vibertest 0.1.0 → 0.1.2

package/dist/index.js

@@ -34,10 +34,10 @@ var rulesSchema = z.record(
 ).optional();
 var thresholdsSchema = z.object({
   maxFileLines: z.number().int().positive().default(500),
-  maxFunctionLines: z.number().int().positive().default(50),
-  maxFunctionParams: z.number().int().positive().default(4),
-  maxImports: z.number().int().positive().default(15),
-  minTestRatio: z.number().min(0).max(1).default(0.2)
+  maxFunctionLines: z.number().int().positive().default(60),
+  maxFunctionParams: z.number().int().positive().default(5),
+  maxImports: z.number().int().positive().default(20),
+  minTestRatio: z.number().min(0).max(1).default(0.05)
 }).partial();
 var configSchema = z.object({
   rules: rulesSchema,
@@ -516,6 +516,251 @@ var DeadCodeRule = class _DeadCodeRule extends BaseRule {
   }
 };
 
+// src/rules/analysis-helpers.ts
+function detectWebFramework(context) {
+  const { packageJson, files } = context;
+  if (!packageJson) return "unknown";
+  const deps = {
+    ...packageJson.dependencies,
+    ...packageJson.devDependencies
+  };
+  if ("next" in deps) {
+    const hasAppDir = files.some((f) => f.path.startsWith("app/") || f.path.includes("/app/"));
+    const hasPagesDir = files.some((f) => f.path.startsWith("pages/") || f.path.includes("/pages/"));
+    if (hasAppDir) return "nextjs-app";
+    if (hasPagesDir) return "nextjs-pages";
+    return "nextjs-app";
+  }
+  if ("@remix-run/react" in deps || "@remix-run/node" in deps) {
+    return "remix";
+  }
+  if ("@sveltejs/kit" in deps) {
+    return "sveltekit";
+  }
+  if ("nuxt" in deps || "nuxt3" in deps) {
+    return "nuxt";
+  }
+  if ("astro" in deps) {
+    return "astro";
+  }
+  if ("vite" in deps) {
+    if ("react" in deps) return "vite-react";
+    if ("vue" in deps) return "vite-vue";
+  }
+  if ("react-scripts" in deps) {
+    return "cra";
+  }
+  if ("express" in deps && !("react" in deps) && !("vue" in deps)) {
+    return "express";
+  }
+  return "unknown";
+}
+function isWebApplication(context) {
+  const framework = detectWebFramework(context);
+  if (framework === "express") return false;
+  if (framework === "unknown") {
+    const pkg = context.packageJson;
+    if (pkg) {
+      const isLibrary = ("main" in pkg || "exports" in pkg || "bin" in pkg) && !("private" in pkg && pkg.private === true);
+      if (isLibrary) return false;
+    }
+    return false;
+  }
+  return true;
+}
+function getLayoutFiles(context) {
+  const framework = detectWebFramework(context);
+  const { files } = context;
+  const layoutPatterns = [];
+  switch (framework) {
+    case "nextjs-app":
+      layoutPatterns.push(
+        /^app\/layout\.[jt]sx?$/,
+        /^src\/app\/layout\.[jt]sx?$/,
+        /app\/\([^)]+\)\/layout\.[jt]sx?$/
+      );
+      break;
+    case "nextjs-pages":
+      layoutPatterns.push(
+        /^pages\/_app\.[jt]sx?$/,
+        /^pages\/_document\.[jt]sx?$/,
+        /^src\/pages\/_app\.[jt]sx?$/
+      );
+      break;
+    case "remix":
+      layoutPatterns.push(
+        /^app\/root\.[jt]sx?$/
+      );
+      break;
+    case "sveltekit":
+      layoutPatterns.push(
+        /^src\/routes\/\+layout\.svelte$/,
+        /^src\/app\.html$/
+      );
+      break;
+    case "nuxt":
+      layoutPatterns.push(
+        /^layouts\/default\.vue$/,
+        /^app\.vue$/
+      );
+      break;
+    case "astro":
+      layoutPatterns.push(
+        /^src\/layouts\/.+\.astro$/
+      );
+      break;
+    case "vite-react":
+    case "cra":
+      layoutPatterns.push(
+        /^src\/App\.[jt]sx?$/,
+        /^src\/main\.[jt]sx?$/,
+        /^index\.html$/
+      );
+      break;
+    case "vite-vue":
+      layoutPatterns.push(
+        /^src\/App\.vue$/,
+        /^src\/main\.[jt]s$/,
+        /^index\.html$/
+      );
+      break;
+  }
+  return files.filter((f) => layoutPatterns.some((p) => p.test(f.path)));
+}
+function isTestFile(filePath) {
+  return /\.(test|spec)\.[jt]sx?$/.test(filePath) || filePath.includes("__tests__");
+}
+function isStoryFile(filePath) {
+  return /\.stories\.[jt]sx?$/.test(filePath);
+}
+function getLineNumber(content, index) {
+  return content.slice(0, index).split("\n").length;
+}
+function hasTryCatch(code) {
+  return /\btry\s*\{/.test(code);
+}
+function hasAwait(code) {
+  return /\bawait\s+/.test(code);
+}
+function isInsideStringOrComment(content, index) {
+  const lineStart = content.lastIndexOf("\n", index) + 1;
+  const lineContent = content.slice(lineStart, index);
+  if (/\/\//.test(lineContent)) return true;
+  const lastBlockOpen = content.lastIndexOf("/*", index);
+  if (lastBlockOpen !== -1) {
