@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/dist/clients/tree-sitter-client.js

@@ -0,0 +1,2787 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { getDegradationLedgerGeneration, incrementDegradationCount, recordDegradation, recordDegradationOnce } from "./degradation-ledger.js";
+import { BoundedFifoMap } from "./bounded-cache.js";
+import { loadWebTreeSitter } from "./deps/web-tree-sitter.js";
+import { transientRetryDelayMs } from "./dispatch/runners/utils/availability-policy.js";
+import { getProjectIgnoreMatcher, isExcludedDirName } from "./file-utils.js";
+import { downloadGrammarDetailed, fileHasWasmMagic, grammarBlockReason, grammarFileSha256, isVendoredGrammar, LANGUAGE_TO_GRAMMAR, pinnedGrammarHash, vendoredGrammarRefusal, vendoredGrammarsDir } from "./grammar-source.js";
+import { getPackageRoot, resolvePackagePath } from "./package-root.js";
+import { resolveWebTreeSitterPackageDir } from "../scripts/lib/web-tree-sitter-dir.mjs";
+import { assertInstallAllowed, getProjectTrustGeneration } from "./project-trust.js";
+import { escapeRegExp } from "./string-utils.js";
+import { logTreeSitterDiagnostic } from "./tree-sitter-logger.js";
+import { notifyUserDegradation } from "./user-notify.js";
+const _require = createRequire(import.meta.url);
+import { createTreeCacheCounters, deriveScanTreeCacheCapacity, TreeCache } from "./tree-sitter-cache.js";
+import { TreeSitterNavigator } from "./tree-sitter-navigator.js";
+import { isProvenSqlAlchemySessionReceiver, isSafePsycopgIdentifierComposition, isSqlAlchemyEntityQueryArgument, isSqlAlchemyStatementArgument, PYTHON_SQLALCHEMY_RECEIVER_NAMES, PYTHON_SQLALCHEMY_STATEMENT_BUILDERS } from "./python-provenance.js";
+import { TreeSitterQueryLoader } from "./tree-sitter-query-loader.js";
+const TREE_SITTER_MAX_SCAN_FILES = 20000;
+const QUERY_BATCH_MAX_LOAD_FAILURES = 3;
+const NO_NESTED_ANCHOR_VISIT_CAP = 1e4;
+const PYTHON_SQL_SINK_METHODS = new Set([
+  "execute",
+  "executemany",
+  "query",
+  "raw"
+]);
+const TYPESCRIPT_SQL_KNOWN_PACKAGES = new Set([
+  "pg",
+  "mysql2",
+  "better-sqlite3",
+  "knex",
+  "@prisma/client"
+]);
+const TYPESCRIPT_SQL_IMPORTS = new WeakMap;
+const NOT_PARSED = { parsed: false };
+function createParserCounters() {
+  return {
+    parserInvocations: 0,
+    parserDurationMs: 0,
+    parserFailures: 0
+  };
+}
+function grammarWriteBlockedReason(dir) {
+  let probe = dir;
+  while (!fs.existsSync(probe)) {
+    const parent = path.dirname(probe);
+    if (parent === probe)
+      return "ENOENT";
+    probe = parent;
+  }
+  try {
+    fs.accessSync(probe, fs.constants.W_OK);
+    return;
+  } catch (err) {
+    return err?.code ?? "EACCES";
+  }
+}
+function grammarFileStamp(filePath) {
+  try {
+    const stat = fs.statSync(filePath);
+    return stat.isFile() ? `${stat.size}:${stat.mtimeMs}` : undefined;
+  } catch {
+    return;
+  }
+}
+function isTreeSitterWasmAbortError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("Aborted") || message.includes("abort()");
+}
+const RESOLUTION_ERROR_CODES = new Set([
+  "ERR_MODULE_NOT_FOUND",
+  "MODULE_NOT_FOUND",
+  "ERR_INVALID_MODULE_SPECIFIER",
+  "ERR_UNSUPPORTED_DIR_IMPORT",
+  "ENOENT",
+  "EMFILE",
+  "EBUSY",
+  "EAGAIN",
+  "EPERM",
+  "ETXTBSY"
+]);
+function collectErrorCodes(err) {
+  const codes = [];
+  let current = err;
+  const seen = new Set;
+  while (current instanceof Error && !seen.has(current)) {
+    seen.add(current);
+    const code = current.code;
+    if (typeof code === "string")
+      codes.push(code);
+    current = current.cause;
+  }
+  return codes;
+}
+function classifyWebTreeSitterLoadFailure(err) {
+  const codes = collectErrorCodes(err);
+  return codes.some((code) => RESOLUTION_ERROR_CODES.has(code)) ? "resolution" : "evaluation";
+}
+
+export class TreeSitterClient {
+  initialized = false;
+  initPromise = null;
+  webTreeSitterLoadFailed = false;
+  languages = new Map;
+  parsers = new Map;
+  treeCache;
+  navigator = new TreeSitterNavigator;
+  grammarsDir;
+  grammarEnsurePromises = new Map;
+  grammarRetryAtMs = new Map;
+  verifiedGrammarPaths = new Map;
+  decodeFailedGrammarPaths = new Map;
+  verifiedGrammarVersionAt = new Map;
+  staleGrammarVersionAt = new Map;
+  staleReportedGrammarPaths = new Set;
+  poisonedGrammarPaths = new Set;
+  grammarFailureAttempts = new Map;
+  grammarLastNotifiedDelayMs = new Map;
+  grammarNotificationsLedgerGen = getDegradationLedgerGeneration();
+  trustBlockedGrammarNotifications = new Set;
+  trustNotificationsGeneration = getProjectTrustGeneration();
+  ParserClass = null;
+  LanguageLoader = null;
+  static QUERY_CACHE_MAX_ENTRIES = 256;
+  static QUERY_BATCH_CACHE_MAX_ENTRIES = 256;
+  queryCache = new BoundedFifoMap(TreeSitterClient.QUERY_CACHE_MAX_ENTRIES);
+  queryBatchCache = new BoundedFifoMap(TreeSitterClient.QUERY_BATCH_CACHE_MAX_ENTRIES);
+  queryCacheCap() {
+    const value = Number.parseInt(process.env.DM_LENS_TREE_SITTER_QUERY_CACHE_CAP ?? "", 10);
+    return Number.isSafeInteger(value) && value > 0 ? value : TreeSitterClient.QUERY_CACHE_MAX_ENTRIES;
+  }
+  queryBatchCacheCap() {
+    const value = Number.parseInt(process.env.DM_LENS_TREE_SITTER_QUERY_BATCH_CACHE_CAP ?? "", 10);
+    return Number.isSafeInteger(value) && value > 0 ? value : TreeSitterClient.QUERY_BATCH_CACHE_MAX_ENTRIES;
+  }
+  cacheQuery(key, value) {
+    this.queryCache.delete(key);
+    const evicted = this.queryCache.setMaxEntries(this.queryCacheCap());
+    evicted.push(...this.queryCache.set(key, value));
+    for (const [, dropped] of evicted)
+      dropped?.query?.delete?.();
+  }
+  cacheQueryBatch(key, value) {
+    this.queryBatchCache.delete(key);
+    const evicted = this.queryBatchCache.setMaxEntries(this.queryBatchCacheCap());
+    evicted.push(...this.queryBatchCache.set(key, value));
+    for (const [, dropped] of evicted)
+      dropped?.query?.delete?.();
+  }
+  queryBatchLoadFailures = new Map;
+  queryLoader = new TreeSitterQueryLoader;
+  verbose;
+  parserCounters = createParserCounters();
+  parseCacheMeasurement = new AsyncLocalStorage;
+  activeMeasurements = 0;
+  onWasmAbort;
+  wasmAborted = false;
+  grammarDirResolutionDeps;
+  constructor(verbose = false, onWasmAbort, grammarDirResolutionDeps) {
+    this.grammarDirResolutionDeps = grammarDirResolutionDeps ?? {
+      resolveAsset: (asset) => this.resolveWebTreeSitterAsset(asset),
+      resolvePackage: (specifier) => _require.resolve(specifier),
+      packageRoot: () => getPackageRoot(import.meta.url),
+      cwd: () => process.cwd()
+    };
+    this.grammarsDir = this.findGrammarsDir();
+    this.verbose = verbose;
+    this.onWasmAbort = onWasmAbort;
+    this.treeCache = new TreeCache(50, verbose, 4096, (key, amount) => {
+      const measurement = this.parseCacheMeasurement.getStore();
+      if (measurement)
+        measurement[key] += amount;
+    }, (error) => this.reportWasmAbort(error));
+  }
+  recordParserCounter(key, amount = 1) {
+    this.parserCounters[key] += amount;
+    const measurement = this.parseCacheMeasurement.getStore();
+    if (measurement)
+      measurement[key] += amount;
+  }
+  reportWasmAbort(error) {
+    if (!isTreeSitterWasmAbortError(error))
+      return false;
+    if (!this.wasmAborted) {
+      this.wasmAborted = true;
+      recordDegradation({
+        kind: "wasm-abort",
+        subject: "web-tree-sitter",
+        reason: error instanceof Error ? error.message : String(error)
+      });
+      this.onWasmAbort?.();
+    }
+    return true;
+  }
+  getRuntimeStats() {
+    return {
+      languagesLoaded: this.languages.size,
+      parsersLoaded: this.parsers.size,
+      queryCacheSize: this.queryCache.size,
+      queryBatchCacheSize: this.queryBatchCache.size
+    };
+  }
+  getParseCacheStats() {
+    return {
+      ...this.treeCache.getStats(),
+      ...this.parserCounters
+    };
+  }
+  ensureTreeCacheCapacity(fileCount) {
+    this.treeCache.setMaxSize(deriveScanTreeCacheCapacity(fileCount, this.treeCache.getMaxSize()));
+  }
+  async withParseCacheMeasurement(work, onComplete) {
+    const measurement = {
+      ...createTreeCacheCounters(),
+      ...createParserCounters()
+    };
+    this.activeMeasurements++;
+    try {
+      return await this.parseCacheMeasurement.run(measurement, async () => {
+        try {
+          return await work();
+        } finally {
+          const cacheStats = this.treeCache.getStats();
+          try {
+            onComplete({
+              ...cacheStats,
+              ...measurement,
+              misses: measurement.lookups - measurement.hits
+            });
+          } catch {}
+        }
+      });
+    } finally {
+      if (--this.activeMeasurements === 0)
+        this.parseCacheMeasurement.disable();
+    }
+  }
+  dbg(msg) {
+    if (this.verbose) {
+      logTreeSitterDiagnostic({
+        subsystem: "tree-sitter-client",
+        level: "debug",
+        message: msg
+      });
+    }
+  }
+  webTreeSitterPackageDir() {
+    return resolveWebTreeSitterPackageDir({
+      resolve: (specifier) => this.grammarDirResolutionDeps.resolvePackage(specifier),
+      packageRoot: () => this.grammarDirResolutionDeps.packageRoot(),
+      cwd: () => this.grammarDirResolutionDeps.cwd()
+    });
+  }
+  resolveWebTreeSitterAsset(asset) {
+    try {
+      const resolved = this.grammarDirResolutionDeps.resolvePackage(`web-tree-sitter/${asset}`);
+      if (fs.existsSync(resolved))
+        return resolved;
+    } catch {}
+    const pkgDir = this.webTreeSitterPackageDir();
+    if (pkgDir) {
+      const candidate = path.join(pkgDir, asset);
+      if (fs.existsSync(candidate))
+        return candidate;
+    }
+    return;
+  }
+  _bundledGrammarsDir;
+  bundledGrammarsDir() {
+    if (this._bundledGrammarsDir)
+      return this._bundledGrammarsDir;
+    try {
+      const dir = resolvePackagePath(import.meta.url, "grammars");
+      if (fs.existsSync(dir))
+        this._bundledGrammarsDir = dir;
+      return this._bundledGrammarsDir;
+    } catch {
+      return;
+    }
+  }
+  _vendoredGrammarsDir;
+  vendoredGrammarsDir() {
+    if (this._vendoredGrammarsDir)
+      return this._vendoredGrammarsDir;
+    try {
+      const dir = vendoredGrammarsDir();
+      if (fs.existsSync(dir))
+        this._vendoredGrammarsDir = dir;
+      return this._vendoredGrammarsDir;
+    } catch {
+      return;
+    }
+  }
+  grammarSourceDirs() {
+    const dirs = [];
+    const push = (d) => {
+      if (d && !dirs.includes(d))
+        dirs.push(d);
+    };
+    push(this.vendoredGrammarsDir());
+    push(this.bundledGrammarsDir());
+    push(this.grammarsDir || undefined);
+    push(this.resolveWebTreeSitterAsset("grammars"));
+    return dirs;
+  }
+  resolveGrammarFile(grammarFile) {
+    for (const dir of this.grammarSourceDirs()) {
+      const candidate = path.join(dir, grammarFile);
+      const stamp = grammarFileStamp(candidate);
+      if (!stamp)
+        continue;
+      if (this.decodeFailedGrammarPaths.get(candidate) === stamp)
+        continue;
+      if (this.verifiedGrammarPaths.get(candidate) === stamp) {
+        if (this.isGrammarVersionCurrent(candidate, grammarFile, stamp)) {
+          return candidate;
+        }
+        continue;
+      }
+      if (fileHasWasmMagic(candidate)) {
+        this.verifiedGrammarPaths.set(candidate, stamp);
+        if (this.isGrammarVersionCurrent(candidate, grammarFile, stamp)) {
+          return candidate;
+        }
+        continue;
+      }
+      this.verifiedGrammarPaths.delete(candidate);
+      this.reportPoisonedGrammarFile(candidate, grammarFile);
+    }
+    return;
+  }
+  refreshGrammarSessionLatches() {
+    const ledgerGen = getDegradationLedgerGeneration();
+    if (ledgerGen === this.grammarNotificationsLedgerGen)
+      return;
+    this.grammarNotificationsLedgerGen = ledgerGen;
+    this.grammarLastNotifiedDelayMs.clear();
+    this.poisonedGrammarPaths.clear();
+    this.staleReportedGrammarPaths.clear();
+  }
+  reportPoisonedGrammarFile(candidate, grammarFile) {
+    this.refreshGrammarSessionLatches();
+    if (this.poisonedGrammarPaths.has(candidate))
+      return;
+    this.poisonedGrammarPaths.add(candidate);
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      level: "warn",
+      message: `ignoring ${candidate}: the file is not a wasm module (missing the \\0asm preamble) — ` + `most likely a captive-portal or proxy page written by an earlier download (#1548). ` + `dm-lens will treat the grammar as missing and try to fetch it again.`,
+      metadata: { grammarFile, path: candidate, outcome: "not-wasm" }
+    });
+    incrementDegradationCount({
+      kind: "grammar-blocked",
+      subject: grammarFile,
+      reason: "on-disk grammar file is not a wasm module — ignored, re-fetching"
+    });
+  }
+  isGrammarVersionCurrent(candidate, grammarFile, stamp) {
+    if (isVendoredGrammar(grammarFile))
+      return true;
+    if (this.staleGrammarVersionAt.get(candidate) === stamp) {
+      this.reportStaleGrammarVersion(candidate, grammarFile);
+      return false;
+    }
+    if (this.verifiedGrammarVersionAt.get(candidate) === stamp)
+      return true;
+    const pinnedHash = pinnedGrammarHash(grammarFile);
+    if (!pinnedHash) {
+      this.verifiedGrammarVersionAt.set(candidate, stamp);
+      return true;
+    }
+    const actualHash = grammarFileSha256(candidate);
+    if (actualHash === pinnedHash) {
+      this.verifiedGrammarVersionAt.set(candidate, stamp);
+      return true;
+    }
+    this.verifiedGrammarVersionAt.delete(candidate);
+    this.staleGrammarVersionAt.set(candidate, stamp);
+    this.reportStaleGrammarVersion(candidate, grammarFile);
+    return false;
+  }
+  reportStaleGrammarVersion(candidate, grammarFile) {
+    this.refreshGrammarSessionLatches();
+    if (this.staleReportedGrammarPaths.has(candidate))
+      return;
+    this.staleReportedGrammarPaths.add(candidate);
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      level: "warn",
+      message: `ignoring ${candidate}: its sha256 no longer matches the pinned grammar ` + `manifest — the pinned tree-sitter-wasms version (or a SOURCE_OVERRIDES entry) ` + `moved since this file was downloaded. dm-lens will treat the grammar as ` + `missing and re-fetch the current build (#1760).`,
+      metadata: { grammarFile, path: candidate, outcome: "stale-version" }
+    });
+    incrementDegradationCount({
+      kind: "grammar-blocked",
+      subject: grammarFile,
+      reason: "cached grammar no longer matches the pinned manifest hash — ignored, re-fetching"
+    });
+  }
+  findGrammarsDir(deps = this.grammarDirResolutionDeps) {
+    const grammarsDir = deps.resolveAsset("grammars");
+    if (grammarsDir && fs.existsSync(path.join(grammarsDir, "tree-sitter-typescript.wasm"))) {
+      return grammarsDir;
+    }
+    try {
+      const wasmsOut = path.join(path.dirname(deps.resolvePackage("tree-sitter-wasms/package.json")), "out");
+      if (fs.existsSync(wasmsOut))
+        return wasmsOut;
+    } catch {}
+    const cwdWasms = path.join(deps.cwd(), "node_modules", "tree-sitter-wasms", "out");
+    if (fs.existsSync(cwdWasms))
+      return cwdWasms;
+    return "";
+  }
+  grammarsWriteDir() {
+    const pkgDir = this.webTreeSitterPackageDir();
+    return pkgDir ? path.join(pkgDir, "grammars") : undefined;
+  }
+  async ensureGrammar(grammarFile) {
+    if (this.resolveGrammarFile(grammarFile)) {
+      return true;
+    }
+    if (!assertInstallAllowed(`tree-sitter grammar fetch: ${grammarFile}`)) {
+      const unavailable = `tree-sitter grammar '${grammarFile}' is unavailable because the project is not trusted; ` + `runtime grammar downloads are disabled until trust is granted.`;
+      logTreeSitterDiagnostic({
+        subsystem: "tree-sitter-client",
+        message: unavailable,
+        metadata: { grammarFile, outcome: "trust-gated" }
+      });
+      recordDegradation({
+        kind: "grammar-blocked",
+        subject: grammarFile,
+        reason: "runtime grammar download blocked because project is untrusted"
+      });
+      const generation = getProjectTrustGeneration();
+      if (generation !== this.trustNotificationsGeneration) {
+        this.trustNotificationsGeneration = generation;
+        this.trustBlockedGrammarNotifications.clear();
+      }
+      if (!this.trustBlockedGrammarNotifications.has(grammarFile)) {
+        this.trustBlockedGrammarNotifications.add(grammarFile);
+        notifyUserDegradation(`dm-lens: ${unavailable}`);
+      }
+      return false;
+    }
+    const inflight = this.grammarEnsurePromises.get(grammarFile);
+    if (inflight)
+      return inflight;
+    const retryAt = this.grammarRetryAtMs.get(grammarFile);
+    if (retryAt !== undefined && Date.now() < retryAt) {
+      return false;
+    }
+    const task = (async () => {
+      try {
+        return await this.fetchGrammar(grammarFile);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.recordGrammarFailure(grammarFile, `The runtime grammar fetch threw an unexpected error (${message}).`, true, "download-failed");
+        return false;
+      }
+    })();
+    this.grammarEnsurePromises.set(grammarFile, task);
+    task.finally(() => {
+      if (this.grammarEnsurePromises.get(grammarFile) === task) {
+        this.grammarEnsurePromises.delete(grammarFile);
+      }
+    }).catch(() => {});
+    return task;
+  }
+  async fetchGrammar(grammarFile) {
+    if (isVendoredGrammar(grammarFile)) {
+      const { reason } = vendoredGrammarRefusal(grammarFile);
+      this.recordGrammarFailure(grammarFile, reason ?? `${grammarFile} is missing from vendor/grammars/.`, false);
+      return false;
+    }
+    const dir = this.grammarsDir && fs.existsSync(this.grammarsDir) ? this.grammarsDir : this.grammarsWriteDir();
+    if (!dir) {
+      this.recordGrammarFailure(grammarFile, "No grammars directory could be resolved for the runtime fetch: the web-tree-sitter package is not locatable from this runtime, from dm-lens's own package root, or from the working directory.", true, "write-dir-unresolvable");
+      return false;
+    }
+    const writeBlock = grammarWriteBlockedReason(dir);
+    if (writeBlock) {
+      this.recordGrammarFailure(grammarFile, `The grammars directory ${dir} cannot be written to (${writeBlock}), so the runtime fetch has nowhere to land.`, true, "write-dir-unwritable");
+      return false;
+    }
+    const { ok, retryable, reason } = await downloadGrammarDetailed(dir, grammarFile);
+    if (ok) {
+      if (!this.grammarsDir)
+        this.grammarsDir = dir;
+      this.grammarRetryAtMs.delete(grammarFile);
+      this.grammarFailureAttempts.delete(grammarFile);
+      this.grammarLastNotifiedDelayMs.delete(grammarFile);
+      logTreeSitterDiagnostic({
+        subsystem: "tree-sitter-client",
+        level: "warn",
+        message: `fetched missing tree-sitter grammar ${grammarFile} at runtime (install scripts were skipped by the package manager)`,
+        metadata: { grammarFile, outcome: "fetched" }
+      });
+    } else {
+      this.recordGrammarFailure(grammarFile, reason ?? "The package manager skipped install scripts and the runtime download failed.", retryable, "download-failed");
+    }
+    return ok;
+  }
+  recordGrammarFailure(grammarFile, detail, retryable, cause) {
+    const attempts = (this.grammarFailureAttempts.get(grammarFile) ?? 0) + 1;
+    this.grammarFailureAttempts.set(grammarFile, attempts);
+    const retryDelayMs = retryable ? transientRetryDelayMs(attempts, "probe-timeout") : undefined;
+    this.grammarRetryAtMs.set(grammarFile, retryDelayMs === undefined ? Number.POSITIVE_INFINITY : Date.now() + retryDelayMs);
+    const remedy = cause === "write-dir-unresolvable" ? `This is a packaging/module-resolution fault, not a download problem: reinstall dm-lens so its ` + `web-tree-sitter dependency is present, or drop the wasm into dm-lens's own grammars/ directory.` : cause === "write-dir-unwritable" ? `This is a filesystem-permission fault, not a download problem: make that directory writable ` + `for the user dm-lens runs as, or reinstall dm-lens as that user.` : retryable ? `if the problem persists, allow the package manager's build scripts ` + `(pnpm approve-builds / bun trustedDependencies) or restore network access.` : `Fix: reinstall with a manager that runs postinstall, allow its build scripts ` + `(pnpm approve-builds / bun trustedDependencies), or restore network access.`;
+    const unavailable = `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` + `module reports and structural rules for this language will be degraded. ` + `${detail} ` + (retryable ? `dm-lens will retry automatically in ${Math.round(retryDelayMs / 1000)}s; ` : `The grammar source reports it does not exist (not a network problem), so this will not ` + `resolve on retry. `) + remedy;
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      message: unavailable,
+      metadata: {
+        grammarFile,
+        outcome: "unavailable",
+        retryable,
+        retryDelayMs,
+        attempts,
+        ...cause ? { cause } : {}
+      }
+    });
+    incrementDegradationCount({
+      kind: "grammar-blocked",
+      subject: grammarFile,
+      reason: retryable ? `runtime grammar download failed — retryable (${detail.trim()})` : `runtime grammar download failed — durable (${detail.trim()})`
+    });
+    this.refreshGrammarSessionLatches();
+    const notifyKey = retryDelayMs ?? -1;
+    if (this.grammarLastNotifiedDelayMs.get(grammarFile) !== notifyKey) {
+      this.grammarLastNotifiedDelayMs.set(grammarFile, notifyKey);
+      notifyUserDegradation(`dm-lens: ${unavailable}`);
+    }
+  }
+  recordGrammarLoadFailure(grammarPath, grammarFile, err) {
+    const stamp = grammarFileStamp(grammarPath);
+    this.verifiedGrammarPaths.delete(grammarPath);
+    if (stamp)
+      this.decodeFailedGrammarPaths.set(grammarPath, stamp);
+    const message = err instanceof Error ? err.message : String(err);
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      level: "warn",
+      message: `Language.load failed for ${grammarPath} even though the wasm preamble check ` + `passed (${message}) — most likely a truncated download (#1564). Treating the ` + `grammar as missing so the next demand re-fetches it.`,
+      metadata: { grammarFile, path: grammarPath, outcome: "load-failed" }
+    });
+    this.recordGrammarFailure(grammarFile, `Language.load failed on a resolved grammar file (${message}).`, true);
+  }
+  async init() {
+    if (this.wasmAborted)
+      return false;
+    if (this.initialized)
+      return true;
+    if (this.webTreeSitterLoadFailed)
+      return false;
+    if (this.initPromise)
+      return this.initPromise;
+    this.initPromise = (async () => {
+      try {
+        let mod;
+        try {
+          mod = await loadWebTreeSitter();
+        } catch (err) {
+          const classification = classifyWebTreeSitterLoadFailure(err);
+          if (classification === "evaluation") {
+            this.webTreeSitterLoadFailed = true;
+          }
+          recordDegradationOnce({
+            kind: "web-tree-sitter-load-failed",
+            subject: "web-tree-sitter",
+            reason: (err instanceof Error ? err.message : String(err)) + (classification === "resolution" ? " (resolution failure — retryable)" : " (evaluation failure — latched for the session)")
+          });
+          throw err;
+        }
+        const anyMod = mod;
+        const ParserClass = anyMod.Parser || anyMod.default || anyMod;
+        if (!ParserClass || typeof ParserClass.init !== "function") {
+          this.dbg("Parser class not found or missing init method");
+          return false;
+        }
+        this.ParserClass = ParserClass;
+        this.LanguageLoader = mod.Language;
+        const wasmPath = this.resolveWebTreeSitterAsset("tree-sitter.wasm");
+        if (!wasmPath) {
+          this.dbg("Could not resolve tree-sitter.wasm");
+          return false;
+        }
+        const wasmDir = path.dirname(wasmPath);
+        this.dbg(`Looking for WASM at: ${wasmPath}, exists: ${fs.existsSync(wasmPath)}`);
+        await ParserClass.init({
+          locateFile: (scriptName) => {
+            const fullPath = path.join(wasmDir, scriptName);
+            this.dbg(`locateFile: ${scriptName} -> ${fullPath}`);
+            return fullPath;
+          }
+        });
+        this.initialized = true;
+        return true;
+      } catch (err) {
+        this.reportWasmAbort(err);
+        this.dbg(`Init error: ${err}`);
+        return false;
+      } finally {
+        this.initPromise = null;
+      }
+    })();
+    return this.initPromise;
+  }
+  resetLoadStateForSession() {
+    this.webTreeSitterLoadFailed = false;
+  }
+  async loadLanguage(languageId) {
+    if (this.wasmAborted)
+      return null;
+    this.dbg(`Loading language: ${languageId}`);
+    if (this.languages.has(languageId)) {
+      this.dbg(`Language ${languageId} already loaded`);
+      return this.languages.get(languageId);
+    }
+    if (!this.ParserClass) {
+      this.dbg(`ParserClass not initialized`);
+      return null;
+    }
+    const grammarFile = LANGUAGE_TO_GRAMMAR[languageId];
+    if (!grammarFile) {
+      this.dbg(`No grammar file for ${languageId}`);
+      return null;
+    }
+    const blockReason = grammarBlockReason(grammarFile);
+    if (blockReason) {
+      this.dbg(`Grammar ${grammarFile} blocked on this runtime — ${blockReason}`);
+      recordDegradation({
+        kind: "grammar-blocked",
+        subject: grammarFile,
+        reason: blockReason
+      });
+      return null;
+    }
+    let grammarPath = this.resolveGrammarFile(grammarFile);
+    if (!grammarPath) {
+      if (await this.ensureGrammar(grammarFile)) {
+        grammarPath = this.resolveGrammarFile(grammarFile);
+      }
+    }
+    this.dbg(`Grammar path: ${grammarPath}, exists: ${grammarPath && fs.existsSync(grammarPath)}`);
+    if (!grammarPath || !fs.existsSync(grammarPath)) {
+      this.dbg(`Grammar file not found: ${grammarPath}`);
+      return null;
+    }
+    try {
+      if (!this.LanguageLoader?.load) {
+        this.dbg(`LanguageLoader.load not available`);
+        return null;
+      }
+      this.dbg(`Calling Language.load...`);
+      const language = await this.LanguageLoader.load(grammarPath);
+      this.dbg(`Language loaded: ${language?.name || "unknown"}`);
+      if (language) {
+        this.languages.set(languageId, language);
