@cosmicdrift/kumiko-guards 0.388.0 → 0.390.0

package/src/guard-unsafe-array-param.ts

@@ -0,0 +1,110 @@
+#!/usr/bin/env bun
+/**
+ * Warns when a `.unsafe(sql, [...])` parameter list holds a JS array (or a spread).
+ *
+ * Bun.SQL binds a JS array parameter as "a,b" on Linux, so `ANY($n)` fails with a
+ * malformed array literal in CI while the same call passes on macOS. Pass
+ * `toPostgresArrayLiteral(values)` (from `@cosmicdrift/kumiko-framework/db`) and cast the
+ * placeholder (`$1::text[]`).
+ *
+ * Heuristic without type info: only array literals and spreads directly inside the
+ * parameter-list literal are reported; array-typed variables pass unnoticed. Warning only.
+ */
+
+import { readFileSync } from "node:fs";
+import { relative } from "node:path";
+import { Node, Project, type SourceFile, SyntaxKind } from "ts-morph";
+import {
+  type GuardViolation,
+  type RepoCheck,
+  reportResults,
+  runRepoChecks,
+} from "./_lib/guard-kit";
+import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
+
+const SCAN: ScanSpec = { scope: "source+tests", extensions: ["ts", "tsx"] };
+
+const UNSAFE_CALL_MARKER = ".unsafe";
+const UNSAFE_PARAMS_ARG_INDEX = 1;
+
+const FIX_HINT =
+  "pass toPostgresArrayLiteral(values) from @cosmicdrift/kumiko-framework/db and cast the placeholder, e.g. ANY($1::text[])";
+
+export type UnsafeArrayParamFinding = {
+  readonly line: number;
+  readonly message: string;
+};
+
+function unwrapExpression(node: Node): Node {
+  let current = node;
+  while (
+    Node.isAsExpression(current) ||
+    Node.isSatisfiesExpression(current) ||
+    Node.isParenthesizedExpression(current)
+  ) {
+    current = current.getExpression();
+  }
+  return current;
+}
+
+export function findUnsafeArrayParams(sf: SourceFile): UnsafeArrayParamFinding[] {
+  const findings: UnsafeArrayParamFinding[] = [];
+  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = call.getExpression();
+    if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "unsafe") continue;
+    const params = call.getArguments()[UNSAFE_PARAMS_ARG_INDEX];
+    if (params === undefined) continue;
+    const paramList = unwrapExpression(params);
+    if (!Node.isArrayLiteralExpression(paramList)) continue;
+    for (const element of paramList.getElements()) {
+      const value = unwrapExpression(element);
+      if (Node.isArrayLiteralExpression(value)) {
+        findings.push({
+          line: element.getStartLineNumber(),
+          message: `array literal as an unsafe() parameter binds as "a,b" on Linux; ${FIX_HINT}`,
+        });
+      } else if (Node.isSpreadElement(element)) {
+        findings.push({
+          line: element.getStartLineNumber(),
+          message: `spread in the unsafe() parameter list; if it feeds ANY($n), ${FIX_HINT}`,
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+export const check: RepoCheck = {
+  name: "Unsafe Array Param Guard",
+  hint:
+    "Bun.SQL binds a JS array parameter as 'a,b' on Linux (CI) but not on macOS. " +
+    "Use toPostgresArrayLiteral(values) with a $n::type[] cast in unsafe() calls.",
+  run(roots) {
+    const paths = scanFiles(SCAN, roots);
+    const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: true });
+    const warnings: GuardViolation[] = [];
+    for (const absPath of paths) {
+      const text = readFileSync(absPath, "utf-8");
+      if (!text.includes(UNSAFE_CALL_MARKER)) continue;
+      const sf = project.createSourceFile(absPath, text, { overwrite: true });
+      for (const finding of findUnsafeArrayParams(sf)) {
+        warnings.push({
+          file: relative(process.cwd(), absPath),
+          line: finding.line,
+          message: finding.message,
+        });
+      }
+    }
+    return {
+      violations: [],
+      warnings: warnings.length > 0 ? warnings : undefined,
+      matchedFiles: paths.length,
+      notApplicable: false,
+    };
+  },
+};
+
+if (import.meta.main) {
+  const failed = reportResults(await runRepoChecks([check]));
+  process.exit(failed > 0 ? 1 : 0);
+}

