---
name: analyze:static
description: Run 40+ linters across all languages with intelligent deduplication and unified reporting
delegates-to: autonomous-agent:orchestrator
---

# Static Analysis Command

Execute comprehensive static analysis across your codebase using 40+ industry-standard linters, with intelligent result deduplication and unified reporting.

## Usage

```bash
/analyze:static [PATH] [OPTIONS]
```

**Examples**:
```bash
/analyze:static                    # Analyze current directory
/analyze:static src/               # Analyze specific directory
/analyze:static src/auth.py        # Analyze specific file
/analyze:static --quick            # Fast analysis (fewer linters)
/analyze:static --security         # Security-focused analysis
```

## Supported Languages and Linters

### Python (10 linters)
- **pylint** - Code quality, bugs, style
- **flake8** - Style guide enforcement
- **mypy** - Static type checking
- **bandit** - Security vulnerability scanning
- **pycodestyle** - PEP 8 style checking
- **pydocstyle** - Docstring conventions
- **vulture** - Dead code detection
- **radon** - Complexity metrics
- **mccabe** - Cyclomatic complexity
- **pyflakes** - Error detection

### JavaScript/TypeScript (5 linters)
- **eslint** - Code quality, bugs, style
- **tslint** - TypeScript-specific linting
- **jshint** - JavaScript error detection
- **prettier** - Code formatting
- **standard** - JavaScript Standard Style

### Multi-Language (3 linters)
- **semgrep** - Security & bug detection (Python, JS, TS, Go, Java)
- **sonarqube** - Comprehensive code quality
- **codeql** - Advanced security scanning

### Go (4 linters)
- **golint** - Style checking
- **govet** - Correctness checking
- **staticcheck** - Advanced static analysis
- **golangci-lint** - Meta-linter (runs 50+ linters)

### Rust (2 linters)
- **clippy** - Comprehensive linting
- **rustfmt** - Code formatting

### Java (3 linters)
- **checkstyle** - Style checking
- **pmd** - Code quality
- **spotbugs** - Bug detection

### C/C++ (3 linters)
- **cppcheck** - Bug and security detection
- **clang-tidy** - Modernization and bug detection
- **cpplint** - Style guide enforcement

### Ruby (2 linters)
- **rubocop** - Style and quality
- **reek** - Code smell detection

### PHP (3 linters)
- **phpcs** - Coding standards
- **phpstan** - Static analysis
- **psalm** - Type system analysis

### Other Languages
- **shellcheck** - Bash/shell script analysis
- **stylelint** - CSS/SCSS/LESS linting
- **sqlfluff** - SQL linting
- **yamllint** - YAML validation
- **markdownlint** - Markdown linting
- **hadolint** - Dockerfile best practices

**Total**: 40+ linters across 15+ languages

## How It Works

### 1. Language Detection

Automatically detects languages in target path:

```python
Detected Languages:
- Python (.py files)
- JavaScript (.js files)
- TypeScript (.ts files)
- CSS (.css files)
```

### 2. Linter Selection

Selects appropriate linters based on detected languages:

```python
Enabled Linters (12):
✅ pylint        (Python quality)
✅ flake8        (Python style)
✅ mypy          (Python typing)
✅ bandit        (Python security)
✅ eslint        (JS/TS quality)
✅ prettier      (JS/TS formatting)
✅ stylelint     (CSS quality)
...
```

### 3. Parallel Execution

Runs linters in parallel for maximum speed:

```python
Running Analysis...
[████████████████████████████████] 12/12 linters (8 parallel workers)

Results:
✅ pylint      (2.3s) - 47 issues
✅ flake8      (1.1s) - 23 issues
✅ mypy        (3.5s) - 12 issues
✅ bandit      (1.8s) - 3 issues
✅ eslint      (4.2s) - 31 issues
...
```

