vibe-code-checker 2.0.0__tar.gz

vibe_code_checker-2.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Krishiv Joshi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vibe_code_checker-2.0.0/MANIFEST.in

@@ -0,0 +1,7 @@
+include rules.json
+include LICENSE
+include README.md
+include check
+recursive-include analyzers *.py *.json
+recursive-include autofix *.py *.json
+recursive-include reporters *.py *.json

vibe_code_checker-2.0.0/PKG-INFO

@@ -0,0 +1,384 @@
+Metadata-Version: 2.4
+Name: vibe-code-checker
+Version: 2.0.0
+Summary: Production-grade, zero-dependency instant bug engine for any codebase.
+Author-email: Krishiv Joshi <krishivjoshi219@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/krishivjoshi219-collab/Vibe-Code-Checker
+Project-URL: Repository, https://github.com/krishivjoshi219-collab/Vibe-Code-Checker.git
+Project-URL: Issues, https://github.com/krishivjoshi219-collab/Vibe-Code-Checker/issues
+Keywords: linter,static-analysis,bug-detector,ast,security-scanner,autofix,code-quality
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# ⚡ Vibe Code Checker (VCC) v2.0
+
+<div align="center">
+
+[![Python](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12-blue.svg)](https://www.python.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Dependencies](https://img.shields.io/badge/dependencies-zero%20(stdlib%20only)-brightgreen.svg)]()
+[![Tests](https://img.shields.io/badge/tests-20%20passed%20(10ms)-success.svg)]()
+[![CI](https://img.shields.io/badge/CI-GitHub%20Actions-blueviolet.svg)]()
+[![Code Quality](https://img.shields.io/badge/quality-production--grade-orange.svg)]()
+
+**Instant, Zero-Dependency Bug Engine for Any Codebase.**  
+*Catches logical, security, async, resource, multi-language, and cosmetic bugs in milliseconds.*
+
+</div>
+
+---
+
+## 📖 Table of Contents
+
+- [Overview](#-overview)
+- [Key Highlights](#-key-highlights)
+- [Architecture](#-architecture)
+- [Detection Engine Catalog](#-detection-engine-catalog)
+  - [1. Logical & Runtime Bugs](#1-logical--runtime-bugs)
+  - [2. Security Vulnerabilities](#2-security-vulnerabilities)
+  - [3. Async & Concurrency](#3-async--concurrency)
+  - [4. Resource Management](#4-resource-management)
+  - [5. Multi-Language & Config](#5-multi-language--config)
+  - [6. Cosmetic & Code Ergonomics](#6-cosmetic--code-ergonomics)
+- [Installation & Quickstart](#-installation--quickstart)
+- [Command Line Interface](#-command-line-interface)
+- [Dual Autofix Engine](#-dual-autofix-engine)
+- [Generated Reports](#-generated-reports)
+- [Inline Rule Suppression](#-inline-rule-suppression)
+- [CI/CD & Pre-Commit Integration](#-cicd--pre-commit-integration)
+- [Programmatic Python API](#-programmatic-python-api)
+- [Performance & Benchmarks](#-performance--benchmarks)
+- [License](#-license)
+
+---
+
+## 🌟 Overview
+
+**Vibe Code Checker (VCC)** is a production-grade static analysis and bug-hunting engine built for developers who need instant, deterministic feedback across their entire software stack.
+
+Unlike traditional linters that require heavy node environments, complex configuration files, or hundreds of megabytes of external dependencies, VCC runs **instantly using only Python's standard library**. It combines deep AST scope analysis with multi-threaded file traversal to uncover dangerous runtime bugs, critical security vulnerabilities, unawaited async calls, and syntax errors in milliseconds.
+
+```
+                    ┌───────────────────────────────────┐
+                    │       vcc --target <project>      │
+                    └─────────────────┬─────────────────┘
+                                      │
+              ┌───────────────────────┴───────────────────────┐
+              ▼                                               ▼
+   ┌───────────────────────┐                       ┌───────────────────────┐
+   │  Parallel AST Scanner │                       │ Multi-Lang Inspector  │
+   │  (Python stdlib AST)  │                       │ (JSON, YAML, JS, SH)  │
+   └──────────┬────────────┘                       └──────────┬────────────┘
+              │                                               │
+              └───────────────────────┬───────────────────────┘
+                                      │
+                                      ▼
+                        ┌───────────────────────────┐
+                        │   Unified Finding Stream  │
+                        │    (P0 / P1 / P2 Triage)   │
+                        └─────────────┬─────────────┘
+                                      │
+            ┌─────────────────────────┼─────────────────────────┐
+            ▼                         ▼                         ▼
+   ┌─────────────────┐       ┌─────────────────┐       ┌─────────────────┐
+   │ Terminal Report │       │  report.json    │       │  Dual Autofix   │
+   │ (Color Diagnostics)     │  report.md      │       │ (--fix/--autofix)
+   └─────────────────┘       └─────────────────┘       └─────────────────┘
+```
+
+---
+
+## 🚀 Key Highlights
+
+* **⚡ Pure Standard Library Core**: Zero required third-party dependencies (`import ast`, `concurrent.futures`, `json`). Works out of the box on any machine with Python 3.10+.
