novahiz 0.1.0

package/skills/code-reviewer/expected_outputs/sample_c_smells_quality.json

@@ -0,0 +1,155 @@
+{
+  "file": "/home/user/claude-skills/engineering-team/skills/code-reviewer/assets/sample_c_smells.c",
+  "language": "c",
+  "metrics": {
+    "lines": {
+      "total": 67,
+      "code": 37,
+      "blank": 17,
+      "comment": 13
+    },
+    "functions": 4,
+    "classes": 0,
+    "avg_complexity": 2.0
+  },
+  "quality_score": 4,
+  "grade": "F",
+  "smells": [
+    {
+      "type": "long_function",
+      "severity": "medium",
+      "message": "Function 'unsafe_input' has 54 lines (max: 50)",
+      "location": "unsafe_input"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 242 should be a named constant",
+      "location": "line 17"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 100 should be a named constant",
+      "location": "line 27"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 134 should be a named constant",
+      "location": "line 31"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 120 should be a named constant",
+      "location": "line 35"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 690 should be a named constant",
+      "location": "line 41"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 416 should be a named constant",
+      "location": "line 47"
+    },
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 100 should be a named constant",
+      "location": "line 62"
+    },
+    {
+      "type": "c_banned_gets",
+      "severity": "high",
+      "message": "'gets()' is unsafe: no bounds check, removed from C11 (CWE-242)",
+      "location": "offset 117"
+    },
+    {
+      "type": "c_banned_strcpy",
+      "severity": "high",
+      "message": "'strcpy()' is unsafe: no bounds check \u2014 prefer strncpy or strlcpy",
+      "location": "offset 157"
+    },
+    {
+      "type": "c_banned_strcpy",
+      "severity": "high",
+      "message": "'strcpy()' is unsafe: no bounds check \u2014 prefer strncpy or strlcpy",
+      "location": "offset 447"
+    },
+    {
+      "type": "c_banned_strcat",
+      "severity": "high",
+      "message": "'strcat()' is unsafe: no bounds check \u2014 prefer strncat or strlcat",
+      "location": "offset 186"
+    },
+    {
+      "type": "c_banned_sprintf",
+      "severity": "high",
+      "message": "'sprintf()' is unsafe: no bounds check \u2014 prefer snprintf",
+      "location": "offset 238"
+    },
+    {
+      "type": "c_format_string",
+      "severity": "high",
+      "message": "'printf(buf)' uses a non-literal format string \u2014 CWE-134 format string vulnerability",
+      "location": "offset 284"
+    },
+    {
+      "type": "c_unbounded_scanf",
+      "severity": "high",
+      "message": "scanf '%s' without a width specifier \u2014 unbounded read can overflow the destination buffer",
+      "location": "offset 326"
+    },
+    {
+      "type": "c_malloc_unchecked",
+      "severity": "medium",
+      "message": "'buf' from malloc/calloc/realloc is not NULL-checked within 5 lines \u2014 dereferencing NULL is UB (CWE-690)",
+      "location": "line 36"
+    },
+    {
+      "type": "c_free_without_null",
+      "severity": "low",
+      "message": "'free(buf)' not followed by 'buf = NULL;' \u2014 dangling pointer can be reused (CWE-416)",
+      "location": "line 42"
+    },
+    {
+      "type": "c_system_non_literal",
+      "severity": "high",
+      "message": "'system(cmd_from_user)' with a non-literal argument \u2014 command injection (CWE-78); use execve with validated args",
+      "location": "offset 571"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "unsafe_input",
+      "parameters": 1,
+      "lines": 54,
+      "complexity": 2
+    },
+    {
+      "name": "leaky_alloc",
+      "parameters": 1,
+      "lines": 28,
+      "complexity": 2
+    },
+    {
+      "name": "run_user_cmd",
+      "parameters": 1,
+      "lines": 15,
+      "complexity": 2
+    },
+    {
+      "name": "main",
+      "parameters": 2,
+      "lines": 9,
+      "complexity": 2
+    }
+  ],
+  "class_details": []
+}

