codesift-mcp 0.3.0 → 0.5.0

package/dist/tools/php-tools.js

@@ -0,0 +1,645 @@
+/**
+ * PHP/Yii2-specific code intelligence tools.
+ *
+ * Provides 9 hidden/discoverable tools that augment generic code intelligence
+ * with PHP framework awareness: PSR-4 namespace resolution, ActiveRecord schema
+ * extraction, event/listener tracing, view mapping, service locator resolution,
+ * security scanning, compound project audit (9-gate), N+1 query detection,
+ * and god-model detection.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getCodeIndex } from "./index-tools.js";
+import { searchPatterns } from "./pattern-tools.js";
+export async function resolvePhpNamespace(repo, className) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const composer = await readJsonSafe(join(index.root, "composer.json"));
+    const psr4 = {
+        ...(composer?.autoload?.["psr-4"] ?? {}),
+        ...(composer?.["autoload-dev"]?.["psr-4"] ?? {}),
+    };
+    // Strip leading backslash
+    const normalized = className.replace(/^\\/, "");
+    const parts = normalized.split("\\");
+    const namespaceOnly = parts.slice(0, -1).join("\\");
+    const shortName = parts[parts.length - 1];
+    // Find matching PSR-4 prefix (longest match wins)
+    let bestPrefix = null;
+    let bestRoot = null;
+    for (const [prefix, roots] of Object.entries(psr4)) {
+        const normalizedPrefix = prefix.replace(/\\$/, "");
+        if (normalized.startsWith(normalizedPrefix + "\\") || normalized === normalizedPrefix) {
+            if (!bestPrefix || normalizedPrefix.length > bestPrefix.length) {
+                bestPrefix = normalizedPrefix;
+                bestRoot = Array.isArray(roots) ? roots[0] ?? null : roots;
+            }
+        }
+    }
+    if (!bestPrefix || !bestRoot) {
+        return {
+            class_name: shortName,
+            namespace: namespaceOnly,
+            file_path: null,
+            exists: false,
+            psr4_root: null,
+            psr4_prefix: null,
+        };
+    }
+    // Construct file path: strip prefix, replace \ with /, append .php
+    const remainder = normalized.slice(bestPrefix.length).replace(/^\\/, "");
+    const relativePath = remainder.replace(/\\/g, "/") + ".php";
+    const root = bestRoot.replace(/\/$/, "");
+    const filePath = root + "/" + relativePath;
+    // Check if file exists in index (strip leading ./ for comparison)
+    const normalizedFP = filePath.replace(/^\.\//, "");
+    const exists = index.files.some((f) => f.path === normalizedFP || f.path === filePath);
+    return {
+        class_name: shortName,
+        namespace: namespaceOnly,
+        file_path: filePath,
+        exists,
+        psr4_root: bestRoot,
+        psr4_prefix: bestPrefix,
+    };
+}
+export async function analyzeActiveRecord(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    // Find PHP class symbols in model files
+    const classSymbols = index.symbols.filter((s) => {
+        if (s.kind !== "class")
+            return false;
+        if (!s.file.endsWith(".php"))
+            return false;
+        if (options?.model_name && s.name !== options.model_name)
+            return false;
+        if (options?.file_pattern && !s.file.includes(options.file_pattern))
+            return false;
+        return true;
+    });
+    const models = [];
+    for (const cls of classSymbols) {
+        // Heuristic: only models that have source containing ActiveRecord or extend Model
+        if (!cls.source)
+            continue;
+        const extendsAR = /extends\s+(?:ActiveRecord|Model|\\yii\\db\\ActiveRecord)/.test(cls.source);
+        if (!extendsAR)
+            continue;
+        const model = {
+            name: cls.name,
+            file: cls.file,
+            table_name: null,
+            relations: [],
+            rules: [],
+            behaviors: [],
+            methods: [],
+        };
+        // Extract tableName() return value
+        const tableMatch = /function\s+tableName\s*\([^)]*\)[^{]*\{[^}]*return\s+['"]([^'"]+)['"]/s.exec(cls.source);
+        if (tableMatch)
+            model.table_name = tableMatch[1];
+        // Find child method symbols
+        const methods = index.symbols.filter((s) => s.parent === cls.id && s.kind === "method");
+        model.methods = methods.map((m) => m.name);
+        // Extract relations from getX() methods that return hasOne/hasMany.
