yoori

React / JavaScript code audit CLI: rule-based scan, curated knowledge-base excerpts on findings, and HTML / Markdown / JSON reports (thematic summary, architecture overview, reading list).

npm package: yoori-js — the short name yoori is not allowed on the public registry (too similar to the existing package yoshi). After install, the command is still yoori.

Install

npm install -g yoori-js
# prerelease
npm install -g yoori-js@alpha

Usage

# After global install — binary name is `yoori`
yoori scan
yoori scan ./src
yoori report
yoori query "useEffect dependencies"

# Without global install
npx yoori-js scan
npx yoori-js scan ./src
npx yoori-js report
npx yoori-js report /path/to/scanner-report.json
npx yoori-js query "useEffect dependencies"

Inside this repo: npm run scan, npm run report, npm run scan:report.

Environment

| Variable | Purpose | |----------|---------| | YOORI_KB | Path to kb-chunks.json or embeddings.json | | YOORI_EMBEDDINGS | Same as YOORI_KB (alternate name) | | YOORI_OUTPUT_DIR | Where scanner-report.json / audit-report.* are written (default: cwd) | | OPENAI_API_KEY | Optional; enables query embedding + semantic retrieval when using embeddings.json | | YOORI_NO_OPEN | Set to 1 to skip opening audit-report.html in the browser after yoori report / npm run report | | CI | When true or 1, the HTML report is not auto-opened (for CI servers) |

Knowledge base

Bundled as knowledge-base/kb-chunks.json in the published package. Maintainers:

npm run validate
npm run build-kb
# or: npm run build-kb:insecure

Optional: npm run embed → embeddings.json (requires OPENAI_API_KEY).

License

MIT