fcis 0.1.0 → 0.2.0

package/src/detection/markers.ts

@@ -23,74 +23,6 @@ export type MarkerDefinition = {
   severity: 'high' | 'medium' | 'low'
 }
 
-/**
- * Database operations that indicate I/O
- */
-export const DATABASE_OPERATIONS = new Set([
-  'findFirst',
-  'findMany',
-  'findUnique',
-  'findUniqueOrThrow',
-  'findFirstOrThrow',
-  'create',
-  'createMany',
-  'update',
-  'updateMany',
-  'delete',
-  'deleteMany',
-  'upsert',
-  'aggregate',
-  'count',
-  'groupBy',
-  '$transaction',
-  '$queryRaw',
-  '$executeRaw',
-])
-
-/**
- * Database client prefixes
- */
-export const DATABASE_PREFIXES = ['db', 'prisma', 'ctx.db', 'ctx.prisma']
-
-/**
- * File system modules that indicate I/O
- */
-export const FS_MODULES = new Set([
-  'fs',
-  'node:fs',
-  'fs/promises',
-  'node:fs/promises',
-])
-
-/**
- * HTTP client modules
- */
-export const HTTP_MODULES = new Set(['axios', 'node-fetch', 'got', 'ky'])
-
-/**
- * Console methods that indicate logging
- */
-export const CONSOLE_METHODS = new Set([
-  'log',
-  'error',
-  'warn',
-  'info',
-  'debug',
-  'trace',
-])
-
-/**
- * Analytics/telemetry function patterns
- */
-export const TELEMETRY_PATTERNS = [
-  /^track[A-Z]/,
-  /^analytics\./,
-  /^segment\./,
-  /^posthog\./,
-  /^mixpanel\./,
-  /^amplitude\./,
-]
-
 /**
  * Marker catalog - all recognized impurity markers
  */
@@ -119,12 +51,6 @@ export const MARKER_CATALOG: Record<MarkerType, MarkerDefinition> = {
     category: 'io',
     severity: 'high',
   },
-  'fs-import': {
-    type: 'fs-import',
-    description: 'Import from file system module',
-    category: 'io',
-    severity: 'medium',
-  },
   'fs-call': {
     type: 'fs-call',
     description: 'File system operation call',
@@ -182,151 +108,3 @@ export function getMarkerDefinition(type: MarkerType): MarkerDefinition {
 export function getAllMarkerTypes(): MarkerType[] {
   return Object.keys(MARKER_CATALOG) as MarkerType[]
 }
-
-/**
- * Get markers by category
- */
-export function getMarkersByCategory(
-  category: MarkerDefinition['category'],
-): MarkerDefinition[] {
-  return Object.values(MARKER_CATALOG).filter(m => m.category === category)
-}
-
-/**
- * Get markers by severity
- */
-export function getMarkersBySeverity(
-  severity: MarkerDefinition['severity'],
-): MarkerDefinition[] {
-  return Object.values(MARKER_CATALOG).filter(m => m.severity === severity)
-}
-
-/**
- * Check if a call expression matches a database operation pattern
- * e.g., "db.user.findFirst", "prisma.user.create", "ctx.db.user.update"
- */
-export function isDatabaseCall(expression: string): boolean {
-  // Check if expression starts with a known database prefix
-  const lowerExpr = expression.toLowerCase()
-
-  for (const prefix of DATABASE_PREFIXES) {
-    if (lowerExpr.startsWith(prefix + '.')) {
-      // Extract the operation (last part of the chain)
-      const parts = expression.split('.')
-      const operation = parts[parts.length - 1]
-      if (operation && DATABASE_OPERATIONS.has(operation)) {
-        return true
-      }
-    }
-  }
-
-  return false
-}
-
-/**
- * Check if a call expression is a fetch call
- */
-export function isFetchCall(expression: string): boolean {
-  return expression === 'fetch' || expression.endsWith('.fetch')
-}
-
-/**
- * Check if a call expression is an HTTP client call
- */
-export function isHttpClientCall(
-  expression: string,
-  importedModules: Set<string>,
-): boolean {
-  // Check if axios or similar is imported
-  for (const module of HTTP_MODULES) {
-    if (importedModules.has(module)) {
-      // Check for axios.get, axios.post, etc.
-      if (
-        expression.startsWith('axios.') ||
-        expression === 'axios' ||
-        expression.startsWith('got.') ||
-        expression === 'got' ||
-        expression.startsWith('ky.')
-      ) {
-        return true
-      }
-    }
-  }
-
-  return false
-}
-
-/**
- * Check if a call expression is a file system call
- */
-export function isFsCall(expression: string): boolean {
-  return (
-    expression.startsWith('fs.') ||
-    expression.startsWith('fsPromises.') ||
-    expression.startsWith('fsp.')
-  )
-}
-
-/**
- * Check if a module specifier is a file system module
- */
-export function isFsModule(moduleSpecifier: string): boolean {
-  return FS_MODULES.has(moduleSpecifier)
-}
-
-/**
- * Check if a property access is an environment variable access
- */
-export function isEnvAccess(propertyChain: string): boolean {
-  return (
-    propertyChain.startsWith('process.env.') || propertyChain === 'process.env'
-  )
-}
-
-/**
- * Check if a call expression is a console log call
- */
-export function isConsoleCall(expression: string): boolean {
-  if (!expression.startsWith('console.')) return false
-
-  const method = expression.slice('console.'.length)
-  return CONSOLE_METHODS.has(method)
-}
-
-/**
- * Check if a call expression is a logging call
- */
-export function isLoggingCall(expression: string): boolean {
-  return (
-    expression.startsWith('logger.') ||
-    expression.startsWith('log.') ||
-    expression === 'log' ||
-    expression.startsWith('Logger.')
-  )
-}
-
-/**
- * Check if a call expression is a telemetry/analytics call
- */
-export function isTelemetryCall(expression: string): boolean {
-  for (const pattern of TELEMETRY_PATTERNS) {
-    if (pattern.test(expression)) {
-      return true
-    }
-  }
-  return false
-}
-
-/**
- * Check if a call expression is a queue enqueue call
- */
-export function isQueueEnqueueCall(expression: string): boolean {
-  return expression.endsWith('.enqueue') || expression.endsWith('.add')
-}
-
-/**
- * Check if a call expression is an event emit call
- */
-export function isEventEmitCall(expression: string): boolean {
-  return expression.endsWith('.emit') || expression.endsWith('.dispatch')
-}