+        // Two-pass detection:
+        //   Pass 1: find the primary `->hasOne(Target::class, ...)` or
+        //           `->hasMany(Target::class, ...)` call.
+        //   Pass 2: scan the rest of the source for modifiers:
+        //             ->via('relation')         (Yii2 2.0.13+ junction table via relation)
+        //             ->viaTable('tbl', [...])  (direct junction table)
+        //             ->inverseOf('relation')   (bidirectional relation)
+        //           The presence of `via` or `viaTable` upgrades the relation type
+        //           to `manyMany`. `inverseOf` is decorative and doesn't change type.
+        for (const m of methods) {
+            if (!m.name.startsWith("get") || !m.source)
+                continue;
+            const relName = m.name.slice(3);
+            const primaryRe = /->(hasOne|hasMany)\s*\(\s*([\w\\]+)(?:::class)?/;
+            const primaryMatch = primaryRe.exec(m.source);
+            if (!primaryMatch)
+                continue;
+            const baseType = primaryMatch[1] === "hasOne" ? "hasOne" : "hasMany";
+            const targetClass = primaryMatch[2];
+            // Scan the method source for junction-table modifiers on the same chain.
+            // If found, the semantic type is manyMany even though the primary call was hasMany.
+            const hasJunction = /->(?:via|viaTable)\s*\(/.test(m.source);
+            const type = hasJunction ? "manyMany" : baseType;
+            model.relations.push({
+                name: relName.charAt(0).toLowerCase() + relName.slice(1),
+                type,
+                target_class: targetClass,
+            });
+        }
+        // Extract rule validators (loose regex on rules() method source)
+        const rulesMethod = methods.find((m) => m.name === "rules");
+        if (rulesMethod?.source) {
+            const ruleMatches = rulesMethod.source.matchAll(/\[\s*\[?['"]?[\w,\s'"]+['"]?\]?\s*,\s*['"]([\w]+)['"]/g);
+            for (const rm of ruleMatches) {
+                if (rm[1] && !model.rules.includes(rm[1]))
+                    model.rules.push(rm[1]);
+            }
+        }
+        // Extract behaviors from behaviors() method
+        const behaviorsMethod = methods.find((m) => m.name === "behaviors");
+        if (behaviorsMethod?.source) {
+            const bMatches = behaviorsMethod.source.matchAll(/([A-Z]\w+Behavior)(?:::class)?/g);
+            for (const bm of bMatches) {
+                if (bm[1] && !model.behaviors.includes(bm[1]))
+                    model.behaviors.push(bm[1]);
+            }
+        }
+        models.push(model);
+    }
+    return { models, total: models.length };
+}
+export async function tracePhpEvent(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const eventMap = new Map();
+    const getOrCreate = (name) => {
+        let e = eventMap.get(name);
+        if (!e) {
+            e = { event_name: name, triggers: [], listeners: [] };
+            eventMap.set(name, e);
+        }
+        return e;
+    };
+    // Scan PHP file symbols for event triggers and listeners
+    const phpSymbols = index.symbols.filter((s) => s.file.endsWith(".php") && s.source);
+    for (const sym of phpSymbols) {
+        const source = sym.source;
+        // Triggers: ->trigger('eventName') or Event::trigger(...)
+        const triggerRe = /->trigger\s*\(\s*['"]([^'"]+)['"]/g;
+        let match;
+        while ((match = triggerRe.exec(source)) !== null) {
+            const eventName = match[1];
+            if (options?.event_name && eventName !== options.event_name)
+                continue;
+            const line = sym.start_line + (source.slice(0, match.index).match(/\n/g)?.length ?? 0);
+            getOrCreate(eventName).triggers.push({
+                file: sym.file,
+                line,
+                context: extractLineContext(source, match.index),
+            });
+        }
+        // Listeners: ->on('eventName', ...) or Event::on(...)
