prodlint 0.10.2 → 0.10.3

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.10.2
+  prodlint v0.10.3
   Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts

package/action.yml

@@ -34,7 +34,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '22'
         # Automatic caching would key off the scanned repo's package.json; npx needs none.
@@ -58,7 +58,7 @@ runs:
 
         # The exact release this action ships with (scripts/sync-versions.cjs bumps it), so
         # pinning the action — @v1, a version tag or a commit SHA — also pins the scanner.
-        OUTPUT=$(npx -y prodlint@0.10.2 "${CMD_ARGS[@]}" 2>&1) || true
+        OUTPUT=$(npx -y prodlint@0.10.3 "${CMD_ARGS[@]}" 2>&1) || true
 
         SCORE=$(echo "$OUTPUT" | node -e "
           const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));

package/dist/cli.js

@@ -2487,15 +2487,16 @@ var deadExportsRule = {
 };
 
 // src/rules/shallow-catch.ts
-function scoreCatchBody(bodyLines) {
-  if (bodyLines.length === 0 || bodyLines.every((l) => l.trim() === "")) {
-    return { score: 0, label: "empty catch" };
-  }
-  const body = bodyLines.join("\n");
+function reportsError(value, param) {
+  if (/error/i.test(value) || /\berr|Err|status|Response|json/.test(value)) return true;
+  return param !== void 0 && new RegExp(`(?<![\\w$])${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(value);
+}
+function scoreCatchBody({ text: body, empty, returned, param }) {
+  if (empty) return { score: 0, label: "empty catch" };
   let score = 0;
   if (/console\.(log|warn|error|info)\s*\(/.test(body)) score = 1;
   if ((/console\.(error|warn)\s*\(/.test(body) || /\b(logger|log)\.(error|warn)\s*\(/.test(body)) && /\b(err|error|e)\b/.test(body)) score = 2;
-  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
+  if (/\bthrow\b/.test(body) || returned.some((value) => reportsError(value, param)) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
   /\btoast\.(error|warn|warning)\s*\(/.test(body) || /\btoast\s*\(\s*\{/.test(body) || // Error monitoring (Sentry, etc.)
   /\b(Sentry\.)?captureException\s*\(/.test(body) || /\b(Sentry\.)?captureMessage\s*\(/.test(body) || // Structured loggers
   /\b(logger|log)\.(error|fatal)\s*\(/.test(body) || // Error handler utilities
@@ -2505,13 +2506,56 @@ function scoreCatchBody(bodyLines) {
     score = 3;
   }
   const labels = {
-    0: "empty catch",
+    0: "catch swallows the error",
     1: "catch only logs (no recovery or propagation)",
     2: "catch logs error but does not propagate or recover",
     3: "catch handles error properly"
   };
   return { score, label: labels[score] };
 }
+function catchFinding(file, catchLine, body) {
+  const { score, label } = scoreCatchBody(body);
+  if (score > 1) return null;
+  return {
+    ruleId: "shallow-catch",
+    file: file.relativePath,
+    line: catchLine + 1,
+    column: file.lines[catchLine].indexOf("catch") + 1,
+    message: body.empty ? "Empty catch block \u2014 errors are silently swallowed" : score === 0 ? "Catch block swallows the error \u2014 it isn't logged, rethrown or returned" : `Decorative error handler: ${label}`,
+    severity: score === 0 ? "warning" : "info",
+    category: "reliability",
+    fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
+  };
+}
+var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
+function blankOut(source, strings) {
+  const blank = (s) => s.replace(/[^\n]/g, " ");
+  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
+}
+function closingBrace(code, open) {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === "{") depth++;
+    else if (code[i] === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+function returnedValues(code, text) {
+  const values = [];
+  for (const m of code.matchAll(/(?<![\w$.])return\b/g)) {
+    const start = m.index + "return".length;
+    let end = start;
+    for (let depth = 0; end < code.length; end++) {
+      const ch = code[end];
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") {
+        if (depth-- === 0) break;
+      } else if (depth === 0 && (ch === ";" || ch === "\n")) break;
+    }
+    values.push(text.slice(start, end));
+  }
+  return values;
+}
 var shallowCatchRule = {
   id: "shallow-catch",
   name: "Shallow Error Handler",
@@ -2528,95 +2572,45 @@ var shallowCatchRule = {
         walkAST(file.ast.program, (node) => {
           if (node.type !== "CatchClause") return;
           if (!node.loc) return;
-          const catchLine = node.loc.start.line - 1;
+          const catchLine2 = node.loc.start.line - 1;
           const body = node.body;
-          if (!body || !body.loc) return;
-          const bodyStart = body.loc.start.line - 1;
