vibe-coding-qa 0.5.0__py3-none-any.whl

vibe_coding_qa/scanners/infrastructure.py

@@ -0,0 +1,125 @@
+"""Infrastructure scanner: TLS, headers, container, nginx configs."""
+
+import re
+from pathlib import Path
+
+from . import BaseScanner, load_ignore_patterns, is_ignored
+from vibe_coding_qa import Finding, Severity
+
+
+class InfrastructureScanner(BaseScanner):
+    module = "infrastructure"
+
+    def scan(self) -> list[Finding]:
+        ignore = load_ignore_patterns(self.repo)
+        self._scan_nginx(ignore)
+        self._scan_docker(ignore)
+        self._scan_csp(ignore)
+        return self.findings
+
+    def _scan_nginx(self, ignore: list[str]) -> None:
+        for path in self.repo.rglob("*.conf"):
+            if is_ignored(path, self.repo, ignore):
+                continue
+            if "nginx" not in path.name.lower() and "default" not in path.name.lower():
+                continue
+            text = path.read_text(encoding="utf-8", errors="ignore")
+            lowered = text.lower()
+            for i, raw in enumerate(text.splitlines(), 1):
+                norm = raw.strip().lower()
+                if "listen 80" in norm and "redirect" not in lowered:
+                    self.add(
+                        rule="nginx-plain-http-listen",
+                        severity=Severity.HIGH,
+                        file=path,
+                        line=i,
+                        message="Nginx listens on plain HTTP without an obvious redirect to HTTPS.",
+                        suggestion="Redirect all HTTP traffic to HTTPS before serving content.",
+                        confidence="medium",
+                    )
+                if re.search(r"ssl_protocols\s+.*(sslv2|sslv3|tlsv1\.0|tlsv1\.1)", raw, re.IGNORECASE):
+                    self.add(
+                        rule="nginx-weak-tls",
+                        severity=Severity.CRITICAL,
+                        file=path,
+                        line=i,
+                        message="Nginx enables a deprecated TLS/SSL protocol.",
+                        suggestion="Use only TLS 1.2 and TLS 1.3.",
+                        confidence="high",
+                    )
+            if "strict-transport-security" not in lowered:
+                self.add(
+                    rule="nginx-missing-hsts",
+                    severity=Severity.HIGH,
+                    file=path,
+                    line=1,
+                    message="HSTS header not detected in Nginx config.",
+                    suggestion="Add add_header Strict-Transport-Security with max-age=63072000; includeSubDomains; preload.",
+                    confidence="medium",
+                )
+            for header in ("x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy"):
+                if header not in lowered:
+                    self.add(
+                        rule=f"nginx-missing-{header.replace('-', '_')}",
+                        severity=Severity.MEDIUM,
+                        file=path,
+                        line=1,
+                        message=f"{header.upper().replace('-', '-')} header not detected in Nginx config.",
+                        suggestion=f"Add the {header.upper().replace('-', '-')} header to every response.",
+                        confidence="low",
+                    )
+
+    def _scan_docker(self, ignore: list[str]) -> None:
+        for path in self.repo.rglob("Dockerfile*"):
+            if is_ignored(path, self.repo, ignore):
+                continue
+            text = path.read_text(encoding="utf-8", errors="ignore")
+            for i, raw in enumerate(text.splitlines(), 1):
+                if re.search(r"^FROM\s+.*:latest", raw, re.IGNORECASE):
+                    self.add(
+                        rule="docker-latest-tag",
+                        severity=Severity.LOW,
+                        file=path,
+                        line=i,
+                        message="Docker base image uses the :latest tag.",
+                        suggestion="Pin a specific digest or version tag for reproducible builds.",
+                        confidence="medium",
+                    )
+                if re.search(r"EXPOSE\s+\d+", raw, re.IGNORECASE) and "EXPOSE 443" not in raw.upper():
+                    self.add(
+                        rule="docker-exposed-port-review",
+                        severity=Severity.INFO,
+                        file=path,
+                        line=i,
+                        message="Dockerfile exposes a port; confirm TLS terminates at the edge or reverse proxy.",
+                        suggestion="Terminate TLS at the reverse proxy or load balancer; do not expose plain HTTP directly.",
+                        confidence="low",
+                    )
+
+    def _scan_csp(self, ignore: list[str]) -> None:
+        for path in self.iter_source_files((".ts", ".tsx", ".js", ".jsx", ".py")):
+            if is_ignored(path, self.repo, ignore):
+                continue
+            text = path.read_text(encoding="utf-8", errors="ignore")
+            for i, raw in enumerate(text.splitlines(), 1):
+                if "content-security-policy" in raw.lower():
+                    if "unsafe-inline" in raw.lower() or "unsafe-eval" in raw.lower():
+                        self.add(
+                            rule="csp-unsafe-directive",
+                            severity=Severity.MEDIUM,
+                            file=path,
+                            line=i,
+                            message="CSP uses unsafe-inline or unsafe-eval.",
+                            suggestion="Use nonces or hashes for scripts and remove unsafe-eval where possible.",
+                            confidence="medium",
+                        )
+                    return
+        self.add(
+            rule="csp-missing",
+            severity=Severity.MEDIUM,
+            file=self.repo,
+            line=1,
+            message="No Content-Security-Policy header detected in source.",
+            suggestion="Add a restrictive CSP through Nginx or application middleware.",
+            confidence="low",
+        )

