prodlint 0.8.0 → 0.9.0

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.8.0
+  prodlint v0.9.0
   Scanned 148 files · 3 critical · 5 warnings
 
   src/app/api/checkout/route.ts
@@ -72,7 +72,7 @@ npm i -g prodlint     # Global install
 | `auth-checks` | API routes with no authentication |
 | `env-exposure` | `NEXT_PUBLIC_` on server-only secrets |
 | `input-validation` | Request body used without validation |
-| `cors-config` | `Access-Control-Allow-Origin: *` |
+| `cors-config` | `Access-Control-Allow-Origin: *`, wildcard + credentials escalated to critical |
 | `unsafe-html` | `dangerouslySetInnerHTML` with user data |
 | `sql-injection` | String-interpolated SQL queries (ORM-aware) |
 | `open-redirect` | User input passed to `redirect()` |
@@ -121,7 +121,7 @@ npm i -g prodlint     # Global install
 | `no-unbounded-query` | `.findMany()` / `.select('*')` with no limit |
 | `no-dynamic-import-loop` | `import()` inside loops |
 | `server-component-fetch-self` | Server components fetching their own API routes |
-| `missing-abort-controller` | Fetch calls without timeout or AbortController |
+| `missing-abort-controller` | Fetch/axios calls without timeout or AbortController |
 
 ### AI Quality (8 rules)
 

package/dist/cli.js

@@ -749,7 +749,8 @@ var secretsRule = {
             column: match.index + 1,
             message: `Hardcoded ${name} detected`,
             severity: "critical",
-            category: "security"
+            category: "security",
+            fix: "Move the secret to an environment variable and access via process.env.SECRET_NAME"
           });
         }
       }
@@ -833,7 +834,8 @@ var hallucinatedImportsRule = {
             column: 1,
             message: `Package "${pkgName}" is imported but not in package.json`,
             severity: isNonProd ? "warning" : "critical",
-            category: "reliability"
+            category: "reliability",
+            fix: "Verify the package exists on npm. The AI may have invented this package name."
           });
         }
         return findings;
@@ -861,7 +863,8 @@ var hallucinatedImportsRule = {
           column: match.index + 1,
           message: `Package "${pkgName}" is imported but not in package.json`,
           severity: isNonProd ? "warning" : "critical",
-          category: "reliability"
+          category: "reliability",
+          fix: "Verify the package exists on npm. The AI may have invented this package name."
         });
       }
     }
@@ -944,7 +947,8 @@ var authChecksRule = {
       column: 1,
       message,
       severity,
-      category: "security"
+      category: "security",
+      fix: "Add authentication check: const session = await auth(); if (!session) return new Response('Unauthorized', { status: 401 })"
     }];
   }
 };
@@ -983,7 +987,8 @@ var envExposureRule = {
           column: 1,
           message: ".env is not listed in .gitignore \u2014 secrets may be committed",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Add .env to .gitignore to prevent committing secrets"
         });
       }
       return findings;
@@ -1005,7 +1010,8 @@ var envExposureRule = {
           column: match.index + 1,
           message: isSensitive ? `Sensitive server env var "${envName}" used in client component` : `Server env var "${envName}" used in client component (will be undefined at runtime)`,
           severity: isSensitive ? "critical" : "warning",
-          category: "security"
+          category: "security",
+          fix: "Move to server-only file or use NEXT_PUBLIC_ prefix only for non-sensitive values"
         });
       }
     }
@@ -1043,7 +1049,8 @@ var errorHandlingRule = {
       column: 1,
       message: "API route handler has no try/catch block",
       severity: "warning",
-      category: "reliability"
+      category: "reliability",
+      fix: "Wrap the handler body in try/catch and return appropriate error responses"
     }];
   }
 };
@@ -1101,7 +1108,8 @@ var inputValidationRule = {
       column: 1,
       message: "Request body accessed without validation (consider using Zod, Yup, or similar)",
       severity: "warning",
-      category: "security"
+      category: "security",
+      fix: "Validate input with Zod or a similar schema library before using it"
     }];
   }
 };
@@ -1158,12 +1166,22 @@ var rateLimitingRule = {
       column: 1,