package/skills/code-reviewer/expected_outputs/sample_csharp_clean_quality.json

@@ -0,0 +1,135 @@
+{
+  "file": "/home/user/claude-skills/engineering-team/skills/code-reviewer/assets/sample_csharp_clean.cs",
+  "language": "csharp",
+  "metrics": {
+    "lines": {
+      "total": 101,
+      "code": 67,
+      "blank": 14,
+      "comment": 20
+    },
+    "functions": 13,
+    "classes": 3,
+    "avg_complexity": 1.3
+  },
+  "quality_score": 98,
+  "grade": "A",
+  "smells": [
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System;' appears unused",
+      "location": "System"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Net.Http;' appears unused",
+      "location": "System.Net.Http"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Threading.Tasks;' appears unused",
+      "location": "System.Threading.Tasks"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Data.SqlClient;' appears unused",
+      "location": "System.Data.SqlClient"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using Microsoft.Extensions.Logging;' appears unused",
+      "location": "Microsoft.Extensions.Logging"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using Microsoft.Extensions.Options;' appears unused",
+      "location": "Microsoft.Extensions.Options"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "HttpClient",
+      "parameters": 0,
+      "lines": 2,
+      "complexity": 1
+    },
+    {
+      "name": "UserService",
+      "parameters": 3,
+      "lines": 8,
+      "complexity": 1
+    },
+    {
+      "name": "Task",
+      "parameters": 1,
+      "lines": 2,
+      "complexity": 2
+    },
+    {
+      "name": "HandleClickAsync",
+      "parameters": 0,
+      "lines": 8,
+      "complexity": 1
+    },
+    {
+      "name": "FetchAsync",
+      "parameters": 0,
+      "lines": 12,
+      "complexity": 2
+    },
+    {
+      "name": "InvalidOperationException",
+      "parameters": 1,
+      "lines": 21,
+      "complexity": 3
+    },
+    {
+      "name": "FirstValue",
+      "parameters": 1,
+      "lines": 4,
+      "complexity": 1
+    },
+    {
+      "name": "GetName",
+      "parameters": 1,
+      "lines": 4,
+      "complexity": 1
+    },
+    {
+      "name": "SqlConnection",
+      "parameters": 1,
+      "lines": 3,
+      "complexity": 1
+    },
+    {
+      "name": "SqlCommand",
+      "parameters": 2,
+      "lines": 7,
+      "complexity": 1
+    }
+  ],
+  "class_details": [
+    {
+      "name": "DbOptions",
+      "methods": 0,
+      "lines": 7
+    },
+    {
+      "name": "UserService",
+      "methods": 8,
+      "lines": 75
+    },
+    {
+      "name": "User",
+      "methods": 0,
+      "lines": 3
+    }
+  ]
+}

package/skills/code-reviewer/expected_outputs/sample_csharp_smells_quality.json

@@ -0,0 +1,143 @@
+{
+  "file": "/home/user/claude-skills/engineering-team/skills/code-reviewer/assets/sample_csharp_smells.cs",
+  "language": "csharp",
+  "metrics": {
+    "lines": {
+      "total": 79,
+      "code": 43,
+      "blank": 11,
+      "comment": 25
+    },
+    "functions": 7,
+    "classes": 1,
+    "avg_complexity": 1.3
+  },
+  "quality_score": 45,
+  "grade": "F",
+  "smells": [
+    {
+      "type": "csharp_async_void",
+      "severity": "high",
+      "message": "'async void HandleClick' \u2014 only safe for event handlers; prefer 'async Task'",
+      "location": "HandleClick"
+    },
+    {
+      "type": "csharp_blocking_async",
+      "severity": "high",
+      "message": "Blocking call on async operation ('.Result' / '.Wait()' / '.GetAwaiter().GetResult()') \u2014 can deadlock in ASP.NET contexts",
+      "location": "offset 430"
+    },
+    {
+      "type": "csharp_swallowed_exception",
+      "severity": "high",
+      "message": "Empty catch block swallows exceptions silently",
+      "location": "offset 853"
+    },
+    {
+      "type": "csharp_undisposed_idisposable",
+      "severity": "medium",
+      "message": "'HttpClient' looks like IDisposable but is not wrapped in 'using' / 'using var'",
+      "location": "offset 555"
+    },
+    {
+      "type": "csharp_undisposed_idisposable",
+      "severity": "medium",
+      "message": "'SqlCommand' looks like IDisposable but is not wrapped in 'using' / 'using var'",
+      "location": "offset 1289"
+    },
+    {
+      "type": "csharp_new_httpclient",
+      "severity": "medium",
+      "message": "'new HttpClient()' \u2014 prefer IHttpClientFactory or a long-lived static instance to avoid socket exhaustion",
+      "location": "offset 606"
+    },
+    {
+      "type": "csharp_missing_await",
+      "severity": "medium",
+      "message": "Async method called without 'await' \u2014 Task is discarded",
+      "location": "line 42"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System;' appears unused",
+      "location": "System"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Net.Http;' appears unused",
+      "location": "System.Net.Http"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Threading.Tasks;' appears unused",
+      "location": "System.Threading.Tasks"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Data.SqlClient;' appears unused",
+      "location": "System.Data.SqlClient"
+    },
+    {
+      "type": "csharp_unused_using",
+      "severity": "low",
+      "message": "'using System.Diagnostics.CodeAnalysis;' appears unused",
+      "location": "System.Diagnostics.CodeAnalysis"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "HandleClick",
+      "parameters": 2,
+      "lines": 9,
+      "complexity": 1
+    },
+    {
+      "name": "FetchAsync",
+      "parameters": 0,
+      "lines": 3,
+      "complexity": 1
+    },
+    {
+      "name": "HttpClient",
+      "parameters": 0,
+      "lines": 3,
+      "complexity": 1
+    },
+    {
+      "name": "HttpClient",
+      "parameters": 0,
+      "lines": 24,
+      "complexity": 3
+    },
+    {
+      "name": "Pointers",
+      "parameters": 0,
+      "lines": 11,
+      "complexity": 1
+    },
+    {
+      "name": "GetName",
+      "parameters": 2,
+      "lines": 5,
+      "complexity": 1
+    },
+    {
+      "name": "SqlCommand",
+      "parameters": 2,
+      "lines": 6,
+      "complexity": 1
+    }
+  ],
+  "class_details": [
+    {
+      "name": "UserService",
+      "methods": 4,
+      "lines": 61
+    }
+  ]
+}