-          const bodyEnd = body.loc.end.line - 1;
-          const bodyLines = bodyStart === bodyEnd ? [file.lines[bodyStart]] : file.lines.slice(bodyStart + 1, bodyEnd);
-          const { score, label } = scoreCatchBody(bodyLines);
-          if (score <= 1) {
-            findings.push({
-              ruleId: "shallow-catch",
-              file: file.relativePath,
-              line: catchLine + 1,
-              column: file.lines[catchLine].indexOf("catch") + 1,
-              message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-              severity: score === 0 ? "warning" : "info",
-              category: "reliability",
-              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-            });
-          }
+          if (body?.start == null || body.end == null) return;
+          const returned = [];
+          walkAST(body, (n) => {
+            if (n.type === "ReturnStatement" && n.argument?.start != null && n.argument.end != null) {
+              returned.push(file.content.slice(n.argument.start, n.argument.end));
+            }
+          });
+          const finding = catchFinding(file, catchLine2, {
+            text: file.content.slice(body.start + 1, body.end - 1),
+            empty: body.body.length === 0,
+            returned,
+            param: node.param?.type === "Identifier" ? node.param.name : void 0
+          });
+          if (finding) findings.push(finding);
         });
         return findings;
       } catch {
       }
     }
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const trimmed = file.lines[i].trim();
-      if (!/\bcatch\s*\(/.test(trimmed) && !/\bcatch\s*\{/.test(trimmed)) continue;
-      let braceStart = -1;
-      for (let j = i; j < Math.min(i + 3, file.lines.length); j++) {
-        if (file.lines[j].includes("{")) {
-          braceStart = j;
-          break;
-        }
-      }
-      if (braceStart === -1) continue;
-      let depth = 0;
-      let bodyEnd = braceStart;
-      let inSingle = false;
-      let inDouble = false;
-      let inTemplate = false;
-      for (let j = braceStart; j < file.lines.length; j++) {
-        const line = file.lines[j];
-        const startPos = j === braceStart ? line.indexOf("{") : 0;
-        for (let k = startPos; k < line.length; k++) {
-          const ch = line[k];
-          const prev = k > 0 ? line[k - 1] : "";
-          const escaped = prev === "\\" && (k < 2 || line[k - 2] !== "\\");
-          if (!escaped) {
-            if (ch === "'" && !inDouble && !inTemplate) {
-              inSingle = !inSingle;
-              continue;
-            }
-            if (ch === '"' && !inSingle && !inTemplate) {
-              inDouble = !inDouble;
-              continue;
-            }
-            if (ch === "`" && !inSingle && !inDouble) {
-              inTemplate = !inTemplate;
-              continue;
-            }
-          }
-          if (inSingle || inDouble || inTemplate) continue;
-          if (ch === "{") depth++;
-          if (ch === "}") {
-            depth--;
-            if (depth === 0) {
-              bodyEnd = j;
-              break;
-            }
-          }
-        }
-        if (depth === 0) break;
-      }
-      const bodyLines = file.lines.slice(braceStart + 1, bodyEnd);
-      const { score, label } = scoreCatchBody(bodyLines);
-      if (score <= 1) {
-        findings.push({
-          ruleId: "shallow-catch",
-          file: file.relativePath,
-          line: i + 1,
-          column: file.lines[i].indexOf("catch") + 1,
-          message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-          severity: score === 0 ? "warning" : "info",
-          category: "reliability",
-          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-        });
-      }
-      i = bodyEnd;
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    const catchRe = /(?<![\w$.])catch\s*(?:\(([^)]*)\)\s*)?\{/g;
+    let catchLine = 0;
+    let scanned = 0;
+    for (let m = catchRe.exec(code); m; m = catchRe.exec(code)) {
+      for (; scanned < m.index; scanned++) if (code[scanned] === "\n") catchLine++;
+      const open = m.index + m[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const finding = catchFinding(file, catchLine, {
+        text: source.slice(open + 1, close),
+        empty: code.slice(open + 1, close).trim() === "",
+        returned: returnedValues(code.slice(open + 1, close), noComments.slice(open + 1, close)),
+        param: m[1]?.match(/^\s*([A-Za-z_$][\w$]*)/)?.[1]
+      });
+      if (finding) findings.push(finding);
     }
     return findings;
   }

package/dist/index.js

@@ -2481,15 +2481,16 @@ var deadExportsRule = {
 };
 
