@duckmind/dm-linux-x64 0.63.9 → 0.64.6

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-dom-node-append.yml

@@ -0,0 +1,8 @@
+id: prefer-dom-node-append
+language: TypeScript
+severity: hint
+message: "Use .append() instead of .appendChild() — accepts multiple nodes and strings"
+note: |
+  .append() is the modern API that accepts DOMStrings and multiple args at once.
+rule:
+  pattern: "$EL.appendChild($CHILD)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-dom-node-text-content-js.yml

@@ -0,0 +1,8 @@
+id: prefer-dom-node-text-content-js
+language: JavaScript
+severity: warning
+message: "Use .textContent instead of .innerText — innerText triggers a layout reflow"
+note: |
+  .innerText forces a layout calculation. .textContent is faster for plain text reads.
+rule:
+  pattern: "$EL.innerText"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-dom-node-text-content.yml

@@ -0,0 +1,8 @@
+id: prefer-dom-node-text-content
+language: TypeScript
+severity: warning
+message: "Use .textContent instead of .innerText — innerText triggers a layout reflow"
+note: |
+  .innerText forces a layout calculation. .textContent is faster for plain text reads.
+rule:
+  pattern: "$EL.innerText"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-keyboard-event-key-js.yml

@@ -0,0 +1,10 @@
+id: prefer-keyboard-event-key-js
+language: JavaScript
+severity: warning
+message: "Use event.key instead of event.keyCode/.which — keyCode is deprecated"
+note: |
+  keyCode and which are deprecated. Use the string-based .key property.
+rule:
+  any:
+    - pattern: "$EVT.keyCode"
+    - pattern: "$EVT.which"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-keyboard-event-key.yml

@@ -0,0 +1,10 @@
+id: prefer-keyboard-event-key
+language: TypeScript
+severity: warning
+message: "Use event.key instead of event.keyCode/.which — keyCode is deprecated"
+note: |
+  keyCode and which are deprecated. Use the string-based .key property.
+rule:
+  any:
+    - pattern: "$EVT.keyCode"
+    - pattern: "$EVT.which"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-math-min-max-js.yml

@@ -0,0 +1,12 @@
+id: prefer-math-min-max-js
+language: JavaScript
+severity: hint
+message: "Use Math.min()/Math.max() instead of ternary for min/max"
+note: |
+  a > b ? a : b is Math.max(a, b). More readable and intent is clearer.
+rule:
+  any:
+    - pattern: "$A > $B ? $A : $B"
+    - pattern: "$A >= $B ? $A : $B"
+    - pattern: "$A < $B ? $A : $B"
+    - pattern: "$A <= $B ? $A : $B"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-math-min-max.yml

@@ -0,0 +1,12 @@
+id: prefer-math-min-max
+language: TypeScript
+severity: hint
+message: "Use Math.min()/Math.max() instead of ternary for min/max"
+note: |
+  a > b ? a : b is Math.max(a, b). More readable and intent is clearer.
+rule:
+  any:
+    - pattern: "$A > $B ? $A : $B"
+    - pattern: "$A >= $B ? $A : $B"
+    - pattern: "$A < $B ? $A : $B"
+    - pattern: "$A <= $B ? $A : $B"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-number-properties-js.yml

@@ -0,0 +1,10 @@
+id: prefer-number-properties-js
+language: JavaScript
+severity: warning
+message: "Use Number.isNaN()/Number.isFinite() instead of global isNaN()/isFinite()"
+note: |
+  Global isNaN() coerces its argument first. Number.isNaN(x) returns true only for NaN.
+rule:
+  any:
+    - pattern: "isNaN($$$ARGS)"
+    - pattern: "isFinite($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-number-properties.yml

@@ -0,0 +1,10 @@
+id: prefer-number-properties
+language: TypeScript
+severity: warning
+message: "Use Number.isNaN()/Number.isFinite() instead of global isNaN()/isFinite()"
+note: |
+  Global isNaN() coerces its argument first. Number.isNaN(x) returns true only for NaN.
+rule:
+  any:
+    - pattern: "isNaN($$$ARGS)"
+    - pattern: "isFinite($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-optional-chain.yml

