specforge-mcp 0.1.0

package/dist/engine/auditor-security/error-checks.d.ts

@@ -0,0 +1,11 @@
+import type { AuditFinding } from '../../types/index.js';
+/**
+ * OWASP A10:2025 — Mishandling of Exceptional Conditions.
+ * Detects: swallowed exceptions, exposed stack traces, unchecked return values,
+ * and missing timeouts on async operations.
+ * Returns a list of human-readable issue descriptions (not AuditFinding objects)
+ * so this function can be used standalone without a file context.
+ */
+export declare function checkOwaspA10Conditions(content: string): string[];
+export declare function checkErrorHandling(file: string, content: string, lines: string[], ext: string): AuditFinding[];
+//# sourceMappingURL=error-checks.d.ts.map

package/dist/engine/auditor-security/error-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-checks.d.ts","sourceRoot":"","sources":["../../../src/engine/auditor-security/error-checks.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA0CjE;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,MAAM,GACV,YAAY,EAAE,CA0EhB"}

package/dist/engine/auditor-security/error-checks.js

@@ -0,0 +1,104 @@
+// engine/auditor-security/error-checks.ts — Error handling and async promise checks
+// Includes OWASP A10:2025 — Mishandling of Exceptional Conditions (SPEC-029 TD-P15-03)
+/**
+ * OWASP A10:2025 — Mishandling of Exceptional Conditions.
+ * Detects: swallowed exceptions, exposed stack traces, unchecked return values,
+ * and missing timeouts on async operations.
+ * Returns a list of human-readable issue descriptions (not AuditFinding objects)
+ * so this function can be used standalone without a file context.
+ */
+export function checkOwaspA10Conditions(content) {
+    const issues = [];
+    // 1. Swallowed exceptions — catch block with no body or only whitespace
+    if (/catch\s*\(\s*\w*\s*\)\s*\{\s*\}/.test(content) || /catch\s*\{\s*\}/.test(content)) {
+        issues.push('Swallowed exception: empty catch block silently discards errors (OWASP A10)');
+    }
+    // 2. Stack traces exposed in production responses
+    if (/(?:res|response|ctx|context)\s*\.\s*(?:send|json|write)\s*\([^)]*(?:stack|\.stack)\b/i.test(content)) {
+        issues.push('Stack trace exposure: error.stack sent in HTTP response — reveals internals to clients (OWASP A10)');
+    }
+    // 3. Unchecked return values — result discarded without null/error check
+    //    Detect patterns like: const result = dangerousOp(); result.doSomething() without null-check
+    if (/const\s+\w+\s*=\s*(?:JSON\.parse|parseInt|parseFloat|Number)\s*\([^)]*\);\s*\n[^\n]*\./.test(content)) {
+        issues.push('Unchecked return value: result of parsing operation used without null/NaN check (OWASP A10)');
+    }
+    // 4. Missing timeout on async/fetch operations
+    const hasFetch = /\bfetch\s*\(/.test(content) || /\baxios\b/.test(content) || /\bhttpClient\b/.test(content);
+    const hasTimeout = /timeout\s*[:=]|AbortSignal\.timeout|setTimeout\s*\(/.test(content);
+    if (hasFetch && !hasTimeout) {
+        issues.push('Missing timeout: async HTTP operation has no timeout configured — risks indefinite hang (OWASP A10)');
+    }
+    return issues;
+}
+export function checkErrorHandling(file, content, lines, ext) {
+    const findings = [];
+    const emptyCatch = content.matchAll(/catch\s*\([^)]*\)\s*\{\s*\}/g);
+    for (const match of emptyCatch) {
+        const lineNum = content.substring(0, match.index).split('\n').length;
+        findings.push({
+            file,
+            line: lineNum,
+            category: 'error-handling',
+            severity: 'error',
+            rule: 'empty-catch',
+            message: 'Empty catch block silently swallows errors.',
+            suggestion: 'At minimum, log the error. Consider re-throwing or handling gracefully.',
+        });
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const catchLine = lines[i];
+        /* v8 ignore next 2 */
+        if (catchLine === undefined) {
+            continue;
+        }
+        if (/catch\s*\(/.exec(catchLine)) {
+            const body = [];
+            let braceCount = 0;
+            for (let j = i; j < Math.min(i + 10, lines.length); j++) {
+                const bodyLine = lines[j];
+                /* v8 ignore next 2 */
+                if (bodyLine === undefined) {
+                    continue;
+                }
+                body.push(bodyLine);
+                braceCount += (bodyLine.match(/\{/g) ?? []).length;
+                braceCount -= (bodyLine.match(/\}/g) ?? []).length;
+                if (braceCount === 0 && j > i) {
+                    break;
+                }
+            }
+            const bodyStr = body.join('\n');
+            if (/console\.(log|error)/.exec(bodyStr) && !/throw|return|reject/.exec(bodyStr)) {
+                findings.push({
+                    file,
+                    line: i + 1,
+                    category: 'error-handling',
+                    severity: 'warning',
+                    rule: 'catch-only-logs',
+                    message: 'Catch block only logs the error without proper handling.',
+                    suggestion: 'Consider returning an error response, retrying, or propagating the error.',
+                });
+            }
+        }
+    }
+    if (['.ts', '.tsx', '.js', '.jsx'].includes(ext)) {
+        const asyncFunctions = content.matchAll(/async\s+(?:function\s+)?(\w+)/g);
+        for (const match of asyncFunctions) {
+            const fnName = match[1];
+            const fnIndex = match.index;
+            const surroundingCode = content.substring(fnIndex, Math.min(fnIndex + 500, content.length));
+            if (!surroundingCode.includes('try') && !surroundingCode.includes('.catch')) {
+                findings.push({
+                    file,
+                    category: 'error-handling',
+                    severity: 'info',
+                    rule: 'unhandled-async',
+                    message: `Async function "${fnName}" may have unhandled promise rejections.`,
+                    suggestion: 'Wrap async operations in try-catch or use .catch() for error handling.',
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=error-checks.js.map

