i18n-smell-detector 0.4.1 → 0.5.0

package/README.md

@@ -2,21 +2,23 @@
 
 [![npm version](https://img.shields.io/npm/v/i18n-smell-detector.svg)](https://www.npmjs.com/package/i18n-smell-detector)
 [![CI](https://github.com/xue-moe/i18n-smell-detector/actions/workflows/ci.yml/badge.svg)](https://github.com/xue-moe/i18n-smell-detector/actions/workflows/ci.yml)
+[![Socket Badge](https://badge.socket.dev/npm/package/i18n-smell-detector)](https://badge.socket.dev/npm/package/i18n-smell-detector)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
 
 Find localization issues that key coverage checks miss.
 
-`i18n-smell-detector` checks localization files for keys whose translated value is identical to the base locale. It can also scan Vue templates for hardcoded user-visible strings.
+`i18n-smell-detector` checks localization files for copied base-locale values and placeholder mismatches. It can also scan Vue, JavaScript, TypeScript, JSX, and TSX source for hardcoded user-visible strings.
 
-Current scope: `check-hardcoded` scans Vue templates only; JavaScript, TypeScript, and JSX strings are not scanned yet. Text classification is rule-based and conservative, so projects with many proper nouns, product codes, or non-English copy should start with `--fail-on none` and tune allowlists before enforcing CI.
+Current scope: text classification is rule-based and conservative, so projects with many proper nouns, product codes, or non-English copy should start with `--fail-on none` and tune allowlists before enforcing CI.
 
 ## Features
 
 - Detect values that are identical to the base locale
-- Detect hardcoded strings in Vue template text and selected attributes
+- Detect missing or extra placeholders across locale values
+- Detect hardcoded strings in Vue templates, JSX/TSX text and attributes, and configured JS/TS function calls
 - Ignore expected matches by key or value
 - Classify findings as `high`, `medium`, `low`, or `ignored`
-- Output results as console text, JSON, or Markdown
+- Output results as console text, JSON, Markdown, or SARIF
 - Fail CI based on a configurable severity level
 
 ## Install
@@ -33,6 +35,7 @@ Run the check:
 npx i18n-smell-detector check --config i18n-smell.config.mjs
 npx i18n-smell-detector check-identical --config i18n-smell.config.mjs
 npx i18n-smell-detector check-hardcoded --config i18n-smell.config.mjs
+npx i18n-smell-detector check-placeholders --config i18n-smell.config.mjs
 ```
 
 Output formats:
@@ -43,6 +46,7 @@ npx i18n-smell-detector check-identical --format json
 npx i18n-smell-detector check-identical --format markdown
 npx i18n-smell-detector check-hardcoded --format json
 npx i18n-smell-detector check --format markdown --output i18n-report.md
+npx i18n-smell-detector check --format sarif --output i18n-smell.sarif
 ```
 
 CLI options:
@@ -50,7 +54,7 @@ CLI options:
 | Option | Description |
 |---|---|
 | `-c, --config <path>` | Use a specific config file. |
-| `--format <format>` | Print `console`, `json`, or `markdown` output. |
+| `--format <format>` | Print `console`, `json`, `markdown`, or `sarif` output. |
 | `--fail-on <level>` | Exit with code `1` for findings at `high`, `medium`, or `low`. Use `none` while tuning. |
 | `--include-ignored` | Include ignored findings in the report. |
 | `--output <path>` | Write the full report to a file and print a short summary. |
@@ -120,10 +124,11 @@ export default {
   baseLocale: 'en',
   checks: {
     identical: true,
-    hardcoded: true
+    hardcoded: true,
+    placeholders: true
   },
   source: [
-    'src/**/*.vue'
+    'src/**/*.{vue,js,jsx,ts,tsx}'
   ],
 