+* **🎯 Compiler-Grade AST Precision**: Replaces naive regex matching with lexical tokenization, AST visitor analysis, and lexical symbol scope resolution.
+* **🛡️ Zero False-Positive Philosophy**: Context-aware heuristics distinguish between intentional test fixtures/fallbacks (e.g. bare `raise` in exception blocks) and actual bugs.
+* **🌐 Multi-Language & Multi-Format**: Native support for Python, JavaScript/TypeScript, JSON, YAML, TOML, Dockerfile, HTML/CSS, and Shell scripts.
+* **🔧 Dual-Track Remediation**:
+  * `--fix`: Safe, instant, deterministic mechanical fixer.
+  * `--autofix`: Gated, interactive AI code remediation powered by OpenCode Zen always-free LLM tiers.
+* **🚦 CI/CD Ready**: Configurable exit-code thresholds (`--fail-on P0`), GCC/ESLint-compatible one-line output (`--format compact`), and pre-commit hook support.
+
+---
+
+## 🔎 Detection Engine Catalog
+
+VCC categorizes all issues into three strict severity tiers:
+* **`P0` CRITICAL**: Severe bugs that cause immediate crashes, data corruption, remote code execution, or critical security vulnerabilities.
+* **`P1` MAJOR**: Silent logic bugs, unawaited coroutines, resource leaks, broken configurations, or weak cryptography.
+* **`P2` MINOR / COSMETIC**: Code hygiene, line length violations, identifier typos, monolithic functions, and style anti-patterns.
+
+### 1. Logical & Runtime Bugs
+| Rule ID | Severity | Description |
+| :--- | :---: | :--- |
+| `undefined-name` | **P0** | Identifier referenced before definition or without an import |
+| `divide-by-zero` | **P0** | Literal division or modulo by zero (`x / 0`, `n % 0`) |
+| `nan-compare` | **P0** | IEEE 754 NaN comparison (`x == float('nan')`), always evaluates to `False` |
+| `collection-mutation-during-iteration` | **P0** | Mutating a list/dict (`del d[k]`, `items.remove(x)`) while iterating over it |
+| `mutable-default-arg` | **P1** | Mutable objects (`[]`, `{}`) as default parameters, persisting state across calls |
+| `unreachable-code` | **P1** | Statements placed after `return`, `raise`, `break`, or `continue` |
+| `tuple-assert` | **P1** | `assert (condition, message)` with parentheses evaluates to non-empty tuple (always truthy) |
+| `missing-return-branch` | **P1** | Inconsistent function returns mixing explicit value returns with implicit `None` |
+| `infinite-loop-static` | **P1** | `while True:` loop containing no `break`, `return`, or `raise` statements |
+| `none-eq-compare` | **P2** | Comparing to `None` using `==` or `!=` instead of identity operators `is` / `is not` |
+| `bool-eq-compare` | **P2** | Comparing to boolean literals using `== True` / `== False` |
+
+### 2. Security Vulnerabilities
+| Rule ID | Severity | Description |
+| :--- | :---: | :--- |
+| `sql-injection` | **P0** | Dynamic f-string, `%`, or `.format()` query interpolation into database `execute()` |
+| `command-injection` | **P0** | Invoking system commands via `shell=True` or unsanitized `os.system()` calls |
+| `hardcoded-secret` | **P0** | Committing API keys, private keys, authorization bearer tokens, or JWTs |
+| `unsafe-pickle` | **P0** | Arbitrary object deserialization via `pickle.loads()` or `_pickle` |
+| `unsafe-yaml-load` | **P0** | Using `yaml.load()` without specifying `SafeLoader` |
