prodlint 0.8.0 → 0.9.0

package/dist/mcp.js

@@ -5,7 +5,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { stat as stat2 } from "fs/promises";
-import { resolve as resolve4 } from "path";
+import { resolve as resolve4, sep as sep2 } from "path";
 
 // src/utils/file-walker.ts
 import fg from "fast-glob";
@@ -753,7 +753,8 @@ var secretsRule = {
             column: match.index + 1,
             message: `Hardcoded ${name} detected`,
             severity: "critical",
-            category: "security"
+            category: "security",
+            fix: "Move the secret to an environment variable and access via process.env.SECRET_NAME"
           });
         }
       }
@@ -837,7 +838,8 @@ var hallucinatedImportsRule = {
             column: 1,
             message: `Package "${pkgName}" is imported but not in package.json`,
             severity: isNonProd ? "warning" : "critical",
-            category: "reliability"
+            category: "reliability",
+            fix: "Verify the package exists on npm. The AI may have invented this package name."
           });
         }
         return findings;
@@ -865,7 +867,8 @@ var hallucinatedImportsRule = {
           column: match.index + 1,
           message: `Package "${pkgName}" is imported but not in package.json`,
           severity: isNonProd ? "warning" : "critical",
-          category: "reliability"
+          category: "reliability",
+          fix: "Verify the package exists on npm. The AI may have invented this package name."
         });
       }
     }
@@ -948,7 +951,8 @@ var authChecksRule = {
       column: 1,
       message,
       severity,
-      category: "security"
+      category: "security",
+      fix: "Add authentication check: const session = await auth(); if (!session) return new Response('Unauthorized', { status: 401 })"
     }];
   }
 };
@@ -987,7 +991,8 @@ var envExposureRule = {
           column: 1,
           message: ".env is not listed in .gitignore \u2014 secrets may be committed",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Add .env to .gitignore to prevent committing secrets"
         });
       }
       return findings;
@@ -1009,7 +1014,8 @@ var envExposureRule = {
           column: match.index + 1,
           message: isSensitive ? `Sensitive server env var "${envName}" used in client component` : `Server env var "${envName}" used in client component (will be undefined at runtime)`,
           severity: isSensitive ? "critical" : "warning",
-          category: "security"
+          category: "security",
+          fix: "Move to server-only file or use NEXT_PUBLIC_ prefix only for non-sensitive values"
         });
       }
     }
@@ -1047,7 +1053,8 @@ var errorHandlingRule = {
       column: 1,
       message: "API route handler has no try/catch block",
       severity: "warning",
-      category: "reliability"
+      category: "reliability",
+      fix: "Wrap the handler body in try/catch and return appropriate error responses"
     }];
   }
 };
@@ -1105,7 +1112,8 @@ var inputValidationRule = {
       column: 1,
       message: "Request body accessed without validation (consider using Zod, Yup, or similar)",
       severity: "warning",
-      category: "security"
+      category: "security",
+      fix: "Validate input with Zod or a similar schema library before using it"
     }];
   }
 };
@@ -1162,12 +1170,22 @@ var rateLimitingRule = {
       column: 1,
       message: "No rate limiting \u2014 anyone could spam this endpoint and run up your API costs",
       severity: "info",
-      category: "security"
+      category: "security",
+      fix: "Add rate limiting: import { Ratelimit } from '@upstash/ratelimit' or use express-rate-limit"
     }];
   }
 };
 
 // src/rules/cors-config.ts
+function hasCredentialsNearby(lines, startLine, commentMap) {
+  const end = Math.min(lines.length, startLine + 8);
+  for (let j = startLine; j < end; j++) {
+    if (commentMap[j]) continue;
+    if (/credentials\s*:\s*true/.test(lines[j])) return true;
+    if (/Access-Control-Allow-Credentials['"]\s*[,:]\s*['"]true['"]/.test(lines[j])) return true;
+  }
+  return false;
+}
 var corsConfigRule = {
   id: "cors-config",
   name: "Permissive CORS",
@@ -1181,14 +1199,16 @@ var corsConfigRule = {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
