novahiz 0.1.0

package/skills/code-reviewer/SKILL.md

@@ -0,0 +1,183 @@
+---
+name: "code-reviewer"
+description: Code review automation for TypeScript, JavaScript, Python, Go, Swift, Kotlin, C#, .NET, Java, C, C++, Rust, Ruby, PHP, and Dart/Flutter. Analyzes PRs for complexity and risk, checks code quality for SOLID violations and code smells, generates review reports. Use when reviewing pull requests, analyzing code quality, identifying issues, generating review checklists.
+---
+
+# Code Reviewer
+
+Automated code review tools for analyzing pull requests, detecting code quality issues, and generating review reports.
+
+---
+
+## How This Skill Is Organized
+
+```
+code-reviewer/
+  SKILL.md                        ← you are here (tools + dispatch table)
+  rules/
+    universal.md                  ← security, async, resources, exceptions, performance — all languages
+  languages/
+    python.md                     ← Python-specific rules + idioms
+    typescript.md                 ← TypeScript / JavaScript-specific rules + idioms
+    go.md                         ← Go-specific rules + idioms
+    swift.md                      ← Swift-specific rules + idioms
+    kotlin.md                     ← Kotlin-specific rules + idioms
+    csharp.md                     ← C# / .NET-specific rules + idioms
+    java.md                       ← Java-specific rules + idioms
+    c.md                          ← C -specific rules + idioms
+    cpp.md                        ← C++ -specific rules + idioms
+    rust.md                       ← Rust -specific rules + idioms
+    ruby.md                       ← Ruby -specific rules + idioms
+    php.md                        ← PHP-specific rules + idioms
+    dart.md                       ← Dart / Flutter-specific rules + idioms
+```
+
+### Loading order for every review
+
+1. This file (`SKILL.md`) — tools and thresholds
+2. `rules/universal.md` — always, for every language
+3. The matching `languages/*.md` — one file based on the extension table below
+
+That is always exactly **2 additional files**, regardless of scope.
+
+| Extension(s) | Load |
+|---|---|
+| `.py` | `languages/python.md` |
+| `.ts`, `.tsx`, `.js`, `.jsx`, `.mjs` | `languages/typescript.md` |
+| `.go` | `languages/go.md` |
+| `.swift` | `languages/swift.md` |
+| `.kt`, `.kts` | `languages/kotlin.md` |
+| `.cs`, `.csx`, `.razor`, `.cshtml` | `languages/csharp.md` |
+| `.java` | `languages/java.md` |
+| `.c`, `.h` | `languages/c.md` |
+| `.cpp`, `.cc`, `.cxx`, `.hpp`, `.hh`, `.hxx` | `languages/cpp.md` |
+| `.rs` | `languages/rust.md` |
+| `.rb`, `.rake`, `.gemspec`, `.ru` | `languages/ruby.md` |
+| `.php`, `.phtml` | `languages/php.md` |
+| `.dart` | `languages/dart.md` |
+
+---
+
+## Tools
+
+### PR Analyzer
+
+Analyzes git diff between branches to assess review complexity and identify risks.
+
+```bash
+# Analyze current branch against main
+python scripts/pr_analyzer.py /path/to/repo
+
+# Compare specific branches
+python scripts/pr_analyzer.py . --base main --head feature-branch
+
+# JSON output for integration
+python scripts/pr_analyzer.py /path/to/repo --json
+```
+
+**What it detects (universal — see also language file for language-specific signals):**
+- Hardcoded secrets (passwords, API keys, tokens, connection strings)
+- SQL / query injection patterns
+- Debug statements left in production code
+- Lint / analyzer suppression annotations
+- TODO/FIXME comments
+
+**Language-specific detections** are defined in each `languages/*.md` file.
+
+**Output includes:**
+- Complexity score (1-10)
+- Risk categorization (critical, high, medium, low)
+- File prioritization for review order
+- Commit message validation
+
+---
+
+### Code Quality Checker
+
+Analyzes source code for structural issues, code smells, and SOLID violations.
+
+```bash
+# Analyze a directory
+python scripts/code_quality_checker.py /path/to/code
+
+# Analyze specific language
+# Valid values: python, typescript, javascript, go, swift, kotlin, csharp, java, c, cpp, rust, ruby, php, dart
+python scripts/code_quality_checker.py . --language java
+
+# JSON output
+python scripts/code_quality_checker.py /path/to/code --json
+```
+
+**Universal thresholds:**
+
+| Issue | Threshold |
+|-------|-----------|
+| Long function | >50 lines |
+| Large file | >500 lines |
+| God class | >20 methods |
+| Too many params | >5 |
+| Deep nesting | >4 levels |
+| High complexity | >10 branches |
+
+Language-specific checks are defined in each `languages/*.md` file.
+
+---
+
+### Review Report Generator
+
+Combines PR analysis and code quality findings into structured review reports.
+
+```bash
+# Generate report for current repo
+python scripts/review_report_generator.py /path/to/repo
+
+# Markdown output
+python scripts/review_report_generator.py . --format markdown --output review.md
+
+# Use pre-computed analyses
+python scripts/review_report_generator.py . \
+  --pr-analysis pr_results.json \
+  --quality-analysis quality_results.json
+```
+
+**Verdicts:**
+
+| Score | Verdict |
+|-------|---------|
+| 90+ with no high issues | Approve |
+| 75+ with ≤2 high issues | Approve with suggestions |
+| 50-74 | Request changes |
+| <50 or critical issues | Block |
+
+---
+
+## Adding a New Language
+
+**Reviewer guidance (required):**
+
+1. Create `languages/<name>.md` using any existing language file as a template — it must have sections: PR Analyzer Signals, Code Quality Checks, Security, Async, Resource Management, Exception Handling, Performance, Idioms.
+2. Add the extension row to the dispatch table above.
+
+That is all the agent-driven review needs.
+
+**Deterministic analyzer support (optional, recommended):** the bundled scripts
+only flag a language they explicitly know. To make `code_quality_checker.py`
+score the new language:
+
+3. Add the extensions to `LANGUAGE_EXTENSIONS` in `scripts/code_quality_checker.py` (this also adds the `--language` choice).
+4. Add `function` / `class` / `method` regex entries for the language in the same file; otherwise it falls back to the Python patterns.
+5. Optionally add a `check_<name>_specific_smells(...)` detector (see the C#, Java, and C ones) and call it from `analyze_file`.
+6. Add `assets/sample_<name>_smells.<ext>` + `_clean` fixtures and commit the expected `--json` output under `expected_outputs/` as a regression guard.
+
+---
+
+## Regression Fixtures
+
+Labelled fixtures live in `assets/` with their committed `--json` output in
+`expected_outputs/` (C#, Java, and C). Drift from the committed JSON signals a
+behaviour change in the analyzer:
+
+```bash
+python scripts/code_quality_checker.py assets/sample_java_smells.java --json \
+  | diff - expected_outputs/sample_java_smells_quality.json
+```

