slopbrick 0.34.10 → 0.35.1

package/dist/engine/worker.cjs

@@ -37139,6 +37139,67 @@ var javaHardcodedCredentialRule = createRule({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+var CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+var javaLostStackTraceRule = createRule({
+  id: "java/lost-stack-trace",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: false,
+  description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    const catchBlocks = [];
+    let cm;
+    CATCH_REGEX.lastIndex = 0;
+    while ((cm = CATCH_REGEX.exec(source)) !== null) {
+      const catchStart = cm.index;
+      const exVar = cm[1];
+      let depth = 1;
+      let i = cm.index + cm[0].length;
+      while (i < source.length && depth > 0) {
+        const ch = source[i];
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+        i++;
+      }
+      catchBlocks.push({ start: catchStart, end: i, exVar });
+    }
+    let m;
+    THROW_NEW_REGEX.lastIndex = 0;
+    while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+      const throwPos = m.index;
+      const args = m[2].trim();
+      const enclosing = catchBlocks.find(
+        (cb) => cb.start < throwPos && throwPos < cb.end
+      );
+      if (!enclosing) continue;
+      const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+      if (exVarPattern.test(args)) continue;
+      const line = source.slice(0, throwPos).split("\n").length;
+      issues.push({
+        ruleId: "java/lost-stack-trace",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: false,
+        message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+        line,
+        column: 1,
+        advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX = /\+/;
@@ -37185,6 +37246,61 @@ var javaSqlStringConcatRule = createRule({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+var METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+var EMPTY_BODY_REGEX = /^\s*$/;
+var RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+var RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+var JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+var javaSuspiciousImplementationRule = createRule({
+  id: "java/suspicious-implementation",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    let m;
+    METHOD_DECL_REGEX.lastIndex = 0;
+    while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+      const methodName = m[1];
+      const body = m[2];
+      if (!STRONG_VERB_REGEX.test(methodName)) continue;
+      let reason = null;
+      if (EMPTY_BODY_REGEX.test(body)) {
+        reason = "empty body";
+      } else if (RETURN_CONSTANT_REGEX.test(body)) {
+        reason = "returns a constant (null/true/false/0/1)";
+      } else if (RETURN_INPUT_REGEX.test(body)) {
+        reason = "returns the input unchanged (pass-through stub)";
+      } else if (JUST_THROW_REGEX.test(body)) {
+        reason = "throws UnsupportedOperationException \u2014 not implemented";
+      }
+      if (!reason) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/suspicious-implementation",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+        line,
+        column: 1,
+        advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
@@ -43320,7 +43436,9 @@ var builtinRules = [
   goStructTagInconsistencyRule,
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
+  javaLostStackTraceRule,
   javaSqlStringConcatRule,
+  javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
   javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
@@ -45710,6 +45828,38 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: true
   },
+  "java/suspicious-implementation": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
+  "java/lost-stack-trace": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,

package/dist/engine/worker.js

@@ -37110,6 +37110,67 @@ var javaHardcodedCredentialRule = createRule({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+var CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+var javaLostStackTraceRule = createRule({
+  id: "java/lost-stack-trace",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: false,
+  description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    const catchBlocks = [];
+    let cm;
+    CATCH_REGEX.lastIndex = 0;
+    while ((cm = CATCH_REGEX.exec(source)) !== null) {
+      const catchStart = cm.index;
+      const exVar = cm[1];
+      let depth = 1;
+      let i = cm.index + cm[0].length;
+      while (i < source.length && depth > 0) {
+        const ch = source[i];
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+        i++;
+      }
+      catchBlocks.push({ start: catchStart, end: i, exVar });
+    }
+    let m;
+    THROW_NEW_REGEX.lastIndex = 0;
+    while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+      const throwPos = m.index;
+      const args = m[2].trim();
+      const enclosing = catchBlocks.find(
+        (cb) => cb.start < throwPos && throwPos < cb.end
+      );
+      if (!enclosing) continue;
+      const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+      if (exVarPattern.test(args)) continue;
+      const line = source.slice(0, throwPos).split("\n").length;
+      issues.push({
+        ruleId: "java/lost-stack-trace",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: false,
+        message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+        line,
+        column: 1,
+        advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX = /\+/;
@@ -37156,6 +37217,61 @@ var javaSqlStringConcatRule = createRule({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+var METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+var EMPTY_BODY_REGEX = /^\s*$/;
+var RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+var RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+var JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+var javaSuspiciousImplementationRule = createRule({
+  id: "java/suspicious-implementation",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    let m;
+    METHOD_DECL_REGEX.lastIndex = 0;
+    while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+      const methodName = m[1];
+      const body = m[2];
+      if (!STRONG_VERB_REGEX.test(methodName)) continue;
+      let reason = null;
+      if (EMPTY_BODY_REGEX.test(body)) {
+        reason = "empty body";
+      } else if (RETURN_CONSTANT_REGEX.test(body)) {
+        reason = "returns a constant (null/true/false/0/1)";
+      } else if (RETURN_INPUT_REGEX.test(body)) {
+        reason = "returns the input unchanged (pass-through stub)";
+      } else if (JUST_THROW_REGEX.test(body)) {
+        reason = "throws UnsupportedOperationException \u2014 not implemented";
+      }
+      if (!reason) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/suspicious-implementation",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+        line,
+        column: 1,
+        advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
@@ -43291,7 +43407,9 @@ var builtinRules = [
   goStructTagInconsistencyRule,
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
+  javaLostStackTraceRule,
   javaSqlStringConcatRule,
+  javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
   javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
@@ -45681,6 +45799,38 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: true
   },
+  "java/suspicious-implementation": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
+  "java/lost-stack-trace": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.10";
+    VERSION = "0.35.1";
   }
 });
 
