ios-agent-mcp 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nagarjuna Reddy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,183 @@
+# ios-agent-mcp
+
+An MCP server that reviews Swift projects against the rules in
+[ios-agent-skill](https://github.com/Nagarjuna2997/ios-agent-skill).
+
+The skill teaches an agent how to *write* iOS code. This server lets an agent
+*check* it — six tools that read a Swift project and report defects with a file,
+a line, the consequence, and the fix.
+
+```
+You:  Review my Swift project for concurrency problems.
+
+Claude → review_swift_concurrency
+
+🔴 Sources/FeedModel.swift:3 — @Observable type is not @MainActor-isolated.
+   Why: @Observable grants no isolation. SwiftUI reads this state during layout
+        while any task may write it — a data race under Swift 5 mode, a compile
+        error under Swift 6.
+   Fix: Annotate the type: `@MainActor @Observable final class …`
+```
+
+---
+
+## Install
+
+### Claude Code
+
+```bash
+claude mcp add ios-agent -- npx -y ios-agent-mcp
+```
+
+### Claude Desktop
+
+`~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "ios-agent": {
+      "command": "npx",
+      "args": ["-y", "ios-agent-mcp"]
+    }
+  }
+}
+```
+
+### Cursor
+
+`.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` globally:
+
+```json
+{
+  "mcpServers": {
+    "ios-agent": {
+      "command": "npx",
+      "args": ["-y", "ios-agent-mcp"]
+    }
+  }
+}
+```
+
+### From source
+
+```bash
+git clone https://github.com/Nagarjuna2997/ios-agent-skill.git
+cd ios-agent-skill/mcp-server
+npm install && npm run build
+# then point your client at: node /absolute/path/to/mcp-server/dist/index.js
+```
+
+---
+
+## Tools
+
+| Tool | Finds |
+|------|-------|
+| `analyze_swift_project` | Structure — file counts, deployment target, frameworks, tests — plus finding counts per category. **Start here.** |
+| `review_swift_concurrency` | `@Observable` without `@MainActor`, `Task.detached`, `DispatchQueue.main.async`, `@unchecked Sendable`, `nonisolated(unsafe)`, unstructured `Task` in `onAppear`, empty `catch`, a type named `Task` |
+| `review_swift_architecture` | Live-implementation default arguments, presentation naming `URLSession`/`APIClient`/`ModelContext`, singletons in view models, domain importing SwiftUI, nested `NavigationStack`, `NavigationView` |
+| `review_swiftui` | Fixed font sizes and heights, `AnyView`, `.cornerRadius`, literal spacing, materials over solid backgrounds, view state on models, `ObservableObject`, `@EnvironmentObject`, `try!` |
+| `check_availability_guards` | Missing guards, **over-restrictive guards** (an iOS 26 API guarded at iOS 27 silently drops every iOS 26 device), Foundation Models without a runtime availability check |
+| `audit_app_store_readiness` | Permission frameworks with no Info.plist purpose string, missing `PrivacyInfo.xcprivacy`, unlocalized strings, unlabeled icon buttons, `print()` |
+
+Every tool takes one argument:
+
+```json
+{ "path": "/absolute/path/to/your/project" }
+```
+
+---
+
+## What it does and does not do
+
+**Does:** static analysis. Reads `.swift`, `Info.plist`, `Package.swift`, and
+`project.pbxproj` under the path you give it. No network, no writes.
+
+**Does not:** prove your app builds or behaves correctly. Run `swift build` and
+`swift test` for that — the tools say so in their own output.
+
+Findings are graded so you can triage:
+
+| | Meaning |
+|---|---|
+| 🔴 **blocker** | Crashes, data races, or App Review rejection |
+| 🟠 **serious** | Real defect — untestable code, accessibility failure, deprecated API |
+| 🟡 **minor** | Maintainability and consistency |
+
+Test, mock, stub, and preview files are exempt from the app-code-only rules, and
+`Package.swift` is skipped — they legitimately do things app code must not.
+
+---
+
+## Development
+
+```bash
+npm install
+npm run build        # tsc
+npm test             # 38 tests: unit + end-to-end over real MCP stdio
+npm run typecheck
+```
+
+Analyzers are pure functions of `(path, content) → Finding[]`, so they are
+tested without the MCP transport. `test/server.smoke.test.js` launches the real
+server and speaks the real protocol, because unit tests cannot tell you whether
+the server actually starts.
+
+To add a rule: write the analyzer, then a test that **fails without the rule**.
+A test that passes either way is not a test.
+
+---
+
+## Publishing (maintainers)
+
+```bash
+cd mcp-server
+npm install          # REQUIRED FIRST — see below
+npm login
+npm publish
+```
+
+**`npm install` is not optional.** `prepublishOnly` runs `npm run build && npm test`, and `build` is `tsc`. On a fresh clone there is no `node_modules`, so the compiler is not present and publish fails with:
+
+```
+error TS2591: Cannot find name 'node:fs/promises'. Do you need to install
+type definitions for node? Try `npm i --save-dev @types/node`
+```
+
+That is the guard working as intended — it refuses to publish an unbuilt package — but the fix is `npm install`, not disabling the hook.
+
+After publishing, verify:
+
+```bash
+npm view ios-agent-mcp version     # registry has it
+npx -y ios-agent-mcp --version     # 1.0.0
+npx -y ios-agent-mcp --help        # usage, tool list, setup commands
+```
+
+`--help` and `--version` print and exit. Every other invocation starts the
+stdio server and blocks waiting for a client, which is correct but looks like a
+hang if you run it by hand.
+
+To see exactly what would ship before committing to it:
+
+```bash
+npm pack --dry-run
+```
+
+Expect ~31 files: `dist/`, `mcp.json`, `README.md`, `LICENSE`, `package.json`. If `dist/` is missing, the build did not run.
+
+### Version numbering
+
+The npm package version and the repository version are **independent**:
+
+| | Version | Why |
+|---|---|---|
+| `ios-agent-mcp` on npm | `1.0.0` | First release of this package |
+| `ios-agent-skill` repo / `SKILL.md` | `2.0.0` | Its own release history |
+
+This is not a mismatch. Bump the npm version only when the server changes.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/analyzers/appstore.d.ts

