codesift-mcp 0.9.0 → 0.9.10

package/dist/tools/patterns/adapters/php.js

@@ -0,0 +1,157 @@
+export const PHP_PATTERNS = {
+    "sql-injection-php": {
+        regex: /\$_(?:GET|POST|REQUEST)\[[^\]]+\][\s\S]{0,200}?(?:->query\(|->execute\(|createCommand\()/,
+        description: "User input from $_GET/$_POST flowing into SQL query without sanitization (PHP)",
+    },
+    "xss-php": {
+        regex: /echo\s+\$_(?:GET|POST|REQUEST)\[|print\s+\$_(?:GET|POST|REQUEST)\[/,
+        description: "Unescaped user input echoed to output — XSS risk (PHP). Use htmlspecialchars()",
+    },
+    "eval-php": {
+        regex: /\beval\s*\(/,
+        description: "eval() usage — code injection risk (PHP)",
+    },
+    "exec-php": {
+        regex: /\b(?:exec|system|passthru|shell_exec|popen|proc_open)\s*\(/,
+        description: "Shell command execution — command injection risk (PHP)",
+    },
+    "unserialize-php": {
+        regex: /\bunserialize\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE)/,
+        description: "unserialize() on user input — deserialization attack risk (PHP)",
+    },
+    "file-include-var": {
+        regex: /(?:require|include)(?:_once)?\s*\(?\s*\$(?!this)/,
+        description: "require/include with variable — file inclusion risk (PHP)",
+    },
+    "unescaped-yii-view": {
+        regex: /<\?=\s*\$(?!this->(?:render|beginBlock|endBlock))(?!.*?Html::encode)/,
+        description: "Yii2 view outputs variable without Html::encode() — XSS risk",
+    },
+    "raw-query-yii": {
+        regex: /createCommand\s*\(\s*["'][^"']*\$\{?\w+/,
+        description: "Yii2 createCommand with string interpolation — SQL injection risk",
+    },
+    // --- Yii2 / PHP additional security & quality patterns (Sprint 2) ---
+    "yii-csrf-disabled": {
+        // Property assignment OR rule override that disables CSRF on a controller.
+        // Common false positive: test-only configs intentionally disable CSRF.
+        // We exclude config/test*.php at the search-pattern level via fileIncludePattern.
+        regex: /\benableCsrfValidation\s*=\s*false\b/,
+        description: "CSRF validation explicitly disabled on a controller — accepts forged requests for state-changing actions (Yii2)",
+        fileIncludePattern: /\.php$/,
+    },
+    "yii-debug-mode-prod": {
+        // Hard-coded `define('YII_DEBUG', true)` in web/index.php is a deploy
+        // disaster — full stack traces leak into production HTTP responses.
+        // The pattern intentionally matches both `define()` and `defined() and`
+        // forms, since both are legal Yii2 entry-point styles.
+        regex: /\b(?:define|defined)\s*\(\s*['"]YII_DEBUG['"][^)]*(?:,\s*true|\)\s*(?:and|&&)\s*YII_DEBUG\s*===?\s*true)/,
+        description: "YII_DEBUG enabled — leaks full stack traces, file paths, and variable contents in HTTP responses (Yii2)",
+    },
+    "yii-cookie-no-validation": {
+        // Empty / placeholder cookie validation key disables HMAC integrity on
+        // signed cookies. Matches blank string or obvious placeholder values.
+        regex: /['"]cookieValidationKey['"]\s*=>\s*['"](?:|change[-_]?me|TODO|xxx+|FIXME|placeholder|insert[-_]?key)['"]/i,
+        description: "cookieValidationKey is empty or placeholder — signed cookies have no HMAC integrity check (Yii2)",
+    },
+    "yii-mass-assignment-unsafe": {
+        // ->setAttributes($_POST) / ->setAttributes($request->post()) — usually
+        // unsafe unless paired with safeAttributes()/scenarios(). We can't tell
+        // statically that the class has scenarios(); flag as MEDIUM and let the
+        // reviewer make the call.
+        regex: /->setAttributes\s*\(\s*(?:\$_(?:POST|GET|REQUEST)\b|Yii::\$app->request->(?:post|get)\(\s*\))/,
+        description: "setAttributes() called with raw user input — bypasses scenarios() guards if not paired with safeAttributes (Yii2)",
+    },
+    "yii-raw-sql-where": {
+        // ActiveQuery->where("col = $var") — string interpolation in WHERE.
+        // Matches both single and double quotes. Yii2 supports param-binding
+        // via array form `['=', 'col', $var]` which is the safe alternative.
+        regex: /->where\s*\(\s*["'][^"']*\$\{?[a-zA-Z_]/,
+        description: "ActiveQuery->where() with string concatenation — bypasses Yii2 parameter binding (Yii2 SQL injection risk)",
+    },
+    "php-md5-password": {
+        // md5/sha1 applied to anything that smells like a password/secret.
+        // High false-positive risk on legitimate hash use; severity HIGH because
+        // when it IS a password hash it's a CVE-class bug.
+        regex: /\b(?:md5|sha1)\s*\(\s*\$(?:password|hasl|haslo|pwd|pass|secret|token|hash)\b/i,
+        description: "md5() or sha1() used on password/secret — both are broken for password hashing. Use password_hash() / Yii::\\$app->security->generatePasswordHash() (PHP)",
+    },
+    "php-rand-token": {
+        // rand() / mt_rand() / uniqid() on a variable named like a token/secret.
+        regex: /\$(?:token|nonce|csrf|secret|api[_-]?key|reset[_-]?key)\s*=\s*(?:rand|mt_rand|uniqid)\s*\(/i,
+        description: "rand()/mt_rand()/uniqid() used to generate token/secret — not cryptographically secure. Use random_bytes() / Yii::\\$app->security->generateRandomString() (PHP)",
+    },
+    "php-loose-comparison-secret": {
+        // == on hash/token comparison — timing attack. Very narrow regex;
+        // requires explicit variable naming.
+        regex: /\b(?:==|!=)\s*\$(?:hash|token|signature|hmac|expected[_-]?hash|secret)\b|\$(?:hash|token|signature|hmac)\s*(?:==|!=)\s*[\$"']/i,
+        description: "Loose comparison on secret/hash/token — timing-attack vulnerable. Use hash_equals() (PHP)",
+    },
+    "yii-rbac-cached-permission": {
+        // ->can() inside a foreach loop — DbManager hits the DB per call site,
+        // O(n) DB roundtrips on a list view. Match foreach + ->can within a
+        // bounded window so we don't false-flag unrelated calls in long files.
+        regex: /\bforeach\s*\([^{]*\{[\s\S]{0,800}?->can\s*\(/,
+        description: "->can() called inside foreach — Yii2 DbManager hits the DB per call. Cache permissions or use checkAccess() once outside the loop (Yii2)",
+    },
+    "yii-no-row-level-locking": {
+        // beginTransaction in the same function as findOne/find()->one()
+        // without ->forUpdate() — concurrency bug in incentive/payment flows.
+        // Bounded window prevents false positives on long methods that legitimately
+        // separate the transaction from the read.
+        regex: /->beginTransaction\s*\(\s*\)[\s\S]{0,1500}?(?:::findOne\s*\(|->one\s*\(\s*\))(?![\s\S]{0,200}->forUpdate\b)/,
+        description: "Transaction reads a row without SELECT FOR UPDATE — concurrent writers can race and produce duplicate state mutations (Yii2)",
+    },
+    "yii-config-hardcoded-secret": {
+        // Hardcoded literal in 'cookieValidationKey' / 'apiKey' / 'jwtSecret'.
+        // Hex/base64 strings of >=20 chars are strong signal. We allow common
+        // env() / getenv() lookups as escape hatch.
+        regex: /['"](?:cookieValidationKey|apiKey|jwtSecret|secretKey|app[_-]?secret|stripe[_-]?secret)['"]\s*=>\s*['"][A-Za-z0-9+\/_=-]{20,}['"]/,
+        description: "Hardcoded secret in config array — should come from env var or runtime/config-local.php that is gitignored (Yii2)",
+    },
+    "yii-unbounded-all": {
+        // Find()-builder ending in ->all() inside a console controller. We can't
+        // easily restrict via path in regex, so use file include pattern. The
+        // pattern matches any `find()...all()` chain that doesn't use ->limit().
+        regex: /::find\s*\([^)]*\)[\s\S]{0,400}?->all\s*\(\s*\)(?![\s\S]{0,100}->limit\b)/,
+        description: "ActiveQuery->all() without ->limit() — loads the entire result set into memory. Use ->batch()/->each() for cron/console flows (Yii2 perf)",
+        fileIncludePattern: /(?:commands|console)\/[^/]+Controller\.php$/,
+    },
+    // --- Sprint 7 perf patterns (sourced from tgm-panel performance-audit findings) ---
+    "yii-translate-in-loop": {
+        // Yii::t() inside a foreach. Costly when paired with DbMessageSource and
+        // no message cache (which IS the tgm-panel perf-audit P1 finding). 800-char
+        // window after the foreach captures typical loop bodies; nested loops
+        // matched separately by global /g.
+        regex: /\bforeach\s*\([^{]*\{[\s\S]{0,800}?\\?\bYii::t\s*\(/,
+        description: "Yii::t() inside foreach — expensive when DbMessageSource caching is off. Move translation outside the loop OR enable enableCaching on the message source (Yii2 perf)",
+    },
+    "yii-dbtarget-info-level": {
+        // DbTarget log target with 'levels' including info/trace/profile.
+        // Writes setting often left from local dev; writes to DB on every
+        // request hits hard at scale. Bounded window captures the array.
+        regex: /['"]class['"]\s*=>\s*['"][^'"]*DbTarget['"][\s\S]{0,400}?['"]levels['"]\s*=>\s*\[[^\]]*\b(?:info|trace|profile)\b/,
+        description: "DbTarget logging info/trace/profile to DB on every request — moves the logger off the hot path (Yii2 perf)",
+    },
+    "yii-find-with-large-then-filter": {
+        // ->find()->all() followed by `array_filter` / `array_map` on the result —
+        // pull-then-filter pattern that should be ->where()->all() instead.
+        regex: /->find\s*\([^)]*\)[\s\S]{0,200}?->all\s*\(\s*\)\s*;\s*[^\n]{0,200}?\barray_(?:filter|map)\s*\(/,
+        description: "ActiveQuery->all() into array_filter/array_map — push the filter into the WHERE clause to reduce I/O (Yii2 perf)",
+    },
+    "yii-cache-no-ttl": {
+        // Yii::$app->cache->set('key', $value)  — no TTL argument means cache
+        // entry persists indefinitely. Often the deliberate choice, but on
+        // user-keyed caches it's a memory bomb.
+        regex: /\\?\bYii::\$app->cache->set\s*\(\s*[^,]+,\s*[^,)]+\)/,
+        description: "cache->set without TTL — entry persists indefinitely. Add a third TTL argument unless caching a global config value (Yii2 perf)",
+    },
+    "yii-no-batch-on-large": {
+        // Same as yii-unbounded-all but applies to non-controller files (services,
+        // jobs/, components/). Together they cover 95% of unbounded reads.
+        regex: /::find\s*\([^)]*\)[\s\S]{0,400}?->all\s*\(\s*\)(?![\s\S]{0,100}->(?:limit|batch|each)\b)/,
+        description: "find()->all() in service/job code without ->limit() / ->batch() / ->each() — risk of OOM on growing tables (Yii2 perf)",
+        fileIncludePattern: /(?:components|services|jobs|workers|tasks)\/[^/]+\.php$/,
+    },
+};
+//# sourceMappingURL=php.js.map

package/dist/tools/patterns/adapters/php.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.js","sourceRoot":"","sources":["../../../../src/tools/patterns/adapters/php.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAA6C;IACpE,mBAAmB,EAAE;QACnB,KAAK,EAAE,0FAA0F;QACjG,WAAW,EAAE,gFAAgF;KAC9F;IACD,SAAS,EAAE;QACT,KAAK,EAAE,oEAAoE;QAC3E,WAAW,EAAE,gFAAgF;KAC9F;IACD,UAAU,EAAE;QACV,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,0CAA0C;KACxD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,4DAA4D;QACnE,WAAW,EAAE,wDAAwD;KACtE;IACD,iBAAiB,EAAE;QACjB,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,iEAAiE;KAC/E;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,kDAAkD;QACzD,WAAW,EAAE,2DAA2D;KACzE;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,sEAAsE;QAC7E,WAAW,EAAE,8DAA8D;KAC5E;IACD,eAAe,EAAE;QACf,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE,mEAAmE;KACjF;IACD,uEAAuE;IACvE,mBAAmB,EAAE;QACnB,2EAA2E;QAC3E,uEAAuE;QACvE,kFAAkF;QAClF,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,iHAAiH;QACnH,kBAAkB,EAAE,QAAQ;KAC7B;IACD,qBAAqB,EAAE;QACrB,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,uDAAuD;QACvD,KAAK,EACH,0GAA0G;QAC5G,WAAW,EACT,yGAAyG;KAC5G;IACD,0BAA0B,EAAE;QAC1B,uEAAuE;QACvE,sEAAsE;QACtE,KAAK,EACH,2GAA2G;QAC7G,WAAW,EACT,kGAAkG;KACrG;IACD,4BAA4B,EAAE;QAC5B,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,0BAA0B;QAC1B,KAAK,EACH,+FAA+F;QACjG,WAAW,EACT,mHAAmH;KACtH;IACD,mBAAmB,EAAE;QACnB,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,KAAK,EAAE,yCAAyC;QAChD,WAAW,EACT,4GAA4G;KAC/G;IACD,kBAAkB,EAAE;QAClB,mEAAmE;QACnE,yEAAyE;QACzE,mDAAmD;QACnD,KAAK,EACH,+EAA+E;QACjF,WAAW,EACT,2JAA2J;KAC9J;IACD,gBAAgB,EAAE;QAChB,yEAAyE;QACzE,KAAK,EACH,6FAA6F;QAC/F,WAAW,EACT,kKAAkK;KACrK;IACD,6BAA6B,EAAE;QAC7B,kEAAkE;QAClE,qCAAqC;QACrC,KAAK,EACH,gIAAgI;QAClI,WAAW,EACT,2FAA2F;KAC9F;IACD,4BAA4B,EAAE;QAC5B,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,KAAK,EAAE,+CAA+C;QACtD,WAAW,EACT,0IAA0I;KAC7I;IACD,0BAA0B,EAAE;QAC1B,iEAAiE;QACjE,sEAAsE;QACtE,4EAA4E;QAC5E,0CAA0C;QAC1C,KAAK,EACH,6GAA6G;QAC/G,WAAW,EACT,8HAA8H;KACjI;IACD,6BAA6B,EAAE;QAC7B,uEAAuE;QACvE,sEAAsE;QACtE,4CAA4C;QAC5C,KAAK,EACH,mIAAmI;QACrI,WAAW,EACT,mHAAmH;KACtH;IACD,mBAAmB,EAAE;QACnB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,KAAK,EAAE,2EAA2E;QAClF,WAAW,EACT,2IAA2I;QAC7I,kBAAkB,EAAE,6CAA6C;KAClE;IACD,qFAAqF;IACrF,uBAAuB,EAAE;QACvB,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,mCAAmC;QACnC,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EACT,sKAAsK;KACzK;IACD,yBAAyB,EAAE;QACzB,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,KAAK,EACH,mHAAmH;QACrH,WAAW,EACT,4GAA4G;KAC/G;IACD,iCAAiC,EAAE;QACjC,2EAA2E;QAC3E,oEAAoE;QACpE,KAAK,EAAE,gGAAgG;QACvG,WAAW,EACT,kHAAkH;KACrH;IACD,kBAAkB,EAAE;QAClB,sEAAsE;QACtE,mEAAmE;QACnE,wCAAwC;QACxC,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EACT,iIAAiI;KACpI;IACD,uBAAuB,EAAE;QACvB,2EAA2E;QAC3E,mEAAmE;QACnE,KAAK,EAAE,0FAA0F;QACjG,WAAW,EACT,wHAAwH;QAC1H,kBAAkB,EAAE,yDAAyD;KAC9E;CACF,CAAC"}

package/dist/tools/patterns/adapters/python.d.ts

@@ -0,0 +1,3 @@
+import type { BuiltinPatternDefinition } from "../types.js";
+export declare const PYTHON_PATTERNS: Record<string, BuiltinPatternDefinition>;
+//# sourceMappingURL=python.d.ts.map

package/dist/tools/patterns/adapters/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../../../src/tools/patterns/adapters/python.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAsEpE,CAAC"}

package/dist/tools/patterns/adapters/python.js

@@ -0,0 +1,72 @@
+export const PYTHON_PATTERNS = {
+    // --- Python anti-patterns ---
+    "mutable-default": {
+        regex: /def\s+\w+\s*\([^)]*=\s*(?:\[\s*\]|\{\s*\}|set\s*\(\s*\))/,
+        description: "Mutable default argument ([], {}, set()) — shared between calls (Python)",
+    },
+    "bare-except": {
+        regex: /except\s*:/,
+        description: "Bare except: catches everything including KeyboardInterrupt (Python)",
+    },
+    "broad-except": {
+        regex: /except\s+(?:Exception|BaseException)\s*:/,
+        description: "Broad exception catch — hides real errors (Python)",
+    },
+    "global-keyword": {
+        regex: /\bglobal\s+\w+/,
+        description: "global keyword — mutable global state makes code hard to test (Python)",
+    },
+    "star-import": {
+        regex: /from\s+\S+\s+import\s+\*/,
+        description: "Star import — pollutes namespace, breaks static analysis (Python)",
+    },
+    "print-debug-py": {
+        regex: /^\s*print\s*\(/m,
+        description: "print() in production code — use logging module (Python)",
+    },
+    "eval-exec": {
+        regex: /\b(?:eval|exec)\s*\(/,
+        description: "eval()/exec() — code injection risk (Python)",
+    },
+    "shell-true": {
+        regex: /subprocess\.\w+\s*\([^)]*shell\s*=\s*True/,
+        description: "subprocess with shell=True — command injection risk (Python)",
+    },
+    "pickle-load": {
+        regex: /pickle\.(?:load|loads)\s*\(/,
+        description: "pickle.load/loads — arbitrary code execution from untrusted data (Python)",
+    },
+    "yaml-unsafe": {
+        regex: /yaml\.load\s*\([^)]*\)(?![\s\S]{0,30}Loader)/,
+        description: "yaml.load without SafeLoader — arbitrary code execution risk (Python)",
+    },
+    "open-no-with": {
+        regex: /(?<!with\s{1,20})\bopen\s*\([^)]+\)\s*(?:\.\w+|;|$)/m,
+        description: "open() without with statement — resource leak if exception occurs (Python)",
+    },
+    "string-concat-loop": {
+        regex: /for\s+\w+\s+in\s+[\s\S]{0,200}?\+=\s*(?:['"]|f['"]|str\()/,
+        description: "String concatenation in loop — O(n^2), use join() or list append (Python)",
+    },
+    "datetime-naive": {
+        regex: /datetime\.(?:now|utcnow)\s*\(\s*\)/,
+        description: "datetime.now()/utcnow() without timezone — naive datetime causes bugs (Python)",
+    },
+    "shadow-builtin": {
+        regex: /^(?:list|dict|set|id|type|input|map|filter|range|str|int|float|bool|tuple|bytes|object|print|open|format|len|sum|min|max|any|all|zip|enumerate|sorted|reversed|next|iter|super|hash|dir|vars|globals|locals)\s*=/m,
+        description: "Assignment shadows Python builtin — breaks code that uses the builtin later (Python)",
+    },
+    "n-plus-one-django": {
+        regex: /for\s+\w+\s+in\s+[\s\S]{0,300}?\.\w+_set\b|\.\w+\.all\(\)/,
+        description: "Potential N+1 query — accessing related objects in loop without select_related/prefetch_related (Django)",
+    },
+    "late-binding": {
+        regex: /for\s+(\w+)\s+in\s+[\s\S]{0,200}?lambda\s*[^:]*:\s*\1\b/,
+        description: "Late binding closure in loop — all lambdas share last loop value (Python)",
+    },
+    "assert-tuple": {
+        regex: /\bassert\s*\(/,
+        description: "assert(expr) — always True because tuple is truthy. Use assert expr without parens (Python)",
+    },
+};
+//# sourceMappingURL=python.js.map

package/dist/tools/patterns/adapters/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../../src/tools/patterns/adapters/python.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,eAAe,GAA6C;IACvE,+BAA+B;IAC/B,iBAAiB,EAAE;QACjB,KAAK,EAAE,0DAA0D;QACjE,WAAW,EAAE,0EAA0E;KACxF;IACD,aAAa,EAAE;QACb,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,sEAAsE;KACpF;IACD,cAAc,EAAE;QACd,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,oDAAoD;KAClE;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,wEAAwE;KACtF;IACD,aAAa,EAAE;QACb,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,mEAAmE;KACjF;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,0DAA0D;KACxE;IACD,WAAW,EAAE;QACX,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,8CAA8C;KAC5D;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,2CAA2C;QAClD,WAAW,EAAE,8DAA8D;KAC5E;IACD,aAAa,EAAE;QACb,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,2EAA2E;KACzF;IACD,aAAa,EAAE;QACb,KAAK,EAAE,8CAA8C;QACrD,WAAW,EAAE,uEAAuE;KACrF;IACD,cAAc,EAAE;QACd,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EAAE,4EAA4E;KAC1F;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,2DAA2D;QAClE,WAAW,EAAE,2EAA2E;KACzF;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,gFAAgF;KAC9F;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,mNAAmN;QAC1N,WAAW,EAAE,sFAAsF;KACpG;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,2DAA2D;QAClE,WAAW,EAAE,0GAA0G;KACxH;IACD,cAAc,EAAE;QACd,KAAK,EAAE,yDAAyD;QAChE,WAAW,EAAE,2EAA2E;KACzF;IACD,cAAc,EAAE;QACd,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,6FAA6F;KAC3G;CACF,CAAC"}

package/dist/tools/patterns/adapters/react.d.ts

@@ -0,0 +1,4 @@
+import type { BuiltinPatternDefinition } from "../types.js";
+export declare const REACT_PATTERNS_BEFORE_NEXTJS: Record<string, BuiltinPatternDefinition>;
+export declare const REACT_PATTERNS_AFTER_NEXTJS: Record<string, BuiltinPatternDefinition>;
+//# sourceMappingURL=react.d.ts.map

package/dist/tools/patterns/adapters/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../../../src/tools/patterns/adapters/react.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAmNjF,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAmIhF,CAAC"}

package/dist/tools/patterns/adapters/react.js

@@ -0,0 +1,345 @@
+export const REACT_PATTERNS_BEFORE_NEXTJS = {
+    "useEffect-no-cleanup": {
+        regex: /useEffect\s*\(\s*(?:async\s*)?\(\)\s*=>\s*\{(?:(?!return\s*\(\s*\)\s*=>|return\s+\(\)\s*=>|return\s*\(\s*\)\s*\{|return\s+function)[\s\S])*\}\s*,/,
+        description: "useEffect without cleanup return — potential memory leak (CQ22)",
+        severity: "warning",
+    },
+    // --- React anti-patterns (Wave 2) ---
+    "hook-in-condition": {
+        regex: /\b(?:if|for|while|switch)\s*\([^)]*\)\s*\{[\s\S]{0,500}?\buse[A-Z]\w*\s*\(/,
+        description: "React hook called inside if/for/while/switch — violates Rule of Hooks",
+        severity: "critical",
+    },
+    "useEffect-async": {
+        regex: /useEffect\s*\(\s*async\s+(?:function\b|\(|[a-z_$])/,
+        description: "async function directly in useEffect — use inner async wrapper (CQ22)",
+        severity: "warning",
+    },
+    "useEffect-object-dep": {
+        regex: /useEffect\s*\([\s\S]*?,\s*\[[^\]]*[{[]/,
+        description: "Object/array literal in useEffect dependency array — causes infinite re-renders",
+        severity: "warning",
+    },
+    "missing-display-name": {
+        regex: /(?:React\.)?(?:memo|forwardRef)\s*\((?:(?!displayName)[\s\S]){0,500}$/,
+        description: "React.memo/forwardRef without displayName nearby — harder to debug in DevTools",
+        severity: "style",
+    },
+    "index-as-key": {
+        regex: /\.map\s*\(\s*\(\s*\w+\s*,\s*(index|idx|i)\b[^)]*\)\s*=>[\s\S]{0,400}?key\s*=\s*\{?\s*\1\b/,
+        description: "Array index used as React key — causes incorrect reconciliation on reorder",
+        severity: "warning",
+    },
+    "inline-handler": {
+        regex: /\bon[A-Z]\w*\s*=\s*\{\s*(?:\([^)]*\)|[a-z_$][\w$]*)\s*=>/,
+        description: "Inline arrow function in JSX event handler — creates new reference every render (memoization killer)",
+        severity: "style",
+    },
+    "conditional-render-hook": {
+        regex: /\breturn\s+[^;{]*;\s*\n[\s\S]*?\buse[A-Z]\w*\s*\(/,
+        description: "React hook called after early return — violates Rule of Hooks",
+        severity: "critical",
+    },
+    // --- React anti-patterns (Wave 4b — additional) ---
+    "dangerously-set-html": {
+        regex: /dangerouslySetInnerHTML\s*=\s*\{/,
+        description: "dangerouslySetInnerHTML used — XSS risk unless content is sanitized (CQ24). Comment/string-embedded mentions are stripped before matching.",
+        severity: "critical",
+        preprocess: "strip-comments-strings",
+    },
+    "direct-dom-access": {
+        regex: /\bdocument\.(getElementById|querySelector|querySelectorAll|getElementsBy)\s*\(/,
+        description: "Direct DOM access in React component — use useRef instead (breaks SSR, bypasses virtual DOM). Comment/string-embedded mentions stripped before matching.",
+        severity: "warning",
+        preprocess: "strip-comments-strings",
+    },
+    "unstable-default-value": {
+        regex: /(?:function\s+[A-Z]\w*|const\s+[A-Z]\w*\s*=\s*(?:\([^)]*\)|[^=]*)\s*=>)\s*[\s\S]{0,100}(?:\{\s*[^}]*=\s*\[\s*\]|\{\s*[^}]*=\s*\{\s*\})/,
+        description: "Default prop value [] or {} in component params — creates new reference every render, breaks memo/PureComponent",
+        severity: "warning",
+    },
+    "jsx-falsy-and": {
+        regex: /\{\s*(?:count|length|size|num|total|amount)\s*&&\s*</,
+        description: "Numeric variable used with && in JSX — renders '0' on screen when falsy. Use ternary or Boolean() (React gotcha)",
+        severity: "warning",
+    },
+    "nested-component-def": {
+        regex: /(?:function\s+[A-Z]\w*\s*\([^)]*\)\s*\{|const\s+[A-Z]\w*\s*=\s*(?:\([^)]*\)|[\w$]*)\s*=>\s*\{)[\s\S]{0,1500}?\n\s{2,}(?:function\s+[A-Z]\w*\s*\(|const\s+[A-Z]\w*\s*=\s*\()/,
+        description: "Component defined inside another component — remounts on every parent render, loses all state. Hoist to module level.",
+        severity: "critical",
+    },
+    "usecallback-no-deps": {
+        regex: /use(?:Callback|Memo)\s*\([\s\S]*?\)\s*\)\s*[;,]/,
+        description: "useCallback/useMemo with only one argument (no dependency array) — useless memoization, value recreated every render",
+        severity: "warning",
+    },
+    // --- React 19 features (Tier 4 — Item 19) ---
+    "react19-use-without-suspense": {
+        regex: /\buse\s*\(\s*[a-zA-Z_$][\w$]*\s*\)/,
+        description: "React 19 use(promise) — must be wrapped in <Suspense> or it throws. Verify Suspense boundary exists in parent.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "critical",
+    },
+    "react19-server-action-not-async": {
+        // Tier 7 fix: matches `export function X`, `export const X = (...) =>`,
+        // AND `export default function X` (gemini finding — default exports were missed).
+        // 2000-char window for actions defined far from the directive.
+        regex: /^[\s\S]{0,200}["']use server["'][\s\S]{0,2000}?\bexport\s+(?:(?:const|let|var)\s+\w+\s*=\s+(?!async\b)(?:\([^)]*\)|\w+)\s*=>|default\s+(?!async\b)function(?:\s+\w+)?\s*\(|(?!async\b)function\s+\w+\s*\()/m,
+        description: "React 19 Server Action: function in 'use server' file must be async (returns Promise). Pattern detects `export function X`, `export const X = (...) =>` arrow, AND `export default function X` (default exports).",
+        fileIncludePattern: /\.(tsx|jsx|ts|js)$/,
+        severity: "critical",
+    },
+    "react19-form-action-non-function": {
+        regex: /<form\s+[^>]*\baction\s*=\s*["'][^"']/,
