codesift-mcp 0.9.0 → 0.9.10

package/dist/tools/php-nplus1-tools.js

@@ -0,0 +1,191 @@
+/**
+ * PHP/Yii2-specific code intelligence tools.
+ *
+ * Implementation module extracted from the legacy php-tools facade.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getCodeIndex } from "./index-tools.js";
+// 7h. find_php_n_plus_one — detect foreach + relation access without ->with()
+// ---------------------------------------------------------------------------
+/**
+ * Common ActiveRecord scalar field names. Property access like $user->id or
+ * $user->created_at inside a foreach is NOT a relation (no N+1 risk), so we
+ * allow-list these to cut false positives.
+ */
+const SCALAR_FIELD_NAMES = new Set([
+    "id", "name", "title", "created_at", "updated_at", "deleted_at", "status",
+    "email", "slug", "code", "type", "value", "label", "description", "enabled",
+    "active", "position", "sort", "order", "count", "total", "amount", "price",
+    "uuid", "hash", "token", "key", "url", "path", "image", "avatar",
+]);
+/**
+ * PHP method names that look like `get*` but are NOT ActiveRecord relation
+ * getters. `$item->save()` / `$item->validate()` inside a foreach is fine;
+ * flagging them as N+1 would be a false positive. These names are stripped
+ * from the `get\w+()` method-call detection before the eager-load check.
+ */
+const METHOD_CALL_BLOCKLIST = new Set([
+    "save", "validate", "delete", "refresh", "load", "populate", "toArray",
+    "afterSave", "beforeSave", "beforeDelete", "afterDelete",
+    "getAttributes", "getAttribute", "getIsNewRecord", "getErrors", "getFirstError",
+    "getOldAttributes", "getDirtyAttributes", "getPrimaryKey", "getTableSchema",
+]);
+/**
+ * Detect N+1 query patterns in Yii2/Eloquent controllers.
+ *
+ * Pattern: `foreach ($items as $item) { $item->relation->... }` without a
+ * prior `->with('relation')` call in the same method scope. This is the
+ * most common N+1 anti-pattern in Yii2 ActiveRecord code.
+ *
+ * Known limitations (acceptable for a "discovery" tool, not a gate):
+ * - Regex-based — can miss multi-line foreach bodies split across nested blocks
+ * - Doesn't cross function boundaries — eager loading in caller is invisible
+ * - False positives on nested loops if the outer collection is already eager-loaded
+ */
+export async function findPhpNPlusOne(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const findings = [];
+    const limit = options?.limit ?? 100;
+    const filePattern = options?.file_pattern;
+    // Normalize `getProfile` → `profile` so the ->with() check matches whether
+    // the relation is accessed as a property or via its auto-generated getter.
+    const normalizeGetter = (name) => {
+        const bare = name.replace(/^get/, "");
+        return bare.length > 0 ? bare.charAt(0).toLowerCase() + bare.slice(1) : "";
+    };
+    // A finding is emitted exactly once per (foreach × relation-name) tuple so
+    // that chained patterns don't double-report the same relation that the
+    // property pattern already caught in the same loop body.
+    const emitFinding = (sym, foreachIdx, relation, pattern, seen) => {
+        if (!relation || seen.has(relation))
+            return findings.length >= limit;
+        seen.add(relation);
+        if (SCALAR_FIELD_NAMES.has(relation.toLowerCase()))
+            return findings.length >= limit;
+        const beforeForeach = sym.source.slice(0, foreachIdx);
+        const withRe = new RegExp(`\\bwith\\s*\\(\\s*['"]${relation}['"]`);
+        if (withRe.test(beforeForeach))
+            return findings.length >= limit;
+        const lineOffset = beforeForeach.split("\n").length - 1;
+        findings.push({
+            file: sym.file,
+            method: sym.name,
+            line: sym.start_line + lineOffset,
+            relation,
+            pattern,
+        });
+        return findings.length >= limit;
+    };
+    // Helper: scan a single chunk of source (a method body OR a view file) for
+    // all 4 N+1 patterns. Returns true once `limit` is hit so the caller can
+    // short-circuit.
