eslint-plugin-ai-guard 1.1.12 → 1.1.13

package/README.md

@@ -57,29 +57,6 @@ This writes:
 Your AI tools will now avoid these patterns before you even run the linter.
 Use `--force` to regenerate after upgrading to a new version with new rules.
 
-## 🤖 Set Up AI Agent Rules
-
-Generate instruction files so Claude Code, Cursor, and GitHub Copilot
-automatically avoid the 17 most common AI-generated anti-patterns:
-
-```bash
-npx ai-guard init-context
-```
-
-Follow the prompts to select your agent(s). Or generate all at once:
-
-```bash
-npx ai-guard init-context --all
-```
-
-This writes:
-- `CLAUDE.md` — read automatically by Claude Code
-- `.cursorrules` — read automatically by Cursor
-- `.github/copilot-instructions.md` — read automatically by GitHub Copilot
-
-Your AI tools will now avoid these patterns before you even run the linter.
-Use `--force` to regenerate after upgrading to a new version with new rules.
-
 ## 🧪 Real-World Usage Philosophy
 
 `ai-guard` is designed for production adoption in existing codebases:
@@ -88,6 +65,18 @@ Use `--force` to regenerate after upgrading to a new version with new rules.
 2. **Strict preset enables full enforcement** for mature teams that want maximum coverage.
 3. **Security preset focuses only on security rules** with critical issues as errors.
 
+## 🛠️ Safe Autofix Support
+
+`ai-guard` now includes safe autofixers for selected high-confidence rules:
+
+- `ai-guard/no-empty-catch` → inserts `{ /* TODO: handle error */ }`
+- `ai-guard/no-await-in-loop` → rewrites simple independent loops to `await Promise.all(...)`
+- `ai-guard/no-hardcoded-secret` → replaces hardcoded literals with `process.env.*`
+- `ai-guard/no-floating-promise` → marks intentional fire-and-forget with `void`
+- `ai-guard/no-async-without-await` → inserts `await (...)` for simple function bodies
+
+These fixes are intentionally conservative and avoid complex transformations when confidence is low.
+
 ## 🎬 Real Workspace Demo
 
 See how `ai-guard` catches a common AI-generated async bug that silent failures in production:
@@ -119,7 +108,7 @@ const users = await Promise.all(userIds.map(async (id) => {
 ### 🎯 Error Handling
 
 - **`ai-guard/no-empty-catch`** (Error)
-  Disallow empty catch blocks. AI tools frequently generate try/catch with empty bodies that silently swallow errors.
+  Disallow empty catch blocks. Includes safe autofix that inserts an explicit placeholder handler comment.
 - **`ai-guard/no-broad-exception`** (Warn)
   Disallow catching `any` or `unknown` without instance narrowing. AI tools default to `catch (e: any)` which obscures the underlying failure.
 - **`ai-guard/no-catch-log-rethrow`** (Off in `recommended`, Error in `strict`)
@@ -134,22 +123,22 @@ const users = await Promise.all(userIds.map(async (id) => {
 - **`ai-guard/no-async-array-callback`** (Warn)
   Disallow async functions in `.map()`, `.filter()`, etc. AI tools frequently suggest `array.map(async ...)` expecting resolved values, creating silent bugs.
 - **`ai-guard/no-floating-promise`** (Error)
-  Require awaiting or handling promises. AI tools frequently generate un-awaited async calls that silently swallow rejections.
+  Require awaiting or handling promises. Includes safe autofix that marks floating calls with `void`.
 - **`ai-guard/no-await-in-loop`** (Warn)
-  Disallow sequential `await` inside loops. AI tools frequently use `for (const x of y) await z(x)` causing O(n) latency instead of parallel `Promise.all()`.
+  Disallow independent sequential `await` inside loops. Intent-aware suppression protects retry/fallback loops, and safe autofix is available for simple independent cases.
 - **`ai-guard/no-async-without-await`** (Warn)
-  Disallow async functions that do not use `await`. AI tools frequently add `async` by default, creating misleading function signatures.
+  Disallow async functions that do not use `await`. Includes safe autofix for simple bodies by inserting explicit await.
 - **`ai-guard/no-redundant-await`** (Off in `recommended`, Error in `strict`)
   Disallow redundant `return await` outside try/catch/finally. AI tools often emit this pattern even when returning the Promise directly is equivalent.
 