+      }
+      return language;
+    } catch (err) {
+      if (!this.reportWasmAbort(err)) {
+        this.recordGrammarLoadFailure(grammarPath, grammarFile, err);
+      }
+      this.dbg(`Language load error: ${err}`);
+      return null;
+    }
+  }
+  async getParser(languageId) {
+    if (this.wasmAborted)
+      return null;
+    if (this.parsers.has(languageId)) {
+      return this.parsers.get(languageId);
+    }
+    const language = await this.loadLanguage(languageId);
+    if (!language || !this.ParserClass)
+      return null;
+    const parser = new this.ParserClass;
+    parser.setLanguage(language);
+    this.parsers.set(languageId, parser);
+    return parser;
+  }
+  async parseFile(filePath, languageId, contentOverride) {
+    const outcome = await this.parseFileAndUse(filePath, languageId, contentOverride, (tree) => tree);
+    return outcome.parsed ? outcome.value : null;
+  }
+  async withParsedTree(filePath, languageId, contentOverride, consume) {
+    return this.parseFileAndUse(filePath, languageId, contentOverride, consume);
+  }
+  async parseFileAndUse(filePath, languageId, contentOverride, consume) {
+    this.dbg(`Parsing ${filePath} with language ${languageId}`);
+    const parser = await this.getParser(languageId);
+    if (!parser) {
+      this.dbg(`Failed to get parser for ${languageId}`);
+      return NOT_PARSED;
+    }
+    let tree;
+    try {
+      const content = contentOverride ?? fs.readFileSync(filePath, "utf-8");
+      this.dbg(`File content length: ${content.length}`);
+      const cachedTree = this.treeCache.get(filePath, content, languageId);
+      if (cachedTree) {
+        this.dbg(`Using cached tree for ${filePath}`);
+        tree = cachedTree;
+      } else {
+        const parseStartedAt = performance.now();
+        this.recordParserCounter("parserInvocations");
+        try {
+          tree = parser.parse(content);
+        } catch (err) {
+          this.recordParserCounter("parserFailures");
+          throw err;
+        } finally {
+          this.recordParserCounter("parserDurationMs", performance.now() - parseStartedAt);
+        }
+        this.dbg(`Parsed, root node type: ${tree.rootNode.type}`);
+        this.treeCache.set(filePath, content, languageId, tree);
+      }
+    } catch (err) {
+      this.reportWasmAbort(err);
+      this.dbg(`Parse error: ${err}`);
+      return NOT_PARSED;
+    }
+    try {
+      return { parsed: true, value: consume(tree) };
+    } catch (error) {
+      this.reportWasmAbort(error);
+      throw error;
+    }
+  }
+  extractInjections(filePath, content) {
+    const injections = [];
+    const sqlPattern = /\b(sql|query|execute)\s*`([^`]+)`/gi;
+    let match;
+    while ((match = sqlPattern.exec(content)) !== null) {
+      const lines = content.slice(0, match.index).split(`
+`);
+      injections.push({
+        type: "sql",
+        content: match[2],
+        line: lines.length,
+        column: lines[lines.length - 1].length
+      });
+    }
+    const cssPattern = /\b(styled(?:\.\w+)?|css)\s*`([^`]+)`/gi;
+    while ((match = cssPattern.exec(content)) !== null) {
+      const lines = content.slice(0, match.index).split(`
+`);
+      injections.push({
+        type: "css",
+        content: match[2],
+        line: lines.length,
+        column: lines[lines.length - 1].length
+      });
+    }
+    const regexPattern = /new\s+RegExp\s*\(\s*`([^`]+)`/gi;
+    while ((match = regexPattern.exec(content)) !== null) {
+      const lines = content.slice(0, match.index).split(`
+`);
+      injections.push({
+        type: "regex",
+        content: match[1],
+        line: lines.length,
+        column: lines[lines.length - 1].length
+      });
+    }
+    this.dbg(`Found ${injections.length} injections in ${filePath}`);
+    return injections;
+  }
+  isAvailable() {
+    if (this.wasmAborted)
+      return false;
+    if (this.resolveGrammarFile("tree-sitter-typescript.wasm"))
+      return true;
+    const dir = this.findGrammarsDir();
+    this.grammarsDir = dir;
+    return !!dir && fs.existsSync(dir);
+  }
+  async isLanguageSupported(languageId) {
+    if (this.wasmAborted)
+      return false;
+    if (!this.initialized)
+      await this.init();
+    const language = await this.loadLanguage(languageId);
+    return language !== null;
+  }
+  getLanguage(languageId) {
+    if (this.wasmAborted)
+      return null;
+    return this.languages.get(languageId) || null;
+  }
+  async structuralSearch(pattern, languageId, rootDir, options = {}) {
+    if (!this.initialized) {
+      const ok = await this.init();
+      if (!ok)
+        return [];
+    }
+    try {
+      await this.queryLoader.loadQueries(rootDir);
+    } catch (err) {
+      this.dbg(`Failed to load queries for ${rootDir}: ${err}`);
+    }
+    this.dbg(`Compiling pattern: ${pattern.slice(0, 50)}...`);
+    const compiled = await this.compileQuery(pattern, languageId);
+    if (!compiled) {
+      this.dbg(`Pattern compilation failed`);
+      return [];
+    }
+    this.dbg(`Pattern compiled, metavars: ${compiled.metavars.join(", ")}`);
+    const files = this.collectFiles(rootDir, languageId, options.fileFilter);
+    this.dbg(`Scanning ${files.length} files...`);
+    const matches = [];
+    const maxResults = options.maxResults ?? 50;
+    for (const file of files) {
+      if (matches.length >= maxResults)
+        break;
+      const fileMatches = await this.searchFileWithQuery(file, compiled.query, compiled.metavars, languageId, pattern, compiled.postFilter, compiled.postFilterParams);
+      matches.push(...fileMatches);
+    }
+    return matches.slice(0, maxResults);
+  }
+  async runQueryOnFile(queryDef, filePath, languageId, options = {}, contentOverride) {
+    if (!this.initialized) {
+      const ok = await this.init();
+      if (!ok)
+        return [];
+    }
+    const compiled = await this.compileRawQuery(queryDef.id, queryDef.query, queryDef.metavars, languageId, queryDef.post_filter, queryDef.post_filter_params);
+    if (!compiled)
+      return [];
+    const matches = await this.searchFileWithQuery(filePath, compiled.query, compiled.metavars, languageId, queryDef.id, compiled.postFilter, compiled.postFilterParams, contentOverride);
+    const maxResults = options.maxResults ?? 50;
+    return matches.slice(0, maxResults);
+  }
+  async runQueriesOnFile(queryDefs, filePath, languageId, options = {}, contentOverride) {
+    if (queryDefs.length === 0)
+      return [];
+    if (!this.initialized) {
+      const ok = await this.init();
+      if (!ok)
+        return [];
+    }
+    const maxResults = options.maxResults ?? 50;
+    const batch = await this.compileQueryBatch(queryDefs, languageId);
+    if (!batch) {
+      const results = [];
+      for (const queryDef of queryDefs) {
+        const matches = await this.runQueryOnFile(queryDef, filePath, languageId, options, contentOverride);
+        for (const match of matches)
+          results.push({ queryDef, match });
+      }
+      return results;
+    }
+    const perQuery = new Map;
+    await this.parseFileAndUse(filePath, languageId, contentOverride, (tree) => {
+      try {
+        const rootNode = tree.rootNode;
+        for (const match of batch.query.matches(rootNode)) {
+          const owner = batch.ownerOfPattern[match.patternIndex];
+          if (owner === undefined)
+            continue;
+          const bucket = perQuery.get(owner) ?? [];
+          if (bucket.length >= maxResults)
+            continue;
+          const entry = batch.entries[owner];
+          const captures = {};
+          for (const capture of match.captures) {
+            if (entry.metavars.includes(capture.name)) {
+              captures[capture.name] = capture.node;
+            }
+          }
+          if (!this.evaluatePredicates(batch.query, match))
+            continue;
+          if (entry.postFilter && !this.applyPostFilter(entry.postFilter, entry.postFilterParams, captures, rootNode)) {
+            continue;
+          }
+          if (match.captures.length === 0)
+            continue;
+          const firstNode = match.captures[0].node;
+          const textCaptures = {};
+          for (const [name, node] of Object.entries(captures)) {
+            textCaptures[name] = node.text;
+          }
+          bucket.push({
+            file: filePath,
+            line: firstNode.startPosition.row + 1,
+            column: firstNode.startPosition.column + 1,
+            matchedText: firstNode.text,
+            nodeType: firstNode.type,
+            captures: textCaptures
+          });
+          perQuery.set(owner, bucket);
+        }
+      } catch (err) {
+        this.reportWasmAbort(err);
+        this.dbg(`Batched query matching error: ${err}`);
+      }
+    });
+    const results = [];
+    for (let i = 0;i < batch.entries.length; i++) {
+      for (const match of perQuery.get(i) ?? []) {
+        results.push({ queryDef: batch.entries[i].queryDef, match });
+      }
+    }
+    return results;
+  }
+  async compileQueryBatch(queryDefs, languageId) {
+    const identity = crypto.createHash("sha256").update(JSON.stringify(queryDefs)).digest("hex");
+    const cacheKey = this.getQueryCacheKey(`batch:${identity}`, languageId);
+    const cached = this.queryBatchCache.get(cacheKey);
+    if (cached !== undefined) {
+      this.queryBatchCache.delete(cacheKey);
+      this.queryBatchCache.set(cacheKey, cached);
+      return cached;
+    }
+    const language = await this.loadLanguage(languageId);
+    if (!language) {
+      const failures = (this.queryBatchLoadFailures.get(cacheKey) ?? 0) + 1;
+      if (failures >= QUERY_BATCH_MAX_LOAD_FAILURES) {
+        this.dbg(`Batch: grammar for ${languageId} failed to load ${failures} times — caching miss`);
+        this.queryBatchLoadFailures.delete(cacheKey);
+        this.cacheQueryBatch(cacheKey, null);
+      } else {
+        this.queryBatchLoadFailures.set(cacheKey, failures);
+      }
+      return null;
+    }
+    this.queryBatchLoadFailures.delete(cacheKey);
+    const build = async () => {
+      const Query = (await loadWebTreeSitter()).Query;
+      const entries = [];
+      const sources = [];
+      const ownerOfPattern = [];
+      for (const queryDef of queryDefs) {
+        let patternCount;
+        try {
+          const probe = new Query(language, queryDef.query);
+          patternCount = probe.patternCount();
+          probe.delete?.();
+        } catch (err) {
+          if (this.reportWasmAbort(err))
+            return null;
+          this.dbg(`Batch: skipping ${queryDef.id} for ${languageId}: ${err}`);
+          this.reportQueryCompileFailure(queryDef.id, languageId, err);
+          continue;
+        }
+        const owner = entries.length;
+        entries.push({
+          queryDef,
+          metavars: queryDef.metavars ?? [],
+          postFilter: queryDef.post_filter,
+          postFilterParams: queryDef.post_filter_params
+        });
+        sources.push(queryDef.query);
+        for (let i = 0;i < patternCount; i++)
+          ownerOfPattern.push(owner);
+      }
+      if (entries.length === 0)
+        return null;
+      try {
+        const query = new Query(language, sources.join(`
+`));
+        if (query.patternCount() !== ownerOfPattern.length) {
+          this.dbg(`Batch pattern count mismatch for ${languageId} (${query.patternCount()} vs ${ownerOfPattern.length}) — falling back`);
+          return null;
+        }
+        return { query, entries, ownerOfPattern };
+      } catch (err) {
+        if (this.reportWasmAbort(err))
+          return null;
+        this.dbg(`Batch compile failed for ${languageId}: ${err}`);
+        return null;
+      }
+    };
+    const batch = await build();
+    this.cacheQueryBatch(cacheKey, batch);
+    return batch;
+  }
+  patternToQuery(pattern, languageId) {
+    const loadedQuery = this.queryLoader.findMatchingQuery(pattern, languageId);
+    if (loadedQuery) {
+      this.dbg(`Using loaded query: ${loadedQuery.id}`);
+      return {
+        query: loadedQuery.query,
+        metavars: loadedQuery.metavars,
+        postFilter: loadedQuery.post_filter,
+        postFilterParams: loadedQuery.post_filter_params,
+        queryDef: loadedQuery
+      };
+    }
+    return this.getInlinePattern(pattern);
+  }
+  getInlinePattern(pattern) {
+    if (pattern.includes("async function") && pattern.includes("$NAME")) {
+      return {
+        query: `(function_declaration
+					"async"
+					name: (identifier) @NAME
+					parameters: (formal_parameters) @PARAMS
+					body: (statement_block) @BODY)`,
+        metavars: ["NAME", "PARAMS", "BODY"]
+      };
+    }
+    if (pattern.includes("console")) {
+      return {
+        query: `(call_expression
+					function: (member_expression
+						object: (identifier) @OBJ (#eq? @OBJ "console")
+						property: (property_identifier) @METHOD)
+					arguments: (arguments) @ARGS)`,
+        metavars: ["OBJ", "METHOD", "ARGS"]
+      };
+    }
+    if (pattern.includes("function $NAME") && pattern.includes("PARAMS")) {
+      return {
+        query: `(function_declaration
+					name: (identifier) @NAME
+					parameters: (formal_parameters) @PARAMS
+					body: (statement_block) @BODY)`,