package/dist/engine/auditor-security/error-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-checks.js","sourceRoot":"","sources":["../../../src/engine/auditor-security/error-checks.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uFAAuF;AAIvF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,wEAAwE;IACxE,IAAI,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC7F,CAAC;IAED,kDAAkD;IAClD,IACE,uFAAuF,CAAC,IAAI,CAC1F,OAAO,CACR,EACD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,iGAAiG;IACjG,IACE,wFAAwF,CAAC,IAAI,CAC3F,OAAO,CACR,EACD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,MAAM,QAAQ,GACZ,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvF,IAAI,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,OAAe,EACf,KAAe,EACf,GAAW;IAEX,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6CAA6C;YACtD,UAAU,EAAE,yEAAyE;SACtF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,sBAAsB;QACtB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,sBAAsB;gBACtB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpB,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACnD,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACnD,IAAI,UAAU,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM;gBACR,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,QAAQ,EAAE,gBAAgB;oBAC1B,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,0DAA0D;oBACnE,UAAU,EAAE,2EAA2E;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;YAC5B,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5E,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,QAAQ,EAAE,gBAAgB;oBAC1B,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,mBAAmB,MAAM,0CAA0C;oBAC5E,UAAU,EAAE,wEAAwE;iBACrF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engine/auditor-security/performance-checks.d.ts

@@ -0,0 +1,3 @@
+import type { AuditFinding } from '../../types/index.js';
+export declare function checkPerformance(file: string, content: string, lines: string[], ext: string): AuditFinding[];
+//# sourceMappingURL=performance-checks.d.ts.map

package/dist/engine/auditor-security/performance-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"performance-checks.d.ts","sourceRoot":"","sources":["../../../src/engine/auditor-security/performance-checks.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,MAAM,GACV,YAAY,EAAE,CA2DhB"}