 ### 🛡️ Security
 
 - **`ai-guard/no-hardcoded-secret`** (Error)
-  Disallow hardcoded keys/passwords. AI tools frequently provide examples with placeholder secrets that accidentally make it into production.
+  Disallow hardcoded keys/passwords. Includes safe autofix that rewrites values to `process.env.*`.
 - **`ai-guard/no-eval-dynamic`** (Error)
   Disallow dynamic `eval()` or `new Function()`.
 - **`ai-guard/no-sql-string-concat`** (Warn in `recommended`, Error in `security`/`strict`)
-  Disallow variable concatenation/interpolation in SQL queries. AI tools frequently generate dangerous code enabling SQL injection.
+  Disallow variable concatenation/interpolation in SQL queries. Now context-aware for known query builders (Knex, Drizzle, Prisma, Kysely, Sequelize, TypeORM, Mikro-ORM) to reduce false positives while staying strict for non-builder sinks.
 - **`ai-guard/no-unsafe-deserialize`** (Warn in `recommended`/`security`, Error in `strict`)
   Disallow `JSON.parse()` on likely untrusted inputs (like `req.body`) without visible validation.
 - **`ai-guard/require-auth-middleware`** (Warn)

package/dist/cli/index.js

@@ -45,6 +45,8 @@ __export(config_manager_exports, {
   readConfig: () => readConfig,
   removeNukeIgnore: () => removeNukeIgnore,
   repairInvalidFlatConfig: () => repairInvalidFlatConfig,
+  switchFlatPreset: () => switchFlatPreset,
+  switchLegacyPreset: () => switchLegacyPreset,
   validateFlatConfigText: () => validateFlatConfigText,
   validateLegacyConfigText: () => validateLegacyConfigText,
   writeConfig: () => writeConfig
@@ -199,6 +201,30 @@ function patchLegacyConfig(existing, preset) {
   }
   return patched;
 }
+function switchFlatPreset(existing, preset) {
+  let patched = existing;
+  patched = patched.replace(
+    /\.\.\.aiGuard\.configs\.(recommended|strict|security)\.rules/g,
+    `...aiGuard.configs.${preset}.rules`
+  );
+  patched = patched.replace(
+    /['"]ai-guard\/(recommended|strict|security)['"]/g,
+    `'ai-guard/${preset}'`
+  );
+  return patched;
+}
+function switchLegacyPreset(existing, preset) {
+  let patched = existing;
+  patched = patched.replace(
+    /['"]plugin:ai-guard\/(recommended|strict|security)['"]/g,
+    `'plugin:ai-guard/${preset}'`
+  );
+  patched = patched.replace(
+    /['"]ai-guard\/(recommended|strict|security)['"]/g,
+    `'ai-guard/${preset}'`
+  );
+  return patched;
+}
 function removeNukeIgnore(existing) {
   const nukePatterns = [/"?\*\*\/\*"?/g];
   const hasNuke = existing.includes('"**/*"') || existing.includes("'**/*'");
@@ -469,8 +495,8 @@ function isSkippablePatternError(error) {
   return hasNoFilesSignal || hasIgnoredSignal;
 }
 async function loadPluginModuleFromCwd(cwd) {
-  const { createRequire } = await import("module");
-  const requireFromCwd = createRequire(import_path.default.join(cwd, "package.json"));
+  const { createRequire: createRequire2 } = await import("module");
+  const requireFromCwd = createRequire2(import_path.default.join(cwd, "package.json"));
   try {
     const resolved = requireFromCwd.resolve("eslint-plugin-ai-guard");
     return import((0, import_url.pathToFileURL)(resolved).href);
@@ -515,6 +541,8 @@ async function runEslint(options) {
     "**/*.jsx",
     "**/*.ts",
     "**/*.tsx",
+    "**/*.mts",
+    "**/*.cts",
     "**/*.mjs",
     "**/*.cjs"
   ];
@@ -551,7 +579,7 @@ async function runEslint(options) {
   ];
   if (tsParser) {
     configBlocks.splice(1, 0, {
-      files: ["**/*.ts", "**/*.tsx"],
+      files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
       languageOptions: {
         parser: tsParser,
@@ -565,7 +593,7 @@ async function runEslint(options) {
     });
   } else {
     configBlocks.splice(1, 0, {
-      files: ["**/*.ts", "**/*.tsx"],
+      files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
       rules
     });
@@ -782,6 +810,7 @@ var import_fs4 = __toESM(require("fs"));
 // cli/utils/detector.ts
