eslint-plugin-ai-guard 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 eslint-plugin-ai-guard contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,166 @@
+<p align="center">
+  <h1 align="center">eslint-plugin-ai-guard</h1>
+  <p align="center">
+    <strong>🛡️ ESLint plugin that catches the code patterns AI tools get wrong most often.</strong>
+  </p>
+  <p align="center">
+    <a href="https://www.npmjs.com/package/eslint-plugin-ai-guard"><img src="https://img.shields.io/npm/v/eslint-plugin-ai-guard.svg?style=flat-square" alt="npm version"></a>
+    <a href="https://github.com/YashJadhav21/eslint-plugin-ai-guard/actions"><img src="https://img.shields.io/github/actions/workflow/status/YashJadhav21/eslint-plugin-ai-guard/ci.yml?style=flat-square&label=CI" alt="CI"></a>
+    <a href="https://www.npmjs.com/package/eslint-plugin-ai-guard"><img src="https://img.shields.io/npm/dm/eslint-plugin-ai-guard.svg?style=flat-square" alt="downloads"></a>
+    <a href="https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/eslint-plugin-ai-guard.svg?style=flat-square" alt="license"></a>
+  </p>
+</p>
+
+---
+
+AI-generated code has **1.7× more issues** and **2.74× more security vulnerabilities** than human code ([CodeRabbit 2025](https://www.coderabbit.ai/)). Existing linters catch human mistakes — `ai-guard` catches the patterns AI tools consistently get wrong: empty catch blocks, floating promises, async array misuse, and more.
+
+## Install
+
+```bash
+npm install --save-dev eslint-plugin-ai-guard
+```
+
+## Quick Start
+
+### ESLint 9 (Flat Config) — `eslint.config.js`
+
+```javascript
+import aiGuard from "eslint-plugin-ai-guard";
+
+export default [
+  {
+    plugins: { "ai-guard": aiGuard },
+    rules: { ...aiGuard.configs.recommended.rules }
+  }
+];
+```
+
+### ESLint 8 (Legacy Config) — `.eslintrc.json`
+
+```json
+{
+  "plugins": ["ai-guard"],
+  "extends": ["plugin:ai-guard/recommended"]
+}
+```
+
+That's it. **Zero configuration required.**
+
+## 🧪 Validated Against Real Repositories
+
+We tested `eslint-plugin-ai-guard` against two real-world codebases to ensure high signal-to-noise ratio:
+
+1. **Next.js Portfolio Website:** Found multiple un-escaped entities (caught by native plugins) but **0 false positives** on AI Guard rules, proving it respects human-written React/Next code.
+2. **CodeCrafters Admin Backend (Express):** Caught exactly the sort of generative flaws the plugin was designed for:
+   - **SQL Injections:** Flagged dynamic string templates used to build SQL queries (`ai-guard/no-sql-string-concat`).
+   - **Leaked Secrets:** Caught mock/test passwords (`process.env` equivalents not used) (`ai-guard/no-hardcoded-secret`).
+   - **O(n) Latency Issues:** Detected sequential awaits inside `for...of` loops parsing database rows (`ai-guard/no-await-in-loop`).
+   - **Floating Promises:** Found unhandled promises inside API handlers (`ai-guard/no-floating-promise`).
+
+## 🎬 Real Workspace Demo
+
+See how `ai-guard` catches a common AI-generated async bug that silent failures in production:
+
+```typescript
+// ❌ BAD: AI often forgets to await or wrap in Promise.all
+const userIds = [1, 2, 3];
+userIds.map(async (id) => {
+  return await fetchUser(id);
+}); 
+// ⚠️ ai-guard flags: Async callback passed to Array.map(). Returns Promise[], not values.
+
+// ✅ GOOD: ai-guard recommended fix
+const users = await Promise.all(userIds.map(async (id) => {
+  return await fetchUser(id);
+}));
+// ✨ ai-guard: No issues found.
+```
+
+### Terminal Output
+
+![ai-guard linting demo](./assets/demo.png)
+
+*The terminal output above shows `ai-guard` catching multiple AI-generated anti-patterns in a single run.*
+
+## Rules
+
+### 🎯 Error Handling
+
+- **`ai-guard/no-empty-catch`** (Error)
+  Disallow empty catch blocks. AI tools frequently generate try/catch with empty bodies that silently swallow errors.
+- **`ai-guard/no-broad-exception`** (Warn)
+  Disallow catching `any` or `unknown` without instance narrowing. AI tools default to `catch (e: any)` which obscures the underlying failure.
