devassist-agent 1.0.0

package/src/modules/dev-time/code-quality-guard.js

@@ -0,0 +1,1340 @@
+/**
+ * CodeQualityGuard - static code analysis rules.
+ *
+ * Defense target: "Code defects" (33% of 88 failures).
+ *   #4  - race condition in bindAppEvents (timing dependency)
+ *   #5  - getElementById vs querySelector confusion
+ *   #6  - no defensive programming (3 null checks missing → app crash)
+ *
+ * This module uses regex + simple AST-like analysis (no external deps)
+ * to catch the most common code quality issues.
+ */
+
+const path = require('path');
+const { Logger } = require('../../core/logger');
+const log = new Logger('CodeQualityGuard');
+
+/**
+ * @typedef {Object} Rule
+ * @property {string} id
+ * @property {string} severity - block | warn | info
+ * @property {string} category
+ * @property {function} check - (ctx) => Finding | Finding[] | null
+ */
+
+// --- Individual rules ---
+
+/**
+ * Rule: Detect getElementById used with class selectors (failure #5)
+ * The report showed code like: document.getElementById('some-class-name')
+ * when the element actually had a class, not an id.
+ */
+const rule_id_class_confusion = {
+  id: 'cq-id-class-confusion',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx|html)$/.test(file.path)) continue;
+      // Pattern: getElementById('.something') — using a dot (class selector) in getElementById
+      const regex = /getElementById\s*\(\s*['"`]\s*\./g;
+      let match;
+      while ((match = regex.exec(file.content)) !== null) {
+        const line = file.content.substring(0, match.index).split('\n').length;
+        findings.push({
+          severity: 'warn',
+          message: `getElementById 使用了类选择器（应使用 querySelector 或真实 ID）`,
+          file: file.path,
+          line,
+          suggestion: `改用 document.querySelector('.classname')，或确认元素确实有 id 属性`,
+        });
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: Detect missing null checks before property access (failure #6)
+ * Pattern: obj.property.method() without checking obj exists first.
+ */
+const rule_null_safety = {
+  id: 'cq-null-safety',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const content = file.content;
+
+      // Detect chains like: data.response.result.someMethod()
+      // without prior null check — common in the 88-failure report
+      const lines = content.split('\n');
+      lines.forEach((line, i) => {
+        // Skip lines that already have optional chaining or null checks
+        if (/\?\./.test(line) || /if\s*\(.*null/.test(line) || /if\s*\(.*undefined/.test(line)) return;
+        // Detect deep property access chains (3+ levels) without null safety
+        const chainMatch = line.match(/(\w+\.){3,}\w+\s*\(/);
+        if (chainMatch) {
+          // Check if there's a null check within 3 lines above
+          const context = lines.slice(Math.max(0, i - 3), i).join('\n');
+          if (!/null|undefined|if\s*\(/.test(context)) {
+            findings.push({
+              severity: 'warn',
+              message: `深层属性链未做空值检查：${chainMatch[0].trim()}`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `使用可选链操作符（?.）或在访问嵌套属性前显式判空`,
+            });
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: Detect missing try/catch around async operations (failure #6)
+ */
+const rule_missing_trycatch = {
+  id: 'cq-missing-trycatch',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        // Detect await without surrounding try/catch
+        if (/\bawait\b/.test(line)) {
+          const context = lines.slice(Math.max(0, i - 5), i + 1).join('\n');
+          if (!/try\s*\{/.test(context) && !/\.catch\s*\(/.test(line) && !/\.then\s*\(/.test(line)) {
+            findings.push({
+              severity: 'info',
+              message: `await 未被 try/catch 或 .catch() 包裹`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `用 try/catch 包裹 await，或添加 .catch() 处理可能的 Promise 拒绝`,
+            });
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: Detect potential race conditions in event binding (failure #4)
+ * Pattern: bindAppEvents called before DOM is ready
+ */
+const race_condition = {
+  id: 'cq-race-condition',
+  severity: 'block',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx|html)$/.test(file.path)) continue;
+      const content = file.content;
+
+      // Pattern: addEventListener or event binding before DOMContentLoaded
+      const hasEarlyBinding = /addEventListener|\.on\s*\(/.test(content.split('DOMContentLoaded')[0] || content);
+      const hasDOMContentLoaded = /DOMContentLoaded/.test(content);
+      const isModule = /document\./.test(content);
+
+      if (hasEarlyBinding && hasDOMContentLoaded && isModule) {
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (/addEventListener|\.on\s*\(/.test(lines[i])) {
+            const beforeContent = lines.slice(0, i).join('\n');
+            if (!/DOMContentLoaded|document\.ready|\$\(document\)\.ready/.test(beforeContent)) {
+              findings.push({
+                severity: 'block',
+                message: `在 DOMContentLoaded 之前绑定事件——存在竞态条件风险`,
+                file: file.path,
+                line: i + 1,
+                suggestion: `将事件绑定移到 DOMContentLoaded 回调中，或确保 DOM 已就绪后再绑定`,
+              });
+              break; // one per file
+            }
+          }
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: Detect duplicate variable declarations (failure #8)
+ * Only flags `var` redeclarations (same function scope) — let/const in
+ * different blocks are legal and not a bug. Also skips common generic names
+ * that legitimately appear in different functions.