 var import_fs2 = __toESM(require("fs"));
 var import_path2 = __toESM(require("path"));
+var import_module = require("module");
 var FLAT_CONFIG_FILES = [
   { file: "eslint.config.js", type: "flat-js" },
   { file: "eslint.config.mjs", type: "flat-mjs" },
@@ -798,7 +827,12 @@ var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
     const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
-    return import_fs2.default.existsSync(pkgPath);
+    if (import_fs2.default.existsSync(pkgPath)) {
+      return true;
+    }
+    const req = (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json"));
+    req.resolve(`${pkgName}/package.json`);
+    return true;
   } catch {
     return false;
   }
@@ -806,8 +840,8 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
     const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
-    if (!import_fs2.default.existsSync(pkgPath)) return null;
-    const raw = import_fs2.default.readFileSync(pkgPath, "utf-8");
+    const resolvedPath = import_fs2.default.existsSync(pkgPath) ? pkgPath : (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const raw = import_fs2.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
   } catch {
@@ -974,9 +1008,9 @@ function registerInitCommand(program2) {
       return;
     }
     try {
-      const { createRequire } = await import("module");
+      const { createRequire: createRequire2 } = await import("module");
       const { pathToFileURL: pathToFileURL2 } = await import("url");
-      const req = createRequire(import_path4.default.join(cwd, "_probe.js"));
+      const req = createRequire2(import_path4.default.join(cwd, "_probe.js"));
       const resolvedPath = req.resolve("eslint-plugin-ai-guard");
       const aiGuard = await import(pathToFileURL2(resolvedPath).href);
       const plugin = aiGuard.default || aiGuard;
@@ -1397,12 +1431,13 @@ function registerPresetCommand(program2) {
       const backupPath = backupConfig(configPath);
       log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
-      const patched = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
+      const withPlugin = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
+      const patched = isFlat(env.configType) ? switchFlatPreset(withPlugin, preset) : switchLegacyPreset(withPlugin, preset);
       if (patched === existing) {
-        log.warn("Config already contains ai-guard. Edit manually to change preset.");
+        log.warn("No preset changes needed. Config already matches selected preset.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))}`);
+        log.success(`Updated ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} to ${import_chalk5.default.cyan(preset)} preset`);
       }
     }
     log.blank();
@@ -1494,7 +1529,7 @@ var import_path8 = __toESM(require("path"));
 var import_chalk7 = __toESM(require("chalk"));
 var import_ora2 = __toESM(require("ora"));
 var BASELINE_FILE = ".ai-guard-baseline.json";
-function saveBaseline(result, preset, cwd) {
+function saveBaseline(result, preset, mode, cwd) {
   const entries = result.files.map((f) => ({
     filePath: f.filePath,
     issues: f.issues.map((i) => ({
@@ -1507,6 +1542,7 @@ function saveBaseline(result, preset, cwd) {
   const baseline = {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     preset,
+    mode,
     totalIssues: result.totalIssues,
     entries
   };
@@ -1527,23 +1563,28 @@ function loadBaseline(cwd) {
 function issueKey(filePath, issue) {
   return `${filePath}::${issue.ruleId}::${issue.line}::${issue.column}::${issue.message}`;
 }
-function buildBaselineSet(baseline) {
+function stableIssueKey(filePath, issue) {
+  return `${filePath}::${issue.ruleId}::${issue.message}`;
+}
+function buildBaselineSet(baseline, mode) {
+  const toKey = mode === "stable" ? stableIssueKey : issueKey;
   const set = /* @__PURE__ */ new Set();
   for (const entry of baseline.entries) {
     for (const issue of entry.issues) {
-      set.add(issueKey(entry.filePath, issue));
+      set.add(toKey(entry.filePath, issue));
     }
   }
   return set;
 }
-function computeNewIssues(result, baselineSet) {
+function computeNewIssues(result, baselineSet, mode) {
+  const toKey = mode === "stable" ? stableIssueKey : issueKey;
   const newFiles = [];
   let totalErrors = 0;
   let totalWarnings = 0;
   const ruleBreakdown = /* @__PURE__ */ new Map();
   for (const file of result.files) {
     const newIssues = file.issues.filter(
-      (i) => !baselineSet.has(issueKey(file.filePath, i))
+      (i) => !baselineSet.has(toKey(file.filePath, i))
     );
     if (newIssues.length === 0) continue;
     const errorCount = newIssues.filter((i) => i.severity === 2).length;
@@ -1570,9 +1611,14 @@ function computeNewIssues(result, baselineSet) {
   };
 }
 function registerBaselineCommand(program2) {
-  program2.command("baseline").description("Save current issues as baseline; future runs show only new issues").option("--save", "Save current state as the new baseline").option("--check", "Show only issues introduced since the last baseline").option("--path <dir>", "Directory to scan", ".").option("--preset <name>", "Preset: recommended | strict | security", "recommended").action(async (opts) => {
+  program2.command("baseline").description("Save current issues as baseline; future runs show only new issues").option("--save", "Save current state as the new baseline").option("--check", "Show only issues introduced since the last baseline").option("--mode <name>", "Baseline match mode: strict | stable", "stable").option("--path <dir>", "Directory to scan", ".").option("--preset <name>", "Preset: recommended | strict | security", "recommended").action(async (opts) => {
     const cwd = process.cwd();
     const preset = opts.preset ?? "recommended";
+    const mode = opts.mode ?? "stable";
+    if (mode !== "strict" && mode !== "stable") {
+      log.error("Invalid --mode. Use strict or stable.");
+      process.exit(1);
+    }
     log.banner("AI GUARD BASELINE");
     log.blank();
     const existingBaseline = loadBaseline(cwd);
@@ -1590,12 +1636,13 @@ function registerBaselineCommand(program2) {
         log.error(err instanceof Error ? err.message : String(err));
         process.exit(1);
       }
-      const baselinePath = saveBaseline(result, preset, cwd);
+      const baselinePath = saveBaseline(result, preset, mode, cwd);
       log.success(
         `Baseline saved \u2192 ${import_chalk7.default.white(import_path8.default.relative(cwd, baselinePath))}`
       );
       log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
       log.info(`  Preset: ${import_chalk7.default.cyan(preset)}`);
+      log.info(`  Mode: ${import_chalk7.default.cyan(mode)}`);
       log.blank();
       log.info("Future runs of " + import_chalk7.default.cyan("ai-guard baseline --check") + " will show only NEW issues.");
       log.info("Add " + import_chalk7.default.white(BASELINE_FILE) + " to your git repository to share baseline with your team.");
@@ -1611,6 +1658,7 @@ function registerBaselineCommand(program2) {
       const baselineDate = new Date(existingBaseline.createdAt).toLocaleString();
       log.info(`Baseline from: ${import_chalk7.default.gray(baselineDate)}`);
       log.info(`Baseline preset: ${import_chalk7.default.cyan(existingBaseline.preset)}`);
+      log.info(`Baseline mode: ${import_chalk7.default.cyan(existingBaseline.mode ?? "strict")}`);
       log.info(`Baseline issues: ${import_chalk7.default.gray(existingBaseline.totalIssues)}`);
       log.blank();
       const spinner = (0, import_ora2.default)({ text: "Scanning for new issues\u2026", color: "cyan" }).start();
@@ -1623,8 +1671,9 @@ function registerBaselineCommand(program2) {
         log.error(err instanceof Error ? err.message : String(err));
         process.exit(1);
       }
-      const baselineSet = buildBaselineSet(existingBaseline);
-      const newResult = computeNewIssues(result, baselineSet);
+      const compareMode = existingBaseline.mode ?? "strict";
+      const baselineSet = buildBaselineSet(existingBaseline, compareMode);
+      const newResult = computeNewIssues(result, baselineSet, compareMode);
       if (newResult.totalIssues === 0) {
         log.success("No new issues since baseline! \u2728");
         log.info(
@@ -1675,7 +1724,7 @@ function registerBaselineCommand(program2) {
 var import_fs6 = __toESM(require("fs"));
 var import_path9 = __toESM(require("path"));
 var import_chalk8 = __toESM(require("chalk"));
-var import_prompts2 = __toESM(require("prompts"));
+var import_prompts2 = require("@inquirer/prompts");
 var RULE_CATEGORIES = {
   "error-handling": [
     "no-empty-catch",
@@ -2071,15 +2120,6 @@ function parseCategories(raw) {
   }
   return valid.length > 0 ? valid : ALL_CATEGORIES;
 }
-function normalizeSelectedAgents(raw) {
-  if (Array.isArray(raw)) {
-    return raw.filter((value) => typeof value === "string");
-  }
-  if (typeof raw === "string") {
-    return [raw];
-  }
-  return [];
-}
 function registerInitContextCommand(program2) {
   program2.command("init-context").description(
     "Generate AI agent instruction files (CLAUDE.md, .cursorrules, copilot-instructions.md)\nso Claude Code, Cursor, and GitHub Copilot avoid the 17 most common AI anti-patterns."
@@ -2098,35 +2138,22 @@ function registerInitContextCommand(program2) {
     if (opts.all) {
       selectedAgents = [...AGENTS];
     } else {
-      let wasCancelled = false;
-      const response = await (0, import_prompts2.default)(
-        {
-          type: "multiselect",
-          name: "agents",
+      let selected;
+      try {
+        selected = await (0, import_prompts2.checkbox)({
           message: "Which AI agents do you use?",
           choices: [
-            { title: "Claude Code", value: "claude", description: "\u2192 writes CLAUDE.md" },
-            { title: "Cursor", value: "cursor", description: "\u2192 writes .cursorrules" },
-            { title: "GitHub Copilot", value: "copilot", description: "\u2192 writes .github/copilot-instructions.md" },
-            { title: "All three (recommended)", value: "all", description: "\u2192 writes all files" }
+            { name: "Claude Code -> writes CLAUDE.md", value: "claude" },
+            { name: "Cursor -> writes .cursorrules", value: "cursor" },
+            { name: "GitHub Copilot -> writes .github/copilot-instructions.md", value: "copilot" },
+            { name: "All three (recommended) -> writes all files", value: "all" }
           ],
-          hint: "Space: select | Enter: confirm",
-          instructions: true,
-          min: 1,
-          warn: "Select at least one agent."
-        },
-        {
-          onCancel: () => {
-            wasCancelled = true;
-            return false;
-          }
-        }
-      );
-      if (wasCancelled) {
+          required: true
+        });
+      } catch {
         log.info("Selection cancelled. Nothing to do.");
         return;
       }
-      const selected = normalizeSelectedAgents(response.agents);
       if (selected.length === 0) {
         log.info("No valid agents selected. Use --all to generate all files.");
         return;
@@ -2145,13 +2172,11 @@ function registerInitContextCommand(program2) {
       const fullPath = import_path9.default.join(cwd, agent.filePath);
       const exists = import_fs6.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
-        const confirm = await (0, import_prompts2.default)({
-          type: "confirm",
-          name: "overwrite",
+        const overwrite = await (0, import_prompts2.confirm)({
           message: `${agent.filePath} already exists. Overwrite?`,
-          initial: false
+          default: false
         });
-        if (!confirm.overwrite) {
+        if (!overwrite) {
           results.push({ file: agent.filePath, status: "skipped" });
           continue;
         }