oc-pilot 0.5.1 → 0.88.1

package/dist/core/presets.js

@@ -0,0 +1,408 @@
+const COMMON_HEAD = `# Project review rules
+
+These rules are injected into every review, test-fix and fix request.
+Keep the file short and concrete; long rule files get truncated.
+
+`;
+function preset(id, title, description, body) {
+    return { id, title, description, rules: `${COMMON_HEAD}${body.trim()}\n` };
+}
+export const PRESETS = [
+    preset("base", "Base", "Minimal language-agnostic starter rules", `
+## Correctness
+- Flag race conditions, off-by-one errors and incorrect null/undefined handling.
+- Flag swallowed errors: empty catch blocks, \`catch {}\` without logging or rethrow.
+- Flag dead branches and unreachable code after return/throw.
+
+## Security
+- Flag injection risks: string-built SQL, shell commands, HTML and eval usage.
+- Flag unvalidated external input crossing trust boundaries without checks.
+- Flag hardcoded credentials, tokens and private keys.
+
+## Maintainability
+- Flag functions longer than ~80 lines or with deeply nested conditionals (3+ levels).
+- Flag duplicated logic that appears three or more times.
+- Flag misleading names: a function that does something other than its name says.
+`),
+    preset("node", "Node.js / TypeScript", "Backend services, CLIs and libraries on modern Node", `
+## Async and errors
+- Always await or explicitly handle promises; flag floating promises and missing .catch.
+- Flag sync APIs in hot paths: readFileSync, existsSync in request handlers.
+- Wrap async route handlers so rejections reach the error middleware.
+- Use structured errors with codes; never throw plain strings.
+
+## APIs and data
+- Validate and normalize all external input at the boundary; distrust it downstream.
+- Flag unbounded queries and missing pagination on collection endpoints.
+- Prefer explicit typed schemas over \`any\`; flag \`as any\` casts and non-null \`!\` chains.
+
+## Operations
+- Fail fast on misconfiguration at startup, not on first request.
+- Log with context (request id, user id); never log secrets or full payloads.
+- Respect timeouts on every outbound call: fetch, DB, message queues.
+- Flag missing cleanup: open handles, timers, listeners after shutdown.
+`),
+    preset("react", "React", "React 18+ components, hooks and state management", `
+## Hooks
+- Every effect dependency must be intentional; flag missing deps and stale closures.
+- Flag derived state stored in useState that should be computed during render.
+- Prefer useReducer or external stores over chains of inter-dependent useState.
+- Flag effects that duplicate what event handlers should do.
+
+## Rendering
+- Keys must be stable ids; flag array-index keys on reorderable lists.
+- Flag state updates that mutate objects or arrays in place.
+- Flag expensive computations in render without useMemo only when measurable.
+- Accessible by default: label inputs, keep keyboard handlers, alt non-decorative images.
+
+## Boundaries
+- Validate data at the network layer; components render, they do not fetch-validate.
+- Flag direct DOM manipulation that React also manages (className, styles, listeners).
+- Colocate styles and types with the component; flag cross-importing internals.
+`),
+    preset("next", "Next.js", "App Router: server components, server actions and caching", `
+## Rendering and data
+- Server Components by default; flag "use client" without a concrete reason.
+- Do not fetch in useEffect for data available via server components; move it server-side.
+- Flag searchParams and dynamic segment params used without validation.
+
+## Security
+- Server Actions must validate input and check auth/ownership; flag blind mutations.
+- Flag secrets reaching the client: sensitive values in NEXT_PUBLIC_ vars or client props.
+- Flag dangerouslySetInnerHTML on user content; sanitize at the data source.
+- Keep middleware lean: it runs on every request.
+
+## Caching and correctness
+- Fetch calls state their cache/revalidate strategy where staleness matters.
+- Flag hydration mismatches: server/client differences in dates, randomness, locale.
+- Use next/image and next/link; flag raw <img> and <a> in app code.
