
*/
|
|
21
|
-
export declare function processFiles(files: string[], analyzeFile: FileAnalyzerFunction, analyzerName: string,
|
|
34
|
+
export declare function processFiles(files: string[], analyzeFile: FileAnalyzerFunction, analyzerName: string, options?: ProcessFilesOptions): Promise<AnalyzerResult>;
|
|
22
35
|
/**
|
|
23
36
|
* Create a violation object with defaults
|
|
37
|
+
* @param data
|
|
38
|
+
* @returns
|
|
24
39
|
*/
|
|
25
40
|
export declare function createViolation(data: Violation): Violation;
|
|
26
41
|
/**
|
|
27
42
|
* Get line and column from an ASTNode
|
|
43
|
+
* @param node
|
|
44
|
+
* @returns
|
|
28
45
|
*/
|
|
29
46
|
export declare function getNodePosition(node: ASTNode): {
|
|
30
47
|
line: number;
|
|
@@ -40,22 +57,35 @@ export declare function isNodeExported(node: ASTNode): boolean;
|
|
|
40
57
|
export declare function getNodeName(node: ASTNode): string | undefined;
|
|
41
58
|
/**
|
|
42
59
|
* Count specific node types in a subtree
|
|
60
|
+
* @param node
|
|
61
|
+
* @param predicate
|
|
62
|
+
* @returns
|
|
43
63
|
*/
|
|
44
64
|
export declare function countNodesOfType(node: ASTNode, predicate: (node: ASTNode) => boolean): number;
|
|
45
65
|
/**
|
|
46
66
|
* Find all nodes of a specific type
|
|
67
|
+
* @param node
|
|
68
|
+
* @param predicate
|
|
69
|
+
* @returns
|
|
47
70
|
*/
|
|
48
71
|
export declare function findNodesOfType(node: ASTNode, predicate: (node: ASTNode) => boolean): ASTNode[];
|
|
49
72
|
/**
|
|
50
73
|
* Traverse AST with a visitor function
|
|
74
|
+
* @param node
|
|
75
|
+
* @param visitor
|
|
51
76
|
*/
|
|
52
77
|
export declare function traverseAST(node: ASTNode, visitor: (node: ASTNode) => void): void;
|
|
53
78
|
/**
|
|
54
79
|
* Filter violations by severity
|
|
80
|
+
* @param minSeverity
|
|
81
|
+
* @param violations
|
|
82
|
+
* @returns
|
|
55
83
|
*/
|
|
56
84
|
export declare function filterViolationsBySeverity(violations: Violation[], minSeverity?: SeverityLevel): Violation[];
|
|
57
85
|
/**
|
|
58
86
|
* Sort violations by severity, file, and line
|
|
87
|
+
* @param violations
|
|
88
|
+
* @returns
|
|
59
89
|
*/
|
|
60
90
|
export declare function sortViolations(violations: Violation[]): Violation[];
|
|
61
91
|
/**
|
|
@@ -64,6 +94,9 @@ export declare function sortViolations(violations: Violation[]): Violation[];
|
|
|
64
94
|
export declare function calculateComplexity(node: ASTNode): number;
|
|
65
95
|
/**
|
|
66
96
|
* Create a standard analyzer function
|
|
97
|
+
* @param defaultConfig
|
|
98
|
+
* @param fileAnalyzer
|
|
99
|
+
* @param name
|
|
67
100
|
*/
|
|
68
101
|
export declare function createAnalyzer(name: string, fileAnalyzer: FileAnalyzerFunction, defaultConfig?: any): (files: string[], config: Record<string, unknown>, options?: {
|
|
69
102
|
minSeverity?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyzerUtils.d.ts","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAWrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,GAAG,EACX,UAAU,CAAC,EAAE,MAAM,KAChB,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEtF;;;GAGG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,oBAAoB,EACjC,YAAY,EAAE,MAAM,EACpB,
|
|
1
|
+
{"version":3,"file":"analyzerUtils.d.ts","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAWrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,GAAG,EACX,UAAU,CAAC,EAAE,MAAM,KAChB,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEtF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,oBAAoB,EACjC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,CAmCzB;AA+BD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,GACd,SAAS,CAEX;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGlC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GACpC,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GACpC,OAAO,EAAE,CAMX;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAC/B,IAAI,CAEN;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,WAAW,CAAC,EAAE,aAAa,GAC1B,SAAS,EAAE,CAWb;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAcnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,oBAAoB,EAClC,aAAa,GAAE,GAAQ,WAEF,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,6BAWnG"}
|
|
@@ -11,34 +11,30 @@ export { getLineAndColumn, getNodeText, getImports, findNodesByKind } from '../u
|