   locales: {
@@ -149,8 +154,8 @@ export default {
   ],
 
   placeholderPatterns: [
-    '\\{[^}]+\\}',
     '\\{\\{[^}]+\\}\\}',
+    '(?<!\\{)\\{[^{}]+\\}(?!\\})',
     '%[sdif]',
     '%\\([^)]+\\)[sdif]',
     '\\$\\d+'
@@ -165,6 +170,22 @@ export default {
       'aria-label',
       'aria-description'
     ],
+    jsxAttributes: [
+      'placeholder',
+      'title',
+      'alt',
+      'aria-label',
+      'aria-description'
+    ],
+    functions: [
+      'toast.success',
+      'toast.error',
+      'alert',
+      'confirm'
+    ],
+    ignoreFiles: [
+      'src/generated/**'
+    ],
     ignoreValues: [
       'OK',
       'ID'
@@ -188,14 +209,17 @@ export default {
 | Option | Type | Default | Description |
 |---|---|---:|---|
 | `baseLocale` | `string` | `'en'` | Locale used as the comparison source. It must also be listed in `locales`. |
-| `checks` | `{ identical?: boolean, hardcoded?: boolean }` | both enabled | Checks run by the combined `check` command. Existing single-check commands ignore this setting. |
-| `source` | `string[]` | `['src/**/*.vue']` | Source globs used by `check-hardcoded`. `node_modules` is ignored. |
+| `checks` | `{ identical?: boolean, hardcoded?: boolean, placeholders?: boolean }` | all enabled | Checks run by the combined `check` command. Existing single-check commands ignore this setting. |
+| `source` | `string[]` | `['src/**/*.{vue,js,jsx,ts,tsx}']` | Source globs used by `check-hardcoded`. `node_modules` and `hardcoded.ignoreFiles` are ignored. |
 | `locales` | `Record<string, string>` | `{}` | Map of locale codes to JSON locale file paths. Relative paths are resolved from the config file directory. |
 | `allowIdenticalKeys` | `(string \| RegExp)[]` | `[]` | Key rules that are allowed to match the base locale. String rules support `*` wildcards, for example `brand.*`. `RegExp` rules are tested against the flattened key. |
 | `allowIdenticalValues` | `(string \| RegExp)[]` | `[]` | Value rules that are allowed to match the base locale. String rules are exact matches, for example `OK`, `API`, or `GET`. `RegExp` rules are tested against the full value. |
-| `placeholderPatterns` | `(string \| RegExp)[]` | `{...}` and `{{...}}` patterns | Placeholder patterns ignored when the whole value is only placeholders and whitespace. String entries must be valid regular expression sources. |
+| `placeholderPatterns` | `(string \| RegExp)[]` | common brace, printf, named printf, and `$1` patterns | Placeholder patterns used by `check-identical` placeholder-only ignores and `check-placeholders` mismatch detection. String entries must be valid regular expression sources. |
 | `ignoreCodeLike` | `boolean` | `true` | Ignore built-in code-like values such as paths, colors, acronyms, and identifiers. Set to `false` to report them. |
 | `hardcoded.vueAttributes` | `string[]` | `placeholder`, `title`, `alt`, `aria-label`, `aria-description` | Static Vue attributes checked by `check-hardcoded`. Dynamic bindings such as `:placeholder` are ignored. |
+| `hardcoded.jsxAttributes` | `string[]` | `placeholder`, `title`, `alt`, `aria-label`, `aria-description` | Static JSX/TSX attributes checked by `check-hardcoded`. Expression attributes are ignored unless they contain a static string literal. |
+| `hardcoded.functions` | `string[]` | `alert`, `confirm`, `toast.success`, `toast.error` | JS/TS call expressions whose static string arguments are checked by `check-hardcoded`. |
+| `hardcoded.ignoreFiles` | `string[]` | `[]` | Glob patterns excluded from `check-hardcoded`, useful for generated files or vendored code. |
 | `hardcoded.ignoreValues` | `(string \| RegExp)[]` | `[]` | Exact values or regular expressions ignored by `check-hardcoded`. |
 | `hardcoded.ignorePatterns` | `(string \| RegExp)[]` | `[]` | Regular expression patterns ignored by `check-hardcoded`. String entries are compiled as regular expressions. |
 | `failOn` | `'high' \| 'medium' \| 'low' \| 'none'` | `'high'` | Lowest severity that makes the CLI exit with code `1`. Use `none` to report without failing. |
@@ -203,7 +227,7 @@ export default {
 | `ignoreCase` | `boolean` | `false` | Compare values case-insensitively when set to `true`. |
 | `ignoreSameLanguageFamily` | `boolean` | `true` | Ignore regional variants that share the same language family, such as `en` and `en-GB`. Set to `false` to check regional variants too. |
 | `includeIgnored` | `boolean` | `false` | Include ignored findings in reports. Can also be enabled with `--include-ignored`. |
-| `format` | `'console' \| 'json' \| 'markdown'` | `'console'` | Default report format. CLI `--format` takes precedence. |
+| `format` | `'console' \| 'json' \| 'markdown' \| 'sarif'` | `'console'` | Default report format. CLI `--format` takes precedence. |
 | `output` | `string` | unset | Report file path. CLI `--output` takes precedence. |
 | `baseline` | `string` | unset | Baseline file path used by `--baseline` or `--update-baseline`. |
 
@@ -263,12 +287,53 @@ Summary counts include all findings, including ignored findings that may be omit
 | `value` | `string` | Identical target value. |
 | `severity` | `'high' \| 'medium' \| 'low' \| 'ignored'` | Classification assigned by the detection rules. |
 | `reason` | `string` | Short explanation for the classification. |
+| `id` | `string` | Stable issue identifier used by JSON, SARIF, and baselines. |
 
 Ignored issues are omitted by default. Pass `--include-ignored` to include them in JSON, console, or Markdown output.
 