+`),
+    preset("vue", "Vue", "Vue 3 Composition API components and reactivity", `
+## Composition API
+- Flag props mutation and v-model on props; props are read-only.
+- computed must stay pure; flag side effects inside computed.
+- watch needs cleanup and a precise source; flag deep watchers used as a default.
+
+## Reactivity
+- Destructuring props loses reactivity; use toRefs where reactivity must survive.
+- Flag in-place mutations of non-reactive copies expected to update the view.
+- v-for keys must be stable ids, not array index, on reorderable lists.
+
+## Boundaries
+- Validate API data at the network layer; components render, they do not fetch-validate.
+- Flag direct DOM manipulation that Vue also manages (bound attrs, listeners).
+- Keep provide/inject typed; flag untyped injection of app-wide state.
+`),
+    preset("svelte", "Svelte", "Svelte 5 runes, stores and SSR", `
+## Runes and state
+- $derived must be pure; flag side effects inside $derived.
+- $effect is for synchronizing with the outside world, not for events; flag misuse.
+- Flag $effect without cleanup of subscriptions and timers.
+- Bindable props must be declared; flag mutating props directly.
+
+## Rendering
+- {#each} keys must be stable ids, not index, on reorderable lists.
+- Flag store subscriptions that should be $derived, and vice versa.
+- Flag reactivity broken by replacing fields of non-reactive objects.
+
+## SSR and boundaries
+- Guard browser-only APIs (window, localStorage) in SSR contexts.
+- Validate data at the load/network layer; components render, they do not fetch-validate.
+`),
+    preset("angular", "Angular", "Signals, dependency injection and RxJS", `
+## Components and signals
+- Use signals (signal/computed/effect) for template state; flag plain mutable fields.
+- OnPush by default: flag in-place array mutations that skip change detection.
+- effect() is for side effects, not dataflow; flag signal chains hidden in effects.
+
+## Templates and DI
+- Prefer inject() over constructor injection; flag services instantiated in components.
+- Flag logic in templates that belongs in the component class.
+- Flag field injection and mutable service state in request-scoped code.
+
+## RxJS
+- Flag subscriptions without takeUntilDestroyed or async pipe management.
+- Prefer switchMap for dependent requests; flag nested subscribe calls.
+- Share expensive streams with shareReplay when many consumers subscribe.
+`),
+    preset("typescript", "TypeScript", "Strict type safety across any runtime", `
+## Type safety
+- Flag \`as any\`, \`@ts-ignore\` without an explanation and implicit any at boundaries.
+- Prefer discriminated unions over boolean-flag combinations.
+- Flag non-null \`!\` on values that can genuinely be null/undefined at runtime.
+- Switch over unions must be exhaustive or safely defaulted.
+
+## Boundaries
+- Validate external data (API, env, files) with a schema before use; distrust unknown.
+- Prefer \`readonly\` and \`as const\` for data that must not change.
+- Flag platform types leaking from untyped interop without explicit narrowing.
+
+## Runtime hygiene
+- Flag \`==\` where \`===\` is meant and truthiness checks where 0 or "" are valid.
+- async functions must propagate errors; flag swallowed promise rejections.
+- Catch clauses narrow \`unknown\` before use; flag \`catch (e: any)\`.
+`),
+    preset("python", "Python", "Python 3.10+ services, scripts and libraries", `
+## Typing and contracts
+- Public functions carry type hints; flag untyped boundaries of modules.
+- Prefer dataclasses or pydantic models over dicts for structured data.
+- Flag bare except and except Exception without re-raise or log; never swallow KeyboardInterrupt.
+
+## Correctness
+- Use context managers for files, sockets, locks and DB transactions.
+- Flag mutable default arguments (\`def f(x=[])\`).
+- Prefer pathlib over string path concatenation.
+- Flag f-string SQL and subprocess calls built from untrusted input; use parameters.
+
+## Style
+- Prefer comprehensions and early returns over nested loops and flags.
+- Flag wildcard imports and unused imports left in the diff.
+- Enums and constants instead of magic strings repeated across files.