### 4. Result Synthesis

Intelligently deduplicates and synthesizes results:

```python
Synthesis:
- Total Issues Found: 152
- Duplicate Issues: 36
- Unique Issues: 116

Deduplication:
- Same issue from multiple linters
- Different rule IDs for same problem
- Fingerprinting-based matching
```

### 5. Quality Score Calculation

```python
Quality Score (0-100) =
    100 - (
        Critical × 10 +
        Error × 5 +
        Warning × 2 +
        Info × 1 +
        Style × 0.5
    )

Example:
- Critical: 2 -> -20 points
- Error: 8 -> -40 points
- Warning: 15 -> -30 points
- Info: 10 -> -10 points
- Style: 20 -> -10 points
---

---------------------
Score: 100 - 110 = 0 (capped at 0)
```

**Scoring Bands**:
- 90-100: Excellent
- 70-89: Good
- 50-69: Needs Improvement
- 0-49: Critical Issues

## Output Format

### Terminal Output (Tier 1: Concise Summary)

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  STATIC ANALYSIS COMPLETE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📊 Quality Score: 78/100 (GOOD)

🔍 Analysis Summary
   Languages: Python, JavaScript, CSS
   Linters: 12 run, 0 failed
   Total Issues: 116 unique (36 duplicates removed)

🚨 Issues by Severity
   🔴 Critical: 2
   🟠 Error: 8
   🟡 Warning: 15
   🔵 Info: 10
   ⚪ Style: 81

📂 Top 3 Files
   1. src/auth.py - 23 issues
   2. src/api.js - 18 issues
   3. src/utils.py - 12 issues

🎯 Top 3 Issues
   1. CRITICAL - SQL injection risk (src/auth.py:45)
   2. ERROR - Undefined variable (src/api.js:112)
   3. ERROR - Type mismatch (src/utils.py:78)

✅ Auto-fixable: 45/116 issues

📄 Detailed Report: .data/reports/static-analysis-2025-01-15.md

⏱️  Analysis completed in 12.4s
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

### File Report (Tier 2: Comprehensive)

Saved to `.data/reports/static-analysis-{DATE}.md`:

```markdown
# Static Analysis Report
**Generated**: 2025-01-15 14:23:45
**Path**: /project/src
**Quality Score**: 78/100

---

## Summary

**Languages Detected**: Python, JavaScript, TypeScript, CSS
**Linters Executed**: 12
**Total Issues**: 116 (36 duplicates removed)
**Duration**: 12.4s

---

## Issues by Severity

| Severity | Count | Percentage |
|----------|-------|-----------|
| 🔴 Critical | 2 | 1.7% |
| 🟠 Error | 8 | 6.9% |
| 🟡 Warning | 15 | 12.9% |
| 🔵 Info | 10 | 8.6% |
| ⚪ Style | 81 | 69.8% |

---

## Issues by Category

- **Security**: 5 issues
- **Bug**: 12 issues
- **Code Quality**: 23 issues
- **Style**: 81 issues
- **Typing**: 8 issues
- **Performance**: 3 issues
- **Documentation**: 2 issues

---

## Top 10 Files with Issues

1. `src/auth.py` - 23 issues
2. `src/api.js` - 18 issues
3. `src/utils.py` - 12 issues
4. `src/components/Button.tsx` - 10 issues
5. `src/database.py` - 9 issues
6. `src/helpers.js` - 8 issues
7. `src/styles/main.css` - 7 issues
8. `src/config.py` - 6 issues
9. `src/routes.js` - 5 issues
10. `src/models.py` - 4 issues

---

## Linter Execution Results

### Successful (12)
- ✅ **pylint** (2.3s) - 47 issues
- ✅ **flake8** (1.1s) - 23 issues
- ✅ **mypy** (3.5s) - 12 issues
- ✅ **bandit** (1.8s) - 3 issues
- ✅ **eslint** (4.2s) - 31 issues
- ✅ **prettier** (0.8s) - 15 issues
- ✅ **stylelint** (1.2s) - 7 issues
- ✅ **semgrep** (5.3s) - 8 issues
- ✅ **pycodestyle** (0.9s) - 18 issues
- ✅ **pydocstyle** (1.0s) - 12 issues
- ✅ **radon** (0.7s) - 4 issues
- ✅ **shellcheck** (0.5s) - 2 issues

### Failed (0)
None

---

## Critical and High Priority Issues

### src/auth.py:45
**Severity**: CRITICAL
**Category**: security
**Linter**: bandit
**Rule**: B608 (SQL injection)
**Message**: Possible SQL injection vector through string-based query construction

**Auto-fixable**: ✅ Yes

**Suggested Fix**:
```python
# Before
query = f"SELECT * FROM users WHERE username = '{username}'"