+    const lastBlockClose = content.lastIndexOf("*/", index);
+    if (lastBlockClose < lastBlockOpen) return true;
+  }
+  const singleQuotes = (lineContent.match(/'/g) ?? []).length;
+  const doubleQuotes = (lineContent.match(/"/g) ?? []).length;
+  const backticks = (lineContent.match(/`/g) ?? []).length;
+  if (singleQuotes % 2 === 1 || doubleQuotes % 2 === 1 || backticks % 2 === 1) {
+    return true;
+  }
+  return false;
+}
+function buildStringRanges(content) {
+  const ranges = [];
+  let i = 0;
+  while (i < content.length) {
+    const ch = content[i];
+    const next = content[i + 1];
+    if (ch === "/" && next === "/") {
+      const start = i;
+      i += 2;
+      while (i < content.length && content[i] !== "\n") i++;
+      ranges.push({ start, end: i });
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      const start = i;
+      i += 2;
+      while (i < content.length - 1) {
+        if (content[i] === "*" && content[i + 1] === "/") {
+          i += 2;
+          break;
+        }
+        i++;
+      }
+      ranges.push({ start, end: i });
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      const quote = ch;
+      const start = i;
+      i++;
+      while (i < content.length) {
+        if (content[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (content[i] === quote) {
+          i++;
+          break;
+        }
+        if (content[i] === "\n") break;
+        i++;
+      }
+      ranges.push({ start, end: i });
+      continue;
+    }
+    if (ch === "`") {
+      const start = i;
+      i++;
+      while (i < content.length) {
+        if (content[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (content[i] === "`") {
+          i++;
+          break;
+        }
+        i++;
+      }
+      ranges.push({ start, end: i });
+      continue;
+    }
+    i++;
+  }
+  return ranges;
+}
+function isInStringRange(ranges, index) {
+  let lo = 0;
+  let hi = ranges.length - 1;
+  while (lo <= hi) {
+    const mid = lo + hi >>> 1;
+    const range = ranges[mid];
+    if (index < range.start) {
+      hi = mid - 1;
+    } else if (index >= range.end) {
+      lo = mid + 1;
+    } else {
+      return true;
+    }
+  }
+  return false;
+}
+function extractFunctionBody(content, startIndex) {
+  let braceCount = 0;
+  let foundOpen = false;
+  let bodyStart = startIndex;
+  for (let i = startIndex; i < content.length; i++) {
+    const char = content[i];
+    if (char === "{") {
+      if (!foundOpen) bodyStart = i;
+      braceCount++;
+      foundOpen = true;
+    } else if (char === "}") {
+      braceCount--;
+      if (foundOpen && braceCount === 0) {
+        return content.slice(bodyStart, i + 1);
+      }
+    }
+  }
+  return null;
+}
+
 // src/rules/hardcoded-secrets.ts
 var HardcodedSecretsRule = class _HardcodedSecretsRule extends BaseRule {
   id = RULE_ID.HARDCODED_SECRETS;
@@ -644,19 +889,29 @@ var HardcodedSecretsRule = class _HardcodedSecretsRule extends BaseRule {
       if (this.shouldSkipFile(file.path)) {
         continue;
       }
+      const ranges = buildStringRanges(file.content);
       const lines = file.content.split("\n");
+      let lineStartIndex = 0;
       for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
         const line = lines[lineIndex];
+        if (isInStringRange(ranges, lineStartIndex)) {
+          lineStartIndex += line.length + 1;
+          continue;
+        }
         if (this.isComment(line)) {
+          lineStartIndex += line.length + 1;
           continue;
         }
         if (this.referencesEnvVar(line)) {
+          lineStartIndex += line.length + 1;
           continue;
         }
         if (this.isExampleValue(line)) {
+          lineStartIndex += line.length + 1;
           continue;
         }
         if (this.isJsxCodeExample(line)) {
+          lineStartIndex += line.length + 1;
           continue;
         }
         for (const secretPattern of _HardcodedSecretsRule.SECRET_PATTERNS) {
@@ -675,6 +930,7 @@ var HardcodedSecretsRule = class _HardcodedSecretsRule extends BaseRule {
             break;
           }
         }
+        lineStartIndex += line.length + 1;
       }
     }
     return issues;
@@ -907,175 +1163,12 @@ var UnusedDepsRule = class _UnusedDepsRule extends BaseRule {
   }
 };
 
-// src/rules/analysis-helpers.ts
-function detectWebFramework(context) {
-  const { packageJson, files } = context;
-  if (!packageJson) return "unknown";
-  const deps = {
-    ...packageJson.dependencies,
-    ...packageJson.devDependencies
-  };
-  if ("next" in deps) {
-    const hasAppDir = files.some((f) => f.path.startsWith("app/") || f.path.includes("/app/"));
-    const hasPagesDir = files.some((f) => f.path.startsWith("pages/") || f.path.includes("/pages/"));
-    if (hasAppDir) return "nextjs-app";
-    if (hasPagesDir) return "nextjs-pages";
-    return "nextjs-app";
-  }
-  if ("@remix-run/react" in deps || "@remix-run/node" in deps) {
-    return "remix";
-  }
-  if ("@sveltejs/kit" in deps) {
-    return "sveltekit";
-  }
-  if ("nuxt" in deps || "nuxt3" in deps) {
-    return "nuxt";
-  }
-  if ("astro" in deps) {
-    return "astro";
-  }
-  if ("vite" in deps) {
-    if ("react" in deps) return "vite-react";
-    if ("vue" in deps) return "vite-vue";
-  }
-  if ("react-scripts" in deps) {
-    return "cra";
-  }
-  if ("express" in deps && !("react" in deps) && !("vue" in deps)) {
-    return "express";
-  }
-  return "unknown";
-}
-function isWebApplication(context) {
-  const framework = detectWebFramework(context);
-  if (framework === "express") return false;
-  if (framework === "unknown") {
-    const pkg = context.packageJson;
-    if (pkg) {
-      const isLibrary = ("main" in pkg || "exports" in pkg || "bin" in pkg) && !("private" in pkg && pkg.private === true);
-      if (isLibrary) return false;
-    }
-    return false;
-  }
-  return true;
-}
-function getLayoutFiles(context) {
-  const framework = detectWebFramework(context);
-  const { files } = context;
-  const layoutPatterns = [];
-  switch (framework) {
-    case "nextjs-app":
-      layoutPatterns.push(
-        /^app\/layout\.[jt]sx?$/,
-        /^src\/app\/layout\.[jt]sx?$/,
-        /app\/\([^)]+\)\/layout\.[jt]sx?$/
-      );
-      break;
-    case "nextjs-pages":
-      layoutPatterns.push(
-        /^pages\/_app\.[jt]sx?$/,
-        /^pages\/_document\.[jt]sx?$/,
-        /^src\/pages\/_app\.[jt]sx?$/
-      );
-      break;
-    case "remix":
-      layoutPatterns.push(
-        /^app\/root\.[jt]sx?$/
-      );
-      break;
-    case "sveltekit":
-      layoutPatterns.push(
-        /^src\/routes\/\+layout\.svelte$/,
-        /^src\/app\.html$/
-      );
-      break;
-    case "nuxt":
-      layoutPatterns.push(
-        /^layouts\/default\.vue$/,
-        /^app\.vue$/
-      );
-      break;
-    case "astro":
-      layoutPatterns.push(
-        /^src\/layouts\/.+\.astro$/
-      );
-      break;
-    case "vite-react":
-    case "cra":
-      layoutPatterns.push(
-        /^src\/App\.[jt]sx?$/,
-        /^src\/main\.[jt]sx?$/,
-        /^index\.html$/
-      );
-      break;
-    case "vite-vue":
-      layoutPatterns.push(
-        /^src\/App\.vue$/,
-        /^src\/main\.[jt]s$/,
-        /^index\.html$/
-      );
-      break;
-  }
-  return files.filter((f) => layoutPatterns.some((p) => p.test(f.path)));
-}
-function isTestFile(filePath) {
-  return /\.(test|spec)\.[jt]sx?$/.test(filePath) || filePath.includes("__tests__");
-}
-function isStoryFile(filePath) {
-  return /\.stories\.[jt]sx?$/.test(filePath);
-}
-function getLineNumber(content, index) {
-  return content.slice(0, index).split("\n").length;
-}
-function hasTryCatch(code) {
-  return /\btry\s*\{/.test(code);
-}
-function hasAwait(code) {
-  return /\bawait\s+/.test(code);
-}
-function isInsideStringOrComment(content, index) {
-  const lineStart = content.lastIndexOf("\n", index) + 1;
-  const lineContent = content.slice(lineStart, index);
-  if (/\/\//.test(lineContent)) return true;
-  const lastBlockOpen = content.lastIndexOf("/*", index);
-  if (lastBlockOpen !== -1) {
-    const lastBlockClose = content.lastIndexOf("*/", index);
-    if (lastBlockClose < lastBlockOpen) return true;
-  }
-  const singleQuotes = (lineContent.match(/'/g) ?? []).length;
-  const doubleQuotes = (lineContent.match(/"/g) ?? []).length;
-  const backticks = (lineContent.match(/`/g) ?? []).length;
-  if (singleQuotes % 2 === 1 || doubleQuotes % 2 === 1 || backticks % 2 === 1) {
-    return true;
-  }
-  return false;
-}
-function extractFunctionBody(content, startIndex) {
-  let braceCount = 0;
-  let foundOpen = false;
-  let bodyStart = startIndex;
-  for (let i = startIndex; i < content.length; i++) {
-    const char = content[i];
-    if (char === "{") {
-      if (!foundOpen) bodyStart = i;
-      braceCount++;
-      foundOpen = true;
-    } else if (char === "}") {
-      braceCount--;
-      if (foundOpen && braceCount === 0) {
-        return content.slice(bodyStart, i + 1);
-      }
-    }
-  }
-  return null;
-}
-
 // src/rules/missing-tests.ts
 var MissingTestsRule = class _MissingTestsRule extends BaseRule {
   id = RULE_ID.MISSING_TESTS;
   name = "Missing Tests";
   description = "Detects projects with no tests, low coverage, or low-quality tests";
-  defaultSeverity = SEVERITY.CRITICAL;
+  defaultSeverity = SEVERITY.HIGH;