+## Placeholder output
+
+`check-placeholders` reports target locale values whose placeholder set differs from the base locale:
+
+```txt
+i18n-smell-detector: placeholder mismatches
+high=1 medium=0 low=0 ignored=0
+
+HIGH zh.user.greeting
+  value: "你好"
+  missing: {name}
+  reason: missing placeholder
+```
+
+JSON output includes `missing` and `extra` arrays:
+
+```json
+{
+  "summary": {
+    "high": 1,
+    "medium": 0,
+    "low": 0,
+    "ignored": 0
+  },
+  "issues": [
+    {
+      "key": "user.greeting",
+      "baseLocale": "en",
+      "targetLocale": "zh",
+      "value": "你好",
+      "missing": ["{name}"],
+      "extra": [],
+      "severity": "high",
+      "reason": "missing placeholder",
+      "id": "placeholders:zh:user.greeting"
+    }
+  ]
+}
+```
+
 ## Hardcoded string output
 
-`check-hardcoded` reports Vue template text and static user-visible attributes:
+`check-hardcoded` reports Vue template text, static Vue attributes, JSX/TSX text and attributes, and configured JS/TS function call strings:
 
 ```txt
 i18n-smell-detector: hardcoded strings
@@ -301,7 +366,8 @@ JSON output includes source locations:
       "value": "Profile settings",
       "severity": "high",
       "reason": "static template text",
-      "kind": "vue-text"
+      "kind": "vue-text",
+      "id": "hardcoded:src/components/UserPanel.vue:12:15:Profile settings"
     }
   ]
 }
@@ -321,7 +387,8 @@ Disable checks during gradual rollout:
 export default {
   checks: {
     identical: true,
-    hardcoded: false
+    hardcoded: false,
+    placeholders: true
   }
 };
 ```
@@ -342,6 +409,12 @@ Combined JSON output groups counts by check:
       "medium": 2,
       "low": 0,
       "ignored": 3
+    },
+    "placeholders": {
+      "high": 1,
+      "medium": 0,
+      "low": 0,
+      "ignored": 0
     }
   },
   "issues": []
@@ -355,10 +428,13 @@ Use `--output` to write the full report to a file. The CLI prints a short summar
 ```bash
 npx i18n-smell-detector check --format markdown --output reports/i18n-report.md
 npx i18n-smell-detector check --format json --output reports/i18n-report.json
+npx i18n-smell-detector check --format sarif --output reports/i18n-smell.sarif
 ```
 
 Markdown output for `check` includes a summary table and one section per check, which makes it suitable for CI artifacts.
 
+SARIF output uses stable issue ids as `partialFingerprints.stableId`, so it can be uploaded to code scanning tools that understand SARIF 2.1.0.
+
 ## Gradual adoption
 
 Use a baseline to ignore existing findings while still failing CI for new ones:
@@ -416,10 +492,11 @@ export default {
     /^HTTP\/\d(\.\d)?$/
   ],
   placeholderPatterns: [
-    '\\{[^}]+\\}',
     '\\{\\{[^}]+\\}\\}',
+    '(?<!\\{)\\{[^{}]+\\}(?!\\})',
     '%[sdif]',
-    '%\\([^)]+\\)[sdif]'
+    '%\\([^)]+\\)[sdif]',
+    '\\$\\d+'
   ],
   failOn: 'high'
 };
@@ -435,13 +512,16 @@ Useful tuning patterns:
 - Set `ignoreSameLanguageFamily: false` if you want to check regional variants such as `en-GB`, `en-AU`, or `pt-BR`.
 - Set `failOn: 'none'` while tuning a new project, then raise it to `high` or `medium` once the allowlist is stable.
 - Pass `--include-ignored` when reviewing why a value was ignored.
-- Use `source` to choose Vue files for `check-hardcoded`.
+- Use `source` to choose Vue, JS, TS, JSX, and TSX files for `check-hardcoded`.
 - Tune `hardcoded.vueAttributes` if your project uses additional static attributes for user-visible text.
+- Tune `hardcoded.jsxAttributes` if your React components use additional static attributes for user-visible text.
+- Tune `hardcoded.functions` to check project-specific notification, modal, or validation helpers.
+- Use `hardcoded.ignoreFiles` for generated source files.
 - Use `hardcoded.ignoreValues` and `hardcoded.ignorePatterns` for intentional literals such as `OK`, version labels, or product codes.
 
 ## Limitations
 
-`check-hardcoded` currently scans Vue templates only. JavaScript, TypeScript, and JSX string detection are not included yet. Classification uses heuristic rules rather than full language detection.
+`check-hardcoded` scans configured static strings in Vue, JS, TS, JSX, and TSX. It does not evaluate runtime expressions or follow variables. Classification uses heuristic rules rather than full language detection.
 
 ## Notes
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "i18n-smell-detector",
-  "version": "0.4.1",
-  "description": "Find locale values copied from the base locale.",
+  "version": "0.5.0",
+  "description": "Find copied locale values, placeholder mismatches, and hardcoded user-visible strings.",
   "type": "module",
   "bin": {
     "i18n-smell-detector": "./bin/i18n-smell-detector.js"
@@ -43,6 +43,7 @@
     "node": ">=18.17"
   },
   "dependencies": {
+    "@babel/parser": "^7.29.7",
     "@vue/compiler-dom": "^3.5.39",
     "@vue/compiler-sfc": "^3.5.39",
     "fast-glob": "^3.3.3"

package/src/baseline.js

@@ -2,7 +2,7 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 
 export function issueId(check, issue) {
-  if (check === 'identical') return `identical:${issue.targetLocale}:${issue.key}`;
+  if (check === 'identical' || check === 'placeholders') return `${check}:${issue.targetLocale}:${issue.key}`;
   return `hardcoded:${issue.file}:${issue.line}:${issue.column}:${issue.value}`;
 }
 