package/src/extraction/extract-functions.ts

@@ -30,6 +30,42 @@ import {
 
 import type { CallSite, ExtractedFunction, FileImports } from '../types.js'
 
+/**
+ * Known higher-order function method names that take inline callbacks.
+ * Callbacks passed to these methods are marked as inline callbacks
+ * and absorbed into their parent function's score.
+ *
+ * Explicitly EXCLUDED (not inline callbacks):
+ * - tRPC handlers: query, mutation, subscription
+ * - Express/framework middleware: use, get, post, put, delete, patch
+ * - Custom application HOFs
+ */
+const INLINE_CALLBACK_METHODS = new Set([
+  // Array methods
+  'map',
+  'filter',
+  'reduce',
+  'forEach',
+  'find',
+  'findIndex',
+  'some',
+  'every',
+  'flatMap',
+  'sort',
+  'toSorted',
+  // Promise methods
+  'then',
+  'catch',
+  'finally',
+  // Timing
+  'setTimeout',
+  'setInterval',
+  // Events
+  'addEventListener',
+  'on',
+  'once',
+])
+
 type FunctionLikeNode =
   | FunctionDeclaration
   | MethodDeclaration
@@ -148,12 +184,28 @@ export function extractFunctions(sourceFile: SourceFile): ExtractedFunction[] {
     if (node.getKind() === SyntaxKind.ArrowFunction) {
       const arrowFn = node as ArrowFunction
       const parentContext = inferParentContext(arrowFn)
+      const isInlineCallback = isInlineCallbackToKnownHOF(parentContext)
+      const enclosingFunctionStartLine = isInlineCallback
+        ? findEnclosingFunctionStartLine(arrowFn)
+        : null
       addFunction(
-        extractFunctionData(arrowFn, filePath, 'arrow', parentContext, false),
+        extractFunctionData(
+          arrowFn,
+          filePath,
+          'arrow',
+          parentContext,
+          false,
+          isInlineCallback,
+          enclosingFunctionStartLine,
+        ),
       )
     } else if (node.getKind() === SyntaxKind.FunctionExpression) {
       const funcExpr = node as FunctionExpression
       const parentContext = inferParentContext(funcExpr)
+      const isInlineCallback = isInlineCallbackToKnownHOF(parentContext)
+      const enclosingFunctionStartLine = isInlineCallback
+        ? findEnclosingFunctionStartLine(funcExpr)
+        : null
       addFunction(
         extractFunctionData(
           funcExpr,
@@ -161,6 +213,8 @@ export function extractFunctions(sourceFile: SourceFile): ExtractedFunction[] {
           'function-expression',
           parentContext,
           false,
+          isInlineCallback,
+          enclosingFunctionStartLine,
         ),
       )
     }
@@ -169,6 +223,39 @@ export function extractFunctions(sourceFile: SourceFile): ExtractedFunction[] {
   return functions
 }
 
