prodlint 0.6.0 → 0.7.1

package/dist/mcp.js

@@ -80,7 +80,10 @@ function isTestFile(relativePath) {
   return /\.(test|spec)\.[jt]sx?$/.test(relativePath) || /(?:^|\/)__tests__\//.test(relativePath) || /(?:^|\/)tests?\//.test(relativePath) || /(?:^|\/)fixtures?\//.test(relativePath) || /(?:^|\/)mocks?\//.test(relativePath);
 }
 function isScriptFile(relativePath) {
-  return /(?:^|\/)scripts?\//.test(relativePath);
+  if (/(?:^|\/)scripts?\//.test(relativePath)) return true;
+  const name = relativePath.split("/").pop() ?? "";
+  const base = name.replace(/\.[^.]+$/, "");
+  return /^(seed|migrate|setup|bootstrap|generate|codegen|sync|deploy|cleanup|reset)$/.test(base);
 }
 function isConfigFile(relativePath) {
   const name = relativePath.split("/").pop() ?? "";
@@ -249,6 +252,100 @@ function findLoopsAST(ast) {
   });
   return loops;
 }
+function getImportSources(ast) {
+  const sources = [];
+  walkAST(ast.program, (node) => {
+    if (node.type === "ImportDeclaration") {
+      const decl = node;
+      sources.push({ source: decl.source.value, line: decl.loc?.start.line ?? 1 });
+    }
+    if (node.type === "CallExpression") {
+      const call = node;
+      if (call.callee.type === "Identifier" && call.callee.name === "require" && call.arguments.length === 1 && call.arguments[0].type === "StringLiteral") {
+        sources.push({ source: call.arguments[0].value, line: node.loc?.start.line ?? 1 });
+      }
+      if (call.callee.type === "Import" && call.arguments.length >= 1 && call.arguments[0].type === "StringLiteral") {
+        sources.push({ source: call.arguments[0].value, line: node.loc?.start.line ?? 1 });
+      }
+    }
+  });
+  return sources;
+}
+function isUserInputNode(node) {
+  if (node.type === "MemberExpression") {
+    const mem = node;
+    if (mem.object.type === "MemberExpression") {
+      const inner = mem.object;
+      if (inner.object.type === "Identifier") {
+        const objName = inner.object.name;
+        if (objName === "req" || objName === "request") {
+          if (inner.property.type === "Identifier") {
+            const prop = inner.property.name;
+            if (prop === "query" || prop === "body" || prop === "params") return true;
+          }
+        }
+      }
+    }
+  }
+  if (node.type === "CallExpression") {
+    const call = node;
+    if (call.callee.type === "MemberExpression") {
+      const callee = call.callee;
+      if (callee.property.type === "Identifier" && callee.property.name === "get") {
+        if (callee.object.type === "Identifier") {
+          const name = callee.object.name;
+          if (name === "searchParams" || name === "formData") return true;
+        }
+        if (callee.object.type === "MemberExpression") {
+          const inner = callee.object;
+          if (inner.property.type === "Identifier" && inner.property.name === "searchParams") {
+            return true;
+          }
+        }
+      }
+    }
+  }
+  return false;
+}
+function isStaticString(node) {
+  if (node.type === "StringLiteral") return true;
+  if (node.type === "TemplateLiteral") {
+    return node.expressions.length === 0;
+  }
+  return false;
+}
+function findUseEffectRanges(ast) {
+  const ranges = [];
+  walkAST(ast.program, (node) => {
+    if (node.type !== "CallExpression") return;
+    const call = node;
+    if (call.callee.type !== "Identifier" || call.callee.name !== "useEffect") return;
+    const callback = call.arguments[0];
+    if (!callback || !callback.loc) return;
+    ranges.push({
+      start: callback.loc.start.line - 1,
+      end: callback.loc.end.line - 1
+    });
+  });
+  return ranges;
+}
+function subtreeContains(node, predicate) {
+  if (predicate(node)) return true;
+  for (const key of Object.keys(node)) {
+    if (key === "start" || key === "end" || key === "loc" || key === "type") continue;
+    const val = node[key];
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (item && typeof item === "object" && item.type) {
+          if (subtreeContains(item, predicate)) return true;
+        }
+      }
+    } else if (val && typeof val === "object" && val.type) {