vibe_coding_qa/scanners/performance.py

@@ -0,0 +1,84 @@
+"""Performance scanner: bundle/debug artifacts, large assets, INP hints."""
+
+import re
+from pathlib import Path
+
+from . import BaseScanner, load_ignore_patterns, is_ignored, is_likely_client_file
+from vibe_coding_qa import Finding, Severity
+
+
+class PerformanceScanner(BaseScanner):
+    module = "performance"
+    LARGE_FILE_BYTES = 500_000
+    LARGE_IMAGE_BYTES = 500_000
+
+    def scan(self) -> list[Finding]:
+        ignore = load_ignore_patterns(self.repo)
+        for path in self.iter_source_files((".ts", ".tsx", ".js", ".jsx", ".py")):
+            if is_ignored(path, self.repo, ignore):
+                continue
+            self._scan_source(path)
+        for path in self.repo.rglob("*"):
+            if not path.is_file():
+                continue
+            if "node_modules" in path.parts or ".git" in path.parts:
+                continue
+            if is_ignored(path, self.repo, ignore):
+                continue
+            self._scan_asset(path)
+        return self.findings
+
+    def _scan_source(self, path: Path) -> None:
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        for i, raw in enumerate(text.splitlines(), 1):
+            if re.search(r"scheduler\.yield\s*\(\)|yield\s+to\s+main", raw, re.IGNORECASE):
+                # Positive signal; skip further INP warnings in this file.
+                return
+            if re.search(r"(onClick|onSubmit|onChange)\s*=\s*\{?\s*(async\s+)?function", raw, re.IGNORECASE):
+                # Heuristic: handlers that do heavy work without yielding.
+                pass
+        # Large synchronous-looking loops in handlers.
+        for i, raw in enumerate(text.splitlines(), 1):
+            if re.search(r"for\s*\([^)]*\)\s*\{[^}]*\b(fetch|await|compute|process)\b", raw, re.IGNORECASE):
+                if is_likely_client_file(path):
+                    self.add(
+                        rule="potential-blocking-handler",
+                        severity=Severity.LOW,
+                        file=path,
+                        line=i,
+                        message="Loop in an event handler may block the main thread.",
+                        suggestion="Yield to the main thread with scheduler.yield() or break work into chunks.",
+                        confidence="low",
+                    )
+
+    def _scan_asset(self, path: Path) -> None:
+        if path.suffix.lower() in {".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"}:
+            try:
+                size = path.stat().st_size
+            except OSError:
+                return
+            if size > self.LARGE_IMAGE_BYTES:
+                self.add(
+                    rule="large-unoptimized-image",
+                    severity=Severity.LOW,
+                    file=path,
+                    line=1,
+                    message=f"Image is {size / 1024:.0f} KB; consider compression or modern formats.",
+                    suggestion="Compress images, serve WebP/AVIF, and use responsive sizes.",
+                    confidence="high",
+                )
+        elif path.suffix.lower() in {".js", ".css", ".ts", ".tsx"}:
+            try:
+                size = path.stat().st_size
+            except OSError:
+                return
+            if size > self.LARGE_FILE_BYTES:
+                self.add(
+                    rule="large-source-file",
+                    severity=Severity.LOW,
+                    file=path,
+                    line=1,
+                    message=f"Source file is {size / 1024:.0f} KB; consider splitting.",
+                    suggestion="Split large modules to improve loading and caching.",
+                    confidence="low",
+                )

