slopbrick 0.35.0 → 0.35.1

package/dist/engine/worker.cjs

@@ -37139,6 +37139,67 @@ var javaHardcodedCredentialRule = createRule({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+var CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+var javaLostStackTraceRule = createRule({
+  id: "java/lost-stack-trace",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: false,
+  description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    const catchBlocks = [];
+    let cm;
+    CATCH_REGEX.lastIndex = 0;
+    while ((cm = CATCH_REGEX.exec(source)) !== null) {
+      const catchStart = cm.index;
+      const exVar = cm[1];
+      let depth = 1;
+      let i = cm.index + cm[0].length;
+      while (i < source.length && depth > 0) {
+        const ch = source[i];
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+        i++;
+      }
+      catchBlocks.push({ start: catchStart, end: i, exVar });
+    }
+    let m;
+    THROW_NEW_REGEX.lastIndex = 0;
+    while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+      const throwPos = m.index;
+      const args = m[2].trim();
+      const enclosing = catchBlocks.find(
+        (cb) => cb.start < throwPos && throwPos < cb.end
+      );
+      if (!enclosing) continue;
+      const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+      if (exVarPattern.test(args)) continue;
+      const line = source.slice(0, throwPos).split("\n").length;
+      issues.push({
+        ruleId: "java/lost-stack-trace",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: false,
+        message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+        line,
+        column: 1,
+        advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX = /\+/;
@@ -43375,6 +43436,7 @@ var builtinRules = [
   goStructTagInconsistencyRule,
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
+  javaLostStackTraceRule,
   javaSqlStringConcatRule,
   javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
@@ -45782,6 +45844,22 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: false
   },
+  "java/lost-stack-trace": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,

package/dist/engine/worker.js

@@ -37110,6 +37110,67 @@ var javaHardcodedCredentialRule = createRule({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+var CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+var javaLostStackTraceRule = createRule({
+  id: "java/lost-stack-trace",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: false,
+  description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    const catchBlocks = [];
+    let cm;
+    CATCH_REGEX.lastIndex = 0;
+    while ((cm = CATCH_REGEX.exec(source)) !== null) {
+      const catchStart = cm.index;
+      const exVar = cm[1];
+      let depth = 1;
+      let i = cm.index + cm[0].length;
+      while (i < source.length && depth > 0) {
+        const ch = source[i];
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+        i++;
+      }
+      catchBlocks.push({ start: catchStart, end: i, exVar });
+    }
+    let m;
+    THROW_NEW_REGEX.lastIndex = 0;
+    while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+      const throwPos = m.index;
+      const args = m[2].trim();
+      const enclosing = catchBlocks.find(
+        (cb) => cb.start < throwPos && throwPos < cb.end
+      );
+      if (!enclosing) continue;
+      const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+      if (exVarPattern.test(args)) continue;
+      const line = source.slice(0, throwPos).split("\n").length;
+      issues.push({
+        ruleId: "java/lost-stack-trace",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: false,
+        message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+        line,
+        column: 1,
+        advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX = /\+/;
@@ -43346,6 +43407,7 @@ var builtinRules = [
   goStructTagInconsistencyRule,
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
+  javaLostStackTraceRule,
   javaSqlStringConcatRule,
   javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
@@ -45753,6 +45815,22 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: false
   },
+  "java/lost-stack-trace": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.35.0";
+    VERSION = "0.35.1";
   }
 });
 
@@ -30797,6 +30797,74 @@ var init_hardcoded_credential = __esm({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX, CATCH_REGEX, javaLostStackTraceRule;
+var init_lost_stack_trace = __esm({
+  "src/rules/java/lost-stack-trace.ts"() {
+    "use strict";
+    init_rule();
+    THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+    CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+    javaLostStackTraceRule = createRule({
+      id: "java/lost-stack-trace",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: false,
+      description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        const catchBlocks = [];
+        let cm;
+        CATCH_REGEX.lastIndex = 0;
+        while ((cm = CATCH_REGEX.exec(source)) !== null) {
+          const catchStart = cm.index;
+          const exVar = cm[1];
+          let depth = 1;
+          let i = cm.index + cm[0].length;
+          while (i < source.length && depth > 0) {
+            const ch = source[i];
+            if (ch === "{") depth++;
+            else if (ch === "}") depth--;
+            i++;
+          }
+          catchBlocks.push({ start: catchStart, end: i, exVar });
+        }
+        let m;
+        THROW_NEW_REGEX.lastIndex = 0;
+        while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+          const throwPos = m.index;
+          const args = m[2].trim();
+          const enclosing = catchBlocks.find(
+            (cb) => cb.start < throwPos && throwPos < cb.end
+          );
+          if (!enclosing) continue;
+          const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+          if (exVarPattern.test(args)) continue;
+          const line = source.slice(0, throwPos).split("\n").length;
+          issues.push({
+            ruleId: "java/lost-stack-trace",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: false,
+            message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+            line,
+            column: 1,
+            advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX, UNSAFE_REGEX, SAFE_REGEX, javaSqlStringConcatRule;
 var init_sql_string_concat = __esm({
@@ -47025,6 +47093,7 @@ var init_builtins = __esm({
     init_struct_tag_inconsistency();
     init_command_injection();
     init_hardcoded_credential();
+    init_lost_stack_trace();
     init_sql_string_concat();
     init_suspicious_implementation();
     init_system_out_println();
@@ -47165,6 +47234,7 @@ var init_builtins = __esm({
       goStructTagInconsistencyRule,
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
+      javaLostStackTraceRule,
       javaSqlStringConcatRule,
       javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
@@ -51877,6 +51947,22 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: false
       },
+      "java/lost-stack-trace": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -60145,6 +60231,8 @@ var RULE_HINTS = {
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
   // v0.35.0 — content-based detection (CoCoNUTS-inspired)
   "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
+  // v0.35.1 — Raidar-inspired content-based detection
+  "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.35.0";
+    VERSION = "0.35.1";
   }
 });
 