+      if (subtreeContains(val, predicate)) return true;
+    }
+  }
+  return false;
+}
 
 // src/utils/frameworks.ts
 var FRAMEWORK_SAFE_METHODS = {
@@ -368,6 +465,66 @@ async function readFileContext(root, relativePath) {
     return null;
   }
 }
+async function getWorkspacePatterns(root, packageJson) {
+  const patterns = [];
+  if (packageJson) {
+    const workspaces = packageJson.workspaces;
+    if (Array.isArray(workspaces)) {
+      patterns.push(...workspaces);
+    } else if (workspaces && typeof workspaces === "object" && Array.isArray(workspaces.packages)) {
+      patterns.push(...workspaces.packages);
+    }
+  }
+  try {
+    const raw = await readFile(resolve(root, "pnpm-workspace.yaml"), "utf-8");
+    let inPackages = false;
+    for (const line of raw.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (/^packages\s*:/.test(trimmed)) {
+        inPackages = true;
+        continue;
+      }
+      if (inPackages) {
+        if (/^-\s+/.test(trimmed)) {
+          const glob = trimmed.replace(/^-\s+/, "").replace(/^['"]|['"]$/g, "");
+          if (glob) patterns.push(glob);
+        } else if (trimmed && !trimmed.startsWith("#")) {
+          break;
+        }
+      }
+    }
+  } catch {
+  }
+  return patterns;
+}
+async function collectWorkspaceDependencies(root, patterns) {
+  const deps = /* @__PURE__ */ new Set();
+  const globPatterns = patterns.map((p) => `${p}/package.json`);
+  try {
+    const pkgFiles = await fg(globPatterns, {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -386,19 +543,26 @@ async function buildProjectContext(root, files) {
       ...packageJson?.peerDependencies ?? {}
     };
     declaredDependencies = new Set(Object.keys(deps));
-    for (const dep of declaredDependencies) {
-      const framework = DEPENDENCY_TO_FRAMEWORK[dep];
-      if (framework) {
-        detectedFrameworks.add(framework);
-      }
+  } catch {
+  }
+  const workspacePatterns = await getWorkspacePatterns(root, packageJson);
+  if (workspacePatterns.length > 0) {
+    const workspaceDeps = await collectWorkspaceDependencies(root, workspacePatterns);
+    for (const dep of workspaceDeps) {
+      declaredDependencies.add(dep);
     }
-    for (const framework of detectedFrameworks) {
-      if (RATE_LIMIT_FRAMEWORKS.has(framework)) {
-        hasRateLimiting = true;
-        break;
-      }
+  }
+  for (const dep of declaredDependencies) {
+    const framework = DEPENDENCY_TO_FRAMEWORK[dep];
+    if (framework) {
+      detectedFrameworks.add(framework);
+    }
+  }
+  for (const framework of detectedFrameworks) {
+    if (RATE_LIMIT_FRAMEWORKS.has(framework)) {
+      hasRateLimiting = true;
+      break;
     }
-  } catch {
   }
   try {
     const raw = await readFile(resolve(root, "tsconfig.json"), "utf-8");
@@ -653,6 +817,32 @@ var hallucinatedImportsRule = {
     const findings = [];
     const seen = /* @__PURE__ */ new Set();
     const isNonProd = isTestFile(file.relativePath) || isScriptFile(file.relativePath);
+    if (file.ast) {
+      try {
+        const imports = getImportSources(file.ast);
+        for (const { source: importPath, line } of imports) {
+          if (importPath.startsWith(".") || importPath.startsWith("/")) continue;
+          const pkgName = getPackageName(importPath);
+          if (seen.has(pkgName)) continue;
+          seen.add(pkgName);
+          if (isPathAlias(importPath, project.tsconfigPaths)) continue;
+          if (isNodeBuiltin(pkgName)) continue;
+          if (IMPLICIT_PACKAGES.has(importPath) || IMPLICIT_PACKAGES.has(pkgName)) continue;
+          if (project.declaredDependencies.has(pkgName)) continue;
+          findings.push({
+            ruleId: "hallucinated-imports",
+            file: file.relativePath,
+            line,
+            column: 1,
+            message: `Package "${pkgName}" is imported but not in package.json`,
+            severity: isNonProd ? "warning" : "critical",
+            category: "reliability"
+          });
+        }
+        return findings;
+      } catch {
+      }
+    }
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