+`),
+    preset("go", "Go", "Go services and CLIs", `
+## Errors
+- Always check returned errors; flag \`_\` assignments of err.
+- Wrap with context: fmt.Errorf("doing x: %w", err); never lose the chain.
+- Do not log and return the same error; pick one per call path.
+
+## Concurrency
+- Every goroutine must have a termination path; flag leaks in loops and handlers.
+- Flag unreleased mutexes, tickers and contexts without defer cancel.
+- Channels: know who closes; flag close from the receiver side.
+- Respect context.Context: pass it down, abort on ctx.Done().
+
+## Correctness
+- Flag range-loop variable capture in goroutines and closures.
+- Defer close on every resource acquired (files, rows, response bodies).
+- Flag ignored return values of fmt.Fprintf-style writers where errors matter.
+- Keep structs narrow; flag exported fields that leak internal state.
+`),
+    preset("rust", "Rust", "Ownership, Result handling and unsafe discipline", `
+## Ownership and errors
+- Use Result/Option instead of unwrap/expect outside tests; invariants need a comment.
+- Prefer \`?\` propagation; flag match arms that swallow Err silently.
+- Flag clones that hide move problems where borrows suffice.
+
+## Safety
+- unsafe blocks must carry a safety comment explaining the invariants upheld.
+- Flag manual pointer arithmetic and transmute in ordinary code.
+- Prefer iterators over index loops; flag slice indexing with computed offsets.
+
+## API
+- Public APIs document panic paths; flag unwrap/index/slice panics in library code.
+- Public error types implement std::error::Error; flag String errors at API boundaries.
+- Flag obvious clippy-level lints introduced by the diff.
+`),
+    preset("java", "Java", "Services on modern Java and Spring", `
+## Errors
+- Exceptions carry context; flag catch blocks that swallow, log-and-continue, or return null.
+- Use Optional over null returns; flag get() without isPresent/orElse guards.
+- Flag catch (Exception/Throwable) without a documented re-throw intent.
+
+## Concurrency
+- Shared mutable state needs synchronization; flag racy fields in request-scoped services.
+- Use try-with-resources for everything AutoCloseable (streams, connections).
+- CompletableFuture chains must handle failures (exceptionally/handle).
+
+## API and data
+- Validate at boundaries; flag unvalidated request params reaching queries.
+- Flag collect-to-list-then-loop where a single stream pipeline suffices.
+- Prefer constructor injection; flag mutable statics and field injection.
+`),
+    preset("kotlin", "Kotlin", "Idiomatic Kotlin, coroutines and Android", `
+## Null safety
+- Flag \`!!\` on values that can be null at runtime; prefer safe calls and early returns.
+- Java interop boundaries handle platform types explicitly.
+- Flag late-initialized state that could be plain nullable or lazy.
+
+## Coroutines
+- Structured concurrency: launch in scopes that get cancelled (viewModelScope, lifecycle).
+- Every launch/async handles errors; flag fire-and-forget coroutines.
+- Flag GlobalScope and runBlocking on production paths; prefer suspend functions.
+- Cancellation must be cooperative: flag CPU loops without isActive/ensureActive checks.
+
+## Idiomatic
+- Prefer val, data classes, sealed hierarchies and expression bodies.
+- Flag Java-style Kotlin: StringBuilder chains, manual getters, platform types leaking.
+`),
+    preset("csharp", "C# / .NET", "async/await discipline and resource safety", `
+## Async
+- Flag .Result/.Wait() on tasks: deadlock risk; async all the way.
+- Flag async void outside event handlers and fire-and-forget without error handling.
+- CancellationToken must flow through every async call chain.
+
+## Resources
+- IDisposable needs using/await using; flag undisposed contexts and connections.
+- Flag event subscriptions and closures that capture this longer than its lifetime.
+
+## API and types
+- Nullable reference types stay on; flag null-forgiving \`!\` where null is possible.
+- Validate at boundaries; flag unvalidated input reaching EF/SQL queries.
+- Flag double enumeration of IEnumerable; materialize when reused.