package/skills/code-reviewer/assets/sample_c_clean.c

@@ -0,0 +1,71 @@
+/*
+ * sample_c_clean.c — sample_c_smells.c refactored per
+ * rules/universal.md + languages/c.md. Same surface area, zero
+ * detector hits.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+void safe_input(void) {
+    char buf[64];
+
+    /* fgets is bounds-aware */
+    if (fgets(buf, sizeof(buf), stdin) == NULL) {
+        return;
+    }
+
+    char dest[10];
+    /* strncpy with explicit bound + manual null-terminate */
+    strncpy(dest, buf, sizeof(dest) - 1);
+    dest[sizeof(dest) - 1] = '\0';
+
+    /* strncat with remaining-space bound */
+    size_t room = sizeof(dest) - strlen(dest) - 1;
+    strncat(dest, "world", room);
+
+    char msg[100];
+    /* snprintf is bounds-aware */
+    snprintf(msg, sizeof(msg), "%s says hello", buf);
+
+    /* Format string is a literal; buf is an argument */
+    printf("%s\n", buf);
+
+    char name[32];
+    /* %s with explicit width prevents overflow */
+    scanf("%31s", name);
+}
+
+
+void checked_alloc(int n) {
+    /* malloc result is NULL-checked before any dereference */
+    char *buf = malloc(n);
+    if (buf == NULL) {
+        return;
+    }
+    buf[0] = 'x';
+    buf[1] = 'y';
+    strncpy(buf, "ok", n - 1);
+
+    free(buf);
+    buf = NULL;
+    printf("done\n");
+}
+
+
+void run_safe_cmd(void) {
+    /* system() with a string literal — no command-injection surface */
+    system("ls -la");
+}
+
+
+int main(int argc, char *argv[]) {
+    (void)argc;
+    (void)argv;
+    safe_input();
+    checked_alloc(100);
+    run_safe_cmd();
+    return 0;
+}

package/skills/code-reviewer/assets/sample_c_smells.c

@@ -0,0 +1,66 @@
+/*
+ * sample_c_smells.c — labelled instances of every C-specific pattern
+ * the code-reviewer skill flags. Every smell is annotated inline with
+ * its CWE and the rule from languages/c.md.
+ *
+ * Refactored counterpart: sample_c_clean.c
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+void unsafe_input(void) {
+    char buf[64];
+
+    /* RULE: banned function gets() — CWE-242, no bounds check */
+    gets(buf);
+
+    char dest[10];
+    /* RULE: banned function strcpy() — no bounds check */
+    strcpy(dest, buf);
+
+    /* RULE: banned function strcat() — no bounds check */
+    strcat(dest, "world");
+
+    char msg[100];
+    /* RULE: banned function sprintf() — no bounds check */
+    sprintf(msg, "%s says hello", buf);
+
+    /* RULE: format-string vulnerability — CWE-134, buf controls format */
+    printf(buf);
+
+    char name[32];
+    /* RULE: unbounded scanf — %s without width, CWE-120 */
+    scanf("%s", name);
+}
+
+
+void leaky_alloc(int n) {
+    /* RULE: malloc result not NULL-checked within 5 lines — CWE-690 */
+    char *buf = malloc(n);
+    buf[0] = 'x';
+    buf[1] = 'y';
+    strcpy(buf, "leak");
+
+    /* RULE: free without zeroing pointer — CWE-416 dangling */
+    free(buf);
+    printf("done\n");
+}
+
+
+void run_user_cmd(const char *cmd_from_user) {
+    /* RULE: system() with non-literal argument — CWE-78 command injection */
+    system(cmd_from_user);
+}
+
+
+int main(int argc, char *argv[]) {
+    if (argc > 1) {
+        unsafe_input();
+        leaky_alloc(100);
+        run_user_cmd(argv[1]);
+    }
+    return 0;
+}

package/skills/code-reviewer/assets/sample_csharp_clean.cs

@@ -0,0 +1,100 @@
+// Sample C# file showing the fixed version of sample_csharp_smells.cs.
+// Same shape, but every smell has been resolved per the patterns documented
+// in rules/universal.md and languages/csharp.md.
+//
+// Run:
+//   python scripts/code_quality_checker.py assets/sample_csharp_clean.cs
+//
+// Expected: no HIGH C#-specific smells flagged.
+
+using System;
+using System.Net.Http;
+using System.Threading.Tasks;
+using System.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace Sample
+{
+    public class DbOptions
+    {
+        // FIX: connection string from configuration, never inlined.
+        public string ConnectionString { get; init; } = "";
+    }
+
+    public class UserService
+    {
+        private readonly string _connectionString;
+        private readonly HttpClient _httpClient;
+        private readonly ILogger<UserService> _logger;
+
+        // FIX: IHttpClientFactory + IOptions, no hardcoded secrets, no `new HttpClient()`.
+        public UserService(
+            IHttpClientFactory httpClientFactory,
+            IOptions<DbOptions> dbOptions,
+            ILogger<UserService> logger)
+        {
+            _httpClient = httpClientFactory.CreateClient("api");
+            _connectionString = dbOptions.Value.ConnectionString;
+            _logger = logger;
+        }
+
+        // FIX: async Task (not async void) so callers can await and observe exceptions.
+        public async Task HandleClickAsync()
+        {
+            // FIX: await the Task instead of blocking on it.
+            var data = await FetchAsync().ConfigureAwait(false);
+            _logger.LogInformation("Fetched {Length} bytes", data.Length);
+        }
+
+        public async Task<string> FetchAsync()
+        {
+            try
+            {
+                // FIX: await the async call — Task is no longer discarded.
+                await FireAndForgetAsync().ConfigureAwait(false);
+
+                // FIX: real null check, no `!`.
+                var user = await GetCurrentUserAsync().ConfigureAwait(false);
+                if (user is null)
+                {
+                    throw new InvalidOperationException("No current user");
+                }
+                _ = user.Name;
+
+                return await _httpClient
+                    .GetStringAsync("https://api.example/data")
+                    .ConfigureAwait(false);
+            }
+            catch (HttpRequestException ex)
+            {
+                // FIX: catch specific exception, log with context, rethrow.
+                _logger.LogError(ex, "Upstream fetch failed");
+                throw;
+            }
+        }
+
+        // FIX: real type, not `dynamic`.
+        public User? CurrentUser { get; private set; }
+
+        // FIX: `unsafe` removed — none of the logic actually needed pointers.
+        public int FirstValue(int[] values) => values.Length > 0 ? values[0] : 0;
+
+        // FIX: no #pragma / [SuppressMessage] — root cause fixed instead.
+        public string GetName(int id)
+        {
+            // FIX: `using var` disposes connection + command deterministically.
+            using var conn = new SqlConnection(_connectionString);
+            // FIX: parameterized query, no string concatenation.
+            using var cmd = new SqlCommand("SELECT name FROM users WHERE id = @id", conn);
+            cmd.Parameters.AddWithValue("@id", id);
+            conn.Open();
+            return (string)cmd.ExecuteScalar();
+        }
+
+        private Task<User?> GetCurrentUserAsync() => Task.FromResult<User?>(null);
+        private Task FireAndForgetAsync() => Task.CompletedTask;
+    }
+
+    public record User(int Id, string Name);
+}