@@ -1151,6 +1341,81 @@ var unsafeHtmlRule = {
   fileExtensions: ["ts", "tsx", "js", "jsx"],
   check(file, _project) {
     const findings = [];
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type === "JSXAttribute") {
+            const attr = node;
+            if (attr.name?.type === "JSXIdentifier" && attr.name.name === "dangerouslySetInnerHTML" && attr.loc) {
+              if (attr.value && subtreeContains(attr.value, (n) => {
+                if (n.type !== "CallExpression") return false;
+                const call = n;
+                if (call.callee.type === "MemberExpression") {
+                  const mem = call.callee;
+                  return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
+                }
+                return false;
+              })) {
+                return;
+              }
+              const line = attr.loc.start.line;
+              findings.push({
+                ruleId: "unsafe-html",
+                file: file.relativePath,
+                line,
+                column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
+                message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
+                severity: "critical",
+                category: "security"
+              });
+            }
+          }
+          if (node.type === "ObjectProperty") {
+            const prop = node;
+            if (prop.key?.type === "Identifier" && prop.key.name === "dangerouslySetInnerHTML" && prop.loc) {
+              if (prop.value && subtreeContains(prop.value, (n) => {
+                if (n.type !== "CallExpression") return false;
+                const call = n;
+                if (call.callee.type === "MemberExpression") {
+                  const mem = call.callee;
+                  return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
+                }
+                return false;
+              })) {
+                return;
+              }
+              const line = prop.loc.start.line;
+              findings.push({
+                ruleId: "unsafe-html",
+                file: file.relativePath,
+                line,
+                column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
+                message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
+                severity: "critical",
+                category: "security"
+              });
+            }
+          }
+          if (node.type === "AssignmentExpression") {
+            const assign = node;
+            if (assign.left?.type === "MemberExpression" && assign.left.property?.type === "Identifier" && assign.left.property.name === "innerHTML" && assign.loc) {
+              const line = assign.loc.start.line;
+              findings.push({
+                ruleId: "unsafe-html",
+                file: file.relativePath,
+                line,
+                column: file.lines[line - 1].indexOf(".innerHTML") + 1,
+                message: "Direct innerHTML assignment is an XSS risk",
+                severity: "critical",
+                category: "security"
+              });
+            }
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
@@ -1404,6 +1669,22 @@ var DIRECT_INPUT_PATTERNS = [
 var WARNING_PATTERNS = [
   /redirect\s*\(\s*(?:url|returnUrl|returnTo|redirectUrl|redirectTo|next|callbackUrl|destination|redirect|goto|to|target|uri|href)\s*[,)]/
 ];
+var SUSPICIOUS_VAR_NAMES = /* @__PURE__ */ new Set([
+  "url",
+  "returnUrl",
+  "returnTo",
+  "redirectUrl",
+  "redirectTo",
+  "next",
+  "callbackUrl",
+  "destination",
+  "redirect",
+  "goto",
+  "to",
+  "target",
+  "uri",
+  "href"
+]);
 var openRedirectRule = {
   id: "open-redirect",
   name: "Open Redirect",
@@ -1413,6 +1694,62 @@ var openRedirectRule = {
   fileExtensions: ["ts", "tsx", "js", "jsx"],
   check(file, _project) {
     const findings = [];
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CallExpression") return;
+          const call = node;
+          if (!call.loc) return;
+          let isRedirect = false;
+          if (call.callee.type === "Identifier" && call.callee.name === "redirect") {