package/dist/engine/auditor-security/performance-checks.js

@@ -0,0 +1,58 @@
+// engine/auditor-security/performance-checks.ts — N+1, sync I/O, spread-in-loop checks
+export function checkPerformance(file, content, lines, ext) {
+    const findings = [];
+    if (/for\s*\(.*\)\s*\{[\s\S]*?(?:await|query|find|fetch|get)\s*\(/.exec(content)) {
+        findings.push({
+            file,
+            category: 'performance',
+            severity: 'warning',
+            rule: 'n-plus-one',
+            message: 'Possible N+1 query pattern: database/API call inside a loop.',
+            suggestion: 'Batch the queries or use eager loading to reduce round trips.',
+        });
+    }
+    if (['.ts', '.js', '.mjs'].includes(ext)) {
+        if (/readFileSync|writeFileSync|readdirSync|statSync|existsSync/.exec(content)) {
+            if (!file.includes('config') && !file.includes('setup') && !file.includes('init')) {
+                findings.push({
+                    file,
+                    category: 'performance',
+                    severity: 'warning',
+                    rule: 'sync-io',
+                    message: 'Synchronous I/O operation detected. This blocks the event loop.',
+                    suggestion: 'Use async/await versions: readFile, writeFile, readdir, stat.',
+                });
+            }
+        }
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const loopLine = lines[i];
+        /* v8 ignore next 2 */
+        if (loopLine === undefined) {
+            continue;
+        }
+        if (/for\s*\(/.exec(loopLine) || /\.forEach\s*\(/.exec(loopLine)) {
+            for (let j = i; j < Math.min(i + 10, lines.length); j++) {
+                const spreadLine = lines[j];
+                /* v8 ignore next 3 */
+                if (spreadLine === undefined) {
+                    continue;
+                }
+                if (/\.\.\.\w+/.exec(spreadLine)) {
+                    findings.push({
+                        file,
+                        line: j + 1,
+                        category: 'performance',
+                        severity: 'info',
+                        rule: 'spread-in-loop',
+                        message: 'Object/array spread inside a loop can cause O(n^2) memory allocation.',
+                        suggestion: 'Consider using Object.assign() or building the result incrementally.',
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=performance-checks.js.map

package/dist/engine/auditor-security/performance-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"performance-checks.js","sourceRoot":"","sources":["../../../src/engine/auditor-security/performance-checks.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAIvF,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAe,EACf,KAAe,EACf,GAAW;IAEX,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,IAAI,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,8DAA8D;YACvE,UAAU,EAAE,+DAA+D;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,4DAA4D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,QAAQ,EAAE,aAAa;oBACvB,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,iEAAiE;oBAC1E,UAAU,EAAE,+DAA+D;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,sBAAsB;QACtB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC5B,sBAAsB;gBACtB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,SAAS;gBACX,CAAC;gBACD,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI;wBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,QAAQ,EAAE,aAAa;wBACvB,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,uEAAuE;wBAChF,UAAU,EAAE,sEAAsE;qBACnF,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engine/auditor-security/security-checks.d.ts

@@ -0,0 +1,8 @@
+import type { AuditFinding } from '../../types/index.js';
+export declare function checkSecurity(file: string, content: string, lines: string[]): AuditFinding[];
+/**
+ * Detect hardcoded system prompts that contain sensitive indicators.
+ * A prompt pattern + sensitive content = HIGH security finding (OWASP LLM07 2025).
+ */
+export declare function checkHardcodedSystemPrompts(file: string, content: string): AuditFinding[];
+//# sourceMappingURL=security-checks.d.ts.map

package/dist/engine/auditor-security/security-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-checks.d.ts","sourceRoot":"","sources":["../../../src/engine/auditor-security/security-checks.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAwF5F;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAuDzF"}

package/dist/engine/auditor-security/security-checks.js

@@ -0,0 +1,127 @@
+// engine/auditor-security/security-checks.ts — Security and XSS checks
+export function checkSecurity(file, content, lines) {
+    const findings = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        /* v8 ignore next 2 */
+        if (line === undefined) {
+            continue;
+        }
+        if (/(?:api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*["'][^"']{8,}["']/i.exec(line)) {
+            if (!/(?:your[-_]|example|placeholder|xxx|change[-_]me|TODO)/i.exec(line)) {
+                findings.push({
+                    file,
+                    line: i + 1,
+                    category: 'security',
+                    severity: 'critical',
+                    rule: 'hardcoded-secret',
+                    message: 'Possible hardcoded secret or API key detected.',
+                    suggestion: 'Move to environment variables. Never commit secrets to source control.',
+                    reference: 'OWASP: Sensitive Data Exposure',
+                });
+            }
+        }
+        if (/(?:query|execute|raw)\s*\(\s*[`"'].*\$\{|.*\+\s*\w+.*(?:WHERE|INSERT|UPDATE|DELETE)/i.exec(line)) {
+            findings.push({
+                file,
+                line: i + 1,
+                category: 'security',
+                severity: 'critical',
+                rule: 'sql-injection-risk',
+                message: 'Potential SQL injection: string interpolation in query detected.',
+                suggestion: 'Use parameterized queries or prepared statements.',
+                reference: 'OWASP: SQL Injection',
+            });
+        }
+        if (/\beval\s*\(/.exec(line)) {
+            findings.push({
+                file,
+                line: i + 1,
+                category: 'security',
+                severity: 'critical',
+                rule: 'no-eval',
+                message: 'eval() is extremely dangerous and enables code injection attacks.',
+                suggestion: 'Find an alternative approach. eval() should almost never be used.',
+                reference: 'OWASP: Code Injection',
+            });
+        }
+        if (/\.innerHTML\s*=|dangerouslySetInnerHTML/.exec(line)) {
+            findings.push({
+                file,
+                line: i + 1,
+                category: 'security',
+                severity: 'error',
+                rule: 'xss-risk',
+                message: 'Direct HTML insertion creates XSS vulnerability risk.',
+                suggestion: 'Sanitize content before insertion, or use safe APIs (textContent, DOM methods).',
+                reference: 'OWASP: Cross-Site Scripting (XSS)',
+            });
+        }
+    }
+    if (/(?:cors|access-control-allow-origin)\s*[:=]\s*['"]\*['"]/i.exec(content)) {
+        findings.push({
+            file,
+            category: 'security',
+            severity: 'warning',
+            rule: 'cors-wildcard',
+            message: 'CORS is configured with wildcard (*) origin.',
+            suggestion: 'Restrict CORS to specific allowed origins in production.',
+            reference: 'OWASP: Security Misconfiguration',
+        });
+    }
+    // SPEC-045 TD-P14-02: Detect hardcoded system prompts with sensitive content
+    findings.push(...checkHardcodedSystemPrompts(file, content));
+    return findings;
+}
+/**
+ * Detect hardcoded system prompts that contain sensitive indicators.
+ * A prompt pattern + sensitive content = HIGH security finding (OWASP LLM07 2025).
+ */
+export function checkHardcodedSystemPrompts(file, content) {
+    const findings = [];
+    // Patterns that indicate a hardcoded system prompt
+    const systemPromptPatterns = [
+        /you\s+are\s+a\s+helpful\s+assistant/i,
+        /SYSTEM_PROMPT\s*=\s*[`"']{1,3}/,
+        /system_prompt\s*=\s*["']/i,
+        /systemPrompt\s*[:=]\s*[`"']/,
+        /system\s*:\s*["'`][\s\S]{20,}/,
+    ];
+    // Sensitive content indicators within prompts
+    const sensitiveIndicators = [/\/etc\//, /sk-[A-Za-z0-9]{10,}/, /Bearer\s+[A-Za-z0-9._-]{10,}/];
+    const hasPromptPattern = systemPromptPatterns.some((p) => p.test(content));
+    if (!hasPromptPattern) {
+        return findings;
+    }
+    const hasSensitiveContent = sensitiveIndicators.some((p) => p.test(content));
+    if (hasSensitiveContent) {
+        findings.push({
+            file,
+            category: 'security',
+            severity: 'error',
+            rule: 'hardcoded-system-prompt-with-secrets',
+            message: 'Hardcoded system prompt contains sensitive content (paths, tokens, or credentials). ' +
+                'System prompts are extractable by adversarial users (OWASP LLM07 2025).',
+            suggestion: 'Load sensitive content dynamically from a secrets manager at runtime. ' +
+                'System prompts should contain only behavioral instructions.',
+            reference: 'OWASP LLM07 2025: System Prompt Leakage',
+        });
+    }
+    else {
+        // Report as warning: hardcoded prompt without secrets is still a maintenance concern.
+        // Prompts should be versioned/configurable, not embedded in source code.
+        findings.push({
+            file,
+            category: 'security',
+            severity: 'warning',
+            rule: 'hardcoded-system-prompt',
+            message: 'Hardcoded system prompt detected. Prompt engineering logic embedded in source code ' +
+                'is hard to iterate on and may leak behavioral instructions to adversarial users.',
+            suggestion: 'Load system prompts from a config file, environment variable, or prompt registry. ' +
+                'This allows prompt updates without code deploys and enables versioning.',
+            reference: 'OWASP LLM07 2025: System Prompt Leakage',
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=security-checks.js.map

package/dist/engine/auditor-security/security-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-checks.js","sourceRoot":"","sources":["../../../src/engine/auditor-security/security-checks.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAIvE,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,KAAe;IAC1E,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,sBAAsB;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAED,IACE,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9F,CAAC;YACD,IAAI,CAAC,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1E,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,QAAQ,EAAE,UAAU;oBACpB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,gDAAgD;oBACzD,UAAU,EAAE,wEAAwE;oBACpF,SAAS,EAAE,gCAAgC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IACE,sFAAsF,CAAC,IAAI,CACzF,IAAI,CACL,EACD,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kEAAkE;gBAC3E,UAAU,EAAE,mDAAmD;gBAC/D,SAAS,EAAE,sBAAsB;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,mEAAmE;gBAC5E,UAAU,EAAE,mEAAmE;gBAC/E,SAAS,EAAE,uBAAuB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,uDAAuD;gBAChE,UAAU,EACR,iFAAiF;gBACnF,SAAS,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,2DAA2D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,8CAA8C;YACvD,UAAU,EAAE,0DAA0D;YACtE,SAAS,EAAE,kCAAkC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAE7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,OAAe;IACvE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,mDAAmD;IACnD,MAAM,oBAAoB,GAAG;QAC3B,sCAAsC;QACtC,gCAAgC;QAChC,2BAA2B;QAC3B,6BAA6B;QAC7B,+BAA+B;KAChC,CAAC;IAEF,8CAA8C;IAC9C,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;IAE/F,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EACL,sFAAsF;gBACtF,yEAAyE;YAC3E,UAAU,EACR,wEAAwE;gBACxE,6DAA6D;YAC/D,SAAS,EAAE,yCAAyC;SACrD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,sFAAsF;QACtF,yEAAyE;QACzE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACL,qFAAqF;gBACrF,kFAAkF;YACpF,UAAU,EACR,oFAAoF;gBACpF,yEAAyE;YAC3E,SAAS,EAAE,yCAAyC;SACrD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engine/auditor-security/testing-checks.d.ts

@@ -0,0 +1,3 @@
+import type { AuditFinding } from '../../types/index.js';
+export declare function checkTestingPractices(file: string, content: string, _lines: string[]): AuditFinding[];
+//# sourceMappingURL=testing-checks.d.ts.map

package/dist/engine/auditor-security/testing-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing-checks.d.ts","sourceRoot":"","sources":["../../../src/engine/auditor-security/testing-checks.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,EAAE,CAuBhB"}

package/dist/engine/auditor-security/testing-checks.js

@@ -0,0 +1,22 @@
+// engine/auditor-security/testing-checks.ts — Testing practices checks
+export function checkTestingPractices(file, content, _lines) {
+    const findings = [];
+    if (!/\.(test|spec)\./.exec(file)) {
+        return findings;
+    }
+    const skippedTests = content.matchAll(/(?:it|test|describe)\s*\.\s*(skip|only)\s*\(/g);
+    for (const match of skippedTests) {
+        findings.push({
+            file,
+            category: 'testing',
+            severity: match[1] === 'only' ? 'error' : 'warning',
+            rule: `test-${match[1]}`,
+            message: `Test marked as .${match[1]}() — this should not be committed.`,
+            suggestion: match[1] === 'only'
+                ? 'Remove .only() before committing — it prevents other tests from running.'
+                : 'Either fix the skipped test or remove it. Skipped tests add noise.',
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=testing-checks.js.map

package/dist/engine/auditor-security/testing-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing-checks.js","sourceRoot":"","sources":["../../../src/engine/auditor-security/testing-checks.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAIvE,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,OAAe,EACf,MAAgB;IAEhB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IACvF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACnD,IAAI,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,oCAAoC;YACxE,UAAU,EACR,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;gBACjB,CAAC,CAAC,0EAA0E;gBAC5E,CAAC,CAAC,oEAAoE;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engine/auditor-security.d.ts

@@ -0,0 +1,6 @@
+export { checkSecurity } from './auditor-security/security-checks.js';
+export { checkErrorHandling } from './auditor-security/error-checks.js';
+export { checkPerformance } from './auditor-security/performance-checks.js';
+export { checkElectronSecurity } from './auditor-security/electron-checks.js';
+export { checkTestingPractices } from './auditor-security/testing-checks.js';
+//# sourceMappingURL=auditor-security.d.ts.map

package/dist/engine/auditor-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor-security.d.ts","sourceRoot":"","sources":["../../src/engine/auditor-security.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/engine/auditor-security.js

@@ -0,0 +1,9 @@
+// engine/auditor-security.ts — Barrel re-export
+// Split into subdirectory for SOLID compliance (> 390 lines).
+// See src/engine/auditor-security/ for the implementation.
+export { checkSecurity } from './auditor-security/security-checks.js';
+export { checkErrorHandling } from './auditor-security/error-checks.js';
+export { checkPerformance } from './auditor-security/performance-checks.js';
+export { checkElectronSecurity } from './auditor-security/electron-checks.js';
+export { checkTestingPractices } from './auditor-security/testing-checks.js';
+//# sourceMappingURL=auditor-security.js.map

package/dist/engine/auditor-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor-security.js","sourceRoot":"","sources":["../../src/engine/auditor-security.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,8DAA8D;AAC9D,2DAA2D;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/engine/auditor.d.ts

@@ -0,0 +1,15 @@
+import type { AuditResult, AuditFinding, AuditSummary, AuditCategory, QualityProfile } from '../types/index.js';
+/**
+ * Audit code quality across multiple categories.
+ * CHAIN OF RESPONSIBILITY PATTERN: independent check modules chained sequentially.
+ * Scans files in the given path and checks against quality rules.
+ * See DESIGN_PATTERNS.md § Chain of Responsibility Pattern.
+ */
+export declare function auditCode(path: string, projectPath: string, categories?: AuditCategory[], profile?: QualityProfile): Promise<AuditResult>;
+/**
+ * Audit a single file for quality issues.
+ */
+export declare function auditFile(filePath: string, categories?: AuditCategory[]): Promise<AuditFinding[]>;
+export declare function buildSummary(findings: AuditFinding[], categories: AuditCategory[]): AuditSummary;
+export declare function calculateScore(findings: AuditFinding[], fileCount: number): number;
+//# sourceMappingURL=auditor.d.ts.map

package/dist/engine/auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor.d.ts","sourceRoot":"","sources":["../../src/engine/auditor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACf,MAAM,mBAAmB,CAAC;AAuD3B;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,UAAU,GAAE,aAAa,EAMxB,EACD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,WAAW,CAAC,CAiEtB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,aAAa,EAA+B,GACvD,OAAO,CAAC,YAAY,EAAE,CAAC,CAuBzB;AAqBD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,YAAY,CAmChG;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAgBlF"}