@@ -0,0 +1,14 @@
+id: prefer-optional-chain
+language: TypeScript
+message: "Use optional chaining '?.' instead of logical AND for null checks"
+severity: hint
+note: |
+  Optional chaining provides more concise and safer access to deeply
+  nested properties. Instead of foo && foo.bar, use foo?.bar.
+rule:
+  any:
+    - pattern: $X && $X.$Y
+    - pattern: $X !== null && $X !== undefined && $X.$Y
+    - pattern: $X != null && $X.$Y
+  not:
+    pattern: $X && $X.$Y && $$$

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-prototype-methods-js.yml

@@ -0,0 +1,8 @@
+id: prefer-prototype-methods-js
+language: JavaScript
+severity: warning
+message: "Use Object.hasOwn() instead of .hasOwnProperty()"
+note: |
+  .hasOwnProperty can be shadowed. Object.hasOwn(obj, key) is safe.
+rule:
+  pattern: "$OBJ.hasOwnProperty($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-prototype-methods.yml

@@ -0,0 +1,8 @@
+id: prefer-prototype-methods
+language: TypeScript
+severity: warning
+message: "Use Object.hasOwn() instead of .hasOwnProperty()"
+note: |
+  .hasOwnProperty can be shadowed. Object.hasOwn(obj, key) is safe.
+rule:
+  pattern: "$OBJ.hasOwnProperty($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-query-selector-js.yml

@@ -0,0 +1,11 @@
+id: prefer-query-selector-js
+language: JavaScript
+severity: hint
+message: "Use document.querySelector() instead of getElementById/getElementsByClassName"
+note: |
+  querySelector/querySelectorAll is the modern unified DOM selection API.
+rule:
+  any:
+    - pattern: "document.getElementById($$$ARGS)"
+    - pattern: "document.getElementsByClassName($$$ARGS)"
+    - pattern: "document.getElementsByTagName($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-query-selector.yml

@@ -0,0 +1,11 @@
+id: prefer-query-selector
+language: TypeScript
+severity: hint
+message: "Use document.querySelector() instead of getElementById/getElementsByClassName"
+note: |
+  querySelector/querySelectorAll is the modern unified DOM selection API.
+rule:
+  any:
+    - pattern: "document.getElementById($$$ARGS)"
+    - pattern: "document.getElementsByClassName($$$ARGS)"
+    - pattern: "document.getElementsByTagName($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-is-empty.yml

@@ -0,0 +1,11 @@
+id: prefer-string-is-empty
+language: java
+severity: warning
+message: Use .isEmpty() instead of .length() == 0 or .equals("").
+note: Ported from VTCode (https://github.com/vinhnx/VTCode), refs #2195. The receiver's type is not checked, so this rule is detection-only. Detection is limited to the exact empty-string and zero-length forms.
+rule:
+  any:
+    - pattern: $S.length() == 0
+    - pattern: $S.equals("")
+files:
+  - "**/*.java"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-slice-js.yml

@@ -0,0 +1,10 @@
+id: prefer-string-slice-js
+language: JavaScript
+severity: hint
+message: "Use .slice() instead of .substring()/.substr()"
+note: |
+  .substring() has confusing behavior with negative arguments. .slice() is consistent.
+rule:
+  any:
+    - pattern: "$STR.substring($$$ARGS)"
+    - pattern: "$STR.substr($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-slice.yml

@@ -0,0 +1,10 @@
+id: prefer-string-slice
+language: TypeScript
+severity: hint
+message: "Use .slice() instead of .substring()/.substr()"
+note: |
+  .substring() has confusing behavior with negative arguments. .slice() is consistent.
+rule:
+  any:
+    - pattern: "$STR.substring($$$ARGS)"
+    - pattern: "$STR.substr($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-starts-ends-with-js.yml