+            isRedirect = true;
+          }
+          if (call.callee.type === "MemberExpression") {
+            const mem = call.callee;
+            if (mem.object.type === "Identifier" && mem.object.name === "NextResponse" && mem.property.type === "Identifier" && mem.property.name === "redirect") {
+              isRedirect = true;
+            }
+          }
+          if (!isRedirect) return;
+          const arg = call.arguments[0];
+          if (!arg) return;
+          if (isStaticString(arg)) return;
+          let targetArg = arg;
+          if (arg.type === "NewExpression" && arg.callee.type === "Identifier" && arg.callee.name === "URL") {
+            targetArg = arg.arguments[0];
+            if (!targetArg) return;
+            if (isStaticString(targetArg)) return;
+          }
+          const lineNum = call.loc.start.line;
+          const col = call.loc.start.column + 1;
+          if (isUserInputNode(targetArg)) {
+            findings.push({
+              ruleId: "open-redirect",
+              file: file.relativePath,
+              line: lineNum,
+              column: col,
+              message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
+              severity: "warning",
+              category: "security"
+            });
+            return;
+          }
+          if (targetArg.type === "Identifier" && SUSPICIOUS_VAR_NAMES.has(targetArg.name)) {
+            findings.push({
+              ruleId: "open-redirect",
+              file: file.relativePath,
+              line: lineNum,
+              column: col,
+              message: "Possible user input in redirect \u2014 verify the URL is validated before use",
+              severity: "warning",
+              category: "security"
+            });
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
@@ -2037,8 +2374,14 @@ function scoreCatchBody(bodyLines) {
   const body = bodyLines.join("\n");
   let score = 0;
   if (/console\.(log|warn|error|info)\s*\(/.test(body)) score = 1;
-  if (/console\.(error|warn)\s*\(/.test(body) && /\b(err|error|e)\b/.test(body)) score = 2;
-  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body)) {
+  if ((/console\.(error|warn)\s*\(/.test(body) || /\b(logger|log)\.(error|warn)\s*\(/.test(body)) && /\b(err|error|e)\b/.test(body)) score = 2;
+  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
+  /\btoast\.(error|warn|warning)\s*\(/.test(body) || /\btoast\s*\(\s*\{/.test(body) || // Error monitoring (Sentry, etc.)
+  /\b(Sentry\.)?captureException\s*\(/.test(body) || /\b(Sentry\.)?captureMessage\s*\(/.test(body) || // Structured loggers
+  /\b(logger|log)\.(error|fatal)\s*\(/.test(body) || // Error handler utilities
+  /\b(handleError|reportError|logError|notifyError|showError|onError|trackError)\s*\(/.test(body) || // Express middleware: next(err)
+  /\bnext\s*\(\s*(err|error|e)\s*\)/.test(body) || // Next.js notFound()
+  /\bnotFound\s*\(/.test(body)) {
     score = 3;
   }
   const labels = {
@@ -2060,6 +2403,34 @@ var shallowCatchRule = {
     if (isTestFile(file.relativePath)) return [];
     if (isScriptFile(file.relativePath)) return [];
     const findings = [];
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CatchClause") return;
+          if (!node.loc) return;
+          const catchLine = node.loc.start.line - 1;
+          const body = node.body;
+          if (!body || !body.loc) return;
+          const bodyStart = body.loc.start.line - 1;
+          const bodyEnd = body.loc.end.line - 1;
+          const bodyLines = bodyStart === bodyEnd ? [file.lines[bodyStart]] : file.lines.slice(bodyStart + 1, bodyEnd);
+          const { score, label } = scoreCatchBody(bodyLines);
+          if (score <= 1) {
+            findings.push({
+              ruleId: "shallow-catch",
+              file: file.relativePath,
+              line: catchLine + 1,
+              column: file.lines[catchLine].indexOf("catch") + 1,
+              message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
+              severity: score === 0 ? "warning" : "info",
+              category: "reliability"
+            });
