tutanus 0.12.0

package/dist/analysts/go/analysts/analyst-go.js

@@ -0,0 +1,74 @@
+import { messages } from '../../../core/messages/index.js';
+import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
+import { criarAnalista, criarOcorrencia } from '../../../types/index.js';
+const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
+function warn(message, relPath, line, nivel) {
+    return criarOcorrencia({
+        relPath,
+        mensagem: message,
+        linha: line,
+        nivel: nivel ?? messages.SeverityNiveis.warning,
+        origem: messages.AnalystOrigens.go,
+        tipo: messages.AnalystTipos.go
+    });
+}
+function collectGeneralIssues(src, relPath) {
+    const ocorrencias = [];
+    const lineOf = createLineLookup(src).lineAt;
+    const scan = maskGoComments(src);
+    const packageMatch = scan.match(/^\s*package\s+(\w+)/m);
+    if (packageMatch) {
+        const pkgName = packageMatch[1];
+        if (/[A-Z_-]/.test(pkgName)) {
+            const line = lineOf(packageMatch.index ?? 0);
+            ocorrencias.push(warn(`Package name '${pkgName}' should be lowercase without underscores or hyphens`, relPath, line, messages.SeverityNiveis.suggestion));
+        }
+    }
+    if (packageMatch && !/^(main|\w+_test)$/.test(packageMatch[1])) {
+        const srcBeforePackage = src.slice(0, packageMatch.index ?? 0);
+        if (!/\/\/\s*(Package|pacote)\s/i.test(srcBeforePackage) && !/\/\*[\s\S]*?(Package|pacote)/i.test(srcBeforePackage)) {
+            const line = lineOf(packageMatch.index ?? 0);
+            ocorrencias.push(warn(`Package '${packageMatch[1]}' missing package-level comment`, relPath, line, messages.SeverityNiveis.suggestion));
+        }
+    }
+    for (const match of scan.matchAll(/_ "(.*?)"/g)) {
+        const line = lineOf(match.index);
+        const importPath = match[1];
+        const srcBefore = src.slice(0, match.index);
+        if (!/\/\/\s*why|\/\/\s*required|\/\/\s*driver/i.test(srcBefore)) {
+            ocorrencias.push(warn(`Blank import '${importPath}' should have a comment explaining why`, relPath, line, messages.SeverityNiveis.info));
+        }
+    }
+    for (const match of scan.matchAll(/func\s+\((\w+)\s+\*?\w+\)\s+\w+/g)) {
+        const receiver = match[1];
+        if (receiver.length > 2 && !/^[a-z]{1,2}$/.test(receiver)) {
+            const line = lineOf(match.index);
+            ocorrencias.push(warn(`Receiver '${receiver}' should be 1-2 lowercase letters; prefer '${receiver[0].toLowerCase()}'`, relPath, line, messages.SeverityNiveis.suggestion));
+        }
+    }
+    let maxDepth = 0;
+    const lines = src.split('\n');
+    for (const line of lines) {
+        const indent = line.match(/^\s*/)?.[0].length ?? 0;
+        const depth = Math.floor(indent / 2);
+        maxDepth = Math.max(maxDepth, depth);
+    }
+    if (maxDepth > 8) {
+        ocorrencias.push(warn(`Deep nesting detected (${maxDepth} levels); consider refactoring`, relPath, 1, messages.SeverityNiveis.suggestion));
+    }
+    return ocorrencias;
+}
+export const analistaGo = criarAnalista({
+    nome: 'analista-go',
+    categoria: 'linguagem',
+    descricao: 'Analisa código Go em busca de organização, nomenclatura e boas práticas gerais.',
+    global: false,
+    test: (relPath) => /\.go$/i.test(relPath),
+    aplicar: async (src, relPath) => {
+        if (disableEnv)
+            return null;
+        const msgs = collectGeneralIssues(src, relPath);
+        return msgs.length ? msgs : null;
+    }
+});
+//# sourceMappingURL=analyst-go.js.map