       message: "No rate limiting \u2014 anyone could spam this endpoint and run up your API costs",
       severity: "info",
-      category: "security"
+      category: "security",
+      fix: "Add rate limiting: import { Ratelimit } from '@upstash/ratelimit' or use express-rate-limit"
     }];
   }
 };
 
 // src/rules/cors-config.ts
+function hasCredentialsNearby(lines, startLine, commentMap) {
+  const end = Math.min(lines.length, startLine + 8);
+  for (let j = startLine; j < end; j++) {
+    if (commentMap[j]) continue;
+    if (/credentials\s*:\s*true/.test(lines[j])) return true;
+    if (/Access-Control-Allow-Credentials['"]\s*[,:]\s*['"]true['"]/.test(lines[j])) return true;
+  }
+  return false;
+}
 var corsConfigRule = {
   id: "cors-config",
   name: "Permissive CORS",
@@ -1177,14 +1195,16 @@ var corsConfigRule = {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
       if (/['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/.test(line)) {
+        const withCreds = hasCredentialsNearby(file.lines, i, file.commentMap);
         findings.push({
           ruleId: "cors-config",
           file: file.relativePath,
           line: i + 1,
           column: line.indexOf("Access-Control") + 1,
-          message: 'Access-Control-Allow-Origin set to "*" allows any domain',
-          severity: "warning",
-          category: "security"
+          message: withCreds ? "CORS wildcard with credentials allows any site to make authenticated requests" : 'Access-Control-Allow-Origin set to "*" allows any domain',
+          severity: withCreds ? "critical" : "warning",
+          category: "security",
+          fix: withCreds ? "Never use credentials with wildcard origin. Set origin to specific trusted domains." : "Restrict origin to specific domains: origin: ['https://yourdomain.com']"
         });
       }
       if (/cors\(\s*\)/.test(line)) {
@@ -1195,18 +1215,21 @@ var corsConfigRule = {
           column: line.indexOf("cors(") + 1,
           message: "cors() called without config allows all origins",
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Pass explicit options: cors({ origin: 'https://yourdomain.com' })"
         });
       }
       if (/origin\s*:\s*['"]\*['"]/.test(line)) {
+        const withCreds = hasCredentialsNearby(file.lines, i, file.commentMap);
         findings.push({
           ruleId: "cors-config",
           file: file.relativePath,
           line: i + 1,
           column: line.indexOf("origin") + 1,
-          message: 'CORS origin set to "*" allows any domain',
-          severity: "warning",
-          category: "security"
+          message: withCreds ? "CORS wildcard with credentials allows any site to make authenticated requests" : 'CORS origin set to "*" allows any domain',
+          severity: withCreds ? "critical" : "warning",
+          category: "security",
+          fix: withCreds ? "Never use credentials with wildcard origin. Set origin to specific trusted domains." : "Restrict origin to specific domains: origin: ['https://yourdomain.com']"
         });
       }
       if (/origin\s*:\s*true/.test(line)) {
@@ -1217,7 +1240,8 @@ var corsConfigRule = {
           column: line.indexOf("origin") + 1,
           message: "CORS origin set to true mirrors any requesting origin",
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Set origin to specific domains instead of reflecting the request origin"
         });
       }
     }
@@ -1260,7 +1284,8 @@ var aiSmellsRule = {
             column: line.indexOf(todoMatch[1]) + 1,
             message: `${todoMatch[1]} comment: ${todoMatch[2].trim() || "(no description)"}`,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Resolve the TODO/FIXME before shipping to production"
           });
         }
         const commentContent = trimmed.slice(2).trim();
@@ -1275,7 +1300,8 @@ var aiSmellsRule = {
               column: 1,
               message: `${COMMENTED_CODE_THRESHOLD}+ consecutive lines of commented-out code`,
               severity: "info",
-              category: "ai-quality"
+              category: "ai-quality",
+              fix: "Remove commented-out code \u2014 use version control to recover old code if needed"
             });
           }
         } else {
@@ -1292,7 +1318,8 @@ var aiSmellsRule = {
           column: 1,
           message: 'Placeholder "not implemented" function',
