@0xcraft/powershot 1.0.0

package/dist/lang/packs.js

@@ -0,0 +1,557 @@
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+/** Shared defaults; a pack overrides only what its grammar spells differently. */
+const COMMON_NODES = {
+    identifier: ['identifier'],
+    comment: ['comment', 'line_comment', 'block_comment'],
+    ifCondition: 'condition',
+    ifBody: 'consequence',
+    declarationName: 'name',
+    block: ['block'],
+};
+/** Pull the key out of `getenv("HOME")` / `environ["HOME"]` style reads. */
+function envKeysFrom(root, callPattern, callTypes) {
+    const out = [];
+    for (const call of nodesOfType(root, callTypes)) {
+        if (!callPattern.test(call.text))
+            continue;
+        const key = /["'`]([A-Z_][A-Z0-9_]*)["'`]/.exec(call.text);
+        if (key?.[1])
+            out.push({ name: key[1], node: call });
+    }
+    return out;
+}
+/** depth-first walk, used by every pack */
+export function walk(node, visit) {
+    visit(node);
+    for (let i = 0; i < node.childCount; i++) {
+        const child = node.child(i);
+        if (child)
+            walk(child, visit);
+    }
+}
+export function nodesOfType(root, types) {
+    const out = [];
+    walk(root, (n) => {
+        if (types.includes(n.type))
+            out.push(n);
+    });
+    return out;
+}
+/**
+ * A comment inside a handler is the author saying "I meant this", in every language.
+ * Deliberate silence is not a defect, so it suppresses the finding — the same rule
+ * the TypeScript checks already follow.
+ */
+function hasComment(node) {
+    if (!node)
+        return false;
+    let found = false;
+    walk(node, (n) => {
+        if (n.type === 'comment' || n.type === 'line_comment' || n.type === 'block_comment')
+            found = true;
+    });
+    return found;
+}
+/** A body is meaningless when it does nothing at all, or only says "pass". */
+function isInertBlock(block, inertTypes) {
+    if (!block)
+        return false;
+    if (hasComment(block))
+        return false;
+    const statements = block.namedChildren.filter((c) => c.type !== 'comment');
+    if (statements.length === 0)
+        return true;
+    return statements.every((s) => inertTypes.includes(s.type));
+}
+/**
+ * The try/catch family. Java, C++, C#, PHP, Kotlin, Swift and Scala all discard a
+ * failure the same way — a handler whose body does nothing, or only logs — so the
+ * rule is written once and each pack supplies its grammar's spelling.
+ */
+function catchBased(catchTypes, bodyField, logPattern) {
+    return (root) => {
+        const out = [];
+        for (const clause of nodesOfType(root, catchTypes)) {
+            const body = (bodyField ? clause.childForFieldName(bodyField) : undefined) ??
+                clause.namedChildren.find((c) => /block|compound_statement|statements/.test(c.type)) ??
+                null;
+            // Kotlin and Swift put the braces straight on the catch clause, so an empty
+            // handler has no body node at all to inspect — only a `{}` at the end
+            if (!body) {
+                if (/\{\s*\}\s*$/.test(clause.text) && !hasComment(clause)) {
+                    out.push({ node: clause, what: 'catch block does nothing' });
+                }
+                continue;
+            }
+            if (isInertBlock(body, [])) {
+                out.push({ node: clause, what: 'catch block does nothing' });
+                continue;
+            }
+            if (hasComment(body))
+                continue;
+            const statements = (body?.namedChildren ?? []).filter((c) => !COMMON_NODES.comment.includes(c.type));
+            if (statements.length > 0 && statements.every((st) => logPattern.test(st.text.trim()))) {
+                out.push({ node: clause, what: 'catch block only logs' });
+            }
+        }
+        return out;
+    };
+}
+const PYTHON = {
+    name: 'python',
+    extensions: ['.py', '.pyi'],
+    grammar: 'tree-sitter-python',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        ifBody: 'consequence',
+        bail: ['return_statement', 'raise_statement', 'continue_statement', 'break_statement'],
+        declaration: ['function_definition', 'class_definition'],
+    },
+    envReads(root) {
+        return envKeysFrom(root, /os\.environ|getenv/, ['call', 'subscript']);
+    },
+    imports(root) {
+        const out = [];
+        for (const stmt of nodesOfType(root, ['import_statement', 'import_from_statement'])) {
+            // `import a.b`, `from a.b import c`, `import a as x` — the module is the first
+            // dotted name, and a relative `from . import x` has none
+            const first = stmt.namedChildren.find((c) => c.type === 'dotted_name' || c.type === 'aliased_import');
+            const dotted = first?.type === 'aliased_import' ? first.namedChildren[0] : first;
+            if (!dotted || stmt.text.includes('from .'))