package/dist/analysts/go/analysts/analyst-go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyst-go.js","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/analyst-go.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;AAGjE,SAAS,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,IAAa,EAAE,KAAc;IAC3E,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,KAAK,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO;QAC/C,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW,EAAE,OAAe;IACxD,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAGjC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;YAC7C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,OAAO,sDAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5J,CAAC;IACH,CAAC;IAGD,IAAI,YAAY,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;YAC7C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,CAAC,CAAC,iCAAiC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,UAAU,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,QAAQ,8CAA8C,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7K,CAAC;IACH,CAAC;IAGD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,QAAQ,gCAAgC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7I,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;IACtC,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,iFAAiF;IAC5F,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAyB,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;CACF,CAAC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { messages } from '@core/messages';\nimport { createLineLookup, maskGoComments } from '@shared/helpers';\n\nimport { criarAnalista, criarOcorrencia } from '@';\n\nconst disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';\ntype Msg = ReturnType<typeof criarOcorrencia>;\n\nfunction warn(message: string, relPath: string, line?: number, nivel?: string): Msg {\n  return criarOcorrencia({\n    relPath,\n    mensagem: message,\n    linha: line,\n    nivel: nivel ?? messages.SeverityNiveis.warning,\n    origem: messages.AnalystOrigens.go,\n    tipo: messages.AnalystTipos.go\n  });\n}\n\nfunction collectGeneralIssues(src: string, relPath: string): Msg[] {\n  const ocorrencias: Msg[] = [];\n  const lineOf = createLineLookup(src).lineAt;\n  const scan = maskGoComments(src);\n\n  // Package naming convention\n  const packageMatch = scan.match(/^\\s*package\\s+(\\w+)/m);\n  if (packageMatch) {\n    const pkgName = packageMatch[1];\n    if (/[A-Z_-]/.test(pkgName)) {\n      const line = lineOf(packageMatch.index ?? 0);\n      ocorrencias.push(warn(`Package name '${pkgName}' should be lowercase without underscores or hyphens`, relPath, line, messages.SeverityNiveis.suggestion));\n    }\n  }\n\n  // Missing package comment (excluding main and test packages)\n  if (packageMatch && !/^(main|\\w+_test)$/.test(packageMatch[1])) {\n    const srcBeforePackage = src.slice(0, packageMatch.index ?? 0);\n    if (!/\\/\\/\\s*(Package|pacote)\\s/i.test(srcBeforePackage) && !/\\/\\*[\\s\\S]*?(Package|pacote)/i.test(srcBeforePackage)) {\n      const line = lineOf(packageMatch.index ?? 0);\n      ocorrencias.push(warn(`Package '${packageMatch[1]}' missing package-level comment`, relPath, line, messages.SeverityNiveis.suggestion));\n    }\n  }\n\n  // Blank import without init or comment\n  for (const match of scan.matchAll(/_ \"(.*?)\"/g)) {\n    const line = lineOf(match.index);\n    const importPath = match[1];\n    const srcBefore = src.slice(0, match.index);\n    if (!/\\/\\/\\s*why|\\/\\/\\s*required|\\/\\/\\s*driver/i.test(srcBefore)) {\n      ocorrencias.push(warn(`Blank import '${importPath}' should have a comment explaining why`, relPath, line, messages.SeverityNiveis.info));\n    }\n  }\n\n  // Receiver naming convention\n  for (const match of scan.matchAll(/func\\s+\\((\\w+)\\s+\\*?\\w+\\)\\s+\\w+/g)) {\n    const receiver = match[1];\n    if (receiver.length > 2 && !/^[a-z]{1,2}$/.test(receiver)) {\n      const line = lineOf(match.index);\n      ocorrencias.push(warn(`Receiver '${receiver}' should be 1-2 lowercase letters; prefer '${receiver[0].toLowerCase()}'`, relPath, line, messages.SeverityNiveis.suggestion));\n    }\n  }\n\n  // Deeply nested conditionals (arrow code)\n  let maxDepth = 0;\n  const lines = src.split('\\n');\n  for (const line of lines) {\n    const indent = line.match(/^\\s*/)?.[0].length ?? 0;\n    const depth = Math.floor(indent / 2);\n    maxDepth = Math.max(maxDepth, depth);\n  }\n  if (maxDepth > 8) {\n    ocorrencias.push(warn(`Deep nesting detected (${maxDepth} levels); consider refactoring`, relPath, 1, messages.SeverityNiveis.suggestion));\n  }\n\n  return ocorrencias;\n}\n\nexport const analistaGo = criarAnalista({\n  nome: 'analista-go',\n  categoria: 'linguagem',\n  descricao: 'Analisa código Go em busca de organização, nomenclatura e boas práticas gerais.',\n  global: false,\n  test: (relPath: string): boolean => /\\.go$/i.test(relPath),\n  aplicar: async (src, relPath): Promise<Msg[] | null> => {\n    if (disableEnv) return null;\n    const msgs = collectGeneralIssues(src, relPath);\n    return msgs.length ? msgs : null;\n  }\n});\n"]}

package/dist/analysts/go/analysts/analyst-resources.d.ts

@@ -0,0 +1,12 @@
+import { criarOcorrencia } from '../../../types/index.js';
+type Msg = ReturnType<typeof criarOcorrencia>;
+export declare const analistaGoRecursos: {
+    nome: string;
+    categoria: string;
+    descricao: string;
+    global: false;
+    test: (relPath: string) => boolean;
+    aplicar: (src: string, relPath: string) => Promise<Msg[] | null>;
+};
+export {};
+//# sourceMappingURL=analyst-resources.d.ts.map

package/dist/analysts/go/analysts/analyst-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyst-resources.d.ts","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/analyst-resources.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,eAAe,EAAE,MAAM,GAAG,CAAC;AAGnD,KAAK,GAAG,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAyD9C,eAAO,MAAM,kBAAkB;;;;;oBAKb,MAAM,KAAG,OAAO;+CACD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CAKpD,CAAC"}

package/dist/analysts/go/analysts/analyst-resources.js

@@ -0,0 +1,62 @@
+import { messages } from '../../../core/messages/index.js';
+import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
+import { criarAnalista, criarOcorrencia } from '../../../types/index.js';
+const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
+function warn(message, relPath, line, nivel) {
+    return criarOcorrencia({
+        relPath,
+        mensagem: message,
+        linha: line,
+        nivel: nivel ?? messages.SeverityNiveis.warning,
+        origem: messages.AnalystOrigens.go,
+        tipo: messages.AnalystTipos.go
+    });
+}
+function collectResourceIssues(src, relPath) {
+    const ocorrencias = [];
+    const lineOf = createLineLookup(src).lineAt;
+    const scan = maskGoComments(src);
+    for (const match of scan.matchAll(/\b(?:os\.Open|os\.Create|file\.Open|http\.Get|http\.Post|net\.Dial|sql\.Open)\s*\(/g)) {
+        const line = lineOf(match.index);
+        const snippet = src.slice(match.index, match.index + 200);
+        if (!/defer\s+\w+\.Close\(\)/.test(snippet) && !/defer\s+\w+\.Release\(\)/.test(snippet)) {
+            ocorrencias.push(warn(messages.GoMensagens.missingDeferClose, relPath, line));
+        }
+    }
+    for (const match of scan.matchAll(/\bos\.Open\s*\(/g)) {
+        const line = lineOf(match.index);
+        const snippet = src.slice(match.index, match.index + 200);
+        if (!/\.Close\(\)/.test(snippet)) {
+            ocorrencias.push(warn(messages.GoMensagens.missingDeferClose, relPath, line, messages.SeverityNiveis.error));
+        }
+    }
+    for (const match of scan.matchAll(/resp(?:onse)?\.Body\s*(?!=)/g)) {
+        const line = lineOf(match.index);
+        const snippet = src.slice(match.index, match.index + 200);
+        if (!/\.Close\(\)/.test(snippet)) {
+            ocorrencias.push(warn('http response body not closed; potential resource leak', relPath, line, messages.SeverityNiveis.error));
+        }
+    }
+    for (const match of scan.matchAll(/^\s*go\s+func\(/gm)) {
+        const line = lineOf(match.index);
+        const block = src.slice(match.index, match.index + 300);
+        if (!block.includes('sync.WaitGroup') && !block.includes('done') && !block.includes('quit') && !block.includes('ctx.Done')) {
+            ocorrencias.push(warn('Goroutine without synchronization mechanism; potential leak', relPath, line, messages.SeverityNiveis.warning));
+        }
+    }
+    return ocorrencias;
+}
+export const analistaGoRecursos = criarAnalista({
+    nome: 'analista-go-recursos',
+    categoria: 'recursos',
+    descricao: 'Detecta vazamentos de recursos e falta de fechamento em código Go.',
+    global: false,
+    test: (relPath) => /\.go$/i.test(relPath),
+    aplicar: async (src, relPath) => {
+        if (disableEnv)
+            return null;
+        const msgs = collectResourceIssues(src, relPath);
+        return msgs.length ? msgs : null;
+    }
+});
+//# sourceMappingURL=analyst-resources.js.map