package/skills/code-reviewer/expected_outputs/sample_java_clean_quality.json

@@ -0,0 +1,53 @@
+{
+  "file": "/home/user/claude-skills/engineering-team/skills/code-reviewer/assets/sample_java_clean.java",
+  "language": "java",
+  "metrics": {
+    "lines": {
+      "total": 56,
+      "code": 33,
+      "blank": 9,
+      "comment": 14
+    },
+    "functions": 3,
+    "classes": 1,
+    "avg_complexity": 2.0
+  },
+  "quality_score": 100,
+  "grade": "A",
+  "smells": [
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 1000 should be a named constant",
+      "location": "line 49"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "UserService",
+      "parameters": 1,
+      "lines": 5,
+      "complexity": 1
+    },
+    {
+      "name": "getName",
+      "parameters": 2,
+      "lines": 17,
+      "complexity": 3
+    },
+    {
+      "name": "process",
+      "parameters": 0,
+      "lines": 10,
+      "complexity": 2
+    }
+  ],
+  "class_details": [
+    {
+      "name": "UserService",
+      "methods": 3,
+      "lines": 38
+    }
+  ]
+}

package/skills/code-reviewer/expected_outputs/sample_java_smells_quality.json

@@ -0,0 +1,83 @@
+{
+  "file": "/home/user/claude-skills/engineering-team/skills/code-reviewer/assets/sample_java_smells.java",
+  "language": "java",
+  "metrics": {
+    "lines": {
+      "total": 57,
+      "code": 29,
+      "blank": 10,
+      "comment": 18
+    },
+    "functions": 3,
+    "classes": 1,
+    "avg_complexity": 2.0
+  },
+  "quality_score": 68,
+  "grade": "D",
+  "smells": [
+    {
+      "type": "magic_number",
+      "severity": "low",
+      "message": "Magic number 1000 should be a named constant",
+      "location": "line 44"
+    },
+    {
+      "type": "java_empty_catch",
+      "severity": "high",
+      "message": "Empty catch block swallows exceptions silently",
+      "location": "offset 684"
+    },
+    {
+      "type": "java_print_stack_trace",
+      "severity": "medium",
+      "message": "'printStackTrace()' is not real error handling \u2014 log via a proper logger or rethrow with context",
+      "location": "offset 913"
+    },
+    {
+      "type": "java_swallowed_interrupt",
+      "severity": "high",
+      "message": "InterruptedException caught without 'Thread.currentThread().interrupt()' \u2014 breaks cooperative cancellation",
+      "location": "offset 841"
+    },
+    {
+      "type": "java_unclosed_resource",
+      "severity": "medium",
+      "message": "'FileInputStream' looks like an AutoCloseable but is not in a try-with-resources statement",
+      "location": "offset 366"
+    },
+    {
+      "type": "java_per_use_heavy_object",
+      "severity": "medium",
+      "message": "'new ObjectMapper()' is expensive \u2014 share a singleton instance instead of constructing per call",
+      "location": "offset 451"
+    }
+  ],
+  "solid_violations": [],
+  "function_details": [
+    {
+      "name": "getName",
+      "parameters": 2,
+      "lines": 18,
+      "complexity": 3
+    },
+    {
+      "name": "process",
+      "parameters": 0,
+      "lines": 11,
+      "complexity": 2
+    },
+    {
+      "name": "log",
+      "parameters": 1,
+      "lines": 6,
+      "complexity": 1
+    }
+  ],
+  "class_details": [
+    {
+      "name": "UserService",
+      "methods": 3,
+      "lines": 40
+    }
+  ]
+}