+    function scanChunk(file, methodName, src, startLine) {
+        const foreachRe = /foreach\s*\(\s*\$(\w+)\s+as\s+(?:\$\w+\s*=>\s*)?\$(\w+)\s*\)/g;
+        let fm;
+        while ((fm = foreachRe.exec(src)) !== null) {
+            const itemVar = fm[2];
+            const foreachIdx = fm.index;
+            const after = src.slice(foreachIdx);
+            const seen = new Set();
+            // Pattern 1 — property access: $item->profile
+            const propRe = new RegExp(`\\$${itemVar}->(\\w+)(?![\\w(])`, "g");
+            let m;
+            while ((m = propRe.exec(after)) !== null) {
+                if (emitFinding({ file, name: methodName, source: src, start_line: startLine }, foreachIdx, m[1], "foreach-access-without-with", seen)) {
+                    return true;
+                }
+            }
+            // Pattern 2 — getter method call: $item->getProfile()
+            const getterRe = new RegExp(`\\$${itemVar}->(get\\w+)\\s*\\(\\s*\\)`, "g");
+            while ((m = getterRe.exec(after)) !== null) {
+                const rawMethod = m[1];
+                if (METHOD_CALL_BLOCKLIST.has(rawMethod))
+                    continue;
+                const normalized = normalizeGetter(rawMethod);
+                if (!normalized || METHOD_CALL_BLOCKLIST.has(normalized.toLowerCase()))
+                    continue;
+                if (emitFinding({ file, name: methodName, source: src, start_line: startLine }, foreachIdx, normalized, "foreach-getter-without-with", seen)) {
+                    return true;
+                }
+            }
+            // Pattern 3 — chained access: $item->rel->sub
+            const chainRe = new RegExp(`\\$${itemVar}->(\\w+)->\\w`, "g");
+            while ((m = chainRe.exec(after)) !== null) {
+                if (emitFinding({ file, name: methodName, source: src, start_line: startLine }, foreachIdx, m[1], "foreach-chained-without-with", seen)) {
+                    return true;
+                }
+            }
+            // Pattern 4 (Sprint 3) — explicit lookup in loop body. Inside the foreach,
+            // a `Model::findOne(...)` / `Model::findAll(...)` / `->find()` is the
+            // lazy-load smell — each iteration hits the database.
+            //
+            // We scan a bounded 2000-char window after the foreach header to keep
+            // the regex cost predictable on large methods. A nested foreach inside
+            // the window will still match on its own /g iteration, and the outer
+            // `seen` set deduplicates so we never double-report a single class+method.
+            const body = after.slice(0, Math.min(after.length, 2000));
+            const findOneRe = /(\w+)::(findOne|findAll|find|findBySql)\s*\(/g;
+            let lm;
+            while ((lm = findOneRe.exec(body)) !== null) {
+                const targetClass = lm[1];
+                const method = lm[2];
+                // Filter common false positives: top-level utility classes that
+                // happen to expose static `find*` methods but aren't AR.
+                if (targetClass === "Yii" ||
+                    targetClass === "ArrayHelper" ||
+                    targetClass === "self" ||
+                    targetClass === "static") {
+                    continue;
+                }
+                const synthetic = `${targetClass}::${method}`;
+                if (emitFinding({ file, name: methodName, source: src, start_line: startLine }, foreachIdx, synthetic, "foreach-findone-in-loop", seen)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    // Method-level scan (Patterns 1-4 inside class methods, the original surface).
+    for (const sym of index.symbols) {
+        if (sym.kind !== "method" || !sym.file.endsWith(".php") || !sym.source)
+            continue;
+        if (filePattern && !sym.file.includes(filePattern))
+            continue;
+        if (scanChunk(sym.file, sym.name, sym.source, sym.start_line)) {
+            return { findings, total: findings.length };
+        }
+    }
+    // View-level scan (Sprint 3 Pattern 5) — Yii2 views/**/*.php files render
+    // lists of models at module level. They're not class methods so they have
+    // no symbol; scan the raw file content. `views/**/*.php` is the canonical
+    // path; `_*.php` partials live at the same level.
+    const viewFiles = index.files.filter((f) => {
+        if (!f.path.endsWith(".php"))
+            return false;
+        if (filePattern && !f.path.includes(filePattern))
+            return false;
+        // Standard Yii2 view paths (basic + advanced + module-scoped layouts).
+        return /(?:^|\/)(?:views|widgets|layouts)\//.test(f.path);
+    });
+    await Promise.all(viewFiles.map(async (file) => {
+        if (findings.length >= limit)
+            return;
+        let content;
+        try {
+            content = await readFile(join(index.root, file.path), "utf-8");
+        }
+        catch {
+            return;
+        }
+        // For views the "method name" is just the file basename — that's what
+        // the caller sees in the finding when there is no enclosing function.