+`),
+    preset("swift", "Swift", "Optionals, structured concurrency and UI state", `
+## Optionals and errors
+- Force unwrap only with an invariant comment; prefer guard let and nil-coalescing.
+- Flag try? that swallows errors silently; handle or propagate instead.
+
+## Concurrency
+- Flag mutable shared state crossing concurrency domains; use actors or isolation.
+- Prefer async/await over manual queues and locks.
+- Long-lived closures and delegates capture [weak self]; flag retain cycles.
+
+## UI and data
+- UI state mutates on the main actor; flag background-context updates.
+- Prefer Codable models over dictionaries; validate decoded external data.
+`),
+    preset("php", "PHP", "PHP 8+ services and Laravel", `
+## Types and errors
+- Declare strict_types; flag missing parameter/return types on public functions.
+- Flag catch blocks that swallow; rethrow or log with context.
+
+## Security
+- SQL through prepared statements only; flag string-interpolated queries.
+- Flag raw $_GET/$_POST/$_SERVER reaching queries or HTML; validate and escape by context.
+- Flag unserialize on user input and any eval usage.
+
+## Laravel
+- N+1: flag relation loops without eager loading.
+- Validate via FormRequest; flag mass assignment without \$fillable.
+- Migrations safe for production: chunk big tables, avoid destructive one-step DDL.
+`),
+    preset("ruby", "Ruby / Rails", "Rails services, queries and migrations", `
+## Errors
+- Never rescue Exception; flag rescue without an error class.
+- Flag swallowed errors; raise specific errors with context over nil returns.
+
+## Rails
+- Strong params on every controller; flag params[:x] used raw.
+- N+1: flag association loops without includes/preload; prefer batch finders.
+- Migrations safe for production: flag renames/removals without a two-step plan.
+
+## Idiomatic
+- Prefer each/map over for loops; early returns over nested conditionals.
+- Do not mutate frozen constants; keep structured logging free of secrets.
+`),
+    preset("flutter", "Flutter / Dart", "Widget trees, state and rendering rules", `
+## Widgets and state
+- Mark constructors const where possible; keep build() pure and cheap.
+- Dispose controllers and streams; flag subscriptions without cancel.
+- Never use BuildContext across async gaps; check mounted after await.
+- setState for local repaints only; prefer ValueNotifier or state packages above the widget.
+- Theme and MediaQuery over hardcoded colors, paddings and text styles.
+
+## Lists and layout
+- ListView.builder for long lists; flag shrinkWrap inside scrollables.
+- Stable keys on dynamic children; const keys where identity suffices.
+- Hero and animations need bounded constraints; flag unbounded Row/Column flex errors.
+
+## Data and platform
+- JSON via typed fromJson/toJson; flag raw Map<String, dynamic> access.
+- Channels and plugins validated on both sides; flag untyped platform calls.
+- Async errors observed: FutureBuilder error paths and runZonedGuarded zones.
+`),
+    preset("elixir", "Elixir / Erlang", "BEAM concurrency and OTP rules", `
+## Processes and OTP
+- GenServer callbacks stay fast; no blocking work in handle_call.
+- Every process has a supervisor; flag spawn/spawn_link without a restart strategy.
+- Task.async needs Task.await with a timeout; flag fire-and-forget tasks on user paths.
+- Trap exits only with a reason; flag catch-all handle_info that swallows messages.
+
+## Correctness
+- Pattern match instead of nil checks; flag case clauses that mimic if-chains.
+- with/else for happy-path pipelines; every else branch handles a real error.
+- Recursion and Enum over manual loops; flag Enum into Map.put (O(n^2) growth).
+- Changesets validate and constrain: flag cast without validate_required or unique_constraint.
+
+## Safety
+- Repo queries parameterized; flag fragment with interpolated user input.
+- No atom creation from user input; strings over atoms at boundaries.
+- Timeouts on external calls; flag GenServer calls to remote nodes without one.