package/skills/code-reviewer/languages/c.md

@@ -0,0 +1,103 @@
+---
+language: c
+extensions: [".c", ".h"]
+---
+
+# C — Language-Specific Review Notes
+
+Load this file alongside `rules/universal.md`. Universal rules are not repeated here — only C-specific rules and idioms.
+
+---
+
+## PR Analyzer — C Risk Signals
+
+- `printf` / debug `fprintf(stderr, ...)` statements left in production code
+- `// TODO` / `// FIXME` comments near memory management code — high risk
+- Disabled compiler warnings (`#pragma GCC diagnostic ignore`, `-w` flags in Makefile)
+- Hardcoded credentials or keys in source
+- Use of banned functions: `gets`, `strcpy`, `strcat`, `sprintf`, `scanf` without width limits
+
+---
+
+## Code Quality — C Checks
+
+- Functions longer than 50 lines — C functions tend to grow organically and become hard to reason about
+- Missing `NULL` check after `malloc` / `calloc` / `realloc`
+- Return value of functions ignored without explicit `(void)` cast
+- Global mutable state used across translation units without clear ownership
+- Magic numbers without `#define` or `const` — especially sizes and offsets
+- Mixed `malloc`/`free` ownership — unclear which caller is responsible for freeing
+
+---
+
+## Security
+
+- Flag `gets()` — no bounds checking, always a buffer overflow; replace with `fgets()`
+- Flag `strcpy()` / `strcat()` — use `strncpy()` / `strncat()` with explicit size, or `strlcpy()` / `strlcat()`
+- Flag `sprintf()` — use `snprintf()` with explicit buffer size
+- Flag `scanf("%s", buf)` without a width specifier — unbounded read
+- Flag `strlen()` result used as a signed integer — potential truncation on 64-bit
+- Flag user-controlled data used as a format string (`printf(user_input)`) — format string attack
+- Flag integer arithmetic used as array index without bounds check
+- Flag signed integer overflow — undefined behavior in C
+
+---
+
+## Async / Concurrency
+
+- Flag shared global or `static` variables accessed from multiple threads without a mutex or `_Atomic`
+- Flag `pthread_mutex_t` / `sem_t` not initialized before use
+- Flag signal handlers that call non-async-signal-safe functions (`malloc`, `printf`, etc.)
+- Flag `volatile` used as a substitute for proper synchronization — it is not sufficient
+- Flag lock acquisition order inconsistency across call sites — deadlock risk
+
+---
+
+## Resource Management
+
+- Flag every `malloc` / `calloc` / `realloc` path — verify a matching `free` exists on all exit paths
+- Flag `fopen` without a matching `fclose` on all paths including error paths
+- Flag `dup` / `socket` / `open` file descriptors not closed on all paths
+- Flag stack-allocated VLAs (variable-length arrays) of unbounded size — stack overflow risk
+- Flag `realloc` return value assigned directly to the source pointer — leaks on failure
+
+---
+
+## Exception Handling
+
+- Flag ignored return values from `malloc`, `fopen`, `read`, `write`, `close` — all can fail
+- Flag `errno` checked after a function that doesn't set it, or not checked immediately after one that does
+- Flag `perror` / `strerror` as the sole error handling in library code — propagate errors to callers
+- Flag functions that return `-1` on error without documenting which `errno` values are possible
+- Flag `assert()` used for runtime error handling — disabled by `NDEBUG` in production builds
+
+---
+
+## Performance
+
+- Flag `strlen()` called repeatedly on the same string in a loop — cache the result
+- Flag unnecessary copies of large structs passed by value — pass by pointer
+- Flag `memcpy` / `memset` on overlapping regions — use `memmove` for overlapping
+- Flag repeated heap allocations in a tight loop — consider a pool or stack allocation
+- Flag `volatile` on variables not accessed by hardware or signal handlers — prevents optimization
+
+---
+
+## Idioms and Best Practices
+
+### Memory Safety
+- Every pointer must have a clear owner responsible for freeing it — document ownership in comments
+- Set pointers to `NULL` immediately after `free` to catch use-after-free early
+- Prefer `calloc` over `malloc` + `memset` for zero-initialized allocations
+- Use `const` on pointer parameters that the function does not modify
+
+### Defensive Coding
+- Always check `NULL` returns from allocation functions
+- Use `size_t` for sizes and counts — never `int`
+- Prefer `snprintf` and `fgets` over any unbounded string function
+- Compile with `-Wall -Wextra -Werror` and treat warnings as errors
+
+### Portability
+- Do not assume pointer size equals `int` size — use `intptr_t` / `uintptr_t`
+- Do not rely on undefined behavior for performance — use compiler intrinsics instead
+- Use `stdint.h` types (`uint32_t`, `int64_t`) for fixed-width requirements