|
|
11
11
|
/**
|
|
12
12
|
* Standard file processing function
|
|
13
13
|
* Handles file reading, parsing, error handling, and progress reporting
|
|
14
|
+
* @param files
|
|
15
|
+
* @param analyzeFile
|
|
16
|
+
* @param analyzerName
|
|
17
|
+
* @param options
|
|
18
|
+
* @returns
|
|
14
19
|
*/
|
|
15
|
-
export async function processFiles(files, analyzeFile, analyzerName,
|
|
20
|
+
export async function processFiles(files, analyzeFile, analyzerName, options = {}) {
|
|
21
|
+
const { config = {}, progressReporter } = options;
|
|
16
22
|
const violations = [];
|
|
17
23
|
const errors = [];
|
|
18
24
|
let processedFiles = 0;
|
|
19
25
|
const startTime = Date.now();
|
|
20
26
|
for (const file of files) {
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
const { ast, errors: parseErrors } = await parse(file);
|
|
30
|
-
if (parseErrors.length > 0) {
|
|
31
|
-
throw new Error(`Parse errors: ${parseErrors.map(e => e.message).join(', ')}`);
|
|
32
|
-
}
|
|
33
|
-
// Run analyzer-specific logic (pass source code for text extraction)
|
|
34
|
-
const fileViolations = await analyzeFile(file, ast, config, content);
|
|
35
|
-
violations.push(...fileViolations);
|
|
36
|
-
processedFiles++;
|
|
27
|
+
// Report progress
|
|
28
|
+
if (progressReporter) {
|
|
29
|
+
progressReporter(processedFiles, files.length, file);
|
|
30
|
+
}
|
|
31
|
+
const outcome = await processOneFile(file, analyzeFile, config);
|
|
32
|
+
violations.push(...outcome.violations);
|
|
33
|
+
if (outcome.error) {
|
|
34
|
+
errors.push(outcome.error);
|
|
37
35
|
}
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
errors.push({ file, error: errorMessage });
|
|
41
|
-
console.error(`Error analyzing ${file}:`, error);
|
|
36
|
+
if (outcome.processed) {
|
|
37
|
+
processedFiles++;
|
|
42
38
|
}
|
|
43
39
|
}
|
|
44
40
|
const result = {
|
|
@@ -52,14 +48,41 @@ export async function processFiles(files, analyzeFile, analyzerName, config = {}
|
|
|
52
48
|
}
|
|
53
49
|
return result;
|
|
54
50
|
}
|
|
51
|
+
/**
|
|
52
|
+
* Read, parse, and run the analyzer over a single file. Failures are captured
|
|
53
|
+
* as an `error` entry rather than thrown so one bad file never aborts the run.
|
|
54
|
+
*/
|
|
55
|
+
async function processOneFile(file, analyzeFile, config) {
|
|
56
|
+
try {
|
|
57
|
+
// Read and parse file
|
|
58
|
+
const { parseTypeScriptFile: parse } = await import('../utils/astParser.js');
|
|
59
|
+
const content = await fs.readFile(file, 'utf-8');
|
|
60
|
+
const { ast, errors: parseErrors } = await parse(file);
|
|
61
|
+
if (parseErrors.length > 0) {
|
|
62
|
+
throw new Error(`Parse errors: ${parseErrors.map(e => e.message).join(', ')}`);
|
|
63
|
+
}
|
|
64
|
+
// Run analyzer-specific logic (pass source code for text extraction)
|
|
65
|
+
const fileViolations = await analyzeFile(file, ast, config, content);
|
|
66
|
+
return { violations: fileViolations, processed: true };
|
|
67
|
+
}
|
|
68
|
+
catch (error) {
|
|
69
|
+
const errorMessage = error instanceof Error ? error.message : String(error);
|
|
70
|
+
console.error(`Error analyzing ${file}:`, error);
|
|
71
|
+
return { violations: [], error: { file, error: errorMessage }, processed: false };
|
|
72
|
+
}
|
|
73
|
+
}
|
|
55
74
|
/**
|
|
56
75
|
* Create a violation object with defaults
|
|
76
|
+
* @param data
|
|
77
|
+
* @returns
|
|
57
78
|
*/
|
|
58
79
|
export function createViolation(data) {
|
|
59
80
|
return data;
|
|
60
81
|
}
|
|
61
82
|
/**
|
|
62
83
|
* Get line and column from an ASTNode
|
|
84
|
+
* @param node
|
|
85
|
+
* @returns
|
|
63
86
|
*/
|
|
64
87
|
export function getNodePosition(node) {
|
|
65
88
|
const loc = bridgeGetLineAndColumn(node);
|
|
@@ -79,6 +102,9 @@ export function getNodeName(node) {
|
|
|
79
102
|
}
|
|
80
103
|
/**
|
|
81
104
|
* Count specific node types in a subtree
|
|
105
|
+
* @param node
|
|
106
|
+
* @param predicate
|
|
107
|
+
* @returns
|
|
82
108
|
*/
|
|
83
109
|
export function countNodesOfType(node, predicate) {
|
|
84
110
|
let count = 0;
|
|
@@ -90,6 +116,9 @@ export function countNodesOfType(node, predicate) {
|
|
|
90
116
|
}
|
|
91
117
|
/**
|
|
92
118
|
* Find all nodes of a specific type
|
|
119
|
+
* @param node
|
|
120
|
+
* @param predicate
|
|
121
|
+
* @returns
|
|
93
122
|
*/
|
|
94
123
|
export function findNodesOfType(node, predicate) {
|
|
95
124
|
const nodes = [];
|
|
@@ -101,12 +130,17 @@ export function findNodesOfType(node, predicate) {
|
|
|
101
130
|
}
|
|
102
131
|
/**
|
|
103
132
|
* Traverse AST with a visitor function
|
|
133
|
+
* @param node
|
|
134
|
+
* @param visitor
|
|
104
135
|
*/
|
|
105
136
|
export function traverseAST(node, visitor) {
|
|
106
137
|
walkAST(node, visitor);
|
|
107
138
|
}
|
|
108
139
|
/**
|
|
109
140
|
* Filter violations by severity
|
|
141
|
+
* @param minSeverity
|
|
142
|
+
* @param violations
|
|
143
|
+
* @returns
|
|
110
144
|
*/
|
|
111
145
|
export function filterViolationsBySeverity(violations, minSeverity) {
|
|
112
146
|
if (!minSeverity) {
|
|
@@ -118,6 +152,8 @@ export function filterViolationsBySeverity(violations, minSeverity) {
|
|
|
118
152
|
}
|
|
119
153
|
/**
|
|
120
154
|
* Sort violations by severity, file, and line
|
|
155
|
+
* @param violations
|
|
156
|
+
* @returns
|
|
121
157
|
*/
|
|
122
158
|
export function sortViolations(violations) {
|
|
123
159
|
return violations.sort((a, b) => {
|
|
@@ -142,11 +178,14 @@ export function calculateComplexity(node) {
|
|
|
142
178
|
}
|
|
143
179
|
/**
|
|
144
180
|
* Create a standard analyzer function
|
|
181
|
+
* @param defaultConfig
|
|
182
|
+
* @param fileAnalyzer
|
|
183
|
+
* @param name
|
|
145
184
|
*/
|
|
146
185
|
export function createAnalyzer(name, fileAnalyzer, defaultConfig = {}) {
|
|
147
186
|
return async (files, config, options) => {
|
|
148
187
|
const mergedConfig = { ...defaultConfig, ...config };
|
|
149
|
-
const result = await processFiles(files, fileAnalyzer, name, mergedConfig);
|
|
188
|
+
const result = await processFiles(files, fileAnalyzer, name, { config: mergedConfig });
|
|
150
189
|
// Apply filtering and sorting
|
|
151
190
|
result.violations = sortViolations(filterViolationsBySeverity(result.violations, options?.minSeverity));
|
|
152
191
|
return result;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyzerUtils.js","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,IAAI,iBAAiB,EAChC,mBAAmB,IAAI,yBAAyB,EAChD,gBAAgB,IAAI,sBAAsB,GAC3C,MAAM,+BAA+B,CAAC;AAEvC,yCAAyC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"analyzerUtils.js","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,IAAI,iBAAiB,EAChC,mBAAmB,IAAI,yBAAyB,EAChD,gBAAgB,IAAI,sBAAsB,GAC3C,MAAM,+BAA+B,CAAC;AAEvC,yCAAyC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAe,EACf,WAAiC,EACjC,YAAoB,EACpB,OAAO,GAAwB,EAAE;IAEjC,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,kBAAkB;QAClB,IAAI,gBAAgB,EAAE,CAAC;YACrB,gBAAgB,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,cAAc,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB;QAC7B,UAAU;QACV,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC;QACzC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACrC,YAAY;KACb,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,WAAiC,EACjC,MAAW;IAEX,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,qEAAqE;QACrE,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa;IAEb,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,SAAqC;IAErC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa,EACb,SAAqC;IAErC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAuB,EACvB,WAA2B;IAE3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEjD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC3B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB;IACpD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,yBAAyB;QACzB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACzE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAE5C,eAAe;QACf,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEpC,eAAe;QACf,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,YAAkC,EAClC,aAAa,GAAQ,EAAE;IAEvB,OAAO,KAAK,EAAE,KAAe,EAAE,MAA+B,EAAE,OAAkC,EAAE,EAAE;QACpG,MAAM,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvF,8BAA8B;QAC9B,MAAM,CAAC,UAAU,GAAG,cAAc,CAChC,0BAA0B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,WAAwC,CAAC,CACjG,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -38,21 +38,19 @@ export interface ContractViolation extends Violation {
|
|
|
38
38
|
missingFields?: string[];
|
|
39
39
|
extraFields?: string[];
|
|
40
40
|
}
|
|
41
|
+
/**
|
|
42
|
+
* Api contract analyzer.