+ */
+const COMMON_NAMES = new Set(['i', 'j', 'k', 'n', 'x', 'y', 'err', 'error', 'e',
+  'file', 'content', 'data', 'result', 'findings', 'lines', 'match', 'line',
+  'entry', 'entries', 'dir', 'full', 'path', 'name', 'value', 'key', 'item',
+  'fn', 'cb', 'req', 'res', 'ctx', 'config', 'options', 'obj', 'arr',
+  'manifest', 'backupPath', 'rel', 'node', 'findings', 'stats', 'conv',
+  'report', 'list', 'handler', 'destDir', 'fullDir', 'fullPath', 'content',
+  'systemPrompt', 'userPrompt', 'provider', 'body', 'response', 'portMatch',
+  'existing', 'variants', 'duplicates', 'declarations', 'exportRegex',
+  'fileEntry', 'manifestPath', 'dirs', 'files',
+]);
+
+const duplicate_declaration = {
+  id: 'cq-duplicate-declaration',
+  severity: 'block',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const content = file.content;
+
+      // Only check `var` redeclarations — these share function scope and are real bugs
+      // let/const in different blocks are perfectly valid
+      const varRegex = /\bvar\s+(\w+)/g;
+      const varDecls = new Map();
+      let match;
+      while ((match = varRegex.exec(content)) !== null) {
+        const name = match[1];
+        if (COMMON_NAMES.has(name)) continue;
+        const line = content.substring(0, match.index).split('\n').length;
+        if (varDecls.has(name)) {
+          const prev = varDecls.get(name);
+          findings.push({
+            severity: 'block',
+            message: `重复的 'var' 声明：'${name}'（在第 ${prev} 行也已声明）`,
+            file: file.path,
+            line,
+            suggestion: `重命名变量或改用 let/const 进行块级作用域声明`,
+          });
+        } else {
+          varDecls.set(name, line);
+        }
+      }
+
+      // Also check for function redeclarations (same name, two function statements)
+      const funcRegex = /\bfunction\s+(\w+)\s*\(/g;
+      const funcDecls = new Map();
+      while ((match = funcRegex.exec(content)) !== null) {
+        const name = match[1];
+        const line = content.substring(0, match.index).split('\n').length;
+        if (funcDecls.has(name)) {
+          const prev = funcDecls.get(name);
+          findings.push({
+            severity: 'block',
+            message: `重复的函数声明：'${name}'（在第 ${prev} 行也已声明）`,
+            file: file.path,
+            line,
+            suggestion: `重命名其中一个函数——重复的函数声明会静默覆盖彼此`,
+          });
+        } else {
+          funcDecls.set(name, line);
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: File too large — module boundary guard (failure #9, over-engineering)
+ */
+const file_too_large = {
+  id: 'cq-file-too-large',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    const maxLines = (ctx.config && ctx.config.maxFileLines) || 800;
+    for (const file of ctx.files) {
+      if (!file.content) continue;
+      const lines = file.content.split('\n').length;
+      if (lines > maxLines) {
+        findings.push({
+          severity: 'warn',
+          message: `文件共 ${lines} 行（上限 ${maxLines} 行）——建议拆分`,
+          file: file.path,
+          line: 1,
+          suggestion: `拆分为更小的模块。88条故障报告显示 app.js 膨胀至 2720 行后，AI 误覆盖为 106 行。`,
+        });
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+// ========== Phase 3 新增规则（基于88条故障报告扩展）==========
+
+/**
+ * Rule: API 响应命名不一致检测（故障 #1 根因：data.list vs data.items vs data.records）
+ * 88条故障中32条与"AI遗忘早期约定"有关，最典型的就是列表键名漂移。
+ * 当同一项目中出现多种列表键名时，标记为 BLOCK。
+ */
+const api_response_naming = {
+  id: 'cq-api-naming-drift',
+  severity: 'block',
+  category: 'convention',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    const listKeyVariants = new Map(); // key -> [{file, line}]
+
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const content = file.content;
+
+      // Detect common list key patterns: data.items, data.records, data.list, data.rows, data.results
+      // Match both assignment (data.items =) and access (data.items.map, data.items[)
+      const patterns = [
+        { regex: /\.(items)\s*[=:[.]/g, key: 'items' },
+        { regex: /\.(records)\s*[=:[.]/g, key: 'records' },
+        { regex: /\.(list)\s*[=:[.]/g, key: 'list' },
+        { regex: /\.(rows)\s*[=:[.]/g, key: 'rows' },
+        { regex: /\.(results)\s*[=:[.]/g, key: 'results' },
+      ];
+
+      for (const { regex, key } of patterns) {
+        let match;
+        const re = new RegExp(regex.source, regex.flags);
+        while ((match = re.exec(content)) !== null) {
+          // Only match data.xxx or response.xxx patterns (skip variable declarations)
+          const beforeMatch = content.substring(Math.max(0, match.index - 20), match.index);
+          if (/data|response|res|result/i.test(beforeMatch)) {
+            if (!listKeyVariants.has(key)) listKeyVariants.set(key, []);
+            const line = content.substring(0, match.index).split('\n').length;
+            listKeyVariants.get(key).push({ file: file.path, line });
+          }
+        }
+      }
+    }
+
+    // If 2+ different key variants are used, flag all
+    if (listKeyVariants.size >= 2) {
+      const variants = [...listKeyVariants.keys()].join(' / ');
+      for (const [key, locations] of listKeyVariants) {
+        for (const loc of locations.slice(0, 3)) { // limit to 3 per key
+          findings.push({
+            severity: 'block',
+            message: `API 列表键名不一致：项目中同时使用了 ${variants}（当前：${key}）`,
+            file: loc.file,
+            line: loc.line,
+            suggestion: `统一使用一种键名（推荐 data.list）。运行 devassist convention add --id naming-list-key --rule "使用 data.list" --severity block 来强制约定`,
+            context: { variants: [...listKeyVariants.keys()], currentKey: key },
+          });
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: fetch/XHR 缺少错误处理（故障 #6：防御性编程缺失）
+ * 未处理的 fetch 调用会导致网络错误时应用崩溃。
+ */
+const fetch_no_catch = {
+  id: 'cq-fetch-no-catch',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        // Detect fetch() call
+        if (/\bfetch\s*\(/.test(line)) {
+          // Check if there's .catch() on the same line or next few lines
+          const context = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+          const hasCatch = /\.catch\s*\(/.test(context);
+          const hasAwait = /\bawait\b/.test(line);
+          const hasTryCatch = /try\s*\{/.test(lines.slice(Math.max(0, i - 5), i + 1).join('\n'));
+
+          if (!hasCatch && !(hasAwait && hasTryCatch)) {
+            findings.push({
+              severity: 'warn',
+              message: `fetch 调用缺少错误处理——网络错误时可能导致未捕获的 Promise 拒绝`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `添加 .catch() 处理器，或用 try/catch 包裹 await fetch()`,
+            });
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 硬编码配置值检测（故障 #1, #3, #13：端口/路径/URL硬编码导致部署问题）
+ * 端口号、API URL、文件路径不应硬编码在代码中。
+ */
+const hardcoded_config = {
+  id: 'cq-hardcoded-config',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      // Skip config files themselves
+      if (/config|\.config\.|env/i.test(file.path)) continue;
+
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        // Skip comments
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+
+        // Detect hardcoded port: :8080, :3000, :5000 etc (but not in comments or strings like "8080px")
+        const portMatch = line.match(/['":\s](\d{4,5})\b(?!\s*(px|em|rem|%|ms|s))/);
+        if (portMatch && /^(80|443|3000|5000|8000|8080|8443|8888|9090)$/.test(portMatch[1])) {
+          // Skip if it's clearly a variable assignment to a config object
+          if (!/process\.env|config|PORT/.test(line)) {
+            findings.push({
+              severity: 'warn',
+              message: `疑似硬编码端口：${portMatch[1]}（应使用环境变量或配置文件）`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `使用 process.env.PORT 或配置文件管理端口号。故障 #1 中 supervisord 占用 8080 导致应用无法启动。`,
+            });
+          }
+        }
+
+        // Detect hardcoded http URL (not localhost in dev)
+        const urlMatch = line.match(/['"]https?:\/\/(?!localhost|127\.0\.0\.1)[^'"]+/);
+        if (urlMatch && !/import|require|sourceMappingURL/.test(line)) {
+          findings.push({
+            severity: 'info',
+            message: `疑似硬编码 URL：${urlMatch[0].slice(0, 50)}...（考虑使用配置管理）`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `将 API URL 移到配置文件或环境变量中，避免环境切换时遗漏`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: console.log 残留检测（故障 #8：调试代码残留导致信息泄漏）
+ * 生产代码中不应保留 console.log 调试输出。
+ */
+const console_log_residual = {
+  id: 'cq-console-log',
+  severity: 'info',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      // Skip logger files and test files
+      if (/logger|test|spec|__test/.test(file.path)) continue;
+
+      const lines = file.content.split('\n');
+      let logCount = 0;
+      lines.forEach((line, i) => {
+        // Skip comments
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Detect console.log (but not console.error/warn/info which are intentional)
+        if (/console\.log\s*\(/.test(line)) {
+          logCount++;
+          if (logCount <= 5) { // limit findings per file
+            findings.push({
+              severity: 'info',
+              message: `console.log 残留——生产代码应使用正式日志模块`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `移除调试日志，或替换为 Logger 模块的 log.debug() 调用`,
+            });
+          }
+        }
+      });
+      if (logCount > 5) {
+        findings.push({
+          severity: 'warn',
+          message: `文件中有 ${logCount} 处 console.log（过多调试日志）`,
+          file: file.path,
+          line: 1,
+          suggestion: `批量清理 console.log，改用统一日志模块。过多的调试输出会影响性能和安全性。`,
+        });
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: async 函数调用缺少 await（故障 #6：异步时序问题）
+ * 调用 async 函数但不 await 会导致 Promise 被丢弃，错误被吞没。
+ */
+const missing_await = {
+  id: 'cq-missing-await',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+
+      lines.forEach((line, i) => {
+        // Skip comments
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Skip lines that already have await
+        if (/\bawait\b/.test(line)) return;
+
+        // Detect common async function calls without await:
+        // - function names starting with get/fetch/load/init/save/update/delete + camelCase
+        const asyncCallMatch = line.match(/\b(get|fetch|load|init|save|update|delete|create|remove|send|post|put)\w+\s*\(/);
+        if (asyncCallMatch) {
+          // Check if it's a standalone call (not assigned to a variable, not in a condition)
+          const trimmed = line.trim();
+          // Skip if it's part of an assignment or condition (those usually handle the promise)
+          if (/^\s*(const|let|var|if|while|return|throw)/.test(trimmed)) return;
+          // Skip if followed by .then or .catch
+          if (/\.then\s*\(|\.catch\s*\(|\.finally\s*\(/.test(line)) return;
+
+          findings.push({
+            severity: 'warn',
+            message: `疑似 async 函数调用缺少 await：${asyncCallMatch[0].replace(/\($/, '')}`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `如果该函数返回 Promise，请添加 await。未 await 的 Promise 会被丢弃，错误不会传播。`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 事件监听无清理检测（故障 #4：竞态条件和内存泄漏）
+ * addEventListener 必须有对应的 removeEventListener，否则内存泄漏。
+ */
+const event_listener_leak = {
+  id: 'cq-event-listener-leak',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const content = file.content;
+
+      const addCount = (content.match(/addEventListener\s*\(/g) || []).length;
+      const removeCount = (content.match(/removeEventListener\s*\(/g) || []).length;
+
+      // If there are addEventListener calls but no removeEventListener
+      if (addCount > 0 && removeCount === 0) {
+        // Check if it's a short-lived page (unlikely to need cleanup)
+        const lineCount = content.split('\n').length;
+        if (lineCount > 100) {
+          // Find first addEventListener
+          const match = content.match(/addEventListener\s*\(/);
+          if (match) {
+            const line = content.substring(0, match.index).split('\n').length;
+            findings.push({
+              severity: 'warn',
+              message: `有 ${addCount} 处 addEventListener 但 0 处 removeEventListener——可能导致内存泄漏`,
+              file: file.path,
+              line,
+              suggestion: `在组件销毁/页面卸载时调用 removeEventListener 清理事件监听器。使用 AbortController 或在 destroy/cleanup 方法中统一移除。`,
+            });
+          }
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: TODO/FIXME/HACK 堆积检测（故障 #9：技术债务积累）
+ * 过多的 TODO 标记表示技术债务在积累，需要定期清理。
+ */
+const tech_debt_markers = {
+  id: 'cq-tech-debt-markers',
+  severity: 'info',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    const markerCounts = new Map(); // file -> count
+
+    for (const file of ctx.files) {
+      if (!file.content) continue;
+      const lines = file.content.split('\n');
+      let count = 0;
+      lines.forEach((line, i) => {
+        if (/\b(TODO|FIXME|HACK|XXX|WORKAROUND)\b/.test(line)) {
+          count++;
+        }
+      });
+      if (count >= 3) {
+        // Find first marker
+        for (let i = 0; i < lines.length; i++) {
+          if (/\b(TODO|FIXME|HACK|XXX|WORKAROUND)\b/.test(lines[i])) {
+            findings.push({
+              severity: 'info',
+              message: `文件中有 ${count} 处 TODO/FIXME/HACK 标记——技术债务在积累`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `运行 devassist debt --scan 查看技术债务看板，制定清理计划。88条故障中23条与重构成本过高有关。`,
+            });
+            break;
+          }
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 魔法数字检测（故障 #8：可维护性差）
+ * 代码中直接出现的硬编码数字（非0、非1、非常见索引）应定义为常量。
+ */
+const magic_numbers = {
+  id: 'cq-magic-numbers',
+  severity: 'info',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      // Skip config/test/constant files
+      if (/config|test|spec|constant|threshold/i.test(file.path)) continue;
+
+      const lines = file.content.split('\n');
+      let magicCount = 0;
+      lines.forEach((line, i) => {
+        // Skip comments, imports, requires
+        if (/^\s*(\/\/|\/\*|\*|import|const|require)/.test(line)) return;
+        // Skip lines with process.env, config, or named constants
+        if (/process\.env|config\.|MAX_|MIN_|DEFAULT_|TIMEOUT|INTERVAL/i.test(line)) return;
+
+        // Detect standalone numbers that aren't 0, 1, -1, or common array indices
+        const numMatch = line.match(/[^.\w](\d{3,})\b(?!\s*(px|em|rem|%|ms|s|\b))/);
+        if (numMatch) {
+          const num = parseInt(numMatch[1]);
+          // Skip common port-like numbers (handled by hardcoded_config) and HTTP status codes