@@ -0,0 +1,17 @@
+import { Finding, SourceFile } from "./types.js";
+export interface ProjectContext {
+    /** Contents of Info.plist files found in the project, concatenated. */
+    infoPlist: string;
+    /** Whether a PrivacyInfo.xcprivacy exists anywhere. */
+    hasPrivacyManifest: boolean;
+    /**
+     * Whether this looks like a shippable app rather than a library.
+     *
+     * An SPM library has no Info.plist and is never submitted to App Review, so
+     * App-Store-only rules must not fire on one.
+     */
+    isApp: boolean;
+}
+export declare function analyzeAppStore(file: SourceFile, context: ProjectContext): Finding[];
+/** Project-level checks that are not tied to a single source file. */
+export declare function analyzeProjectLevelAppStore(context: ProjectContext): Finding[];

package/dist/analyzers/appstore.js

@@ -0,0 +1,78 @@
+import { eachLine, isSupportFile } from "./types.js";
+const DOC = "checklists/app-store-submission.md";
+/** Frameworks whose use requires a purpose string in Info.plist. */
+const PERMISSION_FRAMEWORKS = [
+    { pattern: /\bCLLocationManager\b|import\s+CoreLocation/, key: "NSLocationWhenInUseUsageDescription", what: "location" },
+    { pattern: /\bAVCaptureDevice\b|import\s+AVFoundation/, key: "NSCameraUsageDescription", what: "camera" },
+    { pattern: /\bPHPhotoLibrary\b|import\s+Photos\b/, key: "NSPhotoLibraryUsageDescription", what: "the photo library" },
+    { pattern: /\bHKHealthStore\b|import\s+HealthKit/, key: "NSHealthShareUsageDescription", what: "health data" },
+    { pattern: /\bCNContactStore\b|import\s+Contacts\b/, key: "NSContactsUsageDescription", what: "contacts" },
+    { pattern: /\bCBCentralManager\b|import\s+CoreBluetooth/, key: "NSBluetoothAlwaysUsageDescription", what: "Bluetooth" },
+    { pattern: /\bSFSpeechRecognizer\b|import\s+Speech\b/, key: "NSSpeechRecognitionUsageDescription", what: "speech recognition" },
+    { pattern: /\bEKEventStore\b|import\s+EventKit/, key: "NSCalendarsUsageDescription", what: "calendars" },
+];
+export function analyzeAppStore(file, context) {
+    const findings = [];
+    if (isSupportFile(file.path))
+        return findings;
+    const push = (line, excerpt, rule, severity, message, consequence, fix, doc = DOC) => findings.push({
+        file: file.path,
+        line,
+        severity,
+        rule,
+        message,
+        consequence,
+        fix,
+        doc,
+        excerpt: excerpt.trim(),
+    });
+    // Permission-gated framework used with no purpose string.
+    for (const framework of PERMISSION_FRAMEWORKS) {
+        if (!framework.pattern.test(file.content))
+            continue;
+        if (context.infoPlist.includes(framework.key))
+            continue;
+        const line = file.content.split("\n").findIndex((l) => framework.pattern.test(l)) + 1;
+        push(Math.max(line, 1), framework.key, "missing-purpose-string", "blocker", `Uses ${framework.what} but Info.plist has no ${framework.key}.`, "iOS terminates the app the moment the permission is requested, and App Review rejects the submission.", `Add ${framework.key} to Info.plist with a specific sentence explaining why the app needs ${framework.what}.`);
+    }
+    eachLine(file, (line, number) => {
+        // Hardcoded user-facing strings.
+        const text = /\bText\(\s*"([^"]{4,})"\s*\)/.exec(line);
+        if (text && !/String\(localized:/.test(line) && !/LocalizedStringKey/.test(line)) {
+            push(number, line, "hardcoded-string", "minor", "User-facing string is not localized.", "The string cannot be translated, and a screen reader announces it in the wrong language.", 'Use `String(localized: "…", comment: "…")` or a String Catalog key.', "docs/design/interaction-standards.md");
+        }
+        // Icon-only button with no accessibility label.
+        if (/Button\s*\{/.test(line) &&
+            /Image\(\s*systemName:/.test(line) &&
+            !/accessibilityLabel|Label\(/.test(line)) {
+            push(number, line, "unlabeled-icon-button", "serious", "Icon-only button has no accessibility label.", 'VoiceOver announces it as just "button", making the control unusable without sight.', "Use `Label(\"…\", systemImage:)` with `.labelStyle(.iconOnly)`, or add `.accessibilityLabel(…)`.", "docs/frameworks/accessibility.md");