 // src/rules/shallow-catch.ts
-function scoreCatchBody(bodyLines) {
-  if (bodyLines.length === 0 || bodyLines.every((l) => l.trim() === "")) {
-    return { score: 0, label: "empty catch" };
-  }
-  const body = bodyLines.join("\n");
+function reportsError(value, param) {
+  if (/error/i.test(value) || /\berr|Err|status|Response|json/.test(value)) return true;
+  return param !== void 0 && new RegExp(`(?<![\\w$])${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(value);
+}
+function scoreCatchBody({ text: body, empty, returned, param }) {
+  if (empty) return { score: 0, label: "empty catch" };
   let score = 0;
   if (/console\.(log|warn|error|info)\s*\(/.test(body)) score = 1;
   if ((/console\.(error|warn)\s*\(/.test(body) || /\b(logger|log)\.(error|warn)\s*\(/.test(body)) && /\b(err|error|e)\b/.test(body)) score = 2;
-  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
+  if (/\bthrow\b/.test(body) || returned.some((value) => reportsError(value, param)) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
   /\btoast\.(error|warn|warning)\s*\(/.test(body) || /\btoast\s*\(\s*\{/.test(body) || // Error monitoring (Sentry, etc.)
   /\b(Sentry\.)?captureException\s*\(/.test(body) || /\b(Sentry\.)?captureMessage\s*\(/.test(body) || // Structured loggers
   /\b(logger|log)\.(error|fatal)\s*\(/.test(body) || // Error handler utilities
@@ -2499,13 +2500,56 @@ function scoreCatchBody(bodyLines) {
     score = 3;
   }
   const labels = {
-    0: "empty catch",
+    0: "catch swallows the error",
     1: "catch only logs (no recovery or propagation)",
     2: "catch logs error but does not propagate or recover",
     3: "catch handles error properly"
   };
   return { score, label: labels[score] };
 }
+function catchFinding(file, catchLine, body) {
+  const { score, label } = scoreCatchBody(body);
+  if (score > 1) return null;
+  return {
+    ruleId: "shallow-catch",
+    file: file.relativePath,
+    line: catchLine + 1,
+    column: file.lines[catchLine].indexOf("catch") + 1,
+    message: body.empty ? "Empty catch block \u2014 errors are silently swallowed" : score === 0 ? "Catch block swallows the error \u2014 it isn't logged, rethrown or returned" : `Decorative error handler: ${label}`,
+    severity: score === 0 ? "warning" : "info",
+    category: "reliability",
+    fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
+  };
+}
+var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
+function blankOut(source, strings) {
+  const blank = (s) => s.replace(/[^\n]/g, " ");
+  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
+}
+function closingBrace(code, open) {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === "{") depth++;
+    else if (code[i] === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+function returnedValues(code, text) {
+  const values = [];
+  for (const m of code.matchAll(/(?<![\w$.])return\b/g)) {
+    const start = m.index + "return".length;
+    let end = start;
+    for (let depth = 0; end < code.length; end++) {
+      const ch = code[end];
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") {
+        if (depth-- === 0) break;
+      } else if (depth === 0 && (ch === ";" || ch === "\n")) break;
+    }
+    values.push(text.slice(start, end));
+  }
+  return values;
+}
 var shallowCatchRule = {
   id: "shallow-catch",
   name: "Shallow Error Handler",
@@ -2522,95 +2566,45 @@ var shallowCatchRule = {
         walkAST(file.ast.program, (node) => {
           if (node.type !== "CatchClause") return;
           if (!node.loc) return;
-          const catchLine = node.loc.start.line - 1;
+          const catchLine2 = node.loc.start.line - 1;
           const body = node.body;
-          if (!body || !body.loc) return;
-          const bodyStart = body.loc.start.line - 1;
-          const bodyEnd = body.loc.end.line - 1;
-          const bodyLines = bodyStart === bodyEnd ? [file.lines[bodyStart]] : file.lines.slice(bodyStart + 1, bodyEnd);
-          const { score, label } = scoreCatchBody(bodyLines);
-          if (score <= 1) {
-            findings.push({
-              ruleId: "shallow-catch",
-              file: file.relativePath,
-              line: catchLine + 1,