@@ -30797,6 +30797,74 @@ var init_hardcoded_credential = __esm({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX, CATCH_REGEX, javaLostStackTraceRule;
+var init_lost_stack_trace = __esm({
+  "src/rules/java/lost-stack-trace.ts"() {
+    "use strict";
+    init_rule();
+    THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+    CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+    javaLostStackTraceRule = createRule({
+      id: "java/lost-stack-trace",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: false,
+      description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        const catchBlocks = [];
+        let cm;
+        CATCH_REGEX.lastIndex = 0;
+        while ((cm = CATCH_REGEX.exec(source)) !== null) {
+          const catchStart = cm.index;
+          const exVar = cm[1];
+          let depth = 1;
+          let i = cm.index + cm[0].length;
+          while (i < source.length && depth > 0) {
+            const ch = source[i];
+            if (ch === "{") depth++;
+            else if (ch === "}") depth--;
+            i++;
+          }
+          catchBlocks.push({ start: catchStart, end: i, exVar });
+        }
+        let m;
+        THROW_NEW_REGEX.lastIndex = 0;
+        while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+          const throwPos = m.index;
+          const args = m[2].trim();
+          const enclosing = catchBlocks.find(
+            (cb) => cb.start < throwPos && throwPos < cb.end
+          );
+          if (!enclosing) continue;
+          const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+          if (exVarPattern.test(args)) continue;
+          const line = source.slice(0, throwPos).split("\n").length;
+          issues.push({
+            ruleId: "java/lost-stack-trace",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: false,
+            message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+            line,
+            column: 1,
+            advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX, UNSAFE_REGEX, SAFE_REGEX, javaSqlStringConcatRule;
 var init_sql_string_concat = __esm({
@@ -30850,6 +30918,68 @@ var init_sql_string_concat = __esm({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX, METHOD_DECL_REGEX, EMPTY_BODY_REGEX, RETURN_CONSTANT_REGEX, RETURN_INPUT_REGEX, JUST_THROW_REGEX, javaSuspiciousImplementationRule;
+var init_suspicious_implementation = __esm({
+  "src/rules/java/suspicious-implementation.ts"() {
+    "use strict";
+    init_rule();
+    STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+    METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+    EMPTY_BODY_REGEX = /^\s*$/;
+    RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+    RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+    JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+    javaSuspiciousImplementationRule = createRule({
+      id: "java/suspicious-implementation",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        let m;
+        METHOD_DECL_REGEX.lastIndex = 0;
+        while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+          const methodName = m[1];
+          const body = m[2];
+          if (!STRONG_VERB_REGEX.test(methodName)) continue;
+          let reason = null;
+          if (EMPTY_BODY_REGEX.test(body)) {
+            reason = "empty body";
+          } else if (RETURN_CONSTANT_REGEX.test(body)) {
+            reason = "returns a constant (null/true/false/0/1)";
+          } else if (RETURN_INPUT_REGEX.test(body)) {
+            reason = "returns the input unchanged (pass-through stub)";
+          } else if (JUST_THROW_REGEX.test(body)) {
+            reason = "throws UnsupportedOperationException \u2014 not implemented";
+          }
+          if (!reason) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/suspicious-implementation",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+            line,
+            column: 1,
+            advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
 var init_system_out_println = __esm({
@@ -46963,7 +47093,9 @@ var init_builtins = __esm({
     init_struct_tag_inconsistency();
     init_command_injection();
     init_hardcoded_credential();
+    init_lost_stack_trace();
     init_sql_string_concat();
+    init_suspicious_implementation();
     init_system_out_println();
     init_thread_sleep_in_loop();
     init_coroutine_global_scope();
@@ -47102,7 +47234,9 @@ var init_builtins = __esm({
       goStructTagInconsistencyRule,
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
+      javaLostStackTraceRule,
       javaSqlStringConcatRule,
+      javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
       javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
@@ -51797,6 +51931,38 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: true
       },
+      "java/suspicious-implementation": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
+      "java/lost-stack-trace": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -60063,6 +60229,10 @@ var RULE_HINTS = {
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
   "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
+  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
+  // v0.35.1 — Raidar-inspired content-based detection
+  "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.10";
+    VERSION = "0.35.1";
   }
 });
 