+`),
+    preset("zig", "Zig", "Explicit memory and safety rules", `
+## Memory
+- Every allocation pairs with a free or defer; flag alloc without a visible owner.
+- defer matches acquisition order; errdefer for cleanup before an error return.
+- Allocations return errors: handle OutOfMemory instead of assuming success.
+- No use-after-free: flag returning pointers into stack frames or freed slices.
+- Initialize memory explicitly; flag reads of undefined or padding values.
+
+## Correctness
+- Slices carry bounds; flag pointer arithmetic where slice indexing works.
+- @intCast and @truncate need range justification; flag unchecked narrowing.
+- Prefer tagged unions and exhaustive switch; flag reachable unreachable.
+- Comptime for constants and generics; flag runtime values that should be comptime.
+
+## Idiomatic
+- Errors via error sets with try propagation; flag catch |_| that discards cause.
+- Testing with zig test blocks beside the code; edge cases for boundary math.
+`),
+    preset("scala", "Scala", "Type-safe functional rules", `
+## Types and options
+- Option instead of null; flag .get, .head on Option and isDefined+get pairs.
+- Prefer fold/map/foreach chains over match scaffolding on simple shapes.
+- Either for fallible paths; flag exceptions used as local control flow.
+- Discriminated sealed traits with exhaustive match; flag catch-all cases that hide new variants.
+
+## Concurrency
+- Futures compose with for-comprehensions; block only at the edge.
+- Flag Await.result without timeout on request paths.
+- Side effects in ZIO/Cats Effect kept at the boundary; pure core logic.
+- Structured lifetimes for Akka actors; flag tell to stopped or unwatched actors.
+
+## Idiomatic
+- Givens/implicits with explicit types; flag inferred context params on public APIs.
+- Immutable case classes and copy over var fields.
+- Lazy structures (view, LazyList) when sizes are large; flag eager map on big collections.
+- No wildcard imports; unused imports removed; values over unit-returning expressions.
+`),
+    preset("security", "Security", "Cross-stack hardening rules, combine with a stack preset", `
+## Injection
+- Parameterized queries only; flag string-built SQL and ORM filters from user input.
+- Shell calls take argument arrays, never interpolated strings; flag unsanitized paths.
+- Escape output by context: HTML, attributes, URLs, SQL, shell.
+
+## Auth and crypto
+- Flag mutations missing an auth check and IDOR (ownership) risks on id-addressed data.
+- Compare secrets with constant-time APIs; never log tokens or password fields.
+- Crypto via vetted libraries; flag hand-rolled hashing or encoding labeled as crypto.
+- New dependencies get a provenance check: right repo, no typosquats, lockfile pinned.
+
+## Data exposure
+- Flag secrets in code, config, logs, errors, client bundles and test fixtures.
+- Validate size and content of uploads; flag user input reaching eval or exec.
+`),
+    preset("devops", "DevOps", "Dockerfiles, CI workflows and infrastructure", `
+## Dockerfiles
+- Pin base images to digests or minor versions; flag :latest.
+- Multi-stage builds; flag toolchains shipped in runtime images.
+- Non-root USER, minimal EXPOSE, no secrets in ENV or layers.
+- .dockerignore excludes .git, dependencies and local env files.
+
+## CI workflows
+- Pin actions to commit SHAs; flag floating tags on security-relevant steps.
+- Least-privilege tokens (permissions:); flag secret leaks to forks or logs.
+- Flag secrets echoed to logs or passed into untrusted scripts.
+
+## Infrastructure
+- Terraform/Kubernetes: flag resources without explicit limits and security contexts.
+- Destructive steps (delete, force-push) need an explicit guard or manual gate.
+`),
+];
+export function presetIds() {
+    return PRESETS.map((preset) => preset.id);
+}
+export function getPreset(id) {
+    return PRESETS.find((preset) => preset.id === id);
+}
+const PRESET_SEPARATOR = "\n---\n\n";
+/**
+ * Combines several presets into one rules document for comma-separated
+ * `--preset a,b`. The common header appears once; bodies are joined with
+ * horizontal rules so each stack keeps its own section.
+ */
+export function combinePresets(items) {
+    const bodies = items.map((item) => item.rules.slice(COMMON_HEAD.length));
+    return `${COMMON_HEAD}${bodies.join(PRESET_SEPARATOR)}`;
+}
+//# sourceMappingURL=presets.js.map

package/dist/core/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/core/presets.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,GAAG;;;;;CAKnB,CAAC;AAEF,SAAS,MAAM,CAAC,EAAU,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY;IAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAiB;IACnC,MAAM,CACJ,MAAM,EACN,MAAM,EACN,yCAAyC,EACzC;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,MAAM,EACN,sBAAsB,EACtB,qDAAqD,EACrD;;;;;;;;;;;;;;;;;CAiBH,CACE;IACD,MAAM,CACJ,OAAO,EACP,OAAO,EACP,kDAAkD,EAClD;;;;;;;;;;;;;;;;;CAiBH,CACE;IACD,MAAM,CACJ,MAAM,EACN,SAAS,EACT,2DAA2D,EAC3D;;;;;;;;;;;;;;;;CAgBH,CACE;IACD,MAAM,CACJ,KAAK,EACL,KAAK,EACL,iDAAiD,EACjD;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,QAAQ,EACR,QAAQ,EACR,gCAAgC,EAChC;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,SAAS,EACT,SAAS,EACT,wCAAwC,EACxC;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,YAAY,EACZ,YAAY,EACZ,uCAAuC,EACvC;;;;;;;;;;;;;;;;CAgBH,CACE;IACD,MAAM,CACJ,QAAQ,EACR,QAAQ,EACR,8CAA8C,EAC9C;;;;;;;;;;;;;;;;CAgBH,CACE;IACD,MAAM,CACJ,IAAI,EACJ,IAAI,EACJ,sBAAsB,EACtB;;;;;;;;;;;;;;;;;CAiBH,CACE;IACD,MAAM,CACJ,MAAM,EACN,MAAM,EACN,kDAAkD,EAClD;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,MAAM,EACN,MAAM,EACN,oCAAoC,EACpC;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,QAAQ,EACR,QAAQ,EACR,0CAA0C,EAC1C;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,QAAQ,EACR,WAAW,EACX,4CAA4C,EAC5C;;;;;;;;;;;;;;CAcH,CACE;IACD,MAAM,CACJ,OAAO,EACP,OAAO,EACP,gDAAgD,EAChD;;;;;;;;;;;;;CAaH,CACE;IACD,MAAM,CACJ,KAAK,EACL,KAAK,EACL,6BAA6B,EAC7B;;;;;;;;;;;;;;CAcH,CACE;IACD,MAAM,CACJ,MAAM,EACN,cAAc,EACd,wCAAwC,EACxC;;;;;;;;;;;;;CAaH,CACE;IACD,MAAM,CACJ,SAAS,EACT,gBAAgB,EAChB,yCAAyC,EACzC;;;;;;;;;;;;;;;;;CAiBH,CACE;IACD,MAAM,CACJ,QAAQ,EACR,iBAAiB,EACjB,gCAAgC,EAChC;;;;;;;;;;;;;;;;;CAiBH,CACE;IACD,MAAM,CACJ,KAAK,EACL,KAAK,EACL,kCAAkC,EAClC;;;;;;;;;;;;;;;;;CAiBH,CACE;IACD,MAAM,CACJ,OAAO,EACP,OAAO,EACP,4BAA4B,EAC5B;;;;;;;;;;;;;;;;;;CAkBH,CACE;IACD,MAAM,CACJ,UAAU,EACV,UAAU,EACV,0DAA0D,EAC1D;;;;;;;;;;;;;;;CAeH,CACE;IACD,MAAM,CACJ,QAAQ,EACR,QAAQ,EACR,8CAA8C,EAC9C;;;;;;;;;;;;;;;CAeH,CACE;CACF,CAAC;AAEF,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/core/presets.test.js

@@ -0,0 +1,79 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { combinePresets, getPreset, presetIds, PRESETS } from "./presets.js";
+test("all presets are registered with stable ids", () => {
+    assert.deepEqual(presetIds(), [
+        "base",
+        "node",
+        "react",
+        "next",
+        "vue",
+        "svelte",
+        "angular",
+        "typescript",
+        "python",
+        "go",
+        "rust",
+        "java",
+        "kotlin",
+        "csharp",
+        "swift",
+        "php",
+        "ruby",
+        "flutter",
+        "elixir",
+        "zig",
+        "scala",
+        "security",
+        "devops",
+    ]);
+});
+test("every preset ships non-empty markdown rules", () => {
+    for (const preset of PRESETS) {
+        assert.ok(preset.rules.length > 200, `${preset.id} rules look too short`);
+        assert.ok(preset.rules.startsWith("# Project review rules"), `${preset.id} must start with the common header`);
+        assert.ok(preset.description.length > 0, `${preset.id} needs a description`);
+    }
+});
+test("presets carry stack-specific guidance", () => {
+    const markers = {
+        base: "race conditions",
+        node: "floating promises",
+        react: "## Hooks",
+        next: "use client",
+        vue: "## Composition API",
+        svelte: "$derived",
+        angular: "takeUntilDestroyed",
+        typescript: "discriminated unions",
+        python: "dataclasses",
+        go: "%w",
+        rust: "unsafe",
+        java: "try-with-resources",
+        kotlin: "GlobalScope",
+        csharp: "async void",
+        swift: "retain cycles",
+        php: "strict_types",
+        ruby: "Strong params",
+        flutter: "BuildContext",
+        elixir: "GenServer",
+        zig: "defer",
+        scala: "Option",
+        security: "constant-time",
+        devops: ":latest",
+    };
+    for (const [id, marker] of Object.entries(markers)) {
+        assert.ok(getPreset(id).rules.includes(marker), `${id} must mention "${marker}"`);
+    }
+});
+test("getPreset returns undefined for unknown ids", () => {
+    assert.equal(getPreset("cobol"), undefined);
+});
+test("combinePresets merges bodies under a single header", () => {
+    const combined = combinePresets([getPreset("react"), getPreset("security")]);
+    assert.equal(combined.split("# Project review rules").length - 1, 1);
+    assert.ok(combined.includes("## Hooks"));
+    assert.ok(combined.includes("constant-time"));
+    assert.ok(combined.includes("\n---\n"));
+    assert.ok(combined.endsWith("\n"));
+});
+//# sourceMappingURL=presets.test.js.map

package/dist/core/presets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.test.js","sourceRoot":"","sources":["../../src/core/presets.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7E,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;IACtD,MAAM,CAAC,SAAS,CACd,SAAS,EAAE,EACX;QACE,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,KAAK;QACL,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,QAAQ;QACR,IAAI;QACJ,MAAM;QACN,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,KAAK;QACL,MAAM;QACN,SAAS;QACT,QAAQ;QACR,KAAK;QACL,OAAO;QACP,UAAU;QACV,QAAQ;KACT,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC1E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAC/G,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,MAAM,OAAO,GAA2B;QACtC,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,oBAAoB;QACzB,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,sBAAsB;QAClC,MAAM,EAAE,aAAa;QACrB,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,eAAe;QACtB,GAAG,EAAE,cAAc;QACnB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,SAAS;KAClB,CAAC;IACF,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,kBAAkB,MAAM,GAAG,CAAC,CAAC;IACrF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,SAAS,CAAC,OAAO,CAAE,EAAE,SAAS,CAAC,UAAU,CAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC"}

package/dist/core/prompt.golden.test.js

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { buildInput, buildPrompt, SYSTEM_PROMPT_EN } from "./prompt.js";
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const GOLDEN = join(ROOT, "test", "golden");
+const UPDATE = process.env.OC_PILOT_UPDATE_GOLDEN === "1";
+const DIFF = [
+    "diff --git a/wallet.go b/wallet.go",
+    "@@ -10,3 +10,4 @@ func DeductBalance(u *User, amount int) {",
+    "-\tu.Balance -= amount",
+    "+\tu.Balance -= amount",
+    "+\tlog.Info(\"deduct\", amount)",
+    " }",
+].join("\n");
+const BASE = {
+    recipe: "review",
+    projectType: "Go",
+    additionalContext: "type User struct { ID string; Balance int }",
+    diff: DIFF,
+};
+/**
+ * The prompt is the CLI contract with every model: section order, empty-value
+ * handling and secret redaction must only change on purpose. These snapshots
+ * pin the input half of the prompt; the system half is checked against
+ * prompts/*.md by prompt.test.ts.
+ */
+const CASES = [
+    { name: "input-review-en.txt", input: { ...BASE, lang: "en", repoContext: true } },
+    { name: "input-review-ru.txt", input: { ...BASE, lang: "ru", repoContext: false } },
+    {
+        name: "input-review-secrets.txt",
+        input: {
+            ...BASE,
+            findings: [
+                {
+                    file: "wallet.go",
+                    line: 4,
+                    kind: "OpenAI API key",
+                    severity: "critical",
+                    preview: "sk-p…AAAA",
+                },
+            ],
+        },
+    },
+    {
+        name: "input-empty-commit.txt",
+        input: { recipe: "commit", projectType: "Go", additionalContext: "", diff: "" },
+    },
+];
+for (const item of CASES) {
+    test(`golden ${item.name} matches the built input`, () => {
+        const path = join(GOLDEN, item.name);
+        const actual = `${buildInput(item.input)}\n`;
+        if (UPDATE) {
+            mkdirSync(GOLDEN, { recursive: true });
+            writeFileSync(path, actual, "utf8");
+            return;
+        }
+        assert.ok(existsSync(path), `${item.name} is missing; run OC_PILOT_UPDATE_GOLDEN=1 npm test`);
+        const expected = readFileSync(path, "utf8").replace(/\r\n/g, "\n");
+        assert.equal(actual, expected, `${item.name} drifted; regenerate with OC_PILOT_UPDATE_GOLDEN=1 when the change is intended`);
+    });
+}
+test("every recipe reaches the model with its own RECIPE line", () => {
+    for (const recipe of ["review", "test-fix", "docgen", "custom", "commit"]) {
+        const text = buildPrompt({ ...BASE, recipe });
+        assert.ok(text.includes(`RECIPE: ${recipe}\n`), `${recipe} is not named in the input`);
+        assert.ok(text.startsWith(SYSTEM_PROMPT_EN), `${recipe} lost the system prompt`);
+    }
+});
+//# sourceMappingURL=prompt.golden.test.js.map

package/dist/core/prompt.golden.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.golden.test.js","sourceRoot":"","sources":["../../src/core/prompt.golden.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG,CAAC;AAE1D,MAAM,IAAI,GAAG;IACX,oCAAoC;IACpC,6DAA6D;IAC7D,wBAAwB;IACxB,wBAAwB;IACxB,iCAAiC;IACjC,IAAI;CACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,IAAI,GAAgB;IACxB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,6CAA6C;IAChE,IAAI,EAAE,IAAI;CACX,CAAC;AAEF;;;;;GAKG;AACH,MAAM,KAAK,GAAgD;IACzD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;IAClF,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;IACnF;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE;YACL,GAAG,IAAI;YACP,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,gBAAgB;oBACtB,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,WAAW;iBACrB;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;KAChF;CACF,CAAC;AAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,0BAA0B,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAE7C,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,oDAAoD,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CACV,MAAM,EACN,QAAQ,EACR,GAAG,IAAI,CAAC,IAAI,gFAAgF,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,MAAM,IAAI,CAAC,EAAE,GAAG,MAAM,4BAA4B,CAAC,CAAC;QACvF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,yBAAyB,CAAC,CAAC;IACnF,CAAC;AACH,CAAC,CAAC,CAAC"}