+                continue;
+            out.push({ name: dotted.text, node: stmt });
+        }
+        return out;
+    },
+    signatures(root) {
+        const out = new Map();
+        for (const fn of nodesOfType(root, ['function_definition'])) {
+            const name = fn.childForFieldName('name');
+            const params = fn.childForFieldName('parameters');
+            if (!name || !params)
+                continue;
+            const listed = [];
+            let required = 0;
+            for (const p of params.namedChildren) {
+                // *args and **kwargs demand nothing of a caller, and self/cls are bound
+                if (p.type === 'list_splat_pattern' || p.type === 'dictionary_splat_pattern')
+                    continue;
+                const label = p.text;
+                if (/^(self|cls)\b/.test(label))
+                    continue;
+                listed.push(label);
+                // a default makes it optional; a bare or annotated name does not
+                if (p.type === 'identifier' || p.type === 'typed_parameter')
+                    required++;
+            }
+            out.set(name.text, { required, params: listed, node: fn });
+        }
+        return out;
+    },
+    tests(root) {
+        const out = [];
+        for (const fn of nodesOfType(root, ['function_definition'])) {
+            const name = fn.childForFieldName('name')?.text;
+            if (!name || !name.startsWith('test'))
+                continue;
+            const body = fn.childForFieldName('body');
+            if (!body)
+                continue;
+            const assertions = [];
+            for (const stmt of nodesOfType(body, ['assert_statement'])) {
+                // `assert subject == expected` is what can drift; a bare `assert x` cannot
+                const comparison = stmt.namedChildren.find((c) => c.type === 'comparison_operator');
+                const left = comparison?.namedChildren[0];
+                const right = comparison?.namedChildren[1];
+                if (comparison && left && right) {
+                    assertions.push({ subject: left.text, expected: right.text, node: stmt, expectedNode: right });
+                }
+            }
+            // unittest style: self.assertEqual(subject, expected)
+            for (const call of nodesOfType(body, ['call'])) {
+                const fnName = call.childForFieldName('function')?.text ?? '';
+                if (!/(^|\.)assert[A-Z_]/.test(fnName))
+                    continue;
+                const args = call.childForFieldName('arguments')?.namedChildren ?? [];
+                if (args.length >= 2 && args[0] && args[1]) {
+                    assertions.push({ subject: args[0].text, expected: args[1].text, node: call, expectedNode: args[1] });
+                }
+            }
+            // includes mock's family — `publish.assert_not_awaited()` is how most async
+            // suites assert, and missing it called 25 good tests vacuous on a real repo
+            const asserts = nodesOfType(body, ['assert_statement']).length > 0 ||
+                nodesOfType(body, ['call']).some((c) => /(^|\.)(assert[A-Z_a-z]|fail$|raises$)/.test(c.childForFieldName('function')?.text ?? '')) ||
+                nodesOfType(body, ['with_statement']).some((w) => /raises|assertRaises|pytest\.warns/.test(w.text));
+            const runsSomething = nodesOfType(body, ['call']).length > 0;
+            // a body that is only `pass` or a docstring is a placeholder, not a lie
+            const isPlaceholder = body.namedChildren.every((c) => c.type === 'pass_statement' || c.type === 'expression_statement' && /^["']/.test(c.text.trim()));
+            out.push({ name, node: fn, assertions, provesNothing: runsSomething && !asserts && !isPlaceholder });
+        }
+        return out;
+    },
+    documentedParams(root) {
+        const out = [];
+        for (const fn of nodesOfType(root, ['function_definition'])) {
+            const name = fn.childForFieldName('name')?.text;
+            const params = fn.childForFieldName('parameters');
