pumuki 6.3.7

package/core/rules/presets/heuristics/typescript.ts

@@ -0,0 +1,220 @@
+import type { RuleSet } from '../../RuleSet';
+
+export const typescriptRules: RuleSet = [
+  {
+    id: 'heuristics.ts.empty-catch.ast',
+    description: 'Detects empty catch blocks in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.empty-catch.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected an empty catch block.',
+      code: 'HEURISTICS_EMPTY_CATCH_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.explicit-any.ast',
+    description: 'Detects explicit any usage in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.explicit-any.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected explicit any usage.',
+      code: 'HEURISTICS_EXPLICIT_ANY_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.console-log.ast',
+    description: 'Detects console.log invocations in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.console-log.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected console.log usage.',
+      code: 'HEURISTICS_CONSOLE_LOG_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.console-error.ast',
+    description: 'Detects console.error invocations in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.console-error.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected console.error usage.',
+      code: 'HEURISTICS_CONSOLE_ERROR_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.eval.ast',
+    description: 'Detects eval invocations in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.eval.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected eval usage.',
+      code: 'HEURISTICS_EVAL_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.function-constructor.ast',
+    description: 'Detects Function constructor usage in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.function-constructor.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected Function constructor usage.',
+      code: 'HEURISTICS_FUNCTION_CONSTRUCTOR_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.set-timeout-string.ast',
+    description: 'Detects setTimeout string callbacks in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.set-timeout-string.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected setTimeout with a string callback.',
+      code: 'HEURISTICS_SET_TIMEOUT_STRING_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.set-interval-string.ast',
+    description: 'Detects setInterval string callbacks in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.set-interval-string.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected setInterval with a string callback.',
+      code: 'HEURISTICS_SET_INTERVAL_STRING_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.new-promise-async.ast',
+    description: 'Detects async Promise executor usage in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.new-promise-async.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected async Promise executor usage.',
+      code: 'HEURISTICS_NEW_PROMISE_ASYNC_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.with-statement.ast',
+    description: 'Detects with-statement usage in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.with-statement.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected with-statement usage.',
+      code: 'HEURISTICS_WITH_STATEMENT_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.delete-operator.ast',
+    description: 'Detects delete-operator usage in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.delete-operator.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected delete-operator usage.',
+      code: 'HEURISTICS_DELETE_OPERATOR_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.debugger.ast',
+    description: 'Detects debugger statements in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.debugger.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected debugger statement usage.',
+      code: 'HEURISTICS_DEBUGGER_AST',
+    },
+  },
+];

package/core/rules/presets/heuristics/vm.ts

@@ -0,0 +1,23 @@
+import type { RuleSet } from '../../RuleSet';
+
+export const vmRules: RuleSet = [
+  {
+    id: 'heuristics.ts.vm-dynamic-code-execution.ast',
+    description:
+      'Detects vm dynamic code execution via runInNewContext/runInThisContext in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.vm-dynamic-code-execution.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected vm dynamic code execution call.',
+      code: 'HEURISTICS_VM_DYNAMIC_CODE_EXECUTION_AST',
+    },
+  },
+];

package/core/rules/presets/index.test.ts

@@ -0,0 +1,32 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  androidRuleSet as androidRuleSetFromBarrel,
+  astHeuristicsRuleSet as astHeuristicsRuleSetFromBarrel,
+  backendRuleSet as backendRuleSetFromBarrel,
+  exampleRuleSet as exampleRuleSetFromBarrel,
+  frontendRuleSet as frontendRuleSetFromBarrel,
+  iosEnterpriseRuleSet as iosEnterpriseRuleSetFromBarrel,
+  iosNonNegotiableRuleSet as iosNonNegotiableRuleSetFromBarrel,
+  rulePackVersions as rulePackVersionsFromBarrel,
+} from './index';
+import { androidRuleSet } from './androidRuleSet';
+import { astHeuristicsRuleSet } from './astHeuristicsRuleSet';
+import { backendRuleSet } from './backendRuleSet';
+import { exampleRuleSet } from './exampleRuleSet';
+import { frontendRuleSet } from './frontendRuleSet';
+import { iosEnterpriseRuleSet } from './iosEnterpriseRuleSet';
+import { iosNonNegotiableRuleSet } from './iosNonNegotiableRuleSet';
+import { rulePackVersions } from './rulePackVersions';
+
+test('presets barrel reexporta rule sets y metadata de versiones', () => {
+  assert.equal(astHeuristicsRuleSetFromBarrel, astHeuristicsRuleSet);
+  assert.equal(androidRuleSetFromBarrel, androidRuleSet);
+  assert.equal(backendRuleSetFromBarrel, backendRuleSet);
+  assert.equal(frontendRuleSetFromBarrel, frontendRuleSet);
+  assert.equal(exampleRuleSetFromBarrel, exampleRuleSet);
+  assert.equal(iosEnterpriseRuleSetFromBarrel, iosEnterpriseRuleSet);
+  assert.equal(iosNonNegotiableRuleSetFromBarrel, iosNonNegotiableRuleSet);
+  assert.equal(rulePackVersionsFromBarrel, rulePackVersions);
+  assert.equal(rulePackVersionsFromBarrel.backendRuleSet, rulePackVersions.backendRuleSet);
+});

package/core/rules/presets/index.ts

@@ -0,0 +1,8 @@
+export { astHeuristicsRuleSet } from './astHeuristicsRuleSet';
+export { androidRuleSet } from './androidRuleSet';
+export { backendRuleSet } from './backendRuleSet';
+export { frontendRuleSet } from './frontendRuleSet';
+export { exampleRuleSet } from './exampleRuleSet';
+export { iosEnterpriseRuleSet } from './iosEnterpriseRuleSet';
+export { iosNonNegotiableRuleSet } from './iosNonNegotiableRuleSet';
+export { rulePackVersions } from './rulePackVersions';

package/core/rules/presets/iosEnterpriseRuleSet.ts

@@ -0,0 +1,204 @@
+import type { RuleSet } from '../RuleSet';
+
+export const iosEnterpriseRuleSet: RuleSet = [
+  {
+    id: 'ios.tdd.domain-changes-require-tests',
+    description: 'Requires tests when domain code changes.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+      exclude: ['**/*Tests*/**', '**/*UITests*/**'],
+    },
+    when: {
+      kind: 'All',
+      conditions: [
+        {
+          kind: 'FileChange',
+          where: {
+            pathPrefix: 'Domain/',
+          },
+        },
+        {
+          kind: 'Not',
+          condition: {
+            kind: 'FileChange',
+            where: {
+              pathPrefix: 'Tests/Domain/',
+            },
+          },
+        },
+      ],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'Domain changes require corresponding test updates.',
+      code: 'IOS_TDD_DOMAIN_TESTS',
+    },
+  },
+  {
+    id: 'ios.no-gcd',
+    description: 'Disallows GCD and OperationQueue usage in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+      exclude: ['**/*Tests*/**', '**/Legacy/**', '**/Bridges/**'],
+    },
+    when: {
+      kind: 'FileContent',
+      contains: ['DispatchQueue.', 'DispatchGroup', 'DispatchSemaphore', 'OperationQueue'],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'GCD and OperationQueue usage is not allowed in iOS code.',
+      code: 'IOS_NO_GCD',
+    },
+  },
+  {
+    id: 'ios.no-anyview',
+    description: 'Disallows AnyView usage in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+    },
+    when: {
+      kind: 'FileContent',
+      contains: ['AnyView'],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AnyView usage is not allowed in iOS code.',
+      code: 'IOS_NO_ANYVIEW',
+    },
+  },
+  {
+    id: 'ios.no-print',
+    description: 'Disallows print() usage in iOS code.',
+    severity: 'ERROR',
+    platform: 'ios',
+    stage: 'PRE_PUSH',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+    },
+    when: {
+      kind: 'FileContent',
+      contains: ['print('],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'print() usage is not allowed in iOS code.',
+      code: 'IOS_NO_PRINT',
+    },
+  },
+  {
+    id: 'ios.no-jsonserialization',
+    description: 'Disallows JSONSerialization usage in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+    },
+    when: {
+      kind: 'FileContent',
+      contains: ['JSONSerialization'],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'JSONSerialization usage is not allowed in iOS code.',
+      code: 'IOS_NO_JSONSERIALIZATION',
+    },
+  },
+  {
+    id: 'ios.no-alamofire',
+    description: 'Disallows Alamofire usage in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+    },
+    when: {
+      kind: 'FileContent',
+      contains: ['Alamofire'],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'Alamofire usage is not allowed in iOS code.',
+      code: 'IOS_NO_ALAMOFIRE',
+    },
+  },
+  {
+    id: 'ios.no-force-unwrap',
+    description: 'Disallows force unwraps in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+    },
+    when: {
+      kind: 'All',
+      conditions: [
+        {
+          kind: 'FileContent',
+          contains: ['!'],
+        },
+        {
+          kind: 'Not',
+          condition: {
+            kind: 'FileContent',
+            contains: ['IBOutlet'],
+          },
+        },
+      ],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'Force unwraps are not allowed in iOS code.',
+      code: 'IOS_NO_FORCE_UNWRAP',
+    },
+  },
+  {
+    id: 'ios.no-completion-handlers-outside-bridges',
+    description: 'Disallows completion handlers outside bridges and tests.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    stage: 'PRE_COMMIT',
+    locked: true,
+    scope: {
+      include: ['**/*.swift'],
+      exclude: ['**/Bridges/**', '**/*Tests*/**'],
+    },
+    when: {
+      kind: 'Any',
+      conditions: [
+        {
+          kind: 'FileContent',
+          contains: ['@escaping'],
+        },
+        {
+          kind: 'FileContent',
+          contains: ['completion:'],
+        },
+      ],
+    },
+    then: {
+      kind: 'Finding',
+      message: 'Completion handlers are not allowed outside bridges and tests.',
+      code: 'IOS_NO_COMPLETION_HANDLERS',
+    },
+  },
+];

package/core/rules/presets/iosNonNegotiableRuleSet.ts

@@ -0,0 +1,76 @@
+import type { RuleSet } from '../RuleSet';
+
+export const iosNonNegotiableRuleSet: RuleSet = [
+  {
+    id: 'ios.no_anyview',
+    description: 'Disallow AnyView usage in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'FileChange',
+      where: {
+        pathPrefix: 'ios/',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AnyView usage is not allowed in iOS code.',
+      code: 'IOS_NO_ANYVIEW',
+    },
+  },
+  {
+    id: 'ios.no_dispatchqueue',
+    description: 'Disallow DispatchQueue usage for async in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'FileChange',
+      where: {
+        pathPrefix: 'ios/',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'DispatchQueue-based async is not allowed in iOS code.',
+      code: 'IOS_NO_DISPATCHQUEUE',
+    },
+  },
+  {
+    id: 'ios.no_completion_handlers',
+    description: 'Disallow new completion handlers in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'FileChange',
+      where: {
+        pathPrefix: 'ios/',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'Completion handlers are not allowed for new iOS code.',
+      code: 'IOS_NO_COMPLETION_HANDLERS',
+    },
+  },
+  {
+    id: 'ios.no_print',
+    description: 'Disallow print() usage in iOS code.',
+    severity: 'CRITICAL',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'FileChange',
+      where: {
+        pathPrefix: 'ios/',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'print() usage is not allowed in iOS code.',
+      code: 'IOS_NO_PRINT',
+    },
+  },
+];

package/core/rules/presets/rulePackVersions.test.ts

@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { rulePackVersions, type RulePackName } from './rulePackVersions';
+
+test('rulePackVersions expone versiones semver para todos los packs conocidos', () => {
+  const expected: Record<RulePackName, string> = {
+    astHeuristicsRuleSet: '0.4.0',
+    iosEnterpriseRuleSet: '1.0.0',
+    backendRuleSet: '1.0.0',
+    frontendRuleSet: '1.0.0',
+    androidRuleSet: '1.0.0',
+    rulesgold: '1.0.0',
+    rulesbackend: '1.0.0',
+  };
+
+  assert.deepEqual(rulePackVersions, expected);
+
+  for (const version of Object.values(rulePackVersions)) {
+    assert.match(version, /^\d+\.\d+\.\d+$/);
+  }
+});

package/core/rules/presets/rulePackVersions.ts

@@ -0,0 +1,11 @@
+export const rulePackVersions = {
+  astHeuristicsRuleSet: '0.4.0',
+  iosEnterpriseRuleSet: '1.0.0',
+  backendRuleSet: '1.0.0',
+  frontendRuleSet: '1.0.0',
+  androidRuleSet: '1.0.0',
+  rulesgold: '1.0.0',
+  rulesbackend: '1.0.0',
+} as const;
+
+export type RulePackName = keyof typeof rulePackVersions;

package/core/utils/stableStringify.ts

@@ -0,0 +1,18 @@
+const isRecord = (value: unknown): value is Record<string, unknown> => {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+};
+
+export const stableStringify = (value: unknown): string => {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(',')}]`;
+  }
+  if (isRecord(value)) {
+    const entries = Object.entries(value).sort(([left], [right]) =>
+      left.localeCompare(right)
+    );
+    return `{${entries
+      .map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`)
+      .join(',')}}`;
+  }
+  return JSON.stringify(value) ?? 'null';
+};