hermex 2.0.0-beta.5 → 2.0.0-beta.7

package/dist/cli.mjs

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { Command } from "commander";
-import ora from "ora";
 import chalk from "chalk";
 import Table from "cli-table3";
 import fs, { existsSync, readFileSync } from "node:fs";
@@ -18,6 +17,7 @@ import lockfile from "@yarnpkg/lockfile";
 import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
+import ora from "ora";
 //#region src/utils/format-utils.ts
 /**
 * Format a number with thousand separators
@@ -302,7 +302,9 @@ function formatRuleType(type) {
 		case "require_packages": return "require_packages";
 		case "require_scripts": return "require_scripts";
 		case "require_package_fields": return "pkg_fields";
+		case "forbid_package_fields": return "pkg_fields";
 		case "engine_version": return "engine_version";
+		case "codeowners": return "codeowners";
 	}
 }
 function ruleIcon(violation) {
@@ -321,11 +323,21 @@ function describeViolation(v) {
 	if (v.type === "require_packages") return `${patterns} not installed${suffix}`;
 	if (v.type === "forbid_packages") return `${patterns} is forbidden${suffix}`;
 	if (v.type === "require_scripts") return `script ${patterns} missing in package.json${suffix}`;
-	if (v.type === "require_package_fields") return `field ${patterns} missing in package.json${suffix}`;
+	if (v.type === "require_package_fields") {
+		if (v.fieldPath && v.actualValue !== void 0) return `field ${v.fieldPath} is ${chalk.yellow(v.actualValue)}, does not match required value${suffix}`;
+		return `field ${patterns} missing in package.json${suffix}`;
+	}
+	if (v.type === "forbid_package_fields") return `field ${v.fieldPath ?? patterns} is forbidden in package.json${suffix}`;
 	if (v.type === "engine_version") {
 		if (!v.installedRange) return `engines.node not specified (required ${v.requiredRange})${suffix}`;
 		return `engines.node is ${chalk.yellow(v.installedRange)}, required ${chalk.cyan(v.requiredRange)}${suffix}`;
 	}
+	if (v.type === "codeowners") {
+		if (v.matchedFiles.length === 0) return `CODEOWNERS not found (looked in ${patterns})${suffix}`;
+		const shown = v.matchedFiles.slice(0, 3).join(", ");
+		const more = v.matchedFiles.length > 3 ? ` and ${v.matchedFiles.length - 3} more` : "";
+		return `${v.matchedFiles.length} scanned file(s) have no owner: ${shown}${more}${suffix}`;
+	}
 	return `${patterns} not present${suffix}`;
 }
 function printRules(aggregated) {
@@ -420,11 +432,19 @@ const RuleConfigSchema = z.object({
 	message: z.string().optional()
 });
 const RuleConfigOrArraySchema = z.union([RuleConfigSchema, z.array(RuleConfigSchema)]);
+const PackageFieldRuleSchema = RuleConfigSchema.extend({ 
+/** Optional micromatch patterns the field's stringified value must match */
+values: z.array(z.string()).optional() });
+const PackageFieldRuleOrArraySchema = z.union([PackageFieldRuleSchema, z.array(PackageFieldRuleSchema)]);
 const EngineVersionRuleSchema = z.object({
 	severity: RuleSeveritySchema,
 	range: z.string(),
 	message: z.string().optional()
 });
+const CodeownersRuleSchema = z.object({
+	severity: RuleSeveritySchema,
+	message: z.string().optional()
+});
 const ThresholdSchema = z.union([z.number(), z.literal(false)]);
 const HermexConfigSchema = z.object({
 	includes: z.array(z.string()).default(["**/*.{tsx,jsx,ts,js}"]),
@@ -450,15 +470,18 @@ const HermexConfigSchema = z.object({
 		forbid_packages: RuleConfigOrArraySchema.default([]),
 		require_packages: RuleConfigOrArraySchema.default([]),
 		require_scripts: RuleConfigOrArraySchema.default([]),
-		require_package_fields: RuleConfigOrArraySchema.default([]),
-		engine_version: z.union([EngineVersionRuleSchema, z.array(EngineVersionRuleSchema)]).optional()
+		require_package_fields: PackageFieldRuleOrArraySchema.default([]),
+		forbid_package_fields: PackageFieldRuleOrArraySchema.default([]),
+		engine_version: z.union([EngineVersionRuleSchema, z.array(EngineVersionRuleSchema)]).optional(),
