feat(deslop): add code smell detection patterns (#106) (#115)

* feat(deslop): add code smell detection patterns (#106)

Add high-impact code smell detection patterns:

High-Certainty Patterns (regex-based):
- boolean_blindness: Functions with 3+ consecutive boolean params
- message_chains_methods: Long method chains (4+ calls)
- message_chains_properties: Deep property access (5+ levels)
- mutable_globals_js: Mutable globals with UPPERCASE names
- mutable_globals_py: Mutable global collections in Python

Heuristic Patterns (may have false positives):
- feature_envy: Method using another object 3+ times
- speculative_generality_unused_params: Underscore-prefixed params
- speculative_generality_empty_interface: Empty TypeScript interfaces

Multi-Pass Analyzers:
- analyzeDeadCode: Unreachable code after return/throw/break/continue
- analyzeShotgunSurgery: Files frequently changing together (git analysis)

Pattern skeleton added for dead_code and shotgun_surgery (requiresMultiPass).

* test(deslop): add comprehensive tests for code smell detection (#106)

Add tests for new code smell detection patterns:

High-Certainty Pattern Tests:
- boolean_blindness: 3+ consecutive boolean params
- message_chains_methods: 4+ method call chains
- message_chains_properties: 5+ property access chains
- mutable_globals_js: let/var UPPERCASE in JS
- mutable_globals_py: mutable collections in Python

Heuristic Pattern Tests:
- feature_envy: repeated access to another object
- speculative_generality_unused_params: underscore-prefixed params
- speculative_generality_empty_interface: empty TS interfaces

Multi-Pass Analyzer Tests:
- analyzeDeadCode: unreachable code detection (JS, Python, Go, Rust)
- analyzeShotgunSurgery: git co-change analysis

Also:
- Fixed analyzeDeadCode to handle "} else {" patterns
- Added ReDoS safety tests for all new patterns
- Added language filtering tests

* docs(deslop): update documentation and sync library for code smell detection (#106)

- Add code smell detection section to deslop-around.md
- Add CHANGELOG entry for all new patterns and analyzers
- Sync slop-patterns.js and slop-analyzers.js to all plugins

* docs(readme): add code smell detection to deslop-around features

Updated the README.md `/deslop-around` section to include the newly
added code smell detection patterns:
- Boolean blindness
- Message chains
- Mutable globals
- Dead code
- Shotgun surgery

This ensures the main README is consistent with the detailed
documentation in CHANGELOG.md and deslop-around.md.

* fix(deslop): improve analyzeDeadCode for Python and one-line conditionals

Addresses review feedback from Gemini and Codex:

1. **Python indentation tracking** - Use indentation-based scope detection
   instead of brace-counting for Python files. Fixes false positives where
   next function definition was flagged as dead code.

2. **One-line conditional detection** - Skip termination statements that are
   part of one-line conditionals (e.g., "if (x) return;"). These don't make
   subsequent code unreachable.

3. **Language-aware block detection** - Maintains brace-depth tracking for
   JS/Go/Rust while using indentation for Python.

Fixes issues reported in PR #115 review.

* fix(deslop): correct Python indentation logic in analyzeDeadCode

Fix indentation level check to allow same-level code (dead code) while
stopping only when dedented to a lesser indentation (exited block).

Previous logic stopped at same-or-less indentation, which prevented
detecting dead code at the same level as the return statement.

Now correctly detects:
  def test():
      return 42
      print('unreachable')  # Same indentation = dead code

* chore: trigger CI rerun

* fix(deslop): prevent ReDoS in message_chains patterns

Add bounds to regex quantifiers to prevent catastrophic backtracking:
- Word boundary \b at start (prevents matching mid-string)
- Identifier length limit: 100 chars max
- Method argument limit: 200 chars max
- Repetition bounds: 4-8 for methods, 5-10 for properties

Fixes CI test failure: 'message_chains patterns should resist ReDoS'

* chore: remove accidental test output files

* fix(analyzers): address review feedback - command injection validation

- Add commitLimit validation in analyzeShotgunSurgery to prevent command injection
- Sync validated changes to all plugin lib copies

Author: avifenesh

CHANGELOG.md

@@ -81,6 +81,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - New `analyzeInfrastructureWithoutImplementation()` function in slop-analyzers.js
   - Focused test suite covering key scenarios and edge cases
 
+- **Code Smell Detection** - High-impact code smell patterns for maintainability (#106)
+  - High-certainty patterns (low false positive rate):
+    - `boolean_blindness`: Function calls with 3+ consecutive boolean params
+    - `message_chains_methods`: Long method chains (4+ calls)
+    - `message_chains_properties`: Deep property access (5+ levels)
+    - `mutable_globals_js`: let/var with UPPERCASE names in JavaScript
+    - `mutable_globals_py`: Mutable global collections in Python
+  - Multi-pass analyzers:
+    - `analyzeDeadCode()`: Unreachable code after return/throw/break/continue (JS, Python, Go, Rust)
+    - `analyzeShotgunSurgery()`: Files frequently changing together (git history analysis)
+  - Heuristic patterns (may have false positives):
+    - `feature_envy`: Method using another object 3+ times
+    - `speculative_generality_unused_params`: Underscore-prefixed params
+    - `speculative_generality_empty_interface`: Empty TypeScript interfaces
+  - All patterns have ReDoS-safe regex and comprehensive test coverage
+
 ### Fixed
 - **findMatchingBrace** - Now skips comments to avoid breaking on quotes/apostrophes in comment text (e.g., "it's", "we're")
 - **Reality Check Output Size** - Condensed collector output to ~700 lines/~4.5k tokens (was thousands of lines)

README.md

@@ -169,6 +169,7 @@ Remove debugging code, old TODOs, and AI slop from your codebase.
 - Excessive documentation (JSDoc >3x function body)
 - Phantom references (issue/PR mentions, file path references in comments)
 - Infrastructure components configured but never used (unused DB clients, caches, API clients)
+- Code smells: boolean blindness, message chains, mutable globals, dead code, shotgun surgery
 
 ---