-              column: file.lines[catchLine].indexOf("catch") + 1,
-              message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-              severity: score === 0 ? "warning" : "info",
-              category: "reliability",
-              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-            });
-          }
+          if (body?.start == null || body.end == null) return;
+          const returned = [];
+          walkAST(body, (n) => {
+            if (n.type === "ReturnStatement" && n.argument?.start != null && n.argument.end != null) {
+              returned.push(file.content.slice(n.argument.start, n.argument.end));
+            }
+          });
+          const finding = catchFinding(file, catchLine2, {
+            text: file.content.slice(body.start + 1, body.end - 1),
+            empty: body.body.length === 0,
+            returned,
+            param: node.param?.type === "Identifier" ? node.param.name : void 0
+          });
+          if (finding) findings.push(finding);
         });
         return findings;
       } catch {
       }
     }
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const trimmed = file.lines[i].trim();
-      if (!/\bcatch\s*\(/.test(trimmed) && !/\bcatch\s*\{/.test(trimmed)) continue;
-      let braceStart = -1;
-      for (let j = i; j < Math.min(i + 3, file.lines.length); j++) {
-        if (file.lines[j].includes("{")) {
-          braceStart = j;
-          break;
-        }
-      }
-      if (braceStart === -1) continue;
-      let depth = 0;
-      let bodyEnd = braceStart;
-      let inSingle = false;
-      let inDouble = false;
-      let inTemplate = false;
-      for (let j = braceStart; j < file.lines.length; j++) {
-        const line = file.lines[j];
-        const startPos = j === braceStart ? line.indexOf("{") : 0;
-        for (let k = startPos; k < line.length; k++) {
-          const ch = line[k];
-          const prev = k > 0 ? line[k - 1] : "";
-          const escaped = prev === "\\" && (k < 2 || line[k - 2] !== "\\");
-          if (!escaped) {
-            if (ch === "'" && !inDouble && !inTemplate) {
-              inSingle = !inSingle;
-              continue;
-            }
-            if (ch === '"' && !inSingle && !inTemplate) {
-              inDouble = !inDouble;
-              continue;
-            }
-            if (ch === "`" && !inSingle && !inDouble) {
-              inTemplate = !inTemplate;
-              continue;
-            }
-          }
-          if (inSingle || inDouble || inTemplate) continue;
-          if (ch === "{") depth++;
-          if (ch === "}") {
-            depth--;
-            if (depth === 0) {
-              bodyEnd = j;
-              break;
-            }
-          }
-        }
-        if (depth === 0) break;
-      }
-      const bodyLines = file.lines.slice(braceStart + 1, bodyEnd);
-      const { score, label } = scoreCatchBody(bodyLines);
-      if (score <= 1) {
-        findings.push({
-          ruleId: "shallow-catch",
-          file: file.relativePath,
-          line: i + 1,
-          column: file.lines[i].indexOf("catch") + 1,
-          message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-          severity: score === 0 ? "warning" : "info",
-          category: "reliability",
-          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-        });
-      }
-      i = bodyEnd;
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    const catchRe = /(?<![\w$.])catch\s*(?:\(([^)]*)\)\s*)?\{/g;
+    let catchLine = 0;
+    let scanned = 0;
+    for (let m = catchRe.exec(code); m; m = catchRe.exec(code)) {
+      for (; scanned < m.index; scanned++) if (code[scanned] === "\n") catchLine++;
+      const open = m.index + m[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const finding = catchFinding(file, catchLine, {
+        text: source.slice(open + 1, close),
+        empty: code.slice(open + 1, close).trim() === "",
+        returned: returnedValues(code.slice(open + 1, close), noComments.slice(open + 1, close)),
+        param: m[1]?.match(/^\s*([A-Za-z_$][\w$]*)/)?.[1]
+      });
+      if (finding) findings.push(finding);
     }
     return findings;
   }

