feat(biomarkers): four new rules — unused_export, long_parameter_list, magic_number, hardcoded_url

[mschreib28]

Summary\n\nExtends the biomarker engine (PR colbymchenry#125) with four new rules. Three operate on metrics gathered during the per-symbol AST walk; one is a cross-file graph rule.\n\n### Per-symbol additions to SymbolMetrics\n- paramCount — counted from the function/method's parameter list at AST walk time\n- magicNumberCount — numeric literals not in the trivial allow-list (0, 1, -1, 2, plus float variants)\n- hardcodedUrlCount — string literals matching http(s)|ws(s)|ftp|s3|gs URLs\n\n### New rules\n| Rule | Severity tiers |\n|------|----------------|\n| long_parameter_list | info=4 / warning=5 / error=7 (Clean Code thresholds) |\n| magic_number | info=3 / warning=5 / error=8 |\n| hardcoded_url | info on first / warning at 2 / error at 3+ |\n| unused_export | warning — single SQL query: nodes with is_exported=1 whose only incoming edges are contains/exports/imports/tests (or come from the same file) |\n\n### DB additions\n- findUnusedExports() — single graph query over the whole index\n- appendFindings(...) — insert without delete (needed by cross-file rules so they don't clobber per-file rule output)\n- clearFindingsByKind(...) — wipe one biomarker kind globally before re-emitting\n- replaceFindingsForFile updated to preserve unused_export findings on per-file replace, so sync runs that touch a file don't silently lose its cross-file findings without recomputing them\n\n### Edge-kind exclusions for unused_export\n"Used" means a real consumer edge from outside the symbol's file. Excluded as not-real-use:\n- contains — structural; every method is contained by its class\n- exports — re-export barrels (export { foo } from './a') forward but don't consume\n- imports — the import statement itself isn't a use; real use is calls/references/instantiates/extends/etc.\n- tests — convention-derived test→subject edges aren't a semantic API call\n\n## Test plan\n\n- [x] Live verification — synthetic stress fixture with one 7-param function using 5 magic numbers and 3 dead exports:\n \n fetchAll → long_parameter_list error (7), magic_number error (10)\n unused1, unused2, consumeFetch → unused_export warning\n \n- [x] Unit tests added — 6 new evaluateRules cases covering each new rule's trigger thresholds (long_parameter_list warning at 5 + clean at 3, magic_number error at 8 + clean at 2, hardcoded_url info/warning/error tiers + clean at 0). Plus a metrics() helper so future metric additions don't bloat the test suite.\n- [x] npx vitest run — 830 passed\n- [x] npx tsc --noEmit clean\n- [x] npm run build succeeds\n\n## Notes\n\n- Pre-existing clean code = 0 findings test fixture changed to use non-exported helpers (semantically those WERE unused exports under the new rule — calibration artefact, not a regression)\n- unused_export is skipped on partial scans (sync with filePaths) because it depends on global graph state; replaceFindingsForFile preserves existing unused_export rows on touched files so they remain valid until the next full pass\n- appendFindings + clearFindingsByKind are wrapped in a single queries.transaction(...) so concurrent readers never see the intermediate empty state\n\n🤖 Generated with Claude Code\n

---

Copied from colbymchenry/codegraph#132