package/dist/analysts/go/analysts/analyst-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyst-resources.js","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/analyst-resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;AAGjE,SAAS,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,IAAa,EAAE,KAAc;IAC3E,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,KAAK,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO;QAC/C,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAGjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,qFAAqF,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACjI,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3H,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,SAAS,EAAE,UAAU;IACrB,SAAS,EAAE,oEAAoE;IAC/E,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAyB,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;CACF,CAAC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { messages } from '@core/messages';\nimport { createLineLookup, maskGoComments } from '@shared/helpers';\n\nimport { criarAnalista, criarOcorrencia } from '@';\n\nconst disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';\ntype Msg = ReturnType<typeof criarOcorrencia>;\n\nfunction warn(message: string, relPath: string, line?: number, nivel?: string): Msg {\n  return criarOcorrencia({\n    relPath,\n    mensagem: message,\n    linha: line,\n    nivel: nivel ?? messages.SeverityNiveis.warning,\n    origem: messages.AnalystOrigens.go,\n    tipo: messages.AnalystTipos.go\n  });\n}\n\nfunction collectResourceIssues(src: string, relPath: string): Msg[] {\n  const ocorrencias: Msg[] = [];\n  const lineOf = createLineLookup(src).lineAt;\n  const scan = maskGoComments(src);\n\n  // Missing defer close on resources\n  for (const match of scan.matchAll(/\\b(?:os\\.Open|os\\.Create|file\\.Open|http\\.Get|http\\.Post|net\\.Dial|sql\\.Open)\\s*\\(/g)) {\n    const line = lineOf(match.index);\n    const snippet = src.slice(match.index, match.index + 200);\n    if (!/defer\\s+\\w+\\.Close\\(\\)/.test(snippet) && !/defer\\s+\\w+\\.Release\\(\\)/.test(snippet)) {\n      ocorrencias.push(warn(messages.GoMensagens.missingDeferClose, relPath, line));\n    }\n  }\n\n  // File.Open without explicit Close anywhere\n  for (const match of scan.matchAll(/\\bos\\.Open\\s*\\(/g)) {\n    const line = lineOf(match.index);\n    const snippet = src.slice(match.index, match.index + 200);\n    if (!/\\.Close\\(\\)/.test(snippet)) {\n      ocorrencias.push(warn(messages.GoMensagens.missingDeferClose, relPath, line, messages.SeverityNiveis.error));\n    }\n  }\n\n  // http.Body not closed\n  for (const match of scan.matchAll(/resp(?:onse)?\\.Body\\s*(?!=)/g)) {\n    const line = lineOf(match.index);\n    const snippet = src.slice(match.index, match.index + 200);\n    if (!/\\.Close\\(\\)/.test(snippet)) {\n      ocorrencias.push(warn('http response body not closed; potential resource leak', relPath, line, messages.SeverityNiveis.error));\n    }\n  }\n\n  // goroutine resource leak potential\n  for (const match of scan.matchAll(/^\\s*go\\s+func\\(/gm)) {\n    const line = lineOf(match.index);\n    const block = src.slice(match.index, match.index + 300);\n    if (!block.includes('sync.WaitGroup') && !block.includes('done') && !block.includes('quit') && !block.includes('ctx.Done')) {\n      ocorrencias.push(warn('Goroutine without synchronization mechanism; potential leak', relPath, line, messages.SeverityNiveis.warning));\n    }\n  }\n\n  return ocorrencias;\n}\n\nexport const analistaGoRecursos = criarAnalista({\n  nome: 'analista-go-recursos',\n  categoria: 'recursos',\n  descricao: 'Detecta vazamentos de recursos e falta de fechamento em código Go.',\n  global: false,\n  test: (relPath: string): boolean => /\\.go$/i.test(relPath),\n  aplicar: async (src, relPath): Promise<Msg[] | null> => {\n    if (disableEnv) return null;\n    const msgs = collectResourceIssues(src, relPath);\n    return msgs.length ? msgs : null;\n  }\n});\n"]}

package/dist/analysts/go/analysts/analyst-security.d.ts

@@ -0,0 +1,12 @@
+import { criarOcorrencia } from '../../../types/index.js';
+type Msg = ReturnType<typeof criarOcorrencia>;
+export declare const analistaGoSeguranca: {
+    nome: string;
+    categoria: string;
+    descricao: string;
+    global: false;
+    test: (relPath: string) => boolean;
+    aplicar: (src: string, relPath: string) => Promise<Msg[] | null>;
+};
+export {};
+//# sourceMappingURL=analyst-security.d.ts.map

package/dist/analysts/go/analysts/analyst-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyst-security.d.ts","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/analyst-security.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,eAAe,EAAE,MAAM,GAAG,CAAC;AAGnD,KAAK,GAAG,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AA0C9C,eAAO,MAAM,mBAAmB;;;;;oBAKd,MAAM,KAAG,OAAO;+CACD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CAKpD,CAAC"}