+          if (num >= 100 && num <= 599 && /^(200|301|302|304|400|401|403|404|500|502|503)$/.test(String(num))) return;
+          magicCount++;
+          if (magicCount <= 3) {
+            findings.push({
+              severity: 'info',
+              message: `魔法数字：${num}（应定义为具名常量）`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `将 ${num} 提取为具名常量，如 const MAX_RETRY = ${num}，提高代码可读性和可维护性`,
+            });
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 错误响应格式不一致检测（故障 #6：错误处理不统一）
+ * 检测不同的错误响应结构：有的用 {code, msg}，有的用 {code, message}，有的用 {error: ...}
+ */
+const error_format_inconsistency = {
+  id: 'cq-error-format-drift',
+  severity: 'warn',
+  category: 'convention',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    const formats = new Map(); // format type -> [{file, line}]
+
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const content = file.content;
+
+      // Detect error response patterns
+      const patterns = [
+        { regex: /code\s*:\s*\d{3}.*msg\s*:/g, type: 'code+msg' },
+        { regex: /code\s*:\s*\d{3}.*message\s*:/g, type: 'code+message' },
+        { regex: /error\s*:\s*['"`]/g, type: 'error:string' },
+        { regex: /success\s*:\s*false/g, type: 'success:boolean' },
+        { regex: /status\s*:\s*['"`](error|fail)/g, type: 'status:string' },
+      ];
+
+      for (const { regex, type } of patterns) {
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(content)) !== null) {
+          if (!formats.has(type)) formats.set(type, []);
+          const line = content.substring(0, match.index).split('\n').length;
+          formats.get(type).push({ file: file.path, line });
+        }
+      }
+    }
+
+    // If 2+ different error formats are used
+    if (formats.size >= 2) {
+      const allFormats = [...formats.keys()].join(' / ');
+      for (const [type, locations] of formats) {
+        for (const loc of locations.slice(0, 2)) {
+          findings.push({
+            severity: 'warn',
+            message: `错误响应格式不一致：项目中同时使用了 ${allFormats}（当前：${type}）`,
+            file: loc.file,
+            line: loc.line,
+            suggestion: `统一错误响应格式（推荐 { code: number, msg: string, data: any }）。运行 devassist convention add --id error-format --rule "统一使用 code+msg 格式" 来强制约定`,
+            context: { allFormats, currentType: type },
+          });
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 文件大幅缩减检测（故障 #1 根因：AI 覆盖文件）
+ * 如果代码中出现 fs.writeFile 写入一个大字符串常量到文件，可能是 AI 在覆盖整个文件。
+ */
+const dangerous_file_overwrite = {
+  id: 'cq-dangerous-overwrite',
+  severity: 'warn',
+  category: 'code-quality',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      const content = file.content;
+
+      // Detect fs.writeFileSync with a template literal or string concatenation > 500 chars
+      const writeMatch = content.match(/fs\.writeFileSync\s*\(\s*[^,]+,\s*([`'"])/);
+      if (writeMatch) {
+        const quote = writeMatch[1];
+        // Find the start of the writeFileSync call
+        const startIdx = writeMatch.index;
+        const line = content.substring(0, startIdx).split('\n').length;
+
+        // Check if it's writing a very large string literal
+        if (quote === '`') {
+          // Template literal - find matching backtick
+          const afterWrite = content.substring(writeMatch.index + writeMatch[0].length);
+          const endTick = afterWrite.indexOf('`');
+          if (endTick > 500) {
+            findings.push({
+              severity: 'warn',
+              message: `fs.writeFileSync 写入了大段模板字符串（${endTick} 字符）——疑似 AI 整体覆盖文件`,
+              file: file.path,
+              line,
+              suggestion: `避免用代码生成大段文件内容。88条故障中 AI 将 app.js 从 2720 行覆盖为 106 行是 #1 根因。`,
+            });
+          }
+        }
+      }
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+// ========== Phase 5 新增规则：安全漏洞 + 性能反模式 ==========
+
+// --- 安全漏洞检测 (Security) ---
+
+/**
+ * Rule: eval / Function 构造器使用（代码注入风险）
+ * eval() 和 new Function() 会执行任意代码，是最高危的安全漏洞。
+ */
+const sec_eval_usage = {
+  id: 'sec-eval-usage',
+  severity: 'block',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // eval( or new Function(
+        if (/\beval\s*\(/.test(line) || /\bnew\s+Function\s*\(/.test(line)) {
+          findings.push({
+            severity: 'block',
+            message: `eval/Function 构造器使用——存在代码注入风险`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `移除 eval/new Function，改用 JSON.parse 解析数据，或用 Map/查找表替代动态代码执行`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: SQL 注入风险——字符串拼接构建 SQL 语句
+ */
+const sec_sql_injection = {
+  id: 'sec-sql-injection',
+  severity: 'block',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Pattern: query(`SELECT ... ${var}`) or query('SELECT ...' + var)
+        const hasSQL = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b/i.test(line);