+        const methodName = file.path.split("/").pop() ?? file.path;
+        scanChunk(file.path, methodName, content, 1);
+    }));
+    return { findings, total: findings.length };
+}
+// ---------------------------------------------------------------------------
+//# sourceMappingURL=php-nplus1-tools.js.map

package/dist/tools/php-nplus1-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-nplus1-tools.js","sourceRoot":"","sources":["../../src/tools/php-nplus1-tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,8EAA8E;AAC9E,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ;IACzE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS;IAC3E,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IAC1E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACjE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS;IACtE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa;IACxD,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe;IAC/E,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,gBAAgB;CAC5E,CAAC,CAAC;AAUH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAAmD;IAEnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,cAAc,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,GAAG,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO,EAAE,YAAY,CAAC;IAE1C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC,CAAC;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,WAAW,GAAG,CAClB,GAAuE,EACvE,UAAkB,EAClB,QAAgB,EAChB,OAAe,EACf,IAAiB,EACR,EAAE;QACX,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnB,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC;QAEpF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,yBAAyB,QAAQ,MAAM,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC;QAEhE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,IAAI,EAAE,GAAG,CAAC,UAAU,GAAG,UAAU;YACjC,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC;IAClC,CAAC,CAAC;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,iBAAiB;IACjB,SAAS,SAAS,CAChB,IAAY,EACZ,UAAkB,EAClB,GAAW,EACX,SAAiB;QAEjB,MAAM,SAAS,GAAG,+DAA+D,CAAC;QAClF,IAAI,EAA0B,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC;YAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAE/B,8CAA8C;YAC9C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAClE,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,IACE,WAAW,CACT,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAC9D,UAAU,EACV,CAAC,CAAC,CAAC,CAAE,EACL,6BAA6B,EAC7B,IAAI,CACL,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,MAAM,OAAO,2BAA2B,EACxC,GAAG,CACJ,CAAC;YACF,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACxB,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACnD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;gBAC9C,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;oBACpE,SAAS;gBACX,IACE,WAAW,CACT,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAC9D,UAAU,EACV,UAAU,EACV,6BAA6B,EAC7B,IAAI,CACL,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,8CAA8C;YAC9C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,eAAe,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1C,IACE,WAAW,CACT,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAC9D,UAAU,EACV,CAAC,CAAC,CAAC,CAAE,EACL,8BAA8B,EAC9B,IAAI,CACL,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,2EAA2E;YAC3E,sEAAsE;YACtE,sDAAsD;YACtD,EAAE;YACF,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,2EAA2E;YAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAE1D,MAAM,SAAS,GACb,+CAA+C,CAAC;YAClD,IAAI,EAA0B,CAAC;YAC/B,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;gBACtB,gEAAgE;gBAChE,yDAAyD;gBACzD,IACE,WAAW,KAAK,KAAK;oBACrB,WAAW,KAAK,aAAa;oBAC7B,WAAW,KAAK,MAAM;oBACtB,WAAW,KAAK,QAAQ,EACxB,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GAAG,GAAG,WAAW,KAAK,MAAM,EAAE,CAAC;gBAC9C,IACE,WAAW,CACT,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAC9D,UAAU,EACV,SAAS,EACT,yBAAyB,EACzB,IAAI,CACL,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QACjF,IAAI,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QAC7D,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,uEAAuE;QACvE,OAAO,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,QAAQ,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO;QACrC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC;QAC3D,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,8EAA8E"}

package/dist/tools/php-project-audit-tools.d.ts

@@ -0,0 +1,31 @@
+import { type ActiveRecordAnalysis } from "./php-active-record-tools.js";
+import { type PhpSecurityScanResult } from "./php-security-tools.js";
+export interface AuditGate {
+    name: string;
+    status: "ok" | "error" | "timeout";
+    findings_count: number;
+    duration_ms: number;
+    error?: string;
+}
+export interface PhpProjectAudit {
+    repo: string;
+    duration_ms: number;
+    checks_run: string[];
+    gates: AuditGate[];
+    summary: {
+        total_findings: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        health_score: number;
+        top_risks: string[];
+    };
+    security: PhpSecurityScanResult;
+    activerecord: ActiveRecordAnalysis;
+}
+export declare function phpProjectAudit(repo: string, options?: {
+    file_pattern?: string;
+    checks?: string[];
+}): Promise<PhpProjectAudit>;
+//# sourceMappingURL=php-project-audit-tools.d.ts.map

package/dist/tools/php-project-audit-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-project-audit-tools.d.ts","sourceRoot":"","sources":["../../src/tools/php-project-audit-tools.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAG9F,OAAO,EAA4C,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAK/G,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,QAAQ,EAAE,qBAAqB,CAAC;IAChC,YAAY,EAAE,oBAAoB,CAAC;CACpC;AAMD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACrD,OAAO,CAAC,eAAe,CAAC,CA8I1B"}

package/dist/tools/php-project-audit-tools.js

@@ -0,0 +1,173 @@
+/**
+ * PHP/Yii2-specific code intelligence tools.