+        metavars: ["NAME", "PARAMS", "BODY"],
+        postFilter: "count_params",
+        postFilterParams: { min_params: 6 }
+      };
+    }
+    if (pattern.includes(".then") && pattern.includes(".catch")) {
+      return {
+        query: `(call_expression
+					function: (member_expression
+						object: (call_expression
+							function: (member_expression
+								object: (call_expression
+									function: (member_expression
+										property: (property_identifier) @M1)
+									arguments: (arguments))
+								property: (property_identifier) @M2)
+							arguments: (arguments))
+						property: (property_identifier) @M3)
+					arguments: (arguments))
+					(#match? @M1 "^(then|catch)$")
+					(#match? @M2 "^(then|catch)$")
+					(#match? @M3 "^(then|catch)$")`,
+        metavars: ["M1", "M2", "M3"]
+      };
+    }
+    const simpleMatch = pattern.match(/\$([A-Z_][A-Z0-9_]*)/);
+    if (simpleMatch) {
+      const name = simpleMatch[1];
+      return {
+        query: `(identifier) @${name}`,
+        metavars: [name]
+      };
+    }
+    return { query: "", metavars: [] };
+  }
+  getQueryCacheKey(pattern, languageId) {
+    return `${languageId}:${pattern}`;
+  }
+  async compileQuery(pattern, languageId) {
+    const cacheKey = this.getQueryCacheKey(pattern, languageId);
+    if (this.queryCache.has(cacheKey)) {
+      this.dbg(`Query cache hit: ${cacheKey}`);
+      const cached = this.queryCache.get(cacheKey);
+      this.queryCache.delete(cacheKey);
+      this.queryCache.set(cacheKey, cached);
+      return cached;
+    }
+    const language = await this.loadLanguage(languageId);
+    if (!language) {
+      this.dbg(`Could not load language ${languageId}`);
+      return null;
+    }
+    const { query: queryStr, metavars, postFilter, postFilterParams } = this.patternToQuery(pattern, languageId);
+    this.dbg(`Query string: ${queryStr.slice(0, 100)}...`);
+    try {
+      const Query = (await loadWebTreeSitter()).Query;
+      const query = new Query(language, queryStr);
+      this.dbg(`Query compiled with ${query.patternCount()} patterns`);
+      const result = { query, metavars, postFilter, postFilterParams };
+      this.cacheQuery(cacheKey, result);
+      return result;
+    } catch (err) {
+      this.reportWasmAbort(err);
+      this.dbg(`Query compilation failed: ${err}`);
+      return null;
+    }
+  }
+  async compileRawQuery(queryId, queryStr, metavars, languageId, postFilter, postFilterParams) {
+    const cacheKey = this.getQueryCacheKey(`raw:${queryId}:${queryStr}`, languageId);
+    if (this.queryCache.has(cacheKey)) {
+      const cached = this.queryCache.get(cacheKey);
+      this.queryCache.delete(cacheKey);
+      this.queryCache.set(cacheKey, cached);
+      return cached;
+    }
+    const language = await this.loadLanguage(languageId);
+    if (!language)
+      return null;
+    try {
+      const Query = (await loadWebTreeSitter()).Query;
+      const query = new Query(language, queryStr);
+      const result = { query, metavars, postFilter, postFilterParams };
+      this.cacheQuery(cacheKey, result);
+      return result;
+    } catch (err) {
+      this.reportWasmAbort(err);
+      this.dbg(`Raw query compilation failed (${queryId}): ${err}`);
+      this.reportQueryCompileFailure(queryId, languageId, err);
+      return null;
+    }
+  }
+  reportedCompileFailures = new Set;
+  reportQueryCompileFailure(ruleId, languageId, err) {
+    const key = `${ruleId}:${languageId}`;
+    if (this.reportedCompileFailures.has(key))
+      return;
+    this.reportedCompileFailures.add(key);
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      languageId,
+      message: `tree-sitter rule '${ruleId}' failed to compile against '${languageId}' — ` + `matches for this rule are silently dropped rather than reported. ` + `Fix the query in the rule definition to re-enable it. (${err})`,
+      metadata: { ruleId }
+    });
+  }
+  hasChildToken(node, token) {
+    return node.children?.some((child) => child.type === token || child.text === token);
+  }
+  bindingNames(node) {
+    const names = new Set;
+    if (!node)
+      return names;
+    const stack = [node];
+    while (stack.length > 0) {
+      const current = stack.pop();
+      if (current.type === "identifier")
+        names.add(current.text);
+      else if (current.type === "shorthand_property_identifier_pattern") {
+        names.add(current.text);
+      }
+      if (current.type === "property_identifier" || current.type === "type_identifier" || current.type === "computed_property_name")
+        continue;
+      if (current.type === "assignment_pattern" || current.type === "object_assignment_pattern") {
+        const left = current.childForFieldName?.("left");
+        if (left)
+          stack.push(left);
+        continue;
+      }
+      stack.push(...current.children ?? []);
+    }
+    return names;
+  }
+  containsYieldInFunctionBody(node, root = node) {
+    for (const child of node.children ?? []) {
+      if (child.type === "yield")
+        return true;
+      if (child !== root && ["function_definition", "class_definition", "lambda"].includes(child.type)) {
+        continue;
+      }
+      if (this.containsYieldInFunctionBody(child, root))
+        return true;
+    }
+    return false;
+  }
+  isLikelySqlAlchemyReceiver(text) {
+    const tail = text.split(".").pop() ?? text;
+    return PYTHON_SQLALCHEMY_RECEIVER_NAMES.has(tail.toLowerCase());
+  }
+  switchCaseBodyStatements(caseNode) {
+    const named = (caseNode.children ?? []).filter((c) => c.isNamed && !c.type.includes("comment"));
+    return named.slice(1);
+  }
+  hasFallthroughMarker(caseNode) {
+    const comments = [];
+    const body = this.switchCaseBodyStatements(caseNode);
+    const last = body[body.length - 1];
+    const lastEnd = last?.endIndex ?? caseNode.startIndex;
+    for (const c of caseNode.children ?? []) {
+      if (c.type.includes("comment") && c.startIndex >= lastEnd) {
+        comments.push(c);
+      }
+    }
+    const siblings = (caseNode.parent?.children ?? []).filter((c) => c.isNamed);
+    const index = siblings.findIndex((c) => c.startIndex === caseNode.startIndex);
+    const next = index >= 0 ? siblings[index + 1] : undefined;
+    if (next?.type.includes("comment"))
+      comments.push(next);
+    if (last) {
+      const NESTED_FN = new Set([
+        "function_declaration",
+        "function_expression",
+        "arrow_function",
+        "method_definition",
+        "generator_function",
+        "generator_function_declaration",
+        "class_declaration"
+      ]);
+      const stack = [last];
+      for (let visited = 0;stack.length > 0 && visited < 500; visited++) {
+        const node = stack.pop();
+        if (!node)
+          break;
+        if (node.type.includes("comment"))
+          comments.push(node);
+        if (!NESTED_FN.has(node.type)) {
+          stack.push(...node.children ?? []);
+        }
+      }
+    }
+    return comments.some((c) => /falls?\s?through/i.test(c.text));
+  }
+  statementTerminates(node, depth = 0) {
+    if (depth > 20)
+      return false;
+    const t = node.type;
+    const TERMINATORS = new Set([
+      "break_statement",
+      "return_statement",
+      "throw_statement",
+      "continue_statement"
+    ]);
+    if (TERMINATORS.has(t))
+      return true;
+    if (t === "statement_block" || t === "else_clause" || t === "catch_clause" || t === "finally_clause") {
+      const inner = (node.children ?? []).filter((c) => c.isNamed && !c.type.includes("comment"));
+      const last = inner[inner.length - 1];
+      if (!last)
+        return false;
+      return this.statementTerminates(last, depth + 1);
+    }
+    if (t === "try_statement") {
+      const tryBody = (node.children ?? []).find((c) => c.type === "statement_block");
+      const tryTerminates = tryBody ? this.statementTerminates(tryBody, depth + 1) : false;
+      const catches = (node.children ?? []).filter((c) => c.type === "catch_clause");
+      const fin = (node.children ?? []).find((c) => c.type === "finally_clause");
+      if (tryTerminates) {
+        return catches.every((c) => this.statementTerminates(c, depth + 1));
+      }
+      return !!fin && this.statementTerminates(fin, depth + 1);
+    }
+    if (t === "if_statement") {
+      const named = (node.children ?? []).filter((c) => c.isNamed && !c.type.includes("comment"));
+      const consequence = named[1];
+      const alternative = named[2];
+      if (!consequence || !alternative)
+        return false;
+      return this.statementTerminates(consequence, depth + 1) && this.statementTerminates(alternative, depth + 1);
+    }
+    return false;
+  }
+  nextSiblingIsSwitchLabel(caseNode) {
+    const siblings = (caseNode.parent?.children ?? []).filter((c) => c.isNamed && !c.type.includes("comment"));
+    const index = siblings.findIndex((c) => c.startIndex === caseNode.startIndex);
+    const next = index >= 0 ? siblings[index + 1] : undefined;
+    return next?.type === "switch_case" || next?.type === "switch_default";
+  }
+  bodyHasLoopExit(node, insideNestedLoop) {
+    const NESTS_BREAK = new Set([
+      "for_statement",
+      "for_in_statement",
+      "while_statement",
+      "do_statement",
+      "switch_statement"
+    ]);
+    const NESTED_FN = new Set([
+      "function_declaration",
+      "function_expression",
+      "arrow_function",
+      "method_definition",
+      "generator_function",
+      "generator_function_declaration",
+      "class_declaration"
+    ]);
+    for (const child of node.children ?? []) {
+      const t = child.type;
+      if (NESTED_FN.has(t))
+        continue;
+      if (t === "return_statement" || t === "throw_statement")
+        return true;
+      if (t === "break_statement") {
+        const labeled = (child.children ?? []).some((c) => c.isNamed);
+        if (!insideNestedLoop || labeled)
+          return true;
+      }
+      if (this.bodyHasLoopExit(child, insideNestedLoop || NESTS_BREAK.has(t))) {
+        return true;
+      }
+    }
+    return false;
+  }
+  enclosingBindingName(node) {
+    let cur = node?.parent;
+    for (let depth = 0;cur && depth < 12; depth++) {
+      const t = cur.type;
+      if (t === "variable_declarator") {
+        const name = cur.children?.find((c) => c.isNamed);
+        return name?.text ?? "";
+      }
+      if (t === "assignment_expression") {
+        return cur.children?.[0]?.text ?? "";
+      }
+      if (t === "statement_block" || t === "program" || t === "function_declaration" || t === "function_expression" || t === "arrow_function" || t === "method_definition") {
+        return "";
+      }
+      cur = cur.parent;
+    }
+    return "";
+  }
+  resolvesToFileLiteralConst(name, rootNode) {
+    const valueNode = this.resolveFileConstValueNode(name, rootNode);
+    if (!valueNode)
+      return false;
+    return this.isFixedUrlLiteralExpr(valueNode);
+  }
+  resolveFileConstValueNode(name, rootNode) {
+    const constDeclarators = [];
+    let hasNonConstBinding = false;
+    let hasReassignment = false;
+    const stack = [rootNode];
+    while (stack.length > 0) {
+      const node = stack.pop();
+      if (!node)
+        continue;
+      if (node.type === "variable_declarator") {
+        const nameNode = node.childForFieldName?.("name");
+        if (nameNode?.type === "identifier" && nameNode.text === name) {
+          const decl = node.parent;
+          const isConst = decl?.type === "lexical_declaration" && (decl.children ?? []).some((c) => c.type === "const");
+          if (isConst) {
+            constDeclarators.push(node);
+          } else {
+            hasNonConstBinding = true;
+          }
+        }
+      } else if (node.type === "assignment_expression" || node.type === "augmented_assignment_expression") {
+        const left = node.childForFieldName?.("left");
+        if (left?.type === "identifier" && left.text === name) {
+          hasReassignment = true;
+        } else if ((left?.type === "member_expression" || left?.type === "subscript_expression") && left.childForFieldName?.("object")?.type === "identifier" && left.childForFieldName?.("object")?.text === name) {
+          const searchOnly = left.type === "member_expression" && left.childForFieldName?.("property")?.text === "search";
+          if (!searchOnly) {
+            hasReassignment = true;
+          }
+        }
+      }
+      for (const child of node.children ?? [])
+        stack.push(child);
+    }
+    if (hasNonConstBinding || hasReassignment || constDeclarators.length !== 1) {
+      return null;
+    }
+    return constDeclarators[0].childForFieldName?.("value") ?? null;
+  }
+  isFixedUrlLiteralExpr(node) {
+    if (node.type === "string")
+      return true;
+    if (node.type === "template_string") {
+      return !(node.children ?? []).some((c) => c.type === "template_substitution");
+    }
+    return false;
+  }
+  isImportedBinding(name, rootNode) {
+    return this.importedAs(name, rootNode) !== null;
+  }
+  importedAs(name, rootNode) {
+    const stack = [rootNode];
+    while (stack.length > 0) {
+      const node = stack.pop();
+      if (!node)
+        continue;