+        const listenerRe = /(?:->|::)on\s*\(\s*['"]([^'"]+)['"]/g;
+        while ((match = listenerRe.exec(source)) !== null) {
+            const eventName = match[1];
+            if (options?.event_name && eventName !== options.event_name)
+                continue;
+            const line = sym.start_line + (source.slice(0, match.index).match(/\n/g)?.length ?? 0);
+            getOrCreate(eventName).listeners.push({
+                file: sym.file,
+                line,
+                context: extractLineContext(source, match.index),
+            });
+        }
+    }
+    const events = [...eventMap.values()];
+    return { events, total: events.length };
+}
+export async function findPhpViews(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const mappings = [];
+    // Find action methods in controllers
+    const controllers = index.symbols.filter((s) => s.kind === "class" && s.name.endsWith("Controller") && s.file.endsWith(".php"));
+    for (const ctrl of controllers) {
+        if (options?.controller && !ctrl.name.includes(options.controller))
+            continue;
+        const actions = index.symbols.filter((s) => s.parent === ctrl.id && s.kind === "method" && s.name.startsWith("action"));
+        for (const action of actions) {
+            if (!action.source)
+                continue;
+            // Match $this->render('viewName'), renderPartial('...'), renderAjax('...')
+            const renderRe = /\$this->render(?:Partial|Ajax|AsJson)?\s*\(\s*['"]([^'"]+)['"]/g;
+            let match;
+            while ((match = renderRe.exec(action.source)) !== null) {
+                const viewName = match[1];
+                // Yii2 convention: views/{controller-id}/{view}.php
+                const controllerId = pascalToKebab(ctrl.name.replace(/Controller$/, ""));
+                const viewFile = `views/${controllerId}/${viewName}.php`;
+                const exists = index.files.some((f) => f.path === viewFile || f.path.endsWith("/" + viewFile));
+                const line = action.start_line + (action.source.slice(0, match.index).match(/\n/g)?.length ?? 0);
+                mappings.push({
+                    controller: ctrl.name,
+                    action: action.name,
+                    view_name: viewName,
+                    view_file: exists ? viewFile : null,
+                    render_line: line,
+                });
+            }
+        }
+    }
+    return { mappings, total: mappings.length };
+}
+export async function resolvePhpService(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const services = [];
+    const configFiles = index.files.filter((f) => /config\/(web|console|main|db)\.php$/.test(f.path));
+    for (const cf of configFiles) {
+        let source;
+        try {
+            source = await readFile(join(index.root, cf.path), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        // Match component definitions: 'componentName' => ['class' => 'FQCN', ...]
+        const componentRe = /['"]([\w-]+)['"]\s*=>\s*\[\s*['"]class['"]\s*=>\s*['"]([\w\\]+)['"]/g;
+        let match;
+        while ((match = componentRe.exec(source)) !== null) {
+            const name = match[1];
+            const cls = match[2];
+            if (options?.service_name && name !== options.service_name)
+                continue;
+            // Resolve class to file via PSR-4
+            let filePath = null;
+            try {
+                const resolved = await resolvePhpNamespace(repo, cls);
+                if (resolved.exists)
+                    filePath = resolved.file_path;
+            }
+            catch { /* ignore */ }
+            services.push({
+                name,
+                class: cls,
+                file: filePath,
+                config_file: cf.path,
+            });
+        }
+    }
+    return { services, total: services.length };
+}
+const PHP_SECURITY_CHECKS = [
+    { pattern: "sql-injection-php", severity: "critical" },
+    { pattern: "xss-php", severity: "critical" },
+    { pattern: "eval-php", severity: "critical" },
+    { pattern: "exec-php", severity: "critical" },
+    { pattern: "unserialize-php", severity: "high" },
+    { pattern: "file-include-var", severity: "high" },
+    { pattern: "unescaped-yii-view", severity: "high" },
+    { pattern: "raw-query-yii", severity: "high" },
+];
+export async function phpSecurityScan(repo, options) {
+    const selectedChecks = options?.checks
+        ? PHP_SECURITY_CHECKS.filter((c) => options.checks.includes(c.pattern))
+        : PHP_SECURITY_CHECKS;
+    const findings = [];
+    const summary = { critical: 0, high: 0, medium: 0, low: 0, total: 0 };
+    // Run pattern checks in parallel
+    const results = await Promise.all(selectedChecks.map((check) => searchPatterns(repo, check.pattern, {
+        file_pattern: options?.file_pattern ?? ".php",
+        include_tests: false,
+    }).then((r) => ({ check, result: r })).catch(() => null)));
+    for (const res of results) {
+        if (!res)
+            continue;
+        for (const m of res.result.matches) {
+            findings.push({
+                severity: res.check.severity,
+                pattern: res.check.pattern,
+                file: m.file,
+                line: m.start_line,
+                context: m.context,
+                description: "", // description populated by searchPatterns but not in PatternMatch type
+            });
+            summary[res.check.severity]++;
+            summary.total++;
+        }
+    }
+    return {
+        findings,
+        summary,
+        checks_run: selectedChecks.map((c) => c.pattern),
+    };
+}
+// ---------------------------------------------------------------------------
+// 7h. find_php_n_plus_one — detect foreach + relation access without ->with()
+// ---------------------------------------------------------------------------
+/**
+ * Common ActiveRecord scalar field names. Property access like $user->id or
+ * $user->created_at inside a foreach is NOT a relation (no N+1 risk), so we
+ * allow-list these to cut false positives.