+        const hasInterp = /\$\{/.test(line) || (/\+\s*\w/.test(line) && /['"`]/.test(line));
+        const hasParam = /\$\d|placeholder|\?/.test(line);
+        if (hasSQL && hasInterp && !hasParam) {
+          findings.push({
+            severity: 'block',
+            message: `SQL 语句使用了字符串拼接——存在 SQL 注入风险`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `使用参数化查询：query('SELECT * FROM t WHERE id = ?', [id])，禁止直接拼接用户输入`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 硬编码密钥/密码/Token 检测
+ */
+const sec_hardcoded_secrets = {
+  id: 'sec-hardcoded-secrets',
+  severity: 'block',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    // Patterns that indicate hardcoded secrets
+    const secretPatterns = [
+      { regex: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{6,}['"]/i, label: '密码' },
+      { regex: /(?:secret|api[_-]?key|access[_-]?key)\s*[:=]\s*['"][^'"]{10,}['"]/i, label: 'API密钥' },
+      { regex: /(?:token|bearer)\s*[:=]\s*['"][^'"]{15,}['"]/i, label: 'Token' },
+      { regex: /(?:private[_-]?key)\s*[:=]\s*['"][^'"]{20,}['"]/i, label: '私钥' },
+      { regex: /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/, label: 'PEM私钥' },
+    ];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx|json|env)$/.test(file.path)) continue;
+      // Skip config templates and test files
+      if (/template|\.example|test|spec|\.env\.example/i.test(file.path)) continue;
+      // Skip ai-config.json (stores API keys by design)
+      if (/ai-config\.json$/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Skip env var references
+        if (/process\.env/.test(line)) return;
+        for (const { regex, label } of secretPatterns) {
+          const re = new RegExp(regex.source, 'i');
+          if (re.test(line)) {
+            findings.push({
+              severity: 'block',
+              message: `疑似硬编码${label}——密钥不应出现在源码中`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `将${label}移到环境变量或 .env 文件（加入 .gitignore），代码中通过 process.env 读取`,
+            });
+            break; // one per line
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 路径穿越风险——用户输入直接拼入文件路径
+ */
+const sec_path_traversal = {
+  id: 'sec-path-traversal',
+  severity: 'warn',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Pattern: path.join/resolve with req.body/req.params/req.query/userInput
+        const hasPathOp = /\bpath\.(join|resolve|normalize)\s*\(/.test(line);
+        const hasUserInput = /req\.(body|params|query|headers)|userInput|userInput|filename|filepath/i.test(line);
+        const hasSanitize = /sanitize|normalize|replace\(\.\./.test(line);
+        if (hasPathOp && hasUserInput && !hasSanitize) {
+          findings.push({
+            severity: 'warn',
+            message: `文件路径包含用户输入——存在路径穿越风险`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `对用户输入的路径做 sanitize：移除 ../ 和绝对路径前缀，或用 path.relative 验证最终路径在允许范围内`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 命令注入风险——exec/spawn 使用字符串拼接
+ */
+const sec_command_injection = {
+  id: 'sec-command-injection',
+  severity: 'block',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // exec(`cmd ${var}`) or execSync('cmd ' + var)
+        const hasExec = /\b(exec|execSync|spawn|spawnSync)\s*\(/.test(line);
+        const hasInterp = /\$\{/.test(line) || (/\+\s*\w/.test(line) && /['"`]/.test(line));
+        const hasArrayForm = /\[\s*\]/.test(line); // spawn with array args is safe
+        if (hasExec && hasInterp && !hasArrayForm) {
+          findings.push({
+            severity: 'block',
+            message: `exec/spawn 使用字符串拼接——存在命令注入风险`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `使用 execFile/spawn 的数组参数形式：spawn('cmd', [arg1, arg2])，禁止字符串拼接 shell 命令`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 不安全加密——弱哈希算法 / 弱随机数
+ */
+const sec_insecure_crypto = {
+  id: 'sec-insecure-crypto',
+  severity: 'warn',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // MD5 / SHA1 for password hashing
+        if (/\bcreateHash\s*\(\s*['"`](md5|sha1)['"`]/.test(line)) {
+          findings.push({
+            severity: 'warn',
+            message: `使用了弱哈希算法 (MD5/SHA1)——不适用于密码存储`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `密码存储使用 bcrypt/scrypt/argon2，数据校验使用 SHA-256+。MD5/SHA1 已被证明不安全`,
+          });
+        }
+        // Math.random() for security purposes
+        if (/Math\.random\s*\(/.test(line) && /token|secret|key|password|id|nonce/i.test(line)) {
+          findings.push({
+            severity: 'warn',
+            message: `Math.random() 用于安全场景——密码学不安全的随机数`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `安全场景使用 crypto.randomBytes() 或 crypto.randomUUID()，Math.random() 不是密码学安全的`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: XSS 风险——innerHTML / document.write 使用用户输入
+ */
+const sec_xss_risk = {
+  id: 'sec-xss-risk',