+            const body = fn.childForFieldName('body');
+            if (!name || !params || !body)
+                continue;
+            // the docstring is the first statement, if it is a bare string
+            const first = body.namedChildren[0];
+            if (!first || first.type !== 'expression_statement' || !/^[ru]?["']/.test(first.text.trim()))
+                continue;
+            const declared = params.namedChildren
+                .filter((p) => p.type !== 'list_splat_pattern' && p.type !== 'dictionary_splat_pattern')
+                .map((p) => (p.text.split(/[:=]/)[0] ?? '').trim())
+                .filter((n) => n !== 'self' && n !== 'cls' && n !== '');
+            const documented = [];
+            const text = first.text;
+            // reST `:param name:`. A line at a time: across the whole string the optional
+            // type group swallows the name and matches the *next* directive's colon.
+            for (const line of text.split('\n')) {
+                const m = /^\s*:param\s+(?:[^\s:]+\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*:/.exec(line);
+                if (m?.[1])
+                    documented.push({ name: m[1], node: first });
+            }
+            // Google: an `Args:` block, one `name:` or `name (type):` per line
+            const args = /\n\s*Args:\s*\n([\s\S]*?)(\n\s*(?:Returns|Raises|Yields|Examples?|Notes?):|["']{3})/.exec(text);
+            if (args?.[1]) {
+                for (const line of args[1].split('\n')) {
+                    const m = /^\s{2,}([A-Za-z_][A-Za-z0-9_]*)\s*(?:\([^)]*\))?\s*:/.exec(line);
+                    if (m?.[1])
+                        documented.push({ name: m[1], node: first });
+                }
+            }
+            if (documented.length > 0)
+                out.push({ fn: name, declared, documented });
+        }
+        return out;
+    },
+    swallowedError(root) {
+        const out = [];
+        for (const clause of nodesOfType(root, ['except_clause'])) {
+            const block = clause.namedChildren.find((c) => c.type === 'block') ?? null;
+            // `except: pass` is the canonical Python spelling of discarding a failure
+            if (isInertBlock(block, ['pass_statement', 'ellipsis'])) {
+                out.push({ node: clause, what: 'except block does nothing' });
+                continue;
+            }
+            if (hasComment(block))
+                continue;
+            const statements = (block?.namedChildren ?? []).filter((c) => c.type !== 'comment');
+            const onlyLogs = statements.length > 0 &&
+                statements.every((s) => s.type === 'expression_statement' &&
+                    /^(print|log|logger|logging)\s*[.(]/.test(s.text.trim()));
+            if (onlyLogs)
+                out.push({ node: clause, what: 'except block only logs' });
+        }
+        return out;
+    },
+};
+const GO = {
+    name: 'go',
+    extensions: ['.go'],
+    grammar: 'tree-sitter-go',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        bail: ['return_statement', 'continue_statement', 'break_statement', 'goto_statement'],
+        declaration: ['function_declaration', 'method_declaration', 'type_declaration'],
+    },
+    envReads(root) {
+        return envKeysFrom(root, /os\.Getenv|os\.LookupEnv/, ['call_expression']);
+    },
+    swallowedError(root) {
+        const out = [];
+        // Go has no catch: the idiom is `if err != nil { ... }`, and the failure is
+        // discarded when that body does nothing
+        for (const stmt of nodesOfType(root, ['if_statement'])) {
+            const cond = stmt.childForFieldName('condition');
+            if (!cond || !/\berr\b\s*!=\s*nil/.test(cond.text))
+                continue;
+            const body = stmt.childForFieldName('consequence');
+            if (isInertBlock(body, []))
+                out.push({ node: stmt, what: 'error is checked and then ignored' });
+        }
+        // `_ = f()` deliberately NOT reported: Go compiles without assigning at all, so
+        // the blank identifier is someone saying "I know". An empty `if err != nil` isn't.