package/skills/code-reviewer/assets/sample_csharp_smells.cs

@@ -0,0 +1,78 @@
+// Sample C# file demonstrating every C#-specific pattern the code-reviewer
+// skill detects. Each smell is labelled inline. This file is NOT meant to
+// compile cleanly — it is a fixture for code_quality_checker.py and
+// pr_analyzer.py.
+//
+// Run:
+//   python scripts/code_quality_checker.py assets/sample_csharp_smells.cs
+//
+// Expected output: see expected_outputs/sample_csharp_smells_quality.json
+
+using System;
+using System.Net.Http;
+using System.Threading.Tasks;
+using System.Data.SqlClient;
+using System.Diagnostics.CodeAnalysis;
+
+namespace Sample
+{
+    public class UserService
+    {
+        // [hardcoded_secrets] hardcoded connection string with password
+        public string ConnectionString = "Server=prod;Database=app;Password=hunter2;";
+
+        // [csharp_async_void] async void on a non-event-handler signature
+        public async void HandleClick(object sender, EventArgs e)
+        {
+            // [csharp_blocking_async] .Result blocks on Task in a sync context
+            var data = FetchAsync().Result;
+            // [console_log] Debug.WriteLine output statement
+            Debug.WriteLine(data);
+        }
+
+        public async Task<string> FetchAsync()
+        {
+            // [csharp_new_httpclient] new HttpClient() in method body
+            // [csharp_undisposed_idisposable] HttpClient not in `using`
+            var client = new HttpClient();
+
+            try
+            {
+                // [csharp_missing_await] FireAndForgetAsync() returns Task, never awaited
+                FireAndForgetAsync();
+
+                // [csharp_null_forgiving] `user!.Name` forces null-forgiving
+                var name = user!.Name;
+
+                return await client.GetStringAsync("https://api.example/data");
+            }
+            catch (Exception)
+            {
+                // [csharp_swallowed_exception] empty catch (Exception)
+            }
+            return null!;
+        }
+
+        // [loose_type] C# `dynamic` overuse
+        public dynamic Untyped = null;
+
+        // [csharp_unsafe_block] `unsafe` modifier on a method
+        public unsafe void Pointers()
+        {
+            int x = 0;
+            int* p = &x;
+        }
+
+        // [analyzer_disable] #pragma warning disable
+        #pragma warning disable CS0168
+        // [analyzer_disable] [SuppressMessage] attribute
+        [SuppressMessage("Style", "IDE0060")]
+        public string GetName(SqlConnection conn, int id)
+        {
+            // [csharp_undisposed_idisposable] SqlCommand without `using`
+            // [sql_concatenation] string concatenation builds SQL with user input
+            var cmd = new SqlCommand("SELECT name FROM users WHERE id = " + id, conn);
+            return cmd.ExecuteScalar().ToString();
+        }
+    }
+}