@@ -25,8 +25,6 @@ export async function loadBaseline(filePath) {
 }
 
 export function applyBaseline(results, ids) {
-  if (!ids.size) return results;
-
   return results.map((result) => ({
     ...result,
     issues: result.issues.map((issue) => {
@@ -58,7 +56,7 @@ function toBaselineIssue(check, issue) {
     value: issue.value,
   };
 
-  if (check === 'identical') {
+  if (check === 'identical' || check === 'placeholders') {
     return {
       ...base,
       key: issue.key,

package/src/check-hardcoded.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import fg from 'fast-glob';
+import { scanJsSource } from './source/scan-js-source.js';
 import { scanVueSfc } from './source/scan-vue-sfc.js';
 
 function compareIssues(a, b) {
@@ -15,7 +16,7 @@ export async function checkHardcodedStrings(config, baseDir) {
     cwd: baseDir,
     absolute: true,
     onlyFiles: true,
-    ignore: ['**/node_modules/**'],
+    ignore: ['**/node_modules/**', ...(config.hardcoded.ignoreFiles || [])],
   });
 
   if (files.length === 0) {
@@ -24,7 +25,7 @@ export async function checkHardcodedStrings(config, baseDir) {
 
   const issues = [];
   for (const file of files) {
-    const fileIssues = await scanVueSfc(file, config);
+    const fileIssues = await scanSourceFile(file, config);
     for (const issue of fileIssues) {
       issues.push({
         ...issue,
@@ -35,3 +36,9 @@ export async function checkHardcodedStrings(config, baseDir) {
 
   return issues.sort(compareIssues);
 }
+
+async function scanSourceFile(file, config) {
+  if (file.endsWith('.vue')) return scanVueSfc(file, config);
+  if (/\.[cm]?[jt]sx?$/.test(file)) return scanJsSource(file, config);
+  return [];
+}

package/src/check-placeholders.js

@@ -0,0 +1,60 @@
+function compareIssues(a, b) {
+  const rank = { high: 3, medium: 2, low: 1, ignored: 0 };
+  return rank[b.severity] - rank[a.severity]
+    || a.targetLocale.localeCompare(b.targetLocale)
+    || a.key.localeCompare(b.key);
+}
+
+export function extractPlaceholders(value, patterns) {
+  const placeholders = new Set();
+  const text = String(value);
+
+  for (const pattern of patterns) {
+    pattern.lastIndex = 0;
+    for (const match of text.matchAll(pattern)) {
+      placeholders.add(match[0]);
+    }
+  }
+
+  return [...placeholders].sort();
+}
+
+/**
+ * @param {Record<string, Record<string, string>>} locales
+ * @param {import('./types.js').DetectorConfig} config
+ * @returns {import('./types.js').PlaceholderIssue[]}
+ */
+export function checkPlaceholders(locales, config) {
+  const base = locales[config.baseLocale];
+  const issues = [];
+
+  for (const [targetLocale, target] of Object.entries(locales)) {
+    if (targetLocale === config.baseLocale) continue;
+
+    for (const [key, baseValue] of Object.entries(base)) {
+      if (!(key in target)) continue;
+
+      const basePlaceholders = extractPlaceholders(baseValue, config.placeholderPatterns);
+      const targetPlaceholders = extractPlaceholders(target[key], config.placeholderPatterns);
+      const targetSet = new Set(targetPlaceholders);
+      const baseSet = new Set(basePlaceholders);
+      const missing = basePlaceholders.filter((placeholder) => !targetSet.has(placeholder));
+      const extra = targetPlaceholders.filter((placeholder) => !baseSet.has(placeholder));
+
+      if (missing.length === 0 && extra.length === 0) continue;
+
+      issues.push({
+        key,
+        baseLocale: config.baseLocale,
+        targetLocale,
+        value: target[key],
+        missing,
+        extra,
+        severity: missing.length > 0 ? 'high' : 'medium',
+        reason: missing.length > 0 ? 'missing placeholder' : 'extra placeholder',
+      });
+    }
+  }
+
+  return issues.sort(compareIssues);
+}

package/src/cli.js

@@ -13,11 +13,12 @@ i18n-smell-detector
 Usage:
   i18n-smell-detector check-identical [options]
   i18n-smell-detector check-hardcoded [options]
+  i18n-smell-detector check-placeholders [options]
   i18n-smell-detector check [options]
 
 Options:
   -c, --config <path>       Config file path
-  --format <format>         console | json | markdown  (default: console)
+  --format <format>         console | json | markdown | sarif  (default: console)
   --fail-on <level>         high | medium | low | none (default: config.failOn or high)
   --output <path>           Write the full report to a file
   --baseline <path>         Read a baseline file
@@ -28,6 +29,7 @@ Options:
 Example:
   i18n-smell-detector check-identical -c i18n-smell.config.mjs --format markdown
   i18n-smell-detector check-hardcoded -c i18n-smell.config.mjs --format json
+  i18n-smell-detector check-placeholders -c i18n-smell.config.mjs --format json
 `;
 
 function parseArgs(argv) {
@@ -43,7 +45,7 @@ function parseArgs(argv) {
     } else if (arg === '-c' || arg === '--config') {
       options.configPath = args[++index];
     } else if (arg === '--format') {
-      options.format = readChoice(args[++index], ['console', 'json', 'markdown'], 'format');
+      options.format = readChoice(args[++index], ['console', 'json', 'markdown', 'sarif'], 'format');
     } else if (arg === '--fail-on') {
       options.failOn = readChoice(args[++index], ['none', 'low', 'medium', 'high'], 'fail-on level');
     } else if (arg === '--output') {
@@ -77,7 +79,7 @@ export async function runCli(argv) {
     return;
   }
 