+        return out;
+    },
+};
+const JAVA = {
+    name: 'java',
+    extensions: ['.java'],
+    grammar: 'tree-sitter-java',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        bail: ['return_statement', 'throw_statement', 'continue_statement', 'break_statement'],
+        declaration: ['method_declaration', 'class_declaration', 'interface_declaration', 'record_declaration'],
+    },
+    envReads(root) {
+        return envKeysFrom(root, /System\.getenv/, ['method_invocation']);
+    },
+    swallowedError: catchBased(['catch_clause'], 'body', /^(System\.(out|err)|log|logger|LOG|LOGGER)\s*\./),
+};
+const RUST = {
+    name: 'rust',
+    extensions: ['.rs'],
+    grammar: 'tree-sitter-rust',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_expression'],
+        ifCondition: 'condition',
+        ifBody: 'consequence',
+        bail: ['return_expression', 'break_expression', 'continue_expression'],
+        declaration: ['function_item', 'struct_item', 'enum_item', 'trait_item'],
+    },
+    envReads(root) {
+        return envKeysFrom(root, /env::var|env::var_os/, ['call_expression']);
+    },
+    swallowedError(root) {
+        const out = [];
+        // `let _ = fallible()` deliberately NOT reported: it is Rust's own "on purpose",
+        // written to silence #[must_use]. Measured, 59 findings over 19 commits, all
+        // idiomatic. An empty `Err(..)` arm has no such marker.
+        for (const arm of nodesOfType(root, ['match_arm'])) {
+            const pattern = arm.childForFieldName('pattern');
+            if (!pattern || !/^Err\b/.test(pattern.text.trim()))
+                continue;
+            const value = arm.childForFieldName('value');
+            if (value && (value.text.trim() === '{}' || isInertBlock(value, []))) {
+                out.push({ node: arm, what: 'Err arm does nothing' });
+            }
+        }
+        return out;
+    },
+};
+const CLIKE_LOG = /^(std::(cout|cerr)|printf|fprintf|Console\.|Log|log|logger|error_log|print_r|var_dump)/;
+const CPP = {
+    name: 'cpp',
+    extensions: ['.cpp', '.cc', '.cxx', '.hpp', '.hh', '.h'],
+    grammar: 'tree-sitter-cpp',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        bail: ['return_statement', 'throw_statement', 'break_statement', 'continue_statement', 'goto_statement'],
+        declaration: ['function_definition'],
+        declarationName: 'declarator',
+        block: ['compound_statement'],
+    },
+    envReads: (root) => envKeysFrom(root, /getenv|GetEnvironmentVariable/, ['call_expression']),
+    swallowedError: catchBased(['catch_clause'], 'body', CLIKE_LOG),
+};
+const C = {
+    name: 'c',
+    extensions: ['.c'],
+    grammar: 'tree-sitter-c',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        bail: ['return_statement', 'break_statement', 'continue_statement', 'goto_statement'],
+        declaration: ['function_definition'],
+        declarationName: 'declarator',
+        block: ['compound_statement'],
+    },
+    envReads: (root) => envKeysFrom(root, /getenv/, ['call_expression']),
+    // C has no exceptions; its error handling is return codes, which cannot be told
+    // from ordinary control flow without types. The other checks still apply.