+| `eval-exec` | **P0** | Executing dynamic string code via `eval()` or `exec()` |
+| `weak-random` | **P1** | Using pseudo-random `random.randint()` in security-sensitive contexts (tokens, OTPs) |
+| `weak-hash` | **P1** | Cryptographically broken hashing algorithms (`hashlib.md5`, `hashlib.sha1`) |
+
+### 3. Async & Concurrency
+| Rule ID | Severity | Description |
+| :--- | :---: | :--- |
+| `unawaited-coroutine` | **P1** | Calling an `async def` function without `await` or `asyncio.create_task()` |
+| `sync-blocking-in-async` | **P1** | Invoking blocking calls (`time.sleep()`, synchronous `requests`) inside `async def` |
+
+### 4. Resource Management
+| Rule ID | Severity | Description |
+| :--- | :---: | :--- |
+| `unclosed-file` | **P1** | Invoking `open()` outside of a `with` statement context manager |
+| `httpx-no-timeout` | **P1** | Outbound HTTP requests (`httpx.get()`, `httpx.post()`) executed without an explicit timeout |
+
+### 5. Multi-Language & Config
+| Rule ID | Severity | Description |
+| :--- | :---: | :--- |
+| `invalid-json` | **P0** | Malformed JSON syntax (trailing commas, unquoted keys, control characters) |
+| `yaml-tab-indent` | **P0** | Forbidden tab indentation characters in YAML configurations |
+| `invalid-toml` | **P0** | Syntax errors or duplicate tables in TOML configuration files |
+| `js-loose-eq` | **P1** | JavaScript/TypeScript loose equality operator (`==`, `!=`), causing type coercion bugs |
+| `js-debugger-stmt` | **P1** | Forgotten `debugger;` breakpoints committed to source files |
+| `docker-latest-tag` | **P1** | Unpinned `FROM image:latest` base images in Dockerfiles |
+| `docker-no-user` | **P1** | Container executing as `root` without an explicit non-root `USER` directive |
+| `shell-no-set-e` | **P1** | Shell scripts (`.sh`) missing `set -e` or `set -euo pipefail` error handling |
+| `shell-unquoted-var` | **P1** | Unquoted variables in dangerous shell operations (`rm -rf $DIR`) |
+| `html-inline-event` | **P2** | Inline HTML event handlers (`onclick="..."`) violating CSP best practices |
+
+### 6. Cosmetic & Code Ergonomics
+| Rule ID | Severity | Description |
+| :--- | :---: | :--- |
+| `identifier-typo` | **P2** | Misspelled identifier names checked against 60+ common engineering typos |
+| `deep-nesting` | **P2** | AST control flow nested $\ge$ 5 levels deep (`if / for / while / try / with`) |
+| `long-function` | **P2** | Monolithic functions exceeding 80 executable lines |
+| `many-args` | **P2** | Functions with excessive parameters (> 6 arguments) |
+| `trailing-whitespace` | **P2** | Invisible whitespace at end of lines |
+| `missing-eof-newline` | **P2** | Files missing a final newline character |
+| `mixed-indentation` | **P2** | Mixing tabs and spaces in indentation |
+| `line-too-long` | **P2** | Source lines exceeding standard 120-character width |
+
+---
+
+## 💻 Installation & Quickstart
+
+### Option 1: Standalone CLI (Recommended)
+Clone and run immediately without installing anything:
+```bash
+git clone git@github.com:krishivjoshi219-collab/Vibe-Code-Checker.git
+cd Vibe-Code-Checker
+
+# Scan any target project
+python check.py --target /path/to/project
+```
+
+### Option 2: Editable Install (`vcc` Command)
+```bash
+pip install -e .
+
+# Run globally from any directory
+vcc --target .