package/dist/mcp.js

@@ -2490,15 +2490,16 @@ var deadExportsRule = {
 };
 
 // src/rules/shallow-catch.ts
-function scoreCatchBody(bodyLines) {
-  if (bodyLines.length === 0 || bodyLines.every((l) => l.trim() === "")) {
-    return { score: 0, label: "empty catch" };
-  }
-  const body = bodyLines.join("\n");
+function reportsError(value, param) {
+  if (/error/i.test(value) || /\berr|Err|status|Response|json/.test(value)) return true;
+  return param !== void 0 && new RegExp(`(?<![\\w$])${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(value);
+}
+function scoreCatchBody({ text: body, empty, returned, param }) {
+  if (empty) return { score: 0, label: "empty catch" };
   let score = 0;
   if (/console\.(log|warn|error|info)\s*\(/.test(body)) score = 1;
   if ((/console\.(error|warn)\s*\(/.test(body) || /\b(logger|log)\.(error|warn)\s*\(/.test(body)) && /\b(err|error|e)\b/.test(body)) score = 2;
-  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
+  if (/\bthrow\b/.test(body) || returned.some((value) => reportsError(value, param)) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
   /\btoast\.(error|warn|warning)\s*\(/.test(body) || /\btoast\s*\(\s*\{/.test(body) || // Error monitoring (Sentry, etc.)
   /\b(Sentry\.)?captureException\s*\(/.test(body) || /\b(Sentry\.)?captureMessage\s*\(/.test(body) || // Structured loggers
   /\b(logger|log)\.(error|fatal)\s*\(/.test(body) || // Error handler utilities
@@ -2508,13 +2509,56 @@ function scoreCatchBody(bodyLines) {
     score = 3;
   }
   const labels = {
-    0: "empty catch",
+    0: "catch swallows the error",
     1: "catch only logs (no recovery or propagation)",
     2: "catch logs error but does not propagate or recover",
     3: "catch handles error properly"
   };
   return { score, label: labels[score] };
 }
+function catchFinding(file, catchLine, body) {
+  const { score, label } = scoreCatchBody(body);
+  if (score > 1) return null;
+  return {
+    ruleId: "shallow-catch",
+    file: file.relativePath,
+    line: catchLine + 1,
+    column: file.lines[catchLine].indexOf("catch") + 1,
+    message: body.empty ? "Empty catch block \u2014 errors are silently swallowed" : score === 0 ? "Catch block swallows the error \u2014 it isn't logged, rethrown or returned" : `Decorative error handler: ${label}`,
+    severity: score === 0 ? "warning" : "info",
+    category: "reliability",
+    fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
+  };
+}
+var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
+function blankOut(source, strings) {
+  const blank = (s) => s.replace(/[^\n]/g, " ");
+  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
+}
+function closingBrace(code, open) {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === "{") depth++;
+    else if (code[i] === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+function returnedValues(code, text) {
+  const values = [];
+  for (const m of code.matchAll(/(?<![\w$.])return\b/g)) {
+    const start = m.index + "return".length;
+    let end = start;
+    for (let depth = 0; end < code.length; end++) {
+      const ch = code[end];
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") {
+        if (depth-- === 0) break;
+      } else if (depth === 0 && (ch === ";" || ch === "\n")) break;
+    }
+    values.push(text.slice(start, end));
+  }
+  return values;
+}
 var shallowCatchRule = {
   id: "shallow-catch",
   name: "Shallow Error Handler",
@@ -2531,95 +2575,45 @@ var shallowCatchRule = {
         walkAST(file.ast.program, (node) => {
           if (node.type !== "CatchClause") return;
           if (!node.loc) return;
-          const catchLine = node.loc.start.line - 1;
+          const catchLine2 = node.loc.start.line - 1;
           const body = node.body;
-          if (!body || !body.loc) return;
-          const bodyStart = body.loc.start.line - 1;
-          const bodyEnd = body.loc.end.line - 1;
-          const bodyLines = bodyStart === bodyEnd ? [file.lines[bodyStart]] : file.lines.slice(bodyStart + 1, bodyEnd);
-          const { score, label } = scoreCatchBody(bodyLines);
-          if (score <= 1) {
-            findings.push({
-              ruleId: "shallow-catch",
-              file: file.relativePath,
-              line: catchLine + 1,
-              column: file.lines[catchLine].indexOf("catch") + 1,