+};
+const CSHARP = {
+    name: 'c#',
+    extensions: ['.cs'],
+    grammar: 'tree-sitter-c_sharp',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        bail: ['return_statement', 'throw_statement', 'break_statement', 'continue_statement'],
+        declaration: ['method_declaration', 'class_declaration', 'interface_declaration', 'record_declaration'],
+        block: ['block', 'declaration_list'],
+    },
+    envReads: (root) => envKeysFrom(root, /GetEnvironmentVariable/, ['invocation_expression']),
+    swallowedError: catchBased(['catch_clause'], 'body', CLIKE_LOG),
+};
+const PHP = {
+    name: 'php',
+    extensions: ['.php'],
+    grammar: 'tree-sitter-php',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        bail: ['return_statement', 'throw_expression', 'break_statement', 'continue_statement'],
+        declaration: ['function_definition', 'method_declaration', 'class_declaration'],
+        block: ['compound_statement'],
+    },
+    envReads: (root) => envKeysFrom(root, /getenv|\$_ENV/, ['function_call_expression', 'subscript_expression']),
+    swallowedError: catchBased(['catch_clause'], 'body', CLIKE_LOG),
+};
+const KOTLIN = {
+    name: 'kotlin',
+    extensions: ['.kt', '.kts'],
+    grammar: 'tree-sitter-kotlin',
+    nodes: {
+        ...COMMON_NODES,
+        identifier: ['simple_identifier'],
+        ifStatement: ['if_expression'],
+        bail: ['jump_expression'],
+        declaration: ['function_declaration', 'class_declaration', 'object_declaration'],
+        block: ['statements', 'block'],
+    },
+    envReads: (root) => envKeysFrom(root, /System\.getenv|getenv/, ['call_expression']),
+    swallowedError: catchBased(['catch_block'], undefined, /^(println|print|log|logger|Log)\b/),
+};
+/*
+ * Swift is deliberately absent.
+ *
+ * The pack was written and all of its checks passed — and then the process died
+ * every time, inside V8's background compilation of that grammar, with a signal no
+ * `try` can catch. It is not a bug in the rule: the grammar reliably takes the
+ * runtime down after the work is done.
+ *
+ * The rule this project holds to is that an unsupported language goes unreviewed and
+ * never crashes the run, so shipping a pack that kills the process would break the
+ * guarantee it exists to serve. Restore it when the grammar or the runtime changes;
+ * the definition is kept here so nobody rewrites it from scratch.
+ */
+const SWIFT_DISABLED = {
+    name: 'swift',
+    extensions: ['.swift'],
+    grammar: 'tree-sitter-swift',
+    nodes: {
+        ...COMMON_NODES,
+        identifier: ['simple_identifier'],
+        ifStatement: ['if_statement'],
+        bail: ['control_transfer_statement'],
+        declaration: ['function_declaration', 'class_declaration', 'protocol_declaration'],
+        block: ['statements', 'function_body'],
+    },
+    envReads: (root) => envKeysFrom(root, /ProcessInfo|environment/, ['call_expression', 'subscript_expression']),
+    swallowedError: catchBased(['catch_block'], undefined, /^(print|NSLog|os_log|logger)\b/),
+};
+const RUBY = {
+    name: 'ruby',
+    extensions: ['.rb', '.rake'],
+    grammar: 'tree-sitter-ruby',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if', 'if_modifier'],
+        ifCondition: 'condition',
+        ifBody: 'consequence',
+        bail: ['return', 'break', 'next'],
+        declaration: ['method', 'singleton_method', 'class', 'module'],
+        block: ['body_statement', 'do_block', 'block'],
+    },
+    envReads: (root) => envKeysFrom(root, /ENV/, ['element_reference', 'call']),
+    imports(root) {
+        const out = [];
+        for (const call of nodesOfType(root, ['call'])) {
+            const method = call.childForFieldName('method')?.text;
+            // require_relative always names this repository's own files
+            if (method !== 'require')
+                continue;
+            const literal = /["']([^"']+)["']/.exec(call.text);
+            if (literal?.[1])
+                out.push({ name: literal[1], node: call });
+        }
+        return out;
+    },
+    swallowedError(root) {
+        const out = [];
+        for (const rescue of nodesOfType(root, ['rescue'])) {
+            // a rescue holds its handler inline, so an empty one has no body_statement
+            if (hasComment(rescue))