+ *
+ * Implementation module extracted from the legacy php-tools facade.
+ */
+import { searchPatterns } from "./pattern-tools.js";
+import { analyzeActiveRecord } from "./php-active-record-tools.js";
+import { findPhpGodModel } from "./php-god-model-tools.js";
+import { findPhpNPlusOne } from "./php-nplus1-tools.js";
+import { phpSecurityScan } from "./php-security-tools.js";
+const AUDIT_TIMEOUT = 8000;
+const ALL_CHECKS = ["security", "activerecord", "complexity", "dead_code", "patterns", "clones", "hotspots", "n_plus_one", "god_model", "yii_performance"];
+const DEPRECATED_COMPAT_CHECKS = ["events", "views", "services", "namespace"];
+export async function phpProjectAudit(repo, options) {
+    const startTime = Date.now();
+    const gates = [];
+    const requestedChecks = options?.checks ?? [...ALL_CHECKS];
+    const deprecatedChecks = requestedChecks.filter((check) => DEPRECATED_COMPAT_CHECKS.includes(check));
+    const unknownChecks = requestedChecks.filter((check) => !ALL_CHECKS.includes(check) &&
+        !DEPRECATED_COMPAT_CHECKS.includes(check));
+    if (unknownChecks.length > 0) {
+        throw new Error(`Unsupported php_project_audit check(s): ${unknownChecks.join(", ")}. Supported checks: ${ALL_CHECKS.join(", ")}`);
+    }
+    for (const check of deprecatedChecks) {
+        gates.push({
+            name: check,
+            status: "error",
+            findings_count: 0,
+            duration_ms: 0,
+            error: `Deprecated php_project_audit check "${check}" is no longer part of the compound audit. Use the dedicated PHP tool instead.`,
+        });
+    }
+    const enabled = new Set(requestedChecks.filter((check) => ALL_CHECKS.includes(check)));
+    const fp = options?.file_pattern ?? ".php";
+    const secOpts = {};
+    if (options?.file_pattern)
+        secOpts.file_pattern = options.file_pattern;
+    const tasks = [];
+    if (enabled.has("security"))
+        tasks.push({ name: "security", run: () => phpSecurityScan(repo, secOpts) });
+    if (enabled.has("activerecord"))
+        tasks.push({ name: "activerecord", run: () => analyzeActiveRecord(repo, options?.file_pattern ? { file_pattern: options.file_pattern } : undefined) });
+    if (enabled.has("complexity"))
+        tasks.push({ name: "complexity", run: async () => { const { analyzeComplexity } = await import("./complexity-tools.js"); return analyzeComplexity(repo, { file_pattern: fp, top_n: 10 }); } });
+    if (enabled.has("dead_code"))
+        tasks.push({ name: "dead_code", run: async () => { const { findDeadCode } = await import("./symbol-tools.js"); return findDeadCode(repo, { file_pattern: fp }); } });
+    if (enabled.has("patterns"))
+        tasks.push({ name: "patterns", run: () => searchPatterns(repo, "empty-catch", { file_pattern: fp }) });
+    if (enabled.has("clones"))
+        tasks.push({ name: "clones", run: async () => { const { findClones } = await import("./clone-tools.js"); return findClones(repo, { file_pattern: fp }); } });
+    if (enabled.has("hotspots"))
+        tasks.push({ name: "hotspots", run: async () => { const { analyzeHotspots } = await import("./hotspot-tools.js"); return analyzeHotspots(repo, {}); } });
+    if (enabled.has("n_plus_one"))
+        tasks.push({ name: "n_plus_one", run: () => findPhpNPlusOne(repo, options?.file_pattern ? { file_pattern: options.file_pattern } : undefined) });
+    if (enabled.has("god_model"))
+        tasks.push({ name: "god_model", run: () => findPhpGodModel(repo) });
+    if (enabled.has("yii_performance")) {
+        // Sprint 7: 5 perf patterns sourced from tgm-panel performance-audit
+        // findings. Run them through the file-level scanner alongside
+        // file-level security patterns so module-level matches (configs,
+        // entry-points, view files) are picked up. Each pattern uses its own
+        // severity tier consistent with the perf-audit recommendations.
+        const PERF_PATTERNS = [
+            { pattern: "yii-translate-in-loop", severity: "medium" },
+            { pattern: "yii-dbtarget-info-level", severity: "medium" },
+            { pattern: "yii-find-with-large-then-filter", severity: "high" },
+            { pattern: "yii-cache-no-ttl", severity: "low" },
+            { pattern: "yii-no-batch-on-large", severity: "high" },
+        ];
+        tasks.push({
+            name: "yii_performance",
+            run: async () => {
+                // We reuse the security scan plumbing (parallel pattern runs +
+                // file-level fallback) but with the perf catalog. The result shape
+                // matches PhpSecurityScanResult — caller treats it as informational.
+                const findings = [];
+                const summary = { critical: 0, high: 0, medium: 0, low: 0, total: 0 };
+                const symbolResults = await Promise.all(PERF_PATTERNS.map((check) => searchPatterns(repo, check.pattern, {
+                    file_pattern: fp,
+                    include_tests: false,
+                }).then((r) => ({ check, result: r })).catch(() => null)));
+                for (const res of symbolResults) {
+                    if (!res)
+                        continue;
+                    for (const m of res.result.matches) {
+                        findings.push({
+                            severity: res.check.severity,
+                            pattern: res.check.pattern,
+                            file: m.file,
+                            line: m.start_line,
+                            context: m.context,
+                            description: "",
+                        });
+                        summary[res.check.severity]++;
+                        summary.total++;
+                    }
+                }
+                return {
+                    findings,
+                    summary,
+                    checks_run: PERF_PATTERNS.map((p) => p.pattern),
+                };
+            },
+        });
+    }
+    const settled = await Promise.allSettled(tasks.map(async (t) => {
+        const s = Date.now();
+        const r = await Promise.race([t.run(), new Promise((ok) => setTimeout(() => ok("TIMEOUT"), AUDIT_TIMEOUT))]);
+        return { name: t.name, result: r, ms: Date.now() - s };
+    }));
+    let securityResult = { findings: [], summary: { critical: 0, high: 0, medium: 0, low: 0, total: 0 }, checks_run: [] };
+    let arResult = { models: [], total: 0 };
+    let totalFindings = 0;
+    for (const s of settled) {
+        if (s.status === "rejected") {
+            gates.push({ name: "unknown", status: "error", findings_count: 0, duration_ms: 0, error: String(s.reason) });
+            continue;
+        }
+        const { name, result, ms } = s.value;
+        if (result === "TIMEOUT") {
+            gates.push({ name, status: "timeout", findings_count: 0, duration_ms: ms });
+            continue;
+        }
+        let count = 0;
+        // activerecord is informational (model count), not a problem finding — excluded from totalFindings and health score
+        if (name === "security") {
+            securityResult = result;
+            count = securityResult.summary.total;
+        }
+        else if (name === "activerecord") {
+            arResult = result;
+            count = arResult.total;
+        }
+        else if (name === "complexity")
+            count = result?.summary?.above_threshold ?? 0;
+        else if (name === "dead_code")
+            count = result?.candidates?.length ?? 0;
+        else if (name === "patterns")
+            count = result?.matches?.length ?? 0;
+        else if (name === "clones")
+            count = result?.clones?.length ?? 0;
+        else if (name === "hotspots")
+            count = result?.hotspots?.length ?? 0;
+        else if (name === "n_plus_one")
+            count = result?.findings?.length ?? 0;
+        else if (name === "god_model")
+            count = result?.models?.length ?? 0;
+        else if (name === "yii_performance")
+            count = result?.findings?.length ?? 0;
+        if (name !== "activerecord")
+            totalFindings += count;
+        gates.push({ name, status: "ok", findings_count: count, duration_ms: ms });
+    }
+    const sec = securityResult.summary;
+    // Logarithmic penalties — a few critical findings are serious, but hundreds of
+    // complexity warnings shouldn't tank the score to 0. Each gate uses log2 scaling
+    // so 1 finding ≈ 0, 10 ≈ 17, 100 ≈ 33, 1000 ≈ 50 penalty points.
+    const secPenalty = sec.total > 0 ? Math.round(Math.log2(sec.total + 1) * (sec.critical > 0 ? 8 : 4)) : 0;
+    const qualityFindings = totalFindings - sec.total;
+    const qualPenalty = qualityFindings > 0 ? Math.round(Math.log2(qualityFindings + 1) * 4) : 0;
+    const healthScore = Math.max(0, Math.min(100, 100 - secPenalty - qualPenalty));
+    const topRisks = gates.filter(g => g.findings_count > 0 && g.name !== "activerecord").sort((a, b) => b.findings_count - a.findings_count).slice(0, 3).map(g => `${g.name}: ${g.findings_count} findings`);
+    return {
+        repo, duration_ms: Date.now() - startTime,
+        checks_run: gates.filter(g => g.status === "ok").map(g => g.name),
+        gates,
+        summary: { total_findings: totalFindings, critical: sec.critical, high: sec.high, medium: sec.medium, low: sec.low, health_score: healthScore, top_risks: topRisks },
+        security: securityResult,
+        activerecord: arResult,
+    };
+}
+// ---------------------------------------------------------------------------
+//# sourceMappingURL=php-project-audit-tools.js.map

package/dist/tools/php-project-audit-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-project-audit-tools.js","sourceRoot":"","sources":["../../src/tools/php-project-audit-tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAA6B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAuD,MAAM,yBAAyB,CAAC;AA+B/G,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,CAAU,CAAC;AACpK,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAAsD;IAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,eAAe,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAgD,CAAC,CAAC,CAAC;IAChJ,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAkC,CAAC;QACxD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAgD,CAAC,CAAC,CAAC;IACxF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,KAAK,EAAE,uCAAuC,KAAK,gFAAgF;SACpI,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAkC,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,EAAE,GAAG,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC;IAC3C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,IAAI,OAAO,EAAE,YAAY;QAAE,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAGvE,MAAM,KAAK,GAAW,EAAE,CAAC;IAEzB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxL,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9N,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACpI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxL,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtL,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChL,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,qEAAqE;QACrE,8DAA8D;QAC9D,iEAAiE;QACjE,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,aAAa,GAAG;YACpB,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,QAAiB,EAAE;YACjE,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,QAAiB,EAAE;YACnE,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,MAAe,EAAE;YACzE,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAc,EAAE;YACzD,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAe,EAAE;SAChE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;gBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACtE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;oBAClC,YAAY,EAAE,EAAE;oBAChB,aAAa,EAAE,KAAK;iBACrB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACzD,CACF,CAAC;gBACF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;oBAChC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBACnB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnC,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;4BAC5B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO;4BAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,UAAU;4BAClB,OAAO,EAAE,CAAC,CAAC,OAAO;4BAClB,WAAW,EAAE,EAAE;yBAChB,CAAC,CAAC;wBACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC9B,OAAO,CAAC,KAAK,EAAE,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,OAAO;oBACP,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;iBACvB,CAAC;YAC7B,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,OAAO,CAAY,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxH,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IACzD,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,cAAc,GAA0B,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC7I,IAAI,QAAQ,GAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC9D,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACxJ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAEpH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,oHAAoH;QACpH,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAAC,cAAc,GAAG,MAA+B,CAAC;YAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QAAC,CAAC;aAC/G,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAAC,QAAQ,GAAG,MAA8B,CAAC;YAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAAC,CAAC;aACnG,IAAI,IAAI,KAAK,YAAY;YAAE,KAAK,GAAI,MAAqD,EAAE,OAAO,EAAE,eAAe,IAAI,CAAC,CAAC;