-  if (!['check-identical', 'check-hardcoded', 'check'].includes(options.command)) {
+  if (!['check-identical', 'check-hardcoded', 'check-placeholders', 'check'].includes(options.command)) {
     throw new Error(`Unknown command: ${options.command}\n${HELP}`);
   }
 
@@ -131,6 +133,7 @@ export async function runCli(argv) {
 function commandChecks(command, config) {
   if (command === 'check-identical') return ['identical'];
   if (command === 'check-hardcoded') return ['hardcoded'];
+  if (command === 'check-placeholders') return ['placeholders'];
   return enabledChecks(config);
 }
 
@@ -140,6 +143,7 @@ function renderSingleReport(result, options) {
     title: result.title,
     heading: result.heading,
     emptyMessage: result.emptyMessage,
+    check: result.check,
   });
 }
 

package/src/config.js

@@ -14,7 +14,10 @@ const CONFIG_FILES = [
 
 const DEFAULT_PLACEHOLDER_PATTERNS = [
   String.raw`\{\{[^}]+\}\}`,
-  String.raw`\{[^}]+\}`,
+  String.raw`(?<!\{)\{[^{}]+\}(?!\})`,
+  String.raw`%[sdif]`,
+  String.raw`%\([^)]+\)[sdif]`,
+  String.raw`\$\d+`,
 ];
 
 const DEFAULT_HARDCODED_ATTRIBUTES = [
@@ -25,6 +28,17 @@ const DEFAULT_HARDCODED_ATTRIBUTES = [
   'aria-description',
 ];
 
+const DEFAULT_HARDCODED_FUNCTIONS = [
+  'alert',
+  'confirm',
+  'toast.success',
+  'toast.error',
+];
+
+const DEFAULT_SOURCE_GLOBS = [
+  'src/**/*.{vue,js,jsx,ts,tsx}',
+];
+
 async function exists(filePath) {
   try {
     await access(filePath);
@@ -102,8 +116,8 @@ function validateConfig(config) {
     throw new Error('Config checks must be an object');
   }
 
-  if ('format' in candidate && !['console', 'json', 'markdown'].includes(candidate.format)) {
-    throw new Error('Config format must be console, json, or markdown');
+  if ('format' in candidate && !['console', 'json', 'markdown', 'sarif'].includes(candidate.format)) {
+    throw new Error('Config format must be console, json, markdown, or sarif');
   }
 
   if ('output' in candidate && typeof candidate.output !== 'string') {
@@ -118,6 +132,15 @@ function validateConfig(config) {
   if ('vueAttributes' in hardcoded && !isStringArray(hardcoded.vueAttributes)) {
     throw new Error('Config hardcoded.vueAttributes must be an array of strings');
   }
+  if ('jsxAttributes' in hardcoded && !isStringArray(hardcoded.jsxAttributes)) {
+    throw new Error('Config hardcoded.jsxAttributes must be an array of strings');
+  }
+  if ('functions' in hardcoded && !isStringArray(hardcoded.functions)) {
+    throw new Error('Config hardcoded.functions must be an array of strings');
+  }
+  if ('ignoreFiles' in hardcoded && !isStringArray(hardcoded.ignoreFiles)) {
+    throw new Error('Config hardcoded.ignoreFiles must be an array of glob strings');
+  }
   validateRuleList(hardcoded.ignoreValues, 'hardcoded.ignoreValues');
   validateRuleList(hardcoded.ignorePatterns, 'hardcoded.ignorePatterns');
 }
@@ -137,15 +160,17 @@ function withDefaults(config) {
     checks: {
       identical: true,
       hardcoded: true,
+      placeholders: true,
       ...(config.checks || {}),
     },
     ...config,
     checks: {
       identical: true,
       hardcoded: true,
+      placeholders: true,
       ...(config.checks || {}),
     },
-    source: config.source || ['src/**/*.vue'],
+    source: config.source || DEFAULT_SOURCE_GLOBS,
     hardcoded: normalizeHardcodedConfig(config.hardcoded || {}),
     placeholderPatterns: normalizePlaceholderPatterns(config.placeholderPatterns || DEFAULT_PLACEHOLDER_PATTERNS),
     ignoreCodeLike: config.ignoreCodeLike ?? true,
@@ -186,6 +211,9 @@ function normalizePlaceholderPatterns(patterns) {
 function normalizeHardcodedConfig(config) {
   return {
     vueAttributes: config.vueAttributes || DEFAULT_HARDCODED_ATTRIBUTES,
+    jsxAttributes: config.jsxAttributes || DEFAULT_HARDCODED_ATTRIBUTES,
+    functions: config.functions || DEFAULT_HARDCODED_FUNCTIONS,
+    ignoreFiles: config.ignoreFiles || [],
     ignoreValues: config.ignoreValues || [],
     ignorePatterns: normalizeRegexRules(config.ignorePatterns || [], 'hardcoded.ignorePatterns'),
   };

