octocode-cli 1.5.1 → 1.5.3

package/skills/octocode-engineer/src/ast/search.ts

@@ -1,11 +1,5 @@
 #!/usr/bin/env node
-/**
- * Entry point for `scripts/ast/search.js`. Verifies the @ast-grep native
- * addons and other runtime deps are installed before loading the main
- * search logic. If missing, the bootstrap detects the user's package
- * manager and installs into the skill directory, or prints an actionable
- * manual command.
- */
+
 import { ensureNativeDependencies } from '../common/ensure-deps.js';
 
 ensureNativeDependencies(import.meta.url, { tag: '[octocode-ast-search]' });

package/skills/octocode-engineer/src/ast/tree-sitter.test.ts

@@ -405,10 +405,10 @@ function f() {
 
     it('computes cognitiveComplexity > 0 for nested control flow', () => {
       const code = `function complexFn(x: number, y: boolean) {
-  if (x > 0) {           // +1
-    if (y) {              // +2 (1 + nesting=1)
-      for (let i = 0; i < x; i++) {  // +3 (1 + nesting=2)
-        if (i % 2 === 0) {           // +4 (1 + nesting=3)
+  if (x > 0) {
+    if (y) {
+      for (let i = 0; i < x; i++) {
+        if (i % 2 === 0) {
           console.log(i);
         }
       }

package/skills/octocode-engineer/src/ast/tree-sitter.ts

@@ -473,8 +473,8 @@ export async function resolveTreeSitter(): Promise<TreeSitterRuntime> {
         parserPy.setLanguage(pyLang as Parameters<Parser['setLanguage']>[0]);
       }
     } catch {
-      // tree-sitter-python not installed — Python analysis via tree-sitter disabled
-    }
+    void 0;
+  }
 
     treeSitterRuntime = {
       available: true,

package/skills/octocode-engineer/src/collectors/chains.ts

@@ -4,15 +4,10 @@ import { getLineAndCharacter } from '../common/utils.js';
 
 import type { FileEntry, MessageChainEntry } from '../types/index.js';
 
-/** Minimum property-access depth to flag as a message chain (Law of Demeter). */
+
 const MIN_CHAIN_DEPTH = 4;
 
-/**
- * Walk a property-access or element-access expression to its root and return
- * the full chain text and depth (number of dot-steps).
- *
- * Handles: a.b.c.d    a?.b?.c?.d    a['b']['c']['d']
- */
+
 function measureChain(node: ts.Node, sourceFile: ts.SourceFile): { text: string; depth: number } | null {
   let depth = 0;
   let current: ts.Node = node;
@@ -27,14 +22,12 @@ function measureChain(node: ts.Node, sourceFile: ts.SourceFile): { text: string;
 
   if (depth < MIN_CHAIN_DEPTH) return null;
 
-  // Avoid reporting intermediate nodes — only report the outermost chain.
-  // (The outermost node is the one whose parent is NOT itself a property/element access)
   const parent = node.parent;
   if (
     ts.isPropertyAccessExpression(parent) ||
     ts.isElementAccessExpression(parent)
   ) {
-    return null; // This is an intermediate node; the outermost will be visited.
+    return null;
   }
 
   return { text: node.getText(sourceFile), depth };

package/skills/octocode-engineer/src/collectors/prototype-pollution.ts

@@ -16,7 +16,7 @@ const DEEP_MERGE_NAMES = new Set([
   'mixin',
 ]);
 
-/** Check if a computed-property-write key comes from a for..of/for..in loop over known internal iteration */
+
 function isKeyFromInternalIteration(
   node: ts.ElementAccessExpression,
   sourceFile: ts.SourceFile
@@ -49,7 +49,7 @@ function isKeyFromInternalIteration(
   return false;
 }
 
-/** Check if the containing block has a __proto__/constructor/prototype key guard */
+
 function hasProtoKeyGuard(node: ts.Node, sourceFile: ts.SourceFile): boolean {
   const block = findParentBlock(node);
   if (!block) return false;
@@ -63,7 +63,7 @@ function hasProtoKeyGuard(node: ts.Node, sourceFile: ts.SourceFile): boolean {
   );
 }
 
-/** Check if the target object was created with Object.create(null) or is Map/Set */
+
 function isTargetSafeObject(
   node: ts.ElementAccessExpression,
   sourceFile: ts.SourceFile

package/skills/octocode-engineer/src/collectors/security.ts

@@ -50,9 +50,9 @@ const SECRET_PATTERNS = [
 const SQL_KEYWORDS =
   /\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE)\b/i;
 
