@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/clients/tree-sitter-client.js

@@ -24,11 +24,13 @@ import {
   vendoredGrammarRefusal,
   vendoredGrammarsDir
 } from "./grammar-source.js";
-import { resolvePackagePath } from "./package-root.js";
+import { getPackageRoot, resolvePackagePath } from "./package-root.js";
+import { resolveWebTreeSitterPackageDir } from "../scripts/lib/web-tree-sitter-dir.mjs";
 import {
   assertInstallAllowed,
   getProjectTrustGeneration
 } from "./project-trust.js";
+import { escapeRegExp } from "./string-utils.js";
 import { logTreeSitterDiagnostic } from "./tree-sitter-logger.js";
 import { notifyUserDegradation } from "./user-notify.js";
 const _require = createRequire(import.meta.url);
@@ -38,12 +40,34 @@ import {
   TreeCache
 } from "./tree-sitter-cache.js";
 import { TreeSitterNavigator } from "./tree-sitter-navigator.js";
+import {
+  isProvenSqlAlchemySessionReceiver,
+  isSafePsycopgIdentifierComposition,
+  isSqlAlchemyEntityQueryArgument,
+  isSqlAlchemyStatementArgument,
+  PYTHON_SQLALCHEMY_RECEIVER_NAMES,
+  PYTHON_SQLALCHEMY_STATEMENT_BUILDERS
+} from "./python-provenance.js";
 import {
   TreeSitterQueryLoader
 } from "./tree-sitter-query-loader.js";
 const TREE_SITTER_MAX_SCAN_FILES = 20000;
 const QUERY_BATCH_MAX_LOAD_FAILURES = 3;
 const NO_NESTED_ANCHOR_VISIT_CAP = 1e4;
+const PYTHON_SQL_SINK_METHODS = new Set([
+  "execute",
+  "executemany",
+  "query",
+  "raw"
+]);
+const TYPESCRIPT_SQL_KNOWN_PACKAGES = new Set([
+  "pg",
+  "mysql2",
+  "better-sqlite3",
+  "knex",
+  "@prisma/client"
+]);
+const TYPESCRIPT_SQL_IMPORTS = new WeakMap;
 const NOT_PARSED = { parsed: false };
 function createParserCounters() {
   return {
@@ -52,6 +76,21 @@ function createParserCounters() {
     parserFailures: 0
   };
 }
+function grammarWriteBlockedReason(dir) {
+  let probe = dir;
+  while (!fs.existsSync(probe)) {
+    const parent = path.dirname(probe);
+    if (parent === probe)
+      return "ENOENT";
+    probe = parent;
+  }
+  try {
+    fs.accessSync(probe, fs.constants.W_OK);
+    return;
+  } catch (err) {
+    return err?.code ?? "EACCES";
+  }
+}
 function grammarFileStamp(filePath) {
   try {
     const stat = fs.statSync(filePath);
@@ -60,7 +99,7 @@ function grammarFileStamp(filePath) {
     return;
   }
 }
-export function isTreeSitterWasmAbortError(error) {
+function isTreeSitterWasmAbortError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.includes("Aborted") || message.includes("abort()");
 }
@@ -157,6 +196,7 @@ export class TreeSitterClient {
     this.grammarDirResolutionDeps = grammarDirResolutionDeps ?? {
       resolveAsset: (asset) => this.resolveWebTreeSitterAsset(asset),
       resolvePackage: (specifier) => _require.resolve(specifier),
+      packageRoot: () => getPackageRoot(import.meta.url),
       cwd: () => process.cwd()
     };
     this.grammarsDir = this.findGrammarsDir();
@@ -240,20 +280,25 @@ export class TreeSitterClient {
       });
     }
   }
+  webTreeSitterPackageDir() {
+    return resolveWebTreeSitterPackageDir({
+      resolve: (specifier) => this.grammarDirResolutionDeps.resolvePackage(specifier),
+      packageRoot: () => this.grammarDirResolutionDeps.packageRoot(),
+      cwd: () => this.grammarDirResolutionDeps.cwd()
+    });
+  }
   resolveWebTreeSitterAsset(asset) {
     try {
-      const resolved = _require.resolve(`web-tree-sitter/${asset}`);
+      const resolved = this.grammarDirResolutionDeps.resolvePackage(`web-tree-sitter/${asset}`);
       if (fs.existsSync(resolved))
         return resolved;
     } catch {}
-    try {
-      const candidate = resolvePackagePath(import.meta.url, "node_modules", "web-tree-sitter", asset);
+    const pkgDir = this.webTreeSitterPackageDir();
+    if (pkgDir) {
+      const candidate = path.join(pkgDir, asset);
       if (fs.existsSync(candidate))
         return candidate;
-    } catch {}
-    const cwdCandidate = path.join(process.cwd(), "node_modules", "web-tree-sitter", asset);
-    if (fs.existsSync(cwdCandidate))
-      return cwdCandidate;
+    }
     return;
   }
   _bundledGrammarsDir;
@@ -403,16 +448,8 @@ export class TreeSitterClient {