package/src/reporters/combined.js

@@ -1,10 +1,12 @@
 import { renderConsoleReport } from './console.js';
 import { renderMarkdownReport } from './markdown.js';
+import { renderSarifReport } from './sarif.js';
 import { summarizeIssues } from './summary.js';
 
 export function renderCombinedReport(results, options) {
   if (options.format === 'json') return renderCombinedJson(results, options);
   if (options.format === 'markdown') return renderCombinedMarkdown(results, options);
+  if (options.format === 'sarif') return renderSarifReport(results, options);
   return renderCombinedConsole(results, options);
 }
 

package/src/reporters/console.js

@@ -34,6 +34,9 @@ export function renderConsoleReport(issues, options) {
   for (const issue of visible) {
     lines.push(`${label(issue.severity)} ${formatLocation(issue)}`);
     lines.push(`  value: "${preview(issue.value)}"`);
+    for (const detail of formatDetails(issue)) {
+      lines.push(`  ${detail}`);
+    }
     lines.push(`  reason: ${issue.reason}`);
   }
 
@@ -44,3 +47,10 @@ function formatLocation(issue) {
   if (issue.file) return `${issue.file}:${issue.line}:${issue.column}`;
   return `${issue.targetLocale}.${issue.key}`;
 }
+
+function formatDetails(issue) {
+  const details = [];
+  if (issue.missing?.length) details.push(`missing: ${issue.missing.join(', ')}`);
+  if (issue.extra?.length) details.push(`extra: ${issue.extra.join(', ')}`);
+  return details;
+}

package/src/reporters/index.js

@@ -1,9 +1,19 @@
 import { renderConsoleReport } from './console.js';
 import { renderJsonReport } from './json.js';
 import { renderMarkdownReport } from './markdown.js';
+import { renderSarifReport } from './sarif.js';
 
 export function renderReport(issues, options) {
   if (options.format === 'json') return renderJsonReport(issues, options);
   if (options.format === 'markdown') return renderMarkdownReport(issues, options);
+  if (options.format === 'sarif') {
+    return renderSarifReport([
+      {
+        check: options.check || 'custom',
+        heading: options.heading,
+        issues,
+      },
+    ], options);
+  }
   return renderConsoleReport(issues, options);
 }

package/src/reporters/markdown.js

@@ -1,7 +1,7 @@
 import { summarizeIssues } from './summary.js';
 
 function escapeCell(value) {
-  return String(value).replace(/\|/g, '\\|').replace(/\n/g, '<br>');
+  return String(value).replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/\n/g, '<br>');
 }
 
 export function renderMarkdownReport(issues, options) {
@@ -22,6 +22,9 @@ export function renderMarkdownReport(issues, options) {
   if (visible.some((issue) => issue.file)) {
     lines.push('| Level | Location | Value | Reason |');
     lines.push('|---|---|---|---|');
+  } else if (visible.some((issue) => issue.missing || issue.extra)) {
+    lines.push('| Level | Locale | Key | Value | Missing | Extra | Reason |');
+    lines.push('|---|---|---|---|---|---|---|');
   } else {
     lines.push('| Level | Locale | Key | Value | Reason |');
     lines.push('|---|---|---|---|---|');
@@ -33,9 +36,15 @@ export function renderMarkdownReport(issues, options) {
         `| ${escapeCell(issue.severity)} | ${escapeCell(formatLocation(issue))} | ${escapeCell(issue.value)} | ${escapeCell(issue.reason)} |`
       );
     } else {
-      lines.push(
-        `| ${escapeCell(issue.severity)} | ${escapeCell(issue.targetLocale)} | ${escapeCell(issue.key)} | ${escapeCell(issue.value)} | ${escapeCell(issue.reason)} |`
-      );
+      if (issue.missing || issue.extra) {
+        lines.push(
+          `| ${escapeCell(issue.severity)} | ${escapeCell(issue.targetLocale)} | ${escapeCell(issue.key)} | ${escapeCell(issue.value)} | ${escapeCell((issue.missing || []).join(', '))} | ${escapeCell((issue.extra || []).join(', '))} | ${escapeCell(issue.reason)} |`
+        );
+      } else {
+        lines.push(
+          `| ${escapeCell(issue.severity)} | ${escapeCell(issue.targetLocale)} | ${escapeCell(issue.key)} | ${escapeCell(issue.value)} | ${escapeCell(issue.reason)} |`
+        );
+      }
     }
   }
 