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const trimmed = file.lines[i].trim();
@@ -2393,6 +2764,7 @@ var insecureCookieRule = {
 
 // src/rules/leaked-env-in-logs.ts
 var CONSOLE_WITH_ENV = /console\.(log|warn|error|info|debug)\s*\([^)]*process\.env\./;
+var CONSOLE_METHODS = /* @__PURE__ */ new Set(["log", "warn", "error", "info", "debug"]);
 var leakedEnvInLogsRule = {
   id: "leaked-env-in-logs",
   name: "Leaked Env in Logs",
@@ -2404,6 +2776,48 @@ var leakedEnvInLogsRule = {
     if (isTestFile(file.relativePath)) return [];
     if (isScriptFile(file.relativePath)) return [];
     const findings = [];
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CallExpression") return;
+          const call = node;
+          if (!call.loc) return;
+          if (call.callee.type !== "MemberExpression") return;
+          const mem = call.callee;
+          if (mem.object.type !== "Identifier" || mem.object.name !== "console") return;
+          if (mem.property.type !== "Identifier" || !CONSOLE_METHODS.has(mem.property.name)) return;
+          let hasEnvAccess = false;
+          for (const arg of call.arguments) {
+            if (subtreeContains(arg, (n) => {
+              if (n.type !== "MemberExpression") return false;
+              const m = n;
+              if (m.object.type === "MemberExpression") {
+                const inner = m.object;
+                return inner.object.type === "Identifier" && inner.object.name === "process" && inner.property.type === "Identifier" && inner.property.name === "env";
+              }
+              return false;
+            })) {
+              hasEnvAccess = true;
+              break;
+            }
+          }
+          if (hasEnvAccess) {
+            findings.push({
+              ruleId: "leaked-env-in-logs",
+              file: file.relativePath,
+              line: call.loc.start.line,
+              column: call.loc.start.column + 1,
+              message: "process.env value in console output \u2014 may leak secrets in production logs",
+              severity: "warning",
+              category: "security",
+              fix: "Remove process.env.* from console output \u2014 log a redacted summary instead"
+            });
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
@@ -2508,6 +2922,15 @@ var nextServerActionValidationRule = {
 // src/rules/missing-transaction.ts
 var PRISMA_WRITE_OPS = /prisma\.\w+\.(?:create|update|delete|upsert|createMany|updateMany|deleteMany)\s*\(/;
 var PRISMA_TRANSACTION = /\$transaction\s*\(/;
+var PRISMA_WRITE_METHODS = /* @__PURE__ */ new Set([
+  "create",
+  "update",
+  "delete",
+  "upsert",
+  "createMany",
+  "updateMany",
+  "deleteMany"
+]);
 var missingTransactionRule = {
   id: "missing-transaction",
   name: "Missing Transaction",
@@ -2519,6 +2942,60 @@ var missingTransactionRule = {
     if (isTestFile(file.relativePath)) return [];
     if (isScriptFile(file.relativePath)) return [];
     if (!project.declaredDependencies.has("@prisma/client") && !project.detectedFrameworks.has("prisma")) return [];
+    if (file.ast) {
+      try {
+        const parentMap = /* @__PURE__ */ new Map();
+        walkAST(file.ast.program, (node, parent) => {
+          if (parent) parentMap.set(node, parent);
+        });
+        const writesByScope = /* @__PURE__ */ new Map();
+        const transactionScopes = /* @__PURE__ */ new Set();
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CallExpression") return;
+          const call = node;
+          if (!call.loc) return;
+          if (call.callee.type === "MemberExpression") {
+            const mem = call.callee;
+            if (mem.property.type === "Identifier" && mem.property.name === "$transaction") {
+              const scope2 = findEnclosingFunction(node, parentMap);
+              transactionScopes.add(scope2);
+              return;
+            }
+          }
+          if (call.callee.type !== "MemberExpression") return;
+          const outerMem = call.callee;
+          if (outerMem.property.type !== "Identifier") return;
+          if (!PRISMA_WRITE_METHODS.has(outerMem.property.name)) return;