   /** Patterns that identify test files */
   static TEST_FILE_PATTERNS = [
     /\.test\.[jt]sx?$/,
@@ -1935,11 +2028,12 @@ var MissingErrorHandlingRule = class extends BaseRule {
     const issues = [];
     for (const file of files) {
       if (isTestFile(file.path)) continue;
-      issues.push(...this.checkUnhandledAsync(file));
-      issues.push(...this.checkUnhandledFetch(file));
-      issues.push(...this.checkUnhandledPromiseChains(file));
-      issues.push(...this.checkEmptyCatchBlocks(file));
-      issues.push(...this.checkSwallowedErrors(file));
+      const ranges = buildStringRanges(file.content);
+      issues.push(...this.checkUnhandledAsync(file, ranges));
+      issues.push(...this.checkUnhandledFetch(file, ranges));
+      issues.push(...this.checkUnhandledPromiseChains(file, ranges));
+      issues.push(...this.checkEmptyCatchBlocks(file, ranges));
+      issues.push(...this.checkSwallowedErrors(file, ranges));
       issues.push(...this.checkMissingErrorBoundary(files, context));
     }
     return this.deduplicateProjectIssues(issues);
@@ -1947,11 +2041,12 @@ var MissingErrorHandlingRule = class extends BaseRule {
   // ---------------------------------------------------------------------------
   // Unhandled Async Functions
   // ---------------------------------------------------------------------------
-  checkUnhandledAsync(file) {
+  checkUnhandledAsync(file, ranges) {
     const issues = [];
     const asyncFuncPattern = /^(\s*)(?:export\s+)?async\s+function\s+(\w+)/gm;
     let match;
     while ((match = asyncFuncPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const funcName = match[2];
       const funcBody = extractFunctionBody(file.content, match.index);
       if (funcBody && !hasTryCatch(funcBody) && hasAwait(funcBody)) {
@@ -1960,6 +2055,7 @@ var MissingErrorHandlingRule = class extends BaseRule {
     }
     const asyncArrowPattern = /(?:const|let|var)\s+(\w+)\s*=\s*async\s*\(/g;
     while ((match = asyncArrowPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const funcName = match[1];
       const funcBody = extractFunctionBody(file.content, match.index);
       if (funcBody && !hasTryCatch(funcBody) && hasAwait(funcBody)) {
@@ -1980,11 +2076,12 @@ var MissingErrorHandlingRule = class extends BaseRule {
   // ---------------------------------------------------------------------------
   // Unhandled Fetch/HTTP Calls
   // ---------------------------------------------------------------------------
-  checkUnhandledFetch(file) {
+  checkUnhandledFetch(file, ranges) {
     const issues = [];
     const fetchPattern = /\b(fetch|axios\.(?:get|post|put|patch|delete))\s*\(/g;
     let match;
     while ((match = fetchPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const callName = match[1];
       const callIndex = match.index;
       const surroundingCode = file.content.slice(Math.max(0, callIndex - 500), callIndex);
@@ -2007,12 +2104,12 @@ var MissingErrorHandlingRule = class extends BaseRule {
   // ---------------------------------------------------------------------------
   // Unhandled Promise Chains
   // ---------------------------------------------------------------------------
-  checkUnhandledPromiseChains(file) {
+  checkUnhandledPromiseChains(file, ranges) {
     const issues = [];
     const thenPattern = /\.then\s*\([^)]*\)(?:\s*\.then\s*\([^)]*\))*/g;
     let match;
     while ((match = thenPattern.exec(file.content)) !== null) {
-      if (isInsideStringOrComment(file.content, match.index)) continue;
+      if (isInStringRange(ranges, match.index)) continue;
       const chainEnd = match.index + match[0].length;
       const afterChain = file.content.slice(chainEnd, chainEnd + 50);
       if (!/^\s*\.catch\s*\(/.test(afterChain)) {
@@ -2038,12 +2135,12 @@ var MissingErrorHandlingRule = class extends BaseRule {
    * - Console-only catch: catch(e) { console.log(e) }
    * - Generic catch without re-throw or reporting
    */
-  checkEmptyCatchBlocks(file) {
+  checkEmptyCatchBlocks(file, ranges) {
     const issues = [];
     const catchPattern = /\bcatch\s*\(\s*(\w+)?\s*\)\s*\{/g;
     let match;
     while ((match = catchPattern.exec(file.content)) !== null) {
-      if (isInsideStringOrComment(file.content, match.index)) continue;
+      if (isInStringRange(ranges, match.index)) continue;
       const catchStart = match.index + match[0].length;
       const catchBody = this.extractCatchBody(file.content, catchStart);
       if (!catchBody) continue;
@@ -2110,7 +2207,7 @@ var MissingErrorHandlingRule = class extends BaseRule {
    * - .catch(() => undefined)
    * - .catch(e => console.log(e))
    */