+  severity: 'block',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx|html)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // innerHTML = userInput or document.write(userInput)
+        const hasSink = /\.innerHTML\s*=|document\.write\s*\(/.test(line);
+        const hasUserInput = /req\.(body|params|query)|userInput|location\.(search|hash)|innerHTML/i.test(line);
+        const hasEscape = /escape|sanitize|encode|textContent|DOMPurify/i.test(line);
+        if (hasSink && !hasEscape) {
+          findings.push({
+            severity: 'block',
+            message: `innerHTML/document.write 直接赋值——存在 XSS 风险`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `使用 textContent 替代 innerHTML，或对用户输入做 HTML 转义（&lt; &gt; &amp; &quot;）`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 原型链污染——Object.assign / merge with 用户输入
+ */
+const sec_proto_pollution = {
+  id: 'sec-proto-pollution',
+  severity: 'warn',
+  category: 'security',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Object.assign({}, req.body) or deep merge with user input
+        const hasMerge = /Object\.assign\s*\(|\bmerge\s*\(|\bextend\s*\(/.test(line);
+        const hasUserInput = /req\.(body|params|query)|JSON\.parse|userInput/i.test(line);
+        const hasProtect = /Object\.create\(null\)|\.__proto__|hasOwnProperty/.test(line);
+        if (hasMerge && hasUserInput && !hasProtect) {
+          findings.push({
+            severity: 'warn',
+            message: `Object.assign/merge 使用用户输入——存在原型链污染风险`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `过滤 __proto__ 和 constructor 键名，或使用 Object.create(null) 创建安全对象`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+// --- 性能反模式检测 (Performance) ---
+
+/**
+ * Rule: 异步上下文中的同步 I/O——阻塞事件循环
+ */
+const perf_sync_io_in_async = {
+  id: 'perf-sync-io-in-async',
+  severity: 'warn',
+  category: 'performance',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      let inAsync = false;
+      let asyncStartLine = 0;
+      lines.forEach((line, i) => {
+        // Track async function context
+        const asyncMatch = line.match(/\basync\s+(function\s+)?\w*\s*\(|async\s+=>/);
+        if (asyncMatch) { inAsync = true; asyncStartLine = i; }
+        if (inAsync && /^\}/.test(line.trim())) inAsync = false;
+
+        if (!inAsync) return;
+        // fs.readFileSync / fs.writeFileSync inside async function
+        if (/\bfs\.(readFileSync|writeFileSync|existsSync|statSync|readdirSync|unlinkSync|mkdirSync)\s*\(/.test(line)) {
+          findings.push({
+            severity: 'warn',
+            message: `异步函数中使用同步 I/O（${line.match(/fs\.(\w+Sync)/)?.[1] || 'Sync'}）——阻塞事件循环`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `改用异步版本：fs.promises.readFile / fs.promises.writeFile，避免阻塞 Node.js 事件循环`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 循环中的 await——N+1 查询模式
+ */
+const perf_n_plus_1 = {
+  id: 'perf-n-plus-1',
+  severity: 'warn',
+  category: 'performance',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      let inLoop = false;
+      let loopStartLine = 0;
+      lines.forEach((line, i) => {
+        // Track loop context
+        if (/\b(for|while)\s*\(/.test(line)) { inLoop = true; loopStartLine = i; }
+        if (inLoop && /^\s*\}/.test(line)) inLoop = false;
+
+        if (!inLoop) return;
+        // await inside loop
+        if (/\bawait\b/.test(line)) {
+          // Check if it's a Promise.all pattern (which is OK)
+          const context = lines.slice(loopStartLine, i + 1).join('\n');
+          if (/Promise\.all|map\s*\(\s*async/.test(context)) return;
+          findings.push({
+            severity: 'warn',
+            message: `循环内使用 await——N+1 查询模式，性能瓶颈`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `用 Promise.all 批量并行请求，或改为批量查询：const results = await Promise.all(items.map(fetchItem))`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 字符串拼接循环——应使用数组 join
+ */
+const perf_string_concat_loop = {
+  id: 'perf-string-concat-loop',
+  severity: 'info',
+  category: 'performance',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      let inLoop = false;
+      let loopStartLine = 0;
+      lines.forEach((line, i) => {
+        if (/\b(for|while)\s*\(/.test(line)) { inLoop = true; loopStartLine = i; }
+        if (inLoop && /^\s*\}/.test(line)) inLoop = false;
+        if (!inLoop) return;
+        // str += ... inside loop
+        if (/(\w+)\s*\+=\s*['"`]/.test(line) || /(\w+)\s*=\s*\w+\s*\+\s*['"`]/.test(line)) {
+          findings.push({
+            severity: 'info',
+            message: `循环内字符串拼接——每次拼接都创建新字符串，O(n²) 复杂度`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `用数组收集后 join：const parts = []; loop { parts.push(str) } result = parts.join('')`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 循环内重复编译正则表达式
+ */
+const perf_regex_in_loop = {
+  id: 'perf-regex-in-loop',
+  severity: 'info',