+          if (outerMem.object.type !== "MemberExpression") return;
+          const innerMem = outerMem.object;
+          if (innerMem.object.type !== "Identifier" || innerMem.object.name !== "prisma") return;
+          const scope = findEnclosingFunction(node, parentMap);
+          const existing = writesByScope.get(scope);
+          if (existing) {
+            existing.count++;
+          } else {
+            writesByScope.set(scope, { count: 1, firstLine: call.loc.start.line });
+          }
+        });
+        const findings = [];
+        for (const [scope, { count, firstLine }] of writesByScope) {
+          if (count < 2) continue;
+          if (transactionScopes.has(scope)) continue;
+          findings.push({
+            ruleId: "missing-transaction",
+            file: file.relativePath,
+            line: firstLine,
+            column: 1,
+            message: `${count} Prisma write operations without $transaction \u2014 partial writes may leave inconsistent state`,
+            severity: "warning",
+            category: "reliability",
+            fix: "Wrap sequential writes in prisma.$transaction([...]) for atomicity"
+          });
+        }
+        return findings;
+      } catch {
+      }
+    }
     let writeCount = 0;
     let firstWriteLine = -1;
     const hasTransaction = PRISMA_TRANSACTION.test(file.content);
@@ -2542,6 +3019,16 @@ var missingTransactionRule = {
     }];
   }
 };
+function findEnclosingFunction(node, parentMap) {
+  let current = parentMap.get(node);
+  while (current) {
+    if (current.type === "FunctionDeclaration" || current.type === "FunctionExpression" || current.type === "ArrowFunctionExpression") {
+      return current;
+    }
+    current = parentMap.get(current);
+  }
+  return null;
+}
 
 // src/rules/redirect-in-try-catch.ts
 var redirectInTryCatchRule = {
@@ -3108,6 +3595,14 @@ var VALIDATION_PATTERNS3 = [
   /\.startsWith\s*\(\s*['"]https?:\/\//,
   /\.hostname\s*[!=]==?\s*['"`]/
 ];
+var SUSPICIOUS_URL_VARS = /* @__PURE__ */ new Set([
+  "url",
+  "href",
+  "endpoint",
+  "target",
+  "link",
+  "src"
+]);
 var ssrfRiskRule = {
   id: "ssrf-risk",
   name: "SSRF Risk",
@@ -3118,9 +3613,63 @@ var ssrfRiskRule = {
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
     if (!isApiRoute(file.relativePath) && !/['"]use server['"]/.test(file.content)) return [];
+    const findings = [];
+    if (file.ast) {
+      try {
+        const hasValidationInCode = VALIDATION_PATTERNS3.some((p) => p.test(file.content));
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CallExpression") return;
+          const call = node;
+          if (!call.loc) return;
+          let isFetchLike = false;
+          if (call.callee.type === "Identifier" && call.callee.name === "fetch") {
+            isFetchLike = true;
+          }
+          if (call.callee.type === "MemberExpression") {
+            const mem = call.callee;
+            if (mem.object.type === "Identifier" && mem.object.name === "axios") {
+              isFetchLike = true;
+            }
+          }
+          if (!isFetchLike) return;
+          const arg = call.arguments[0];
+          if (!arg) return;
+          if (isStaticString(arg)) return;
+          const lineNum = call.loc.start.line;
+          const col = call.loc.start.column + 1;
+          if (isUserInputNode(arg)) {
+            findings.push({
+              ruleId: "ssrf-risk",
+              file: file.relativePath,
+              line: lineNum,
+              column: col,
+              message: "User-controlled URL passed to fetch \u2014 validate against an allowlist to prevent SSRF",
+              severity: "warning",
+              category: "security",
+              fix: "Validate the URL against an allowlist of permitted domains before making the request"
+            });
+            return;
+          }
+          if (arg.type === "Identifier" && SUSPICIOUS_URL_VARS.has(arg.name)) {
+            if (hasValidationInCode) return;
+            findings.push({
+              ruleId: "ssrf-risk",
+              file: file.relativePath,