package/src/pre-push.sh

@@ -151,13 +151,25 @@ fi
 # canonical sibling path instead of this worktree — checking the wrong
 # code. Run the worktree-local check only when scripts/check-wt.sh is
 # tracked and executable (untracked/symlink stubs must not hijack push).
-# A check-wt.sh that wraps this hook sets KUMIKO_CHECK_WT=1 so it is not re-entered.
-if [ "${KUMIKO_CHECK_WT:-0}" != "1" ] \
+# Re-entry from the wrapping check-wt.sh is detected by process ancestry: the
+# hook records its own PID in KUMIKO_CHECK_WT_OWNER before delegating, so a
+# freely exported variable cannot skip the tracked check-wt.sh.
+is_reentry_from_check_wt() {
+  reentry_pid=$$
+  case "${KUMIKO_CHECK_WT_OWNER:-}" in '' | *[!0-9]*) return 1 ;; esac
+  while [ -n "$reentry_pid" ] && [ "$reentry_pid" -gt 1 ]; do
+    [ "$reentry_pid" = "$KUMIKO_CHECK_WT_OWNER" ] && return 0
+    reentry_pid=$(ps -o ppid= -p "$reentry_pid" 2>/dev/null | tr -d ' ')
+  done
+  return 1
+}
+
+if ! is_reentry_from_check_wt \
    && [ "$(git rev-parse --path-format=absolute --git-dir)" != "$GIT_COMMON_DIR" ] \
    && git -C "$REPO_ROOT" ls-files --error-unmatch scripts/check-wt.sh >/dev/null 2>&1 \
    && [ -x "$REPO_ROOT/scripts/check-wt.sh" ]; then
   echo "[pre-push] worktree detected — worktree check (see scripts/check-wt.sh)…"
-  cd "$REPO_ROOT" && exec "$REPO_ROOT/scripts/check-wt.sh"
+  cd "$REPO_ROOT" && KUMIKO_CHECK_WT_OWNER=$$ exec "$REPO_ROOT/scripts/check-wt.sh"
 fi
 
 # Runs a guard bin from the worktree's or the parent's node_modules/.bin

package/src/run-guards.ts

@@ -38,15 +38,19 @@ import { guard as i18nKeys } from "./guard-i18n-keys";
 import { guard as i18nLocaleMount } from "./guard-i18n-locale-mount";
 import { guard as i18nLocaleTerminology } from "./guard-i18n-locale-terminology";
 import { guard as importExtensions } from "./guard-import-extensions";
+import { guard as internalSubpathImports } from "./guard-internal-subpath-imports";
 import { guard as libTestCoverage } from "./guard-lib-test-coverage";
 import { guard as noDateApi } from "./guard-no-date-api";
 import { guard as noDirectFs } from "./guard-no-direct-fs";
 import { guard as noLogicInViews } from "./guard-no-logic-in-views";
 import { guard as noTemporalPolyfillImport } from "./guard-no-temporal-polyfill-import";
 import { guard as restrictedSymbols } from "./guard-restricted-symbols";
+import { guard as rlsSessionSettings } from "./guard-rls-session-settings";
 import { guard as screenConventions } from "./guard-screen-conventions";
 import { guard as silentSkip } from "./guard-silent-skip";
 import { guard as tenantEscalation } from "./guard-tenant-escalation";
+import { guard as testEsFixtures } from "./guard-test-es-fixtures";
+import { guard as testEsRowWrites } from "./guard-test-es-row-writes";
 import { guard as testTemplateDrift } from "./guard-test-template-drift";
 import { guard as testTimeouts } from "./guard-test-timeouts";
 import { guard as unsafeJsonParse } from "./guard-unsafe-json-parse";
@@ -66,6 +70,8 @@ export const GUARDS = [
   noDateApi,
   noTemporalPolyfillImport,
   restrictedSymbols,
+  internalSubpathImports,
+  rlsSessionSettings,
   fakeTests,
   noLogicInViews,
   errorReasons,
@@ -81,6 +87,8 @@ export const GUARDS = [
   appFeatureStructure,
   libTestCoverage,
   testTimeouts,
+  testEsFixtures,
+  testEsRowWrites,
   testTemplateDrift,
   fileSize,
   commentIssueRefOnly,

package/src/run-repo-checks.ts

@@ -15,8 +15,10 @@ import { check as noDirectProcessEnv } from "./guard-no-direct-process-env";
 import { check as primitivesDiscipline } from "./guard-primitives-discipline";
 import { check as rawSql } from "./guard-raw-sql";
 import { check as rendererBoundaries } from "./guard-renderer-boundaries";
+import { check as schemaCliFeatures } from "./guard-schema-cli-features";
 import { check as testStackDrift } from "./guard-test-stack-drift";
 import { check as thinWrappers } from "./guard-thin-wrappers";
+import { check as unsafeArrayParam } from "./guard-unsafe-array-param";
 import { check as upgradeState } from "./guard-upgrade-state";
 
 export const REPO_CHECKS = [
@@ -35,6 +37,8 @@ export const REPO_CHECKS = [
   agentDocsDrift,
   subpathExports,
   guardsDocDrift,
+  unsafeArrayParam,
+  schemaCliFeatures,
 ];
 
 export const REPO_CHECK_FLAGS: readonly string[] = ["--write-baseline"];