+ */
+const SCALAR_FIELD_NAMES = new Set([
+    "id", "name", "title", "created_at", "updated_at", "deleted_at", "status",
+    "email", "slug", "code", "type", "value", "label", "description", "enabled",
+    "active", "position", "sort", "order", "count", "total", "amount", "price",
+    "uuid", "hash", "token", "key", "url", "path", "image", "avatar",
+]);
+/**
+ * PHP method names that look like `get*` but are NOT ActiveRecord relation
+ * getters. `$item->save()` / `$item->validate()` inside a foreach is fine;
+ * flagging them as N+1 would be a false positive. These names are stripped
+ * from the `get\w+()` method-call detection before the eager-load check.
+ */
+const METHOD_CALL_BLOCKLIST = new Set([
+    "save", "validate", "delete", "refresh", "load", "populate", "toArray",
+    "afterSave", "beforeSave", "beforeDelete", "afterDelete",
+    "getAttributes", "getAttribute", "getIsNewRecord", "getErrors", "getFirstError",
+    "getOldAttributes", "getDirtyAttributes", "getPrimaryKey", "getTableSchema",
+]);
+/**
+ * Detect N+1 query patterns in Yii2/Eloquent controllers.
+ *
+ * Pattern: `foreach ($items as $item) { $item->relation->... }` without a
+ * prior `->with('relation')` call in the same method scope. This is the
+ * most common N+1 anti-pattern in Yii2 ActiveRecord code.
+ *
+ * Known limitations (acceptable for a "discovery" tool, not a gate):
+ * - Regex-based — can miss multi-line foreach bodies split across nested blocks
+ * - Doesn't cross function boundaries — eager loading in caller is invisible
+ * - False positives on nested loops if the outer collection is already eager-loaded
+ */
+export async function findPhpNPlusOne(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const findings = [];
+    const limit = options?.limit ?? 100;
+    const filePattern = options?.file_pattern;
+    // Normalize `getProfile` → `profile` so the ->with() check matches whether
+    // the relation is accessed as a property or via its auto-generated getter.
+    const normalizeGetter = (name) => {
+        const bare = name.replace(/^get/, "");
+        return bare.length > 0 ? bare.charAt(0).toLowerCase() + bare.slice(1) : "";
+    };
+    // A finding is emitted exactly once per (foreach × relation-name) tuple so
+    // that chained patterns don't double-report the same relation that the
+    // property pattern already caught in the same loop body.