+        }
+        // print() is not structured logging and ships in release.
+        if (/^\s*print\s*\(/.test(line)) {
+            push(number, line, "print-logging", "minor", "print() used for diagnostics.", "Not structured, not filterable, not redacted, and not stripped from release builds.", "Use `Logger` from OSLog.", "docs/frameworks/oslog.md");
+        }
+    });
+    return findings;
+}
+/** Project-level checks that are not tied to a single source file. */
+export function analyzeProjectLevelAppStore(context) {
+    // A library is not submitted to App Review — this rule does not apply.
+    if (!context.isApp)
+        return [];
+    if (context.hasPrivacyManifest)
+        return [];
+    return [
+        {
+            file: "PrivacyInfo.xcprivacy",
+            line: 1,
+            severity: "blocker",
+            rule: "missing-privacy-manifest",
+            message: "No PrivacyInfo.xcprivacy found in the project.",
+            consequence: "App Store Connect rejects submissions that use required-reason APIs without a privacy manifest.",
+            fix: "Add a PrivacyInfo.xcprivacy declaring collected data types and required-reason API usage.",
+            doc: "docs/design/interaction-standards.md",
+            excerpt: "(project-level)",
+        },
+    ];
+}
+//# sourceMappingURL=appstore.js.map

package/dist/analyzers/appstore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appstore.js","sourceRoot":"","sources":["../../src/analyzers/appstore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,GAAG,GAAG,oCAAoC,CAAC;AAEjD,oEAAoE;AACpE,MAAM,qBAAqB,GAA0D;IACnF,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,qCAAqC,EAAE,IAAI,EAAE,UAAU,EAAE;IACxH,EAAE,OAAO,EAAE,2CAA2C,EAAE,GAAG,EAAE,0BAA0B,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzG,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,gCAAgC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACrH,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,+BAA+B,EAAE,IAAI,EAAE,aAAa,EAAE;IAC9G,EAAE,OAAO,EAAE,wCAAwC,EAAE,GAAG,EAAE,4BAA4B,EAAE,IAAI,EAAE,UAAU,EAAE;IAC1G,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,mCAAmC,EAAE,IAAI,EAAE,WAAW,EAAE;IACvH,EAAE,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,qCAAqC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC/H,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,6BAA6B,EAAE,IAAI,EAAE,WAAW,EAAE;CACzG,CAAC;AAgBF,MAAM,UAAU,eAAe,CAC7B,IAAgB,EAChB,OAAuB;IAEvB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE9C,MAAM,IAAI,GAAG,CACX,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,QAA6B,EAC7B,OAAe,EACf,WAAmB,EACnB,GAAW,EACX,GAAG,GAAG,GAAG,EACT,EAAE,CACF,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,OAAO;QACP,WAAW;QACX,GAAG;QACH,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;KACxB,CAAC,CAAC;IAEL,0DAA0D;IAC1D,KAAK,MAAM,SAAS,IAAI,qBAAqB,EAAE,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACpD,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;YAAE,SAAS;QAExD,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3E,IAAI,CACF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EACjB,SAAS,CAAC,GAAG,EACb,wBAAwB,EACxB,SAAS,EACT,QAAQ,SAAS,CAAC,IAAI,0BAA0B,SAAS,CAAC,GAAG,GAAG,EAChE,uGAAuG,EACvG,OAAO,SAAS,CAAC,GAAG,wEAAwE,SAAS,CAAC,IAAI,GAAG,CAC9G,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC9B,iCAAiC;QACjC,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,IAAI,CACF,MAAM,EACN,IAAI,EACJ,kBAAkB,EAClB,OAAO,EACP,sCAAsC,EACtC,0FAA0F,EAC1F,qEAAqE,EACrE,sCAAsC,CACvC,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EACxC,CAAC;YACD,IAAI,CACF,MAAM,EACN,IAAI,EACJ,uBAAuB,EACvB,SAAS,EACT,8CAA8C,EAC9C,qFAAqF,EACrF,kGAAkG,EAClG,kCAAkC,CACnC,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CACF,MAAM,EACN,IAAI,EACJ,eAAe,EACf,OAAO,EACP,+BAA+B,EAC/B,qFAAqF,EACrF,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CAAC,OAAuB;IACjE,uEAAuE;IACvE,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO;QACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,gDAAgD;YACzD,WAAW,EACT,iGAAiG;YACnG,GAAG,EAAE,2FAA2F;YAChG,GAAG,EAAE,sCAAsC;YAC3C,OAAO,EAAE,iBAAiB;SAC3B;KACF,CAAC;AACJ,CAAC"}