+              line: lineNum,
+              column: col,
+              message: "User-controlled URL passed to fetch \u2014 validate against an allowlist to prevent SSRF",
+              severity: "warning",
+              category: "security",
+              fix: "Validate the URL against an allowlist of permitted domains before making the request"
+            });
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     const hasValidation = VALIDATION_PATTERNS3.some((p) => p.test(file.content));
     if (hasValidation) return [];
-    const findings = [];
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
@@ -3162,6 +3711,25 @@ var SANITIZATION_PATTERNS = [
   /sanitize/i,
   /realpath/
 ];
+var FS_FUNCTION_NAMES = /* @__PURE__ */ new Set([
+  "readFile",
+  "readFileSync",
+  "createReadStream",
+  "writeFile",
+  "writeFileSync",
+  "createWriteStream",
+  "unlink",
+  "unlinkSync",
+  "rm",
+  "rmSync"
+]);
+var SUSPICIOUS_PATH_VARS = /* @__PURE__ */ new Set([
+  "filePath",
+  "fileName",
+  "path",
+  "file",
+  "name"
+]);
 var pathTraversalRule = {
   id: "path-traversal",
   name: "Path Traversal",
@@ -3171,9 +3739,73 @@ var pathTraversalRule = {
   fileExtensions: ["ts", "tsx", "js", "jsx"],
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
+    const findings = [];
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CallExpression") return;
+          const call = node;
+          if (!call.loc) return;
+          let fnName = null;
+          if (call.callee.type === "Identifier" && FS_FUNCTION_NAMES.has(call.callee.name)) {
+            fnName = call.callee.name;
+          }
+          if (call.callee.type === "MemberExpression") {
+            const mem = call.callee;
+            if (mem.property.type === "Identifier") {
+              if (FS_FUNCTION_NAMES.has(mem.property.name)) {
+                fnName = mem.property.name;
+              }
+              if (mem.property.name === "join" && mem.object.type === "Identifier" && mem.object.name === "path") {
+                fnName = "path.join";
+              }
+              if (mem.property.name === "sendFile") {
+                fnName = "sendFile";
+              }
+            }
+          }
+          if (!fnName) return;
+          const argsToCheck = fnName === "path.join" ? call.arguments : [call.arguments[0]];
+          for (const arg of argsToCheck) {
+            if (!arg) continue;
+            if (isStaticString(arg)) continue;
+            const lineNum = call.loc.start.line;
+            const col = call.loc.start.column + 1;
+            if (isUserInputNode(arg)) {
+              const action = fnName.includes("write") || fnName.includes("Write") ? "write" : fnName.includes("unlink") || fnName === "rm" || fnName === "rmSync" ? "delete" : fnName === "sendFile" ? "send" : "read";
+              findings.push({
+                ruleId: "path-traversal",
+                file: file.relativePath,
+                line: lineNum,
+                column: col,
+                message: fnName === "path.join" ? "path.join with user input \u2014 still vulnerable to traversal with ../" : `File ${action} with user-controlled path \u2014 allows ${action === "send" ? "sending" : action + "ing"} arbitrary files`,
+                severity: "critical",
+                category: "security",
+                fix: "Validate the resolved path starts with an expected base directory: path.resolve(base, input).startsWith(path.resolve(base))"
+              });
+              return;
+            }
+            if (arg.type === "Identifier" && SUSPICIOUS_PATH_VARS.has(arg.name)) {
+              findings.push({
+                ruleId: "path-traversal",
+                file: file.relativePath,
+                line: lineNum,
+                column: col,
+                message: `File operation with potentially user-controlled path \u2014 validate before use`,
+                severity: "warning",
+                category: "security",
+                fix: "Validate the resolved path starts with an expected base directory: path.resolve(base, input).startsWith(path.resolve(base))"