@@ -0,0 +1,10 @@
+id: prefer-string-starts-ends-with-js
+language: JavaScript
+severity: warning
+message: "Use .startsWith()/.endsWith() instead of indexOf for prefix/suffix checks"
+note: |
+  str.indexOf(sub) === 0 should be str.startsWith(sub). Clearer intent.
+rule:
+  any:
+    - pattern: "$STR.indexOf($SUB) === 0"
+    - pattern: "$STR.indexOf($SUB) == 0"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-starts-ends-with.yml

@@ -0,0 +1,10 @@
+id: prefer-string-starts-ends-with
+language: TypeScript
+severity: warning
+message: "Use .startsWith()/.endsWith() instead of indexOf for prefix/suffix checks"
+note: |
+  str.indexOf(sub) === 0 should be str.startsWith(sub). Clearer intent.
+rule:
+  any:
+    - pattern: "$STR.indexOf($SUB) === 0"
+    - pattern: "$STR.indexOf($SUB) == 0"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-trim-start-end-js.yml

@@ -0,0 +1,10 @@
+id: prefer-string-trim-start-end-js
+language: JavaScript
+severity: hint
+message: "Use .trimStart()/.trimEnd() instead of .trimLeft()/.trimRight()"
+note: |
+  trimLeft/trimRight are non-standard aliases. Use the ECMA standard trimStart/trimEnd.
+rule:
+  any:
+    - pattern: "$STR.trimLeft()"
+    - pattern: "$STR.trimRight()"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-string-trim-start-end.yml

@@ -0,0 +1,10 @@
+id: prefer-string-trim-start-end
+language: TypeScript
+severity: hint
+message: "Use .trimStart()/.trimEnd() instead of .trimLeft()/.trimRight()"
+note: |
+  trimLeft/trimRight are non-standard aliases. Use the ECMA standard trimStart/trimEnd.
+rule:
+  any:
+    - pattern: "$STR.trimLeft()"
+    - pattern: "$STR.trimRight()"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-structured-clone-js.yml

@@ -0,0 +1,9 @@
+id: prefer-structured-clone-js
+language: JavaScript
+severity: warning
+message: "Use structuredClone() instead of JSON.parse(JSON.stringify()) for deep cloning"
+note: |
+  JSON round-tripping loses undefined, Date objects, and circular refs.
+  structuredClone() handles all of these correctly.
+rule:
+  pattern: "JSON.parse(JSON.stringify($$$ARGS))"

package/extensions/dm-lens/rules/ast-grep-rules/rules/prefer-structured-clone.yml

@@ -0,0 +1,9 @@
+id: prefer-structured-clone
+language: TypeScript
+severity: warning
+message: "Use structuredClone() instead of JSON.parse(JSON.stringify()) for deep cloning"
+note: |
+  JSON round-tripping loses undefined, Date objects, and circular refs.
+  structuredClone() handles all of these correctly.
+rule:
+  pattern: "JSON.parse(JSON.stringify($$$ARGS))"

package/extensions/dm-lens/rules/ast-grep-rules/rules/python-optional-type.yml

@@ -0,0 +1,22 @@
+id: python-optional-type
+language: Python
+severity: hint
+message: "Optional[T] requires Python 3.10+ to rewrite as T | None"
+note: |
+  `Optional[T]` can be written as `T | None` on Python 3.10 and later.
+  A CPython 3.11 stdlib census found 1,675 matches and zero defects, so this
+  remains a modernization hint rather than a warning about incorrect code.
+  This rule is detection-only because the target project's Python version is
+  not available to a syntax-only matcher. Do not apply the rewrite to Python
+  3.8 or 3.9 code.
+rule:
+  kind: type
+  regex: '^(Optional|typing\.Optional|t\.Optional)\['
+has_fix: false
+tags:
+  - python
+  - typing
+  - modernization
+examples:
+  bad: "value: Optional[str]"
+  good: "value: str | None"

package/extensions/dm-lens/rules/ast-grep-rules/rules/redos-nested-quantifier.yml