vibe_coding_qa/scanners/quality.py

@@ -0,0 +1,129 @@
+"""Quality scanner: TypeScript/JavaScript/Python static checks."""
+
+import re
+from pathlib import Path
+
+from . import BaseScanner, load_ignore_patterns, is_ignored, is_likely_client_file, is_test_or_fixture
+from vibe_coding_qa import Finding, Severity
+
+
+class QualityScanner(BaseScanner):
+    module = "quality"
+
+    def scan(self) -> list[Finding]:
+        ignore = load_ignore_patterns(self.repo)
+        for path in self.iter_source_files((".ts", ".tsx", ".js", ".jsx", ".py")):
+            if is_ignored(path, self.repo, ignore):
+                continue
+            self._scan_console_logs(path)
+            self._scan_todos(path)
+            self._scan_any_types(path)
+            self._scan_missing_error_boundaries(path)
+            self._scan_debugger_statements(path)
+        self._scan_build_config(ignore)
+        return self.findings
+
+    def _scan_console_logs(self, path: Path) -> None:
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        for i, raw in enumerate(text.splitlines(), 1):
+            if re.search(r"(?<!\w)console\.(log|debug|warn)\s*\(", raw):
+                if is_test_or_fixture(path):
+                    continue
+                self.add(
+                    rule="console-log-in-production",
+                    severity=Severity.LOW,
+                    file=path,
+                    line=i,
+                    message="Console logging statement found in source code.",
+                    suggestion="Remove console.log/debug/warn from production builds or route through a logging service.",
+                    confidence="high",
+                    fixable=True,
+                )
+
+    def _scan_todos(self, path: Path) -> None:
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        for i, raw in enumerate(text.splitlines(), 1):
+            if re.search(r"(?<!\w)(TODO|FIXME|HACK|XXX)\s*[:\(]", raw, re.IGNORECASE):
+                self.add(
+                    rule="unfinished-todo",
+                    severity=Severity.LOW,
+                    file=path,
+                    line=i,
+                    message="Unresolved TODO/FIXME/HACK marker found.",
+                    suggestion="Resolve or ticket the item before release.",
+                    confidence="high",
+                )
+
+    def _scan_any_types(self, path: Path) -> None:
+        if path.suffix not in {".ts", ".tsx"}:
+            return
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        for i, raw in enumerate(text.splitlines(), 1):
+            if ": any" in raw or "as any" in raw or "<any>" in raw:
+                self.add(
+                    rule="unsafe-any-type",
+                    severity=Severity.MEDIUM,
+                    file=path,
+                    line=i,
+                    message="Unsafe `any` type assertion detected.",
+                    suggestion="Replace `any` with a specific interface or use `unknown` with a type guard.",
+                    confidence="medium",
+                )
+
+    def _scan_missing_error_boundaries(self, path: Path) -> None:
+        if not is_likely_client_file(path) or path.suffix not in {".tsx", ".jsx"}:
+            return
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        # Only flag if a component file has no error boundary and is reasonably large.
+        if "ErrorBoundary" in text or "error boundary" in text.lower():
+            return
+        if len(text.splitlines()) < 40:
+            return
+        self.add(
+            rule="missing-error-boundary",
+            severity=Severity.MEDIUM,
+            file=path,
+            line=1,
+            message="No React ErrorBoundary detected in this component file.",
+            suggestion="Add an error boundary to prevent a single component crash from taking down the whole UI.",
+            confidence="low",
+        )
+
+    def _scan_debugger_statements(self, path: Path) -> None:
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        for i, raw in enumerate(text.splitlines(), 1):
+            if re.search(r"(?<!\w)debugger;?\s*$", raw):
+                self.add(
+                    rule="debugger-statement",
+                    severity=Severity.LOW,
+                    file=path,
+                    line=i,
+                    message="`debugger` statement left in source.",
+                    suggestion="Remove debugger statements before production builds.",
+                    confidence="high",
+                    fixable=True,
+                )
+
+    def _scan_build_config(self, ignore: list[str]) -> None:
+        vite = self.repo / "vite.config.ts"
+        next_config = self.repo / "next.config.js"
+        for path in (vite, next_config):
+            if not path.is_file():
+                continue
+            if is_ignored(path, self.repo, ignore):
+                continue
+            text = path.read_text(encoding="utf-8", errors="ignore")
+            for i, raw in enumerate(text.splitlines(), 1):
+                if "sourcemap" in raw.lower() and "false" not in raw.lower():
+                    self.add(
+                        rule="source-maps-enabled",
+                        severity=Severity.LOW,
+                        file=path,
+                        line=i,
+                        message="Source maps may be enabled in production build config.",
+                        suggestion="Disable source maps in production to avoid exposing source code.",
+                        confidence="low",
+                    )
+                if "console" in raw.lower() and "drop" in raw.lower():
+                    # Config removes console logs; clear prior findings is done in engine, not here.
+                    pass