+  category: 'performance',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      let inLoop = false;
+      lines.forEach((line, i) => {
+        if (/\b(for|while)\s*\(/.test(line)) { inLoop = true; }
+        if (inLoop && /^\s*\}/.test(line)) inLoop = false;
+        if (!inLoop) return;
+        // new RegExp( inside loop
+        if (/\bnew\s+RegExp\s*\(/.test(line)) {
+          findings.push({
+            severity: 'info',
+            message: `循环内 new RegExp()——每次迭代都重新编译正则`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `将正则声明移到循环外部：const re = /pattern/g; 然后在循环内使用 re.test()`,
+          });
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: JSON.parse 缺少校验——解析失败会导致崩溃
+ */
+const perf_json_parse_unsafe = {
+  id: 'perf-json-parse-unsafe',
+  severity: 'warn',
+  category: 'performance',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // JSON.parse without try/catch
+        if (/\bJSON\.parse\s*\(/.test(line)) {
+          const context = lines.slice(Math.max(0, i - 3), i + 1).join('\n');
+          if (!/try\s*\{|catch/.test(context)) {
+            findings.push({
+              severity: 'warn',
+              message: `JSON.parse 未被 try/catch 包裹——解析失败会导致应用崩溃`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `用 try/catch 包裹 JSON.parse，或使用安全的解析函数：const safeParse = (s) => { try { return JSON.parse(s) } catch { return null } }`,
+            });
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+/**
+ * Rule: 大量数据同步处理——缺少分页/流式处理
+ */
+const perf_no_pagination = {
+  id: 'perf-no-pagination',
+  severity: 'warn',
+  category: 'performance',
+  check(ctx) {
+    if (!ctx.files) return null;
+    const findings = [];
+    for (const file of ctx.files) {
+      if (!file.content || !/\.(js|ts|jsx|tsx)$/.test(file.path)) continue;
+      if (/node_modules|[\/\\](tests?|specs?)[\/\\]/.test(file.path)) continue;
+      const lines = file.content.split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\/\/|\/\*|\*)/.test(line)) return;
+        // Pattern: SELECT * without LIMIT, or .find() without .limit()
+        const hasSelectAll = /\bSELECT\s+\*/i.test(line);
+        const hasNoLimit = !/\bLIMIT\b/i.test(line);
+        const hasNoOffset = !/\bOFFSET\b/i.test(line);
+        if (hasSelectAll && hasNoLimit) {
+          findings.push({
+            severity: 'warn',
+            message: `SELECT * 无 LIMIT——全表扫描可能导致内存溢出`,
+            file: file.path,
+            line: i + 1,
+            suggestion: `添加分页：SELECT * FROM t LIMIT 20 OFFSET 0，或使用游标分页`,
+          });
+        }
+        // .find() / .findAll() without .limit()
+        if (/\.(find|findAll|selectAll)\s*\(/.test(line) && !/\.limit\s*\(/.test(lines.slice(i, Math.min(i + 5, lines.length)).join('\n'))) {
+          // Only flag if it looks like a DB query (has await or model reference)
+          if (/\bawait\b/.test(line) || /Model|model|repository|repo/i.test(line)) {
+            findings.push({
+              severity: 'warn',
+              message: `查询无 limit()——大量数据时可能导致内存溢出`,
+              file: file.path,
+              line: i + 1,
+              suggestion: `添加分页：Model.find(filter).limit(20).skip(offset)`,
+            });
+          }
+        }
+      });
+    }
+    return findings.length > 0 ? findings : null;
+  }
+};
+
+// Export all rules for registration
+const codeQualityRules = [
+  // 原有规则
+  rule_id_class_confusion,
+  rule_null_safety,
+  rule_missing_trycatch,
+  race_condition,
+  duplicate_declaration,
+  file_too_large,
+  // Phase 3 新增规则（基于88条故障扩展）
+  api_response_naming,         // API 响应键名漂移（32/88 约定遗忘根因）
+  fetch_no_catch,              // fetch 缺少错误处理（6/88 防御性编程）
+  hardcoded_config,            // 硬编码配置值（1,3,13/88 部署问题）
+  console_log_residual,        // console.log 残留
+  missing_await,               // async 调用缺少 await
+  event_listener_leak,         // 事件监听无清理（4/88 竞态条件）
+  tech_debt_markers,           // TODO/FIXME 堆积（23/88 重构成本）
+  magic_numbers,               // 魔法数字
+  error_format_inconsistency,  // 错误响应格式不一致
+  dangerous_file_overwrite,    // 危险文件覆盖（41/88 局部优化根因）
+  // Phase 5 新增：安全漏洞检测
+  sec_eval_usage,              // eval/Function 代码注入
+  sec_sql_injection,           // SQL 注入
+  sec_hardcoded_secrets,       // 硬编码密钥/密码
+  sec_path_traversal,          // 路径穿越
+  sec_command_injection,       // 命令注入
+  sec_insecure_crypto,         // 不安全加密
+  sec_xss_risk,                // XSS 风险
+  sec_proto_pollution,         // 原型链污染
+  // Phase 5 新增：性能反模式检测
+  perf_sync_io_in_async,       // 异步中同步 I/O
+  perf_n_plus_1,               // N+1 查询
+  perf_string_concat_loop,     // 循环内字符串拼接
+  perf_regex_in_loop,          // 循环内编译正则
+  perf_json_parse_unsafe,      // JSON.parse 无 try/catch
+  perf_no_pagination,          // 无分页查询
+];
+
+module.exports = { codeQualityRules, CodeQualityGuard: { rules: codeQualityRules } };