aACzH,IAAI,IAAI,KAAK,WAAW;YAAE,KAAK,GAAI,MAAqC,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC;aAClG,IAAI,IAAI,KAAK,UAAU;YAAE,KAAK,GAAI,MAAkC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;aAC3F,IAAI,IAAI,KAAK,QAAQ;YAAE,KAAK,GAAI,MAAiC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;aACvF,IAAI,IAAI,KAAK,UAAU;YAAE,KAAK,GAAI,MAAmC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;aAC7F,IAAI,IAAI,KAAK,YAAY;YAAE,KAAK,GAAI,MAAmC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;aAC/F,IAAI,IAAI,KAAK,WAAW;YAAE,KAAK,GAAI,MAAiC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;aAC1F,IAAI,IAAI,KAAK,iBAAiB;YAAE,KAAK,GAAI,MAAmC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAEzG,IAAI,IAAI,KAAK,cAAc;YAAE,aAAa,IAAI,KAAK,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC;IACnC,+EAA+E;IAC/E,iFAAiF;IACjF,iEAAiE;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,eAAe,GAAG,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;IAClD,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC;IAE1M,OAAO;QACL,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,KAAK;QACL,OAAO,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE;QACpK,QAAQ,EAAE,cAAc;QACxB,YAAY,EAAE,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E"}

package/dist/tools/php-security-tools.d.ts

@@ -0,0 +1,24 @@
+export interface PhpSecurityFinding {
+    severity: "critical" | "high" | "medium" | "low";
+    pattern: string;
+    file: string;
+    line: number;
+    context: string;
+    description: string;
+}
+export interface PhpSecurityScanResult {
+    findings: PhpSecurityFinding[];
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        total: number;
+    };
+    checks_run: string[];
+}
+export declare function phpSecurityScan(repo: string, options?: {
+    file_pattern?: string;
+    checks?: string[];
+}): Promise<PhpSecurityScanResult>;
+//# sourceMappingURL=php-security-tools.d.ts.map

package/dist/tools/php-security-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-security-tools.d.ts","sourceRoot":"","sources":["../../src/tools/php-security-tools.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAyCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACrD,OAAO,CAAC,qBAAqB,CAAC,CA6DhC"}

package/dist/tools/php-security-tools.js

@@ -0,0 +1,172 @@
+/**
+ * PHP/Yii2-specific code intelligence tools.
+ *
+ * Implementation module extracted from the legacy php-tools facade.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getCodeIndex } from "./index-tools.js";
+import { BUILTIN_PATTERNS, searchPatterns } from "./pattern-tools.js";
+const PHP_SECURITY_CHECKS = [
+    // Original 8 checks
+    { pattern: "sql-injection-php", severity: "critical" },
+    { pattern: "xss-php", severity: "critical" },
+    { pattern: "eval-php", severity: "critical" },
+    { pattern: "exec-php", severity: "critical" },
+    { pattern: "unserialize-php", severity: "high" },
+    { pattern: "file-include-var", severity: "high" },
+    { pattern: "unescaped-yii-view", severity: "high" },
+    { pattern: "raw-query-yii", severity: "high" },
+    // Sprint 2 additions: Yii2- + PHP-specific patterns informed by tgm-panel
+    // db-audit + perf-audit findings, plus the gap analysis section 4 catalog.
+    { pattern: "yii-csrf-disabled", severity: "high" },
+    { pattern: "yii-debug-mode-prod", severity: "critical" },
+    { pattern: "yii-cookie-no-validation", severity: "high" },
+    { pattern: "yii-mass-assignment-unsafe", severity: "medium" },
+    { pattern: "yii-raw-sql-where", severity: "high" },
+    { pattern: "php-md5-password", severity: "high" },
+    { pattern: "php-rand-token", severity: "high" },
+    { pattern: "php-loose-comparison-secret", severity: "medium" },
+    { pattern: "yii-rbac-cached-permission", severity: "low" },
+    { pattern: "yii-no-row-level-locking", severity: "high" },
+    { pattern: "yii-config-hardcoded-secret", severity: "critical" },
+    { pattern: "yii-unbounded-all", severity: "medium" },
+];
+/**
+ * Patterns that hit code at module level (top-level `return [...]`,
+ * top-level `define(...)` calls in entry-point files) and therefore are
+ * NOT visible via `searchPatterns` — that helper iterates `index.symbols`,
+ * so files without any class/function/method produce zero hits. We scan
+ * these patterns by reading file content directly.
+ */
+const FILE_LEVEL_PATTERNS = new Set([
+    "yii-debug-mode-prod",
+    "yii-cookie-no-validation",
+    "yii-config-hardcoded-secret",
+]);
+export async function phpSecurityScan(repo, options) {
+    const selectedChecks = options?.checks
+        ? PHP_SECURITY_CHECKS.filter((c) => options.checks.includes(c.pattern))
+        : PHP_SECURITY_CHECKS;
+    const findings = [];
+    const summary = { critical: 0, high: 0, medium: 0, low: 0, total: 0 };
+    // Symbol-level scans run via the existing searchPatterns helper. Skip the
+    // file-level patterns here — they're handled below by a direct file read.
