@forexcodes/pine-validator

Deterministic static analysis for TradingView Pine Script v6 — catches the correctness bugs that compile but lie: look-ahead bias, repainting, version-hygiene issues, and dead risk controls.

No network. No dependencies. Your code never leaves the machine. This is the same engine that powers forexcodes.com and the ForexCodes VS Code extension — open-sourced so the checks are transparent.

Why

A Pine script can pass the compiler, plot cleanly, and still mislead you: it peeks at future bars, repaints a signal after the bar closes, or exposes a "Stop %" input that's never wired to an exit. None of that shows up as a compile error — it shows up later, as live behaviour that doesn't match the backtest. This library flags exactly those.

What it checks

Code	Rule	Example
L1	Look-ahead bias	request.security(..., lookahead=barmerge.lookahead_on) with no [1] offset; negative history offsets
R1	Repainting	forming-bar signals with no barstate.isconfirmed gate; varip / timenow state
L3	Backtest/live divergence	calc_on_every_tick=true on a strategy
C1	Version hygiene	missing //@version=6; un-namespaced rsi→ta.rsi; removed study() / bare security()
IN	Intent mismatch	a stop/risk input declared but never passed to strategy.exit(stop=...)

Conservative by design — a false alarm is as bad as a miss, so it strips comments/strings, skips user-defined names, and never matches a dot-qualified call.

Usage

import { validate, looksLikePine } from "@forexcodes/pine-validator";

const code = `//@version=6
strategy("EMA cross", overlay=true)
htf = request.security(syminfo.tickerid, "240", close, lookahead=barmerge.lookahead_on)
if ta.crossover(ta.ema(close,12), ta.ema(close,26)) and close > htf
    strategy.entry("Long", strategy.long)`;

if (looksLikePine(code)) {
  const { findings, counts, verdict } = validate(code);
  console.log(verdict);            // "NEEDS FIXES — critical correctness issue(s)"
  console.log(counts);             // { critical: 1, high: 0, medium: 0, info: 0 }
  for (const f of findings) console.log(`L${f.line} ${f.code}: ${f.message}`);
}

validate(code) returns { findings, counts, verdict }. Each finding has { code, rule, severity, line, message, fix }.

Want more?

This is the deterministic core. For AI-enhanced explanations, one-click fixes, a shareable Strategy Health Score™ badge, and MetaTrader (MQL4/MQL5) support, use the hosted platform at forexcodes.com.

Honest by design

This measures code correctness only — whether a script does what it says and whether its backtest reflects reproducible behaviour. It is not a measure of profitability, and nothing here is financial advice. Trading involves substantial risk of loss.

License

MIT © Veltrix Technology LLC (ForexCodes)