package/dist/analyzers/architecture.d.ts

@@ -0,0 +1,2 @@
+import { Finding, SourceFile } from "./types.js";
+export declare function analyzeArchitecture(file: SourceFile): Finding[];

package/dist/analyzers/architecture.js

@@ -0,0 +1,63 @@
+import { eachLine, isSupportFile } from "./types.js";
+const DOC = "patterns/clean-architecture.md";
+/** Concrete data-layer types that must not appear in the presentation layer. */
+const DATA_LAYER_TYPES = /\b(URLSession|APIClient|ModelContext|NSManagedObjectContext|NSPersistentContainer)\b/;
+/** Heuristic: does this path look like presentation-layer code? */
+function isPresentationLayer(path) {
+    return /(Views?|Presentation|Screens?|UI)\//i.test(path) ||
+        /(View|ViewModel|Screen)\.swift$/.test(path);
+}
+/** Heuristic: does this path look like domain-layer code? */
+function isDomainLayer(path) {
+    return /(Domain|Entities|UseCases)\//i.test(path);
+}
+export function analyzeArchitecture(file) {
+    const findings = [];
+    const support = isSupportFile(file.path);
+    if (support)
+        return findings;
+    const push = (line, excerpt, rule, severity, message, consequence, fix, doc = DOC) => findings.push({
+        file: file.path,
+        line,
+        severity,
+        rule,
+        message,
+        consequence,
+        fix,
+        doc,
+        excerpt: excerpt.trim(),
+    });
+    eachLine(file, (line, number) => {
+        // A dependency defaulting to a live implementation.
+        if (/\binit\s*\(/.test(line) &&
+            /:\s*(any\s+)?\w+\s*=\s*(Live|Remote|Default|URLSession|\w*APIClient)\w*\s*[.(]/.test(line)) {
+            push(number, line, "live-default-dependency", "blocker", "Initializer parameter defaults to a live implementation.", "Any call site that forgets to inject silently hits the real network or disk, including tests and previews, with no signal that it happened.", "Make the parameter required. The composition root supplies it.");
+        }
+        // Presentation naming concrete data-layer types.
+        if (isPresentationLayer(file.path) && DATA_LAYER_TYPES.test(line) && !/^\s*import\b/.test(line)) {
+            push(number, line, "presentation-names-data-type", "serious", "Presentation layer names a concrete data-layer type.", "The screen cannot be unit-tested or previewed without a real client, so previews need a network and tests become integration tests.", "Depend on a protocol declared in the domain layer, injected through `init`.");
+        }
+        // Singleton resolution inside a view model.
+        if (/\bViewModel\b/.test(file.path) || /class\s+\w*(ViewModel|Model)\b/.test(file.content)) {
+            if (/=\s*\w+\s*\.\s*shared\b/.test(line)) {
+                push(number, line, "singleton-in-viewmodel", "serious", "View model resolves a dependency from a global singleton.", "Not injectable, not overridable in previews, and shared mutable state leaks between parallel tests.", "Inject the dependency through `init`, from a composition root.");
+            }
+        }
+        // Domain layer importing UI frameworks.
+        if (isDomainLayer(file.path) && /^\s*import\s+(SwiftUI|UIKit|AppKit)\b/.test(line)) {
+            push(number, line, "domain-imports-ui", "blocker", "Domain layer imports a UI framework.", "The dependency rule is inverted: business logic can no longer be tested, reused on another platform, or extracted into a package.", "Remove the import. Move anything genuinely UI-shaped into the presentation layer.");
+        }
+        // A screen owning its own NavigationStack.
+        if (/NavigationStack\s*[({]/.test(line) && !/^\s*(\/\/|\*)/.test(line)) {
+            if (/Detail|Row|Cell|Section/.test(file.path)) {
+                push(number, line, "nested-navigation-stack", "serious", "A pushed screen appears to own its own NavigationStack.", "A nested stack renders a second navigation bar and breaks programmatic navigation.", "Only the root of each tab owns a NavigationStack.", "docs/swiftui/deep-linking-and-routing.md");
+            }
+        }
+        // Deprecated navigation API.
+        if (/\bNavigationView\s*\{/.test(line)) {
+            push(number, line, "deprecated-navigationview", "serious", "NavigationView is deprecated.", "Programmatic navigation and deep linking do not work reliably, and behavior differs across OS versions.", "Use `NavigationStack` with `NavigationPath` and `.navigationDestination(for:)`.", "docs/swiftui/navigation.md");
+        }
+    });
+    return findings;
+}
+//# sourceMappingURL=architecture.js.map