           severity: "warning",
-          category: "ai-quality"
+          category: "ai-quality",
+          fix: "Replace with a production-ready implementation or remove the function"
         });
       }
       if (/console\.log\s*\(/.test(line)) {
@@ -1310,7 +1337,8 @@ var aiSmellsRule = {
         column: 1,
         message: `${consoleLogCount} console.log statements (consider a proper logger)`,
         severity: "warning",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Replace console.log with a structured logger (e.g., pino, winston) or remove debug logs"
       });
     }
     if (anyTypeCount > ANY_TYPE_THRESHOLD) {
@@ -1321,7 +1349,8 @@ var aiSmellsRule = {
         column: 1,
         message: `${anyTypeCount} uses of "any" type (consider proper typing)`,
         severity: "warning",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: 'Replace "any" with specific types or use "unknown" with type narrowing'
       });
     }
     return findings;
@@ -1363,7 +1392,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
                 message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1389,7 +1419,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
                 message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1404,7 +1435,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf(".innerHTML") + 1,
                 message: "Direct innerHTML assignment is an XSS risk",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1432,7 +1464,8 @@ var unsafeHtmlRule = {
           column: line.indexOf("dangerouslySetInnerHTML") + 1,
           message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
       if (/\w\.innerHTML\s*=/.test(line)) {
@@ -1443,7 +1476,8 @@ var unsafeHtmlRule = {
           column: line.indexOf(".innerHTML") + 1,
           message: "Direct innerHTML assignment is an XSS risk",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
     }
@@ -1505,7 +1539,8 @@ var sqlInjectionRule = {
             column: 1,
             message,
             severity,
-            category: "security"
+            category: "security",
+            fix: "Use parameterized queries: db.query('SELECT * FROM users WHERE id = $1', [id])"
           });
           break;
         }
@@ -1553,7 +1588,8 @@ var placeholderContentRule = {
             column: match.index + 1,
             message: label,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Replace placeholder content with real production values before deploying"
           });
           break;
         }
@@ -1599,7 +1635,8 @@ var staleFallbackRule = {
             column: match.index + 1,
             message: `${label} \u2014 use environment variable instead`,
             severity: "warning",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Replace hardcoded URL with an environment variable: process.env.DATABASE_URL or similar"
           });
           break;
         }
@@ -1645,7 +1682,8 @@ var hallucinatedApiRule = {
             column: match.index + 1,
             message: fix,
             severity: "warning",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix
           });
         }
       }
@@ -1727,7 +1765,8 @@ var openRedirectRule = {
               column: col,
               message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
               severity: "warning",
-              category: "security"
+              category: "security",
+              fix: "Validate the redirect URL against an allowlist of trusted domains"
             });
             return;
           }
@@ -1739,7 +1778,8 @@ var openRedirectRule = {
               column: col,
               message: "Possible user input in redirect \u2014 verify the URL is validated before use",
               severity: "warning",
-              category: "security"
+              category: "security",
+              fix: "Validate the redirect URL against an allowlist of trusted domains"
             });
           }
         });
@@ -1760,7 +1800,8 @@ var openRedirectRule = {
             column: match.index + 1,
             message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
             severity: "warning",
-            category: "security"
+            category: "security",
+            fix: "Validate the redirect URL against an allowlist of trusted domains"
           });
           break;
         }
@@ -1776,7 +1817,8 @@ var openRedirectRule = {
             column: match.index + 1,
             message: "Possible user input in redirect \u2014 verify the URL is validated before use",
             severity: "warning",
-            category: "security"
+            category: "security",
+            fix: "Validate the redirect URL against an allowlist of trusted domains"
           });
           break;
         }
@@ -1814,7 +1856,8 @@ var noSyncFsRule = {
           column: match.index + 1,
           message: `Synchronous ${fnName}() blocks the event loop \u2014 use async alternative`,
           severity,
-          category: "performance"
+          category: "performance",
+          fix: `Use the async version: fs.promises.${fnName.replace("Sync", "")}() instead of ${fnName}()`
         });
       }
     }
@@ -1872,7 +1915,8 @@ var noNPlusOneRule = {
             column: match.index + 1,
             message: "Database/fetch call inside loop \u2014 potential N+1 query, consider batching",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Use eager loading (include/join) or batch the queries outside the loop"
           });
           break;
         }
@@ -1908,7 +1952,8 @@ var noDynamicImportLoopRule = {
             column: match.index + 1,
             message: "Dynamic import() inside loop \u2014 move import outside or use Promise.all",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Move the dynamic import outside the loop and call it once"
           });
         }
       }
@@ -1940,7 +1985,8 @@ var noUnboundedQueryRule = {
           column: line.indexOf(".findMany") + 1,
           message: ".findMany() without take/limit \u2014 query may return unbounded results",
           severity: "warning",
-          category: "performance"
+          category: "performance",
+          fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
         });
         continue;
       }
@@ -1954,7 +2000,8 @@ var noUnboundedQueryRule = {
             column: line.indexOf(".findMany") + 1,
             message: ".findMany() without take \u2014 add pagination or limit",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
           });
         }
         continue;
@@ -1970,7 +2017,8 @@ var noUnboundedQueryRule = {
             column: line.indexOf(".select") + 1,
             message: ".select('*') without .limit() or filter \u2014 add pagination or a where clause",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
           });
         }
       }
@@ -2049,7 +2097,8 @@ var unhandledPromiseRule = {
         column: col ? col.index + 1 : 1,
         message: "Async call without await, return, or assignment \u2014 promise result is lost",
         severity: "warning",
-        category: "reliability"
+        category: "reliability",
+        fix: "Add .catch() handler or use try/catch with await"
       });
     }
     return findings;
@@ -2081,7 +2130,8 @@ var missingLoadingStateRule = {
           column: 1,
           message: "useEffect with fetch but no loading/pending state \u2014 users see empty content during load",
           severity: "info",
-          category: "reliability"
+          category: "reliability",
+          fix: "Add a loading state: const [loading, setLoading] = useState(true) and show a spinner/skeleton while loading"
         }];
       }
     }
@@ -2112,7 +2162,8 @@ var missingErrorBoundaryRule = {
       column: 1,
       message: `Layout without error.tsx \u2014 errors in ${dir} will bubble up to parent error boundary`,
       severity: "info",
-      category: "reliability"
+      category: "reliability",
+      fix: "Add an error.tsx file in the same route segment to catch rendering errors"
     }];
   }
 };
@@ -2250,7 +2301,8 @@ var codebaseConsistencyRule = {
         column: 1,
         message: `${dim.label}: ${consistency}% consistent \u2014 dominant: ${dominant} (${dominantCount} files), minority: ${minorities.join(", ")}`,
         severity: consistency < 60 ? "warning" : "info",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Standardize on one pattern across the codebase for consistency"
       });
     }
     return findings;
@@ -2260,7 +2312,7 @@ var codebaseConsistencyRule = {
 // src/rules/dead-exports.ts
 function isEntryPoint(relativePath) {
   const name = relativePath.split("/").pop() ?? "";
-  return /^(page|layout|loading|error|not-found|route|middleware|instrumentation)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
+  return /^(page|layout|loading|error|not-found|route|middleware|instrumentation|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
 }
 var THRESHOLD = 5;
 var deadExportsRule = {
@@ -2283,8 +2335,31 @@ var deadExportsRule = {
     const importedFiles = /* @__PURE__ */ new Set();
     for (const file of sourceFiles) {
       if (isEntryPoint(file.relativePath)) continue;
+      let inTemplateLiteral = false;
       for (let i = 0; i < file.lines.length; i++) {
         const line = file.lines[i];
+        let backtickCount = 0;
+        for (let j = 0; j < line.length; j++) {
+          if (line[j] === "\\") {
+            j++;
+            continue;
+          }
+          if (line[j] === "`") backtickCount++;
+        }
+        if (backtickCount % 2 === 1) inTemplateLiteral = !inTemplateLiteral;
+        if (inTemplateLiteral && backtickCount % 2 === 0) continue;
+        const exportIdx = line.indexOf("export");
+        if (exportIdx >= 0) {
+          let inStr = false;
+          for (let j = 0; j < exportIdx; j++) {
+            if (line[j] === "\\") {
+              j++;
+              continue;
+            }
+            if (line[j] === "'" || line[j] === '"' || line[j] === "`") inStr = !inStr;
+          }
+          if (inStr) continue;
+        }
         let match;
         const namedRe = /export\s+(?:async\s+)?(?:function|const|let|class|enum)\s+(\w+)/g;
         while ((match = namedRe.exec(line)) !== null) {
@@ -2356,7 +2431,8 @@ var deadExportsRule = {
         column: 1,
         message: `${totalDead} exported symbols never imported \u2014 dead exports pollute AI context. Top files: ${topFiles.join(", ")}`,
         severity: totalDead > 20 ? "warning" : "info",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Remove the unused export or add a consumer"
       });
     }
     return findings;
@@ -2420,7 +2496,8 @@ var shallowCatchRule = {
               column: file.lines[catchLine].indexOf("catch") + 1,
               message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
               severity: score === 0 ? "warning" : "info",
-              category: "reliability"
+              category: "reliability",
+              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
             });
           }
         });
@@ -2488,7 +2565,8 @@ var shallowCatchRule = {
           column: file.lines[i].indexOf("catch") + 1,
           message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
           severity: score === 0 ? "warning" : "info",
-          category: "reliability"
+          category: "reliability",
+          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
         });
       }
       i = bodyEnd;
@@ -2540,7 +2618,8 @@ var comprehensionDebtRule = {
             column: 1,
             message: `${fnName}() has ${params} parameters (max ${MAX_PARAMS}) \u2014 hard to call correctly`,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Group related parameters into an options object"
           });
         }
       }
@@ -2567,7 +2646,8 @@ var comprehensionDebtRule = {
                 column: 1,
                 message: `${fnName}() is ${length} lines long (max ${MAX_FUNCTION_LENGTH}) \u2014 consider splitting`,
                 severity: "info",
-                category: "ai-quality"
+                category: "ai-quality",
+                fix: "Break this into smaller, focused functions with clear names"
               });
             }
             if (maxDepthInFn > MAX_NESTING_DEPTH) {
@@ -2578,7 +2658,8 @@ var comprehensionDebtRule = {
                 column: 1,
                 message: `${fnName}() has nesting depth ${maxDepthInFn} (max ${MAX_NESTING_DEPTH}) \u2014 flatten with early returns`,
                 severity: "info",
-                category: "ai-quality"
+                category: "ai-quality",
+                fix: "Reduce nesting with early returns, guard clauses, or extracted helper functions"
               });
             }
             inFunction = false;
@@ -2685,7 +2766,8 @@ var phantomDependencyRule = {
           column: 1,
           message: `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Add the missing package to dependencies in package.json, or remove the import if the package is hallucinated"
         });
       }
       for (const pattern of SUSPICIOUS_PATTERNS) {
@@ -2697,7 +2779,8 @@ var phantomDependencyRule = {
             column: 1,
             message: `"${name}" has a suspicious package name pattern \u2014 verify it's legitimate`,
             severity: "info",
-            category: "security"
+            category: "security",
+            fix: "Verify the package on npm \u2014 suspicious names may indicate typosquatting or hallucination"
           });
           break;
         }
@@ -3450,7 +3533,8 @@ var evalInjectionRule = {
             column: match.index + 1,
             message: msg,
             severity: "critical",
-            category: "security"
+            category: "security",
+            fix: "Replace eval/Function constructor with a safe alternative like JSON.parse() or a sandboxed interpreter"
           });
           break;
         }
@@ -3853,6 +3937,8 @@ var hydrationMismatchRule = {
     if (isClientComponent(file.content)) return [];
     if (!/(?:^|\/)(?:src\/)?app\//.test(file.relativePath)) return [];
     if (/route\.[jt]sx?$/.test(file.relativePath)) return [];
+    if (/(?:^|\/)(?:src\/)?app\/(?:lib|utils|helpers|server|actions)\//.test(file.relativePath)) return [];
+    if (/\.[jt]s$/.test(file.relativePath) && !/<[A-Z]/.test(file.content)) return [];
     const findings = [];
     let useEffectRanges = [];
     if (file.ast) {
@@ -4245,44 +4331,57 @@ var clientSideAuthOnlyRule = {
 };
 
 // src/rules/missing-abort-controller.ts
-var FETCH_CALL = /\bfetch\s*\(/;
+var HTTP_CALL = /\b(fetch|axios)\s*[.(]/;
 var HAS_TIMEOUT = [
   /AbortController/,
   /abort/i,
   /signal\s*:/,
-  /timeout/i,
-  /setTimeout.*abort/s
+  /timeout\s*:/,
+  /timeout\s*=/,
+  /setTimeout.*abort/s,
+  /axios\.create\s*\([^)]*timeout/s
 ];
+var BACKGROUND_PATTERN = /\b(setInterval|cron|schedule|createWorker|bullmq|agenda|queue\.process)\b/;
+function isBackgroundFile(file) {
+  if (BACKGROUND_PATTERN.test(file.content)) return true;
+  const p = file.relativePath.toLowerCase();
+  return /\b(cron|jobs?|workers?|queues?|tasks?|background)\b/.test(p);
+}
 var missingAbortControllerRule = {
   id: "missing-abort-controller",
   name: "Missing Abort Controller",
-  description: "Detects fetch calls in API routes without timeout or AbortController \u2014 requests can hang indefinitely",
+  description: "Detects fetch/axios calls without timeout or AbortController \u2014 requests can hang indefinitely",
   category: "performance",
   severity: "info",
   fileExtensions: ["ts", "tsx", "js", "jsx"],
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
-    if (!isApiRoute(file.relativePath) && !/['"]use server['"]/.test(file.content)) return [];
-    if (!FETCH_CALL.test(file.content)) return [];
+    const isRelevant = isApiRoute(file.relativePath) || /['"]use server['"]/.test(file.content) || isBackgroundFile(file);
+    if (!isRelevant) return [];
+    if (!HTTP_CALL.test(file.content)) return [];
     const hasTimeout = HAS_TIMEOUT.some((p) => p.test(file.content));
     if (hasTimeout) return [];
     let reportLine = 1;
+    let matchedCall = "fetch";
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      if (FETCH_CALL.test(file.lines[i])) {
+      const m = file.lines[i].match(HTTP_CALL);
+      if (m) {
         reportLine = i + 1;
+        matchedCall = m[1];
         break;
       }
     }
+    const isFetch = matchedCall === "fetch";
     return [{
       ruleId: "missing-abort-controller",
       file: file.relativePath,
       line: reportLine,
       column: 1,
-      message: "fetch() without timeout or AbortController \u2014 request will hang indefinitely if the upstream server doesn't respond",
+      message: `${matchedCall}() without timeout or AbortController \u2014 request will hang indefinitely if the upstream server doesn't respond`,
       severity: "info",
       category: "performance",
-      fix: "Add a timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 10000); fetch(url, { signal: controller.signal })"
+      fix: isFetch ? "Add a timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 10000); fetch(url, { signal: controller.signal })" : "Add a timeout: axios.get(url, { timeout: 10000 }) or configure in axios.create({ timeout: 10000 })"
     }];
   }
 };