-/** Strings that look like placeholders, not real secrets */
+
 const PLACEHOLDER_PATTERN = /^(YOUR_|REPLACE_ME|<[a-z_-]+>|\$\{|{{)/i;
-/** UUID pattern: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx */
+
 const UUID_PATTERN =
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
@@ -74,7 +74,7 @@ function isPlaceholderOrUuid(value: string): boolean {
   return PLACEHOLDER_PATTERN.test(value) || UUID_PATTERN.test(value);
 }
 
-/** Skip strings inside finding metadata fields (suggestedFix, reason, impact, etc.) */
+
 const METADATA_PROP_NAMES = new Set([
   'suggestedFix',
   'strategy',

package/skills/octocode-engineer/src/common/ensure-deps.ts

@@ -1,13 +1,3 @@
-/**
- * Ensures native and pure-JS dependencies required at runtime are installed.
- *
- * The skill's bundle cannot inline native addons (@ast-grep/napi, tree-sitter
- * variants) — they must exist in the skill's node_modules at runtime. When the
- * skill ships standalone (outside the monorepo's hoisted node_modules), the
- * first run needs to install them. This module detects the user's package
- * manager from lockfiles, runs install against the skill directory, and exits
- * with an actionable message if install fails.
- */
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -75,7 +65,6 @@ function planInstall(skillDir: string): InstallPlan {
 }
 
 function findSkillDir(entryUrl: string): string {
-  // Walk up from the entry file until we find a package.json — that's the skill root.
   let dir = dirname(fileURLToPath(entryUrl));
   for (let i = 0; i < MAX_SKILL_DIR_HOPS; i++) {
     if (existsSync(join(dir, 'package.json'))) return dir;
@@ -83,7 +72,6 @@ function findSkillDir(entryUrl: string): string {
     if (parent === dir) break;
     dir = parent;
   }
-  // Fallback: assume scripts/<file>.js → skill root is one level up.
   return dirname(dirname(fileURLToPath(entryUrl)));
 }
 
@@ -102,18 +90,13 @@ function missingPackagesFrom(skillDir: string, entryUrl: string): string[] {
 }
 
 export interface EnsureDepsOptions {
-  /** If false, print instructions and exit; do not run the installer. */
+  
   autoInstall?: boolean;
-  /** Log prefix for user-facing messages. */
+  
   tag?: string;
 }
 
-/**
- * Verify the skill's runtime dependencies are resolvable. If not:
- *   - Detect the user's package manager from the skill directory's lockfile.
- *   - If autoInstall is true (default), run the installer in the skill dir.
- *   - Otherwise, print the exact command for the user and exit 1.
- */
+
 export function ensureNativeDependencies(
   entryUrl: string,
   options: EnsureDepsOptions = {},

package/skills/octocode-engineer/src/detectors/code-quality.ts

@@ -921,7 +921,6 @@ export function detectMessageChains(fileSummaries: FileEntry[]): FindingDraft[]
   const findings: FindingDraft[] = [];
   for (const entry of fileSummaries) {
     if (!entry.messageChains || entry.messageChains.length === 0) continue;
-    // Group by line start — take the deepest chain at each location
     const byLine = new Map<number, typeof entry.messageChains[0]>();
     for (const chain of entry.messageChains) {
       const existing = byLine.get(chain.lineStart);

package/skills/octocode-engineer/src/index.test.ts

@@ -1234,7 +1234,7 @@ describe('diversifyFindings', () => {
 
   it('returns all findings when limit >= length', () => {
     const input = [makeDraft('high', 'a', 1), makeDraft('high', 'b', 1)];
-    expect(diversifyFindings(input, 10)).toBe(input); // same reference
+    expect(diversifyFindings(input, 10)).toBe(input);
     expect(diversifyFindings(input, 2)).toBe(input);
   });
 

package/skills/octocode-engineer/src/index.ts

@@ -433,17 +433,7 @@ export function assignFindingIds(
   return { findings, byFile };
 }
 