|
|
43
|
+
*/
|
|
41
44
|
export declare class APIContractAnalyzer {
|
|
42
45
|
private endpoints;
|
|
43
46
|
private calls;
|
|
44
47
|
/**
|
|
45
48
|
* Analyze API contracts and find violations
|
|
49
|
+
* @param calls
|
|
50
|
+
* @param endpoints
|
|
51
|
+
* @returns
|
|
46
52
|
*/
|
|
47
53
|
analyzeContracts(endpoints: APIEndpoint[], calls: APICall[]): Promise<ContractViolation[]>;
|
|
48
|
-
/**
|
|
49
|
-
* Extract API endpoints from code entities
|
|
50
|
-
*/
|
|
51
|
-
static extractEndpoints(entities: any[]): APIEndpoint[];
|
|
52
|
-
/**
|
|
53
|
-
* Extract API calls from code entities
|
|
54
|
-
*/
|
|
55
|
-
static extractAPICalls(entities: any[]): APICall[];
|
|
56
54
|
/**
|
|
57
55
|
* Find API calls that don't have matching endpoints
|
|
58
56
|
*/
|
|
@@ -85,20 +83,17 @@ export declare class APIContractAnalyzer {
|
|
|
85
83
|
* Check if an API call includes authentication
|
|
86
84
|
*/
|
|
87
85
|
private callHasAuthentication;
|
|
88
|
-
private static extractGoEndpoint;
|
|
89
|
-
private static extractTypeScriptEndpoint;
|
|
90
|
-
private static extractPythonEndpoint;
|
|
91
|
-
private static extractTypeScriptAPICall;
|
|
92
|
-
private static extractGoAPICall;
|
|
93
|
-
private static extractMethodFromGo;
|
|
94
|
-
private static extractPathFromGo;
|
|
95
|
-
private static extractMethodFromTypeScript;
|
|
96
|
-
private static extractPathFromTypeScript;
|
|
97
|
-
private static extractMethodFromPython;
|
|
98
|
-
private static extractPathFromPython;
|
|
99
|
-
private static extractCallMethodFromTypeScript;
|
|
100
|
-
private static extractUrlFromTypeScript;
|
|
101
|
-
private static extractCallMethodFromGo;
|
|
102
|
-
private static extractUrlFromGo;
|
|
103
86
|
}
|
|
87
|
+
/**
|
|
88
|
+
* Extract API endpoints from code entities
|
|
89
|
+
* @param entities
|
|
90
|
+
* @returns
|
|
91
|
+
*/
|
|
92
|
+
export declare function extractEndpoints(entities: any[]): APIEndpoint[];
|
|
93
|
+
/**
|
|
94
|
+
* Extract API calls from code entities
|
|
95
|
+
* @param entities
|
|
96
|
+
* @returns
|
|
97
|
+
*/
|
|
98
|
+
export declare function extractAPICalls(entities: any[]): APICall[];
|
|
104
99
|
//# sourceMappingURL=APIContractAnalyzer.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"APIContractAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/cross-language/APIContractAnalyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,eAAe,CAAC;IAC/H,YAAY,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,eAAe,CAAC;IACvI,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,KAAK,CAAiB;IAE9B
|
|
1
|
+
{"version":3,"file":"APIContractAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/cross-language/APIContractAnalyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,eAAe,CAAC;IAC/H,YAAY,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,eAAe,CAAC;IACvI,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,KAAK,CAAiB;IAE9B;;;;;OAKG;IACG,gBAAgB,CACpB,SAAS,EAAE,WAAW,EAAE,EACxB,KAAK,EAAE,OAAO,EAAE,GACf,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAmB9B;IAED;;OAEG;YACW,kBAAkB;IA6BhC;;OAEG;YACW,oBAAoB;IA2ClC;;OAEG;YACW,oBAAoB;IA6BlC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,UAAU;IA6BlB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAkCjC;;OAEG;IACH,OAAO,CAAC,qBAAqB;CAM9B;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAwB/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAkB1D"}
|