     return "";
   }
   grammarsWriteDir() {
-    try {
-      let dir = path.dirname(_require.resolve("web-tree-sitter"));
-      while (path.basename(dir) !== "web-tree-sitter" && dir !== path.dirname(dir)) {
-        dir = path.dirname(dir);
-      }
-      if (path.basename(dir) === "web-tree-sitter") {
-        return path.join(dir, "grammars");
-      }
-    } catch {}
-    return;
+    const pkgDir = this.webTreeSitterPackageDir();
+    return pkgDir ? path.join(pkgDir, "grammars") : undefined;
   }
   async ensureGrammar(grammarFile) {
     if (this.resolveGrammarFile(grammarFile)) {
@@ -453,7 +490,7 @@ export class TreeSitterClient {
         return await this.fetchGrammar(grammarFile);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        this.recordGrammarFailure(grammarFile, `The runtime grammar fetch threw an unexpected error (${message}).`, true);
+        this.recordGrammarFailure(grammarFile, `The runtime grammar fetch threw an unexpected error (${message}).`, true, "download-failed");
         return false;
       }
     })();
@@ -473,7 +510,12 @@ export class TreeSitterClient {
     }
     const dir = this.grammarsDir && fs.existsSync(this.grammarsDir) ? this.grammarsDir : this.grammarsWriteDir();
     if (!dir) {
-      this.recordGrammarFailure(grammarFile, "No writable grammars directory could be located for the runtime fetch.", true);
+      this.recordGrammarFailure(grammarFile, "No grammars directory could be resolved for the runtime fetch: the web-tree-sitter package is not locatable from this runtime, from dm-lens's own package root, or from the working directory.", true, "write-dir-unresolvable");
+      return false;
+    }
+    const writeBlock = grammarWriteBlockedReason(dir);
+    if (writeBlock) {
+      this.recordGrammarFailure(grammarFile, `The grammars directory ${dir} cannot be written to (${writeBlock}), so the runtime fetch has nowhere to land.`, true, "write-dir-unwritable");
       return false;
     }
     const { ok, retryable, reason } = await downloadGrammarDetailed(dir, grammarFile);
@@ -490,16 +532,17 @@ export class TreeSitterClient {
         metadata: { grammarFile, outcome: "fetched" }
       });
     } else {
-      this.recordGrammarFailure(grammarFile, reason ?? "The package manager skipped install scripts and the runtime download failed.", retryable);
+      this.recordGrammarFailure(grammarFile, reason ?? "The package manager skipped install scripts and the runtime download failed.", retryable, "download-failed");
     }
     return ok;
   }
-  recordGrammarFailure(grammarFile, detail, retryable) {
+  recordGrammarFailure(grammarFile, detail, retryable, cause) {
     const attempts = (this.grammarFailureAttempts.get(grammarFile) ?? 0) + 1;
     this.grammarFailureAttempts.set(grammarFile, attempts);
     const retryDelayMs = retryable ? transientRetryDelayMs(attempts, "probe-timeout") : undefined;
     this.grammarRetryAtMs.set(grammarFile, retryDelayMs === undefined ? Number.POSITIVE_INFINITY : Date.now() + retryDelayMs);
-    const unavailable = retryable ? `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` + `module reports and structural rules for this language will be degraded. ` + `${detail} dm-lens will retry automatically in ${Math.round(retryDelayMs / 1000)}s; ` + `if the problem persists, allow the package manager's build scripts ` + `(pnpm approve-builds / bun trustedDependencies) or restore network access.` : `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` + `module reports and structural rules for this language will be degraded. ` + `${detail} The grammar source reports it does not exist (not a network problem), so this will not ` + `resolve on retry. Fix: reinstall with a manager that runs postinstall, allow its build scripts ` + `(pnpm approve-builds / bun trustedDependencies), or restore network access.`;
+    const remedy = cause === "write-dir-unresolvable" ? `This is a packaging/module-resolution fault, not a download problem: reinstall dm-lens so its ` + `web-tree-sitter dependency is present, or drop the wasm into dm-lens's own grammars/ directory.` : cause === "write-dir-unwritable" ? `This is a filesystem-permission fault, not a download problem: make that directory writable ` + `for the user dm-lens runs as, or reinstall dm-lens as that user.` : retryable ? `if the problem persists, allow the package manager's build scripts ` + `(pnpm approve-builds / bun trustedDependencies) or restore network access.` : `Fix: reinstall with a manager that runs postinstall, allow its build scripts ` + `(pnpm approve-builds / bun trustedDependencies), or restore network access.`;
+    const unavailable = `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` + `module reports and structural rules for this language will be degraded. ` + `${detail} ` + (retryable ? `dm-lens will retry automatically in ${Math.round(retryDelayMs / 1000)}s; ` : `The grammar source reports it does not exist (not a network problem), so this will not ` + `resolve on retry. `) + remedy;
     logTreeSitterDiagnostic({
       subsystem: "tree-sitter-client",
       message: unavailable,
@@ -508,7 +551,8 @@ export class TreeSitterClient {
         outcome: "unavailable",
         retryable,
         retryDelayMs,
-        attempts
+        attempts,
+        ...cause ? { cause } : {}
       }
     });
     incrementDegradationCount({
@@ -846,7 +890,8 @@ export class TreeSitterClient {
     const perQuery = new Map;
     await this.parseFileAndUse(filePath, languageId, contentOverride, (tree) => {
       try {
-        for (const match of batch.query.matches(tree.rootNode)) {
+        const rootNode = tree.rootNode;
+        for (const match of batch.query.matches(rootNode)) {
           const owner = batch.ownerOfPattern[match.patternIndex];
           if (owner === undefined)
             continue;
@@ -862,7 +907,7 @@ export class TreeSitterClient {
           }
           if (!this.evaluatePredicates(batch.query, match))
             continue;
-          if (entry.postFilter && !this.applyPostFilter(entry.postFilter, entry.postFilterParams, captures, tree.rootNode)) {
+          if (entry.postFilter && !this.applyPostFilter(entry.postFilter, entry.postFilterParams, captures, rootNode)) {
             continue;
           }
           if (match.captures.length === 0)
@@ -1158,12 +1203,7 @@ export class TreeSitterClient {
   }
   isLikelySqlAlchemyReceiver(text) {
     const tail = text.split(".").pop() ?? text;
-    return new Set([
-      "session",
-      "db_session",
-      "async_session",
-      "sync_session"
-    ]).has(tail.toLowerCase());
+    return PYTHON_SQLALCHEMY_RECEIVER_NAMES.has(tail.toLowerCase());
   }
   switchCaseBodyStatements(caseNode) {
     const named = (caseNode.children ?? []).filter((c) => c.isNamed && !c.type.includes("comment"));
@@ -1505,7 +1545,11 @@ export class TreeSitterClient {
       return false;
     const callee = node.children?.[0]?.text ?? "";
     const expression = node.text;
-    return ["select", "insert", "update", "delete"].some((name) => callee === name || expression.startsWith(`${name}(`));
+    for (const name of PYTHON_SQLALCHEMY_STATEMENT_BUILDERS) {
+      if (callee === name || expression.startsWith(`${name}(`))
+        return true;
+    }
+    return false;
   }
   applyPostFilter(postFilter, postFilterParams, captures, rootNode) {
     function extractSlots(classNode) {
@@ -1545,9 +1589,6 @@ export class TreeSitterClient {
       }
       return slots;
     }
-    function escapeRegExp(s) {
-      return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    }
     switch (postFilter) {
       case "no_nested_anchor_chain": {
         try {
@@ -2219,6 +2260,112 @@ export class TreeSitterClient {
       }
       case "ts_command_injection_sink":
         return captures.MOD?.text === "child_process" && /^(exec|execSync)$/.test(captures.FN?.text ?? "");
+      case "ts_sql_injection_sink": {
+        const template = captures.TEMPLATE?.text ?? "";
+        const rawPrefix = template.replace(/^`/, "").replace(/`$/, "").replace(/^(?:\s|\/\*[\s\S]*?\*\/|--[^\n]*(?:\n|$))*/, "");