package/dist/analysts/go/analysts/analyst-security.js

@@ -0,0 +1,51 @@
+import { messages } from '../../../core/messages/index.js';
+import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
+import { criarAnalista, criarOcorrencia } from '../../../types/index.js';
+const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
+function warn(message, relPath, line, nivel) {
+    return criarOcorrencia({
+        relPath,
+        mensagem: message,
+        linha: line,
+        nivel: nivel ?? messages.SeverityNiveis.warning,
+        origem: messages.AnalystOrigens.go,
+        tipo: messages.AnalystTipos.go
+    });
+}
+function collectSecurityIssues(src, relPath) {
+    const ocorrencias = [];
+    const lineOf = createLineLookup(src).lineAt;
+    const scan = maskGoComments(src);
+    for (const match of scan.matchAll(/^\s*[a-zA-Z_][a-zA-Z0-9_]*\s*:?\s*=\s*(?:os\.|ioutil\.|io\.|net\.|http\.|json\.|xml\.|encoding\/)\w+\.\w+\([^)]*\)\s*$/gm)) {
+        if (/err\s*:?=\s*/.test(match[0]) || /if\s+err\s*!=\s*nil/.test(scan.slice(0, match.index)))
+            continue;
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(messages.GoMensagens.uncheckedError, relPath, line, messages.SeverityNiveis.error));
+    }
+    for (const match of scan.matchAll(/(?:password|secret|api[_-]?key|token|credential)\s*(?::\s*|=\s*["'`])([^"'`\s]{4,})/gi)) {
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(messages.GoMensagens.hardcodedSecret, relPath, line, messages.SeverityNiveis.error));
+    }
+    for (const match of scan.matchAll(/\b(fmt\.(?:Print|Sprint|Fprint))\s*\(\s*([^)]+)\)/g)) {
+        const args = match[2] ?? '';
+        if (/["'`]/.test(args.trim()))
+            continue;
+        const line = lineOf(match.index);
+        ocorrencias.push(warn(messages.GoMensagens.printWithoutFormat, relPath, line));
+    }
+    return ocorrencias;
+}
+export const analistaGoSeguranca = criarAnalista({
+    nome: 'analista-go-seguranca',
+    categoria: 'seguranca',
+    descricao: 'Detecta vulnerabilidades de segurança em código Go.',
+    global: false,
+    test: (relPath) => /\.go$/i.test(relPath),
+    aplicar: async (src, relPath) => {
+        if (disableEnv)
+            return null;
+        const msgs = collectSecurityIssues(src, relPath);
+        return msgs.length ? msgs : null;
+    }
+});
+//# sourceMappingURL=analyst-security.js.map

package/dist/analysts/go/analysts/analyst-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyst-security.js","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/analyst-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;AAGjE,SAAS,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,IAAa,EAAE,KAAc;IAC3E,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,KAAK,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO;QAC/C,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAGjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,0HAA0H,CAAC,EAAE,CAAC;QAC9J,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QACtG,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,uFAAuF,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7G,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;IAC/C,IAAI,EAAE,uBAAuB;IAC7B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,qDAAqD;IAChE,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAyB,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;CACF,CAAC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { messages } from '@core/messages';\nimport { createLineLookup, maskGoComments } from '@shared/helpers';\n\nimport { criarAnalista, criarOcorrencia } from '@';\n\nconst disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';\ntype Msg = ReturnType<typeof criarOcorrencia>;\n\nfunction warn(message: string, relPath: string, line?: number, nivel?: string): Msg {\n  return criarOcorrencia({\n    relPath,\n    mensagem: message,\n    linha: line,\n    nivel: nivel ?? messages.SeverityNiveis.warning,\n    origem: messages.AnalystOrigens.go,\n    tipo: messages.AnalystTipos.go\n  });\n}\n\nfunction collectSecurityIssues(src: string, relPath: string): Msg[] {\n  const ocorrencias: Msg[] = [];\n  const lineOf = createLineLookup(src).lineAt;\n  const scan = maskGoComments(src);\n\n  // Unchecked errors from common Go functions\n  for (const match of scan.matchAll(/^\\s*[a-zA-Z_][a-zA-Z0-9_]*\\s*:?\\s*=\\s*(?:os\\.|ioutil\\.|io\\.|net\\.|http\\.|json\\.|xml\\.|encoding\\/)\\w+\\.\\w+\\([^)]*\\)\\s*$/gm)) {\n    if (/err\\s*:?=\\s*/.test(match[0]) || /if\\s+err\\s*!=\\s*nil/.test(scan.slice(0, match.index))) continue;\n    const line = lineOf(match.index);\n    ocorrencias.push(warn(messages.GoMensagens.uncheckedError, relPath, line, messages.SeverityNiveis.error));\n  }\n\n  // Hardcoded secrets\n  for (const match of scan.matchAll(/(?:password|secret|api[_-]?key|token|credential)\\s*(?::\\s*|=\\s*[\"'`])([^\"'`\\s]{4,})/gi)) {\n    const line = lineOf(match.index);\n    ocorrencias.push(warn(messages.GoMensagens.hardcodedSecret, relPath, line, messages.SeverityNiveis.error));\n  }\n\n  // Printf without format string\n  for (const match of scan.matchAll(/\\b(fmt\\.(?:Print|Sprint|Fprint))\\s*\\(\\s*([^)]+)\\)/g)) {\n    const args = match[2] ?? '';\n    if (/[\"'`]/.test(args.trim())) continue;\n    const line = lineOf(match.index);\n    ocorrencias.push(warn(messages.GoMensagens.printWithoutFormat, relPath, line));\n  }\n\n  return ocorrencias;\n}\n\nexport const analistaGoSeguranca = criarAnalista({\n  nome: 'analista-go-seguranca',\n  categoria: 'seguranca',\n  descricao: 'Detecta vulnerabilidades de segurança em código Go.',\n  global: false,\n  test: (relPath: string): boolean => /\\.go$/i.test(relPath),\n  aplicar: async (src, relPath): Promise<Msg[] | null> => {\n    if (disableEnv) return null;\n    const msgs = collectSecurityIssues(src, relPath);\n    return msgs.length ? msgs : null;\n  }\n});\n"]}

package/dist/analysts/go/analysts/index.d.ts

@@ -0,0 +1,6 @@
+export * from './analyst-best-practices.js';
+export * from './analyst-concurrency.js';
+export * from './analyst-go.js';
+export * from './analyst-resources.js';
+export * from './analyst-security.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/go/analysts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/index.ts"],"names":[],"mappings":"AACA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC"}

package/dist/analysts/go/analysts/index.js

@@ -0,0 +1,6 @@
+export * from './analyst-best-practices.js';
+export * from './analyst-concurrency.js';
+export * from './analyst-go.js';
+export * from './analyst-resources.js';
+export * from './analyst-security.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/go/analysts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/go/analysts/index.ts"],"names":[],"mappings":"AACA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './analyst-best-practices.js';\nexport * from './analyst-concurrency.js';\nexport * from './analyst-go.js';\nexport * from './analyst-resources.js';\nexport * from './analyst-security.js';\n"]}