+/**
+ * Check if a function is an inline callback to a known HOF
+ */
+function isInlineCallbackToKnownHOF(parentContext: string | null): boolean {
+  if (parentContext === null) return false
+  return INLINE_CALLBACK_METHODS.has(parentContext)
+}
+
+/**
+ * Find the start line of the enclosing function for a node.
+ * Returns null if the node is at module scope (no enclosing function).
+ */
+function findEnclosingFunctionStartLine(node: Node): number | null {
+  let current = node.getParent()
+
+  while (current) {
+    const kind = current.getKind()
+    if (
+      kind === SyntaxKind.FunctionDeclaration ||
+      kind === SyntaxKind.MethodDeclaration ||
+      kind === SyntaxKind.ArrowFunction ||
+      kind === SyntaxKind.FunctionExpression ||
+      kind === SyntaxKind.GetAccessor ||
+      kind === SyntaxKind.SetAccessor
+    ) {
+      return current.getStartLineNumber()
+    }
+    current = current.getParent()
+  }
+
+  return null // module-scope, no enclosing function
+}
+
 /**
  * Infer a meaningful name/context for an arrow function or function expression
  * based on its position in the AST (e.g., method name it's passed to, property name, etc.)
@@ -221,6 +308,8 @@ function extractFunctionData(
   kind: ExtractedFunction['kind'],
   parentContext: string | null = null,
   isExportedOverride?: boolean,
+  isInlineCallback: boolean = false,
+  enclosingFunctionStartLine: number | null = null,
 ): ExtractedFunction {
   const startLine = node.getStartLineNumber()
   const endLine = node.getEndLineNumber()
@@ -280,6 +369,8 @@ function extractFunctionData(
     hasAwait,
     propertyAccessChains,
     kind,
+    enclosingFunctionStartLine,
+    isInlineCallback,
   }
 }
 
@@ -336,14 +427,27 @@ function isStatement(node: Node): boolean {
 
 /**
  * Check if a function body contains conditionals
+ * Note: Does not descend into nested functions (arrow functions, function expressions, etc.)
  */
 function checkForConditionals(body: Node | undefined): boolean {
   if (!body) return false
 
   let hasConditionals = false
 
-  body.forEachDescendant(node => {
+  body.forEachDescendant((node, traversal) => {
     const kind = node.getKind()
+
+    // Don't descend into nested functions
+    if (
+      kind === SyntaxKind.FunctionDeclaration ||
+      kind === SyntaxKind.FunctionExpression ||
+      kind === SyntaxKind.ArrowFunction ||
+      kind === SyntaxKind.MethodDeclaration
+    ) {
+      traversal.skip()
+      return
+    }
+
     if (
       kind === SyntaxKind.IfStatement ||
       kind === SyntaxKind.ConditionalExpression ||

package/src/extraction/extractor.ts

@@ -8,80 +8,38 @@
 import { Project, SourceFile } from 'ts-morph'
 import * as path from 'node:path'
 import * as fs from 'node:fs'
+import * as jsonc from 'jsonc-parser'
 