+		codeowners: CodeownersRuleSchema.optional()
 	}).default(() => ({
 		detect_files: [],
 		require_files: [],
 		forbid_packages: [],
 		require_packages: [],
 		require_scripts: [],
-		require_package_fields: []
+		require_package_fields: [],
+		forbid_package_fields: []
 	})),
 	output: z.object({
 		summary: z.union([z.literal("log"), z.literal(false)]).default("log"),
@@ -870,10 +893,10 @@ function analyzeConditionalExpression(node, state) {
 */
 function analyzeArrayExpression(node, state) {
 	if (node.elements?.some((elem) => {
-		if (elem?.type === "Identifier") return state.componentNames.has(elem.value);
+		if (elem?.expression?.type === "Identifier") return state.componentNames.has(elem.expression.value);
 		return false;
 	})) state.usagePatterns.arrayMappings.add({
-		components: node.elements?.map((elem) => elem?.value).filter(Boolean),
+		components: node.elements?.map((elem) => elem?.expression?.value).filter(Boolean),
 		line: node.span?.start || 0
 	});
 }
@@ -899,11 +922,11 @@ function analyzeObjectExpression(node, state) {
 * Analyzes React.lazy() imports
 */
 function analyzeLazyImport(node, state) {
-	const arg = node.arguments?.[0];
+	const arg = node.arguments?.[0]?.expression;
 	if (arg?.type === "ArrowFunctionExpression" && arg.body?.type === "CallExpression") {
 		const importCall = arg.body;
 		if (importCall.callee?.type === "Import") {
-			const source = importCall.arguments?.[0]?.value;
+			const source = importCall.arguments?.[0]?.expression?.value;
 			if (source) state.usagePatterns.lazyImports.add({
 				source,
 				line: node.span?.start || 0
@@ -915,7 +938,7 @@ function analyzeLazyImport(node, state) {
 * Analyzes dynamic import() calls
 */
 function analyzeDynamicImport(node, state) {
-	const source = node.arguments?.[0]?.value;
+	const source = node.arguments?.[0]?.expression?.value;
 	if (source) state.usagePatterns.dynamicImports.add({
 		source,
 		line: node.span?.start || 0
@@ -929,7 +952,7 @@ function analyzeDynamicImport(node, state) {
 function analyzeHOCUsage(node, state) {
 	state.usagePatterns.hocUsage.add({
 		function: node.callee?.value || "[unknown]",
-		component: node.arguments?.[0]?.value || "[unknown]",
+		component: node.arguments?.[0]?.expression?.value || "[unknown]",
 		line: node.span?.start || 0
 	});
 }
@@ -937,7 +960,7 @@ function analyzeHOCUsage(node, state) {
 * Analyzes React.memo() usage
 */
 function analyzeMemoUsage(node, state) {
-	const component = node.arguments?.[0];
+	const component = node.arguments?.[0]?.expression;
 	if (component?.type === "Identifier" && state.componentNames.has(component.value)) state.usagePatterns.memoizedComponents.add({
 		component: component.value,
 		line: node.span?.start || 0
@@ -968,7 +991,7 @@ function analyzeMemberExpression(node, state) {
 * Checks if a node represents HOC pattern
 */
 function isHOCPattern(node, state) {
-	return node.callee?.type === "Identifier" && node.arguments?.some((arg) => arg.type === "Identifier" && state.componentNames.has(arg.value));
+	return node.callee?.type === "Identifier" && node.arguments?.some((arg) => arg.expression?.type === "Identifier" && state.componentNames.has(arg.expression.value));
 }
 //#endregion
 //#region src/swc-parser/core/visitor.ts
@@ -1075,8 +1098,9 @@ function visitChildren(node, state, context) {
 /**
 * Generates a comprehensive usage report from parser state
 */
-function generateReport(state) {
+function generateReport(state, filePath) {
 	return {
+		filePath,
 		summary: {
 			totalImports: state.usagePatterns.defaultImports.size + state.usagePatterns.namedImports.size + state.usagePatterns.namespaceImports.size,
 			totalComponents: state.componentNames.size,
@@ -1157,7 +1181,7 @@ function swcOptionsForFile(filePath) {
 function parseCode(code, filePath = "file.tsx") {
 	const state = createState();
 	visitNode(parseSync(code, swcOptionsForFile(filePath)), state);
-	return generateReport(state);
+	return generateReport(state, filePath);
 }
 function parseFile(filePath) {
 	return parseCode(fs.readFileSync(filePath, "utf8"), filePath);
@@ -1296,18 +1320,63 @@ function evaluateScriptRules(repoPath, rulesConfig) {
 }
 //#endregion
 //#region src/rules/package-field-rules.ts
+/** Resolves a dot-path like "engines.node" against the manifest object. */
+function getFieldAtPath(pkg, path) {
+	let current = pkg;
+	for (const key of path.split(".")) {
+		if (current === null || typeof current !== "object" || !(key in current)) return {
+			exists: false,
+			value: void 0
+		};
+		current = current[key];
+	}
+	return {
+		exists: true,
+		value: current
+	};
+}
+/** Primitives compare by string form; objects/arrays never match a value pattern. */
+function valueMatches(value, valuePatterns) {
+	if (value === null || typeof value === "object") return false;
+	return micromatch.isMatch(String(value), valuePatterns);
+}
 function evaluatePackageFieldRules(repoPath, rulesConfig) {
-	const rules = toArray(rulesConfig.require_package_fields);
-	if (rules.length === 0) return [];
+	const requireRules = toArray(rulesConfig.require_package_fields);
+	const forbidRules = toArray(rulesConfig.forbid_package_fields);
+	if (requireRules.length === 0 && forbidRules.length === 0) return [];
 	const pkg = readPackageJson(repoPath);
-	const fieldKeys = pkg ? Object.keys(pkg) : [];
-	return rules.filter((rule) => !rule.patterns.some((p) => fieldKeys.includes(p))).map((rule) => ({
-		type: "require_package_fields",
-		severity: rule.severity,
-		patterns: rule.patterns,
-		message: rule.message,
-		matchedFiles: []
-	}));
+	const violations = [];
+	for (const rule of requireRules) {
+		const lookups = rule.patterns.map((p) => ({
+			path: p,
+			...getFieldAtPath(pkg, p)
+		}));
+		if (!lookups.some((l) => l.exists && (!rule.values || valueMatches(l.value, rule.values)))) {
+			const mismatch = rule.values ? lookups.find((l) => l.exists) : void 0;
+			violations.push({
+				type: "require_package_fields",
+				severity: rule.severity,
+				patterns: rule.patterns,
+				message: rule.message,
+				matchedFiles: [],
+				fieldPath: mismatch?.path,
+				actualValue: mismatch && typeof mismatch.value !== "object" ? String(mismatch.value) : void 0
+			});
+		}
+	}
+	for (const rule of forbidRules) for (const pattern of rule.patterns) {
+		const lookup = getFieldAtPath(pkg, pattern);
+		if (lookup.exists && (!rule.values || valueMatches(lookup.value, rule.values))) violations.push({
+			type: "forbid_package_fields",
+			severity: rule.severity,
+			patterns: rule.patterns,
+			message: rule.message,
+			matchedFiles: [],
+			fieldPath: pattern,
+			actualValue: lookup.value !== null && typeof lookup.value !== "object" ? String(lookup.value) : void 0
+		});
+	}
+	return violations;
 }
 //#endregion
 //#region src/rules/engine-version.ts
@@ -1338,13 +1407,102 @@ function evaluateEngineVersion(repoPath, rulesConfig) {
 	});
 }
 //#endregion
+//#region src/rules/codeowners.ts
+const CODEOWNERS_LOCATIONS = [
+	".github/CODEOWNERS",
+	"CODEOWNERS",
+	"docs/CODEOWNERS"
+];
+/** First existing location, GitHub search order. Null if none exist. */
+function findCodeownersFile(repoPath) {
+	for (const location of CODEOWNERS_LOCATIONS) {
+		const full = path$1.join(repoPath, location);
+		if (fs$1.existsSync(full)) return full;
+	}
+	return null;
+}
+/** Parses content into entries; skips blank lines and # comments. */
+function parseCodeowners(content) {
+	const entries = [];
+	for (const rawLine of content.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#")) continue;
+		const tokens = line.split(/\s+/);
+		const pattern = tokens[0];
+		const owners = tokens.slice(1);
+		entries.push({
+			pattern,
+			globs: codeownersPatternToGlobs(pattern),
+			owners
+		});
+	}
+	return entries;
+}
+/**
+* Translates a CODEOWNERS (gitignore-style) pattern into micromatch glob(s).