package/src/reporters/sarif.js

@@ -0,0 +1,105 @@
+export function renderSarifReport(results, options) {
+  const visible = results.flatMap((result) => {
+    const issues = options.includeIgnored ? result.issues : result.issues.filter((issue) => issue.severity !== 'ignored');
+    return issues.map((issue) => ({ check: result.check, title: result.heading, ...issue }));
+  });
+  const rules = new Map();
+
+  for (const issue of visible) {
+    const ruleId = ruleIdFor(issue);
+    if (!rules.has(ruleId)) {
+      rules.set(ruleId, {
+        id: ruleId,
+        name: issue.reason,
+        shortDescription: { text: issue.reason },
+        fullDescription: { text: `${issue.title || issue.check}: ${issue.reason}` },
+        defaultConfiguration: { level: sarifLevel(issue.severity) },
+        properties: {
+          check: issue.check,
+          severity: issue.severity,
+        },
+      });
+    }
+  }
+
+  return `${JSON.stringify({
+    version: '2.1.0',
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: 'i18n-smell-detector',
+            informationUri: 'https://github.com/xue-moe/i18n-smell-detector',
+            rules: [...rules.values()],
+          },
+        },
+        results: visible.map(toSarifResult),
+      },
+    ],
+  }, null, 2)}\n`;
+}
+
+function toSarifResult(issue) {
+  const result = {
+    ruleId: ruleIdFor(issue),
+    level: sarifLevel(issue.severity),
+    message: { text: messageFor(issue) },
+    properties: {
+      id: issue.id,
+      check: issue.check,
+      severity: issue.severity,
+      reason: issue.reason,
+      key: issue.key,
+      baseLocale: issue.baseLocale,
+      targetLocale: issue.targetLocale,
+      value: issue.value,
+      missing: issue.missing,
+      extra: issue.extra,
+    },
+  };
+
+  if (issue.file) {
+    result.locations = [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: issue.file },
+          region: {
+            startLine: issue.line,
+            startColumn: issue.column,
+          },
+        },
+      },
+    ];
+  }
+
+  result.partialFingerprints = {
+    stableId: issue.id,
+  };
+
+  return result;
+}
+
+function ruleIdFor(issue) {
+  return `i18n-smell/${issue.check}/${slug(issue.reason)}`;
+}
+
+function sarifLevel(severity) {
+  if (severity === 'high') return 'error';
+  if (severity === 'medium') return 'warning';
+  if (severity === 'low') return 'note';
+  return 'none';
+}
+
+function messageFor(issue) {
+  if (issue.file) return `${issue.reason}: ${issue.value}`;
+  const details = [];
+  if (issue.missing?.length) details.push(`missing ${issue.missing.join(', ')}`);
+  if (issue.extra?.length) details.push(`extra ${issue.extra.join(', ')}`);
+  const suffix = details.length ? ` (${details.join('; ')})` : '';
+  return `${issue.targetLocale}.${issue.key}: ${issue.reason}${suffix}`;
+}
+
+function slug(value) {
+  return String(value).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'issue';
+}

package/src/run-checks.js

@@ -1,5 +1,6 @@
 import { checkHardcodedStrings } from './check-hardcoded.js';
 import { checkIdenticalTranslations } from './check-identical.js';
+import { checkPlaceholders } from './check-placeholders.js';
 import { loadFlattenedLocales } from './locale/load-locales.js';
 
 const CHECK_META = {
@@ -13,15 +14,24 @@ const CHECK_META = {
     heading: 'Hardcoded strings',
     emptyMessage: 'No hardcoded strings found.',
   },
+  placeholders: {
+    title: 'placeholder mismatches',
+    heading: 'Placeholder mismatches',
+    emptyMessage: 'No placeholder mismatches found.',
+  },
 };
 
 export async function runChecks(config, configDir, names) {
   const results = [];
+  let locales;
 
   for (const check of names) {
     if (check === 'identical') {
-      const locales = await loadFlattenedLocales(config, configDir);
+      locales ||= await loadFlattenedLocales(config, configDir);
       results.push({ check, ...CHECK_META[check], issues: checkIdenticalTranslations(locales, config) });
+    } else if (check === 'placeholders') {
+      locales ||= await loadFlattenedLocales(config, configDir);
+      results.push({ check, ...CHECK_META[check], issues: checkPlaceholders(locales, config) });
     } else if (check === 'hardcoded') {
       results.push({ check, ...CHECK_META[check], issues: await checkHardcodedStrings(config, configDir) });
     }
@@ -31,5 +41,5 @@ export async function runChecks(config, configDir, names) {
 }
 
 export function enabledChecks(config) {
-  return ['identical', 'hardcoded'].filter((check) => config.checks[check]);
+  return ['identical', 'hardcoded', 'placeholders'].filter((check) => config.checks[check]);
 }