@@ -0,0 +1,23 @@
+id: redos-nested-quantifier
+language: TypeScript
+severity: warning
+message: "Nested unbounded quantifier in regex — risks catastrophic backtracking (ReDoS)"
+metadata:
+  category: security
+note: |
+  A single quantified atom nested inside another repetition — e.g. (a+)+ , (a*)* ,
+  ([a-z]+)* , (\d+){2,} — can match the same input in exponentially many ways, so a
+  crafted string causes catastrophic backtracking (CWE-1333, ReDoS). This fires
+  only when BOTH the inner and outer quantifier are unbounded (+, *, or {n,}) AND
+  the group body is just that one atom. Bounded quantifiers like {2,3}, and groups
+  with a mandatory prefix that makes the partition unique (e.g. (ba+)+ ,
+  (-[a-z0-9]+){3,} ), are not flagged.
+
+  Fix: use a bounded quantifier ({1,N}), rewrite so the inner group has only one
+  way to match (e.g. (ba+)+ is fine), use a negated character class instead of .
+  ([^_]*_.* instead of .*_.*), or mimic an atomic group: ((?=(a+))\2)+ . For
+  untrusted input, prefer a non-backtracking engine (RE2 / node-re2) or solve it
+  without a regex.
+rule:
+  kind: regex_pattern
+  regex: '\((?:\?:)?(?:\[(?:[^\]\\]|\\.)*\]|\\.|[^\\()\[\]{}*+?|])(?:[*+]|\{\d+,\})\)+(?:[*+]|\{\d+,\})'

package/extensions/dm-lens/rules/ast-grep-rules/rules/reducible-list-comprehension.yml

@@ -0,0 +1,29 @@
+id: reducible-list-comprehension
+language: Python
+severity: warning
+message: "A list comprehension is unnecessary here; use a generator expression"
+note: |
+  `any`, `all`, and `sum` consume iterables directly, so the list allocation
+  can be removed without changing the operation's result. The generator
+  expression can short-circuit, so evaluation counts differ; apply this fix
+  only when the element expression is side-effect-free.
+rule:
+  pattern: $FN([$X for $Y in $Z])
+  not:
+    any:
+      - pattern: $FN([$X async for $Y in $Z])
+      - pattern: $FN([await $X for $Y in $Z])
+      - has:
+          pattern: await $$$
+          stopBy: end
+constraints:
+  FN:
+    regex: "^(any|all|sum)$"
+fix: "$FN($X for $Y in $Z)"
+tags:
+  - python
+  - performance
+  - modernization
+examples:
+  bad: "total = sum([price for price in prices])"
+  good: "total = sum(price for price in prices)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/redundant-state.yml

@@ -0,0 +1,16 @@
+id: redundant-state
+language: TypeScript
+message: "Redundant state — '$NAME' is only used to return it, inline the value"
+severity: warning
+note: |
+  const $NAME = $VALUE; return $NAME; is redundant.
+  Inline: return $VALUE; directly.
+  Grade 2.1 — low complexity, easy fix.
+rule:
+  all:
+    - pattern: return $NAME
+    - follows:
+        pattern: const $NAME = $VALUE
+        strict: true
+fix: |
+  return $VALUE;

package/extensions/dm-lens/rules/ast-grep-rules/rules/redundant-unsafe-function.yml