+    const symbolLevelChecks = selectedChecks.filter((c) => !FILE_LEVEL_PATTERNS.has(c.pattern));
+    const fileLevelChecks = selectedChecks.filter((c) => FILE_LEVEL_PATTERNS.has(c.pattern));
+    // Run pattern checks in parallel
+    const results = await Promise.all(symbolLevelChecks.map((check) => searchPatterns(repo, check.pattern, {
+        file_pattern: options?.file_pattern ?? ".php",
+        include_tests: false,
+    }).then((r) => ({ check, result: r })).catch(() => null)));
+    for (const res of results) {
+        if (!res)
+            continue;
+        for (const m of res.result.matches) {
+            findings.push({
+                severity: res.check.severity,
+                pattern: res.check.pattern,
+                file: m.file,
+                line: m.start_line,
+                context: m.context,
+                description: "", // description populated by searchPatterns but not in PatternMatch type
+            });
+            summary[res.check.severity]++;
+            summary.total++;
+        }
+    }
+    // File-level scan: read every PHP file once, run each file-level pattern
+    // against it. This catches top-level `define('YII_DEBUG', true)` and
+    // hardcoded literals in `return [...]` config arrays which never live
+    // inside a class or function.
+    if (fileLevelChecks.length > 0) {
+        const fileFindings = await runFileLevelChecks(repo, fileLevelChecks, options?.file_pattern);
+        for (const f of fileFindings) {
+            findings.push(f);
+            summary[f.severity]++;
+            summary.total++;
+        }
+    }
+    return {
+        findings,
+        summary,
+        checks_run: selectedChecks.map((c) => c.pattern),
+    };
+}
+async function runFileLevelChecks(repo, checks, filePattern) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        return [];
+    const out = [];
+    const phpFiles = index.files.filter((f) => {
+        if (!f.path.endsWith(".php"))
+            return false;
+        if (filePattern && !f.path.includes(filePattern))
+            return false;
+        return true;
+    });
+    // Pull each pattern definition up-front. We want one regex object per
+    // check, not per file, to avoid re-compilation churn.
+    const compiled = checks
+        .map((check) => {
+        const def = BUILTIN_PATTERNS[check.pattern];
+        if (!def)
+            return null;
+        // Re-create the regex with /g so we can iterate matches across the
+        // whole file content. Built-in patterns are stored without /g because
+        // searchPatterns calls .exec() once per symbol.
+        const flags = (def.regex.flags.includes("g") ? "" : "g") + def.regex.flags;
+        return {
+            check,
+            regex: new RegExp(def.regex.source, flags),
+            fileIncludePattern: def.fileIncludePattern,
+            fileExcludePattern: def.fileExcludePattern,
+        };
+    })
+        .filter((c) => c !== null);
+    await Promise.all(phpFiles.map(async (file) => {
+        let content;
+        try {
+            content = await readFile(join(index.root, file.path), "utf-8");
+        }
+        catch {
+            return;
+        }
+        for (const c of compiled) {
+            if (c.fileIncludePattern && !c.fileIncludePattern.test(file.path))
+                continue;
+            if (c.fileExcludePattern && c.fileExcludePattern.test(file.path))
+                continue;
+            c.regex.lastIndex = 0;
+            let m;
+            while ((m = c.regex.exec(content)) !== null) {
+                const line = countLines(content, m.index);
+                out.push({
+                    severity: c.check.severity,
+                    pattern: c.check.pattern,
+                    file: file.path,
+                    line,
+                    context: extractLine(content, m.index),
+                    description: "",
+                });
+            }
+        }
+    }));
+    return out;
+}
+function countLines(source, idx) {
+    let line = 1;
+    for (let i = 0; i < idx; i++) {
+        if (source.charCodeAt(i) === 10)
+            line++;
+    }
+    return line;
+}
+function extractLine(source, idx) {
+    const start = source.lastIndexOf("\n", idx) + 1;
+    const end = source.indexOf("\n", idx);
+    const out = source.slice(start, end === -1 ? source.length : end);
+    return out.trim().slice(0, 200);
+}
+// ---------------------------------------------------------------------------
+//# sourceMappingURL=php-security-tools.js.map