-              message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-              severity: score === 0 ? "warning" : "info",
-              category: "reliability",
-              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-            });
-          }
+          if (body?.start == null || body.end == null) return;
+          const returned = [];
+          walkAST(body, (n) => {
+            if (n.type === "ReturnStatement" && n.argument?.start != null && n.argument.end != null) {
+              returned.push(file.content.slice(n.argument.start, n.argument.end));
+            }
+          });
+          const finding = catchFinding(file, catchLine2, {
+            text: file.content.slice(body.start + 1, body.end - 1),
+            empty: body.body.length === 0,
+            returned,
+            param: node.param?.type === "Identifier" ? node.param.name : void 0
+          });
+          if (finding) findings.push(finding);
         });
         return findings;
       } catch {
       }
     }
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const trimmed = file.lines[i].trim();
-      if (!/\bcatch\s*\(/.test(trimmed) && !/\bcatch\s*\{/.test(trimmed)) continue;
-      let braceStart = -1;
-      for (let j = i; j < Math.min(i + 3, file.lines.length); j++) {
-        if (file.lines[j].includes("{")) {
-          braceStart = j;
-          break;
-        }
-      }
-      if (braceStart === -1) continue;
-      let depth = 0;
-      let bodyEnd = braceStart;
-      let inSingle = false;
-      let inDouble = false;
-      let inTemplate = false;
-      for (let j = braceStart; j < file.lines.length; j++) {
-        const line = file.lines[j];
-        const startPos = j === braceStart ? line.indexOf("{") : 0;
-        for (let k = startPos; k < line.length; k++) {
-          const ch = line[k];
-          const prev = k > 0 ? line[k - 1] : "";
-          const escaped = prev === "\\" && (k < 2 || line[k - 2] !== "\\");
-          if (!escaped) {
-            if (ch === "'" && !inDouble && !inTemplate) {
-              inSingle = !inSingle;
-              continue;
-            }
-            if (ch === '"' && !inSingle && !inTemplate) {
-              inDouble = !inDouble;
-              continue;
-            }
-            if (ch === "`" && !inSingle && !inDouble) {
-              inTemplate = !inTemplate;
-              continue;
-            }
-          }
-          if (inSingle || inDouble || inTemplate) continue;
-          if (ch === "{") depth++;
-          if (ch === "}") {
-            depth--;
-            if (depth === 0) {
-              bodyEnd = j;
-              break;
-            }
-          }
-        }
-        if (depth === 0) break;
-      }
-      const bodyLines = file.lines.slice(braceStart + 1, bodyEnd);
-      const { score, label } = scoreCatchBody(bodyLines);
-      if (score <= 1) {
-        findings.push({
-          ruleId: "shallow-catch",
-          file: file.relativePath,
-          line: i + 1,
-          column: file.lines[i].indexOf("catch") + 1,
-          message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-          severity: score === 0 ? "warning" : "info",
-          category: "reliability",
-          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-        });
-      }
-      i = bodyEnd;
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    const catchRe = /(?<![\w$.])catch\s*(?:\(([^)]*)\)\s*)?\{/g;
+    let catchLine = 0;
+    let scanned = 0;
+    for (let m = catchRe.exec(code); m; m = catchRe.exec(code)) {
+      for (; scanned < m.index; scanned++) if (code[scanned] === "\n") catchLine++;
+      const open = m.index + m[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const finding = catchFinding(file, catchLine, {
+        text: source.slice(open + 1, close),
+        empty: code.slice(open + 1, close).trim() === "",
+        returned: returnedValues(code.slice(open + 1, close), noComments.slice(open + 1, close)),
+        param: m[1]?.match(/^\s*([A-Za-z_$][\w$]*)/)?.[1]
+      });
+      if (finding) findings.push(finding);
     }
     return findings;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prodlint",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
   "license": "MIT",
   "author": "prodlint contributors",