+        if (/^(?:SELECT[\s\S]*(?:\bFROM\b|\$\{)|INSERT\s+INTO\b|UPDATE\s+[\s\S]*\bSET\b|DELETE\s+FROM\b|CREATE\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|DROP\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|ALTER\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|GRANT\b|REVOKE\b|WITH[\s\S]*\bSELECT\b|MERGE\s+INTO\b|TRUNCATE\s+TABLE\b|REPLACE\s+INTO\b)/i.test(rawPrefix))
+          return true;
+        if (!rootNode || !captures.OBJ)
+          return false;
+        let imported = TYPESCRIPT_SQL_IMPORTS.get(rootNode);
+        if (!imported) {
+          const names = new Set;
+          const stack = [rootNode];
+          while (stack.length > 0) {
+            const node = stack.pop();
+            if (!node)
+              continue;
+            if (node.type === "import_statement") {
+              const source = node.childForFieldName?.("source")?.text ?? "";
+              const packageName = source.replace(/^['"]|['"]$/g, "");
+              const isKnown = [...TYPESCRIPT_SQL_KNOWN_PACKAGES].some((pkg) => packageName === pkg || packageName.startsWith(`${pkg}/`));
+              if (isKnown) {
+                const importStack = [node];
+                while (importStack.length > 0) {
+                  const importNode = importStack.pop();
+                  if (!importNode)
+                    continue;
+                  if (importNode.type === "identifier" || importNode.type === "import_specifier") {
+                    names.add(importNode.text);
+                  }
+                  importStack.push(...importNode.children);
+                }
+              }
+            }
+            stack.push(...node.children);
+          }
+          const declarations = new Map;
+          const declarationStack = [rootNode];
+          while (declarationStack.length > 0) {
+            const node = declarationStack.pop();
+            if (!node)
+              continue;
+            if (node.type === "variable_declarator") {
+              const name = node.childForFieldName?.("name")?.text;
+              const value = node.childForFieldName?.("value");
+              if (name && value)
+                declarations.set(name, value);
+            }
+            declarationStack.push(...node.children);
+          }
+          const resolvesKnownValue = (node, seen = new Set) => {
+            if (node.type === "identifier") {
+              if (names.has(node.text))
+                return true;
+              if (seen.has(node.text))
+                return false;
+              const value = declarations.get(node.text);
+              if (!value)
+                return false;
+              seen.add(node.text);
+              return resolvesKnownValue(value, seen);
+            }
+            if (node.type === "await_expression") {
+              const value = node.children.find((child) => child.isNamed);
+              return value ? resolvesKnownValue(value, seen) : false;
+            }
+            if (node.type === "new_expression") {
+              const ctor = node.childForFieldName?.("constructor");
+              return ctor ? resolvesKnownValue(ctor, seen) : false;
+            }
+            if (node.type === "call_expression") {
+              const fn = node.childForFieldName?.("function");
+              return fn ? resolvesKnownValue(fn, seen) : false;
+            }
+            return false;
+          };
+          let changed = true;
+          while (changed) {
+            changed = false;
+            for (const [name, value] of declarations) {
+              if (!names.has(name) && resolvesKnownValue(value)) {
+                names.add(name);
+                changed = true;
+              }
+            }
+          }
+          imported = names;
+          TYPESCRIPT_SQL_IMPORTS.set(rootNode, imported);
+        }
+        const resolvesToKnownClient = (node) => {
+          if (node.type === "identifier")
+            return imported.has(node.text);
+          if (node.type === "await_expression") {
+            const value = node.children.find((child) => child.isNamed);
+            return value ? resolvesToKnownClient(value) : false;
+          }
+          if (node.type === "new_expression") {
+            const ctor = node.childForFieldName?.("constructor");