-  checkSwallowedErrors(file) {
+  checkSwallowedErrors(file, ranges) {
     const issues = [];
     const swallowedPatterns = [
       // .catch(() => {}) or .catch(() => { })
@@ -2123,7 +2220,7 @@ var MissingErrorHandlingRule = class extends BaseRule {
     for (const pattern of swallowedPatterns) {
       let match2;
       while ((match2 = pattern.exec(file.content)) !== null) {
-        if (isInsideStringOrComment(file.content, match2.index)) continue;
+        if (isInStringRange(ranges, match2.index)) continue;
         issues.push(
           this.createIssue({
             severity: SEVERITY.HIGH,
@@ -2140,7 +2237,7 @@ var MissingErrorHandlingRule = class extends BaseRule {
     const consoleOnlyCatchPattern = /\.catch\s*\(\s*\(?\s*(\w+)\s*\)?\s*=>\s*\{?\s*console\.(log|error|warn)\s*\(\s*\1\s*\)\s*;?\s*\}?\s*\)/g;
     let match;
     while ((match = consoleOnlyCatchPattern.exec(file.content)) !== null) {
-      if (isInsideStringOrComment(file.content, match.index)) continue;
+      if (isInStringRange(ranges, match.index)) continue;
       issues.push(
         this.createIssue({
           severity: SEVERITY.MEDIUM,
@@ -2207,6 +2304,7 @@ var AbandonedTodoRule = class _AbandonedTodoRule extends BaseRule {
     const issues = [];
     for (const file of context.files) {
       if (isTestFile(file.path)) continue;
+      const ranges = buildStringRanges(file.content);
       const contentWithoutJsdoc = file.content.replace(
         /\/\*\*[\s\S]*?\*\//g,
         (match2) => "\n".repeat((match2.match(/\n/g) ?? []).length)
@@ -2217,6 +2315,7 @@ var AbandonedTodoRule = class _AbandonedTodoRule extends BaseRule {
       );
       let match;
       while ((match = regex.exec(contentWithoutJsdoc)) !== null) {
+        if (isInStringRange(ranges, match.index)) continue;
         const keyword = match[1] ?? "TODO";
         const comment = match[2]?.trim() ?? "";
         const line = getLineNumber(contentWithoutJsdoc, match.index);
@@ -2794,31 +2893,34 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
     const issues = [];
     for (const file of context.files) {
       if (isTestFile(file.path) || _ObsoletePatternsRule.CONFIG_PATTERNS.test(file.path)) continue;
-      this.checkVarDeclarations(file, issues);
-      this.checkCallbackHell(file, issues);
-      this.checkClassComponents(file, issues);
-      this.checkCommonJsInTs(file, issues);
-      this.checkLegacyApis(file, issues);
+      const ranges = buildStringRanges(file.content);
+      this.checkVarDeclarations(file, issues, ranges);
+      this.checkCallbackHell(file, issues, ranges);
+      this.checkClassComponents(file, issues, ranges);
+      this.checkCommonJsInTs(file, issues, ranges);
+      this.checkLegacyApis(file, issues, ranges);
     }
     return issues;
   }
   /** `var` declarations — should be const/let */
-  checkVarDeclarations(file, issues) {
-    const lines = file.content.split("\n");
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i];
-      if (/\bvar\s+\w+/.test(line) && !isInsideStringOrComment(file.content, file.content.indexOf(line))) {
-        const trimmed = line.trim();
-        if (trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*")) continue;
-        issues.push(this.createObsoleteIssue(file.path, i + 1, trimmed, "var", "const/let"));
-      }
+  checkVarDeclarations(file, issues, ranges) {
+    const regex = /\bvar\s+\w+/g;
+    let match;
+    while ((match = regex.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
+      const line = getLineNumber(file.content, match.index);
+      const lineContent = file.content.split("\n")[line - 1]?.trim() ?? match[0];
+      if (lineContent.startsWith("//") || lineContent.startsWith("*") || lineContent.startsWith("/*")) continue;
+      issues.push(this.createObsoleteIssue(file.path, line, lineContent, "var", "const/let"));
     }
   }
   /** .then() chains with 3+ nesting levels — should be async/await */
-  checkCallbackHell(file, issues) {
-    const thenChain = /\.then\([^)]*\)\s*\.then\([^)]*\)\s*\.then\(/;
-    if (thenChain.test(file.content)) {
-      const line = getLineNumber(file.content, file.content.search(thenChain));
+  checkCallbackHell(file, issues, ranges) {
+    const thenChain = /\.then\([^)]*\)\s*\.then\([^)]*\)\s*\.then\(/g;
+    let match;
+    while ((match = thenChain.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
+      const line = getLineNumber(file.content, match.index);
       issues.push(
         this.createIssue({
           message: "Promise chain with 3+ .then() calls detected",
@@ -2828,14 +2930,16 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