       if (/['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/.test(line)) {
+        const withCreds = hasCredentialsNearby(file.lines, i, file.commentMap);
         findings.push({
           ruleId: "cors-config",
           file: file.relativePath,
           line: i + 1,
           column: line.indexOf("Access-Control") + 1,
-          message: 'Access-Control-Allow-Origin set to "*" allows any domain',
-          severity: "warning",
-          category: "security"
+          message: withCreds ? "CORS wildcard with credentials allows any site to make authenticated requests" : 'Access-Control-Allow-Origin set to "*" allows any domain',
+          severity: withCreds ? "critical" : "warning",
+          category: "security",
+          fix: withCreds ? "Never use credentials with wildcard origin. Set origin to specific trusted domains." : "Restrict origin to specific domains: origin: ['https://yourdomain.com']"
         });
       }
       if (/cors\(\s*\)/.test(line)) {
@@ -1199,18 +1219,21 @@ var corsConfigRule = {
           column: line.indexOf("cors(") + 1,
           message: "cors() called without config allows all origins",
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Pass explicit options: cors({ origin: 'https://yourdomain.com' })"
         });
       }
       if (/origin\s*:\s*['"]\*['"]/.test(line)) {
+        const withCreds = hasCredentialsNearby(file.lines, i, file.commentMap);
         findings.push({
           ruleId: "cors-config",
           file: file.relativePath,
           line: i + 1,
           column: line.indexOf("origin") + 1,
-          message: 'CORS origin set to "*" allows any domain',
-          severity: "warning",
-          category: "security"
+          message: withCreds ? "CORS wildcard with credentials allows any site to make authenticated requests" : 'CORS origin set to "*" allows any domain',
+          severity: withCreds ? "critical" : "warning",
+          category: "security",
+          fix: withCreds ? "Never use credentials with wildcard origin. Set origin to specific trusted domains." : "Restrict origin to specific domains: origin: ['https://yourdomain.com']"
         });
       }
       if (/origin\s*:\s*true/.test(line)) {
@@ -1221,7 +1244,8 @@ var corsConfigRule = {
           column: line.indexOf("origin") + 1,
           message: "CORS origin set to true mirrors any requesting origin",
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Set origin to specific domains instead of reflecting the request origin"
         });
       }
     }
@@ -1264,7 +1288,8 @@ var aiSmellsRule = {
             column: line.indexOf(todoMatch[1]) + 1,
             message: `${todoMatch[1]} comment: ${todoMatch[2].trim() || "(no description)"}`,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Resolve the TODO/FIXME before shipping to production"
           });
         }
         const commentContent = trimmed.slice(2).trim();
@@ -1279,7 +1304,8 @@ var aiSmellsRule = {
               column: 1,
               message: `${COMMENTED_CODE_THRESHOLD}+ consecutive lines of commented-out code`,
               severity: "info",
-              category: "ai-quality"
+              category: "ai-quality",
+              fix: "Remove commented-out code \u2014 use version control to recover old code if needed"
             });
           }
         } else {
@@ -1296,7 +1322,8 @@ var aiSmellsRule = {
           column: 1,
           message: 'Placeholder "not implemented" function',
           severity: "warning",
-          category: "ai-quality"
+          category: "ai-quality",
+          fix: "Replace with a production-ready implementation or remove the function"
         });
       }
       if (/console\.log\s*\(/.test(line)) {
@@ -1314,7 +1341,8 @@ var aiSmellsRule = {
         column: 1,
         message: `${consoleLogCount} console.log statements (consider a proper logger)`,
         severity: "warning",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Replace console.log with a structured logger (e.g., pino, winston) or remove debug logs"
       });
     }
     if (anyTypeCount > ANY_TYPE_THRESHOLD) {
@@ -1325,7 +1353,8 @@ var aiSmellsRule = {
         column: 1,
         message: `${anyTypeCount} uses of "any" type (consider proper typing)`,