-/**
- * Programmatic scan API — the equivalent of dependency-cruiser's `cruise()`
- * or madge's constructor. Runs the full analysis pipeline without CLI I/O.
- *
- * Usage:
- * ```ts
- * import { scan, DEFAULT_OPTS } from './index.js';
- * const result = await scan({ root: '/path/to/project', graph: true });
- * console.log(result.exitCode); // 0=clean, 1=findings, 2=error
- * ```
- */
+
 export async function scan(
   overrides: Partial<AnalysisOptions> = {}
 ): Promise<ScanResult> {

package/skills/octocode-engineer/src/pipeline/affected.ts

@@ -6,10 +6,7 @@ import { ALLOWED_EXTS } from '../types/index.js';
 
 import type { DependencyState } from '../types/index.js';
 
-/**
- * Resolves --affected: git changed files + transitive dependents.
- * Inspired by dependency-cruiser's --affected (uses watskeburt internally).
- */
+
 export function resolveAffectedFiles(
   root: string,
   revision: string,
@@ -45,9 +42,7 @@ function getGitChangedFiles(root: string, revision: string): string[] {
   }
 }
 
-/**
- * BFS: walk incoming edges to collect all transitive dependents of changed files.
- */
+
 function collectTransitiveDependents(
   seeds: Set<string>,
   state: DependencyState,

package/skills/octocode-engineer/src/pipeline/baseline.ts

@@ -9,10 +9,7 @@ export interface BaselineEntry {
   title: string;
 }
 
-/**
- * Saves current findings as a baseline for future --ignore-known runs.
- * Inspired by dependency-cruiser's --ignore-known baseline file.
- */
+
 export function saveBaseline(
   root: string,
   findings: Finding[]
@@ -37,10 +34,7 @@ export function saveBaseline(
   return baselinePath;
 }
 
-/**
- * Loads a baseline file and filters out known findings.
- * Match key: (category, file) — title changes don't break the match.
- */
+
 export function filterKnownFindings<T extends Pick<Finding, 'category' | 'file'>>(
   findings: T[],
   baselinePath: string,

package/skills/octocode-engineer/src/pipeline/cache.ts

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
-export const ANALYSIS_SCHEMA_VERSION = '1.1.0'; // Keep in sync with REPORT_SCHEMA_VERSION in index.ts
+export const ANALYSIS_SCHEMA_VERSION = '1.1.0';
 
 interface CacheEntry {
   mtimeMs: number;
@@ -18,7 +18,7 @@ interface AnalysisCache {
 }
 
 const CACHE_VERSION = 1;
-const DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+const DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 
 export function loadCache(root: string): AnalysisCache | null {
   const cachePath = path.join(

package/skills/octocode-engineer/src/pipeline/config-loader.test.ts

@@ -167,9 +167,8 @@ describe('config-loader', () => {
       fs.writeFileSync(
         path.join(root, '.octocode-scan.json'),
         `{
-  // Enable graph
   "graph": true,
-  "flow": false // Not yet
+  "flow": false
 }`
       );
       const config = loadConfigFile(root, null);

package/skills/octocode-engineer/src/pipeline/config-loader.ts

@@ -7,11 +7,6 @@ type ConfigOverrides = Partial<Omit<AnalysisOptions, 'root' | 'packageRoot' | 'c
 
 const CONFIG_NAMES = ['.octocode-scan.json', '.octocode-scan.jsonc'];
 
-/**
- * Loads config from file, auto-discovered config, or package.json#octocode.
- * CLI flags always win over config file values.
- * Inspired by knip's .knip.json and eslint's flat config.
- */
 export function loadConfigFile(
   root: string,
   explicitPath: string | null
@@ -75,10 +70,6 @@ function normalizeConfig(obj: Record<string, unknown>): ConfigOverrides {
   return result as ConfigOverrides;
 }
 
-/**
- * Merges config file overrides into defaults, then CLI overrides on top.
- * CLI args that differ from defaults always win.
- */
 export function mergeConfigIntoDefaults(
   defaults: AnalysisOptions,
   config: ConfigOverrides,

package/skills/octocode-engineer/src/pipeline/create-options.ts

@@ -8,17 +8,7 @@ export interface CreateOptionsInput {
   args: AnalysisOptions;
 }
 
-/**
- * Transforms raw parsed CLI args into validated, normalized runtime options.
- * This is Layer 2 in the 3-layer CLI pattern (args → options → engine).
- *
- * Responsible for:
- * - Deriving computed fields (packageRoot)
- * - Auto-enabling flags based on feature selection (test-quality → includeTests)
- *
- * Inspired by knip's create-options.ts, eslint's translate-cli-options.js,
- * and dependency-cruiser's normalize-cli-options.mjs.
- */
+
 export function createOptions({ args }: CreateOptionsInput): AnalysisOptions {
   const opts = { ...args };
 