+      if (node.type === "import_specifier") {
+        const nameNode = node.childForFieldName?.("name");
+        const aliasNode = node.childForFieldName?.("alias");
+        const local = (aliasNode ?? nameNode)?.text;
+        if (local === name)
+          return nameNode?.text ?? null;
+      } else if (node.type === "namespace_import" || node.type === "import_clause") {
+        for (const c of node.children ?? []) {
+          if (c.type === "identifier" && c.text === name)
+            return name;
+        }
+      }
+      for (const child of node.children ?? [])
+        stack.push(child);
+    }
+    return null;
+  }
+  isFixedUrlBaseExpr(base, rootNode) {
+    if (base.type === "string")
+      return true;
+    if (base.type === "identifier") {
+      return this.isFixedBaseIdentifier(base, rootNode);
+    }
+    if (base.type === "template_string") {
+      for (const child of base.children ?? []) {
+        if (child.type !== "template_substitution")
+          continue;
+        const inner = (child.children ?? []).find((c) => c.isNamed);
+        if (!inner || inner.type !== "identifier" || !this.isFixedBaseIdentifier(inner, rootNode)) {
+          return false;
+        }
+      }
+      return true;
+    }
+    return false;
+  }
+  isFixedBaseIdentifier(ident, rootNode) {
+    const name = ident.text;
+    if (!this.isShadowedByEnclosingParam(ident, name) && this.resolvesToFileLiteralConst(name, rootNode)) {
+      return true;
+    }
+    return this.isImportedBinding(name, rootNode);
+  }
+  isShadowedByEnclosingParam(node, name) {
+    const FUNCTION_TYPES = new Set([
+      "function_declaration",
+      "function_expression",
+      "generator_function",
+      "generator_function_declaration",
+      "arrow_function",
+      "method_definition"
+    ]);
+    let current = node.parent;
+    while (current) {
+      if (FUNCTION_TYPES.has(current.type)) {
+        const bare = current.childForFieldName?.("parameter");
+        if (bare?.type === "identifier" && bare.text === name)
+          return true;
+        const params = current.childForFieldName?.("parameters");
+        if (params && this.paramsBindName(params, name))
+          return true;
+      }
+      current = current.parent;
+    }
+    return false;
+  }
+  paramsBindName(params, name) {
+    for (const param of params.children ?? []) {
+      if (!param.isNamed)
+        continue;
+      const pattern = param.type === "required_parameter" || param.type === "optional_parameter" ? param.childForFieldName?.("pattern") : param;
+      if (pattern && this.patternBindsName(pattern, name))
+        return true;
+    }
+    return false;
+  }
+  patternBindsName(pattern, name) {
+    if (pattern.type === "identifier")
+      return pattern.text === name;
+    const stack = [pattern];
+    while (stack.length > 0) {
+      const n = stack.pop();
+      if (!n)
+        continue;
+      if ((n.type === "identifier" || n.type === "shorthand_property_identifier_pattern") && n.text === name) {
+        return true;
+      }
+      if (n.type === "assignment_pattern") {
+        const left = n.childForFieldName?.("left") ?? n.children?.[0];
+        if (left)
+          stack.push(left);
+        continue;
+      }
+      for (const c of n.children ?? [])
+        stack.push(c);
+    }
+    return false;
+  }
+  resolvesToFixedNewUrlConst(name, rootNode) {
+    const value = this.resolveFileConstValueNode(name, rootNode);
+    if (!value || value.type !== "new_expression")
+      return false;
+    const ctor = value.childForFieldName?.("constructor");
+    const ctorName = ctor?.text ?? "";
+    const isUrlCtor = ctorName === "URL" || ctor?.type === "identifier" && this.importedAs(ctorName, rootNode) === "URL";
+    if (!isUrlCtor)
+      return false;
+    const args = (value.childForFieldName?.("arguments")?.children ?? []).filter((c) => c.isNamed && c.type !== "comment");
+    if (args.length === 0)
+      return false;
+    if (!this.isFixedUrlLiteralExpr(args[0]))
+      return false;
+    if (args.length === 1)
+      return true;
+    return this.isFixedUrlBaseExpr(args[1], rootNode);
+  }
+  newUrlBaseVarName(urlNode) {
+    let member;
+    if (urlNode.type === "call_expression") {
+      member = urlNode.childForFieldName?.("function");
+    } else if (urlNode.type === "member_expression") {
+      member = urlNode;
+    }
+    if (!member || member.type !== "member_expression")
+      return null;
+    const prop = member.childForFieldName?.("property")?.text;
+    if (prop !== "toString" && prop !== "href")
+      return null;
+    const object = member.childForFieldName?.("object");
+    if (object?.type !== "identifier")
+      return null;
+    return object.text;
+  }
+  isSafeSqlAlchemyExpressionCall(node) {
+    if (node.type !== "call")
+      return false;
+    const callee = node.children?.[0]?.text ?? "";
+    const expression = node.text;
+    for (const name of PYTHON_SQLALCHEMY_STATEMENT_BUILDERS) {
+      if (callee === name || expression.startsWith(`${name}(`))
+        return true;
+    }
+    return false;
+  }
+  applyPostFilter(postFilter, postFilterParams, captures, rootNode) {
+    function extractSlots(classNode) {
+      const classText = classNode.text ?? "";
+      if (!classText.includes("__slots__"))
+        return null;
+      const body = classNode.children?.find((c) => c.type === "block");
+      if (!body)
+        return null;
+      const slots = [];
+      for (const stmt of body.children ?? []) {
+        if (stmt.type !== "expression_statement")
+          continue;
+        const assignment = stmt.children?.find((c) => c.type === "assignment");
+        if (!assignment)
+          continue;
+        const lhsText = (assignment.children?.[0]?.text ?? "").trim();
+        if (lhsText !== "__slots__")
+          continue;
+        const rhs = assignment.children?.[2];
+        if (!rhs)
+          continue;
+        if (rhs.type === "string") {
+          const s = (rhs.text ?? "").replace(/^["']|["']$/g, "");
+          if (s)
+            slots.push(s);
+        } else if (rhs.type === "tuple" || rhs.type === "list") {
+          for (const el of rhs.children ?? []) {
+            if (!el.isNamed)
+              continue;
+            if (el.type === "string") {
+              slots.push((el.text ?? "").replace(/^["']|["']$/g, ""));
+            }
+          }
+        }
+        break;
+      }
+      return slots;
+    }
+    switch (postFilter) {
+      case "no_nested_anchor_chain": {
+        try {
+          const outer = captures.OUTER_ELEMENT;
+          if (!outer) {
+            this.reportPostFilterFailure(postFilter, "missing OUTER_ELEMENT capture");
+            return true;
+          }
+          const isAnchorElement = (node) => {
+            if (node.type !== "jsx_element")
+              return false;
+            const opening = node.childForFieldName?.("open_tag") ?? node.children?.find((child) => child.type === "jsx_opening_element");
+            const name = opening?.childForFieldName?.("name") ?? opening?.children?.find((child) => child.type === "identifier");
+            return name?.text === "a";
+          };
+          let visited = 0;
+          let ancestor = outer.parent;
+          while (ancestor) {
+            if (++visited > NO_NESTED_ANCHOR_VISIT_CAP) {
+              this.reportPostFilterFailure(postFilter, `ancestor walk exceeded ${NO_NESTED_ANCHOR_VISIT_CAP} nodes`);
+              return true;
+            }
+            if (isAnchorElement(ancestor))
+              return false;
+            ancestor = ancestor.parent;
+          }
+          const pending = [...outer.children ?? []];
+          while (pending.length > 0) {
+            const node = pending.pop();
+            if (!node)
+              continue;
+            if (++visited > NO_NESTED_ANCHOR_VISIT_CAP) {
+              this.reportPostFilterFailure(postFilter, `descendant walk exceeded ${NO_NESTED_ANCHOR_VISIT_CAP} nodes`);
+              return true;
+            }
+            if (isAnchorElement(node))
+              return true;
+            pending.push(...node.children ?? []);
+          }
+          return false;
+        } catch (error) {
+          const reason = error instanceof Error ? error.message : String(error);
+          this.reportPostFilterFailure(postFilter, `tree walk failed${reason ? `: ${reason}` : ""}`);
+          return true;
+        }
+      }
+      case "differs_only_by_case": {
+        try {
+          const field = captures.FIELD?.text ?? "";
+          const method = captures.METHOD?.text ?? "";
+          return field !== method && field.toLocaleLowerCase() === method.toLocaleLowerCase();
+        } catch {
+          return true;
+        }
+      }
+      case "in_default_package": {
+        try {
+          if (!rootNode)
+            return true;
+          return !(rootNode.children ?? []).some((node) => node.type === "package_declaration");
+        } catch {
+          return true;
+        }
+      }
+      case "missing_mimetype_and_download_name": {
+        try {
+          const firstArg = captures.FIRST_ARG;
+          if (!firstArg)
+            return true;
+          if (firstArg.type === "string")
+            return false;
+          const args = firstArg.parent;
+          if (!args)
+            return true;
+          return !(args.children ?? []).some((node) => {
+            if (node.type !== "keyword_argument")
+              return false;
+            const name = node.childForFieldName?.("name")?.text;
+            return name === "mimetype" || name === "download_name";
+          });
+        } catch {
+          return true;
+        }
+      }
+      case "missing_super_call": {
+        try {
+          const body = captures.BODY;
+          const method = captures.METHOD?.text ?? "";
+          if (!body || !method)
+            return true;
+          const stack = [body];
+          for (let visited = 0;stack.length > 0 && visited < 1e4; visited++) {
+            const node = stack.pop();
+            if (!node)
+              break;
+            if (node.type === "method_invocation" && node.childForFieldName?.("object")?.text === "super" && node.childForFieldName?.("name")?.text === method) {
+              return false;
+            }
+            stack.push(...node.children ?? []);
+          }
+          return true;
+        } catch {
+          return true;
+        }
+      }
+      case "no_assertion_call": {
+        try {
+          const body = captures.BODY;
+          if (!body)
+            return true;
+          const assertionNames = /^(?:assert\w*|fail|verify|expect|check|assume\w*)$/i;
+          const stack = [body];
+          for (let visited = 0;stack.length > 0 && visited < 1e4; visited++) {
+            const node = stack.pop();
+            if (!node)
+              break;
+            if (node.type === "method_invocation") {
+              const name = node.childForFieldName?.("name")?.text ?? "";
+              if (assertionNames.test(name))
+                return false;
+            }
+            stack.push(...node.children ?? []);
+          }
+          return true;
+        } catch {
+          return true;
+        }
+      }
+      case "not_closed_or_try_with_resources": {
+        try {
+          const declaration = captures.DECL;
+          const resource = captures.RESOURCE?.text ?? "";
+          if (!declaration || !resource)
+            return true;
+          const scope = this.navigator.findParent(declaration, [
+            "method_declaration",
+            "constructor_declaration",
+            "block"
+          ]) ?? rootNode;
+          if (!scope)
+            return true;
+          const resourceWord = new RegExp(`\\b${escapeRegExp(resource)}\\b`);
+          const stack = [scope];
+          for (let visited = 0;stack.length > 0 && visited < 1e4; visited++) {
+            const node = stack.pop();
+            if (!node)
+              break;
+            if (node.type === "method_invocation" && node.childForFieldName?.("object")?.text === resource && node.childForFieldName?.("name")?.text === "close") {
+              return false;
+            }
+            if (node.type === "resource" && resourceWord.test(node.text ?? "")) {
+              return false;
+            }
+            stack.push(...node.children ?? []);
+          }
+          return true;
+        } catch {
+          return true;
+        }
+      }
+      case "same_method_no_base_case": {
+        try {
+          const method = captures.NAME?.text ?? "";
+          if (!method || captures.RECURSE?.text !== method)
+            return false;
+          const call = captures.CALL;
+          const declaration = call ? this.navigator.findParent(call, ["method_declaration"]) : undefined;
+          if (!declaration)
+            return true;
+          const stack = [declaration];
+          for (let visited = 0;stack.length > 0 && visited < 1e4; visited++) {
+            const node = stack.pop();
+            if (!node)
+              break;
+            if (node.type === "if_statement" || node.type === "switch_expression" || node.type === "switch_statement" || node.type === "while_statement" || node.type === "do_statement" || node.type === "for_statement" || node.type === "enhanced_for_statement" || node.type === "ternary_expression") {