+
+### ⏱️ Async Stability
+
+- **`ai-guard/no-async-array-callback`** (Error)
+  Disallow async functions in `.map()`, `.filter()`, etc. AI tools frequently suggest `array.map(async ...)` expecting resolved values, creating silent bugs.
+- **`ai-guard/no-floating-promise`** (Error)
+  Require awaiting or handling promises. AI tools frequently generate un-awaited async calls that silently swallow rejections.
+- **`ai-guard/no-await-in-loop`** (Warn)
+  Disallow sequential `await` inside loops. AI tools frequently use `for (const x of y) await z(x)` causing O(n) latency instead of parallel `Promise.all()`.
+
+### 🛡️ Security
+
+- **`ai-guard/no-hardcoded-secret`** (Error)
+  Disallow hardcoded keys/passwords. AI tools frequently provide examples with placeholder secrets that accidentally make it into production.
+- **`ai-guard/no-eval-dynamic`** (Error)
+  Disallow dynamic `eval()` or `new Function()`.
+- **`ai-guard/no-sql-string-concat`** (Error)
+  Disallow variable concatenation/interpolation in SQL queries. AI tools frequently generate dangerous code enabling SQL injection.
+- **`ai-guard/require-auth-middleware`** (Warn)
+  Enforce authentication middleware on Express/Fastify routes. AI tools frequently generate unprotected endpoints exposing sensitive data.
+
+### Configs
+
+| Config | Description |
+| --- | --- |
+| `recommended` | Most impactful rules at `error` — works with zero configuration |
+| `strict` | All rules at `error` — for teams that want maximum coverage |
+| `security` | Security-focused rules only — for AppSec teams |
+
+## Why This Exists
+
+AI coding assistants generate code that **looks correct** but has subtle structural issues:
+
+- 🕳️ **Empty catch blocks** — errors vanish silently
+- ⏳ **`array.map(async ...)`** — returns `Promise[]`, not resolved values
+- 🔥 **Floating promises** — `fetchData()` without `await` = silent failures
+
+These patterns pass TypeScript and existing linters. `ai-guard` catches them.
+
+## Supported Environments
+
+- **ESLint** 8.x and 9.x (flat config)
+- **Node.js** ≥ 18
+- **TypeScript** and JavaScript
+
+## Development
+
+```bash
+git clone https://github.com/YashJadhav21/eslint-plugin-ai-guard.git
+cd eslint-plugin-ai-guard
+npm install
+npm run test        # Run test suite
+npm run build       # Build CJS + ESM
+npm run typecheck   # TypeScript check
+```
+
+## Contributing
+
+Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+
+**Rule requests:** Open an issue using the [Rule Request template](https://github.com/YashJadhav21/eslint-plugin-ai-guard/issues/new).
+
+**False positive reports:** Open an issue using the [False Positive template](https://github.com/YashJadhav21/eslint-plugin-ai-guard/issues/new) — we take zero false positives seriously.
+
+## License
+
+[MIT](LICENSE) — free forever. No rules behind a paywall.
+
+---
+
+<p align="center">
+  Built to make AI-assisted development safer. ⚡
+</p>

package/dist/index.d.mts

@@ -0,0 +1,89 @@
+import * as _typescript_eslint_utils_ts_eslint from '@typescript-eslint/utils/ts-eslint';
+import { TSESLint } from '@typescript-eslint/utils';
+
+/**
+ * All rules exported by the plugin.
+ * Each key is the rule name (without the plugin prefix).