package/dist/analyzers/architecture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"architecture.js","sourceRoot":"","sources":["../../src/analyzers/architecture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,GAAG,GAAG,gCAAgC,CAAC;AAE7C,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,sFAAsF,CAAC;AAEhH,mEAAmE;AACnE,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;QACtD,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,6DAA6D;AAC7D,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO;QAAE,OAAO,QAAQ,CAAC;IAE7B,MAAM,IAAI,GAAG,CACX,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,QAA6B,EAC7B,OAAe,EACf,WAAmB,EACnB,GAAW,EACX,GAAG,GAAG,GAAG,EACT,EAAE,CACF,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,OAAO;QACP,WAAW;QACX,GAAG;QACH,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;KACxB,CAAC,CAAC;IAEL,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC9B,oDAAoD;QACpD,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3F,CAAC;YACD,IAAI,CACF,MAAM,EACN,IAAI,EACJ,yBAAyB,EACzB,SAAS,EACT,0DAA0D,EAC1D,6IAA6I,EAC7I,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChG,IAAI,CACF,MAAM,EACN,IAAI,EACJ,8BAA8B,EAC9B,SAAS,EACT,sDAAsD,EACtD,qIAAqI,EACrI,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3F,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CACF,MAAM,EACN,IAAI,EACJ,wBAAwB,EACxB,SAAS,EACT,2DAA2D,EAC3D,qGAAqG,EACrG,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnF,IAAI,CACF,MAAM,EACN,IAAI,EACJ,mBAAmB,EACnB,SAAS,EACT,sCAAsC,EACtC,mIAAmI,EACnI,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,CACF,MAAM,EACN,IAAI,EACJ,yBAAyB,EACzB,SAAS,EACT,yDAAyD,EACzD,oFAAoF,EACpF,mDAAmD,EACnD,0CAA0C,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,CACF,MAAM,EACN,IAAI,EACJ,2BAA2B,EAC3B,SAAS,EACT,+BAA+B,EAC/B,yGAAyG,EACzG,iFAAiF,EACjF,4BAA4B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/availability.d.ts

@@ -0,0 +1,2 @@
+import { Finding, SourceFile } from "./types.js";
+export declare function analyzeAvailability(file: SourceFile): Finding[];

package/dist/analyzers/availability.js

@@ -0,0 +1,96 @@
+import { eachLine } from "./types.js";
+const DOC = "docs/compatibility-matrix.md";
+/**
+ * Symbols and the iOS version in which they were INTRODUCED.
+ *
+ * The rule this enforces: guard on the version where a symbol became available,
+ * never on the newest SDK you happen to be building with. Writing
+ * `#available(iOS 27, *)` around an iOS 26 API silently drops every iOS 26
+ * device to the fallback path — invisible when testing on a current device.
+ */
+const INTRODUCED = [
+    // iOS 26
+    { pattern: /\.glassEffect\s*\(/, version: 26, name: "glassEffect" },
+    { pattern: /\bGlassEffectContainer\b/, version: 26, name: "GlassEffectContainer" },
+    { pattern: /\.glassEffectID\s*\(/, version: 26, name: "glassEffectID" },
+    { pattern: /\.buttonStyle\(\s*\.glass(Prominent)?\s*\)/, version: 26, name: "glass button style" },
+    { pattern: /\bSystemLanguageModel\b/, version: 26, name: "SystemLanguageModel" },
+    { pattern: /\bLanguageModelSession\b/, version: 26, name: "LanguageModelSession" },
+    { pattern: /@Generable\b/, version: 26, name: "@Generable" },
+    // iOS 27
+    { pattern: /\bPrivateCloudComputeLanguageModel\b/, version: 27, name: "PrivateCloudComputeLanguageModel" },
+    { pattern: /\bDynamicProfile\b/, version: 27, name: "DynamicProfile" },
+    { pattern: /\bOCRTool\b|\bBarcodeReaderTool\b/, version: 27, name: "built-in system tools" },
+    // iOS 18
+    { pattern: /\bMeshGradient\b/, version: 18, name: "MeshGradient" },
+    { pattern: /\bTextRenderer\b/, version: 18, name: "TextRenderer" },
+];
+/** Highest iOS version mentioned in an availability guard on or above a line. */
+function guardedVersions(content) {
+    const versions = [];
+    const guard = /#available\(\s*iOS\s+(\d+)|@available\([^)]*iOS\s+(\d+)/g;
+    let match;
+    while ((match = guard.exec(content)) !== null) {
+        versions.push(Number(match[1] ?? match[2]));
+    }
+    return versions;
+}
+export function analyzeAvailability(file) {
+    const findings = [];
+    const guards = guardedVersions(file.content);
+    eachLine(file, (text, number) => {
+        for (const entry of INTRODUCED) {
+            if (!entry.pattern.test(text))
+                continue;
+            // Unguarded use of a version-gated symbol.
+            if (guards.length === 0) {
+                findings.push({
+                    file: file.path,
+                    line: number,
+                    severity: "blocker",
+                    rule: "missing-availability-guard",
+                    message: `${entry.name} requires iOS ${entry.version} but the file has no availability guard.`,
+                    consequence: "The app fails to compile against an older deployment target, or crashes on launch if the symbol is weakly linked.",
+                    fix: `Wrap in \`if #available(iOS ${entry.version}.0, *)\` or annotate with \`@available(iOS ${entry.version}.0, *)\`, and provide a fallback.`,
+                    doc: DOC,
+                    excerpt: text.trim(),
+                });
+                continue;
+            }
+            // Over-guarded: guarded at a HIGHER version than the symbol needs.
+            const tightest = Math.min(...guards);
+            if (tightest > entry.version) {
+                findings.push({
+                    file: file.path,
+                    line: number,
+                    severity: "serious",
+                    rule: "over-restrictive-guard",
+                    message: `${entry.name} was introduced in iOS ${entry.version} but is guarded at iOS ${tightest}.`,
+                    consequence: `Every device on iOS ${entry.version}–${tightest - 1} falls back unnecessarily, losing the feature for a large installed base. This is invisible when testing on a current device.`,
+                    fix: `Guard on iOS ${entry.version}, the version where the symbol was introduced — not the newest SDK.`,
+                    doc: DOC,
+                    excerpt: text.trim(),
+                });
+            }
+        }
+    });
+    // Foundation Models used without the RUNTIME availability check.
+    const usesFoundationModels = /\bLanguageModelSession\s*\(/.test(file.content);
+    const hasRuntimeCheck = /SystemLanguageModel[^\n]*\.availability|case\s+\.available/.test(file.content);
+    if (usesFoundationModels && !hasRuntimeCheck) {
+        const line = file.content.split("\n").findIndex((l) => /\bLanguageModelSession\s*\(/.test(l)) + 1;
+        findings.push({
+            file: file.path,
+            line,
+            severity: "blocker",
+            rule: "missing-runtime-model-check",
+            message: "Foundation Models used without a runtime availability check.",
+            consequence: "An @available guard proves the symbol exists; it does not prove the model is usable on this device, in this region, with Apple Intelligence enabled. The feature fails at tap time.",
+            fix: "Check `SystemLanguageModel.default.availability` and show a real unavailable state before the entry point renders.",
+            doc: "docs/frameworks/foundation-models.md",
+            excerpt: "LanguageModelSession(...)",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=availability.js.map

package/dist/analyzers/availability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"availability.js","sourceRoot":"","sources":["../../src/analyzers/availability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,GAAG,GAAG,8BAA8B,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,GAA8D;IAC5E,SAAS;IACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;IACnE,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClF,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IACvE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAClG,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAChF,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClF,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5D,SAAS;IACT,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC1G,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtE,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC5F,SAAS;IACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;IAClE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;CACnE,CAAC;AAEF,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,0DAA0D,CAAC;IACzE,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE7C,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAExC,2CAA2C;YAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,iBAAiB,KAAK,CAAC,OAAO,0CAA0C;oBAC9F,WAAW,EACT,mHAAmH;oBACrH,GAAG,EAAE,+BAA+B,KAAK,CAAC,OAAO,8CAA8C,KAAK,CAAC,OAAO,mCAAmC;oBAC/I,GAAG,EAAE,GAAG;oBACR,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,0BAA0B,KAAK,CAAC,OAAO,0BAA0B,QAAQ,GAAG;oBAClG,WAAW,EAAE,uBAAuB,KAAK,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,+HAA+H;oBAChM,GAAG,EAAE,gBAAgB,KAAK,CAAC,OAAO,qEAAqE;oBACvG,GAAG,EAAE,GAAG;oBACR,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,4DAA4D,CAAC,IAAI,CACvF,IAAI,CAAC,OAAO,CACb,CAAC;IACF,IAAI,oBAAoB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;YACJ,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,8DAA8D;YACvE,WAAW,EACT,qLAAqL;YACvL,GAAG,EAAE,oHAAoH;YACzH,GAAG,EAAE,sCAAsC;YAC3C,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/concurrency.d.ts

@@ -0,0 +1,8 @@
+import { Finding, SourceFile } from "./types.js";
+/**
+ * Swift 6 isolation and concurrency rules.
+ *
+ * These are the same rules enforced by templates/hooks/forbid-antipatterns.sh —
+ * this is that engine made addressable by an agent.
+ */
+export declare function analyzeConcurrency(file: SourceFile): Finding[];

package/dist/analyzers/concurrency.js

@@ -0,0 +1,75 @@
+import { eachLine, isSupportFile } from "./types.js";
+const DOC = "docs/swift/swift-concurrency.md";
+/**
+ * Swift 6 isolation and concurrency rules.
+ *
+ * These are the same rules enforced by templates/hooks/forbid-antipatterns.sh —
+ * this is that engine made addressable by an agent.
+ */
+export function analyzeConcurrency(file) {
+    const findings = [];
+    const support = isSupportFile(file.path);
+    const push = (line, excerpt, rule, severity, message, consequence, fix, doc = DOC) => findings.push({
+        file: file.path,
+        line,
+        severity,
+        rule,
+        message,
+        consequence,
+        fix,
+        doc,
+        excerpt: excerpt.trim(),
+    });
+    // File-level: @Observable without @MainActor anywhere in the file.
+    // Checked at file scope because the annotations may be on separate lines.
+    const hasObservable = /^\s*@Observable\b/m.test(file.content);
+    const hasMainActor = /@MainActor\b/.test(file.content);
+    if (hasObservable && !hasMainActor && !support) {
+        const line = file.content.split("\n").findIndex((l) => /^\s*@Observable\b/.test(l)) + 1;
+        push(line, "@Observable", "observable-without-mainactor", "blocker", "@Observable type is not @MainActor-isolated.", "@Observable grants no isolation. SwiftUI reads this state during layout while any task may write it — a data race under Swift 5 mode, a compile error under Swift 6.", "Annotate the type: `@MainActor @Observable final class …`. Annotate the type, not individual members — per-member isolation leaves gaps.");
+    }
+    // Non-final observable classes.
+    const nonFinal = file.content
+        .split("\n")
+        .findIndex((l) => /^\s*(public\s+)?class\s+\w+/.test(l) && !/final/.test(l));
+    if (hasObservable && nonFinal >= 0) {
+        push(nonFinal + 1, file.content.split("\n")[nonFinal], "observable-not-final", "minor", "@Observable class is not `final`.", "A subclass can add unobserved stored properties, and every access costs a dynamic dispatch.", "Mark the class `final`.");
+    }
+    eachLine(file, (line, number) => {
+        if (/\bDispatchQueue\s*\.\s*main\s*\.\s*async\b/.test(line)) {
+            push(number, line, "dispatchqueue-main-async", "serious", "DispatchQueue.main.async in Swift Concurrency code.", "Hand-rolled thread hopping bypasses the isolation the compiler can check, and defers the write by a run-loop turn.", "Isolate the enclosing type with @MainActor and assign directly.");
+        }
+        if (/\bTask\s*\.\s*detached\b/.test(line)) {
+            push(number, line, "task-detached", "serious", "Task.detached drops actor isolation, priority, and task-locals.", "Writes to isolated state from the detached task are cross-actor: a data race under Swift 5, a compile error under Swift 6.", "Use `Task { }` (which inherits the enclosing actor), a `nonisolated async` function, or an actor.");
+        }
+        if (/\bawait\s+MainActor\s*\.\s*run\b/.test(line)) {
+            push(number, line, "redundant-mainactor-run", "minor", "await MainActor.run inside an already-isolated type is redundant.", "Adds a suspension point and obscures that the type is already main-actor isolated.", "Assign directly if the enclosing type is @MainActor; otherwise isolate the type.");
+        }
+        if (/@unchecked\s+Sendable/.test(line)) {
+            push(number, line, "unchecked-sendable", "serious", "@unchecked Sendable asserts thread safety the compiler cannot verify.", "If there is no lock, actor, or documented single-threaded contract behind it, this is a race the type system was trying to prevent.", "Prefer a value type, an immutable `final class`, an `actor`, or Swift 6.4's `weak let` / `~Sendable`. If genuinely needed, add a comment naming the mechanism that protects it.");
+        }
+        if (/\bnonisolated\(unsafe\)/.test(line)) {
+            push(number, line, "nonisolated-unsafe", "minor", "nonisolated(unsafe) opts storage out of isolation checking.", "Nothing prevents concurrent access; correctness rests entirely on an unstated invariant.", "Add a comment naming what protects it, or move the state into an actor.");
+        }
+        // Unstructured Task in onAppear — outlives the view.
+        if (/\.onAppear\s*\{/.test(line) && /\bTask\s*\{/.test(line)) {
+            push(number, line, "task-in-onappear", "serious", "Unstructured Task in onAppear is never cancelled.", "The task keeps running after the view is dismissed and can write to a model whose screen is gone.", "Use `.task { }` or `.task(id:) { }`, which SwiftUI cancels on disappear.");
+        }
+        // A type named Task shadows _Concurrency.Task.
+        if (/^\s*(public\s+|internal\s+)?(struct|class|enum|actor)\s+Task\b/.test(line)) {
+            push(number, line, "type-named-task", "blocker", "A type named `Task` shadows _Concurrency.Task.", "`Task { … }` in the same file fails to compile with a confusing 'extra trailing closure' error.", "Rename it (TodoItem, WorkItem, JobRecord…).");
+        }
+    });
+    // Empty catch — swallows failures silently.
+    //
+    // Uses eachLine (which strips comments) rather than a raw regex over the whole
+    // file: a doc comment mentioning `catch { }` as an anti-pattern is not itself
+    // an anti-pattern.
+    eachLine(file, (line, number) => {
+        if (/catch\s*\{\s*\}/.test(line)) {
+            push(number, line, "empty-catch", "serious", "Empty catch block discards a failure silently.", "The operation fails with no log, no user feedback, and no way to diagnose it in production.", "Surface the error, or comment why the no-op is deliberate (e.g. `catch is CancellationError`).", "patterns/error-handling.md");
+        }
+    });
+    return findings;
+}
+//# sourceMappingURL=concurrency.js.map

package/dist/analyzers/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../../src/analyzers/concurrency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,GAAG,GAAG,iCAAiC,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,CACX,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,QAA6B,EAC7B,OAAe,EACf,WAAmB,EACnB,GAAW,EACX,GAAG,GAAG,GAAG,EACT,EAAE,CACF,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,OAAO;QACP,WAAW;QACX,GAAG;QACH,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;KACxB,CAAC,CAAC;IAEL,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,CACF,IAAI,EACJ,aAAa,EACb,8BAA8B,EAC9B,SAAS,EACT,8CAA8C,EAC9C,sKAAsK,EACtK,0IAA0I,CAC3I,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,aAAa,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CACF,QAAQ,GAAG,CAAC,EACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAClC,sBAAsB,EACtB,OAAO,EACP,mCAAmC,EACnC,6FAA6F,EAC7F,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC9B,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,IAAI,CACF,MAAM,EACN,IAAI,EACJ,0BAA0B,EAC1B,SAAS,EACT,qDAAqD,EACrD,oHAAoH,EACpH,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,CACF,MAAM,EACN,IAAI,EACJ,eAAe,EACf,SAAS,EACT,iEAAiE,EACjE,4HAA4H,EAC5H,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,CACF,MAAM,EACN,IAAI,EACJ,yBAAyB,EACzB,OAAO,EACP,mEAAmE,EACnE,oFAAoF,EACpF,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,CACF,MAAM,EACN,IAAI,EACJ,oBAAoB,EACpB,SAAS,EACT,uEAAuE,EACvE,qIAAqI,EACrI,iLAAiL,CAClL,CAAC;QACJ,CAAC;QAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CACF,MAAM,EACN,IAAI,EACJ,oBAAoB,EACpB,OAAO,EACP,6DAA6D,EAC7D,0FAA0F,EAC1F,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,qDAAqD;QACrD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,CACF,MAAM,EACN,IAAI,EACJ,kBAAkB,EAClB,SAAS,EACT,mDAAmD,EACnD,mGAAmG,EACnG,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChF,IAAI,CACF,MAAM,EACN,IAAI,EACJ,iBAAiB,EACjB,SAAS,EACT,gDAAgD,EAChD,iGAAiG,EACjG,6CAA6C,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,mBAAmB;IACnB,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC9B,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CACF,MAAM,EACN,IAAI,EACJ,aAAa,EACb,SAAS,EACT,gDAAgD,EAChD,6FAA6F,EAC7F,gGAAgG,EAChG,4BAA4B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/swiftui.d.ts

@@ -0,0 +1,2 @@
+import { Finding, SourceFile } from "./types.js";
+export declare function analyzeSwiftUI(file: SourceFile): Finding[];