+                continue;
+            const body = rescue.namedChildren.find((c) => c.type === 'body_statement' || c.type === 'then');
+            const statements = (body?.namedChildren ?? []).filter((c) => !COMMON_NODES.comment.includes(c.type));
+            if (statements.length === 0) {
+                out.push({ node: rescue, what: 'rescue block does nothing' });
+                continue;
+            }
+            if (statements.every((st) => /^(puts|print|p|log|logger|Rails\.logger)\b/.test(st.text.trim()))) {
+                out.push({ node: rescue, what: 'rescue block only logs' });
+            }
+        }
+        return out;
+    },
+};
+void SWIFT_DISABLED;
+const SOLIDITY = {
+    name: 'solidity',
+    extensions: ['.sol'],
+    grammar: 'tree-sitter-solidity',
+    nodes: {
+        ...COMMON_NODES,
+        ifStatement: ['if_statement'],
+        // revert and require are how a contract refuses, alongside plain return
+        bail: ['return_statement', 'revert_statement', 'break_statement', 'continue_statement'],
+        declaration: ['function_definition', 'contract_declaration', 'modifier_definition'],
+        block: ['block_statement', 'function_body', 'contract_body'],
+    },
+    swallowedError: catchBased(['catch_clause'], 'body', /^(emit|console\.log)/),
+};
+export const PACKS = [PYTHON, GO, JAVA, RUST, CPP, C, CSHARP, PHP, KOTLIN, RUBY, SOLIDITY];
+export function packFor(path) {
+    return PACKS.find((p) => p.extensions.some((e) => path.endsWith(e)));
+}
+let ready;
+const parsers = new Map();
+/**
+ * Measured, not guessed, and the measurement is worth writing down because the naive
+ * one is misleading. Loading grammars is cheap — all eleven load for ~143MB. Parsing
+ * with them is not: V8 tiers up each wasm module in the background, and RSS climbed
+ * 63 → 690MB across eleven before the process died inside that compilation. Six
+ * grammars sat at ~131MB and were comfortable.
+ */
+const MAX_GRAMMARS = 6;
+export const skippedLanguages = [];
+/**
+ * Grammars load lazily and once. A repository with no Python pays nothing for
+ * Python, and the wasm runtime is only initialised when a foreign file appears.
+ */
+async function parserFor(pack) {
+    const cached = parsers.get(pack.name);
+    if (cached)
+        return cached;
+    if (parsers.size >= MAX_GRAMMARS) {
+        if (!skippedLanguages.includes(pack.name))
+            skippedLanguages.push(pack.name);
+        return undefined;
+    }
+    try {
+        if (!ready) {
+            ready = (async () => {
+                const mod = (await import('web-tree-sitter'));
+                const Parser = (mod.default ?? mod);
+                await Parser.init();
+                return Parser;
+            })();
+        }
+        const Parser = await ready;
+        const require_ = createRequire(import.meta.url);
+        const wasmDir = join(dirname(require_.resolve('tree-sitter-wasms/package.json')), 'out');
+        const language = await Parser.Language.load(join(wasmDir, pack.grammar + '.wasm'));
+        const parser = new Parser();
+        parser.setLanguage(language);
+        parsers.set(pack.name, parser);
+        return parser;
+    }
+    catch {
+        // a missing grammar means this language is simply not reviewed — never a crash
+        return undefined;
+    }
+}
+export async function parse(pack, source) {
+    const parser = await parserFor(pack);
+    if (!parser)
+        return undefined;
+    try {
+        return parser.parse(source);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=packs.js.map

package/dist/lang/pyright.js

@@ -0,0 +1,108 @@
+import { execFileSync } from 'node:child_process';
+import { decode } from '#app/text.js';
+const HALLUCINATION_RULES = new Map([
+    ['reportAttributeAccessIssue', 'attribute does not exist on the type'],
+    ['reportCallIssue', 'call does not match the signature'],
+    ['reportArgumentType', 'argument type does not match the parameter'],
+    ['reportIndexIssue', 'type does not support this indexing'],
+    ['reportNoOverloadImplementation', 'no overload matches this call'],
+    ['reportRedeclaration', 'redeclared with a different type'],
+    ['reportUndefinedVariable', 'name is not defined'],
+]);
+/**
+ * Where pyright might be — on PATH, put there by whoever runs this.