+              return false;
+            }
+            stack.push(...node.children ?? []);
+          }
+          return stack.length > 0 ? false : true;
+        } catch {
+          return true;
+        }
+      }
+      case "memset_for_sensitive_data": {
+        try {
+          const destination = captures.DEST?.text ?? "";
+          const value = captures.VALUE?.text?.trim() ?? "";
+          if (!/^(?:0|0x0+|NULL|nullptr)$/.test(value))
+            return false;
+          return /(?:pass(?:word)?|passwd|secret|token|api_?key|private_?key|credential|auth|pin)/i.test(destination);
+        } catch {
+          return true;
+        }
+      }
+      case "unsafe_regex_dynamic_identifier": {
+        try {
+          const interpolationNode = captures.INTERPOLATION;
+          const interpolation = interpolationNode?.text ?? "";
+          const identifier = interpolation.match(/^\$\{\s*([A-Za-z_$][\w$]*)\s*\}$/)?.[1];
+          if (!identifier || !rootNode || !interpolationNode)
+            return true;
+          const useRow = interpolationNode.startPosition.row;
+          const hasEscapeSignal = (text) => /\b(?:escape|Escape)\w*\s*\(/.test(text) || /\.\s*replace\s*\(\s*\//.test(text);
+          let lastWriteRow = -1;
+          let lastWriteSafe = false;
+          const consider = (row, valueText) => {
+            if (row >= useRow || row < lastWriteRow)
+              return;
+            lastWriteRow = row;
+            lastWriteSafe = valueText !== undefined && hasEscapeSignal(valueText);
+          };
+          const stack = [rootNode];
+          while (stack.length > 0) {
+            const node = stack.pop();
+            if (!node)
+              continue;
+            if (node.type === "variable_declarator") {
+              const name = node.childForFieldName?.("name");
+              if (name?.text === identifier) {
+                const initializer = node.childForFieldName?.("value");
+                consider(node.startPosition.row, initializer?.text);
+              }
+            } else if (node.type === "assignment_expression") {
+              const left = node.childForFieldName?.("left");
+              if (left?.type === "identifier" && left.text === identifier) {
+                const right = node.childForFieldName?.("right");
+                consider(node.startPosition.row, right?.text);
+              }
+            }
+            stack.push(...node.children);
+          }
+          return lastWriteRow >= 0 && lastWriteSafe ? false : true;
+        } catch {
+          return true;
+        }
+      }
+      case "is_generator_with_valued_return": {
+        const returnNode = captures.RETURN;
+        const functionNode = captures.FUNCTION ?? (returnNode ? this.navigator.findParent(returnNode, ["function_definition"]) : undefined);
+        if (!functionNode)
+          return false;
+        if (this.hasChildToken(functionNode, "async"))
+          return false;
+        return this.containsYieldInFunctionBody(functionNode);
+      }
+      case "count_params": {
+        const paramsNode = captures.PARAMS;
+        if (!paramsNode)
+          return true;
+        const paramCount = paramsNode.children.filter((c) => {
+          if (c.type !== "required_parameter")
+            return false;
+          if (c.text.includes("="))
+            return false;
+          if (c.children?.some((ch) => ch.text === "?"))
+            return false;
+          return true;
+        }).length;
+        return paramCount >= (postFilterParams?.min_params ?? 6);
+      }
+      case "empty_body": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return true;
+        const meaningful = bodyNode.children.filter((c) => c.isNamed && c.type !== "comment" && c.type !== "line_comment" && c.type !== "block_comment");
+        return meaningful.length === 0;
+      }
+      case "is_empty_block": {
+        const caseNode = captures.CASE;
+        if (!caseNode)
+          return false;
+        if (this.switchCaseBodyStatements(caseNode).length > 0)
+          return false;
+        return !this.nextSiblingIsSwitchLabel(caseNode);
+      }
+      case "no_break_or_return_in_body": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return false;
+        return !this.bodyHasLoopExit(bodyNode, false);
+      }
+      case "same_param_name": {
+        const first = this.bindingNames(captures.PARAM1);
+        const second = this.bindingNames(captures.NAME);
+        return [...first].some((name) => second.has(name));
+      }
+      case "no_terminating_statement": {
+        const caseNode = captures.CASE;
+        if (!caseNode)
+          return false;
+        if (this.hasFallthroughMarker(caseNode))
+          return false;
+        const body = this.switchCaseBodyStatements(caseNode);
+        if (body.length === 0)
+          return false;
+        return !this.statementTerminates(body[body.length - 1]);
+      }
+      case "no_break_or_return": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return false;
+        return !this.bodyHasLoopExit(bodyNode, false);
+      }
+      case "is_double_checked_locking": {
+        const outer = captures.FIELD?.text;
+        const inner = captures.FIELD2?.text;
+        return !!outer && outer === inner;
+      }
+      case "shadows_parent_field": {
+        const parentName = captures.PARENT?.text;
+        const fieldName = captures.NAME?.text;
+        if (!parentName || !fieldName)
+          return false;
+        let root = captures.NAME;
+        while (root.parent)
+          root = root.parent;
+        const stack = [root];
+        while (stack.length) {
+          const node = stack.pop();
+          if (node.type === "class_declaration" && node.childForFieldName?.("name")?.text === parentName) {
+            const body = node.childForFieldName?.("body");
+            for (const member of body?.children ?? []) {
+              if (member.type !== "field_declaration")
+                continue;
+              for (const declarator of member.children ?? []) {
+                if (declarator.type === "variable_declarator" && declarator.childForFieldName?.("name")?.text === fieldName) {
+                  return true;
+                }
+              }
+            }
+          }
+          for (const child of node.children ?? [])
+            stack.push(child);
+        }
+        return false;
+      }
+      case "missing_break_between_cases": {
+        const label = captures.LABEL;
+        const group = label?.parent;
+        if (!group)
+          return false;
+        const TERMINATORS = new Set([
+          "break_statement",
+          "return_statement",
+          "throw_statement",
+          "continue_statement",
+          "yield_statement"
+        ]);
+        for (const child of group.children ?? []) {
+          if (TERMINATORS.has(child.type))
+            return false;
+        }
+        return true;
+      }
+      case "scoped_lock_empty_args": {
+        const decl = captures.DECL;
+        if (!decl)
+          return false;
+        for (const sibling of decl.parent?.children ?? []) {
+          if (sibling.type === "argument_list")
+            return false;
+        }
+        return true;
+      }
+      case "calc_missing_spaces": {
+        const text = captures.EXPR?.text ?? "";
+        return /[\w%)][+-][\w.(]/.test(text);
+      }
+      case "bare_except_only": {
+        const clauseNode = captures.CLAUSE;
+        if (!clauseNode)
+          return true;
+        const hasExceptionSpec = clauseNode.children.some((c) => {
+          if (!c.isNamed)
+            return false;
+          return c.type !== "block";
+        });
+        return !hasExceptionSpec;
+      }
+      case "eq_mod_fn": {
+        const mod = captures.MOD?.text ?? "";
+        const fn = captures.FN?.text ?? "";
+        return mod === "threading" && fn === "Thread";
+      }
+      case "regex_first_arg_identifier": {
+        const mod = captures.MOD?.text ?? "";
+        if (mod !== "re")
+          return false;
+        const func = captures.FUNC?.text ?? "";
+        if (!/^(compile|match|search|fullmatch|findall|finditer|sub|subn|split)$/.test(func)) {
+          return false;
+        }
+        const argsNode = captures.ARGS;
+        if (!argsNode)
+          return false;
+        const firstNamed = (argsNode.children ?? []).find((c) => c.isNamed);
+        if (!firstNamed)
+          return false;
+        return firstNamed.type === "identifier";
+      }
+      case "open_mode_invalid": {
+        const modeNode = captures.MODE;
+        if (!modeNode)
+          return false;
+        const text = modeNode.text ?? "";
+        const stripped = text.replace(/^["']|["']$/g, "");
+        if (stripped.length === 0)
+          return false;
+        if (stripped.length === 1)
+          return false;
+        if (!/^[rwxabt+]+$/.test(stripped))
+          return true;
+        const validShape = /^[rwax][bt]?\+?$/;
+        if (!validShape.test(stripped))
+          return true;
+        return false;
+      }
+      case "status_204_with_value_return": {
+        const funcNode = captures.FUNC;
+        const valNode = captures.VAL;
+        if (!funcNode || !valNode)
+          return false;
+        if (Number(valNode.text ?? 0) !== 204)
+          return false;
+        const queue = [funcNode];
+        while (queue.length > 0) {
+          const node = queue.shift();
+          if (node.type === "return_statement") {
+            const hasValue = node.children.some((c) => c.isNamed && c.type !== "comment");
+            if (hasValue)
+              return true;
+          }
+          if (node.children)
+            queue.push(...node.children);
+        }
+        return false;
+      }
+      case "has_mixed_async": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return true;
+        const bodyText = bodyNode.text;
+        return bodyText.includes("await") && /\.\s*(then|catch)\s*\(/.test(bodyText);
+      }
+      case "format_arity_mismatch": {
+        const formatNode = captures.FORMAT;
+        const argsNode = captures.ARGS;
+        if (!formatNode || !argsNode)
+          return false;
+        const fmtText = (formatNode.text ?? "").replace(/^["']|["']$/g, "");
+        const fmt = fmtText;
+        let placeholderCount = 0;
+        const namedKeys = [];
+        const positionalRegex = /%(?:\([^)]+\))?[#0\- +]*\d*(?:\.\d+)?[hlL]?[diouxXeEfFgGcrs%]/g;
+        const positionalMatches = fmt.match(positionalRegex) ?? [];
+        for (const m of positionalMatches) {
+          if (m === "%%")
+            continue;
+          placeholderCount++;
+          const namedMatch = m.match(/^%\(([^)]+)\)/);
+          if (namedMatch)
+            namedKeys.push(namedMatch[1]);
+        }
+        if (namedKeys.length > 0) {
+          if (argsNode.type === "dictionary") {
+            const dictKeys = [];
+            for (const child of argsNode.children ?? []) {
+              if (child.type === "pair" && child.children?.[0]) {
+                dictKeys.push((child.children[0].text ?? "").replace(/^["']|["']$/g, ""));
+              }
+            }
+            const missing = namedKeys.filter((k) => !dictKeys.includes(k));
+            return missing.length > 0;
+          }
+          return true;
+        }
+        if (argsNode.type === "tuple") {
+          const argCount = (argsNode.children ?? []).filter((c) => c.isNamed).length;
+          if (argCount !== placeholderCount)
+            return true;
+        }
+        return false;
+      }
+      case "aws_policy_public": {
+        const policyNode = captures.POLICY;
+        if (!policyNode)
+          return false;
+        const text = policyNode.text ?? "";
+        const patterns = [
+          /"Principal"\s*:\s*"\*"/,
+          /"Principal"\s*:\s*\{\s*"AWS"\s*:\s*"\*"\s*\}/,
+          /"Effect"\s*:\s*"Allow"[\s\S]*?"Action"\s*:\s*"\*"[\s\S]*?"Resource"\s*:\s*"\*"/,
+          /"Principal"\s*:\s*"\*"/
+        ];
+        return patterns.some((p) => p.test(text));
+      }
+      case "slots_attribute_mismatch": {
+        const selfNode = captures.SELF;
+        const attrNode = captures.ATTR;
+        const methodNode = captures.METHOD;
+        if (!selfNode || !attrNode || !methodNode)
+          return false;
+        if (selfNode.text !== "self")
+          return false;
+        const attrName = attrNode.text ?? "";
+        let parent = methodNode.parent;
+        while (parent && parent.type !== "class_definition") {
+          parent = parent.parent;
+        }
+        if (!parent)
+          return false;
+        const slots = extractSlots(parent);
+        if (slots === null || slots.length === 0)
+          return false;
+        return !slots.includes(attrName);
+      }
+      case "special_method_arity": {
+        const nameNode = captures.NAME;
+        const paramsNode = captures.PARAMS;
+        if (!nameNode || !paramsNode)
+          return false;
+        const name = nameNode.text ?? "";
+        const expected = {
+          __del__: 0,
+          __repr__: 0,