+              });
+              return;
+            }
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     const hasSanitization = SANITIZATION_PATTERNS.some((p) => p.test(file.content));
     if (hasSanitization) return [];
-    const findings = [];
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
@@ -3225,18 +3857,31 @@ var hydrationMismatchRule = {
     if (!/(?:^|\/)(?:src\/)?app\//.test(file.relativePath)) return [];
     if (/route\.[jt]sx?$/.test(file.relativePath)) return [];
     const findings = [];
+    let useEffectRanges = [];
+    if (file.ast) {
+      try {
+        useEffectRanges = findUseEffectRanges(file.ast);
+      } catch {
+      }
+    }
+    const hasAstRanges = useEffectRanges.length > 0 || file.ast != null;
     let insideUseEffect = false;
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
-      if (/\buseEffect\s*\(/.test(line)) {
-        insideUseEffect = true;
-      }
-      if (insideUseEffect) {
-        if (/^\s*\}\s*,\s*\[/.test(line) || /^\s*\}\s*\)\s*;?\s*$/.test(line)) {
-          insideUseEffect = false;
+      if (hasAstRanges) {
+        const inEffect = useEffectRanges.some((r) => i >= r.start && i <= r.end);
+        if (inEffect) continue;
+      } else {
+        if (/\buseEffect\s*\(/.test(line)) {
+          insideUseEffect = true;
+        }
+        if (insideUseEffect) {
+          if (/^\s*\}\s*,\s*\[/.test(line) || /^\s*\}\s*\)\s*;?\s*$/.test(line)) {
+            insideUseEffect = false;
+          }
+          continue;
         }
-        continue;
       }
       for (const { pattern, msg } of [...BROWSER_ONLY_PATTERNS, ...NONDETERMINISTIC_PATTERNS]) {
         const match = pattern.exec(line);
@@ -3461,6 +4106,7 @@ var HAS_EXPIRY = [
   /expirationTime/,
   /maxAge/
 ];
+var EXPIRY_KEYS = /* @__PURE__ */ new Set(["expiresIn", "exp", "expirationTime", "maxAge"]);
 var jwtNoExpiryRule = {
   id: "jwt-no-expiry",
   name: "JWT Without Expiration",
@@ -3472,6 +4118,55 @@ var jwtNoExpiryRule = {
     if (isTestFile(file.relativePath)) return [];
     if (!JWT_SIGN.test(file.content)) return [];
     const findings = [];
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "CallExpression") return;
+          const call = node;
+          if (!call.loc) return;
+          if (call.callee.type !== "MemberExpression") return;
+          const mem = call.callee;
+          if (mem.object.type !== "Identifier" || mem.object.name !== "jwt") return;
+          if (mem.property.type !== "Identifier" || mem.property.name !== "sign") return;
+          let hasExpiry = false;
+          for (const arg of call.arguments) {
+            if (arg.type === "ObjectExpression") {
+              const obj = arg;
+              for (const prop of obj.properties) {
+                if (prop.type === "ObjectProperty" && prop.key.type === "Identifier" && EXPIRY_KEYS.has(prop.key.name)) {
+                  hasExpiry = true;
+                  break;
+                }
+              }
+            }
+            if (hasExpiry) break;
+          }
+          if (!hasExpiry && call.arguments[0]?.type === "ObjectExpression") {
+            const payload = call.arguments[0];
+            for (const prop of payload.properties) {
+              if (prop.type === "ObjectProperty" && prop.key.type === "Identifier" && prop.key.name === "exp") {
+                hasExpiry = true;
+                break;
+              }
+            }
+          }
+          if (!hasExpiry) {
+            findings.push({
+              ruleId: "jwt-no-expiry",
+              file: file.relativePath,
+              line: call.loc.start.line,
+              column: call.loc.start.column + 1,
+              message: "jwt.sign() without expiresIn \u2014 tokens never expire, a compromised token is valid forever",
+              severity: "warning",
+              category: "security",
+              fix: 'Add expiration: jwt.sign(payload, secret, { expiresIn: "1h" })'
+            });
+          }
+        });
+        return findings;
+      } catch {
+      }
+    }
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];