+ */
+declare const allRules: {
+    readonly 'no-empty-catch': _typescript_eslint_utils_ts_eslint.RuleModule<"emptyCatch", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-broad-exception': _typescript_eslint_utils_ts_eslint.RuleModule<"broadException", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-async-array-callback': _typescript_eslint_utils_ts_eslint.RuleModule<"asyncArrayCallback", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-floating-promise': _typescript_eslint_utils_ts_eslint.RuleModule<"floatingPromise", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-await-in-loop': _typescript_eslint_utils_ts_eslint.RuleModule<"awaitInLoop", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-hardcoded-secret': _typescript_eslint_utils_ts_eslint.RuleModule<"hardcodedSecret", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-eval-dynamic': _typescript_eslint_utils_ts_eslint.RuleModule<"evalDynamic" | "newFunctionDynamic", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-sql-string-concat': _typescript_eslint_utils_ts_eslint.RuleModule<"sqlStringConcat", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
+        authMiddlewareNames?: string[];
+    }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+};
+
+declare const recommended: TSESLint.ClassicConfig.Config;
+
+declare const strict: TSESLint.ClassicConfig.Config;
+
+declare const security: TSESLint.ClassicConfig.Config;
+
+declare const plugin: {
+    meta: {
+        name: string;
+        version: string;
+    };
+    rules: {
+        readonly 'no-empty-catch': _typescript_eslint_utils_ts_eslint.RuleModule<"emptyCatch", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-broad-exception': _typescript_eslint_utils_ts_eslint.RuleModule<"broadException", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-async-array-callback': _typescript_eslint_utils_ts_eslint.RuleModule<"asyncArrayCallback", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-floating-promise': _typescript_eslint_utils_ts_eslint.RuleModule<"floatingPromise", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-await-in-loop': _typescript_eslint_utils_ts_eslint.RuleModule<"awaitInLoop", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-hardcoded-secret': _typescript_eslint_utils_ts_eslint.RuleModule<"hardcodedSecret", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-eval-dynamic': _typescript_eslint_utils_ts_eslint.RuleModule<"evalDynamic" | "newFunctionDynamic", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-sql-string-concat': _typescript_eslint_utils_ts_eslint.RuleModule<"sqlStringConcat", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
+            authMiddlewareNames?: string[];
+        }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+    };
+    configs: {
+        recommended: _typescript_eslint_utils_ts_eslint.ClassicConfig.Config;
+        strict: _typescript_eslint_utils_ts_eslint.ClassicConfig.Config;
+        security: _typescript_eslint_utils_ts_eslint.ClassicConfig.Config;
+    };
+};
+
+export { plugin as default, recommended, allRules as rules, security, strict };

package/dist/index.d.ts

@@ -0,0 +1,89 @@
+import * as _typescript_eslint_utils_ts_eslint from '@typescript-eslint/utils/ts-eslint';
+import { TSESLint } from '@typescript-eslint/utils';
+
+/**
+ * All rules exported by the plugin.
+ * Each key is the rule name (without the plugin prefix).
+ */
+declare const allRules: {
+    readonly 'no-empty-catch': _typescript_eslint_utils_ts_eslint.RuleModule<"emptyCatch", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-broad-exception': _typescript_eslint_utils_ts_eslint.RuleModule<"broadException", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-async-array-callback': _typescript_eslint_utils_ts_eslint.RuleModule<"asyncArrayCallback", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-floating-promise': _typescript_eslint_utils_ts_eslint.RuleModule<"floatingPromise", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-await-in-loop': _typescript_eslint_utils_ts_eslint.RuleModule<"awaitInLoop", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-hardcoded-secret': _typescript_eslint_utils_ts_eslint.RuleModule<"hardcodedSecret", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-eval-dynamic': _typescript_eslint_utils_ts_eslint.RuleModule<"evalDynamic" | "newFunctionDynamic", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'no-sql-string-concat': _typescript_eslint_utils_ts_eslint.RuleModule<"sqlStringConcat", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+    readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
+        authMiddlewareNames?: string[];
+    }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
+};
+
+declare const recommended: TSESLint.ClassicConfig.Config;
+
+declare const strict: TSESLint.ClassicConfig.Config;
+
+declare const security: TSESLint.ClassicConfig.Config;
+
+declare const plugin: {
+    meta: {
+        name: string;
+        version: string;
+    };
+    rules: {
+        readonly 'no-empty-catch': _typescript_eslint_utils_ts_eslint.RuleModule<"emptyCatch", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-broad-exception': _typescript_eslint_utils_ts_eslint.RuleModule<"broadException", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-async-array-callback': _typescript_eslint_utils_ts_eslint.RuleModule<"asyncArrayCallback", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-floating-promise': _typescript_eslint_utils_ts_eslint.RuleModule<"floatingPromise", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-await-in-loop': _typescript_eslint_utils_ts_eslint.RuleModule<"awaitInLoop", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-hardcoded-secret': _typescript_eslint_utils_ts_eslint.RuleModule<"hardcodedSecret", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-eval-dynamic': _typescript_eslint_utils_ts_eslint.RuleModule<"evalDynamic" | "newFunctionDynamic", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'no-sql-string-concat': _typescript_eslint_utils_ts_eslint.RuleModule<"sqlStringConcat", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+        readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
+            authMiddlewareNames?: string[];
+        }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
+    };
+    configs: {
+        recommended: _typescript_eslint_utils_ts_eslint.ClassicConfig.Config;
+        strict: _typescript_eslint_utils_ts_eslint.ClassicConfig.Config;
+        security: _typescript_eslint_utils_ts_eslint.ClassicConfig.Config;
+    };
+};
+
+export { plugin as default, recommended, allRules as rules, security, strict };