+          __str__: 0,
+          __hash__: 0,
+          __bool__: 0,
+          __len__: 0,
+          __eq__: 1,
+          __lt__: 1,
+          __le__: 1,
+          __gt__: 1,
+          __ge__: 1,
+          __ne__: 1
+        };
+        const expectedCount = expected[name];
+        if (expectedCount === undefined)
+          return false;
+        const paramCount = (paramsNode.children ?? []).filter((c) => {
+          if (c.type !== "identifier" && c.type !== "typed_parameter")
+            return false;
+          if (c.text.includes("="))
+            return false;
+          return true;
+        }).length;
+        return paramCount !== expectedCount + 1;
+      }
+      case "no_super_call": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return true;
+        return !/(?<!\/\/.*)super\s*\(/.test(bodyNode.text);
+      }
+      case "in_test_block": {
+        const first = Object.values(captures)[0];
+        return !!first && this.navigator.isInTestBlock(first);
+      }
+      case "not_in_test_block": {
+        const first = Object.values(captures)[0];
+        return !first || !this.navigator.isInTestBlock(first);
+      }
+      case "not_in_try_catch": {
+        const first = Object.values(captures)[0];
+        return !first || !this.navigator.isInTryCatch(first);
+      }
+      case "in_try_catch": {
+        const first = Object.values(captures)[0];
+        return !!first && this.navigator.isInTryCatch(first);
+      }
+      case "name_matches_param": {
+        const nameNode = captures.NAME;
+        const paramNode = captures.PARAM;
+        return !!nameNode && !!paramNode && nameNode.text === paramNode.text;
+      }
+      case "not_in_function": {
+        const first = Object.values(captures)[0];
+        return !first || !this.navigator.isInside(first, [
+          "function_definition",
+          "function_declaration",
+          "method_definition",
+          "arrow_function"
+        ]);
+      }
+      case "check_secret_pattern": {
+        const varName = captures.VARNAME?.text ?? "";
+        const varNameLower = varName.toLowerCase();
+        if (varName === varName.toUpperCase() && /[A-Z]/.test(varName)) {
+          return false;
+        }
+        return [
+          /api[_-]?key/,
+          /api[_-]?secret/,
+          /password/,
+          /passwd/,
+          /secret/,
+          /token/,
+          /auth/,
+          /private[_-]?key/,
+          /access[_-]?token/,
+          /credentials/,
+          /aws[_-]?secret/,
+          /github[_-]?token/,
+          /client[_-]?secret/
+        ].some((p) => p.test(varNameLower));
+      }
+      case "returns_error": {
+        const first = Object.values(captures)[0];
+        if (!first)
+          return false;
+        const funcNode = this.navigator.findParent(first, [
+          "function_declaration",
+          "method_declaration"
+        ]);
+        if (!funcNode)
+          return false;
+        const signature = String(funcNode.text ?? "").split("{", 1)[0]?.trim() ?? "";
+        const returnPart = signature.match(/func\s*(?:\([^)]*\)\s*)?[A-Za-z_]\w*\s*\([^)]*\)\s*(.*)$/s)?.[1]?.trim() ?? "";
+        return returnPart.length > 0 && /\berror\b/.test(returnPart);
+      }
+      case "python_empty_except": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return true;
+        return !bodyNode.children.some((c) => c.isNamed && c.type !== "pass_statement" && c.type !== "comment");
+      }
+      case "check_in_operator_types": {
+        const target = captures.TARGET;
+        if (!target)
+          return false;
+        return ["none", "true", "false", "integer", "float"].includes(target.type);
+      }
+      case "torchscript_super_call": {
+        const call = captures.CALL;
+        if (!call)
+          return false;
+        const isTorchScriptDecorated = (node) => {
+          const decorated = node?.parent;
+          if (!decorated || decorated.type !== "decorated_definition")
+            return false;
+          return (decorated.children ?? []).some((c) => c.type === "decorator" && /^@(torch\.jit\.script|jit\.script)$/.test(c.text ?? ""));
+        };
+        const methodNode = this.navigator.findParent(call, [
+          "function_definition"
+        ]);
+        if (!methodNode)
+          return false;
+        const classNode = this.navigator.findParent(methodNode, [
+          "class_definition"
+        ]);
+        return isTorchScriptDecorated(methodNode) || isTorchScriptDecorated(classNode);
+      }
+      case "exit_params_insufficient": {
+        const params = captures.PARAMS;
+        if (!params)
+          return true;
+        const named = (params.children ?? []).filter((c) => c.isNamed);
+        if (named.some((c) => c.type === "list_splat_pattern" || c.type === "dictionary_splat_pattern")) {
+          return false;
+        }
+        return named.length < 4;
+      }
+      case "ruby_empty_rescue": {
+        const bodyNode = captures.BODY;
+        if (!bodyNode)
+          return true;
+        return !bodyNode.children.some((c) => c.isNamed && !["comment", "nil", "nil_literal"].includes(c.type));
+      }
+      case "ts_command_injection_sink":
+        return captures.MOD?.text === "child_process" && /^(exec|execSync)$/.test(captures.FN?.text ?? "");
+      case "ts_sql_injection_sink": {
+        const template = captures.TEMPLATE?.text ?? "";
+        const rawPrefix = template.replace(/^`/, "").replace(/`$/, "").replace(/^(?:\s|\/\*[\s\S]*?\*\/|--[^\n]*(?:\n|$))*/, "");
+        if (/^(?:SELECT[\s\S]*(?:\bFROM\b|\$\{)|INSERT\s+INTO\b|UPDATE\s+[\s\S]*\bSET\b|DELETE\s+FROM\b|CREATE\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|DROP\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|ALTER\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|GRANT\b|REVOKE\b|WITH[\s\S]*\bSELECT\b|MERGE\s+INTO\b|TRUNCATE\s+TABLE\b|REPLACE\s+INTO\b)/i.test(rawPrefix))
+          return true;
+        if (!rootNode || !captures.OBJ)
+          return false;
+        let imported = TYPESCRIPT_SQL_IMPORTS.get(rootNode);
+        if (!imported) {
+          const names = new Set;
+          const stack = [rootNode];
+          while (stack.length > 0) {
+            const node = stack.pop();
+            if (!node)
+              continue;
+            if (node.type === "import_statement") {
+              const source = node.childForFieldName?.("source")?.text ?? "";
+              const packageName = source.replace(/^['"]|['"]$/g, "");
+              const isKnown = [...TYPESCRIPT_SQL_KNOWN_PACKAGES].some((pkg) => packageName === pkg || packageName.startsWith(`${pkg}/`));
+              if (isKnown) {
+                const importStack = [node];
+                while (importStack.length > 0) {
+                  const importNode = importStack.pop();
+                  if (!importNode)
+                    continue;
+                  if (importNode.type === "identifier" || importNode.type === "import_specifier") {
+                    names.add(importNode.text);
+                  }
+                  importStack.push(...importNode.children);
+                }
+              }
+            }
+            stack.push(...node.children);
+          }
+          const declarations = new Map;
+          const declarationStack = [rootNode];
+          while (declarationStack.length > 0) {
+            const node = declarationStack.pop();
+            if (!node)
+              continue;
+            if (node.type === "variable_declarator") {
+              const name = node.childForFieldName?.("name")?.text;
+              const value = node.childForFieldName?.("value");
+              if (name && value)
+                declarations.set(name, value);
+            }
+            declarationStack.push(...node.children);
+          }
+          const resolvesKnownValue = (node, seen = new Set) => {
+            if (node.type === "identifier") {
+              if (names.has(node.text))
+                return true;
+              if (seen.has(node.text))
+                return false;
+              const value = declarations.get(node.text);
+              if (!value)
+                return false;
+              seen.add(node.text);
+              return resolvesKnownValue(value, seen);
+            }
+            if (node.type === "await_expression") {
+              const value = node.children.find((child) => child.isNamed);
+              return value ? resolvesKnownValue(value, seen) : false;
+            }
+            if (node.type === "new_expression") {
+              const ctor = node.childForFieldName?.("constructor");
+              return ctor ? resolvesKnownValue(ctor, seen) : false;
+            }
+            if (node.type === "call_expression") {
+              const fn = node.childForFieldName?.("function");
+              return fn ? resolvesKnownValue(fn, seen) : false;
+            }
+            return false;
+          };
+          let changed = true;
+          while (changed) {
+            changed = false;
+            for (const [name, value] of declarations) {
+              if (!names.has(name) && resolvesKnownValue(value)) {
+                names.add(name);
+                changed = true;
+              }
+            }
+          }
+          imported = names;
+          TYPESCRIPT_SQL_IMPORTS.set(rootNode, imported);
+        }
+        const resolvesToKnownClient = (node) => {
+          if (node.type === "identifier")
+            return imported.has(node.text);
+          if (node.type === "await_expression") {
+            const value = node.children.find((child) => child.isNamed);
+            return value ? resolvesToKnownClient(value) : false;
+          }
+          if (node.type === "new_expression") {
+            const ctor = node.childForFieldName?.("constructor");
+            return ctor ? resolvesToKnownClient(ctor) : false;
+          }
+          if (node.type === "call_expression") {
+            const fn = node.childForFieldName?.("function");
+            return fn ? resolvesToKnownClient(fn) : false;
+          }
+          return false;
+        };
+        return resolvesToKnownClient(captures.OBJ);
+      }
+      case "ts_ssrf_sink": {
+        const fn = captures.FN?.text ?? "";
+        const obj = captures.OBJ?.text ?? "";
+        const urlText = captures.URL?.text ?? "";
+        const allowedFns = new Set([
+          "fetch",
+          "request",
+          "get",
+          "post",
+          "put",
+          "patch",
+          "delete"
+        ]);
+        if (!allowedFns.has(fn))
+          return false;
+        if (rootNode && captures.URL?.type === "identifier" && this.resolvesToFileLiteralConst(urlText, rootNode)) {
+          return false;
+        }
+        if (rootNode && captures.URL) {
+          const urlVar = this.newUrlBaseVarName(captures.URL);
+          if (urlVar && this.resolvesToFixedNewUrlConst(urlVar, rootNode)) {
+            return false;
+          }
+        }
+        const looksLikeExternalInput = urlText.includes(".") || /user|external|remote|input|target|webhook|callback|redirect|untrusted|arbitrary/i.test(urlText);
+        if (!looksLikeExternalInput)
+          return false;
+        if (!obj)
+          return fn === "fetch";
+        return new Set([
+          "axios",
+          "http",
+          "https",
+          "got",
+          "request",
+          "superagent",
+          "undici"
+        ]).has(obj);
+      }
+      case "ts_weak_hash_algorithm":
+        return captures.FN?.text === "createHash" && /^(md5|sha1)$/i.test(captures.ALG?.text ?? "");
+      case "ts_insecure_random_source": {
+        if (captures.OBJ?.text !== "Math" || captures.FN?.text !== "random")
+          return false;
+        const varName = this.enclosingBindingName(captures.CALL ?? captures.VAR);
+        return /token|secret|password|key|nonce|salt|csrf|auth|session|credential|hash|otp|pin/i.test(varName);
+      }
+      case "ts_detached_async_call":
+        return /(Async$|fetch$|request$)/.test(captures.FN?.text ?? "");
+      case "incomplete_assertion": {
+        const expectNode = captures.EXPECT;
+        if (!expectNode)
+          return false;
+        const CHAI_PROPERTY_ASSERTIONS = new Set([
+          "true",
+          "false",
+          "null",
+          "undefined",
+          "empty",
+          "NaN",
+          "finite",
+          "exist",
+          "arguments",
+          "extensible",
+          "sealed",
+          "frozen",
+          "locked"
+        ]);
+        let current = expectNode.parent;
+        if (!current)
+          return false;
+        current = current.parent;
+        if (!current)
+          return false;
+        if (current.type === "expression_statement" || current.type === "return_statement")
+          return true;
+        let lastPropertyName = null;
+        while (current && current.type === "member_expression") {
+          const propNode = current.children?.find((c) => c.type === "property_identifier");
+          if (propNode)
+            lastPropertyName = propNode.text;
+          const parent = current.parent;
+          if (!parent)
+            return false;