           learnMoreUrl: "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Using_promises"
         })
       );
+      break;
     }
   }
   /** React class components — should be function components */
-  checkClassComponents(file, issues) {
+  checkClassComponents(file, issues, ranges) {
     if (file.extension !== ".tsx" && file.extension !== ".jsx") return;
     const pattern = /extends\s+(?:React\.)?Component\b/g;
     let match;
     while ((match = pattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const line = getLineNumber(file.content, match.index);
       issues.push(
         this.createIssue({
@@ -2849,7 +2953,7 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
     }
   }
   /** require() or module.exports in .ts/.tsx files */
-  checkCommonJsInTs(file, issues) {
+  checkCommonJsInTs(file, issues, ranges) {
     if (file.extension !== ".ts" && file.extension !== ".tsx") return;
     const patterns = [
       { regex: /\brequire\s*\(/g, name: "require()" },
@@ -2858,7 +2962,7 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
     for (const { regex, name } of patterns) {
       let match;
       while ((match = regex.exec(file.content)) !== null) {
-        if (isInsideStringOrComment(file.content, match.index)) continue;
+        if (isInStringRange(ranges, match.index)) continue;
         const line = getLineNumber(file.content, match.index);
         issues.push(
           this.createObsoleteIssue(file.path, line, name, "CommonJS (require/module.exports)", "ES modules (import/export)")
@@ -2867,7 +2971,7 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
     }
   }
   /** Legacy APIs: arguments keyword, new Array(), new Object() */
-  checkLegacyApis(file, issues) {
+  checkLegacyApis(file, issues, ranges) {
     const legacyPatterns = [
       { regex: /\barguments\b/g, old: "arguments keyword", modern: "rest parameters (...args)" },
       { regex: /\bnew\s+Array\s*\(/g, old: "new Array()", modern: "array literal []" },
@@ -2876,7 +2980,7 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
     for (const { regex, old, modern } of legacyPatterns) {
       let match;
       while ((match = regex.exec(file.content)) !== null) {
-        if (isInsideStringOrComment(file.content, match.index)) continue;
+        if (isInStringRange(ranges, match.index)) continue;
         const line = getLineNumber(file.content, match.index);
         issues.push(this.createObsoleteIssue(file.path, line, match[0].trim(), old, modern));
       }
@@ -2897,6 +3001,8 @@ var ObsoletePatternsRule = class _ObsoletePatternsRule extends BaseRule {
 // src/rules/ai-smell.ts
 var AiSmellRule = class _AiSmellRule extends BaseRule {
   id = RULE_ID.AI_SMELL;
+  /** Pre-computed string/comment ranges for the current file */
+  currentRanges = [];
   name = "AI Smell";
   description = "Detects signs of unreviewed AI-generated code";
   defaultSeverity = SEVERITY.LOW;
@@ -3021,6 +3127,7 @@ var AiSmellRule = class _AiSmellRule extends BaseRule {
       if (![".ts", ".tsx", ".js", ".jsx"].includes(file.extension)) continue;
       this.checkGenericFileName(file, issues);
       if (isTestFile(file.path)) continue;
+      this.currentRanges = buildStringRanges(file.content);
       this.checkObviousComments(file, issues);
       this.checkConsoleLog(file, issues);
       this.checkGenericNaming(file, issues);
@@ -3072,6 +3179,7 @@ var AiSmellRule = class _AiSmellRule extends BaseRule {
     const regex = /\bconsole\.log\s*\(/g;
     let match;
     while ((match = regex.exec(file.content)) !== null) {
+      if (isInStringRange(this.currentRanges, match.index)) continue;
       const line = getLineNumber(file.content, match.index);
       issues.push(this.createIssue({
         severity: SEVERITY.MEDIUM,
@@ -3087,6 +3195,7 @@ var AiSmellRule = class _AiSmellRule extends BaseRule {
     const regex = /\b(?:const|let|var)\s+(\w+)\s*=/g;
     let match;
     while ((match = regex.exec(file.content)) !== null) {
+      if (isInStringRange(this.currentRanges, match.index)) continue;
       const name = match[1];
       if (_AiSmellRule.GENERIC_NAMES.has(name)) {
         const beforeMatch = file.content.slice(Math.max(0, match.index - 20), match.index);
@@ -3137,6 +3246,7 @@ var AiSmellRule = class _AiSmellRule extends BaseRule {
       const regex = new RegExp(pattern.source, pattern.flags);
       let match;
       while ((match = regex.exec(file.content)) !== null) {
+        if (isInStringRange(this.currentRanges, match.index)) continue;
         const line = getLineNumber(file.content, match.index);
         const snippet = match[0].slice(0, 60) + (match[0].length > 60 ? "..." : "");
         issues.push(this.createIssue({