+        description: "React 19 form action prop should be a function (Server Action), not a string URL. Use <form action={serverAction}> for progressive enhancement.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "react19-useoptimistic-no-transition": {
+        // Tier 7 fix: \b boundary — myUseTransitionWrapper no longer suppresses match.
+        // Tier 8: preprocess strips comment/string content before lookahead — closes
+        // Tier 7 R-2.1 known limit (transition tokens in JSDoc/comments).
+        regex: /\buseOptimistic\s*\((?![\s\S]{0,1000}?\b(?:useTransition|startTransition)\b)/,
+        description: "React 19 useOptimistic should be paired with useTransition/startTransition for non-urgent updates. Comment/string-embedded mentions stripped before matching.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+        preprocess: "strip-comments-strings",
+    },
+    // --- oxlint-inspired React rules (April 2026) ---
+    "hook-usestate-destructure": {
+        regex: /(?:^|\n)\s*useState\s*(?:<[^>]+>)?\s*\([^)]*\)\s*;/,
+        description: "useState() called without destructuring [value, setter] — value is inaccessible. Use: const [value, setValue] = useState(initial). (oxlint react/hook-use-state)",
+        fileIncludePattern: /\.(tsx|jsx|ts)$/,
+        severity: "critical",
+    },
+    "prefer-function-component": {
+        regex: /class\s+\w+\s+extends\s+(?:React\.)?(?:Component|PureComponent)\b/,
+        description: "Class component could be a function component — class components lack hook support, are harder to tree-shake, and React Compiler cannot optimize them. (oxlint react/prefer-function-component)",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "style",
+    },
+    // --- React Compiler bailout patterns (GA v1.0, Oct 2025 — Next.js 16 stable) ---
+    "compiler-side-effect-in-render": {
+        regex: /\b(?:console\.(?:log|warn|error|info)\s*\(|Math\.random\s*\(|Date\.now\s*\(|document\.(?:getElementById|querySelector|createElement)\s*\()/,
+        description: "Side effect in render body — React Compiler silently skips memoization. Move to useEffect or event handler.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "compiler-ref-read-in-render": {
+        regex: /(?:^|\n)\s*(?:const|let|var)\s+\w+\s*=\s*\w+Ref\.current\b/,
+        description: "Reading ref.current during render — React Compiler cannot track ref mutations. Read refs in useEffect or event handlers only.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "compiler-prop-mutation": {
+        regex: /\bprops\.\w+\.(?:push|pop|shift|unshift|splice|sort|reverse|fill)\s*\(/,
+        description: "Mutating props object — breaks React Compiler immutability assumption. Clone before mutating: [...props.items, newItem].",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "compiler-state-mutation": {
+        regex: /(?:^|\n)\s*\w+\.(?:push|pop|shift|unshift|splice|sort|reverse|fill)\s*\([\s\S]{0,200}?set[A-Z]\w*\s*\(\s*\w+\s*\)/,
+        description: "Direct state mutation then setState with same reference — React Compiler assumes immutable updates. Use spread: setItems([...items, newItem]).",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "compiler-try-catch-bailout": {
+        regex: /(?:function\s+[A-Z]\w*|const\s+[A-Z]\w*\s*=)[\s\S]{0,300}?\btry\s*\{[\s\S]{0,500}?\bcatch\s*\(/,
+        description: "try/catch in component body — React Compiler may silently bail out (known issue #35644). Move error handling to useEffect or extract to a hook.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "compiler-redundant-memo": {
+        regex: /\b(?:React\.)?memo\s*\(\s*(?:function\s+[A-Z]|(?:\([^)]*\)|[A-Z]\w*)\s*=>)/,
+        description: "React.memo wrapping — React Compiler auto-memoizes, making manual memo redundant. Safe to remove after compiler adoption.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "style",
+    },
+    "compiler-redundant-usecallback": {
+        regex: /\buseCallback\s*\(\s*(?:\([^)]*\)|[a-z_$][\w$]*)\s*=>/,
+        description: "useCallback wrapping — React Compiler auto-memoizes callbacks, making manual useCallback redundant. Safe to remove after compiler adoption.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "style",
+    },
+    // --- RSC boundary serializability (Tier 4 — Item 18) ---
+    "rsc-non-serializable-prop": {
+        // Detects patterns like onClick={fn} or callback={handler} on JSX elements
+        // when the file has "use client" directive or imports from a client component.
+        // Heuristic: prop=function-reference (not arrow inline, that's caught elsewhere).
+        regex: /\b(?:onClick|onChange|onSubmit|onError|callback|handler|render)\s*=\s*\{\s*[a-z_$][\w$]*\s*\}/,
+        description: "Function passed as prop across RSC boundary — must be a Server Action ('use server') or component must be Client Component ('use client'). Functions are not serializable.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "critical",
+    },
+    "rsc-date-prop": {
+        regex: /\b\w+\s*=\s*\{\s*new\s+Date\s*\(/,
+        description: "Date object passed as prop — Date is serializable in JSON but loses prototype across RSC boundary. Use ISO string + parse on client side.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    // --- useEffect pain points (37% of devs struggle — State of React 2025) ---
+    "useEffect-missing-cleanup": {
+        regex: /useEffect\s*\(\s*(?:\([^)]*\)|[a-z_$][\w$]*)\s*=>[\s\S]{0,800}?(?:addEventListener|setInterval|setTimeout|subscribe|on\s*\()(?:(?!return\s*(?:\(\s*\)\s*=>|function))[\s\S]){0,800}\}\s*,/,
+        description: "useEffect with addEventListener/setInterval/subscribe but no cleanup return — memory leak. Return a cleanup function that removes the listener/clears the interval.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+    "useEffect-setstate-loop": {
+        // Tier 7 fix (multiple gemini findings):
+        //  1. Original matched `[` in setState array literal arg → anchored on `}, [`.
+        //  2. Cross-effect bridging — non-greedy walk now bails on next `useEffect`.
+        //  3. Implicit-return arrows: alternation block-bodied OR concise.
+        //  4. `\1\b` matched `count` inside `props.count` — fixed by `(?<!\.)\b\1\b`.
+        //  5. Tier 7 review R-3: concise arm's first `\)` could close a NESTED call like
+        //     `setCount(getY())`. Fix: require concise-arm setState arg has NO inner `(`
+        //     by using `[^()]*` for the simple case (most real bugs); complex args fall
+        //     through to the block-bodied arm. Documented as known limit.
+        regex: /useEffect\s*\(\s*(?:\([^)]*\)|[a-z_$][\w$]*)\s*=>\s*(?:\{(?:(?!\buseEffect\b)[\s\S]){0,800}?\bset([A-Z]\w*)\s*\((?:(?!\buseEffect\b)[\s\S]){0,300}?\}\s*,\s*\[[^\]]*?(?<!\.)\b\1\b|set([A-Z]\w*)\s*\([^()]{0,200}\)\s*,\s*\[[^\]]*?(?<!\.)\b\2\b)/i,
+        description: "setState inside useEffect with same state variable in dependency array — infinite render loop. Block-bodied form `() => { setX(); }, [x]` AND concise form `() => setX(arg), [x]` (concise arm requires non-nested arg). Bails out at next useEffect; rejects `props.count` property chains. Known limit: concise form with nested calls (setX(getY())) is not detected — block form covers it.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "critical",
+    },
+    "useEffect-missing-deps-identifier": {
+        // Heuristic: useEffect with empty dep array [] but body references an
+        // identifier that looks like a prop/state (lowerCamelCase, 2+ chars).
+        // Subset of eslint-react-hooks/exhaustive-deps — catches the common
+        // "empty deps but reads mutable value" bug without full scope analysis.
+        regex: /useEffect\s*\(\s*\([^)]*\)\s*=>\s*\{[\s\S]{0,400}?\b(?:props\.\w+|[a-z][a-zA-Z]*(?:\.\w+)?)[\s\S]{0,400}?\}\s*,\s*\[\s*\]\s*\)/,
+        description: "useEffect with empty deps array [] reads props/state identifiers in body — likely missing dependencies. If intentional, add // eslint-disable-next-line react-hooks/exhaustive-deps with reason.",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        severity: "warning",
+    },
+};
+export const REACT_PATTERNS_AFTER_NEXTJS = {
+    // --- TanStack Query patterns ---
+    "tanstack-missing-invalidation": {
+        regex: /\buseMutation\s*\((?:(?!invalidateQueries|invalidateQuery)[\s\S]){0,800}\}\s*\)/,
+        description: "useMutation without invalidateQueries in onSuccess/onSettled — stale data remains in cache after mutation. Add queryClient.invalidateQueries() on success.",
+        fileIncludePattern: /\.(tsx|jsx|ts)$/,
+        severity: "warning",
+    },
+    // --- React Tier 5 (May 2026) — derived state, stale closures, context perf, security ---
+    "derived-state": {
+        regex: /const\s*\[\s*(\w+)\s*,\s*set\1\s*\]\s*=\s*useState\s*\(\s*props\.\1\s*\)[\s\S]{0,2000}?useEffect\s*\([\s\S]{0,500}?set\1\s*\(\s*props\.\1\s*\)/i,
+        description: "useState(props.X) + useEffect that syncs setX(props.X) — derived state anti-pattern. Lift state up or compute during render. NOTE: matches when state name follows setX for prop x. Custom-named setters (props.value → setDisplayValue) not detected. The /i flag is intentional — it catches cross-case variants like useState(props.Name) + setName(props.name).",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "stale-closure-setstate": {
+        regex: /const\s*\[\s*(\w+)\s*,\s*set([A-Z]\w*)\s*\]\s*=\s*useState[^\n;]*(?:;|\n)(?:(?!const\s*\[\s*\w+\s*,\s*set[A-Z]\w*\s*\]\s*=\s*useState)[\s\S]){0,3000}?\bset\2\s*\(\s*\1\s*[+\-*/]/,
+        description: "setState called with non-functional update referencing current state value (setX(X + n)) — risks stale closure in event handlers, timers, or async callbacks. Use functional form: setX(prev => prev + n). NOTE: requires standard [x, setX] = useState() naming; boolean toggles (setOpen(!open)) and broken functional updaters not detected.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "context-provider-value-inline": {
+        regex: /<\w+\.Provider\s+[^>]*\bvalue\s*=\s*\{\s*[\{\[]/,
+        description: "Context.Provider value is an inline object/array literal — new reference every render forces ALL consumers to re-render. Wrap in useMemo: value={useMemo(() => ({...}), [deps])}. NOTE: does not detect intermediate-variable form or destructured Provider.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "jsx-no-target-blank": {
+        regex: /<a\s+(?:(?!>)[\s\S]){0,500}?target\s*=\s*(?:["']_blank["']|\{\s*["']_blank["']\s*\})(?:(?!>)[\s\S]){0,500}?>/,
+        description: "<a target=\"_blank\"> without rel=\"noopener noreferrer\" — tabnabbing/window.opener security risk. Add rel=\"noopener noreferrer\". NOTE: matches both string and JSX-brace forms; postFilter requires whitespace before rel= to avoid URL false-positive.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+        // require leading whitespace before `rel` (real attribute, not `?rel=` in URL)
+        // AND require rel value to contain BOTH `noopener` AND `noreferrer` as exact
+        // whitespace-separated tokens (so `noopenerx noreferrer` does NOT pass).
+        // Accepts string form `rel="..."` and JSX-brace-with-string-literal form
+        // `rel={"..."}` / `rel={'...'}`. Dynamic JSX expression form `rel={var}`
+        // remains a false-positive (cannot be resolved statically).
+        postFilter: (match) => {
+            const relMatch = /\srel\s*=\s*\{\s*["']([^"']*)["']\s*\}/.exec(match)
+                ?? /\srel\s*=\s*["']([^"']*)["']/.exec(match);
+            if (!relMatch)
+                return true; // no rel attribute → real positive
+            const tokens = new Set(relMatch[1].toLowerCase().split(/\s+/).filter(Boolean));
+            // safe only if both exact tokens present
+            return !(tokens.has("noopener") && tokens.has("noreferrer"));
+        },
+    },
+    "button-no-type": {
+        regex: /<button(?=[\s>])(?![^>]{0,500}\stype\s*=)[^>]{0,500}>/,
+        description: "<button> without explicit type attribute — defaults to type=\"submit\" which can unintentionally submit a form. Add type=\"button\" for non-submit buttons. NOTE: word-boundary lookahead `(?=[\\s>])` ensures HTML <button> only — not <button-group> or <ButtonIcon>. Negative lookahead `(?![^>]{0,500}\\stype\\s*=)` requires whitespace before type= (so data-type= correctly does NOT block the match).",
+        severity: "style",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    // --- React Tier 6 (May 2026) — extending Tier 5 coverage ---
+    "derived-state-reducer": {
+        regex: /useReducer\s*\([\s\S]{0,500}?\)[\s\S]{0,2000}?useEffect\s*\([\s\S]{0,500}?dispatch\s*\(\s*\{\s*type\s*:\s*['"][a-zA-Z_-]*sync/i,
+        description: "useReducer + useEffect dispatching a sync-typed action — derived state via reducer.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "derived-state-custom-setter": {
+        regex: /useState\s*\(\s*props\.(\w+)\s*\)[\s\S]{0,2000}?useEffect\s*\([\s\S]{0,500}?set[A-Z]\w*\s*\(\s*props\.\1\s*\)/,
+        description: "useState(props.X) + useEffect with custom-named setter syncing props.X — derived state anti-pattern (custom setter naming variant).",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "stale-closure-toggle": {
+        regex: /const\s*\[\s*(\w+)\s*,\s*set([A-Z]\w*)\s*\]\s*=\s*useState[\s\S]{0,3000}?\bset\2\s*\(\s*!\s*\1\s*\)/,
+        description: "setX(!X) boolean toggle — risks stale closure. Use functional form: setX(prev => !prev).",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "stale-closure-broken-functional": {
+        // codex Run findings: regex must require updater param NAME ≠ state var name
+        // (e.g. `setCount(count => count + 1)` is correct shadowing, not the bug).
+        // Three-group form: \1 = state var, \3 = updater param. Match only when \3 != \1
+        // by requiring \1 ref AFTER updater param that's a distinct identifier.
+        regex: /const\s*\[\s*(\w+)\s*,\s*set([A-Z]\w*)\s*\]\s*=\s*useState[\s\S]{0,3000}?\bset\2\s*\(\s*(?!(?:\1\b))(\w+)\s*=>\s*[\s\S]{0,200}?\b\1\b/,
+        description: "Functional updater that references the outer state var instead of the prev parameter (e.g., setCount(prev => count + 1)) — still stale-closure-prone. NOTE: correctly skips intentional shadowing (setCount(count => count + 1)).",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "context-provider-value-via-variable": {
+        // gemini findings: original lookbehind was syntactically broken; missed arrays.
+        // Fix: drop lookbehind (negation handled via word `useMemo` exclusion in identifier
+        // value-source), accept both {object} and [array] literal sources.
+        regex: /\b(?:const|let|var)\s+(\w+)\s*=\s*(?!useMemo\b)[{\[][\s\S]{0,500}?[}\]]\s*;[\s\S]{0,500}?<\w+\.Provider\s+[^>]*\bvalue\s*=\s*\{\s*\1\s*\}/,
+        description: "Context.Provider value passed via local variable assigned to inline object/array literal — new reference every render. Wrap in useMemo: const ctx = useMemo(() => ({...}), [deps]). Detects both {} and [] forms; correctly skips useMemo-wrapped values.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "context-provider-value-inline-destructured": {
+        regex: /const\s*\{\s*([A-Z]\w*Provider\w*|Provider)\s*\}\s*=\s*\w+[\s\S]{0,2000}?<\1\s+[^>]*\bvalue\s*=\s*\{\s*[\{\[]/,
+        description: "Destructured Provider with inline object/array literal value — same perf problem as <Ctx.Provider value={{...}}>. Wrap in useMemo.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "react-lazy-no-suspense-same-file": {
+        // Tier 6 Item 1 — single-file approximation. Cross-file detection (Suspense in router parent)
+        // requires interprocedural analysis — deferred to Tier 7.
+        // Codex/gemini findings:
+        //  - <React.Suspense> form must be matched (was bypassable with `import * as React`)
+        //  - Suspense placed BEFORE lazy() in file was missed (forward-only lookahead)
+        // Fix: from-start-of-file negation `((?!<(?:React\.)?Suspense\b)[\s\S])*` + same trailing.
+        regex: /^((?!<(?:React\.)?Suspense\b)[\s\S])*(?:const|let|var)\s+[A-Z]\w*\s*=\s*(?:React\.)?lazy\s*\(((?!<(?:React\.)?Suspense\b)[\s\S]){0,3000}?export\s+default/,
+        description: "React.lazy() in entrypoint file (has `export default`) without any <Suspense> or <React.Suspense> anywhere in the same file — likely missing Suspense boundary. NOTE: heuristic only — Suspense in router parent file is a known false-positive case (cross-file detection deferred to Tier 7).",
+        severity: "style",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "error-boundary-incomplete": {
+        // Tier 6 Item 14 — ErrorBoundary coverage (partial). True coverage analysis
+        // (which routes wrapped) requires cross-file scope — Tier 7. This pattern detects
+        // class components that DEFINE one of the two ErrorBoundary lifecycle methods but
+        // not the other, indicating incomplete error handling.
+        // Match strategy: class with componentDidCatch but no getDerivedStateFromError in same body
+        // (or vice versa) is an incomplete ErrorBoundary.
+        regex: /class\s+\w+\s+extends\s+(?:React\.)?(?:Component|PureComponent)\b[\s\S]{0,3000}?(?:componentDidCatch\s*\([\s\S]{0,2000}?\}(?![\s\S]{0,2000}?getDerivedStateFromError)|getDerivedStateFromError\s*\([\s\S]{0,2000}?\}(?![\s\S]{0,2000}?componentDidCatch))/,
+        description: "ErrorBoundary class component has componentDidCatch but not getDerivedStateFromError (or vice versa). React requires BOTH lifecycle methods for a complete ErrorBoundary: getDerivedStateFromError to render fallback UI, componentDidCatch to log the error.",
+        severity: "warning",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+    "rsc-non-serializable-prop-deep": {
+        // Tier 6 Item 11 — deep RSC serializability. Detects common non-serializable types
+        // passed across RSC boundary: Map, Set, Class instances (PascalCase constructor),
+        // Symbol(). Complements rsc-non-serializable-prop which catches function refs only.
+        regex: /\b(?:onClick|onChange|onSubmit|onError|callback|handler|render|data|value|state)\s*=\s*\{\s*new\s+(?:Map|Set|WeakMap|WeakSet|Symbol|RegExp|Promise|[A-Z]\w*)\s*\(/,
+        description: "Non-serializable type passed as prop across RSC boundary — Map/Set/Class instance/Symbol/RegExp/Promise are NOT JSON-serializable. Convert to plain object/array on server, reconstruct on client.",
+        severity: "critical",
+        fileIncludePattern: /\.(tsx|jsx)$/,
+    },
+};
+//# sourceMappingURL=react.js.map

package/dist/tools/patterns/adapters/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../../../../src/tools/patterns/adapters/react.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,4BAA4B,GAA6C;IACpF,sBAAsB,EAAE;QACtB,KAAK,EAAE,mJAAmJ;QAC1J,WAAW,EAAE,iEAAiE;QAC9E,QAAQ,EAAE,SAAS;KACpB;IACD,uCAAuC;IACvC,mBAAmB,EAAE;QACnB,KAAK,EAAE,4EAA4E;QACnF,WAAW,EAAE,uEAAuE;QACpF,QAAQ,EAAE,UAAU;KACrB;IACD,iBAAiB,EAAE;QACjB,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EAAE,uEAAuE;QACpF,QAAQ,EAAE,SAAS;KACpB;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,iFAAiF;QAC9F,QAAQ,EAAE,SAAS;KACpB;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,uEAAuE;QAC9E,WAAW,EAAE,gFAAgF;QAC7F,QAAQ,EAAE,OAAO;KAClB;IACD,cAAc,EAAE;QACd,KAAK,EAAE,2FAA2F;QAClG,WAAW,EAAE,4EAA4E;QACzF,QAAQ,EAAE,SAAS;KACpB;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,0DAA0D;QACjE,WAAW,EAAE,sGAAsG;QACnH,QAAQ,EAAE,OAAO;KAClB;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,UAAU;KACrB;IACD,qDAAqD;IACrD,sBAAsB,EAAE;QACtB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,4IAA4I;QACzJ,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,wBAAwB;KACrC;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,gFAAgF;QACvF,WAAW,EAAE,0JAA0J;QACvK,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,wBAAwB;KACrC;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,wIAAwI;QAC/I,WAAW,EAAE,iHAAiH;QAC9H,QAAQ,EAAE,SAAS;KACpB;IACD,eAAe,EAAE;QACf,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EAAE,kHAAkH;QAC/H,QAAQ,EAAE,SAAS;KACpB;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,6KAA6K;QACpL,WAAW,EAAE,uHAAuH;QACpI,QAAQ,EAAE,UAAU;KACrB;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,iDAAiD;QACxD,WAAW,EAAE,sHAAsH;QACnI,QAAQ,EAAE,SAAS;KACpB;IACD,+CAA+C;IAC/C,8BAA8B,EAAE;QAC9B,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,gHAAgH;QAC7H,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD,iCAAiC,EAAE;QACjC,wEAAwE;QACxE,kFAAkF;QAClF,+DAA+D;QAC/D,KAAK,EAAE,6MAA6M;QACpN,WAAW,EAAE,mNAAmN;QAChO,kBAAkB,EAAE,oBAAoB;QACxC,QAAQ,EAAE,UAAU;KACrB;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,iJAAiJ;QAC9J,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,qCAAqC,EAAE;QACrC,+EAA+E;QAC/E,6EAA6E;QAC7E,kEAAkE;QAClE,KAAK,EAAE,8EAA8E;QACrF,WAAW,EAAE,+JAA+J;QAC5K,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,wBAAwB;KACrC;IACD,mDAAmD;IACnD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EAAE,kKAAkK;QAC/K,kBAAkB,EAAE,iBAAiB;QACrC,QAAQ,EAAE,UAAU;KACrB;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,mEAAmE;QAC1E,WAAW,EAAE,iMAAiM;QAC9M,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,OAAO;KAClB;IACD,kFAAkF;IAClF,gCAAgC,EAAE;QAChC,KAAK,EAAE,4IAA4I;QACnJ,WAAW,EAAE,6GAA6G;QAC1H,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,6BAA6B,EAAE;QAC7B,KAAK,EAAE,4DAA4D;QACnE,WAAW,EAAE,+HAA+H;QAC5I,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,wEAAwE;QAC/E,WAAW,EAAE,0HAA0H;QACvI,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,mHAAmH;QAC1H,WAAW,EAAE,gJAAgJ;QAC7J,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,gGAAgG;QACvG,WAAW,EAAE,iJAAiJ;QAC9J,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,4EAA4E;QACnF,WAAW,EAAE,2HAA2H;QACxI,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,OAAO;KAClB;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,uDAAuD;QAC9D,WAAW,EAAE,6IAA6I;QAC1J,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,OAAO;KAClB;IACD,0DAA0D;IAC1D,2BAA2B,EAAE;QAC3B,2EAA2E;QAC3E,+EAA+E;QAC/E,kFAAkF;QAClF,KAAK,EAAE,+FAA+F;QACtG,WAAW,EAAE,4KAA4K;QACzL,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD,eAAe,EAAE;QACf,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,2IAA2I;QACxJ,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,6EAA6E;IAC7E,2BAA2B,EAAE;QAC3B,KAAK,EAAE,2LAA2L;QAClM,WAAW,EAAE,qKAAqK;QAClL,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;IACD,yBAAyB,EAAE;QACzB,yCAAyC;QACzC,+EAA+E;QAC/E,6EAA6E;QAC7E,mEAAmE;QACnE,8EAA8E;QAC9E,iFAAiF;QACjF,iFAAiF;QACjF,gFAAgF;QAChF,kEAAkE;QAClE,KAAK,EAAE,oPAAoP;QAC3P,WAAW,EAAE,iYAAiY;QAC9Y,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD,mCAAmC,EAAE;QACnC,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,KAAK,EAAE,gIAAgI;QACvI,WAAW,EAAE,kMAAkM;QAC/M,kBAAkB,EAAE,cAAc;QAClC,QAAQ,EAAE,SAAS;KACpB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAA6C;IACnF,kCAAkC;IAClC,+BAA+B,EAAE;QAC/B,KAAK,EAAE,iFAAiF;QACxF,WAAW,EAAE,4JAA4J;QACzK,kBAAkB,EAAE,iBAAiB;QACrC,QAAQ,EAAE,SAAS;KACpB;IACD,0FAA0F;IAC1F,eAAe,EAAE;QACf,KAAK,EAAE,iJAAiJ;QACxJ,WAAW,EAAE,qWAAqW;QAClX,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,mLAAmL;QAC1L,WAAW,EAAE,iVAAiV;QAC9V,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,+BAA+B,EAAE;QAC/B,KAAK,EAAE,iDAAiD;QACxD,WAAW,EAAE,8PAA8P;QAC3Q,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,8GAA8G;QACrH,WAAW,EAAE,6PAA6P;QAC1Q,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;QAClC,+EAA+E;QAC/E,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,QAAQ,GACZ,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC;mBACjD,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;YAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAChF,yCAAyC;YACzC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/D,CAAC;KACF;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,uDAAuD;QAC9D,WAAW,EAAE,+YAA+Y;QAC5Z,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,cAAc;KACnC;IACD,8DAA8D;IAC9D,uBAAuB,EAAE;QACvB,KAAK,EAAE,gIAAgI;QACvI,WAAW,EAAE,qFAAqF;QAClG,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,6BAA6B,EAAE;QAC7B,KAAK,EAAE,+GAA+G;QACtH,WAAW,EAAE,qIAAqI;QAClJ,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,qGAAqG;QAC5G,WAAW,EAAE,0FAA0F;QACvG,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,iCAAiC,EAAE;QACjC,6EAA6E;QAC7E,2EAA2E;QAC3E,iFAAiF;QACjF,wEAAwE;QACxE,KAAK,EAAE,uIAAuI;QAC9I,WAAW,EAAE,mOAAmO;QAChP,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,qCAAqC,EAAE;QACrC,gFAAgF;QAChF,oFAAoF;QACpF,mEAAmE;QACnE,KAAK,EAAE,2IAA2I;QAClJ,WAAW,EAAE,2PAA2P;QACxQ,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,4CAA4C,EAAE;QAC5C,KAAK,EAAE,+GAA+G;QACtH,WAAW,EAAE,oIAAoI;QACjJ,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,kCAAkC,EAAE;QAClC,8FAA8F;QAC9F,0DAA0D;QAC1D,yBAAyB;QACzB,qFAAqF;QACrF,+EAA+E;QAC/E,2FAA2F;QAC3F,KAAK,EAAE,2JAA2J;QAClK,WAAW,EAAE,iSAAiS;QAC9S,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,cAAc;KACnC;IACD,2BAA2B,EAAE;QAC3B,4EAA4E;QAC5E,kFAAkF;QAClF,kFAAkF;QAClF,uDAAuD;QACvD,4FAA4F;QAC5F,kDAAkD;QAClD,KAAK,EAAE,2PAA2P;QAClQ,WAAW,EAAE,+PAA+P;QAC5Q,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,cAAc;KACnC;IACD,gCAAgC,EAAE;QAChC,mFAAmF;QACnF,kFAAkF;QAClF,oFAAoF;QACpF,KAAK,EAAE,mKAAmK;QAC1K,WAAW,EAAE,oMAAoM;QACjN,QAAQ,EAAE,UAAU;QACpB,kBAAkB,EAAE,cAAc;KACnC;CACF,CAAC"}