@@ -0,0 +1,53 @@
+id: redundant-unsafe-function
+language: Rust
+severity: error
+message: Unsafe function without unsafe block inside
+note: |
+  A function marked `unsafe` advertises that the body contains operations the
+  compiler cannot verify as safe. If the body has no `unsafe` block, either
+  the marker is unnecessary (the function performs no unsafe operations and
+  the `unsafe` keyword should be removed) or it is misplaced (an unsafe
+  operation lives outside an `unsafe { … }` block and should be wrapped).
+  Either case warrants review.
+
+  Exempt when a `/// # Safety` doc-comment section precedes the function:
+  Rust's own convention (rustdoc's `missing_safety_doc` lint, and
+  clippy's `undocumented_unsafe_blocks`) is that an `unsafe fn` states
+  its caller obligations in a `# Safety` doc section instead of wrapping
+  its whole body in a redundant `unsafe { ... }` block — the function
+  signature IS the unsafe boundary, the doc section is where the
+  contract lives.
+
+  2026-08-20 (review round, refs #1806): the first ship of this valve
+  used `follows: {stopBy: end, kind: line_comment, regex: '#\s*Safety'}`,
+  copying the `SAFETY:`-comment shape from `no-chained-type-assertions`
+  too literally. `stopBy: end` scans EVERY preceding sibling all the way
+  to the top of the file — one `# Safety` comment ANYWHERE earlier
+  (a stray file-top note, or a doc block that belongs to a DIFFERENT,
+  earlier function) exempted every `unsafe fn` after it. Probe: a
+  documented function followed by two undocumented ones scored 0 hits;
+  the two alone scored 2. Fixed by bounding the backward scan with
+  `stopBy: {not: {kind: line_comment}}` — it stops at the first
+  non-comment sibling, so only the CONTIGUOUS run of `///`/`//` lines
+  directly above the function is searched, never an earlier function's
+  doc block or an unrelated comment further up the file. (This valve
+  shipped with zero corpus hits either side in the original PR —
+  corpus silence isn't proof of correctness; the fixtures below are
+  the whole evidence, deliberately adversarial.)
+rule:
+  all:
+    - kind: function_item
+    - has:
+        kind: function_modifiers
+        regex: "^unsafe"
+    - not:
+        has:
+          kind: unsafe_block
+          stopBy: end
+    - not:
+        follows:
+          stopBy:
+            not:
+              kind: line_comment
+          kind: line_comment
+          regex: '#\s*Safety'

package/extensions/dm-lens/rules/ast-grep-rules/rules/redundant-usestate-type.yml

@@ -0,0 +1,15 @@
+id: redundant-usestate-type
+language: Tsx
+severity: info
+message: "`useState<TYPE>(...)` where TYPE is a primitive redundant — TS can infer it from the initial value"
+note: |
+  `useState<number>(0)`, `useState<string>('')`, `useState<boolean>(false)` are
+  all redundant — TS can infer the state type from the initial value. Drop
+  the explicit type argument.
+rule:
+  any:
+    - pattern: useState<$T>($A)
+constraints:
+  T:
+    regex: "^(number|string|boolean)$"
+fix: useState($A)

package/extensions/dm-lens/rules/ast-grep-rules/rules/require-await.yml

@@ -0,0 +1,14 @@
+id: require-await
+language: TypeScript
+message: "Async function has no 'await' expression — consider removing 'async' keyword"
+severity: warning
+note: |
+  An async function without await does not benefit from being async.
+  Remove the async keyword or add await expressions inside the function.
+rule:
+  all:
+    - pattern: async function $NAME($$$PARAMS) { $$$BODY }
+    - not:
+        has:
+          pattern: await $$$
+          stopBy: end

package/extensions/dm-lens/rules/ast-grep-rules/rules/require-safety-comment-for-as-unknown-as.yml