@@ -3159,6 +3269,7 @@ var AiSmellRule = class _AiSmellRule extends BaseRule {
       const regex = new RegExp(pattern.source, pattern.flags);
       let match;
       while ((match = regex.exec(file.content)) !== null) {
+        if (isInStringRange(this.currentRanges, match.index)) continue;
         const line = getLineNumber(file.content, match.index);
         issues.push(this.createIssue({
           severity: SEVERITY.LOW,
@@ -3180,6 +3291,7 @@ var AiSmellRule = class _AiSmellRule extends BaseRule {
       const regex = new RegExp(pattern.source, pattern.flags);
       let match;
       while ((match = regex.exec(file.content)) !== null) {
+        if (isInStringRange(this.currentRanges, match.index)) continue;
         const line = getLineNumber(file.content, match.index);
         issues.push(this.createIssue({
           severity: SEVERITY.MEDIUM,
@@ -3487,10 +3599,11 @@ var SecurityAntipatternsRule = class extends BaseRule {
     const issues = [];
     for (const file of files) {
       if (isTestFile(file.path)) continue;
-      issues.push(...this.checkSqlInjection(file));
-      issues.push(...this.checkCorsWildcard(file));
-      issues.push(...this.checkLocalStorageSensitive(file));
-      issues.push(...this.checkDangerousHtml(file));
+      const ranges = buildStringRanges(file.content);
+      issues.push(...this.checkSqlInjection(file, ranges));
+      issues.push(...this.checkCorsWildcard(file, ranges));
+      issues.push(...this.checkLocalStorageSensitive(file, ranges));
+      issues.push(...this.checkDangerousHtml(file, ranges));
       issues.push(...this.checkEvalUsage(file));
       issues.push(...this.checkInsecureRandomness(file));
       issues.push(...this.checkHardcodedCredentials(file));
@@ -3506,7 +3619,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
    * - Template literals in SQL queries
    * - String concatenation in SQL queries
    */
-  checkSqlInjection(file) {
+  checkSqlInjection(file, ranges) {
     const issues = [];
     const lines = file.content.split("\n");
     const sqlPatterns = [
@@ -3529,9 +3642,17 @@ var SecurityAntipatternsRule = class extends BaseRule {
       /\bEXEC(UTE)?\s+\w+/i
       // EXEC/EXECUTE procedure
     ];
+    let lineStartIndex = 0;
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (line.trim().startsWith("//") || line.trim().startsWith("*")) continue;
+      if (isInStringRange(ranges, lineStartIndex)) {
+        lineStartIndex += line.length + 1;
+        continue;
+      }
+      if (line.trim().startsWith("//") || line.trim().startsWith("*")) {
+        lineStartIndex += line.length + 1;
+        continue;
+      }
       const templateMatch = /`([^`]*\$\{[^}]+\}[^`]*)`/.exec(line);
       if (templateMatch) {
         const templateContent = templateMatch[1];
@@ -3568,6 +3689,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
           break;
         }
       }
+      lineStartIndex += line.length + 1;
     }
     return issues;
   }
@@ -3577,7 +3699,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
   /**
    * Detects CORS wildcard configuration outside test files
    */
-  checkCorsWildcard(file) {
+  checkCorsWildcard(file, ranges) {
     const issues = [];
     if (/\.(md|txt|json)$/.test(file.path)) return [];
     const patterns = [
@@ -3593,6 +3715,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
     for (const pattern of patterns) {
       const match = pattern.exec(file.content);
       if (match) {
+        if (isInStringRange(ranges, match.index)) continue;
         const line = getLineNumber(file.content, match.index);
         issues.push(
           this.createIssue({
@@ -3615,7 +3738,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
   /**
    * Detects storing sensitive data in localStorage
    */
-  checkLocalStorageSensitive(file) {
+  checkLocalStorageSensitive(file, ranges) {
     const issues = [];
     const sensitiveKeys = [
       "token",
@@ -3636,6 +3759,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
     const pattern = /localStorage\.setItem\s*\(\s*['"`]([^'"`]+)['"`]/gi;
     let match;
     while ((match = pattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const key = match[1].toLowerCase();
       if (sensitiveKeys.some((sensitive) => key.includes(sensitive))) {
         issues.push(
@@ -3659,12 +3783,20 @@ var SecurityAntipatternsRule = class extends BaseRule {
   /**
    * Detects dangerous HTML injection patterns
    */
-  checkDangerousHtml(file) {
+  checkDangerousHtml(file, ranges) {
     const issues = [];
     const lines = file.content.split("\n");
+    let lineStartIndex = 0;