 /**
- * Strips JSON comments (both line // and block /* comments)
- * This allows parsing tsconfig.json files that contain comments
+ * Result of validating tsconfig content
  */
-export function stripJsonComments(jsonString: string): string {
-  let result = ''
-  let inString = false
-  let inLineComment = false
-  let inBlockComment = false
-  let i = 0
-
-  while (i < jsonString.length) {
-    const char = jsonString[i]
-    const nextChar = jsonString[i + 1]
-
-    // Handle string state (don't strip comments inside strings)
-    if (!inLineComment && !inBlockComment && char === '"') {
-      // Check if this quote is escaped
-      let backslashCount = 0
-      let j = i - 1
-      while (j >= 0 && jsonString[j] === '\\') {
-        backslashCount++
-        j--
-      }
-      if (backslashCount % 2 === 0) {
-        inString = !inString
-      }
-    }
-
-    if (inString) {
-      result += char
-      i++
-      continue
-    }
-
-    // Handle line comment start
-    if (!inBlockComment && char === '/' && nextChar === '/') {
-      inLineComment = true
-      i += 2
-      continue
-    }
-
-    // Handle line comment end
-    if (inLineComment && (char === '\n' || char === '\r')) {
-      inLineComment = false
-      result += char
-      i++
-      continue
-    }
-
-    // Handle block comment start
-    if (!inLineComment && char === '/' && nextChar === '*') {
-      inBlockComment = true
-      i += 2
-      continue
-    }
+export type TsconfigValidationResult =
+  | { valid: true }
+  | { valid: false; error: string }
 
-    // Handle block comment end
-    if (inBlockComment && char === '*' && nextChar === '/') {
-      inBlockComment = false
-      i += 2
-      continue
-    }
-
-    // Add character if not in a comment
-    if (!inLineComment && !inBlockComment) {
-      result += char
+/**
+ * Validates tsconfig.json content (JSONC format with comments and trailing commas)
+ *
+ * This is a pure function that can be used by both the CLI and the extractor
+ * to validate tsconfig content without duplication.
+ *
+ * @param content - The raw tsconfig.json file content
+ * @returns Validation result indicating success or failure with error message
+ */
+export function validateTsconfigContent(
+  content: string,
+): TsconfigValidationResult {
+  const errors: jsonc.ParseError[] = []
+  jsonc.parse(content, errors, { allowTrailingComma: true })
+
+  if (errors.length > 0 && errors[0]) {
+    return {
+      valid: false,
+      error: `Parse error at offset ${errors[0].offset}: ${jsonc.printParseErrorCode(errors[0].error)}`,
     }
-
-    i++
   }
 
-  return result
+  return { valid: true }
 }
 
 export type ExtractorOptions = {
@@ -108,18 +66,17 @@ export function loadProject(options: ExtractorOptions): ExtractorResult {
 
   // Validate tsconfig exists
   const absoluteTsconfigPath = path.resolve(tsconfigPath)
+  const projectDir = path.dirname(absoluteTsconfigPath)
   if (!fs.existsSync(absoluteTsconfigPath)) {
     throw new Error(`tsconfig.json not found at: ${absoluteTsconfigPath}`)
   }
 
-  // Validate tsconfig is valid JSON (strip comments first since TypeScript allows them)
-  try {
-    const content = fs.readFileSync(absoluteTsconfigPath, 'utf-8')
-    const strippedContent = stripJsonComments(content)
-    JSON.parse(strippedContent)
-  } catch (e) {
+  // Validate tsconfig is valid JSONC (TypeScript allows comments and trailing commas)
+  const content = fs.readFileSync(absoluteTsconfigPath, 'utf-8')
+  const validationResult = validateTsconfigContent(content)
+  if (!validationResult.valid) {
     throw new Error(
-      `Invalid tsconfig.json at ${absoluteTsconfigPath}: ${e instanceof Error ? e.message : String(e)}`,
+      `Invalid tsconfig.json at ${absoluteTsconfigPath}: ${validationResult.error}`,
     )
   }
 
@@ -130,10 +87,14 @@ export function loadProject(options: ExtractorOptions): ExtractorResult {
   })
 
   // Get source files, filtering to .ts only (excluding .tsx for v1)
+  // Also filter to only files under the tsconfig directory to exclude
+  // transitive dependencies from other packages
   let sourceFiles = project.getSourceFiles().filter(sf => {
     const filePath = sf.getFilePath()
     // Include only .ts files, exclude .tsx, .d.ts, test files, and generated files
+    // Must be under the project directory (not transitive deps from other packages)
     return (
+      filePath.startsWith(projectDir + '/') &&
       filePath.endsWith('.ts') &&
       !filePath.endsWith('.d.ts') &&
       !filePath.endsWith('.test.ts') &&