Static Analysis

What it does

frontend-qa static --dir src

static parses your source with ts-morph — no browser, no dev server, no network access. --dir defaults to src.

What it checks

Based on packages/core’s static-analysis collectors:

Missing alt — <img> elements (JSX) without an alt attribute
Unsafe dangerouslySetInnerHTML — usage that isn’t obviously sanitized
Dead exports — exported symbols with no detected importer within the project
Unresolved imports — import specifiers that don’t resolve to a file or package
TODO / FIXME — source comments flagged as an info-severity reminder, not a defect

Each finding is an Issue with evidence: 'StaticAnalysis' and, where available, a source: { url, line, column } pointing at the exact location.

Exit code

static exits 1 if any high or critical issue is found, 0 otherwise — independent of --fail-on, which only applies to scan.

When to use it vs. `scan`

static never opens a browser, so it’s fast enough to run on every save or in a pre-commit hook. It catches source-level issues (a missing alt, an unresolved import) that don’t require the app to actually run — scan’s runtime collectors catch what only shows up once the app executes (a console error, a failed fetch).

Example

frontend-qa static --dir src

[frontend-qa] static analysis: src
[frontend-qa] issues: 2 (high=1 medium=0 low=0 info=1)
  - [high] static.dangerous-html: dangerouslySetInnerHTML without sanitization — src/components/Markdown.tsx:14
  - [info] static.todo: TODO comment — src/utils/format.ts:8

Next