         severity: "warning",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: 'Replace "any" with specific types or use "unknown" with type narrowing'
       });
     }
     return findings;
@@ -1367,7 +1396,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
                 message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1393,7 +1423,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
                 message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1408,7 +1439,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf(".innerHTML") + 1,
                 message: "Direct innerHTML assignment is an XSS risk",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1436,7 +1468,8 @@ var unsafeHtmlRule = {
           column: line.indexOf("dangerouslySetInnerHTML") + 1,
           message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
       if (/\w\.innerHTML\s*=/.test(line)) {
@@ -1447,7 +1480,8 @@ var unsafeHtmlRule = {
           column: line.indexOf(".innerHTML") + 1,
           message: "Direct innerHTML assignment is an XSS risk",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
     }
@@ -1509,7 +1543,8 @@ var sqlInjectionRule = {
             column: 1,
             message,
             severity,
-            category: "security"
+            category: "security",
+            fix: "Use parameterized queries: db.query('SELECT * FROM users WHERE id = $1', [id])"
           });
           break;
         }
@@ -1557,7 +1592,8 @@ var placeholderContentRule = {
             column: match.index + 1,
             message: label,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Replace placeholder content with real production values before deploying"
           });
           break;
         }
@@ -1603,7 +1639,8 @@ var staleFallbackRule = {
             column: match.index + 1,
             message: `${label} \u2014 use environment variable instead`,
             severity: "warning",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Replace hardcoded URL with an environment variable: process.env.DATABASE_URL or similar"
           });
           break;
         }
@@ -1649,7 +1686,8 @@ var hallucinatedApiRule = {
             column: match.index + 1,
             message: fix,
             severity: "warning",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix
           });
         }
       }
@@ -1731,7 +1769,8 @@ var openRedirectRule = {
               column: col,
               message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
               severity: "warning",
-              category: "security"
+              category: "security",
+              fix: "Validate the redirect URL against an allowlist of trusted domains"
             });
             return;
           }
@@ -1743,7 +1782,8 @@ var openRedirectRule = {
               column: col,
               message: "Possible user input in redirect \u2014 verify the URL is validated before use",
               severity: "warning",
-              category: "security"
+              category: "security",
+              fix: "Validate the redirect URL against an allowlist of trusted domains"
             });
           }
         });
@@ -1764,7 +1804,8 @@ var openRedirectRule = {
             column: match.index + 1,
             message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
             severity: "warning",
-            category: "security"
+            category: "security",
+            fix: "Validate the redirect URL against an allowlist of trusted domains"
           });
           break;
         }
@@ -1780,7 +1821,8 @@ var openRedirectRule = {
             column: match.index + 1,
             message: "Possible user input in redirect \u2014 verify the URL is validated before use",
             severity: "warning",
-            category: "security"
+            category: "security",
+            fix: "Validate the redirect URL against an allowlist of trusted domains"
           });
           break;
         }
@@ -1818,7 +1860,8 @@ var noSyncFsRule = {
           column: match.index + 1,
           message: `Synchronous ${fnName}() blocks the event loop \u2014 use async alternative`,
           severity,
-          category: "performance"
+          category: "performance",
+          fix: `Use the async version: fs.promises.${fnName.replace("Sync", "")}() instead of ${fnName}()`
         });
       }