package/src/source/scan-js-source.js

@@ -0,0 +1,148 @@
+import { readFile } from 'node:fs/promises';
+import { parse } from '@babel/parser';
+import { classifyHardcoded } from '../rules/classify-hardcoded.js';
+
+const SKIP_KEYS = new Set([
+  'comments',
+  'errors',
+  'extra',
+  'leadingComments',
+  'loc',
+  'range',
+  'start',
+  'end',
+  'trailingComments',
+]);
+
+function normalizeText(value) {
+  return value.replace(/\s+/g, ' ').trim();
+}
+
+function makeIssue({ file, loc, value, kind, baseReason, config }) {
+  const text = normalizeText(value);
+  if (!text) return null;
+
+  const classification = classifyHardcoded(text, config);
+  return {
+    file,
+    line: loc.start.line,
+    column: loc.start.column + 1,
+    value: text,
+    severity: classification.severity,
+    reason: classification.severity === 'ignored' ? classification.reason : baseReason,
+    kind,
+  };
+}
+
+export async function scanJsSource(file, config) {
+  const source = await readFile(file, 'utf8');
+  let ast;
+
+  try {
+    ast = parse(source, {
+      sourceType: 'unambiguous',
+      plugins: ['jsx', 'typescript'],
+      errorRecovery: false,
+    });
+  } catch (error) {
+    throw new Error(`Malformed JavaScript or TypeScript file ${file}: ${error.message}`);
+  }
+
+  const issues = [];
+  const functions = new Set(config.hardcoded.functions || []);
+  const jsxAttributes = new Set(config.hardcoded.jsxAttributes || []);
+
+  walk(ast, (node) => {
+    if (node.type === 'CallExpression' && functions.has(calleeName(node.callee))) {
+      for (const argument of node.arguments || []) {
+        const value = staticString(argument);
+        if (value === null) continue;
+
+        const issue = makeIssue({
+          file,
+          loc: argument.loc,
+          value,
+          kind: `js-call:${calleeName(node.callee)}`,
+          baseReason: `static string passed to ${calleeName(node.callee)}`,
+          config,
+        });
+        if (issue) issues.push(issue);
+      }
+      return;
+    }
+
+    if (node.type === 'JSXText') {
+      const issue = makeIssue({
+        file,
+        loc: node.loc,
+        value: node.value,
+        kind: 'jsx-text',
+        baseReason: 'static JSX text',
+        config,
+      });
+      if (issue) issues.push(issue);
+      return;
+    }
+
+    if (node.type === 'JSXAttribute' && jsxAttributes.has(jsxName(node.name))) {
+      const value = staticString(node.value);
+      if (value === null) return;
+
+      const issue = makeIssue({
+        file,
+        loc: node.value.loc,
+        value,
+        kind: `jsx-attribute:${jsxName(node.name)}`,
+        baseReason: `static ${jsxName(node.name)} attribute`,
+        config,
+      });
+      if (issue) issues.push(issue);
+    }
+  });
+
+  return issues;
+}
+
+function walk(node, visitor) {
+  if (!node || typeof node.type !== 'string') return;
+  visitor(node);
+
+  for (const [key, value] of Object.entries(node)) {
+    if (SKIP_KEYS.has(key)) continue;
+    if (Array.isArray(value)) {
+      for (const child of value) walk(child, visitor);
+    } else if (value && typeof value.type === 'string') {
+      walk(value, visitor);
+    }
+  }
+}
+
+function calleeName(node) {
+  if (!node) return '';
+  if (node.type === 'Identifier') return node.name;
+  if (node.type === 'ThisExpression') return 'this';
+  if (node.type === 'Super') return 'super';
+  if (node.type === 'MemberExpression' || node.type === 'OptionalMemberExpression') {
+    const object = calleeName(node.object);
+    const property = node.computed ? staticString(node.property) : calleeName(node.property);
+    return object && property ? `${object}.${property}` : '';
+  }
+  return '';
+}
+
+function jsxName(node) {
+  if (!node) return '';
+  if (node.type === 'JSXIdentifier') return node.name;
+  if (node.type === 'JSXNamespacedName') return `${jsxName(node.namespace)}:${jsxName(node.name)}`;
+  return '';
+}
+
+function staticString(node) {
+  if (!node) return null;
+  if (node.type === 'StringLiteral') return node.value;
+  if (node.type === 'TemplateLiteral' && node.expressions.length === 0) {
+    return node.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw).join('');
+  }
+  if (node.type === 'JSXExpressionContainer') return staticString(node.expression);
+  return null;
+}

package/src/types.js

@@ -1,6 +1,6 @@
 /**
  * @typedef {'ignored' | 'low' | 'medium' | 'high'} Severity
- * @typedef {'console' | 'json' | 'markdown'} ReportFormat
+ * @typedef {'console' | 'json' | 'markdown' | 'sarif'} ReportFormat
  *
  * @typedef {Object} DetectorConfig
  * @property {string} baseLocale
@@ -9,8 +9,8 @@
  * @property {(string | RegExp)[]=} allowIdenticalValues
  * @property {(string | RegExp)[]=} placeholderPatterns
  * @property {string[]=} source
- * @property {{vueAttributes: string[], ignoreValues: (string | RegExp)[], ignorePatterns: RegExp[]}=} hardcoded
- * @property {{identical: boolean, hardcoded: boolean}=} checks
+ * @property {{vueAttributes: string[], jsxAttributes: string[], functions: string[], ignoreFiles: string[], ignoreValues: (string | RegExp)[], ignorePatterns: RegExp[]}=} hardcoded
+ * @property {{identical: boolean, hardcoded: boolean, placeholders: boolean}=} checks
  * @property {ReportFormat=} format
  * @property {string=} output
  * @property {string=} baseline
@@ -37,6 +37,16 @@
  * @property {Severity} severity
  * @property {string} reason
  * @property {string} kind
+ *
+ * @typedef {Object} PlaceholderIssue
+ * @property {string} key
+ * @property {string} baseLocale
+ * @property {string} targetLocale
+ * @property {string} value
+ * @property {string[]} missing
+ * @property {string[]} extra
+ * @property {Severity} severity
+ * @property {string} reason
  */
 
 export {};