+          if (parent.type === "expression_statement" || parent.type === "return_statement") {
+            if (lastPropertyName && CHAI_PROPERTY_ASSERTIONS.has(lastPropertyName))
+              return false;
+            return true;
+          }
+          if (parent.type === "call_expression")
+            return false;
+          current = parent;
+        }
+        return false;
+      }
+      case "py_command_injection_sink": {
+        const mod = captures.MOD?.text ?? "";
+        const fn = captures.FN?.text ?? "";
+        const kw = captures.KW?.text ?? "";
+        return mod === "os" && /^(system|popen)$/.test(fn) || mod === "subprocess" && /^(run|Popen|call|check_output|check_call)$/.test(fn) && kw === "shell";
+      }
+      case "go_command_injection_sink":
+        return captures.PKG?.text === "exec" && /^(Command|CommandContext)$/.test(captures.FN?.text ?? "") && /^"(sh|bash|zsh|cmd|powershell|pwsh)"$/.test(captures.SHELL?.text ?? "") && /^"(-c|\/c)"$/.test(captures.FLAG?.text ?? "");
+      case "ruby_command_injection_sink":
+        return /^(system|exec|spawn|popen|capture3|capture2|capture2e)$/.test(captures.FN?.text ?? "");
+      case "py_ssrf_sink":
+        return captures.MOD?.text === "requests" && /^(get|post|put|patch|delete|request|head|options)$/.test(captures.FN?.text ?? "");
+      case "py_path_traversal_sink":
+        return /^(open|read_text|read_bytes|write_text|write_bytes|remove|unlink|rmdir)$/.test(captures.FN?.text ?? "");
+      case "go_path_traversal_sink":
+        return /^(os|ioutil)$/.test(captures.PKG?.text ?? "") && /^(Open|OpenFile|ReadFile|WriteFile|Create|Remove|RemoveAll)$/.test(captures.FN?.text ?? "");
+      case "py_sql_injection_sink": {
+        const fn = captures.FN?.text ?? "";
+        if (!PYTHON_SQL_SINK_METHODS.has(fn))
+          return false;
+        const sqlNode = captures.SQL;
+        const receiver = captures.OBJ;
+        if (fn === "execute" && this.isLikelySqlAlchemyReceiver(receiver?.text ?? "")) {
+          return false;
+        }
+        if (sqlNode && this.isSafeSqlAlchemyExpressionCall(sqlNode)) {
+          return false;
+        }
+        if (isProvenSqlAlchemySessionReceiver(receiver, rootNode)) {
+          if (fn === "query" && isSqlAlchemyEntityQueryArgument(sqlNode, rootNode)) {
+            return false;
+          }
+          if (fn === "execute" && isSqlAlchemyStatementArgument(sqlNode, rootNode)) {
+            return false;
+          }
+        }
+        if (isSafePsycopgIdentifierComposition(sqlNode, rootNode)) {
+          return false;
+        }
+        return true;
+      }
+      case "go_sql_injection_sink":
+        return /^(Query|QueryContext|QueryRow|QueryRowContext|Exec|ExecContext)$/.test(captures.DBFN?.text ?? "") && captures.FMTPKG?.text === "fmt" && captures.FMTFN?.text === "Sprintf";
+      case "py_insecure_deserialization_sink":
+        return /^(pickle|yaml)$/.test(captures.MOD?.text ?? "") && /^(load|loads|unsafe_load)$/.test(captures.FN?.text ?? "");
+      case "ruby_insecure_deserialization_sink":
+        return /^(Marshal|YAML|Psych)$/.test(captures.MOD?.text ?? "") && /^(load|unsafe_load)$/.test(captures.FN?.text ?? "");
+      case "match_captures": {
+        for (const [captureName, pattern] of Object.entries(postFilterParams ?? {})) {
+          const node = captures[captureName];
+          if (!node)
+            return false;
+          if (!new RegExp(pattern).test(node.text))
+            return false;
+        }
+        return true;
+      }
+      case "case_range_single_value": {
+        const start = captures.START?.text ?? "";
+        const end = captures.END?.text ?? "";
+        return start === end;
+      }
+      case "goto_jumps_backward": {
+        const label = captures.LABEL;
+        const gotoNode = captures.GOTO;
+        if (!label || !gotoNode)
+          return false;
+        return label.startIndex < gotoNode.startIndex;
+      }
+      case "goto_targets_inner_block": {
+        const target = captures.TARGET;
+        if (!target)
+          return false;
+        let depth = 0;
+        let node = target.parent;
+        while (node) {
+          if (node.type === "compound_statement")
+            depth++;
+          node = node.parent;
+        }
+        return depth >= 2;
+      }
+      case "c_memset_sensitive_arg": {
+        const callNode = captures.CALL;
+        if (!callNode || callNode.type !== "call_expression")
+          return false;
+        const argList = callNode.children?.find((c) => c.type === "argument_list");
+        if (!argList)
+          return false;
+        const firstArg = argList.children?.find((c) => c.isNamed);
+        if (!firstArg)
+          return false;
+        const argName = firstArg.text ?? "";
+        return /password|secret|key|token|credential|auth|private|passwd|pin|salt|nonce|iv|seed/i.test(argName);
+      }
+      case "c_stdlib_name": {
+        const name = captures.NAME?.text ?? "";
+        const STDLIB_NAMES = new Set([
+          "malloc",
+          "calloc",
+          "realloc",
+          "free",
+          "alloca",
+          "printf",
+          "fprintf",
+          "sprintf",
+          "snprintf",
+          "vprintf",
+          "vfprintf",
+          "vsprintf",
+          "vsnprintf",
+          "scanf",
+          "fscanf",
+          "sscanf",
+          "vscanf",
+          "vfscanf",
+          "vsscanf",
+          "strcpy",
+          "strncpy",
+          "strcat",
+          "strncat",
+          "strcmp",
+          "strncmp",
+          "strlen",
+          "strchr",
+          "strrchr",
+          "strstr",
+          "strerror",
+          "memcpy",
+          "memmove",
+          "memset",
+          "memcmp",
+          "memchr",
+          "fopen",
+          "fclose",
+          "fread",
+          "fwrite",
+          "fgets",
+          "fputs",
+          "getc",
+          "putc",
+          "getchar",
+          "putchar",
+          "exit",
+          "abort",
+          "assert",
+          "errno",
+          "abs",
+          "labs",
+          "llabs",
+          "div",
+          "ldiv",
+          "lldiv",
+          "atoi",
+          "atol",
+          "atoll",
+          "strtol",
+          "strtoll",
+          "strtoul",
+          "strtoull",
+          "strtod",
+          "strtof",
+          "strtold",
+          "qsort",
+          "bsearch",
+          "time",
+          "clock",
+          "difftime",
+          "mktime",
+          "strftime",
+          "getenv",
+          "setenv",
+          "putenv",
+          "system",
+          "isalpha",
+          "isdigit",
+          "isalnum",
+          "isspace",
+          "isupper",
+          "islower",
+          "toupper",
+          "tolower",
+          "sizeof",
+          "offsetof",
+          "NULL",
+          "EXIT_SUCCESS",
+          "EXIT_FAILURE"
+        ]);
+        return STDLIB_NAMES.has(name);
+      }
+      case "c_octal_literal": {
+        const num = captures.NUM?.text ?? "";
+        return /^0[0-7]+$/.test(num);
+      }
+      case "c_noreturn_attr": {
+        const attr = captures.ATTR?.text ?? "";
+        return attr === "noreturn";
+      }
+      case "c_label_in_switch": {
+        const stmt = captures.STMT;
+        if (!stmt)
+          return false;
+        let node = stmt.parent;
+        while (node) {
+          if (node.type === "switch_statement")
+            return true;
+          node = node.parent;
+        }
+        return false;
+      }
+      default:
+        this.reportMissingPostFilter(postFilter);
+        return false;
+    }
+  }
+  reportedMissingPostFilters = new Set;
+  reportedPostFilterFailures = new Set;
+  reportPostFilterFailure(postFilter, reason) {
+    if (this.reportedPostFilterFailures.has(postFilter))
+      return;
+    this.reportedPostFilterFailures.add(postFilter);
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      message: `tree-sitter rule post_filter '${postFilter}' failed — ` + `keeping the diagnostic (fail-open): ${reason}.`,
+      metadata: { postFilter }
+    });
+  }
+  reportMissingPostFilter(postFilter) {
+    if (this.reportedMissingPostFilters.has(postFilter))
+      return;
+    this.reportedMissingPostFilters.add(postFilter);
+    logTreeSitterDiagnostic({
+      subsystem: "tree-sitter-client",
+      message: `tree-sitter rule post_filter '${postFilter}' is not implemented — ` + `matches for the rules using it are suppressed rather than reported unfiltered. ` + `Implement it in applyPostFilter (clients/tree-sitter-client.ts) to re-enable them.`,
+      metadata: { postFilter }
+    });
+  }
+  textPredicatesInvalidLogged = false;
+  hasValidTextPredicates(query) {
+    const valid = Array.isArray(query?.textPredicates);
+    if (!valid) {
+      if (!this.textPredicatesInvalidLogged) {
+        this.textPredicatesInvalidLogged = true;
+        logTreeSitterDiagnostic({
+          subsystem: "tree-sitter-client",
+          message: "web-tree-sitter Query.textPredicates is missing or not an array — " + "#match?/#eq? predicates cannot be evaluated. Failing CLOSED: matches " + "for this query are dropped rather than reported unfiltered.",
+          metadata: { textPredicatesType: typeof query?.textPredicates }
+        });
+      }
+      recordDegradationOnce({
+        kind: "query-predicates-invalid",
+        subject: "web-tree-sitter",
+        reason: "Query.textPredicates is missing or not an array — #match?/#eq? " + "predicates cannot be evaluated; structural matches relying on them " + "are dropped fail-closed"
+      });
+    }
+    return valid;
+  }
+  evaluatePredicates(query, match) {
+    if (!this.hasValidTextPredicates(query))
+      return false;
+    const predicates = query.textPredicates?.[match.patternIndex] ?? [];
+    return predicates.every((fn) => fn(match.captures));
+  }
+  async searchFileWithQuery(filePath, query, metavars, languageId, _originalPattern, postFilter, postFilterParams, contentOverride) {
+    const matches = [];
+    await this.parseFileAndUse(filePath, languageId, contentOverride, (tree) => {
+      try {
+        const rootNode = tree.rootNode;
+        const queryMatches = query.matches(rootNode);
+        for (const match of queryMatches) {
+          const captures = {};
+          for (const capture of match.captures) {
+            if (metavars.includes(capture.name)) {
+              captures[capture.name] = capture.node;
+            }
+          }
+          if (!this.evaluatePredicates(query, match)) {
+            continue;
+          }
+          if (postFilter && !this.applyPostFilter(postFilter, postFilterParams, captures, rootNode)) {
+            continue;
+          }
+          if (match.captures.length > 0) {
+            const firstNode = match.captures[0].node;
+            const textCaptures = {};
+            for (const [name, node] of Object.entries(captures)) {
+              textCaptures[name] = node.text;
+            }
+            matches.push({
+              file: filePath,
+              line: firstNode.startPosition.row + 1,
+              column: firstNode.startPosition.column + 1,
+              matchedText: firstNode.text,
+              nodeType: firstNode.type,
+              captures: textCaptures
+            });
+          }
+        }
+        if (matches.length > 0) {
+          this.dbg(`Found ${matches.length} matches in ${path.basename(filePath)}`);
+        }
+      } catch (err) {
+        this.reportWasmAbort(err);
+        this.dbg(`Query matching error: ${err}`);
+      }
+    });
+    return matches;
+  }
+  collectFiles(dir, languageId, fileFilter) {
+    const files = [];
+    const extensions = this.getExtensionsForLanguage(languageId);
+    const rootDir = path.resolve(dir);
+    const ignoreMatcher = getProjectIgnoreMatcher(rootDir);
+    const scan = (d) => {
+      if (files.length >= TREE_SITTER_MAX_SCAN_FILES)
+        return;
+      try {
+        const entries = fs.readdirSync(d, { withFileTypes: true });
+        for (const entry of entries) {
+          if (files.length >= TREE_SITTER_MAX_SCAN_FILES)
+            return;
+          const full = path.join(d, entry.name);
+          if (entry.isDirectory()) {
+            if (isExcludedDirName(entry.name))
+              continue;
+            if (ignoreMatcher.isIgnored(full, true))
+              continue;
+            scan(full);
+          } else if (extensions.some((ext) => entry.name.endsWith(ext))) {
+            if (ignoreMatcher.isIgnored(full, false))
+              continue;
+            if (!fileFilter || fileFilter(full)) {
+              files.push(full);
+            }
+          }
+        }
+      } catch {}
+    };
+    scan(rootDir);
+    return files;
+  }
+  getExtensionsForLanguage(languageId) {
+    const mapping = {
+      typescript: [".ts", ".mts", ".cts"],
+      tsx: [".tsx"],
+      javascript: [".js", ".mjs", ".cjs"],
+      python: [".py"],
+      rust: [".rs"],
+      go: [".go"],
+      java: [".java"],
+      kotlin: [".kt", ".kts"],
+      dart: [".dart"],
+      c: [".c", ".h"],
+      cpp: [".cpp", ".hpp", ".cc", ".hh"],
+      elixir: [".ex", ".exs"],
+      ruby: [".rb"]
+    };
+    return mapping[languageId] || [];
+  }
+}