+    const emitFinding = (sym, foreachIdx, relation, pattern, seen) => {
+        if (!relation || seen.has(relation))
+            return findings.length >= limit;
+        seen.add(relation);
+        if (SCALAR_FIELD_NAMES.has(relation.toLowerCase()))
+            return findings.length >= limit;
+        const beforeForeach = sym.source.slice(0, foreachIdx);
+        const withRe = new RegExp(`\\bwith\\s*\\(\\s*['"]${relation}['"]`);
+        if (withRe.test(beforeForeach))
+            return findings.length >= limit;
+        const lineOffset = beforeForeach.split("\n").length - 1;
+        findings.push({
+            file: sym.file,
+            method: sym.name,
+            line: sym.start_line + lineOffset,
+            relation,
+            pattern,
+        });
+        return findings.length >= limit;
+    };
+    for (const sym of index.symbols) {
+        if (sym.kind !== "method" || !sym.file.endsWith(".php") || !sym.source)
+            continue;
+        if (filePattern && !sym.file.includes(filePattern))
+            continue;
+        const src = sym.source;
+        const foreachRe = /foreach\s*\(\s*\$(\w+)\s+as\s+(?:\$\w+\s*=>\s*)?\$(\w+)\s*\)/g;
+        let fm;
+        while ((fm = foreachRe.exec(src)) !== null) {
+            const itemVar = fm[2];
+            const foreachIdx = fm.index;
+            const after = src.slice(foreachIdx);
+            // Guard against double-counting: each distinct relation name reported
+            // once per foreach, regardless of which pattern matched first.
+            const seen = new Set();
+            // Pattern 1 — property access: $item->profile
+            // The negative lookahead `(?![\w(])` blocks both:
+            //   1) following word chars (prevents backtracking to a partial capture
+            //      like `$item->getProfile()` matching "getProfil" as a property);
+            //   2) an opening paren (excludes method calls, handled by pattern 2).
+            const propRe = new RegExp(`\\$${itemVar}->(\\w+)(?![\\w(])`, "g");
+            let m;
+            while ((m = propRe.exec(after)) !== null) {
+                if (emitFinding({ file: sym.file, name: sym.name, source: src, start_line: sym.start_line }, foreachIdx, m[1], "foreach-access-without-with", seen)) {
+                    return { findings, total: findings.length };
+                }
+            }
+            // Pattern 2 — getter method call: $item->getProfile()
+            // Normalize to bare relation name for both the dedup and the ->with() check.
+            const getterRe = new RegExp(`\\$${itemVar}->(get\\w+)\\s*\\(\\s*\\)`, "g");
+            while ((m = getterRe.exec(after)) !== null) {
+                const rawMethod = m[1];
+                if (METHOD_CALL_BLOCKLIST.has(rawMethod))
+                    continue;
+                const normalized = normalizeGetter(rawMethod);
+                if (!normalized || METHOD_CALL_BLOCKLIST.has(normalized.toLowerCase()))
+                    continue;
+                if (emitFinding({ file: sym.file, name: sym.name, source: src, start_line: sym.start_line }, foreachIdx, normalized, "foreach-getter-without-with", seen)) {
+                    return { findings, total: findings.length };
+                }
+            }
+            // Pattern 3 — chained access: $item->rel->sub (the first segment is the trigger)
+            const chainRe = new RegExp(`\\$${itemVar}->(\\w+)->\\w`, "g");
+            while ((m = chainRe.exec(after)) !== null) {
+                if (emitFinding({ file: sym.file, name: sym.name, source: src, start_line: sym.start_line }, foreachIdx, m[1], "foreach-chained-without-with", seen)) {
+                    return { findings, total: findings.length };
+                }
+            }
+        }
+    }
+    return { findings, total: findings.length };
+}
+/**
+ * Flag oversized PHP classes. Two scopes:
+ *
+ * - `scope: "activerecord"` (default) — only models extending ActiveRecord.
+ *   Uses `analyzeActiveRecord` for model detection and counts relations as a
+ *   third threshold alongside methods and lines. Classic Yii2 god-model case:
+ *   Survey.php in Mobi2 with 175 methods, 30 relations, 2291 lines.
+ *
+ * - `scope: "all"` — every PHP class in the index, regardless of base class.
+ *   Captures service god-classes (UserService with 80 methods), component
+ *   aggregates, and any other PHP class that outgrew its responsibility.
+ *   `relation_count` is 0 for non-AR classes — the `min_relations` check is
+ *   skipped so a service with 60 methods isn't hidden by a relation threshold.
+ *
+ * Thresholds default to 50/15/500 but are configurable for both scopes.
+ */
+export async function findPhpGodModel(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const minM = options?.min_methods ?? 50;
+    const minR = options?.min_relations ?? 15;
+    const minL = options?.min_lines ?? 500;
+    const scope = options?.scope ?? "activerecord";
+    const models = [];
+    if (scope === "activerecord") {
+        const ar = await analyzeActiveRecord(repo);
+        for (const m of ar.models) {
+            // Look up the class symbol by (name, kind, file) — file match keeps
+            // duplicate class names in different paths reported independently.
