Language support
Code Buster recognizes 18 source languages. Related languages are grouped below where they share an analysis adapter or rule family.
Implementation depth and real-world validation are tracked separately. High, Moderate, and Foundational describe analysis depth; they do not mean every construct is understood.
| Language | Depth | Testing status | Main capabilities |
|---|---|---|---|
| Dart | High | Done | Multi-package workspace graph, callables, broad language rules, Flutter analysis, and analyzer-policy checks |
| C# | High | Done | Project-aware graph, production/test classification, and validated correctness, reliability, security, and style rules |
| Java | High | Done | Validated package cycles, resources, exceptions, concurrency, SQL, cryptography, and serialization rules |
| Nim | High | Needs more testing | Dedicated parser, complete rule-pack wiring, and focused regressions |
| Python | High | Validated on three repositories | FastAPI, HTTPie, and Requests validation covering imports, callables, graph analysis, security, and broad rules |
| C, C++, Objective-C | Moderate | Needs more testing | Dialect gating, includes, callables, safety, and modernization rules |
| Go | Moderate | Validated on three repositories | Gin, Hugo, and Go JOSE validation covering module imports, callables, source roles, reliability, security, and advisory precision |
| JavaScript, TypeScript | Moderate | Done | Validated module graph, callables, frontend sinks, Node.js, SQL templates, security, and TypeScript checks |
| Lua, Luau | Moderate | Needs more testing | Module and callable extraction with correctness, runtime, and style checks |
| SQL dialects | Moderate | Needs more testing | Dialect-aware statements, correctness, safety, and maintainability |
| Rust | Moderate | Self-hosted and validated on real repositories | Modules, use edges, callables, Cargo policy, panic and unsafe boundaries, ownership leaks, debug residue, and shell execution |
| Mojo | Moderate | Needs real-world validation | Imports, callables, current syntax migration, string indexing, and raises contracts |
| Odin | Moderate | Needs real-world validation | Directory-package imports, procedures, and focused panic, pointer, transmute, and initialization rules |
| Wren | Moderate | Needs more testing | Imports, callables, and a dedicated rule pack |
| CSS | Foundational | Needs more testing | Discovery plus targeted structural and style checks |
| HTML | Foundational | Needs more testing | Discovery, embedded scripts, correctness, and style checks |
Framework profiles
Frameworks are detected independently from source languages. A framework profile reuses its language parser while adding framework-specific detection and rules. Flutter activates on top of Dart; it is not counted as a separate source language.
| Framework | Languages | Detection | Rule coverage |
|---|---|---|---|
| Flutter | Dart | Flutter SDK dependencies in pubspec.yaml |
Widget lifecycle, build behavior, layout, themes, and shared UI components |
| React | JavaScript, TypeScript | react or react-dom dependencies in package.json |
Repository classification; dedicated framework rules are not yet available |
cb config explain reports detected frameworks. cb rules <rule> reports a required framework when a rule belongs to a framework profile.
Use languages = ["auto"] for manifest and source-based detection, or list languages explicitly in code-buster.toml. Use cb inspect <path> when an extension, generated marker, or repository profile produces unexpected classification.
Unsupported source remains visible in the coverage ledger. Code Buster does not silently treat unsupported files as analyzed.