+            return ctor ? resolvesToKnownClient(ctor) : false;
+          }
+          if (node.type === "call_expression") {
+            const fn = node.childForFieldName?.("function");
+            return fn ? resolvesToKnownClient(fn) : false;
+          }
+          return false;
+        };
+        return resolvesToKnownClient(captures.OBJ);
+      }
       case "ts_ssrf_sink": {
         const fn = captures.FN?.text ?? "";
         const obj = captures.OBJ?.text ?? "";
@@ -2332,17 +2479,27 @@ export class TreeSitterClient {
         return /^(os|ioutil)$/.test(captures.PKG?.text ?? "") && /^(Open|OpenFile|ReadFile|WriteFile|Create|Remove|RemoveAll)$/.test(captures.FN?.text ?? "");
       case "py_sql_injection_sink": {
         const fn = captures.FN?.text ?? "";
-        if (!new Set(["execute", "executemany", "query", "raw"]).has(fn)) {
+        if (!PYTHON_SQL_SINK_METHODS.has(fn))
           return false;
-        }
         const sqlNode = captures.SQL;
-        const receiver = captures.OBJ?.text ?? "";
-        if (fn === "execute" && this.isLikelySqlAlchemyReceiver(receiver)) {
+        const receiver = captures.OBJ;
+        if (fn === "execute" && this.isLikelySqlAlchemyReceiver(receiver?.text ?? "")) {
           return false;
         }
         if (sqlNode && this.isSafeSqlAlchemyExpressionCall(sqlNode)) {
           return false;
         }
+        if (isProvenSqlAlchemySessionReceiver(receiver, rootNode)) {
+          if (fn === "query" && isSqlAlchemyEntityQueryArgument(sqlNode, rootNode)) {
+            return false;
+          }
+          if (fn === "execute" && isSqlAlchemyStatementArgument(sqlNode, rootNode)) {
+            return false;
+          }
+        }
+        if (isSafePsycopgIdentifierComposition(sqlNode, rootNode)) {
+          return false;
+        }
         return true;
       }
       case "go_sql_injection_sink":
@@ -2571,7 +2728,8 @@ export class TreeSitterClient {
     const matches = [];
     await this.parseFileAndUse(filePath, languageId, contentOverride, (tree) => {
       try {
-        const queryMatches = query.matches(tree.rootNode);
+        const rootNode = tree.rootNode;
+        const queryMatches = query.matches(rootNode);
         for (const match of queryMatches) {
           const captures = {};
           for (const capture of match.captures) {
@@ -2582,7 +2740,7 @@ export class TreeSitterClient {
           if (!this.evaluatePredicates(query, match)) {
             continue;
           }
-          if (postFilter && !this.applyPostFilter(postFilter, postFilterParams, captures, tree.rootNode)) {
+          if (postFilter && !this.applyPostFilter(postFilter, postFilterParams, captures, rootNode)) {
             continue;
           }
           if (match.captures.length > 0) {
@@ -2663,40 +2821,3 @@ export class TreeSitterClient {
     return mapping[languageId] || [];
   }
 }
-export function regexStructuralSearch(pattern, files, options = {}) {
-  const matches = [];
-  const maxResults = options.maxResults ?? 50;
-  const regexPattern = pattern.replace(/\\/g, "\\\\").replace(/\./g, "\\.").replace(/\$\$\$[A-Z_][A-Z0-9_]*/g, "(.*?)").replace(/\$[A-Z_][A-Z0-9_]*/g, "([^,)]+)");
-  try {
-    const regex = new RegExp(regexPattern, "g");
-    for (const file of files) {
-      if (matches.length >= maxResults)
-        break;
-      try {
-        const content = fs.readFileSync(file, "utf-8");
-        const lines = content.split(`
-`);
-        for (let i = 0;i < lines.length; i++) {
-          regex.lastIndex = 0;
-          const match = regex.exec(lines[i]);
-          if (match) {
-            const captures = {};
-            for (let j = 1;j < match.length; j++) {
-              captures[`$${j}`] = match[j];
-            }
-            matches.push({
-              file,
-              line: i + 1,
-              column: match.index + 1,
-              matchedText: match[0],
-              captures
-            });
-            if (matches.length >= maxResults)
-              break;
-          }
-        }
-      } catch {}
-    }
-  } catch {}
-  return matches;
-}