+            const classSym = index.symbols.find((s) => s.name === m.name && s.kind === "class" && s.file === m.file);
+            const lineCount = classSym ? classSym.end_line - classSym.start_line : 0;
+            const reasons = [];
+            if (m.methods.length > minM)
+                reasons.push(`methods: ${m.methods.length} > ${minM}`);
+            if (m.relations.length > minR)
+                reasons.push(`relations: ${m.relations.length} > ${minR}`);
+            if (lineCount > minL)
+                reasons.push(`lines: ${lineCount} > ${minL}`);
+            if (reasons.length > 0) {
+                models.push({
+                    name: m.name,
+                    file: m.file,
+                    method_count: m.methods.length,
+                    relation_count: m.relations.length,
+                    line_count: lineCount,
+                    reasons,
+                });
+            }
+        }
+    }
+    else {
+        // scope === "all" — iterate every PHP class symbol directly.
+        const classSyms = index.symbols.filter((s) => s.kind === "class" && s.file.endsWith(".php"));
+        for (const cls of classSyms) {
+            const methodCount = index.symbols.filter((s) => s.parent === cls.id && s.kind === "method").length;
+            const lineCount = cls.end_line - cls.start_line;
+            const reasons = [];
+            if (methodCount > minM)
+                reasons.push(`methods: ${methodCount} > ${minM}`);
+            if (lineCount > minL)
+                reasons.push(`lines: ${lineCount} > ${minL}`);
+            // min_relations intentionally skipped in "all" scope — not AR, no relations
+            if (reasons.length > 0) {
+                models.push({
+                    name: cls.name,
+                    file: cls.file,
+                    method_count: methodCount,
+                    relation_count: 0,
+                    line_count: lineCount,
+                    reasons,
+                });
+            }
+        }
+    }
+    // Sort by severity (number of reasons desc, then methods desc)
+    models.sort((a, b) => b.reasons.length - a.reasons.length || b.method_count - a.method_count);
+    return { models, total: models.length };
+}
+const AUDIT_TIMEOUT = 8000;
+export async function phpProjectAudit(repo, options) {
+    const startTime = Date.now();
+    const gates = [];
+    const allChecks = ["security", "activerecord", "complexity", "dead_code", "patterns", "clones", "hotspots", "n_plus_one", "god_model"];
+    const enabled = new Set(options?.checks ?? allChecks);
+    const fp = options?.file_pattern ?? ".php";
+    const secOpts = {};
+    if (options?.file_pattern)
+        secOpts.file_pattern = options.file_pattern;
+    const tasks = [];
+    if (enabled.has("security"))
+        tasks.push({ name: "security", run: () => phpSecurityScan(repo, secOpts) });
+    if (enabled.has("activerecord"))
+        tasks.push({ name: "activerecord", run: () => analyzeActiveRecord(repo, options?.file_pattern ? { file_pattern: options.file_pattern } : undefined) });
+    if (enabled.has("complexity"))
+        tasks.push({ name: "complexity", run: async () => { const { analyzeComplexity } = await import("./complexity-tools.js"); return analyzeComplexity(repo, { file_pattern: fp, top_n: 10 }); } });
+    if (enabled.has("dead_code"))
+        tasks.push({ name: "dead_code", run: async () => { const { findDeadCode } = await import("./symbol-tools.js"); return findDeadCode(repo, { file_pattern: fp }); } });
+    if (enabled.has("patterns"))
+        tasks.push({ name: "patterns", run: () => searchPatterns(repo, "empty-catch", { file_pattern: fp }) });
+    if (enabled.has("clones"))
+        tasks.push({ name: "clones", run: async () => { const { findClones } = await import("./clone-tools.js"); return findClones(repo, { file_pattern: fp }); } });
+    if (enabled.has("hotspots"))
+        tasks.push({ name: "hotspots", run: async () => { const { analyzeHotspots } = await import("./hotspot-tools.js"); return analyzeHotspots(repo, {}); } });
+    if (enabled.has("n_plus_one"))
+        tasks.push({ name: "n_plus_one", run: () => findPhpNPlusOne(repo, options?.file_pattern ? { file_pattern: options.file_pattern } : undefined) });