# After
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))
```

---

### src/api.js:112
**Severity**: ERROR
**Category**: bug
**Linter**: eslint
**Rule**: no-undef
**Message**: 'response' is not defined

**Auto-fixable**: ❌ No

**Context**:
```javascript
110: function handleRequest(request) {
111:   processRequest(request);
112:   return response.json();  // <- 'response' not defined
113: }
```

---

### src/utils.py:78
**Severity**: ERROR
**Category**: typing
**Linter**: mypy
**Rule**: assignment
**Message**: Incompatible types in assignment (expression has type "str", variable has type "int")

**Auto-fixable**: [WARN]️ Suggest manual fix

**Context**:
```python
76: def calculate_age(birth_year: int) -> int:
77:   current_year = 2025
78:   age = current_year - birth_year
79:   age = str(age)  # <- Type error: int expected, str assigned
80:   return age
```

---

[... continues with all critical/error issues ...]

---

## Fixable Issues Summary

**Total Auto-fixable**: 45/116 (38.8%)

### By Category
- **Style**: 38 auto-fixable
- **Code Quality**: 5 auto-fixable
- **Security**: 2 auto-fixable

Apply all fixes:
```bash
/apply-static-analysis-fixes
```

Apply specific fixes:
```bash
/apply-fix {issue-fingerprint}
```

---

## Quality Score Breakdown

```
Base Score: 100

Penalties:
- Critical (2 × 10): -20
- Error (8 × 5): -40
- Warning (15 × 2): -30
- Info (10 × 1): -10
- Style (81 × 0.5): -40.5

Total Penalty: -140.5 (capped at 100)
Final Score: 0 -> Adjusted to actual: 78/100

Note: Score uses weighted algorithm with diminishing returns
```

**Score Interpretation**:
- ✅ **70-100**: Production ready
- [WARN]️ **50-69**: Needs improvement
- ❌ **0-49**: Critical issues require attention

**Current Status**: ✅ GOOD (78/100)

---

## Recommendations

### Critical Actions (2)
1. **Fix SQL injection vulnerability** (src/auth.py:45)
   - Use parameterized queries
   - Auto-fixable: Yes

2. **Fix critical type error** (src/database.py:123)
   - Review type annotations
   - Auto-fixable: No (requires manual review)

### Suggested Improvements (8)
1. **Add type hints** to 12 functions
2. **Fix undefined variables** in 3 locations
3. **Improve error handling** in 5 functions
4. **Add missing docstrings** to 15 functions
5. **Reduce complexity** in 4 functions
6. **Remove unused imports** in 8 files
7. **Fix naming conventions** in 6 variables
8. **Update deprecated syntax** in 3 files

### Style Improvements (81)
- Run auto-formatter on all files
- Apply `black` for Python
- Apply `prettier` for JavaScript/TypeScript
- Apply `stylelint --fix` for CSS

---

## Next Steps

1. **Address Critical Issues**: Fix 2 critical security vulnerabilities
2. **Apply Auto-fixes**: Run `/apply-static-analysis-fixes` for 45 fixable issues
3. **Manual Review**: Review 8 error-level issues requiring manual fixes
4. **Continuous Monitoring**: Integrate into CI/CD pipeline
5. **Re-run Analysis**: Verify quality score improvement

**Target Score**: 85+/100 (Excellent)

---

**End of Report**
```

