feat(pipeline): implement 3-phase slop detection pipeline architecture (#107) (#116)

* feat(pipeline): implement 3-phase slop detection pipeline architecture (#107)

Implement a pipeline-based detection system with certainty-tagged findings:

Phase 1 (always runs):
- Built-in regex patterns from slop-patterns.js
- Multi-pass analyzers (doc/code ratio, verbosity, over-engineering, buzzwords)
- HIGH certainty findings - can be auto-fixed directly

Phase 2 (optional - if tools available):
- jscpd for duplicate code detection
- madge for circular dependency detection
- escomplex for cyclomatic complexity analysis
- LOW certainty findings - need verification

Phase 3 (LLM handoff):
- Certainty-tagged findings for agent review
- Token-efficient prompt format
- Action guidance by certainty level

New files:
- lib/patterns/pipeline.js - Pipeline orchestrator
- lib/patterns/cli-enhancers.js - Optional CLI tool integration
- lib/config/index.js - Config stub
- __tests__/pipeline.test.js - Pipeline tests
- __tests__/cli-enhancers.test.js - CLI enhancers tests

Updates:
- deslop-work.md - Now uses pipeline orchestrator
- lib/index.js - Exports new modules

Features:
- Thoroughness levels: quick (regex), normal (+analyzers), deep (+CLI)
- Mode inheritance: report vs apply from deslop-around
- Graceful degradation when CLI tools not installed
- Missing tools notification at end of analysis

* feat(cli-enhancers): add language-aware tool detection with caching

- Detect project languages (JS/TS, Python, Go, Rust) from config files
- Recommend CLI tools appropriate for detected languages
- Add per-repo caching with 5-minute TTL for tool availability
- Support jscpd (cross-lang), madge/escomplex (JS), pylint/radon (Python),
  golangci-lint (Go), clippy (Rust)
- Update tests with 61 new test cases for language detection
- Fix pipeline tests to use functions meeting minimum thresholds

Relates to #107

* fix(cli-enhancers): prevent command injection in path handling

- Escape user-provided paths with escapeDoubleQuotes() before shell execution
- Affects runDuplicateDetection, runDependencyAnalysis, runComplexityAnalysis
- Add 3 security tests for shell metacharacter handling
- Synced fix to all 5 plugin lib directories

Security: Prevents command injection via malicious paths containing
$, backticks, $(cmd), or quotes.

* docs: update deslop-around documentation for pipeline architecture

Added comprehensive documentation for the new 3-phase slop detection
pipeline introduced in #107:

- **Architecture section**: Explains Phase 1 (regex), Phase 2 (multi-pass),
  Phase 3 (CLI tools) with certainty levels (HIGH/MEDIUM/LOW)
- **Thoroughness levels**: Documents quick/normal/deep modes
- **Language-aware tools**: Lists recommended tools per language
  - JavaScript/TypeScript: jscpd, madge, escomplex
  - Python: pylint, radon
  - Go: golangci-lint
  - Rust: clippy
- **Enhanced detection list**: Added buzzword inflation and code smells

Updated files:
- README.md: Main command reference
- docs/USAGE.md: Detailed usage guide

Refs #107

* fix(pipeline): honor language filter for non-JS language runs

When a non-JS language filter is set (e.g., python), the previous logic
incorrectly allowed JS files through. Now the special case for 'js'
detection only applies when the language filter IS javascript or
typescript.

Addresses review feedback from Codex.

* refactor(tests): remove unused variables in test files

Address Copilot review feedback:
- Remove unused 'name' in CLI_TOOLS iteration
- Use more descriptive variable names in cache refresh test
- Remove unused multiPassFindings and mediumFindings variables

Author: avifenesh

CHANGELOG.md

@@ -8,6 +8,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- **Slop Detection Pipeline Architecture** - 3-phase detection pipeline with certainty-tagged findings (#107)
+  - **Phase 1** (always runs): Built-in regex patterns + multi-pass analyzers
+  - **Phase 2** (optional): CLI tool integration (jscpd, madge, escomplex) - if available
+  - **Phase 3**: LLM handoff with structured findings
+  - Certainty levels: HIGH (regex), MEDIUM (multi-pass), LOW (CLI tools)
+  - Thoroughness levels: quick (regex only), normal (+multi-pass), deep (+CLI)
+  - Mode inheritance from deslop-around: report (analyze only) vs apply (fix issues)
+  - New `runPipeline()` function in lib/patterns/pipeline.js
+  - New lib/patterns/cli-enhancers.js for optional tool detection
+  - deslop-work.md agent updated to use pipeline orchestrator
+  - Graceful degradation when CLI tools not installed
+
 - **Buzzword Inflation Detection** - New project-level analyzer for `/deslop-around` command (#113)
   - Detects quality claims in documentation without supporting code evidence
   - 6 buzzword categories: production, enterprise, security, scale, reliability, completeness

README.md

@@ -152,14 +152,28 @@ Ship your code from commit to production with full validation and state integrat
 
 ### `/deslop-around` - AI Slop Cleanup
 
-Remove debugging code, old TODOs, and AI slop from your codebase.
+Remove debugging code, old TODOs, and AI slop from your codebase with a 3-phase detection pipeline.
 
 ```bash
 /deslop-around                    # Report mode - analyze only
 /deslop-around apply              # Apply fixes with verification
 /deslop-around apply src/ 10      # Fix up to 10 issues in src/
 ```
 
+**Architecture:**
+- **Phase 1** - Built-in regex patterns (HIGH certainty)
+- **Phase 2** - Multi-pass analyzers (MEDIUM certainty)
+- **Phase 3** - Optional CLI tools (LOW certainty, graceful degradation)
+  - JavaScript/TypeScript: jscpd, madge, escomplex
+  - Python: pylint, radon
+  - Go: golangci-lint
+  - Rust: clippy
+
+**Thoroughness levels:**
+- `quick` - Phase 1 only (fastest)
+- `normal` - Phase 1 + Phase 2 (default)
+- `deep` - Phase 1 + Phase 2 + Phase 3 (if tools available)
+
 **Detects:**
 - Console debugging (`console.log`, `print()`, `dbg!()`)
 - Old TODOs and commented code
@@ -170,6 +184,7 @@ Remove debugging code, old TODOs, and AI slop from your codebase.
 - Phantom references (issue/PR mentions, file path references in comments)
 - Infrastructure components configured but never used (unused DB clients, caches, API clients)
 - Code smells: boolean blindness, message chains, mutable globals, dead code, shotgun surgery
+- Buzzword inflation (quality claims without evidence)
 
 ---