+```
+
+---
+
+## 📋 Command Line Interface
+
+```
+usage: vcc [-h] [--target TARGET] [--severity {P0,P1,P2}]
+           [--category CATEGORY] [--fail-on {P0,P1,P2,none}]
+           [--format {pretty,compact,json}] [--fix] [--autofix]
+           [--model MODEL] [--limit LIMIT] [--workers WORKERS]
+           [--no-ruff] [--rule-list] [--output-dir OUTPUT_DIR]
+           [target_pos]
+```
+
+### Common Workflows
+
+```bash
+# 1. Scan current repository
+vcc
+
+# 2. Focus on critical bugs and security vulnerabilities only
+vcc --severity P0
+
+# 3. Scan a specific category
+vcc --category security
+vcc --category async
+vcc --category logic
+
+# 4. CI/CD Gate: Fail build if any P0 (blockers) are detected
+vcc --fail-on P0
+
+# 5. Output one-line diagnostics for GitHub Actions or VSCode error matchers
+vcc --format compact
+
+# 6. Output pure JSON for downstream tooling
+vcc --format json
+```
+
+---
+
+## 🔧 Dual Autofix Engine
+
+VCC features two dedicated remediation engines:
+
+### 1. Deterministic Mechanical Fixer (`--fix`)
+Safely applies immediate code edits to mechanical and cosmetic issues without external calls:
+```bash
+vcc --fix
+```
+Automatically handles:
+- Stripping trailing whitespace
+- Appending missing EOF newlines
+- Converting `x == None` to `x is None` and `x != None` to `x is not None`
+- Converting `x == True` to `bool(x)` or direct evaluation
+
+### 2. Interactive AI Assistant (`--autofix`)
+For non-trivial logical or architectural bugs, VCC connects to OpenCode Zen always-free LLM tiers to generate human-in-the-loop diffs:
+```bash
+vcc --autofix --limit 5
+```
+Supported always-free models:
+* `big-pickle`
+* `mimo-v2.5-free`
+* `ling-3.0-flash-fin-free`
+* `nemotron-3-ultra-free`
+* `nemotron-3.5-lightning-free`
+* `muse-spark-1.3-contributor-free`
+
+Generated remediation candidates are written to `fixes/<finding-id>_suggestion.md` for human review before application.
+
+---
+
+## 📊 Generated Reports
+
+Every scan automatically generates structured diagnostics in the output directory:
+
+* **`report.json`**: Machine-readable diagnostic catalog including line/column coordinates, AST rule IDs, code snippets, and pre-formatted LLM repair prompts.
+* **`report.md`**: Executive markdown report containing high-level summary tables, severity breakdown, and actionable fix suggestions.
+
+---
+
+## 🏷️ Inline Rule Suppression
+
+Suppress intentional test cases, mock data, or legacy exceptions using standard inline comments:
+
+```python
+# Universal line suppression (standard linters & VCC)
+api_key = "test-fixture-key"  # noqa
+
+# VCC explicit ignore
+val = 100 / 0  # vcc:ignore
+
+# Rule-specific suppression
+data = x == None  # vcc:disable=none-eq-compare
+def handler(a, b, c, d, e, f, g):  # vcc:disable=many-args
+    pass
+```
+
+---
+
+## 🔄 CI/CD & Pre-Commit Integration
+
+### GitHub Actions Workflow
+Add `.github/workflows/vcc.yml` to your project:
+
+```yaml
+name: Vibe Code Checker
+
+on: [push, pull_request]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Run VCC
+        run: |
+          git clone --depth 1 https://github.com/krishivjoshi219-collab/Vibe-Code-Checker.git /tmp/vcc
+          python /tmp/vcc/check.py --target . --fail-on P0 --format compact
+```
+
+### Pre-Commit Hook
+Add to your `.pre-commit-config.yaml`:
+
+```yaml
+repos:
+  - repo: https://github.com/krishivjoshi219-collab/Vibe-Code-Checker
+    rev: main
+    hooks:
+      - id: vibe-code-checker
+```
+
+---
+
+## 🐍 Programmatic Python API
+
+You can embed VCC directly into your internal tooling or test suites:
+
+```python
+from analyzers import scan_file, walker
+from check import load_rules
+
+# Load rule catalog
+rules = load_rules()
+
+# Discover all supported source files
+files = walker.discover_files("./src", rules)
+
+# Scan a single file
+findings = scan_file("./src/agent/models.py", rules)
+
+for issue in findings:
+    print(f"[{issue['severity']}] {issue['rule']}: {issue['title']} (Line {issue['line']})")
+```
+
+---
+
+## ⚡ Performance & Benchmarks
+
+Benchmarked on an Intel i7 / AMD Ryzen workstation with 40+ source files across Python, TypeScript, JSON, and HTML:
+
+| Metric | VCC v2.0 | Traditional Linter Suite |
+| :--- | :---: | :---: |
+| **Startup Time** | **< 15ms** | ~800ms - 2.5s |
+| **Full Repository Scan** | **360ms - 500ms** | 4.2s - 12.0s |
+| **External Dependencies** | **0 (Stdlib only)** | 15 - 50+ packages |
+| **Unit Test Suite (20 tests)** | **10ms** | 1.8s |
+| **Memory Footprint** | **~24 MB** | ~180 MB |
+
+---
+
+## 📄 License
+
+This project is licensed under the **MIT License** — see the [LICENSE](LICENSE) file for details.