+*
+* Rules:
+* - `*` alone matches everything.
+* - A leading `/`, or a `/` anywhere in the middle of the pattern, anchors
+*   the match to the repo root (the leading `/` is stripped once anchored).
+* - A pattern with no anchoring gets a `**\/` prefix so it matches at any depth.
+* - A trailing `/` restricts the match to a directory, so `/**` is appended.
+* - A bare name (no glob characters, no slash at all) also matches as a
+*   directory anywhere, so the `/**` directory variant is added alongside
+*   the plain match.
+*/
+function codeownersPatternToGlobs(pattern) {
+	if (pattern === "*") return ["**"];
+	let p = pattern;
+	const hadLeadingSlash = p.startsWith("/");
+	if (hadLeadingSlash) p = p.slice(1);
+	const hadTrailingSlash = p.endsWith("/") && p.length > 1;
+	if (hadTrailingSlash) p = p.slice(0, -1);
+	const hasInternalSlash = p.includes("/");
+	const anchored = hadLeadingSlash || hasInternalSlash;
+	const hasGlobChars = /[*?[\]{}!()]/.test(p);
+	const isBareName = !anchored && !hasGlobChars && !hadTrailingSlash;
+	const base = anchored ? p : `**/${p}`;
+	const globs = [hadTrailingSlash ? `${base}/**` : base];
+	if (isBareName) globs.push(`${base}/**`);
+	return globs;
+}
+/** Last matching entry wins; owned iff that entry has >= 1 owner. */
+function fileIsOwned(file, entries) {
+	for (let i = entries.length - 1; i >= 0; i--) if (micromatch.isMatch(file, entries[i].globs, { dot: true })) return entries[i].owners.length > 0;
+	return false;
+}
+function evaluateCodeowners(repoPath, rulesConfig, scannedFiles) {
+	const rule = rulesConfig.codeowners;
+	if (!rule) return [];
+	const filePath = findCodeownersFile(repoPath);
+	if (!filePath) return [{
+		type: "codeowners",
+		severity: rule.severity,
+		patterns: CODEOWNERS_LOCATIONS,
+		message: rule.message,
+		matchedFiles: []
+	}];
+	const entries = parseCodeowners(fs$1.readFileSync(filePath, "utf-8"));
+	const unowned = scannedFiles.map((f) => (path$1.isAbsolute(f) ? path$1.relative(repoPath, f) : f).replace(/\\/g, "/")).filter((f) => !fileIsOwned(f, entries));
+	if (unowned.length === 0) return [];
+	return [{
+		type: "codeowners",
+		severity: rule.severity,
+		patterns: [path$1.basename(filePath)],
+		message: rule.message,
+		matchedFiles: unowned
+	}];
+}
+//#endregion
 //#region src/rules/evaluator.ts
-function evaluateRules(repoPath, rulesConfig, excludes) {
+function evaluateRules(repoPath, rulesConfig, excludes, scannedFiles = []) {
 	return [
 		...evaluateFileRules(repoPath, rulesConfig, excludes),
 		...evaluateScriptRules(repoPath, rulesConfig),
 		...evaluatePackageFieldRules(repoPath, rulesConfig),
-		...evaluateEngineVersion(repoPath, rulesConfig)
+		...evaluateEngineVersion(repoPath, rulesConfig),
+		...evaluateCodeowners(repoPath, rulesConfig, scannedFiles)
 	];
 }
 //#endregion
@@ -1462,14 +1620,16 @@ function aggregateReports(reports, versions = {}, config, multiVersions = {}) {
 		for (const jsx of report.patterns.usage.jsx) {
 			const key = jsx.component;
 			const existing = componentUsageMap.get(key);
-			if (existing) existing.count++;
-			else {
+			if (existing) {
+				existing.count++;
+				existing.files.add(report.filePath);
+			} else {
 				const source = findComponentSource(jsx.component, report, availablePackages);
 				componentUsageMap.set(key, {