@@ -0,0 +1,184 @@
+id: require-safety-comment-for-as-unknown-as
+language: TypeScript
+severity: error
+metadata:
+  category: dm-lens-self-scan
+message: "'x as unknown as T' with no nearby SAFETY: comment — state the invariant TypeScript can't check"
+note: |
+  Narrowed port of dmmulroy/anti-slop's
+  `require-safety-comment-for-type-assertion`
+  (src/rules/require-safety-comment-for-type-assertion.ts, MIT).
+  Upstream requires a `SAFETY:` comment before EVERY non-const type
+  assertion (`as`/angle-bracket), walking up through statement-owner
+  node kinds looking for a preceding comment. This port narrows the
+  target to `x as unknown as T` specifically — the two-hop cast through
+  `unknown`. The 2026-08-19 audit found 2,180 non-const assertions
+  repo-wide and ZERO `SAFETY:` comments; requiring one on every
+  assertion would mean authoring ~1,750 comments in one PR. `as unknown
+  as` is the form that actually launders evidence (routes through the
+  top type rather than a single verifiable hop), and it is the exact
+  shape AGENTS.md's defect shape 13 already asks for in prose: "when a
+  call site hands the policy an outcome it did NOT derive... justify it
+  in a comment at the call site." This rule makes that convention
+  checkable for its most evidence-destroying form.
+
+  2026-08-20 (refs #1727, #1777): promoted `hint` -> `error`. `error` is
+  the only tier that maps to semantic `blocking`
+  (`clients/dispatch/runners/ast-grep-napi.ts`), so AGENTS.md's severity
+  policy requires a documented zero-false-positive audit here. Two
+  changes make that audit come out clean.
+
+  1. STRUCTURAL SCOPING: test paths are excluded (`ignores:` below). In a
+     test, `x as unknown as T` is almost always a partial test double —
+     reaching into a private field or stubbing the two methods of a
+     surface the subject actually calls. The "invariant TypeScript can't
+     check" there is "this stub covers what the code under test touches",
+     which is the test's own subject matter, not a hidden runtime claim.
+     Four-corpus census (2026-08-20) confirms the shape concentrates in
+     test paths rather than assuming it:
+
+     | corpus | total | test-path | non-test | suppressed |
+     |---|---:|---:|---:|---:|
+     | dm-lens (`clients/`+`tests/`) | 305 | 289 | 16 | 95% |
+     | pi core (`packages/`) | 182 | 155 | 27 | 85% |
+     | opencode (`packages/`) | 194 | 154 | 40 | 79% |
+     | oh-my-pi (`packages/`) | 1803 | 1644 | 159 | 91% |
+
+     This is a FALSE-NEGATIVE bias, deliberately, and it is not small:
+     289 uncommented `as unknown as` sites in dm-lens's own `tests/`
+     now raise NO diagnostic at all, where each previously raised an
+     `error` through `no-chained-type-assertions.yml`'s `unknown` arm.
+     The same trade costs 1,644 sites on oh-my-pi. It is a path glob,
+     not a semantic check — ast-grep cannot verify a cast is really a
+     test double, only that it lives under a test path.
+
+  2. REPO-SIDE REMEDIATION: the 16 remaining `clients/` sites were read
+     individually and each was given a truthful `SAFETY:` comment
+     naming the specific invariant (an optional Node API absent from
+     `@types/node`, a two-phase-init field filled before first read, a
+     `Object.fromEntries` key-type loss, a process-global stash). None
+     was a comment written to silence the rule; where the cast had no
+     justification it was replaced instead
+     (`clients/runtime-context.ts`).
+
+  Post-narrowing census on dm-lens: 0 findings over `clients/` +
+  `tests/`. The rule is tagged `metadata.category: dm-lens-self-scan`,
+  so CI's `npm run astgrep:self-scan` lane keeps it at zero.
+
+  Placement contract: a `SAFETY:` comment may directly precede the cast,
+  its enclosing statement, or an object-literal member (`pair`) containing
+  the cast. Array elements and call arguments are also supported through the
+  direct-cast arm when the comment is immediately above the cast expression.
+  JSX attributes, class static blocks, and switch cases are not comment
+  anchors for this valve; place those comments on the enclosing statement.
+  Inline comments remain valid, for example `/* SAFETY: ... */ x as unknown
+  as T`. Upstream walks an arbitrary number of statement-owner levels looking
+  for ANY preceding comment in the file; this port only checks one level up
+  from the assertion and one level up from its immediate containing
+  statement or supported object member. There is NO dominance verification:
+  the rule proves a comment is adjacent, never that the comment is true or
+  that it describes this cast.
+
+  2026-08-20 (#1847, found in #1843's review): the "one level up from
+  its immediate containing statement" kind list omitted
+  `export_statement` and `public_field_definition`, so a `SAFETY:`