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (line.trim().startsWith("//") || line.trim().startsWith("*")) continue;
+      if (isInStringRange(ranges, lineStartIndex)) {
+        lineStartIndex += line.length + 1;
+        continue;
+      }
+      if (line.trim().startsWith("//") || line.trim().startsWith("*")) {
+        lineStartIndex += line.length + 1;
+        continue;
+      }
       if (/\.innerHTML\s*=\s*(?!['"`]<)/.test(line)) {
         if (!/\.innerHTML\s*=\s*['"`][^'"`]*['"`]\s*;?\s*$/.test(line)) {
           issues.push(
@@ -3709,6 +3841,7 @@ var SecurityAntipatternsRule = class extends BaseRule {
           })
         );
       }
+      lineStartIndex += line.length + 1;
     }
     return issues;
   }
@@ -4980,10 +5113,11 @@ var AccessibilityRule = class _AccessibilityRule extends BaseRule {
       (f) => /\.[jt]sx?$/.test(f.extension) && !isTestFile(f.path) && !isStoryFile(f.path)
     );
     for (const file of uiFiles) {
-      issues.push(...this.checkImagesWithoutAlt(file));
-      issues.push(...this.checkNonSemanticClickHandlers(file));
-      issues.push(...this.checkInputsWithoutLabels(file));
-      issues.push(...this.checkGenericLinkText(file));
+      const ranges = buildStringRanges(file.content);
+      issues.push(...this.checkImagesWithoutAlt(file, ranges));
+      issues.push(...this.checkNonSemanticClickHandlers(file, ranges));
+      issues.push(...this.checkInputsWithoutLabels(file, ranges));
+      issues.push(...this.checkGenericLinkText(file, ranges));
     }
     const layoutFiles = getLayoutFiles(context);
     issues.push(...this.checkMissingLandmarks(layoutFiles));
@@ -4992,11 +5126,12 @@ var AccessibilityRule = class _AccessibilityRule extends BaseRule {
   // ---------------------------------------------------------------------------
   // 023-A: Images Without Alt Text
   // ---------------------------------------------------------------------------
-  checkImagesWithoutAlt(file) {
+  checkImagesWithoutAlt(file, ranges) {
     const issues = [];
     const imgPattern = /<(?:img|Image)\s+([^>]*?)(?:\/>|>)/gi;
     let match;
     while ((match = imgPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const attributes = match[1] ?? "";
       const line = getLineNumber(file.content, match.index);
       const altMatch = attributes.match(/alt\s*=\s*["']([^"']*)["']/i);
@@ -5066,11 +5201,12 @@ var AccessibilityRule = class _AccessibilityRule extends BaseRule {
   // ---------------------------------------------------------------------------
   // 023-B: Non-Semantic Click Handlers
   // ---------------------------------------------------------------------------
-  checkNonSemanticClickHandlers(file) {
+  checkNonSemanticClickHandlers(file, ranges) {
     const issues = [];
     const onClickPattern = /<(\w+)\s+([^>]*onClick[^>]*)>/gi;
     let match;
     while ((match = onClickPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const tagName = match[1]?.toLowerCase() ?? "";
       const attributes = match[2] ?? "";
       const line = getLineNumber(file.content, match.index);
@@ -5103,7 +5239,7 @@ var AccessibilityRule = class _AccessibilityRule extends BaseRule {
   // ---------------------------------------------------------------------------
   // 023-C: Form Inputs Without Labels
   // ---------------------------------------------------------------------------
-  checkInputsWithoutLabels(file) {
+  checkInputsWithoutLabels(file, ranges) {
     const issues = [];
     const inputPattern = /<(input|select|textarea)\s+([^>]*)(?:\/>|>)/gi;
     let match;
@@ -5115,6 +5251,7 @@ var AccessibilityRule = class _AccessibilityRule extends BaseRule {
     }
     inputPattern.lastIndex = 0;
     while ((match = inputPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const tagName = match[1]?.toLowerCase() ?? "";
       const attributes = match[2] ?? "";
       const line = getLineNumber(file.content, match.index);
@@ -5190,11 +5327,12 @@ var AccessibilityRule = class _AccessibilityRule extends BaseRule {
   // ---------------------------------------------------------------------------
   // 023-E: Non-Descriptive Link Text
   // ---------------------------------------------------------------------------
-  checkGenericLinkText(file) {
+  checkGenericLinkText(file, ranges) {
     const issues = [];
     const linkPattern = /<(?:a|Link)\s+([^>]*)>([^<]+)<\/(?:a|Link)>/gi;
     let match;
     while ((match = linkPattern.exec(file.content)) !== null) {
+      if (isInStringRange(ranges, match.index)) continue;
       const attributes = match[1] ?? "";
       const linkText = match[2]?.trim().toLowerCase() ?? "";
       const line = getLineNumber(file.content, match.index);