## Advanced Options

### Quick Analysis (Fast Mode)

```bash
/analyze:static --quick
```

**Features**:
- Runs only essential linters (10-15)
- Skips style-only linters
- Focuses on bugs and security
- 3-5x faster execution

**Use Case**: Rapid feedback during development

### Security-Focused Analysis

```bash
/analyze:static --security
```

**Features**:
- Runs only security linters
- Deep vulnerability scanning
- OWASP Top 10 focused
- SARIF output for CI/CD

**Linters**:
- bandit (Python)
- semgrep (multi-language)
- codeql (multi-language)
- eslint security plugins
- shellcheck
- hadolint

### Category-Specific Analysis

```bash
/analyze:static --category=typing     # Only type checking
/analyze:static --category=style      # Only style checking
/analyze:static --category=complexity # Only complexity analysis
```

### Output Formats

```bash
/analyze:static --format=json         # JSON output
/analyze:static --format=sarif        # SARIF for CI/CD
/analyze:static --format=html         # HTML report
```

## Integration with Learning System

The static analysis system integrates with pattern learning:

```python
# After each analysis
learning_engine.store_pattern({
    "task_type": "static_analysis",
    "context": {
        "languages": detected_languages,
        "linters_used": linters_run,
        "issues_found": total_issues
    },
    "execution": {
        "duration": total_duration,
        "parallel_workers": 8
    },
    "outcome": {
        "quality_score": 78,
        "fix_success_rate": 0.92
    }
})

# Future analyses benefit from:
- Learned false positive patterns
- Optimal linter combinations
- Expected issue distributions
- Quality score trends
```

## CI/CD Integration

### GitHub Actions Example

```yaml
name: Static Analysis
on: [push, pull_request]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Static Analysis
        run: |
          /analyze:static --format=sarif --output=results.sarif
      - name: Upload Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif
```

### GitLab CI Example

```yaml
static-analysis:
  stage: test
  script:
    - /analyze:static --format=json --output=results.json
  artifacts:
    reports:
      codequality: results.json
```

## Performance Expectations

| Project Size | Files | Linters | Duration | Workers |
|-------------|-------|---------|----------|---------|
| Small | <50 | 8 | 5-15s | 4 |
| Medium | 50-200 | 12 | 15-60s | 8 |
| Large | 200-1000 | 15 | 1-5min | 12 |
| XLarge | 1000+ | 20+ | 5-15min | 16 |

**Optimization**:
- Parallel execution (default: 8 workers)
- Incremental analysis (only changed files)
- Caching of linter installations
- Smart linter selection

## Troubleshooting

### Issue: Linter Not Found

```
❌ pylint not installed
```

**Solution**:
```bash
pip install pylint flake8 mypy bandit
npm install -g eslint prettier
```

### Issue: Timeout

```
[WARN]️ semgrep timeout after 60s
```

**Solution**:
```bash
/analyze:static --timeout=120  # Increase timeout
```

### Issue: Too Many Style Issues

```
⚪ Style: 500 issues
```

**Solution**:
```bash
# Run auto-formatter first
black .
prettier --write .

# Then analyze
/analyze:static
```

## Best Practices

1. **Run Before Commit**: Integrate into pre-commit hooks
2. **Target Score 85+**: Aim for "Excellent" quality
3. **Fix Critical First**: Address security and errors before style
4. **Use Auto-Fix**: Apply 38% of fixes automatically
5. **Regular Analysis**: Run daily or per commit
6. **Track Trends**: Monitor quality score over time
7. **Team Standards**: Configure linters for team preferences

---

This command provides comprehensive static analysis with minimal configuration, intelligent result synthesis, and actionable recommendations.