@@ -37,10 +27,7 @@ function autoEnableTestQuality(opts: AnalysisOptions): void {
   }
 }
 
-/**
- * Resolves `--exclude` into a features set by subtracting from ALL_CATEGORIES.
- * Called during CLI arg parsing when --exclude is used.
- */
+
 export function resolveExcludeToFeatures(
   excludeSet: Set<string>
 ): Set<string> {

package/skills/octocode-engineer/src/pipeline/reporters.ts

@@ -1,9 +1,5 @@
 import type { Finding, ReporterFormat } from '../types/index.js';
 
-/**
- * Formats findings for alternative output targets.
- * Inspired by eslint's --format flag and dependency-cruiser's reporter plugins.
- */
 
 export function formatFindings(
   findings: Finding[],
@@ -34,10 +30,7 @@ function severityToLevel(severity: string): string {
   }
 }
 
-/**
- * Compact: one-line per finding for terminal/CI logs.
- * Format: severity:file:line - [category] title
- */
+
 function formatCompact(findings: Finding[], root: string): string {
   return findings
     .map(f => {
@@ -48,10 +41,7 @@ function formatCompact(findings: Finding[], root: string): string {
     .join('\n');
 }
 
-/**
- * GitHub Actions: ::warning / ::error annotations.
- * These appear inline on PR diffs.
- */
+
 function formatGitHubActions(findings: Finding[], root: string): string {
   return findings
     .map(f => {

package/skills/octocode-engineer/src/reporting/summary-md.test.ts

@@ -173,13 +173,13 @@ describe('computeHealthScore', () => {
   it('penalizes medium findings (weight 3)', () => {
     const findings = [makeFinding({ severity: 'medium' })];
     const score = computeHealthScore(findings, 10);
-    expect(score).toBe(97); // 100 - (3/10)*10 = 97
+    expect(score).toBe(97);
   });
 
   it('penalizes low findings (weight 1)', () => {
     const findings = [makeFinding({ severity: 'low' })];
     const score = computeHealthScore(findings, 10);
-    expect(score).toBe(99); // 100 - (1/10)*10 = 99
+    expect(score).toBe(99);
   });
 
   it('info severity has weight 0', () => {

package/skills/octocode-engineer/src/run.ts

@@ -1,11 +1,5 @@
 #!/usr/bin/env node
-/**
- * Entry point for the octocode-engineer scanner. Verifies runtime
- * dependencies (native addons that cannot be bundled + the TypeScript
- * compiler) are installed before loading the pipeline. If missing, the
- * bootstrap detects the user's package manager from lockfiles and installs
- * into the skill's own node_modules, or prints an actionable manual command.
- */
+
 import { ensureNativeDependencies } from './common/ensure-deps.js';
 
 ensureNativeDependencies(import.meta.url, { tag: '[octocode-scan]' });

package/skills/octocode-engineer/src/types/constants.ts

@@ -6,7 +6,6 @@ import type { AnalysisOptions, Thresholds } from './core.js';
 import type { DependencyProfile } from './dependency.js';
 
 export const DEFAULT_THRESHOLDS: Thresholds = {
-  // Architecture
   couplingThreshold: 15,
   fanInThreshold: 20,
   fanOutThreshold: 15,
@@ -17,7 +16,6 @@ export const DEFAULT_THRESHOLDS: Thresholds = {
   sdpMaxSourceInstability: 0.6,
   layerOrder: [],
 
-  // Code quality
   minFunctionStatements: 6,
   minFlowStatements: 6,
   criticalComplexityThreshold: 30,
@@ -35,15 +33,12 @@ export const DEFAULT_THRESHOLDS: Thresholds = {
   magicStringMinOccurrences: 3,
   booleanParamThreshold: 3,
 
-  // Semantic
   overrideChainThreshold: 3,
   shotgunThreshold: 8,
 
-  // Security
   secretEntropyThreshold: 4.5,
   secretMinLength: 20,
 
-  // Test quality
   mockThreshold: 10,
 };
 

package/skills/octocode-engineer/src/types/core.ts

@@ -123,7 +123,6 @@ export interface ControlMapEntry extends FlowEntry {
 }
 
 export interface Thresholds {
-  // Architecture
   couplingThreshold: number;
   fanInThreshold: number;
   fanOutThreshold: number;
@@ -134,7 +133,6 @@ export interface Thresholds {
   sdpMaxSourceInstability: number;
   layerOrder: string[];
 