     }
@@ -1876,7 +1919,8 @@ var noNPlusOneRule = {
             column: match.index + 1,
             message: "Database/fetch call inside loop \u2014 potential N+1 query, consider batching",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Use eager loading (include/join) or batch the queries outside the loop"
           });
           break;
         }
@@ -1912,7 +1956,8 @@ var noDynamicImportLoopRule = {
             column: match.index + 1,
             message: "Dynamic import() inside loop \u2014 move import outside or use Promise.all",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Move the dynamic import outside the loop and call it once"
           });
         }
       }
@@ -1944,7 +1989,8 @@ var noUnboundedQueryRule = {
           column: line.indexOf(".findMany") + 1,
           message: ".findMany() without take/limit \u2014 query may return unbounded results",
           severity: "warning",
-          category: "performance"
+          category: "performance",
+          fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
         });
         continue;
       }
@@ -1958,7 +2004,8 @@ var noUnboundedQueryRule = {
             column: line.indexOf(".findMany") + 1,
             message: ".findMany() without take \u2014 add pagination or limit",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
           });
         }
         continue;
@@ -1974,7 +2021,8 @@ var noUnboundedQueryRule = {
             column: line.indexOf(".select") + 1,
             message: ".select('*') without .limit() or filter \u2014 add pagination or a where clause",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
           });
         }
       }
@@ -2053,7 +2101,8 @@ var unhandledPromiseRule = {
         column: col ? col.index + 1 : 1,
         message: "Async call without await, return, or assignment \u2014 promise result is lost",
         severity: "warning",
-        category: "reliability"
+        category: "reliability",
+        fix: "Add .catch() handler or use try/catch with await"
       });
     }
     return findings;
@@ -2085,7 +2134,8 @@ var missingLoadingStateRule = {
           column: 1,
           message: "useEffect with fetch but no loading/pending state \u2014 users see empty content during load",
           severity: "info",
-          category: "reliability"
+          category: "reliability",
+          fix: "Add a loading state: const [loading, setLoading] = useState(true) and show a spinner/skeleton while loading"
         }];
       }
     }
@@ -2116,7 +2166,8 @@ var missingErrorBoundaryRule = {
       column: 1,
       message: `Layout without error.tsx \u2014 errors in ${dir} will bubble up to parent error boundary`,
       severity: "info",
-      category: "reliability"
+      category: "reliability",
+      fix: "Add an error.tsx file in the same route segment to catch rendering errors"
     }];
   }
 };
@@ -2254,7 +2305,8 @@ var codebaseConsistencyRule = {
         column: 1,
         message: `${dim.label}: ${consistency}% consistent \u2014 dominant: ${dominant} (${dominantCount} files), minority: ${minorities.join(", ")}`,
         severity: consistency < 60 ? "warning" : "info",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Standardize on one pattern across the codebase for consistency"
       });
     }
     return findings;
@@ -2264,7 +2316,7 @@ var codebaseConsistencyRule = {
 // src/rules/dead-exports.ts
 function isEntryPoint(relativePath) {
   const name = relativePath.split("/").pop() ?? "";
-  return /^(page|layout|loading|error|not-found|route|middleware|instrumentation)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
+  return /^(page|layout|loading|error|not-found|route|middleware|instrumentation|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
 }
 var THRESHOLD = 5;
 var deadExportsRule = {
@@ -2287,8 +2339,31 @@ var deadExportsRule = {
     const importedFiles = /* @__PURE__ */ new Set();
     for (const file of sourceFiles) {
       if (isEntryPoint(file.relativePath)) continue;
+      let inTemplateLiteral = false;
       for (let i = 0; i < file.lines.length; i++) {
         const line = file.lines[i];
+        let backtickCount = 0;
+        for (let j = 0; j < line.length; j++) {
+          if (line[j] === "\\") {
+            j++;
+            continue;
+          }
+          if (line[j] === "`") backtickCount++;
+        }
+        if (backtickCount % 2 === 1) inTemplateLiteral = !inTemplateLiteral;
+        if (inTemplateLiteral && backtickCount % 2 === 0) continue;
+        const exportIdx = line.indexOf("export");
+        if (exportIdx >= 0) {
+          let inStr = false;
+          for (let j = 0; j < exportIdx; j++) {
+            if (line[j] === "\\") {
+              j++;
+              continue;
+            }
+            if (line[j] === "'" || line[j] === '"' || line[j] === "`") inStr = !inStr;
+          }
+          if (inStr) continue;
+        }
         let match;
         const namedRe = /export\s+(?:async\s+)?(?:function|const|let|class|enum)\s+(\w+)/g;
         while ((match = namedRe.exec(line)) !== null) {
@@ -2360,7 +2435,8 @@ var deadExportsRule = {
         column: 1,
         message: `${totalDead} exported symbols never imported \u2014 dead exports pollute AI context. Top files: ${topFiles.join(", ")}`,
         severity: totalDead > 20 ? "warning" : "info",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Remove the unused export or add a consumer"
       });
     }
     return findings;
@@ -2424,7 +2500,8 @@ var shallowCatchRule = {
               column: file.lines[catchLine].indexOf("catch") + 1,
               message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
               severity: score === 0 ? "warning" : "info",
-              category: "reliability"
+              category: "reliability",
+              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
             });
           }
         });
@@ -2492,7 +2569,8 @@ var shallowCatchRule = {
           column: file.lines[i].indexOf("catch") + 1,
           message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
           severity: score === 0 ? "warning" : "info",
-          category: "reliability"
+          category: "reliability",
+          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
         });
       }
       i = bodyEnd;
@@ -2544,7 +2622,8 @@ var comprehensionDebtRule = {
             column: 1,
             message: `${fnName}() has ${params} parameters (max ${MAX_PARAMS}) \u2014 hard to call correctly`,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Group related parameters into an options object"
           });
         }
       }
@@ -2571,7 +2650,8 @@ var comprehensionDebtRule = {
                 column: 1,
                 message: `${fnName}() is ${length} lines long (max ${MAX_FUNCTION_LENGTH}) \u2014 consider splitting`,
                 severity: "info",
-                category: "ai-quality"
+                category: "ai-quality",
+                fix: "Break this into smaller, focused functions with clear names"
               });
             }
             if (maxDepthInFn > MAX_NESTING_DEPTH) {
@@ -2582,7 +2662,8 @@ var comprehensionDebtRule = {
                 column: 1,
                 message: `${fnName}() has nesting depth ${maxDepthInFn} (max ${MAX_NESTING_DEPTH}) \u2014 flatten with early returns`,
                 severity: "info",
-                category: "ai-quality"
+                category: "ai-quality",
+                fix: "Reduce nesting with early returns, guard clauses, or extracted helper functions"
               });
             }
             inFunction = false;
@@ -2689,7 +2770,8 @@ var phantomDependencyRule = {
           column: 1,
           message: `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Add the missing package to dependencies in package.json, or remove the import if the package is hallucinated"
         });
       }
       for (const pattern of SUSPICIOUS_PATTERNS) {
@@ -2701,7 +2783,8 @@ var phantomDependencyRule = {
             column: 1,
             message: `"${name}" has a suspicious package name pattern \u2014 verify it's legitimate`,
             severity: "info",
-            category: "security"
+            category: "security",
+            fix: "Verify the package on npm \u2014 suspicious names may indicate typosquatting or hallucination"
           });
           break;
         }
@@ -3454,7 +3537,8 @@ var evalInjectionRule = {
             column: match.index + 1,
             message: msg,
             severity: "critical",
-            category: "security"
+            category: "security",
+            fix: "Replace eval/Function constructor with a safe alternative like JSON.parse() or a sandboxed interpreter"
           });
           break;
         }
@@ -3857,6 +3941,8 @@ var hydrationMismatchRule = {
     if (isClientComponent(file.content)) return [];
     if (!/(?:^|\/)(?:src\/)?app\//.test(file.relativePath)) return [];
     if (/route\.[jt]sx?$/.test(file.relativePath)) return [];
+    if (/(?:^|\/)(?:src\/)?app\/(?:lib|utils|helpers|server|actions)\//.test(file.relativePath)) return [];
+    if (/\.[jt]s$/.test(file.relativePath) && !/<[A-Z]/.test(file.content)) return [];
     const findings = [];
     let useEffectRanges = [];
     if (file.ast) {
@@ -4249,44 +4335,57 @@ var clientSideAuthOnlyRule = {
 };
 
 // src/rules/missing-abort-controller.ts
-var FETCH_CALL = /\bfetch\s*\(/;
+var HTTP_CALL = /\b(fetch|axios)\s*[.(]/;
 var HAS_TIMEOUT = [
   /AbortController/,
   /abort/i,
   /signal\s*:/,
-  /timeout/i,
-  /setTimeout.*abort/s
+  /timeout\s*:/,
+  /timeout\s*=/,
+  /setTimeout.*abort/s,
+  /axios\.create\s*\([^)]*timeout/s
 ];
+var BACKGROUND_PATTERN = /\b(setInterval|cron|schedule|createWorker|bullmq|agenda|queue\.process)\b/;
+function isBackgroundFile(file) {
+  if (BACKGROUND_PATTERN.test(file.content)) return true;
+  const p = file.relativePath.toLowerCase();
+  return /\b(cron|jobs?|workers?|queues?|tasks?|background)\b/.test(p);
+}
 var missingAbortControllerRule = {
   id: "missing-abort-controller",
   name: "Missing Abort Controller",
-  description: "Detects fetch calls in API routes without timeout or AbortController \u2014 requests can hang indefinitely",
+  description: "Detects fetch/axios calls without timeout or AbortController \u2014 requests can hang indefinitely",
   category: "performance",
   severity: "info",
   fileExtensions: ["ts", "tsx", "js", "jsx"],
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
-    if (!isApiRoute(file.relativePath) && !/['"]use server['"]/.test(file.content)) return [];
-    if (!FETCH_CALL.test(file.content)) return [];
+    const isRelevant = isApiRoute(file.relativePath) || /['"]use server['"]/.test(file.content) || isBackgroundFile(file);
+    if (!isRelevant) return [];
+    if (!HTTP_CALL.test(file.content)) return [];
     const hasTimeout = HAS_TIMEOUT.some((p) => p.test(file.content));
     if (hasTimeout) return [];
     let reportLine = 1;
+    let matchedCall = "fetch";
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      if (FETCH_CALL.test(file.lines[i])) {
+      const m = file.lines[i].match(HTTP_CALL);
+      if (m) {
         reportLine = i + 1;
+        matchedCall = m[1];
         break;
       }
     }
+    const isFetch = matchedCall === "fetch";
     return [{
       ruleId: "missing-abort-controller",
       file: file.relativePath,
       line: reportLine,
       column: 1,
-      message: "fetch() without timeout or AbortController \u2014 request will hang indefinitely if the upstream server doesn't respond",
+      message: `${matchedCall}() without timeout or AbortController \u2014 request will hang indefinitely if the upstream server doesn't respond`,
       severity: "info",
       category: "performance",
-      fix: "Add a timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 10000); fetch(url, { signal: controller.signal })"
+      fix: isFetch ? "Add a timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 10000); fetch(url, { signal: controller.signal })" : "Add a timeout: axios.get(url, { timeout: 10000 }) or configure in axios.create({ timeout: 10000 })"
     }];
   }
 };
@@ -4659,7 +4758,9 @@ server.tool(
   async ({ path, ignore }) => {
     const resolved = resolve4(path);
     const cwd = process.cwd();
-    if (!resolved.startsWith(cwd)) {
+    const normalizedResolved = process.platform === "win32" ? resolved.toLowerCase() : resolved;
+    const normalizedCwd = process.platform === "win32" ? cwd.toLowerCase() : cwd;
+    if (normalizedResolved !== normalizedCwd && !normalizedResolved.startsWith(normalizedCwd + sep2)) {
       return {
         content: [{ type: "text", text: `Error: Path must be within the current working directory (${cwd})` }],
         isError: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prodlint",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
   "license": "MIT",
   "author": "prodlint contributors",