 					name: jsx.component,
 					source,
 					count: 1,
-					files: /* @__PURE__ */ new Set()
+					files: /* @__PURE__ */ new Set([report.filePath])
 				});
 			}
 		}
@@ -1981,7 +2141,7 @@ async function runPipeline(config, spinner) {
 	spinner.succeed(chalk.green(`Analysis complete! Analyzed ${reports.length}/${files.length} files`));
 	printErrors(parseErrors);
 	const aggregated = aggregateReports(reports, lockfileResult.versions, config, lockfileResult.multiVersions);
-	const evaluatorViolations = evaluateRules(process.cwd(), config.rules, config.excludes);
+	const evaluatorViolations = evaluateRules(process.cwd(), config.rules, config.excludes, files);
 	aggregated.ruleViolations = [...aggregated.ruleViolations, ...evaluatorViolations];
 	if (config.releaseAge.enabled) {
 		spinner.start("Fetching release age from registry...");
@@ -1992,6 +2152,24 @@ async function runPipeline(config, spinner) {
 	return aggregated;
 }
 //#endregion
+//#region src/commands/command-context.ts
+/**
+* Shared command preamble: routes human-readable chrome (version line,
+* spinner) to stderr when the command emits JSON on stdout.
+*/
+function createCommandContext(config) {
+	const isJson = config.output.format === "json";
+	const stream = isJson ? process.stderr : process.stdout;
+	stream.write(chalk.gray(`hermex v${getVersion()}\n`));
+	return {
+		isJson,
+		spinner: ora({
+			text: "Parsing lockfile...",
+			stream
+		}).start()
+	};
+}
+//#endregion
 //#region src/commands/scan.ts
 function registerScanCommand(program) {
 	program.command("scan").description("Scan and analyze local files").option("--config <path>", "Path to hermex config file (overrides CWD discovery)").action(async (options) => {
@@ -1999,12 +2177,7 @@ function registerScanCommand(program) {
 	});
 }
 async function executeScan(config) {
-	const isJson = config.output.format === "json";
-	(isJson ? process.stderr : process.stdout).write(chalk.gray(`hermex v${getVersion()}\n`));
-	const spinner = ora({
-		text: "Parsing lockfile...",
-		stream: isJson ? process.stderr : process.stdout
-	}).start();
+	const { isJson, spinner } = createCommandContext(config);
 	try {
 		const aggregated = await runPipeline(config, spinner);
 		if (!aggregated) return;
@@ -2013,8 +2186,7 @@ async function executeScan(config) {
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		spinner.fail(chalk.red("Analysis failed: " + message));
-		console.error(error);
-		process.exit(1);
+		process.exitCode = 1;
 	}
 }
 function printScanResults(aggregated, config) {
@@ -2073,12 +2245,7 @@ function registerComplyCommand(program) {
 	});
 }
 async function executeComply(config) {
-	const isJson = config.output.format === "json";
-	(isJson ? process.stderr : process.stdout).write(chalk.gray(`hermex v${getVersion()}\n`));
-	const spinner = ora({
-		text: "Parsing lockfile...",
-		stream: isJson ? process.stderr : process.stdout
-	}).start();
+	const { isJson, spinner } = createCommandContext(config);
 	try {
 		const aggregated = await runPipeline(config, spinner);
 		if (!aggregated) {
@@ -2096,7 +2263,6 @@ async function executeComply(config) {
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		spinner.fail(chalk.red("Compliance check failed: " + message));
-		console.error(error);
 		process.exitCode = 2;
 	}
 }