+    if (enabled.has("god_model"))
+        tasks.push({ name: "god_model", run: () => findPhpGodModel(repo) });
+    const settled = await Promise.allSettled(tasks.map(async (t) => {
+        const s = Date.now();
+        const r = await Promise.race([t.run(), new Promise((ok) => setTimeout(() => ok("TIMEOUT"), AUDIT_TIMEOUT))]);
+        return { name: t.name, result: r, ms: Date.now() - s };
+    }));
+    let securityResult = { findings: [], summary: { critical: 0, high: 0, medium: 0, low: 0, total: 0 }, checks_run: [] };
+    let arResult = { models: [], total: 0 };
+    let totalFindings = 0;
+    for (const s of settled) {
+        if (s.status === "rejected") {
+            gates.push({ name: "unknown", status: "error", findings_count: 0, duration_ms: 0, error: String(s.reason) });
+            continue;
+        }
+        const { name, result, ms } = s.value;
+        if (result === "TIMEOUT") {
+            gates.push({ name, status: "timeout", findings_count: 0, duration_ms: ms });
+            continue;
+        }
+        let count = 0;
+        // activerecord is informational (model count), not a problem finding — excluded from totalFindings and health score
+        if (name === "security") {
+            securityResult = result;
+            count = securityResult.summary.total;
+        }
+        else if (name === "activerecord") {
+            arResult = result;
+            count = arResult.total;
+        }
+        else if (name === "complexity")
+            count = result?.summary?.above_threshold ?? 0;
+        else if (name === "dead_code")
+            count = result?.candidates?.length ?? 0;
+        else if (name === "patterns")
+            count = result?.matches?.length ?? 0;
+        else if (name === "clones")
+            count = result?.clones?.length ?? 0;
+        else if (name === "hotspots")
+            count = result?.hotspots?.length ?? 0;
+        else if (name === "n_plus_one")
+            count = result?.findings?.length ?? 0;
+        else if (name === "god_model")
+            count = result?.models?.length ?? 0;
+        if (name !== "activerecord")
+            totalFindings += count;
+        gates.push({ name, status: "ok", findings_count: count, duration_ms: ms });
+    }
+    const sec = securityResult.summary;
+    // Logarithmic penalties — a few critical findings are serious, but hundreds of
+    // complexity warnings shouldn't tank the score to 0. Each gate uses log2 scaling
+    // so 1 finding ≈ 0, 10 ≈ 17, 100 ≈ 33, 1000 ≈ 50 penalty points.
+    const secPenalty = sec.total > 0 ? Math.round(Math.log2(sec.total + 1) * (sec.critical > 0 ? 8 : 4)) : 0;
+    const qualityFindings = totalFindings - sec.total;
+    const qualPenalty = qualityFindings > 0 ? Math.round(Math.log2(qualityFindings + 1) * 4) : 0;
+    const healthScore = Math.max(0, Math.min(100, 100 - secPenalty - qualPenalty));
+    const topRisks = gates.filter(g => g.findings_count > 0 && g.name !== "activerecord").sort((a, b) => b.findings_count - a.findings_count).slice(0, 3).map(g => `${g.name}: ${g.findings_count} findings`);
+    return {
+        repo, duration_ms: Date.now() - startTime,
+        checks_run: gates.filter(g => g.status === "ok").map(g => g.name),
+        gates,
+        summary: { total_findings: totalFindings, critical: sec.critical, high: sec.high, medium: sec.medium, low: sec.low, health_score: healthScore, top_risks: topRisks },
+        security: securityResult,
+        activerecord: arResult,
+    };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+async function readJsonSafe(path) {
+    try {
+        const content = await readFile(path, "utf-8");
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+function extractLineContext(source, index) {
+    const lineStart = source.lastIndexOf("\n", index) + 1;
+    const lineEnd = source.indexOf("\n", index);
+    const end = lineEnd === -1 ? source.length : lineEnd;
+    return source.slice(lineStart, end).trim().slice(0, 200);
+}
+function pascalToKebab(s) {
+    return s.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+//# sourceMappingURL=php-tools.js.map