@@ -30778,6 +30778,74 @@ var init_hardcoded_credential = __esm({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX, CATCH_REGEX, javaLostStackTraceRule;
+var init_lost_stack_trace = __esm({
+  "src/rules/java/lost-stack-trace.ts"() {
+    "use strict";
+    init_rule();
+    THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+    CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+    javaLostStackTraceRule = createRule({
+      id: "java/lost-stack-trace",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: false,
+      description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        const catchBlocks = [];
+        let cm;
+        CATCH_REGEX.lastIndex = 0;
+        while ((cm = CATCH_REGEX.exec(source)) !== null) {
+          const catchStart = cm.index;
+          const exVar = cm[1];
+          let depth = 1;
+          let i = cm.index + cm[0].length;
+          while (i < source.length && depth > 0) {
+            const ch = source[i];
+            if (ch === "{") depth++;
+            else if (ch === "}") depth--;
+            i++;
+          }
+          catchBlocks.push({ start: catchStart, end: i, exVar });
+        }
+        let m;
+        THROW_NEW_REGEX.lastIndex = 0;
+        while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+          const throwPos = m.index;
+          const args = m[2].trim();
+          const enclosing = catchBlocks.find(
+            (cb) => cb.start < throwPos && throwPos < cb.end
+          );
+          if (!enclosing) continue;
+          const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+          if (exVarPattern.test(args)) continue;
+          const line = source.slice(0, throwPos).split("\n").length;
+          issues.push({
+            ruleId: "java/lost-stack-trace",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: false,
+            message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+            line,
+            column: 1,
+            advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX, UNSAFE_REGEX, SAFE_REGEX, javaSqlStringConcatRule;
 var init_sql_string_concat = __esm({
@@ -30831,6 +30899,68 @@ var init_sql_string_concat = __esm({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX, METHOD_DECL_REGEX, EMPTY_BODY_REGEX, RETURN_CONSTANT_REGEX, RETURN_INPUT_REGEX, JUST_THROW_REGEX, javaSuspiciousImplementationRule;
+var init_suspicious_implementation = __esm({
+  "src/rules/java/suspicious-implementation.ts"() {
+    "use strict";
+    init_rule();
+    STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+    METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+    EMPTY_BODY_REGEX = /^\s*$/;
+    RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+    RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+    JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+    javaSuspiciousImplementationRule = createRule({
+      id: "java/suspicious-implementation",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        let m;
+        METHOD_DECL_REGEX.lastIndex = 0;
+        while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+          const methodName = m[1];
+          const body = m[2];
+          if (!STRONG_VERB_REGEX.test(methodName)) continue;
+          let reason = null;
+          if (EMPTY_BODY_REGEX.test(body)) {
+            reason = "empty body";
+          } else if (RETURN_CONSTANT_REGEX.test(body)) {
+            reason = "returns a constant (null/true/false/0/1)";
+          } else if (RETURN_INPUT_REGEX.test(body)) {
+            reason = "returns the input unchanged (pass-through stub)";
+          } else if (JUST_THROW_REGEX.test(body)) {
+            reason = "throws UnsupportedOperationException \u2014 not implemented";
+          }
+          if (!reason) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/suspicious-implementation",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+            line,
+            column: 1,
+            advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
 var init_system_out_println = __esm({
@@ -46944,7 +47074,9 @@ var init_builtins = __esm({
     init_struct_tag_inconsistency();
     init_command_injection();
     init_hardcoded_credential();
+    init_lost_stack_trace();
     init_sql_string_concat();
+    init_suspicious_implementation();
     init_system_out_println();
     init_thread_sleep_in_loop();
     init_coroutine_global_scope();
@@ -47083,7 +47215,9 @@ var init_builtins = __esm({
       goStructTagInconsistencyRule,
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
+      javaLostStackTraceRule,
       javaSqlStringConcatRule,
+      javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
       javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
@@ -51775,6 +51909,38 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: true
       },
+      "java/suspicious-implementation": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
+      "java/lost-stack-trace": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -59962,6 +60128,10 @@ var RULE_HINTS = {
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
   "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
+  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
+  // v0.35.1 — Raidar-inspired content-based detection
+  "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.34.10",
+  "version": "0.35.1",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {