thuban 0.3.2 → 0.3.3

package/packages/scanner/code-scanner.js

@@ -1,713 +1,758 @@
-/**
- * Code Scanner
- *
- * @purpose Event-driven CodeScanner component
- * @module sentinel
- * @layer application
- * @imports-from fs, path, events
- * @exports-to sentinel
- * @side-effects File system reads, Spawns child processes, Console output, Event emission
- * @critical-for sentinel
- */
-
-/**
- * Sentinel Code Scanner
- *
- * Scans codebase for security, quality, performance, and AI-specific issues.
- * Based on CODEX/Thuban FORGE layer specifications.
- *
- * Categories:
- * - Security: Secrets, injection, auth gaps
- * - Quality: Complexity, duplication, dead code
- * - Performance: N+1, memory leaks, blocking
- * - Maintainability: Docs, nesting, coupling
- * - AI-Specific: Hallucinated imports, inconsistent patterns
- */
-
-const fs = require('fs');
-const path = require('path');
-const EventEmitter = require('events');
-
-class CodeScanner extends EventEmitter {
-  constructor(config = {}) {
-    super();
-
-    this.config = {
-      rootPath: config.rootPath || process.cwd(),
-      ignorePatterns: config.ignorePatterns || [
-        'node_modules/**',
-        '.git/**',
-        'dist/**',
-        '.orion/snapshots/**'
-      ],
-      maxFileSize: config.maxFileSize || 1024 * 1024, // 1MB
-      complexityThreshold: config.complexityThreshold || 15,
-      nestingThreshold: config.nestingThreshold || 4,
-      ...config
-    };
-
-    // Safe patterns that should NOT trigger security warnings
-    this.safePatterns = [
-      // Environment variable names (not actual secrets)
-      /keyEnv\s*[:=]/i,
-      /envVar\s*[:=]/i,
-      /process\.env\[/,
-      /process\.env\./,
-      // Model version strings and hashes
-      /model\s*[:=]\s*['"][^'"]+['"]/i,
-      /version\s*[:=]\s*['"][^'"]+['"]/i,  // version: "hash"
-      /claude-|gpt-|gemini-|llama-|mistral-|deepseek-|grok-|sonar-/i,
-      // API endpoints (URLs, not keys)
-      /endpoint\s*[:=]/i,
-      /https?:\/\//,
-      // Common safe strings
-      /_API_KEY['"]/,  // env var names end with _API_KEY
-      /API_KEY['"]\s*\)/,  // process.env["API_KEY"]
-      // Error messages and validation
-      /errors?\.\w+\s*=/i,  // errors.password = "message"
-      /Error\s*[:=]/i,
-      /required|invalid|must be|cannot be/i,  // validation messages
-    ];
-
-    // Test file patterns (allow mock data)
-    this.testFilePatterns = [
-      /\.test\.(js|ts|jsx|tsx)$/,
-      /\.spec\.(js|ts|jsx|tsx)$/,
-      /__tests__\//,
-      /\.mock\.(js|ts)$/,
-      /test-.*\.js$/,
-    ];
-
-    // Issue patterns - security focused
-    this.securityPatterns = [
-      {
-        id: 'SEC001',
-        name: 'Hardcoded API Key',
-        // Match strings that look like actual API keys:
-        // - sk-xxx, pk-xxx (Stripe-style)
-        // - xox-xxx (Slack-style)
-        // - AKIA... (AWS-style)
-        // - Mix of numbers/letters that looks random (not readable words)
-        pattern: /['"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['"]|['"][a-zA-Z0-9]{32,}['"]/,
-        context: /(api[_-]?key|apikey|secret[_\s]*key|token|credential|bearer)/i,
-        severity: 'critical',
-        message: 'Possible hardcoded API key or secret detected',
-        skipIfSafe: true  // Skip if line matches safe patterns
-      },
-      {
-        id: 'SEC002',
-        name: 'Hardcoded Password',
-        pattern: /password\s*[:=]\s*['"][^'"]+['"]/i,
-        severity: 'critical',
-        message: 'Hardcoded password detected',
-        skipInTests: true,  // Skip in test files
-        skipIfSafe: true    // Skip error messages and validation
-      },
-      {
-        id: 'SEC003',
-        name: 'SQL Injection Risk',
-        // Only match actual SQL queries with string interpolation
-        // Requires SQL keyword as whole word (not path.join etc)
-        pattern: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|WHERE)\b.*(\$\{|\+\s*['"]|\+\s*\w+)/i,
-        severity: 'error',
-        message: 'Potential SQL injection - use parameterized queries'
-      },
-      {
-        id: 'SEC004',
-        name: 'eval() Usage',
-        pattern: /\beval\s*\(/,
-        severity: 'error',
-        message: 'eval() is dangerous and should be avoided'
-      },
-      {
-        id: 'SEC005',
-        name: 'innerHTML Assignment',
-        pattern: /\.innerHTML\s*=/,
-        severity: 'warning',
-        message: 'innerHTML can cause XSS - consider using textContent or sanitization'
-      },
-      {
-        id: 'SEC006',
-        name: 'Disabled Security',
-        pattern: /rejectUnauthorized\s*:\s*false/,
-        severity: 'error',
-        message: 'SSL certificate validation disabled'
-      },
-      {
-        id: 'SEC007',
-        name: 'Exposed .env Reference',
-        pattern: /\.env['"]/,
-        context: /fs\.(read|write)|path\.join/i,
-        severity: 'warning',
-        message: 'Direct .env file manipulation - ensure not exposed'
-      }
-    ];
-
-    // Quality patterns
-    this.qualityPatterns = [
-      {
-        id: 'QUAL001',
-        name: 'Console.log in Production',
-        pattern: /console\.(log|debug|info)\(/,
-        severity: 'info',
-        message: 'console.log found - consider using proper logging',
-        // Only report in non-dev files - skip test files and dev utilities
-        skipInTests: true,
-        skipInDirs: ['test', 'scripts', 'tools', 'dev']
-      },
-      {
-        id: 'QUAL002',
-        name: 'TODO Comment',
-        pattern: /\/\/\s*TODO|\/\*\s*TODO|\*\s*TODO/i,
-        severity: 'info',
-        message: 'TODO comment found - track in issue system'
-      },
-      {
-        id: 'QUAL003',
-        name: 'FIXME Comment',
-        pattern: /\/\/\s*FIXME|\/\*\s*FIXME|\*\s*FIXME/i,
-        severity: 'warning',
-        message: 'FIXME comment found - needs attention'
-      },
-      {
-        id: 'QUAL004',
-        name: 'Empty Catch Block',
-        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
-        severity: 'warning',
-        message: 'Empty catch block swallows errors'
-      },
-      {
-        id: 'QUAL005',
-        name: 'Magic Number',
-        // Only flag suspicious numbers, not common ones like ports, timeouts, dates
-        pattern: /(?<![0-9a-zA-Z_])(?!(?:1000|2000|3000|3001|4000|5000|8000|8080|9000|80|443|24|60|1024|2048|4096)\b)\d{5,}(?![0-9])/,
-        severity: 'info',
-        message: 'Magic number detected - consider using named constant',
-        skipInTests: true
-      },
-      {
-        id: 'QUAL006',
-        name: 'Callback Hell',
-        pattern: /\)\s*=>\s*\{[^}]*\)\s*=>\s*\{[^}]*\)\s*=>\s*\{/,
-        severity: 'warning',
-        message: 'Deeply nested callbacks - consider async/await'
-      }
-    ];
-
-    // Performance patterns
-    this.performancePatterns = [
-      {
-        id: 'PERF001',
-        name: 'Sync FS in Async',
-        pattern: /fs\.(readFileSync|writeFileSync|readdirSync|statSync)/,
-        severity: 'warning',
-        message: 'Synchronous file operation - may block event loop'
-      },
-      {
-        id: 'PERF002',
-        name: 'Missing Await',
-        pattern: /async\s+function[^{]*\{[^}]*(?<!await\s)new\s+Promise/,
-        severity: 'warning',
-        message: 'Promise created in async function without await'
-      },
-      {
-        id: 'PERF003',
-        name: 'Loop Database Query',
-        pattern: /for\s*\([^)]*\)\s*\{[^}]*(query|find|select|update)/i,
-        severity: 'error',
-        message: 'Possible N+1 query pattern - consider batch operation'
-      },
-      {
-        id: 'PERF004',
-        name: 'Large Array in Memory',
-        pattern: /new\s+Array\s*\(\s*\d{6,}\s*\)/,
-        severity: 'warning',
-        message: 'Large array allocation - consider streaming'
-      }
-    ];
-
-    // AI-specific patterns
-    this.aiPatterns = [
-      {
-        id: 'AI001',
-        name: 'Potentially Hallucinated Import',
-        pattern: /require\(['"](?!\.)[^'"]+['"]\)/,
-        severity: 'info',
-        message: 'External dependency - verify it exists in package.json',
-        check: (match, content, filePath) => this._checkDependencyExists(match, filePath)
-      },
-      {
-        id: 'AI002',
-        name: 'Unused Import',
-        pattern: /const\s+(\w+)\s*=\s*require\(['"][^'"]+['"]\)/,
-        severity: 'info',
-        message: 'Import may be unused - verify usage',
-        check: (match, content) => this._checkImportUsage(match, content)
-      },
-      {
-        id: 'AI003',
-        name: 'Over-Engineered Pattern',
-        pattern: /class\s+\w+Factory\s*\{|AbstractFactory|Singleton\.getInstance/,
-        severity: 'info',
-        message: 'Complex pattern detected - ensure justified by requirements'
-      }
-    ];
-  }
-
-  /**
-   * Scan all files in the codebase
-   */
-  async scanAll() {
-    console.log('[CODE-SCANNER] Starting full codebase scan...');
-    const startTime = Date.now();
-
-    const result = {
-      filesScanned: 0,
-      issues: [],
-      summary: {},
-      duration: 0
-    };
-
-    try {
-      const files = await this._discoverFiles(this.config.rootPath);
-      console.log(`[CODE-SCANNER] Found ${files.length} files to scan`);
-
-      for (const file of files) {
-        const fileIssues = await this.scanFile(file);
-        result.filesScanned++;
-        result.issues.push(...fileIssues);
-      }
-
-      result.duration = Date.now() - startTime;
-      result.summary = this._summarizeIssues(result.issues);
-
-      console.log(`[CODE-SCANNER] Scan complete: ${result.filesScanned} files, ${result.issues.length} issues`);
-      return result;
-    } catch (error) {
-      console.error('[CODE-SCANNER] Scan failed:', error.message);
-      result.error = error.message;
-      return result;
-    }
-  }
-
-  /**
-   * Scan specific files
-   */
-  async scanFiles(filePaths) {
-    const result = {
-      filesScanned: 0,
-      issues: [],
-      summary: {}
-    };
-
-    for (const filePath of filePaths) {
-      const fileIssues = await this.scanFile(filePath);
-      result.filesScanned++;
-      result.issues.push(...fileIssues);
-    }
-
-    result.summary = this._summarizeIssues(result.issues);
-    return result;
-  }
-
-  /**
-   * Scan a single file
-   */
-  async scanFile(filePath) {
-    const issues = [];
-
-    try {
-      // Check file size
-      const stats = fs.statSync(filePath);
-      if (stats.size > this.config.maxFileSize) {
-        return [{
-          file: filePath,
-          category: 'quality',
-          severity: 'info',
-          id: 'FILE001',
-          message: `File too large (${Math.round(stats.size / 1024)}KB) - skipped detailed scan`
-        }];
-      }
-
-      // Read file content
-      const content = fs.readFileSync(filePath, 'utf8');
-      const lines = content.split('\n');
-      const ext = path.extname(filePath).toLowerCase();
-      const supportedExts = ['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs', '.py', '.pyw', '.go', '.rs', '.java', '.kt', '.cs'];
-
-      // Scan supported source files with pattern matching
-      if (supportedExts.includes(ext)) {
-        // Security scan
-        issues.push(...this._runPatternScan(filePath, content, lines, this.securityPatterns, 'security'));
-
-        // Quality scan
-        issues.push(...this._runPatternScan(filePath, content, lines, this.qualityPatterns, 'quality'));
-
-        // Performance scan
-        issues.push(...this._runPatternScan(filePath, content, lines, this.performancePatterns, 'performance'));
-
-        // AI-specific scan
-        issues.push(...this._runPatternScan(filePath, content, lines, this.aiPatterns, 'ai'));
-
-        // Complexity analysis
-        issues.push(...this._analyzeComplexity(filePath, content, lines));
-
-        // Nesting analysis
-        issues.push(...this._analyzeNesting(filePath, content, lines));
-      }
-
-      // JSON-specific checks
-      if (ext === '.json') {
-        issues.push(...this._scanJson(filePath, content));
-      }
-
-      // Emit event for each issue found
-      for (const issue of issues) {
-        this.emit('issueFound', issue);
-      }
-
-      return issues;
-    } catch (error) {
-      return [{
-        file: filePath,
-        category: 'error',
-        severity: 'error',
-        id: 'SCAN001',
-        message: `Failed to scan file: ${error.message}`
-      }];
-    }
-  }
-
-  /**
-   * Get current scan rules
-   */
-  getRules() {
-    return {
-      security: this.securityPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
-      quality: this.qualityPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
-      performance: this.performancePatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
-      ai: this.aiPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity }))
-    };
-  }
-
-  // Private methods
-
-  async _discoverFiles(dir, files = []) {
-    try {
-      const entries = fs.readdirSync(dir, { withFileTypes: true });
-
-      for (const entry of entries) {
-        const fullPath = path.join(dir, entry.name);
-        const relativePath = path.relative(this.config.rootPath, fullPath);
-
-        // Check ignore patterns
-        if (this._shouldIgnore(relativePath)) {
-          continue;
-        }
-
-        if (entry.isDirectory()) {
-          await this._discoverFiles(fullPath, files);
-        } else if (entry.isFile()) {
-          const ext = path.extname(entry.name).toLowerCase();
-          if (['.js', '.ts', '.jsx', '.tsx', '.json'].includes(ext)) {
-            files.push(fullPath);
-          }
-        }
-      }
-    } catch (error) {
-      // Skip inaccessible directories
-    }
-
-    return files;
-  }
-
-  _shouldIgnore(relativePath) {
-    const normalized = relativePath.replace(/\\/g, '/');
-
-    // Always ignore any path containing these directories (anywhere in path)
-    const alwaysIgnore = ['node_modules', '.git', 'dist', '.vite'];
-    for (const dir of alwaysIgnore) {
-      if (normalized.includes('/' + dir + '/') ||
-          normalized.startsWith(dir + '/') ||
-          normalized === dir ||
-          normalized.endsWith('/' + dir)) {
-        return true;
-      }
-    }
-
-    for (const pattern of this.config.ignorePatterns) {
-      const normalizedPattern = pattern.replace(/\\/g, '/');
-
-      // Extract base directory from pattern (e.g., 'node_modules' from 'node_modules/**')
-      const baseDir = normalizedPattern.split('/')[0].replace(/\*/g, '');
-
-      // Check if path IS the ignored directory or starts with it
-      if (baseDir && (normalized === baseDir || normalized.startsWith(baseDir + '/'))) {
-        return true;
-      }
-
-      // Simple glob matching for more complex patterns
-      let regexPattern = normalizedPattern
-        .replace(/\./g, '\\.')
-        .replace(/\*\*/g, '.*')
-        .replace(/\*/g, '[^/]*');
-
-      if (new RegExp('^' + regexPattern).test(normalized)) {
-        return true;
-      }
-    }
-
-    return false;
-  }
-
-  _runPatternScan(filePath, content, lines, patterns, category) {
-    const issues = [];
-
-    // Check if this is a test file
-    const isTestFile = this.testFilePatterns.some(p => p.test(filePath));
-    const relativePath = path.relative(this.config.rootPath, filePath).replace(/\\/g, '/');
-
-    for (const pattern of patterns) {
-      // Skip this pattern entirely in test files if flagged
-      if (pattern.skipInTests && isTestFile) {
-        continue;
-      }
-
-      // Skip if file is in excluded directories
-      if (pattern.skipInDirs) {
-        const inSkippedDir = pattern.skipInDirs.some(dir =>
-          relativePath.startsWith(dir + '/') || relativePath.includes('/' + dir + '/')
-        );
-        if (inSkippedDir) continue;
-      }
-
-      // Check context pattern first if it exists (file-level)
-      if (pattern.context && !pattern.lineContext && !pattern.context.test(content)) {
-        continue;
-      }
-
-      // Find all matches
-      let lineNum = 0;
-      for (const line of lines) {
-        lineNum++;
-        const match = line.match(pattern.pattern);
-
-        if (match) {
-          // Skip if line matches any safe pattern (for SEC001 type checks)
-          if (pattern.skipIfSafe) {
-            const isSafe = this.safePatterns.some(sp => sp.test(line));
-            if (isSafe) continue;
-          }
-
-          // Run additional check if defined
-          if (pattern.check) {
-            const shouldReport = pattern.check(match, content, filePath);
-            if (!shouldReport) continue;
-          }
-
-          issues.push({
-            file: filePath,
-            line: lineNum,
-            column: match.index,
-            category,
-            severity: pattern.severity,
-            id: pattern.id,
-            name: pattern.name,
-            message: pattern.message,
-            code: line.trim().substring(0, 100)
-          });
-        }
-      }
-    }
-
-    return issues;
-  }
-
-  _analyzeComplexity(filePath, content, lines) {
-    const issues = [];
-
-    // Count decision points (simplified cyclomatic complexity)
-    const decisionKeywords = /\b(if|else|for|while|switch|case|catch|&&|\|\||\?)\b/g;
-    const functionMatches = content.match(/function\s+\w+|=>\s*\{|async\s+\w+/g) || [];
-    const decisionMatches = content.match(decisionKeywords) || [];
-
-    const avgComplexity = functionMatches.length > 0
-      ? decisionMatches.length / functionMatches.length
-      : 0;
-
-    if (avgComplexity > this.config.complexityThreshold) {
-      issues.push({
-        file: filePath,
-        category: 'quality',
-        severity: 'warning',
-        id: 'CMPLX001',
-        name: 'High Complexity',
-        message: `Average cyclomatic complexity is ${avgComplexity.toFixed(1)} (threshold: ${this.config.complexityThreshold})`
-      });
-    }
-
-    // Check file length
-    if (lines.length > 500) {
-      issues.push({
-        file: filePath,
-        category: 'quality',
-        severity: 'info',
-        id: 'CMPLX002',
-        name: 'Long File',
-        message: `File has ${lines.length} lines - consider splitting`
-      });
-    }
-
-    return issues;
-  }
-
-  _analyzeNesting(filePath, content, lines) {
-    const issues = [];
-    let maxNesting = 0;
-    let currentNesting = 0;
-    let maxNestingLine = 0;
-
-    let lineNum = 0;
-    for (const line of lines) {
-      lineNum++;
-
-      // Count braces (simplified)
-      const opens = (line.match(/\{/g) || []).length;
-      const closes = (line.match(/\}/g) || []).length;
-
-      currentNesting += opens - closes;
-
-      if (currentNesting > maxNesting) {
-        maxNesting = currentNesting;
-        maxNestingLine = lineNum;
-      }
-    }
-
-    if (maxNesting > this.config.nestingThreshold) {
-      issues.push({
-        file: filePath,
-        line: maxNestingLine,
-        category: 'quality',
-        severity: 'warning',
-        id: 'NEST001',
-        name: 'Deep Nesting',
-        message: `Max nesting depth is ${maxNesting} at line ${maxNestingLine} (threshold: ${this.config.nestingThreshold})`
-      });
-    }
-
-    return issues;
-  }
-
-  _scanJson(filePath, content) {
-    const issues = [];
-
-    try {
-      JSON.parse(content);
-    } catch (error) {
-      issues.push({
-        file: filePath,
-        category: 'quality',
-        severity: 'error',
-        id: 'JSON001',
-        name: 'Invalid JSON',
-        message: `JSON parse error: ${error.message}`
-      });
-    }
-
-    // Check for sensitive data in JSON
-    if (/(password|secret|api[_-]?key|token)/i.test(content)) {
-      issues.push({
-        file: filePath,
-        category: 'security',
-        severity: 'warning',
-        id: 'JSON002',
-        name: 'Sensitive Data in JSON',
-        message: 'Possible sensitive data in JSON file - verify not committed'
-      });
-    }
-
-    return issues;
-  }
-
-  _checkDependencyExists(match, filePath) {
-    // Extract module name
-    const moduleMatch = match[0].match(/require\(['"]([^'"]+)['"]\)/);
-    if (!moduleMatch) return true;
-
-    const moduleName = moduleMatch[1];
-
-    // Skip relative imports
-    if (moduleName.startsWith('.')) return false;
-
-    // Skip Node built-ins
-    const builtins = ['fs', 'path', 'os', 'crypto', 'http', 'https', 'events', 'util', 'stream', 'child_process', 'url', 'querystring', 'buffer'];
-    if (builtins.includes(moduleName.split('/')[0])) return false;
-
-    // Check package.json
-    try {
-      let pkgPath = path.join(this.config.rootPath, 'package.json');
-
-      // Also check server/package.json for server files
-      if (filePath.includes('server')) {
-        const serverPkgPath = path.join(this.config.rootPath, 'server', 'package.json');
-        if (fs.existsSync(serverPkgPath)) {
-          pkgPath = serverPkgPath;
-        }
-      }
-
-      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-      const allDeps = {
-        ...(pkg.dependencies || {}),
-        ...(pkg.devDependencies || {})
-      };
-
-      const baseModule = moduleName.split('/')[0];
-      return !allDeps[baseModule] && !allDeps[moduleName];
-    } catch (e) {
-      return false;
-    }
-  }
-
-  _checkImportUsage(match, content) {
-    const varName = match[1];
-    if (!varName) return false;
-
-    // Count occurrences (beyond the require line)
-    const regex = new RegExp('\\b' + varName + '\\b', 'g');
-    const occurrences = (content.match(regex) || []).length;
-
-    // If only appears once (the require), it's unused
-    return occurrences <= 1;
-  }
-
-  _summarizeIssues(issues) {
-    return {
-      total: issues.length,
-      bySeverity: {
-        critical: issues.filter(i => i.severity === 'critical').length,
-        error: issues.filter(i => i.severity === 'error').length,
-        warning: issues.filter(i => i.severity === 'warning').length,
-        info: issues.filter(i => i.severity === 'info').length
-      },
-      byCategory: issues.reduce((acc, i) => {
-        acc[i.category] = (acc[i.category] || 0) + 1;
-        return acc;
-      }, {}),
-      topFiles: this._getTopFiles(issues, 10)
-    };
-  }
-
-  _getTopFiles(issues, limit) {
-    const fileCounts = issues.reduce((acc, i) => {
-      acc[i.file] = (acc[i.file] || 0) + 1;
-      return acc;
-    }, {});
-
-    return Object.entries(fileCounts)
-      .sort((a, b) => b[1] - a[1])
-      .slice(0, limit)
-      .map(([file, count]) => ({ file: path.relative(this.config.rootPath, file), count }));
-  }
-}
-
-module.exports = CodeScanner;
+/**
+ * Code Scanner
+ *
+ * @purpose Event-driven CodeScanner component
+ * @module sentinel
+ * @layer application
+ * @imports-from fs, path, events
+ * @exports-to sentinel
+ * @side-effects File system reads, Spawns child processes, Console output, Event emission
+ * @critical-for sentinel
+ */
+
+/**
+ * Sentinel Code Scanner
+ *
+ * Scans codebase for security, quality, performance, and AI-specific issues.
+ * Based on CODEX/Thuban FORGE layer specifications.
+ *
+ * Categories:
+ * - Security: Secrets, injection, auth gaps
+ * - Quality: Complexity, duplication, dead code
+ * - Performance: N+1, memory leaks, blocking
+ * - Maintainability: Docs, nesting, coupling
+ * - AI-Specific: Hallucinated imports, inconsistent patterns
+ */
+
+const fs = require('fs');
+const path = require('path');
+const EventEmitter = require('events');
+
+class CodeScanner extends EventEmitter {
+  constructor(config = {}) {
+    super();
+
+    this.config = {
+      rootPath: config.rootPath || process.cwd(),
+      ignorePatterns: config.ignorePatterns || [
+        'node_modules/**',
+        '.git/**',
+        'dist/**',
+        '.orion/snapshots/**'
+      ],
+      maxFileSize: config.maxFileSize || 1024 * 1024, // 1MB
+      complexityThreshold: config.complexityThreshold || 15,
+      nestingThreshold: config.nestingThreshold || 4,
+      ...config
+    };
+
+    // Safe patterns that should NOT trigger security warnings
+    this.safePatterns = [
+      // Environment variable names (not actual secrets)
+      /keyEnv\s*[:=]/i,
+      /envVar\s*[:=]/i,
+      /process\.env\[/,
+      /process\.env\./,
+      // Model version strings and hashes
+      /model\s*[:=]\s*['"][^'"]+['"]/i,
+      /version\s*[:=]\s*['"][^'"]+['"]/i,  // version: "hash"
+      /claude-|gpt-|gemini-|llama-|mistral-|deepseek-|grok-|sonar-/i,
+      // API endpoints (URLs, not keys)
+      /endpoint\s*[:=]/i,
+      /https?:\/\//,
+      // Common safe strings
+      /_API_KEY['"]/,  // env var names end with _API_KEY
+      /API_KEY['"]\s*\)/,  // process.env["API_KEY"]
+      // Error messages and validation
+      /errors?\.\w+\s*=/i,  // errors.password = "message"
+      /Error\s*[:=]/i,
+      /required|invalid|must be|cannot be/i,  // validation messages
+    ];
+
+    // Test file patterns (allow mock data)
+    this.testFilePatterns = [
+      /\.test\.(js|ts|jsx|tsx)$/,
+      /\.spec\.(js|ts|jsx|tsx)$/,
+      /__tests__\//,
+      /\.mock\.(js|ts)$/,
+      /test-.*\.js$/,
+    ];
+
+    // Issue patterns - security focused
+    this.securityPatterns = [
+      {
+        id: 'SEC001',
+        name: 'Hardcoded API Key',
+        // Match strings that look like actual API keys:
+        // - sk-xxx, pk-xxx (Stripe-style)
+        // - xox-xxx (Slack-style)
+        // - AKIA... (AWS-style)
+        // - Mix of numbers/letters that looks random (not readable words)
+        pattern: /['"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['"]|['"][a-zA-Z0-9]{32,}['"]/,
+        context: /(api[_-]?key|apikey|secret[_\s]*key|token|credential|bearer)/i,
+        severity: 'critical',
+        message: 'Possible hardcoded API key or secret detected',
+        skipIfSafe: true  // Skip if line matches safe patterns
+      },
+      {
+        id: 'SEC002',
+        name: 'Hardcoded Password',
+        pattern: /password\s*[:=]\s*['"][^'"]+['"]/i,
+        severity: 'critical',
+        message: 'Hardcoded password detected',
+        skipInTests: true,  // Skip in test files
+        skipIfSafe: true    // Skip error messages and validation
+      },
+      {
+        id: 'SEC003',
+        name: 'SQL Injection Risk',
+        // Only match actual SQL queries with string interpolation
+        // Requires SQL keyword as whole word (not path.join etc)
+        pattern: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|WHERE)\b.*(\$\{|\+\s*['"]|\+\s*\w+|f['"].*\{|%s|%d)/i,
+        severity: 'error',
+        message: 'Potential SQL injection - use parameterized queries'
+      },
+      {
+        id: 'SEC004',
+        name: 'eval() Usage',
+        pattern: /\beval\s*\(/,
+        severity: 'error',
+        message: 'eval() is dangerous and should be avoided'
+      },
+      {
+        id: 'SEC005',
+        name: 'innerHTML Assignment',
+        pattern: /\.innerHTML\s*=/,
+        severity: 'warning',
+        message: 'innerHTML can cause XSS - consider using textContent or sanitization'
+      },
+      {
+        id: 'SEC006',
+        name: 'Disabled Security',
+        // JS/Node: rejectUnauthorized: false
+        // Python: verify=False (requests)
+        // Go: InsecureSkipVerify: true
+        pattern: /rejectUnauthorized\s*:\s*false|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true/,
+        severity: 'error',
+        message: 'SSL certificate validation disabled'
+      },
+      {
+        id: 'SEC007',
+        name: 'Exposed .env Reference',
+        pattern: /\.env['"]/,
+        // JS: fs.read/write  Python: open(  Go: os.Open(
+        context: /fs\.(read|write)|path\.join|open\s*\(|os\.Open/i,
+        severity: 'warning',
+        message: 'Direct .env file manipulation - ensure not exposed'
+      },
+      {
+        id: 'SEC008',
+        name: 'Unsafe Block (Rust)',
+        pattern: /\bunsafe\s*\{/,
+        severity: 'warning',
+        message: 'Rust unsafe block - verify memory safety guarantees'
+      },
+      {
+        id: 'SEC009',
+        name: 'Shell Execution (PHP/Ruby)',
+        pattern: /\bshell_exec\s*\(|\bpassthru\s*\(|`[^`]+`/,
+        severity: 'error',
+        message: 'Shell execution function - command injection risk if input unsanitized'
+      }
+    ];
+
+    // Quality patterns
+    this.qualityPatterns = [
+      {
+        id: 'QUAL001',
+        name: 'Console.log in Production',
+        pattern: /console\.(log|debug|info)\(/,
+        severity: 'info',
+        message: 'console.log found - consider using proper logging',
+        // Only report in non-dev files - skip test files and dev utilities
+        skipInTests: true,
+        skipInDirs: ['test', 'scripts', 'tools', 'dev']
+      },
+      {
+        id: 'QUAL002',
+        name: 'TODO Comment',
+        pattern: /\/\/\s*TODO|\/\*\s*TODO|\*\s*TODO|#\s*TODO/i,
+        severity: 'info',
+        message: 'TODO comment found - track in issue system'
+      },
+      {
+        id: 'QUAL003',
+        name: 'FIXME Comment',
+        pattern: /\/\/\s*FIXME|\/\*\s*FIXME|\*\s*FIXME|#\s*FIXME/i,
+        severity: 'warning',
+        message: 'FIXME comment found - needs attention'
+      },
+      {
+        id: 'QUAL004',
+        name: 'Empty Catch Block',
+        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        severity: 'warning',
+        message: 'Empty catch block swallows errors'
+      },
+      {
+        id: 'QUAL005',
+        name: 'Magic Number',
+        // Only flag suspicious numbers, not common ones like ports, timeouts, dates
+        pattern: /(?<![0-9a-zA-Z_])(?!(?:1000|2000|3000|3001|4000|5000|8000|8080|9000|80|443|24|60|1024|2048|4096)\b)\d{5,}(?![0-9])/,
+        severity: 'info',
+        message: 'Magic number detected - consider using named constant',
+        skipInTests: true
+      },
+      {
+        id: 'QUAL006',
+        name: 'Callback Hell',
+        pattern: /\)\s*=>\s*\{[^}]*\)\s*=>\s*\{[^}]*\)\s*=>\s*\{/,
+        severity: 'warning',
+        message: 'Deeply nested callbacks - consider async/await'
+      }
+    ];
+
+    // Performance patterns
+    this.performancePatterns = [
+      {
+        id: 'PERF001',
+        name: 'Sync FS in Async',
+        pattern: /fs\.(readFileSync|writeFileSync|readdirSync|statSync)/,
+        severity: 'warning',
+        message: 'Synchronous file operation - may block event loop'
+      },
+      {
+        id: 'PERF002',
+        name: 'Missing Await',
+        pattern: /async\s+function[^{]*\{[^}]*(?<!await\s)new\s+Promise/,
+        severity: 'warning',
+        message: 'Promise created in async function without await'
+      },
+      {
+        id: 'PERF003',
+        name: 'Loop Database Query',
+        pattern: /for\s*\([^)]*\)\s*\{[^}]*(query|find|select|update)/i,
+        severity: 'error',
+        message: 'Possible N+1 query pattern - consider batch operation'
+      },
+      {
+        id: 'PERF004',
+        name: 'Large Array in Memory',
+        pattern: /new\s+Array\s*\(\s*\d{6,}\s*\)/,
+        severity: 'warning',
+        message: 'Large array allocation - consider streaming'
+      }
+    ];
+
+    // AI-specific patterns
+    this.aiPatterns = [
+      {
+        id: 'AI001',
+        name: 'Potentially Hallucinated Import',
+        pattern: /require\(['"](?!\.)[^'"]+['"]\)/,
+        severity: 'info',
+        message: 'External dependency - verify it exists in package.json',
+        check: (match, content, filePath) => this._checkDependencyExists(match, filePath)
+      },
+      {
+        id: 'AI002',
+        name: 'Unused Import',
+        pattern: /const\s+(\w+)\s*=\s*require\(['"][^'"]+['"]\)/,
+        severity: 'info',
+        message: 'Import may be unused - verify usage',
+        check: (match, content) => this._checkImportUsage(match, content)
+      },
+      {
+        id: 'AI003',
+        name: 'Over-Engineered Pattern',
+        pattern: /class\s+\w+Factory\s*\{|AbstractFactory|Singleton\.getInstance/,
+        severity: 'info',
+        message: 'Complex pattern detected - ensure justified by requirements'
+      }
+    ];
+  }
+
+  /**
+   * Scan all files in the codebase
+   */
+  async scanAll() {
+    console.log('[CODE-SCANNER] Starting full codebase scan...');
+    const startTime = Date.now();
+
+    const result = {
+      filesScanned: 0,
+      issues: [],
+      summary: {},
+      duration: 0
+    };
+
+    try {
+      const files = await this._discoverFiles(this.config.rootPath);
+      console.log(`[CODE-SCANNER] Found ${files.length} files to scan`);
+
+      for (const file of files) {
+        const fileIssues = await this.scanFile(file);
+        result.filesScanned++;
+        result.issues.push(...fileIssues);
+      }
+
+      result.duration = Date.now() - startTime;
+      result.summary = this._summarizeIssues(result.issues);
+
+      console.log(`[CODE-SCANNER] Scan complete: ${result.filesScanned} files, ${result.issues.length} issues`);
+      return result;
+    } catch (error) {
+      console.error('[CODE-SCANNER] Scan failed:', error.message);
+      result.error = error.message;
+      return result;
+    }
+  }
+
+  /**
+   * Scan specific files
+   */
+  async scanFiles(filePaths) {
+    const result = {
+      filesScanned: 0,
+      issues: [],
+      summary: {}
+    };
+
+    for (const filePath of filePaths) {
+      const fileIssues = await this.scanFile(filePath);
+      result.filesScanned++;
+      result.issues.push(...fileIssues);
+    }
+
+    result.summary = this._summarizeIssues(result.issues);
+    return result;
+  }
+
+  /**
+   * Scan a single file
+   */
+  async scanFile(filePath) {
+    const issues = [];
+
+    try {
+      // Check file size
+      const stats = fs.statSync(filePath);
+
+      // Skip symlinks that point outside the project (prevent loops)
+      if (stats.isSymbolicLink && stats.isSymbolicLink()) {
+        return [];
+      }
+
+      if (stats.size === 0) {
+        return []; // Empty file — nothing to scan
+      }
+
+      if (stats.size > this.config.maxFileSize) {
+        return [{
+          file: filePath,
+          category: 'quality',
+          severity: 'info',
+          id: 'FILE001',
+          message: `File too large (${Math.round(stats.size / 1024)}KB) - skipped detailed scan`
+        }];
+      }
+
+      // Read file content
+      let rawContent;
+      try {
+        rawContent = fs.readFileSync(filePath);
+      } catch (readErr) {
+        return []; // Unreadable file — skip silently
+      }
+
+      // Detect binary files by checking for null bytes in first 512 bytes
+      const sampleSize = Math.min(rawContent.length, 512);
+      for (let i = 0; i < sampleSize; i++) {
+        if (rawContent[i] === 0) {
+          return []; // Binary file — skip
+        }
+      }
+
+      const content = rawContent.toString('utf8');
+      const lines = content.split('\n');
+      const ext = path.extname(filePath).toLowerCase();
+      const supportedExts = ['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs', '.py', '.pyw', '.go', '.rs', '.java', '.kt', '.cs', '.php', '.rb'];
+
+      // Scan supported source files with pattern matching
+      if (supportedExts.includes(ext)) {
+        // Security scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.securityPatterns, 'security'));
+
+        // Quality scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.qualityPatterns, 'quality'));
+
+        // Performance scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.performancePatterns, 'performance'));
+
+        // AI-specific scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.aiPatterns, 'ai'));
+
+        // Complexity analysis
+        issues.push(...this._analyzeComplexity(filePath, content, lines));
+
+        // Nesting analysis
+        issues.push(...this._analyzeNesting(filePath, content, lines));
+      }
+
+      // JSON-specific checks
+      if (ext === '.json') {
+        issues.push(...this._scanJson(filePath, content));
+      }
+
+      // Emit event for each issue found
+      for (const issue of issues) {
+        this.emit('issueFound', issue);
+      }
+
+      return issues;
+    } catch (error) {
+      return [{
+        file: filePath,
+        category: 'error',
+        severity: 'error',
+        id: 'SCAN001',
+        message: `Failed to scan file: ${error.message}`
+      }];
+    }
+  }
+
+  /**
+   * Get current scan rules
+   */
+  getRules() {
+    return {
+      security: this.securityPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
+      quality: this.qualityPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
+      performance: this.performancePatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
+      ai: this.aiPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity }))
+    };
+  }
+
+  // Private methods
+
+  async _discoverFiles(dir, files = []) {
+    try {
+      const entries = fs.readdirSync(dir, { withFileTypes: true });
+
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        const relativePath = path.relative(this.config.rootPath, fullPath);
+
+        // Check ignore patterns
+        if (this._shouldIgnore(relativePath)) {
+          continue;
+        }
+
+        if (entry.isDirectory()) {
+          await this._discoverFiles(fullPath, files);
+        } else if (entry.isFile()) {
+          const ext = path.extname(entry.name).toLowerCase();
+          if (['.js', '.ts', '.jsx', '.tsx', '.json', '.py', '.pyw', '.go', '.rs', '.java', '.kt', '.cs', '.php', '.rb'].includes(ext)) {
+            files.push(fullPath);
+          }
+        }
+      }
+    } catch (error) {
+      // Skip inaccessible directories
+    }
+
+    return files;
+  }
+
+  _shouldIgnore(relativePath) {
+    const normalized = relativePath.replace(/\\/g, '/');
+
+    // Always ignore any path containing these directories (anywhere in path)
+    const alwaysIgnore = ['node_modules', '.git', 'dist', '.vite'];
+    for (const dir of alwaysIgnore) {
+      if (normalized.includes('/' + dir + '/') ||
+          normalized.startsWith(dir + '/') ||
+          normalized === dir ||
+          normalized.endsWith('/' + dir)) {
+        return true;
+      }
+    }
+
+    for (const pattern of this.config.ignorePatterns) {
+      const normalizedPattern = pattern.replace(/\\/g, '/');
+
+      // Extract base directory from pattern (e.g., 'node_modules' from 'node_modules/**')
+      const baseDir = normalizedPattern.split('/')[0].replace(/\*/g, '');
+
+      // Check if path IS the ignored directory or starts with it
+      if (baseDir && (normalized === baseDir || normalized.startsWith(baseDir + '/'))) {
+        return true;
+      }
+
+      // Simple glob matching for more complex patterns
+      let regexPattern = normalizedPattern
+        .replace(/\./g, '\\.')
+        .replace(/\*\*/g, '.*')
+        .replace(/\*/g, '[^/]*');
+
+      if (new RegExp('^' + regexPattern).test(normalized)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  _runPatternScan(filePath, content, lines, patterns, category) {
+    const issues = [];
+
+    // Check if this is a test file (test against basename only to avoid matching parent folder names)
+    const basename = path.basename(filePath);
+    const isTestFile = this.testFilePatterns.some(p => p.test(basename)) ||
+      this.testFilePatterns.some(p => p.test(filePath) && !p.source.includes('\\.js$'));
+    const relativePath = path.relative(this.config.rootPath, filePath).replace(/\\/g, '/');
+
+    for (const pattern of patterns) {
+      // Skip this pattern entirely in test files if flagged
+      if (pattern.skipInTests && isTestFile) {
+        continue;
+      }
+
+      // Skip if file is in excluded directories
+      if (pattern.skipInDirs) {
+        const inSkippedDir = pattern.skipInDirs.some(dir =>
+          relativePath.startsWith(dir + '/') || relativePath.includes('/' + dir + '/')
+        );
+        if (inSkippedDir) continue;
+      }
+
+      // Check context pattern first if it exists (file-level)
+      if (pattern.context && !pattern.lineContext && !pattern.context.test(content)) {
+        continue;
+      }
+
+      // Find all matches
+      let lineNum = 0;
+      for (const line of lines) {
+        lineNum++;
+        const match = line.match(pattern.pattern);
+
+        if (match) {
+          // Skip if line matches any safe pattern (for SEC001 type checks)
+          if (pattern.skipIfSafe) {
+            const isSafe = this.safePatterns.some(sp => sp.test(line));
+            if (isSafe) continue;
+          }
+
+          // Run additional check if defined
+          if (pattern.check) {
+            const shouldReport = pattern.check(match, content, filePath);
+            if (!shouldReport) continue;
+          }
+
+          issues.push({
+            file: filePath,
+            line: lineNum,
+            column: match.index,
+            category,
+            severity: pattern.severity,
+            id: pattern.id,
+            name: pattern.name,
+            message: pattern.message,
+            code: line.trim().substring(0, 100)
+          });
+        }
+      }
+    }
+
+    return issues;
+  }
+
+  _analyzeComplexity(filePath, content, lines) {
+    const issues = [];
+
+    // Count decision points (simplified cyclomatic complexity)
+    const decisionKeywords = /\b(if|else|for|while|switch|case|catch|&&|\|\||\?)\b/g;
+    const functionMatches = content.match(/function\s+\w+|=>\s*\{|async\s+\w+/g) || [];
+    const decisionMatches = content.match(decisionKeywords) || [];
+
+    const avgComplexity = functionMatches.length > 0
+      ? decisionMatches.length / functionMatches.length
+      : 0;
+
+    if (avgComplexity > this.config.complexityThreshold) {
+      issues.push({
+        file: filePath,
+        category: 'quality',
+        severity: 'warning',
+        id: 'CMPLX001',
+        name: 'High Complexity',
+        message: `Average cyclomatic complexity is ${avgComplexity.toFixed(1)} (threshold: ${this.config.complexityThreshold})`
+      });
+    }
+
+    // Check file length
+    if (lines.length > 500) {
+      issues.push({
+        file: filePath,
+        category: 'quality',
+        severity: 'info',
+        id: 'CMPLX002',
+        name: 'Long File',
+        message: `File has ${lines.length} lines - consider splitting`
+      });
+    }
+
+    return issues;
+  }
+
+  _analyzeNesting(filePath, content, lines) {
+    const issues = [];
+    let maxNesting = 0;
+    let currentNesting = 0;
+    let maxNestingLine = 0;
+
+    let lineNum = 0;
+    for (const line of lines) {
+      lineNum++;
+
+      // Count braces (simplified)
+      const opens = (line.match(/\{/g) || []).length;
+      const closes = (line.match(/\}/g) || []).length;
+
+      currentNesting += opens - closes;
+
+      if (currentNesting > maxNesting) {
+        maxNesting = currentNesting;
+        maxNestingLine = lineNum;
+      }
+    }
+
+    if (maxNesting > this.config.nestingThreshold) {
+      issues.push({
+        file: filePath,
+        line: maxNestingLine,
+        category: 'quality',
+        severity: 'warning',
+        id: 'NEST001',
+        name: 'Deep Nesting',
+        message: `Max nesting depth is ${maxNesting} at line ${maxNestingLine} (threshold: ${this.config.nestingThreshold})`
+      });
+    }
+
+    return issues;
+  }
+
+  _scanJson(filePath, content) {
+    const issues = [];
+
+    try {
+      JSON.parse(content);
+    } catch (error) {
+      issues.push({
+        file: filePath,
+        category: 'quality',
+        severity: 'error',
+        id: 'JSON001',
+        name: 'Invalid JSON',
+        message: `JSON parse error: ${error.message}`
+      });
+    }
+
+    // Check for sensitive data in JSON
+    if (/(password|secret|api[_-]?key|token)/i.test(content)) {
+      issues.push({
+        file: filePath,
+        category: 'security',
+        severity: 'warning',
+        id: 'JSON002',
+        name: 'Sensitive Data in JSON',
+        message: 'Possible sensitive data in JSON file - verify not committed'
+      });
+    }
+
+    return issues;
+  }
+
+  _checkDependencyExists(match, filePath) {
+    // Extract module name
+    const moduleMatch = match[0].match(/require\(['"]([^'"]+)['"]\)/);
+    if (!moduleMatch) return true;
+
+    const moduleName = moduleMatch[1];
+
+    // Skip relative imports
+    if (moduleName.startsWith('.')) return false;
+
+    // Skip Node built-ins
+    const builtins = ['fs', 'path', 'os', 'crypto', 'http', 'https', 'events', 'util', 'stream', 'child_process', 'url', 'querystring', 'buffer'];
+    if (builtins.includes(moduleName.split('/')[0])) return false;
+
+    // Check package.json
+    try {
+      let pkgPath = path.join(this.config.rootPath, 'package.json');
+
+      // Also check server/package.json for server files
+      if (filePath.includes('server')) {
+        const serverPkgPath = path.join(this.config.rootPath, 'server', 'package.json');
+        if (fs.existsSync(serverPkgPath)) {
+          pkgPath = serverPkgPath;
+        }
+      }
+
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      const allDeps = {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {})
+      };
+
+      const baseModule = moduleName.split('/')[0];
+      return !allDeps[baseModule] && !allDeps[moduleName];
+    } catch (e) {
+      return false;
+    }
+  }
+
+  _checkImportUsage(match, content) {
+    const varName = match[1];
+    if (!varName) return false;
+
+    // Count occurrences (beyond the require line)
+    const regex = new RegExp('\\b' + varName + '\\b', 'g');
+    const occurrences = (content.match(regex) || []).length;
+
+    // If only appears once (the require), it's unused
+    return occurrences <= 1;
+  }
+
+  _summarizeIssues(issues) {
+    return {
+      total: issues.length,
+      bySeverity: {
+        critical: issues.filter(i => i.severity === 'critical').length,
+        error: issues.filter(i => i.severity === 'error').length,
+        warning: issues.filter(i => i.severity === 'warning').length,
+        info: issues.filter(i => i.severity === 'info').length
+      },
+      byCategory: issues.reduce((acc, i) => {
+        acc[i.category] = (acc[i.category] || 0) + 1;
+        return acc;
+      }, {}),
+      topFiles: this._getTopFiles(issues, 10)
+    };
+  }
+
+  _getTopFiles(issues, limit) {
+    const fileCounts = issues.reduce((acc, i) => {
+      acc[i.file] = (acc[i.file] || 0) + 1;
+      return acc;
+    }, {});
+
+    return Object.entries(fileCounts)
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, limit)
+      .map(([file, count]) => ({ file: path.relative(this.config.rootPath, file), count }));
+  }
+}
+
+module.exports = CodeScanner;