package/skills/code-reviewer/assets/sample_java_clean.java

@@ -0,0 +1,55 @@
+// Sample Java file showing the fixed version of sample_java_smells.java.
+// Same shape, but every smell has been resolved per the patterns documented
+// in rules/universal.md and languages/java.md.
+//
+// Run:
+//   python scripts/code_quality_checker.py assets/sample_java_clean.java
+//
+// Expected: no HIGH Java-specific smells flagged.
+
+package sample;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+public class UserService {
+
+    // FIX: heavy object shared as a singleton instead of constructed per call.
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    // FIX: connection string injected from configuration, never inlined.
+    private final String connectionString;
+
+    public UserService(String connectionString) {
+        this.connectionString = connectionString;
+    }
+
+    public String getName(Connection conn, int id) {
+        // FIX: try-with-resources guarantees the stream and statement close.
+        try (InputStream config = new FileInputStream("/etc/config");
+             // FIX: parameterized query, no string concatenation.
+             PreparedStatement stmt =
+                 conn.prepareStatement("SELECT name FROM users WHERE id = ?")) {
+            stmt.setInt(1, id);
+            try (ResultSet rs = stmt.executeQuery()) {
+                return rs.next() ? rs.getString("name") : null;
+            }
+        } catch (Exception e) {
+            // FIX: rethrow with context instead of swallowing.
+            throw new IllegalStateException("Failed to load user " + id, e);
+        }
+    }
+
+    public void process() {
+        try {
+            Thread.sleep(1000);
+        } catch (InterruptedException e) {
+            // FIX: restore the interrupt flag so cancellation still propagates.
+            Thread.currentThread().interrupt();
+        }
+    }
+}

package/skills/code-reviewer/assets/sample_java_smells.java

@@ -0,0 +1,56 @@
+// Sample Java file demonstrating the Java-specific patterns the code-reviewer
+// skill detects. Each smell is labelled inline. This file is NOT meant to
+// compile cleanly — it is a fixture for code_quality_checker.py and
+// pr_analyzer.py.
+//
+// Run:
+//   python scripts/code_quality_checker.py assets/sample_java_smells.java
+//
+// Expected output: see expected_outputs/sample_java_smells_quality.json
+
+package sample;
+
+import java.io.FileInputStream;
+import java.sql.Connection;
+import java.sql.Statement;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+public class UserService {
+
+    // [hardcoded_secrets] hardcoded JDBC URL with password
+    public String connectionString = "jdbc:postgresql://prod/app?user=app&password=hunter2";
+
+    // [analyzer_disable] @SuppressWarnings without justification
+    @SuppressWarnings("unchecked")
+    public String getName(Connection conn, int id) throws Exception {
+        // [java_unclosed_resource] FileInputStream not in try-with-resources
+        FileInputStream fis = new FileInputStream("/etc/config");
+
+        // [java_per_use_heavy_object] new ObjectMapper() constructed per call
+        ObjectMapper mapper = new ObjectMapper();
+
+        try {
+            Statement stmt = conn.createStatement();
+            // [sql_concatenation] string concatenation builds SQL with user input
+            return stmt.executeQuery("SELECT name FROM users WHERE id = " + id).toString();
+        } catch (Exception e) {
+            // [java_empty_catch] empty catch swallows the exception
+        }
+        return null;
+    }
+
+    public void process() {
+        try {
+            Thread.sleep(1000);
+        } catch (InterruptedException e) {
+            // [java_swallowed_interrupt] interrupt flag not restored
+            // [console_log] printStackTrace used as error handling
+            e.printStackTrace();
+        }
+    }
+
+    public void log(String message) {
+        // [console_log] System.out.println left in production code
+        System.out.println(message);
+    }
+}

package/skills/code-reviewer/expected_outputs/sample_c_clean_quality.json

@@ -0,0 +1,65 @@
+{
+  "file": "/home/user/claude-skills/engineering-team/skills/code-reviewer/assets/sample_c_clean.c",
+  "language": "c",
+  "metrics": {
+    "lines": {
+      "total": 72,
+      "code": 43,
+      "blank": 17,
+      "comment": 12
+    },
+    "functions": 4,
+    "classes": 0,
+    "avg_complexity": 1.8
+  },
+  "quality_score": 100,
+  "grade": "A",
+  "smells": [
+    {
+      "type": "long_function",
+      "severity": "medium",
+      "message": "Function 'safe_input' has 61 lines (max: 50)",
+      "location": "safe_input"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 100 should be a named constant",
+      "location": "line 29"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 100 should be a named constant",
+      "location": "line 68"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "safe_input",
+      "parameters": 1,
+      "lines": 61,
+      "complexity": 3
+    },
+    {
+      "name": "checked_alloc",
+      "parameters": 1,
+      "lines": 31,
+      "complexity": 2
+    },
+    {
+      "name": "run_safe_cmd",
+      "parameters": 1,
+      "lines": 15,
+      "complexity": 1
+    },
+    {
+      "name": "main",
+      "parameters": 2,
+      "lines": 9,
+      "complexity": 1
+    }
+  ],
+  "class_details": []
+}