+  comment placed directly above an exported cast (`export const b =
+  (x as unknown as T).y;`) or a class-field cast (`bar: unknown = (x as
+  unknown as T).y;`) could not satisfy the valve — the rule is
+  `error`-tier and semantically `blocking`, so this left no escape for
+  those two shapes. Added both kinds. Verified the containing-statement
+  walk already covers casts nested deeper without a new kind: a cast
+  inside a `static {}` init block or an arrow-function body still
+  resolves to an ancestor `lexical_declaration`/`variable_declaration`
+  already in the list (probed with ast-grep's own `--rule` scan, not
+  reasoning about the grammar from memory), and a `SAFETY:` comment on
+  an `export const` nested inside a `namespace` block clears the valve
+  through the same `export_statement` kind — `stopBy: end` already
+  walks past the namespace wrapper to find it. `readonly`/`abstract`/
+  `static`/private-`#name` class fields all parse to the same
+  `public_field_definition` kind, so one entry covers all of them.
+
+  2026-08-20 (#1852 review, F1): the same defect shape one more time —
+  an enum member's initializer cast (`enum Foo { A = (x as unknown as
+  T).y }`) has no recognized ancestor either. The member's own kind is
+  `enum_assignment` (probed the same way: `ast-grep scan --rule` against
+  a real `enum`/`const enum`/`export enum` snippet rather than guessing
+  from the export/field precedent). One `enum_assignment` kind entry
+  covers plain, `const`, and `export` enums alike, the same way
+  `public_field_definition` covered every class-field modifier —
+  `enum_assignment` is the member-list node itself, unaffected by
+  keywords on the enclosing `enum_declaration`. `declare enum` members
+  have no initializer expression to cast, so there is nothing to probe
+  there.
+
+  Matched pair with `no-chained-type-assertions.yml`. As of 2026-08-20
+  the two PARTITION the assertion space instead of overlapping: this
+  rule owns `x as unknown as T` (with the `SAFETY:` escape valve); that
+  rule owns the concrete `x as A as B` chain, which has no escape valve
+  because it has no legitimate reading. Before the split both rules
+  matched the identical `as unknown as` site list (verified: 16/16
+  dm-lens, 182/182 pi, 194/194 opencode), so every uncommented site
+  raised two diagnostics for one defect.
+
+  2026-08-20 (#1834): both `follows` checks used `stopBy: end`, which
+  scans EVERY preceding sibling all the way to the top of the enclosing
+  block, not just the comment directly above the cast. A `SAFETY:`
+  comment attached to one cast silently exempted every LATER cast in the
+  same block, including casts on a different subject with no
+  justification of their own. Probe: `// SAFETY: ...` above `const a =
+  (y as unknown as string).length` followed by an undocumented `const b
+  = (x as unknown as string).length` scored 0 hits; `b`'s cast should
+  have been flagged. Fixed the same way as `redundant-unsafe-function`'s
+  identical valve (PR #1821, refs #1806): bound the backward scan with
+  `stopBy: {not: {kind: comment}}`, so it stops at the first non-comment
+  sibling and only ever searches the CONTIGUOUS comment run directly
+  above the cast (or its containing statement), never an earlier
+  statement's comment. The "Scope and known gap" note above already
+  described this contiguous-comment intent; the shipped pattern didn't
+  implement it.
+
+  2026-08-20 (#1870): the pair arm is bounded by the nearest `pair`. An
+  outer object member's SAFETY comment must not suppress a cast in a nested
+  member, and a nested member's comment must not suppress a parent cast.
+  The direct-cast arm remains the precise escape valve for comments adjacent
+  to casts in array elements and call arguments.
+ignores:
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.test.mts"
+  - "**/*.test.cts"
+  - "**/*.spec.ts"
+  - "**/*.spec.tsx"
+  - "**/tests/**"
+  - "**/test/**"
+  - "**/__tests__/**"
+rule:
+  pattern: $X as unknown as $Y
+  not:
+    any:
+      - follows:
+          kind: comment
+          regex: 'SAFETY\s*:'
+          stopBy: { not: { kind: comment } }
+      - inside:
+          stopBy: { kind: pair }
+          any:
+            - kind: pair
+          follows:
+            kind: comment
+            regex: 'SAFETY\s*:'
+            stopBy: { not: { kind: comment } }
+      - inside:
+          stopBy: end
+          any:
+            - kind: expression_statement
+            - kind: lexical_declaration
+            - kind: variable_declaration
+            - kind: return_statement
+            - kind: export_statement
+            - kind: public_field_definition
+            - kind: enum_assignment
+          follows:
+            kind: comment
+            regex: 'SAFETY\s*:'
+            stopBy: { not: { kind: comment } }