package/dist/engine/auditor.js

@@ -0,0 +1,204 @@
+// engine/auditor.ts — Code Auditor Engine (public API + scoring)
+// Check functions are in auditor-code-quality.ts, auditor-security.ts, auditor-architecture.ts
+import { readFile } from 'node:fs/promises';
+import { join, extname } from 'node:path';
+import { glob } from 'glob';
+import { checkCleanCode, checkDry, checkCustomRule } from './auditor-code-quality.js';
+import { checkSecurity, checkErrorHandling, checkPerformance, checkTestingPractices, checkElectronSecurity, } from './auditor-security.js';
+import { checkSolid, checkArchitecture } from './auditor-architecture.js';
+// === Constants ===
+const CODE_EXTENSIONS = new Set([
+    '.ts',
+    '.tsx',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.py',
+    '.go',
+    '.rs',
+    '.java',
+    '.kt',
+    '.kts',
+    '.rb',
+    '.php',
+    '.cs',
+    '.swift',
+    '.dart',
+    '.ex',
+    '.exs',
+    '.scala',
+    '.clj',
+]);
+const DEFAULT_IGNORE = [
+    'node_modules/**',
+    'dist/**',
+    'build/**',
+    '.git/**',
+    'vendor/**',
+    '__pycache__/**',
+    '.next/**',
+    '.nuxt/**',
+    'coverage/**',
+    '.cache/**',
+    '*.min.*',
+    '*.bundle.*',
+];
+// === Public API ===
+/**
+ * Audit code quality across multiple categories.
+ * CHAIN OF RESPONSIBILITY PATTERN: independent check modules chained sequentially.
+ * Scans files in the given path and checks against quality rules.
+ * See DESIGN_PATTERNS.md § Chain of Responsibility Pattern.
+ */
+export async function auditCode(path, projectPath, categories = [
+    'solid',
+    'clean-code',
+    'architecture',
+    'security',
+    'error-handling',
+], profile) {
+    const effectiveCategories = profile?.enabledCategories ?? categories;
+    const customRules = profile?.customRules ?? [];
+    const files = await findCodeFiles(path, projectPath);
+    const findings = [];
+    for (const file of files) {
+        const fullPath = join(projectPath, file);
+        let content;
+        try {
+            content = await readFile(fullPath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split('\n');
+        const ext = extname(file);
+        if (effectiveCategories.includes('clean-code')) {
+            findings.push(...checkCleanCode(file, content, lines));
+        }
+        if (effectiveCategories.includes('solid')) {
+            findings.push(...checkSolid(file, content, lines, ext));
+        }
+        if (effectiveCategories.includes('architecture')) {
+            findings.push(...checkArchitecture(file, content, lines, projectPath));
+        }
+        if (effectiveCategories.includes('security')) {
+            findings.push(...checkSecurity(file, content, lines));
+            // SPEC-014b: Electron-specific security checks
+            findings.push(...checkElectronSecurity(file, content, lines));
+        }
+        if (effectiveCategories.includes('error-handling')) {
+            findings.push(...checkErrorHandling(file, content, lines, ext));
+        }
+        if (effectiveCategories.includes('performance')) {
+            findings.push(...checkPerformance(file, content, lines, ext));
+        }
+        if (effectiveCategories.includes('testing')) {
+            findings.push(...checkTestingPractices(file, content, lines));
+        }
+        if (effectiveCategories.includes('dry')) {
+            findings.push(...checkDry(file, content, lines));
+        }
+        for (const rule of customRules) {
+            if (effectiveCategories.includes(rule.category)) {
+                const match = checkCustomRule(file, content, rule);
+                if (match) {
+                    findings.push(match);
+                }
+            }
+        }
+    }
+    const summary = buildSummary(findings, effectiveCategories);
+    const score = calculateScore(findings, files.length);
+    return {
+        filesAnalyzed: files.length,
+        findings,
+        summary,
+        score,
+    };
+}
+/**
+ * Audit a single file for quality issues.
+ */
+export async function auditFile(filePath, categories = ['clean-code', 'security']) {
+    let content;
+    try {
+        content = await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split('\n');
+    const ext = extname(filePath);
+    const findings = [];
+    if (categories.includes('clean-code')) {
+        findings.push(...checkCleanCode(filePath, content, lines));
+    }
+    if (categories.includes('security')) {
+        findings.push(...checkSecurity(filePath, content, lines));
+    }
+    if (categories.includes('error-handling')) {
+        findings.push(...checkErrorHandling(filePath, content, lines, ext));
+    }
+    return findings;
+}
+// === Helpers ===
+async function findCodeFiles(path, projectPath) {
+    const searchPath = path.startsWith('/') ? path : join(projectPath, path);
+    try {
+        const files = await glob('**/*', {
+            cwd: searchPath,
+            nodir: true,
+            ignore: DEFAULT_IGNORE,
+            maxDepth: 8,
+        });
+        return files.filter((f) => CODE_EXTENSIONS.has(extname(f))).slice(0, 200);
+    }
+    catch {
+        return [];
+    }
+}
+export function buildSummary(findings, categories) {
+    const byCategory = {};
+    for (const category of categories) {
+        const catFindings = findings.filter((f) => f.category === category);
+        const worstSeverity = catFindings.reduce((worst, f) => {
+            const severityOrder = { critical: 4, error: 3, warning: 2, info: 1 };
+            const fSev = severityOrder[f.severity] ?? 0;
+            /* v8 ignore next 1 */
+            const wSev = severityOrder[worst] ?? 0;
+            return fSev > wSev ? f.severity : worst;
+        }, 'info');
+        byCategory[category] = {
+            count: catFindings.length,
+            severity: worstSeverity,
+        };
+    }
+    const ruleCounts = new Map();
+    for (const f of findings) {
+        ruleCounts.set(f.rule, (ruleCounts.get(f.rule) ?? 0) + 1);
+    }
+    const topIssues = [...ruleCounts.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 5)
+        .map(([rule, count]) => `${rule}: ${count} occurrences`);
+    const strengths = categories
+        .filter((cat) => !findings.some((f) => f.category === cat))
+        .map((cat) => `No issues found in ${cat}`);
+    const score = calculateScore(findings, 0);
+    return { byCategory, topIssues, strengths, score };
+}
+export function calculateScore(findings, fileCount) {
+    if (findings.length === 0) {
+        return 100;
+    }
+    const weights = { critical: 10, error: 5, warning: 2, info: 0.5 };
+    let penalty = 0;
+    for (const finding of findings) {
+        penalty += weights[finding.severity] ?? 1;
+    }
+    const normalizer = Math.max(1, fileCount * 0.5);
+    const score = Math.max(0, 100 - (penalty / normalizer) * 10);
+    return Math.round(score);
+}
+//# sourceMappingURL=auditor.js.map