-  // Code quality
   minFunctionStatements: number;
   minFlowStatements: number;
   criticalComplexityThreshold: number;
@@ -152,15 +150,12 @@ export interface Thresholds {
   magicStringMinOccurrences: number;
   booleanParamThreshold: number;
 
-  // Semantic
   overrideChainThreshold: number;
   shotgunThreshold: number;
 
-  // Security
   secretEntropyThreshold: number;
   secretMinLength: number;
 
-  // Test quality
   mockThreshold: number;
 }
 

package/skills/octocode-news/eslint.config.mjs

@@ -5,12 +5,7 @@ import eslintPluginPrettierRecommended from "eslint-plugin-prettier/recommended"
 
 export default tseslint.config(
   {
-    ignores: ["node_modules/**", "scripts/**"]
-  },
-  js.configs.recommended,
-  ...tseslint.configs.recommended,
-  {
-    files: ["src/**/*.ts", "*.mjs"],
+    ignores: ["node_modules*.ts", "*.mjs"],
     languageOptions: {
       ecmaVersion: "latest",
       sourceType: "module",

package/skills/octocode-news/src/rss-core.ts

@@ -82,7 +82,6 @@ export function parseFeedCatalog(markdown) {
       pastSeparator = false;
     }
 
-    // Fenced-block parsing (legacy ### RSS Feeds format)
     if (/^### RSS Feeds/.test(trimmed)) {
       awaitingFence = true;
       insideFeedBlock = false;
@@ -107,7 +106,6 @@ export function parseFeedCatalog(markdown) {
       return;
     }
 
-    // Table parsing: extract from RSS column
     if (trimmed.startsWith("|")) {
       const cells = trimmed
         .replace(/^\|/, "")
@@ -326,8 +324,8 @@ export async function readResponseBody(response, maxBytes = 1024 * 1024) {
     try {
       await reader.cancel();
     } catch {
-      // Ignore cancellation errors once we have the bytes we need.
-    }
+    void 0;
+  }
   }
 
   text += decoder.decode();

package/skills/octocode-research/ecosystem.config.cjs

@@ -11,76 +11,45 @@
  * @see docs/SERVER_FLOWS.md for detailed flow documentation
  */
 
-// PM2 logs disabled - app handles all logging with rotation
 
 module.exports = {
   apps: [{
     name: 'octocode-research',
     script: './scripts/server.js',
     
-    // ============================================
-    // RESTART STRATEGIES
-    // ============================================
     
-    // ❌ REMOVED: cron_restart: '0 * * * *'
-    // Replaced by idle-based restart in server.ts (30 min idle → restart)
     
-    // ✅ Memory guard (PM2 safety net)
     max_memory_restart: '500M',
     
-    // ============================================
-    // GRACEFUL SHUTDOWN
-    // ============================================
     
-    // Allow 2 minutes for connection draining during shutdown
-    // This gives long-running requests time to complete
     kill_timeout: 120000,
     
-    // Wait for process.send('ready') before marking as online
     wait_ready: true,
     
-    // Timeout for ready signal (15s for MCP initialization)
     listen_timeout: 15000,
     
-    // ============================================
-    // RESTART BEHAVIOR
-    // ============================================
     
-    // Auto-restart on crash
     autorestart: true,
     
-    // Max consecutive restarts before stopping
     max_restarts: 10,
     
-    // Delay between restarts
     restart_delay: 1000,
     
-    // Exponential backoff on repeated crashes
     exp_backoff_restart_delay: 100,
     
-    // Minimum uptime to consider app started successfully
     min_uptime: 5000,
     
-    // ============================================
-    // LOGGING
-    // ============================================
     
-    // PM2 logs disabled - app handles logging in ~/.octocode/logs/
     out_file: '/dev/null',
     error_file: '/dev/null',
     merge_logs: true,
     combine_logs: true,
     
-    // ============================================
-    // ENVIRONMENT
-    // ============================================
     
-    // Node.js environment
     env: {
       NODE_ENV: 'production',
     },
     
-    // Development environment (pm2 start --env development)
     env_development: {
       NODE_ENV: 'development',
     },

package/skills/octocode-research/package.json

@@ -52,7 +52,7 @@
     "js-yaml": "^4.1.1",
     "octocode-mcp": "workspace:^",
     "octocode-shared": "workspace:^",
-    "zod": "^3.25.0"
+    "zod": "^4.0.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.27.0",