+ *
+ * Deliberately not the reviewed repository's `node_modules`. Resolving it there let a
+ * repository supply the binary that reviews it, which is arbitrary code execution
+ * dressed as a dev dependency, and it happens before a single finding is reported.
+ */
+const CANDIDATES = [
+    { cmd: 'pyright', prefix: [] },
+    { cmd: 'basedpyright', prefix: [] },
+];
+let resolved;
+export function pyrightCommand(root) {
+    if (resolved !== undefined)
+        return resolved ?? undefined;
+    for (const candidate of CANDIDATES) {
+        try {
+            execFileSync(candidate.cmd, [...candidate.prefix, '--version'], {
+                cwd: root,
+                stdio: ['ignore', 'ignore', 'ignore'],
+                timeout: 30_000,
+            });
+            resolved = candidate;
+            return candidate;
+        }
+        catch {
+            // try the next place it could live
+        }
+    }
+    resolved = null;
+    return undefined;
+}
+export function pyrightAvailable(root) {
+    return pyrightCommand(root) !== undefined;
+}
+/**
+ * Run pyright over the given files and keep only the diagnostics that mean something
+ * was invented. Type-strictness complaints are deliberately not reported: a review
+ * that argues about optional-ness on every line is a review nobody reads.
+ */
+export function pyrightDiagnostics(root, files) {
+    if (files.length === 0)
+        return [];
+    const command = pyrightCommand(root);
+    if (!command)
+        return [];
+    let raw;
+    try {
+        raw = decode(execFileSync(command.cmd, [...command.prefix, '--outputjson', ...files], {
+            cwd: root,
+            maxBuffer: 64 * 1024 * 1024,
+            // pyright exits non-zero when it finds anything, which is the normal case
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 180_000,
+        }));
+    }
+    catch (e) {
+        const err = e;
+        // pyright exits non-zero whenever it finds something, which is the normal case and
+        // still writes its report. What is not normal is dying without one: killed by a
+        // signal, or out of time. Returning [] there would report "nothing found" about a
+        // checker that never looked, so it is raised and becomes a recorded failure.
+        // an empty Buffer is truthy, which is how the first attempt at this check missed
+        // the very case it was written for
+        if (!err.stdout || err.stdout.length === 0) {
+            throw new Error(err.signal
+                ? 'pyright was killed by ' + err.signal
+                : 'pyright could not run (' + (err.status ?? 'no exit code') + ')');
+        }
+        raw = decode(err.stdout);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const d of parsed.generalDiagnostics ?? []) {
+        if (d.severity !== 'error')
+            continue;
+        const meaning = d.rule ? HALLUCINATION_RULES.get(d.rule) : undefined;
+        if (!meaning || !d.file)
+            continue;
+        out.push({
+            file: d.file,
+            line: (d.range?.start?.line ?? 0) + 1,
+            column: (d.range?.start?.character ?? 0) + 1,
+            rule: d.rule ?? '',
+            message: (d.message ?? '').split('\n')[0] ?? '',
+            meaning,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=pyright.js.map