package/dist/analysts/go/detectors/detector-conventions.d.ts

@@ -0,0 +1,12 @@
+import type { criarOcorrencia } from '../../../types/index.js';
+type Msg = ReturnType<typeof criarOcorrencia>;
+export declare const detectorConvencoes: {
+    nome: string;
+    categoria: string;
+    descricao: string;
+    global: false;
+    test: (relPath: string) => boolean;
+    aplicar: (src: string, relPath: string) => Promise<Msg[] | null>;
+};
+export {};
+//# sourceMappingURL=detector-conventions.d.ts.map

package/dist/analysts/go/detectors/detector-conventions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-conventions.d.ts","sourceRoot":"","sources":["../../../../src/analysts/go/detectors/detector-conventions.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAIzC,KAAK,GAAG,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AA0F9C,eAAO,MAAM,kBAAkB;;;;;oBAKb,MAAM,KAAG,OAAO;+CACD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CAKpD,CAAC"}

package/dist/analysts/go/detectors/detector-conventions.js

@@ -0,0 +1,99 @@
+import { messages } from '../../../core/messages/index.js';
+import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
+import { criarAnalista } from '../../../types/index.js';
+const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
+function detectConventions(src, relPath) {
+    const ocorrencias = [];
+    const lineOf = createLineLookup(src).lineAt;
+    const scan = maskGoComments(src);
+    for (const match of scan.matchAll(/^func\s+(?:\([^)]*\)\s+)?([a-z]\w*)\s*\(/gm)) {
+        const funcName = match[1];
+        if (/^[A-Z]/.test(funcName) || /[_-]/.test(funcName))
+            continue;
+        if (!/^[a-z][a-zA-Z0-9]*$/.test(funcName)) {
+            const line = lineOf(match.index);
+            ocorrencias.push({
+                relPath,
+                mensagem: `Function '${funcName}' does not follow Go naming convention (CamelCase)`,
+                linha: line,
+                nivel: messages.SeverityNiveis.suggestion,
+                origem: 'detector-convencoes',
+                tipo: 'go/rule'
+            });
+        }
+    }
+    for (const match of scan.matchAll(/\b(\w{4,})\s*:=\s*/g)) {
+        const line = lineOf(match.index);
+        const lineText = scan.split('\n')[line - 1] ?? '';
+        if (/index|counter|helper|temp/i.test(match[1]))
+            continue;
+        if (/^\s*for\b/.test(lineText))
+            continue;
+        const varName = match[1];
+        if (/^[a-z][a-zA-Z0-9]*$/.test(varName) && varName.length > 8) {
+            ocorrencias.push({
+                relPath,
+                mensagem: `Variable '${varName}' is long for a short-scope variable; consider a shorter name`,
+                linha: line,
+                nivel: messages.SeverityNiveis.info,
+                origem: 'detector-convencoes',
+                tipo: 'go/rule'
+            });
+        }
+    }
+    for (const match of scan.matchAll(/^import\s+\([^)]+\)/gm)) {
+        const block = match[0];
+        const lines = block.split('\n');
+        for (const impLine of lines) {
+            const impMatch = impLine.match(/"([^"]+)"/);
+            if (impMatch) {
+                const path = impMatch[1];
+                if (/\.$/i.test(path)) {
+                    const absIdx = (match.index ?? 0) + block.indexOf(impLine);
+                    const line = lineOf(absIdx);
+                    ocorrencias.push({
+                        relPath,
+                        mensagem: `Import path '${path}' ends with a dot; possible incomplete path`,
+                        linha: line,
+                        nivel: messages.SeverityNiveis.warning,
+                        origem: 'detector-convencoes',
+                        tipo: 'go/rule'
+                    });
+                }
+            }
+        }
+    }
+    for (const match of scan.matchAll(/\bfmt\.Errorf\s*\([^)]*\)/g)) {
+        const call = match[0];
+        const line = lineOf(match.index);
+        if (call.includes('%w')) {
+            const srcBefore = src.slice(0, match.index);
+            const ifMatch = srcBefore.match(/\bif\s+(err|.+err)\s*!=\s*nil[^{]*\{/);
+            if (ifMatch) {
+                ocorrencias.push({
+                    relPath,
+                    mensagem: 'Good practice: error wrapping with %w in fmt.Errorf',
+                    linha: line,
+                    nivel: messages.SeverityNiveis.info,
+                    origem: 'detector-convencoes',
+                    tipo: 'go/rule'
+                });
+            }
+        }
+    }
+    return ocorrencias;
+}
+export const detectorConvencoes = criarAnalista({
+    nome: 'detector-convencoes-go',
+    categoria: 'estilo',
+    descricao: 'Verifica conformidade com convenções de código Go.',
+    global: false,
+    test: (relPath) => /\.go$/i.test(relPath),
+    aplicar: async (src, relPath) => {
+        if (disableEnv)
+            return null;
+        const msgs = detectConventions(src, relPath);
+        return msgs.length ? msgs : null;
+    }
+});
+//# sourceMappingURL=detector-conventions.js.map

package/dist/analysts/go/detectors/detector-conventions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-conventions.js","sourceRoot":"","sources":["../../../../src/analysts/go/detectors/detector-conventions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC;AAElC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;AAGjE,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAAe;IACrD,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAGjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;QAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,WAAW,CAAC,IAAI,CAAC;gBACf,OAAO;gBACP,QAAQ,EAAE,aAAa,QAAQ,oDAAoD;gBACnF,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,UAAU;gBACzC,MAAM,EAAE,qBAAqB;gBAC7B,IAAI,EAAE,SAAS;aACT,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1D,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,WAAW,CAAC,IAAI,CAAC;gBACf,OAAO;gBACP,QAAQ,EAAE,aAAa,OAAO,+DAA+D;gBAC7F,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI;gBACnC,MAAM,EAAE,qBAAqB;gBAC7B,IAAI,EAAE,SAAS;aACT,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC5B,WAAW,CAAC,IAAI,CAAC;wBACf,OAAO;wBACP,QAAQ,EAAE,gBAAgB,IAAI,6CAA6C;wBAC3E,KAAK,EAAE,IAAI;wBACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,OAAO;wBACtC,MAAM,EAAE,qBAAqB;wBAC7B,IAAI,EAAE,SAAS;qBACT,CAAC,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,WAAW,CAAC,IAAI,CAAC;oBACf,OAAO;oBACP,QAAQ,EAAE,qDAAqD;oBAC/D,KAAK,EAAE,IAAI;oBACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI;oBACnC,MAAM,EAAE,qBAAqB;oBAC7B,IAAI,EAAE,SAAS;iBACT,CAAC,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,oDAAoD;IAC/D,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAyB,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;CACF,CAAC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { messages } from '@core/messages';\nimport { createLineLookup, maskGoComments } from '@shared/helpers';\n\nimport type { criarOcorrencia } from '@';\nimport { criarAnalista } from '@';\n\nconst disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';\ntype Msg = ReturnType<typeof criarOcorrencia>;\n\nfunction detectConventions(src: string, relPath: string): Msg[] {\n  const ocorrencias: Msg[] = [];\n  const lineOf = createLineLookup(src).lineAt;\n  const scan = maskGoComments(src);\n\n  // Function naming: should be CamelCase (exported) or camelCase (unexported)\n  for (const match of scan.matchAll(/^func\\s+(?:\\([^)]*\\)\\s+)?([a-z]\\w*)\\s*\\(/gm)) {\n    const funcName = match[1];\n    if (/^[A-Z]/.test(funcName) || /[_-]/.test(funcName)) continue;\n    if (!/^[a-z][a-zA-Z0-9]*$/.test(funcName)) {\n      const line = lineOf(match.index);\n      ocorrencias.push({\n        relPath,\n        mensagem: `Function '${funcName}' does not follow Go naming convention (CamelCase)`,\n        linha: line,\n        nivel: messages.SeverityNiveis.suggestion,\n        origem: 'detector-convencoes',\n        tipo: 'go/rule'\n      } as Msg);\n    }\n  }\n\n  // Variable naming: short variable names in small scopes\n  for (const match of scan.matchAll(/\\b(\\w{4,})\\s*:=\\s*/g)) {\n    const line = lineOf(match.index);\n    const lineText = scan.split('\\n')[line - 1] ?? '';\n    if (/index|counter|helper|temp/i.test(match[1])) continue;\n    if (/^\\s*for\\b/.test(lineText)) continue;\n    const varName = match[1];\n    if (/^[a-z][a-zA-Z0-9]*$/.test(varName) && varName.length > 8) {\n      ocorrencias.push({\n        relPath,\n        mensagem: `Variable '${varName}' is long for a short-scope variable; consider a shorter name`,\n        linha: line,\n        nivel: messages.SeverityNiveis.info,\n        origem: 'detector-convencoes',\n        tipo: 'go/rule'\n      } as Msg);\n    }\n  }\n\n  // Import path style: prefer clean paths without \"github.com\" in certain contexts\n  for (const match of scan.matchAll(/^import\\s+\\([^)]+\\)/gm)) {\n    const block = match[0];\n    const lines = block.split('\\n');\n    for (const impLine of lines) {\n      const impMatch = impLine.match(/\"([^\"]+)\"/);\n      if (impMatch) {\n        const path = impMatch[1];\n        if (/\\.$/i.test(path)) {\n          const absIdx = (match.index ?? 0) + block.indexOf(impLine);\n          const line = lineOf(absIdx);\n          ocorrencias.push({\n            relPath,\n            mensagem: `Import path '${path}' ends with a dot; possible incomplete path`,\n            linha: line,\n            nivel: messages.SeverityNiveis.warning,\n            origem: 'detector-convencoes',\n            tipo: 'go/rule'\n          } as Msg);\n        }\n      }\n    }\n  }\n\n  // Use of fmt.Errorf with %w for error wrapping (Go 1.13+)\n  for (const match of scan.matchAll(/\\bfmt\\.Errorf\\s*\\([^)]*\\)/g)) {\n    const call = match[0];\n    const line = lineOf(match.index);\n    if (call.includes('%w')) {\n      const srcBefore = src.slice(0, match.index);\n      const ifMatch = srcBefore.match(/\\bif\\s+(err|.+err)\\s*!=\\s*nil[^{]*\\{/);\n      if (ifMatch) {\n        ocorrencias.push({\n          relPath,\n          mensagem: 'Good practice: error wrapping with %w in fmt.Errorf',\n          linha: line,\n          nivel: messages.SeverityNiveis.info,\n          origem: 'detector-convencoes',\n          tipo: 'go/rule'\n        } as Msg);\n      }\n    }\n  }\n\n  return ocorrencias;\n}\n\nexport const detectorConvencoes = criarAnalista({\n  nome: 'detector-convencoes-go',\n  categoria: 'estilo',\n  descricao: 'Verifica conformidade com convenções de código Go.',\n  global: false,\n  test: (relPath: string): boolean => /\\.go$/i.test(relPath),\n  aplicar: async (src, relPath): Promise<Msg[] | null> => {\n    if (disableEnv) return null;\n    const msgs = detectConventions(src, relPath);\n    return msgs.length ? msgs : null;\n  }\n});\n"]}

package/dist/analysts/go/detectors/detector-errors-un-handled.d.ts

@@ -0,0 +1,12 @@
+import type { criarOcorrencia } from '../../../types/index.js';
+type Msg = ReturnType<typeof criarOcorrencia>;
+export declare const detectorErrosNaoTratados: {
+    nome: string;
+    categoria: string;
+    descricao: string;
+    global: false;
+    test: (relPath: string) => boolean;
+    aplicar: (src: string, relPath: string) => Promise<Msg[] | null>;
+};
+export {};
+//# sourceMappingURL=detector-errors-un-handled.d.ts.map

package/dist/analysts/go/detectors/detector-errors-un-handled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-errors-un-handled.d.ts","sourceRoot":"","sources":["../../../../src/analysts/go/detectors/detector-errors-un-handled.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAIzC,KAAK,GAAG,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AA0D9C,eAAO,MAAM,wBAAwB;;;;;oBAKnB,MAAM,KAAG,OAAO;+CACD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CAKpD,CAAC"}

package/dist/analysts/go/detectors/detector-errors-un-handled.js

@@ -0,0 +1,68 @@
+import { messages } from '../../../core/messages/index.js';
+import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
+import { criarAnalista } from '../../../types/index.js';
+const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
+function detectUncheckedErrors(src, relPath) {
+    const ocorrencias = [];
+    const lineOf = createLineLookup(src).lineAt;
+    const scan = maskGoComments(src);
+    const errorReturningPatterns = [
+        /(\w+)\s*:?=\s*(?:os\.|ioutil\.|io\.)\w+\.\w+\(/g,
+        /(\w+)\s*:?=\s*(?:json|xml)\.\w+\(/g,
+        /(\w+)\s*:?=\s*(?:net\.|http\.)\w+\.\w+\(/g,
+        /(\w+)\s*:?=\s*(?:db|sql)\.\w+\(/g,
+        /(\w+)\s*:?=\s*exec\.Command\(/g,
+        /(\w+)\s*:?=\s*template\.\w+\(/g,
+        /(\w+)\s*:?=\s*regexp\.Compile\(/g,
+        /(\w+)\s*:?=\s*strconv\.\w+\(/g,
+        /(\w+)\s*:?=\s*(?:fmt\.Sprintf|fmt\.Fprintf)\(/g,
+    ];
+    for (const pattern of errorReturningPatterns) {
+        for (const match of scan.matchAll(pattern)) {
+            const line = lineOf(match.index);
+            const varName = match[1];
+            const lineText = scan.split('\n')[line - 1] ?? '';
+            const nextLines = scan.split('\n').slice(line, line + 3).join('\n');
+            if (/\bif\s+err\s*!=\s*nil/.test(nextLines))
+                continue;
+            if (varName === 'err' || varName === '_')
+                continue;
+            if (/err\s*:?=\s*/.test(lineText))
+                continue;
+            ocorrencias.push({
+                relPath,
+                mensagem: messages.GoMensagens.uncheckedError,
+                linha: line,
+                nivel: messages.SeverityNiveis.error,
+                origem: 'detector-erros-nao-tratados',
+                tipo: 'go/rule'
+            });
+        }
+    }
+    for (const match of scan.matchAll(/_\s*=\s*(?:os\.|ioutil\.|io\.|json\.|xml\.|net\.|http\.)\w+\.\w+\(/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push({
+            relPath,
+            mensagem: 'Error return explicitly ignored with _; consider checking the error',
+            linha: line,
+            nivel: messages.SeverityNiveis.warning,
+            origem: 'detector-erros-nao-tratados',
+            tipo: 'go/rule'
+        });
+    }
+    return ocorrencias;
+}
+export const detectorErrosNaoTratados = criarAnalista({
+    nome: 'detector-erros-nao-tratados',
+    categoria: 'seguranca',
+    descricao: 'Detecta chamadas a funções que retornam erro sem tratamento adequado.',
+    global: false,
+    test: (relPath) => /\.go$/i.test(relPath),
+    aplicar: async (src, relPath) => {
+        if (disableEnv)
+            return null;
+        const msgs = detectUncheckedErrors(src, relPath);
+        return msgs.length ? msgs : null;
+    }
+});
+//# sourceMappingURL=detector-errors-un-handled.js.map

package/dist/analysts/go/detectors/detector-errors-un-handled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-errors-un-handled.js","sourceRoot":"","sources":["../../../../src/analysts/go/detectors/detector-errors-un-handled.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC;AAElC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;AAGjE,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAGjC,MAAM,sBAAsB,GAAG;QAC7B,iDAAiD;QACjD,oCAAoC;QACpC,2CAA2C;QAC3C,kCAAkC;QAClC,gCAAgC;QAChC,gCAAgC;QAChC,kCAAkC;QAClC,+BAA+B;QAC/B,gDAAgD;KACjD,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpE,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YACtD,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,GAAG;gBAAE,SAAS;YACnD,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAE5C,WAAW,CAAC,IAAI,CAAC;gBACf,OAAO;gBACP,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,cAAc;gBAC7C,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK;gBACpC,MAAM,EAAE,6BAA6B;gBACrC,IAAI,EAAE,SAAS;aACT,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,qEAAqE,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC;YACf,OAAO;YACP,QAAQ,EAAE,qEAAqE;YAC/E,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,OAAO;YACtC,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,SAAS;SACT,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,uEAAuE;IAClF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAyB,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;CACF,CAAC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { messages } from '@core/messages';\nimport { createLineLookup, maskGoComments } from '@shared/helpers';\n\nimport type { criarOcorrencia } from '@';\nimport { criarAnalista } from '@';\n\nconst disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';\ntype Msg = ReturnType<typeof criarOcorrencia>;\n\nfunction detectUncheckedErrors(src: string, relPath: string): Msg[] {\n  const ocorrencias: Msg[] = [];\n  const lineOf = createLineLookup(src).lineAt;\n  const scan = maskGoComments(src);\n\n  // Functions that commonly return errors\n  const errorReturningPatterns = [\n    /(\\w+)\\s*:?=\\s*(?:os\\.|ioutil\\.|io\\.)\\w+\\.\\w+\\(/g,\n    /(\\w+)\\s*:?=\\s*(?:json|xml)\\.\\w+\\(/g,\n    /(\\w+)\\s*:?=\\s*(?:net\\.|http\\.)\\w+\\.\\w+\\(/g,\n    /(\\w+)\\s*:?=\\s*(?:db|sql)\\.\\w+\\(/g,\n    /(\\w+)\\s*:?=\\s*exec\\.Command\\(/g,\n    /(\\w+)\\s*:?=\\s*template\\.\\w+\\(/g,\n    /(\\w+)\\s*:?=\\s*regexp\\.Compile\\(/g,\n    /(\\w+)\\s*:?=\\s*strconv\\.\\w+\\(/g,\n    /(\\w+)\\s*:?=\\s*(?:fmt\\.Sprintf|fmt\\.Fprintf)\\(/g,\n  ];\n\n  for (const pattern of errorReturningPatterns) {\n    for (const match of scan.matchAll(pattern)) {\n      const line = lineOf(match.index);\n      const varName = match[1];\n      const lineText = scan.split('\\n')[line - 1] ?? '';\n      const nextLines = scan.split('\\n').slice(line, line + 3).join('\\n');\n\n      if (/\\bif\\s+err\\s*!=\\s*nil/.test(nextLines)) continue;\n      if (varName === 'err' || varName === '_') continue;\n      if (/err\\s*:?=\\s*/.test(lineText)) continue;\n\n      ocorrencias.push({\n        relPath,\n        mensagem: messages.GoMensagens.uncheckedError,\n        linha: line,\n        nivel: messages.SeverityNiveis.error,\n        origem: 'detector-erros-nao-tratados',\n        tipo: 'go/rule'\n      } as Msg);\n    }\n  }\n\n  // Error return ignored with underscore\n  for (const match of scan.matchAll(/_\\s*=\\s*(?:os\\.|ioutil\\.|io\\.|json\\.|xml\\.|net\\.|http\\.)\\w+\\.\\w+\\(/g)) {\n    const line = lineOf(match.index);\n    ocorrencias.push({\n      relPath,\n      mensagem: 'Error return explicitly ignored with _; consider checking the error',\n      linha: line,\n      nivel: messages.SeverityNiveis.warning,\n      origem: 'detector-erros-nao-tratados',\n      tipo: 'go/rule'\n    } as Msg);\n  }\n\n  return ocorrencias;\n}\n\nexport const detectorErrosNaoTratados = criarAnalista({\n  nome: 'detector-erros-nao-tratados',\n  categoria: 'seguranca',\n  descricao: 'Detecta chamadas a funções que retornam erro sem tratamento adequado.',\n  global: false,\n  test: (relPath: string): boolean => /\\.go$/i.test(relPath),\n  aplicar: async (src, relPath): Promise<Msg[] | null> => {\n    if (disableEnv) return null;\n    const msgs = detectUncheckedErrors(src, relPath);\n    return msgs.length ? msgs : null;\n  }\n});\n"]}

package/dist/analysts/go/detectors/detector-vulnerabilities.d.ts

@@ -0,0 +1,12 @@
+import type { criarOcorrencia } from '../../../types/index.js';
+type Msg = ReturnType<typeof criarOcorrencia>;
+export declare const detectorVulnerabilidades: {
+    nome: string;
+    categoria: string;
+    descricao: string;
+    global: false;
+    test: (relPath: string) => boolean;
+    aplicar: (src: string, relPath: string) => Promise<Msg[] | null>;
+};
+export {};
+//# sourceMappingURL=detector-vulnerabilities.d.ts.map

package/dist/analysts/go/detectors/detector-vulnerabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-vulnerabilities.d.ts","sourceRoot":"","sources":["../../../../src/analysts/go/detectors/detector-vulnerabilities.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAIzC,KAAK,GAAG,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAgE9C,eAAO,MAAM,wBAAwB;;;;;oBAKnB,MAAM,KAAG,OAAO;+CACD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CAKpD,CAAC"}

package/dist/analysts/go/detectors/detector-vulnerabilities.js

@@ -0,0 +1,71 @@
+import { messages } from '../../../core/messages/index.js';
+import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
+import { criarAnalista } from '../../../types/index.js';
+const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
+function detectVulnerabilities(src, relPath) {
+    const ocorrencias = [];
+    const lineOf = createLineLookup(src).lineAt;
+    const scan = maskGoComments(src);
+    for (const match of scan.matchAll(/(?:password|secret|api[_-]?key|token|credential|senha)\s*(?::\s*|=\s*["'`])([^"'`\s]{4,})/gi)) {
+        const line = lineOf(match.index);
+        const value = match[1];
+        if (value.includes('${') || value.includes('os.Getenv') || value.includes('$'))
+            continue;
+        ocorrencias.push({
+            relPath,
+            mensagem: messages.GoMensagens.hardcodedSecret,
+            linha: line,
+            nivel: messages.SeverityNiveis.error,
+            origem: 'detector-vulnerabilidades',
+            tipo: 'go/rule'
+        });
+    }
+    for (const match of scan.matchAll(/`(?:SELECT|INSERT|UPDATE|DELETE)\b[\s\S]{0,200}`\s*\+/gi)) {
+        const line = lineOf(match.index);
+        ocorrencias.push({
+            relPath,
+            mensagem: 'SQL query built via string concatenation; risk of SQL injection. Use parameterized queries.',
+            linha: line,
+            nivel: messages.SeverityNiveis.error,
+            origem: 'detector-vulnerabilidades',
+            tipo: 'go/rule'
+        });
+    }
+    for (const match of scan.matchAll(/\bexec\.Command\s*\(\s*["'`][^"'`]*["'`]\s*,\s*["'`][^"'`]*\$|fmt\.Sprintf\s*\([^)]*\)\s*\)/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push({
+            relPath,
+            mensagem: 'Command constructed with variable interpolation; risk of command injection',
+            linha: line,
+            nivel: messages.SeverityNiveis.error,
+            origem: 'detector-vulnerabilidades',
+            tipo: 'go/rule'
+        });
+    }
+    for (const match of scan.matchAll(/\bos\.Open\s*\([^)]*r\.(?:FormValue|URL\.Query|PathValue|Header)/g)) {
+        const line = lineOf(match.index);
+        ocorrencias.push({
+            relPath,
+            mensagem: 'File operation using user input; risk of path traversal. Validate/sanitize the path.',
+            linha: line,
+            nivel: messages.SeverityNiveis.error,
+            origem: 'detector-vulnerabilidades',
+            tipo: 'go/rule'
+        });
+    }
+    return ocorrencias;
+}
+export const detectorVulnerabilidades = criarAnalista({
+    nome: 'detector-vulnerabilidades-go',
+    categoria: 'seguranca',
+    descricao: 'Detecta vulnerabilidades de segurança como injeção SQL, command injection e path traversal.',
+    global: false,
+    test: (relPath) => /\.go$/i.test(relPath),
+    aplicar: async (src, relPath) => {
+        if (disableEnv)
+            return null;
+        const msgs = detectVulnerabilities(src, relPath);
+        return msgs.length ? msgs : null;
+    }
+});
+//# sourceMappingURL=detector-vulnerabilities.js.map