@@ -30778,6 +30778,74 @@ var init_hardcoded_credential = __esm({
   }
 });
 
+// src/rules/java/lost-stack-trace.ts
+var THROW_NEW_REGEX, CATCH_REGEX, javaLostStackTraceRule;
+var init_lost_stack_trace = __esm({
+  "src/rules/java/lost-stack-trace.ts"() {
+    "use strict";
+    init_rule();
+    THROW_NEW_REGEX = /throw\s+new\s+(\w+(?:Exception|Error|Throwable))\s*\(([^)]*)\)/g;
+    CATCH_REGEX = /catch\s*\(\s*(?:final\s+)?[\w<>,\s]+\s+(\w+)\s*\)\s*\{/g;
+    javaLostStackTraceRule = createRule({
+      id: "java/lost-stack-trace",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: false,
+      description: "catch block throws a new exception without the original cause \u2014 stack trace is lost",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        const catchBlocks = [];
+        let cm;
+        CATCH_REGEX.lastIndex = 0;
+        while ((cm = CATCH_REGEX.exec(source)) !== null) {
+          const catchStart = cm.index;
+          const exVar = cm[1];
+          let depth = 1;
+          let i = cm.index + cm[0].length;
+          while (i < source.length && depth > 0) {
+            const ch = source[i];
+            if (ch === "{") depth++;
+            else if (ch === "}") depth--;
+            i++;
+          }
+          catchBlocks.push({ start: catchStart, end: i, exVar });
+        }
+        let m;
+        THROW_NEW_REGEX.lastIndex = 0;
+        while ((m = THROW_NEW_REGEX.exec(source)) !== null) {
+          const throwPos = m.index;
+          const args = m[2].trim();
+          const enclosing = catchBlocks.find(
+            (cb) => cb.start < throwPos && throwPos < cb.end
+          );
+          if (!enclosing) continue;
+          const exVarPattern = new RegExp(`\\b${enclosing.exVar}\\b`);
+          if (exVarPattern.test(args)) continue;
+          const line = source.slice(0, throwPos).split("\n").length;
+          issues.push({
+            ruleId: "java/lost-stack-trace",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: false,
+            message: `throw new ${m[1]}(${args}) \u2014 original exception \`${enclosing.exVar}\` is not included as cause`,
+            line,
+            column: 1,
+            advice: `The catch block declares exception variable \`${enclosing.exVar}\` but the throw statement doesn't include it as a cause. The original stack trace is lost. Fix: \`throw new ${m[1]}("...", ${enclosing.exVar})\` \u2014 the second argument to the exception constructor is the cause, which Java's Throwable framework preserves in the stack trace chain. Reference: java/lost-stack-trace v0.35.1 (Raidar-inspired content-based detection of AI-polished error handling).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX, UNSAFE_REGEX, SAFE_REGEX, javaSqlStringConcatRule;
 var init_sql_string_concat = __esm({
@@ -47006,6 +47074,7 @@ var init_builtins = __esm({
     init_struct_tag_inconsistency();
     init_command_injection();
     init_hardcoded_credential();
+    init_lost_stack_trace();
     init_sql_string_concat();
     init_suspicious_implementation();
     init_system_out_println();
@@ -47146,6 +47215,7 @@ var init_builtins = __esm({
       goStructTagInconsistencyRule,
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
+      javaLostStackTraceRule,
       javaSqlStringConcatRule,
       javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
@@ -51855,6 +51925,22 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: false
       },
+      "java/lost-stack-trace": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.1: NEW RULE \u2014 Raidar-inspired content-based detection. The Raidar paper (ICLR 2024) showed that LLMs tend to 'polish' error handling by wrapping exceptions but losing the original cause; the inverse observation is that AI-generated code often has this pattern. This rule detects catch blocks that throw a new exception WITHOUT including the original exception as a cause \u2014 the original stack trace is lost. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (ON by default) and verdict=OK. v9 calibration is pending. The expected impact: low recall (most production code preserves the original exception) but very high precision (when it fires, it's a real bug \u2014 debugging without the stack trace is impossible).",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -60044,6 +60130,8 @@ var RULE_HINTS = {
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
   // v0.35.0 — content-based detection (CoCoNUTS-inspired)
   "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
+  // v0.35.1 — Raidar-inspired content-based detection
+  "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {