@herbertgao/pi-extensions 2026.10.1 → 2026.10.2

package/node_modules/pi-lens/dist/clients/dispatch/rules/async-noise.js

@@ -1,40 +0,0 @@
-import { isTestFile } from "../../file-utils.js";
-export const asyncNoiseRule = {
-    id: "async-noise",
-    requires: ["file.functionSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath) && !isTestFile(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const summaries = store.getFileFact(ctx.filePath, "file.functionSummaries");
-        if (!summaries)
-            return [];
-        const diagnostics = [];
-        // Function name patterns that legitimately declare async for interface compliance
-        // or future-proofing (lifecycle hooks, event handlers, middleware, abstract stubs)
-        const ASYNC_INTERFACE_PATTERN = /^(on[A-Z]|handle[A-Z]|before[A-Z]|after[A-Z]|setup|teardown|init|dispose|connect|disconnect|open|close|start|stop|run|execute|invoke|dispatch|middleware)/;
-        for (const fn of summaries) {
-            if (fn.isAsync &&
-                !fn.hasAwait &&
-                !fn.hasReturnAwaitCall &&
-                !fn.isPassThroughWrapper &&
-                !fn.hasExplicitPromiseReturnType &&
-                !ASYNC_INTERFACE_PATTERN.test(fn.name) &&
-                // Skip single-statement functions — likely interface stubs or thin wrappers
-                fn.statementCount > 1) {
-                diagnostics.push({
-                    id: `async-noise:${ctx.filePath}:${fn.line}:${fn.column}`,
-                    tool: "fact-rules",
-                    filePath: ctx.filePath,
-                    line: fn.line,
-                    column: fn.column,
-                    severity: "warning",
-                    semantic: "warning",
-                    message: `Async function '${fn.name}' has no await and appears to add async noise`,
-                    rule: "async-noise",
-                });
-            }
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/async-unnecessary-wrapper.js

@@ -1,27 +0,0 @@
-export const asyncUnnecessaryWrapperRule = {
-    id: "async-unnecessary-wrapper",
-    requires: ["file.functionSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
-        const diagnostics = [];
-        for (const f of fns) {
-            if (!f.isAsync || !f.isPassThroughWrapper || f.hasAwait)
-                continue;
-            diagnostics.push({
-                id: `async-unnecessary-wrapper:${ctx.filePath}:${f.line}`,
-                tool: "fact-rules",
-                rule: "async-unnecessary-wrapper",
-                filePath: ctx.filePath,
-                line: f.line,
-                column: f.column,
-                severity: "warning",
-                semantic: "warning",
-                message: `'${f.name}' is async but has no await and just forwards to '${f.passThroughTarget}' — the async keyword is unnecessary and wraps the return in an extra Promise`,
-            });
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/cors-wildcard.js

@@ -1,54 +0,0 @@
-/**
- * cors-wildcard — Access-Control-Allow-Origin: * (TS/JS/Python/Go). Regex/line-based
- * (no compiler); formerly SN-004 in the SonarJS-inspired batch (#402).
- */
-export const corsWildcardRule = {
-    id: "cors-wildcard",
-    requires: ["file.content"],
-    appliesTo(ctx) {
-        return /\.(tsx?|py|go)$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const content = store.getFileFact(ctx.filePath, "file.content");
-        if (!content)
-            return [];
-        const diagnostics = [];
-        const lines = content.split("\n");
-        for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
-            if (/^\s*(?:\/\/|\*|#|\/)/.test(line))
-                continue;
-            const isWildcard = 
-            // TS/JS: header assignment or cors() call
-            (/["']Access-Control-Allow-Origin["']/.test(line) &&
-                /["']\*["']/.test(line)) ||
-                /origin\s*:\s*["']\*["']/.test(line) ||
-                (/cors\s*\(/.test(line) && /\*/.test(line)) ||
-                // Python (FastAPI CORSMiddleware / Flask-CORS):
-                // wildcard allow_origins/origins assignment
-                /(?:allow_origins|origins)\s*=\s*["']\*["']/.test(line) ||
-                // wildcard allow_origins/origins array assignment
-                /(?:allow_origins|origins)\s*=\s*[[(]["']\*["']/.test(line) ||
-                // Go (gin-cors, chi-cors, gorilla):
-                // AllowAllOrigins enabled
-                /AllowAllOrigins\s*:\s*true/.test(line) ||
-                // wildcard AllowOrigins/AllowedOrigins slice
-                // Use [^*\n]{0,60} instead of .* to prevent super-linear backtracking
-                /Allow(?:ed)?Origins[^*\n]{0,60}\*/.test(line);
-            if (isWildcard) {
-                diagnostics.push({
-                    id: `cors-wildcard:${ctx.filePath}:${i + 1}`,
-                    tool: "fact-rules",
-                    rule: "cors-wildcard",
-                    filePath: ctx.filePath,
-                    line: i + 1,
-                    column: 1,
-                    severity: "error",
-                    semantic: "blocking",
-                    message: "CORS wildcard origin (*) allows any website to make credentialed requests — restrict to known origins",
-                });
-            }
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/error-obscuring.js

@@ -1,32 +0,0 @@
-export const errorObscuringRule = {
-    id: "error-obscuring",
-    requires: ["file.tryCatchSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const summaries = store.getFileFact(ctx.filePath, "file.tryCatchSummaries");
-        if (!summaries)
-            return [];
-        const diagnostics = [];
-        for (const s of summaries) {
-            if (!s.isEmpty &&
-                !s.hasRethrow &&
-                s.catchParam !== null &&
-                !s.bodyText.includes(s.catchParam)) {
-                diagnostics.push({
-                    id: `error-obscuring:${ctx.filePath}:${s.line}:${s.column}`,
-                    tool: "fact-rules",
-                    rule: "error-obscuring",
-                    filePath: ctx.filePath,
-                    line: s.line,
-                    column: s.column,
-                    severity: "warning",
-                    semantic: "warning",
-                    message: `Catch block catches '${s.catchParam}' but never references it — the error is obscured`,
-                });
-            }
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/error-swallowing.js

@@ -1,31 +0,0 @@
-export const errorSwallowingRule = {
-    id: "error-swallowing",
-    requires: ["file.tryCatchSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const summaries = store.getFileFact(ctx.filePath, "file.tryCatchSummaries");
-        if (!summaries)
-            return [];
-        const diagnostics = [];
-        for (const s of summaries) {
-            if (s.isEmpty &&
-                !s.isDocumentedLocalFallback &&
-                s.boundaryCategory !== "fs") {
-                diagnostics.push({
-                    id: `error-swallowing:${ctx.filePath}:${s.line}:${s.column}`,
-                    tool: "fact-rules",
-                    rule: "error-swallowing",
-                    filePath: ctx.filePath,
-                    line: s.line,
-                    column: s.column,
-                    severity: "error",
-                    semantic: "blocking",
-                    message: `Empty catch block silently swallows errors`,
-                });
-            }
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/framework-call-noise.js

@@ -1,67 +0,0 @@
-/**
- * Shared test-framework-call recognition for `high-fan-out` and `high-complexity`
- * (#577). A normal `it()`/`describe()` body naturally invokes many assertion/mock
- * helpers — that's test structure, not a coordination smell or genuine complexity.
- *
- * Two complementary heuristics, both call-name-based (no `ctx.fileRole` gating —
- * these calls only exist in test-framework code, so the signal is safe to apply
- * unconditionally):
- *
- * 1. `isTestFrameworkNoiseCall` — filters individual "meaningful calls" the same
- *    way `console.*`/`Math.*`/etc. are already excluded in high-fan-out. Handles
- *    assertion-heavy `it()` bodies directly.
- * 2. `isTestSuiteOrganizer` — a `describe()`/`it()`/`test()` wrapper's own
- *    FunctionSummary aggregates every call and branch from ALL of its nested test
- *    bodies (the shared tree-sitter walk in function-facts.ts does not stop at
- *    nested-function boundaries, since each nested callback also gets its own,
- *    correctly-scoped, FunctionSummary). That aggregation is not real fan-out or
- *    complexity — it's the sum of independent nested tests. A function is an
- *    "organizer" if it directly invokes `it`/`test`/`describe` (or their
- *    `.only`/`.skip`/`.each` variants) — i.e. it exists to group other tests, not
- *    to implement logic itself. This does NOT exempt genuinely complex/tangled
- *    test HELPER functions, since those don't call `it`/`describe`/`test`
- *    themselves.
- */
-const EXPECT_CHAIN_PREFIX = "expect(";
-const TEST_LIFECYCLE_NAMES = new Set([
-    "it",
-    "test",
-    "describe",
-    "beforeeach",
-    "aftereach",
-    "beforeall",
-    "afterall",
-]);
-const TEST_LIFECYCLE_PREFIXES = ["it.", "test.", "describe."];
-const MOCK_LIBRARY_PREFIXES = ["vi.", "jest."];
-/**
- * True if `call` (a raw callee string from `FunctionSummary.outgoingCalls`) is
- * test-framework noise: an `expect(...)` assertion chain, a test lifecycle call
- * (`it`/`describe`/`test`/`beforeEach`/etc., including `.only`/`.skip`/`.each`
- * variants), or a mock-library call (`vi.*`/`jest.*`).
- */
-export function isTestFrameworkNoiseCall(call) {
-    const lower = call.toLowerCase();
-    if (lower === "expect" || lower.startsWith(EXPECT_CHAIN_PREFIX))
-        return true;
-    if (TEST_LIFECYCLE_NAMES.has(lower))
-        return true;
-    if (TEST_LIFECYCLE_PREFIXES.some((p) => lower.startsWith(p)))
-        return true;
-    if (MOCK_LIBRARY_PREFIXES.some((p) => lower.startsWith(p)))
-        return true;
-    return false;
-}
-/**
- * True if this function's (unfiltered) outgoing calls include a direct call to
- * `it`/`test`/`describe` — i.e. it groups nested test bodies rather than
- * implementing logic itself. Its aggregated fan-out/complexity reflects the sum
- * of independent nested tests, not one function's real signal.
- */
-export function isTestSuiteOrganizer(calls) {
-    return calls.some((call) => {
-        const lower = call.toLowerCase();
-        const base = lower.split("(")[0].split(".")[0];
-        return base === "it" || base === "test" || base === "describe";
-    });
-}

package/node_modules/pi-lens/dist/clients/dispatch/rules/high-complexity.js

@@ -1,72 +0,0 @@
-import { isTestSuiteOrganizer } from "./framework-call-noise.js";
-// Defaults match the historical hardcoded values so behavior is unchanged for
-// projects without a config. Project-specific overrides are read from the
-// per-dispatch context; these mutable fallbacks exist for tests/legacy direct
-// rule evaluation only.
-const DEFAULT_HIGH_COMPLEXITY_THRESHOLD = 15;
-const DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD = 6;
-let ccThreshold = DEFAULT_HIGH_COMPLEXITY_THRESHOLD;
-let depthThreshold = DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD;
-function isPositiveFiniteThreshold(value) {
-    return Number.isFinite(value) && value > 0;
-}
-/** Override fallback thresholds for tests/legacy direct rule evaluation. */
-export function setHighComplexityThresholds(cc, depth) {
-    // Non-positive thresholds make every function violate the rule; treat them as
-    // invalid config/test input rather than turning the rule into noise.
-    if (isPositiveFiniteThreshold(cc))
-        ccThreshold = cc;
-    if (isPositiveFiniteThreshold(depth))
-        depthThreshold = depth;
-}
-/** Test helper: restore compile-time defaults. */
-export function resetHighComplexityThresholds() {
-    ccThreshold = DEFAULT_HIGH_COMPLEXITY_THRESHOLD;
-    depthThreshold = DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD;
-}
-export const highComplexityRule = {
-    id: "high-complexity",
-    requires: ["file.functionSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
-        const diagnostics = [];
-        const configuredCcThreshold = ctx.projectConfig?.rules["high-complexity"]?.threshold;
-        const activeCcThreshold = configuredCcThreshold ?? ccThreshold;
-        for (const f of fns) {
-            // A describe()/it()/test() wrapper's own complexity/nesting-depth
-            // aggregates branches from ALL of its nested test bodies (#577) — e.g. a
-            // `for` loop inside each of several `it()`s sums into the enclosing
-            // `describe()`'s cyclomatic complexity, even though no single test is
-            // complex. Unlike high-fan-out's call-name filter, there's no per-call
-            // signal to exclude for branch counting, so the equivalent fix here is to
-            // skip the organizer function itself. Genuinely complex test HELPER
-            // functions don't call it/describe/test themselves, so they're unaffected.
-            if (isTestSuiteOrganizer(f.outgoingCalls))
-                continue;
-            const ccBreached = f.cyclomaticComplexity >= activeCcThreshold;
-            const depthBreached = f.maxNestingDepth >= depthThreshold;
-            if (!ccBreached && !depthBreached)
-                continue;
-            const parts = [];
-            if (ccBreached)
-                parts.push(`cyclomatic complexity ${f.cyclomaticComplexity}`);
-            if (depthBreached)
-                parts.push(`nesting depth ${f.maxNestingDepth}`);
-            diagnostics.push({
-                id: `high-complexity:${ctx.filePath}:${f.line}`,
-                tool: "fact-rules",
-                rule: "high-complexity",
-                filePath: ctx.filePath,
-                line: f.line,
-                column: f.column,
-                severity: "warning",
-                semantic: "warning",
-                message: `'${f.name}' has ${parts.join(" and ")} — consider breaking it up`,
-            });
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/high-fan-out.js

@@ -1,74 +0,0 @@
-import { isTestFrameworkNoiseCall, isTestSuiteOrganizer, } from "./framework-call-noise.js";
-// Default matches the historical hardcoded value so behavior is unchanged for
-// projects without a config. Project-specific overrides are read from the
-// per-dispatch context; this mutable fallback exists for tests/legacy direct
-// rule evaluation only.
-const DEFAULT_HIGH_FAN_OUT_THRESHOLD = 20;
-let fanOutThreshold = DEFAULT_HIGH_FAN_OUT_THRESHOLD;
-/** Override fallback threshold for tests/legacy direct rule evaluation. */
-export function setHighFanOutThreshold(n) {
-    // Non-positive thresholds make every function violate the rule; treat them as
-    // invalid config/test input rather than turning the rule into noise.
-    if (Number.isFinite(n) && n > 0)
-        fanOutThreshold = n;
-}
-/** Test helper: restore compile-time default. */
-export function resetHighFanOutThreshold() {
-    fanOutThreshold = DEFAULT_HIGH_FAN_OUT_THRESHOLD;
-}
-export const highFanOutRule = {
-    id: "high-fan-out",
-    requires: ["file.functionSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
-        const diagnostics = [];
-        const configuredFanOutThreshold = ctx.projectConfig?.rules["high-fan-out"]?.threshold;
-        const activeFanOutThreshold = configuredFanOutThreshold ?? fanOutThreshold;
-        for (const f of fns) {
-            // A describe()/it()/test() wrapper's own call list aggregates every call
-            // from ALL of its nested test bodies (#577) — not real fan-out. Genuinely
-            // complex test HELPER functions don't call it/describe/test themselves, so
-            // they're unaffected.
-            if (isTestSuiteOrganizer(f.outgoingCalls))
-                continue;
-            // Filter out noise: utility calls, logging, type assertions, and
-            // test-framework calls (expect/it/describe/vi.*/jest.*, #577) — assertion-
-            // and mock-heavy test bodies naturally call many of these; that's test
-            // structure, not a coordination smell.
-            const meaningful = f.outgoingCalls.filter((c) => {
-                const lower = c.toLowerCase();
-                return (!lower.startsWith("console.") &&
-                    !lower.startsWith("math.") &&
-                    !lower.startsWith("json.") &&
-                    !lower.startsWith("object.") &&
-                    !lower.startsWith("array.") &&
-                    !lower.startsWith("string(") &&
-                    !lower.startsWith("number(") &&
-                    !lower.startsWith("boolean(") &&
-                    !lower.startsWith("error(") &&
-                    c !== "resolve" &&
-                    c !== "reject" &&
-                    c !== "next" &&
-                    c !== "done" &&
-                    !isTestFrameworkNoiseCall(c));
-            });
-            if (meaningful.length < activeFanOutThreshold)
-                continue;
-            diagnostics.push({
-                id: `high-fan-out:${ctx.filePath}:${f.line}`,
-                tool: "fact-rules",
-                rule: "high-fan-out",
-                filePath: ctx.filePath,
-                line: f.line,
-                column: f.column,
-                severity: "warning",
-                semantic: "warning",
-                message: `'${f.name}' calls ${meaningful.length} distinct functions — coordination smell, consider splitting responsibilities`,
-            });
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/high-import-coupling.js

@@ -1,37 +0,0 @@
-/**
- * high-import-coupling — a file importing from > 15 distinct modules. Fact-based
- * (reads `file.imports` from the tree-sitter import provider, no compiler);
- * formerly QR-003 (#402).
- */
-const IMPORT_COUPLING_THRESHOLD = 15;
-// Registry/hub files are intentionally wide — they import everything by design
-const IMPORT_COUPLING_EXEMPT = /[/\\](index|integration)\.[cm]?tsx?$/;
-export const highImportCouplingRule = {
-    id: "high-import-coupling",
-    requires: ["file.imports"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        if (IMPORT_COUPLING_EXEMPT.test(ctx.filePath))
-            return [];
-        const imports = store.getFileFact(ctx.filePath, "file.imports") ?? [];
-        const sources = new Set(imports.map((i) => i.source));
-        const count = sources.size;
-        if (count <= IMPORT_COUPLING_THRESHOLD)
-            return [];
-        return [
-            {
-                id: `high-import-coupling:${ctx.filePath}:1:1`,
-                tool: "fact-rules",
-                rule: "high-import-coupling",
-                filePath: ctx.filePath,
-                line: 1,
-                column: 1,
-                severity: "warning",
-                semantic: "warning",
-                message: `File imports from ${count} distinct modules (threshold: ${IMPORT_COUPLING_THRESHOLD}) — split responsibilities`,
-            },
-        ];
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/missing-error-propagation.js

@@ -1,62 +0,0 @@
-/**
- * Flags async functions where a catch block logs the error but doesn't
- * rethrow — the caller receives undefined and assumes success.
- *
- * Distinct from error-obscuring (catch param never referenced) and
- * error-swallowing (empty catch). This catches the "looks handled" pattern:
- *   } catch (err) {
- *     console.error(err);   ← appears handled
- *   }                        ← but caller gets undefined, not the error
- */
-export const missingErrorPropagationRule = {
-    id: "missing-error-propagation",
-    requires: ["file.functionSummaries", "file.tryCatchSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
-        const catches = store.getFileFact(ctx.filePath, "file.tryCatchSummaries") ?? [];
-        const diagnostics = [];
-        // Only consider async functions
-        const asyncFns = fns.filter((f) => f.isAsync && !f.isPassThroughWrapper);
-        for (const f of asyncFns) {
-            // Find catch blocks within this function's body
-            // (catch line >= function line, and within reasonable range)
-            const nextFnLine = fns
-                .filter((g) => g.line > f.line)
-                .reduce((min, g) => Math.min(min, g.line), Infinity);
-            const relevantCatches = catches.filter((c) => c.line >= f.line && c.line < nextFnLine);
-            for (const c of relevantCatches) {
-                if (c.isEmpty || c.hasRethrow)
-                    continue;
-                if (!c.hasLogging)
-                    continue;
-                // Structured return or documented fallback = intentional error handling
-                if (c.catchReturnsDefault)
-                    continue;
-                if (c.catchReturnsStructuredError)
-                    continue;
-                if (c.isDocumentedLocalFallback)
-                    continue;
-                if (c.isFilesystemExistenceProbe)
-                    continue;
-                // Catch body that sets an error-flag variable = intentional state management
-                if (/\b(serverFailed|failed|error)\s*=/.test(c.bodyText))
-                    continue;
-                diagnostics.push({
-                    id: `missing-error-propagation:${ctx.filePath}:${c.line}`,
-                    tool: "fact-rules",
-                    rule: "missing-error-propagation",
-                    filePath: ctx.filePath,
-                    line: c.line,
-                    column: c.column,
-                    severity: "warning",
-                    semantic: "warning",
-                    message: `Catch block in async '${f.name}' logs the error but doesn't rethrow — callers receive undefined and assume success`,
-                });
-            }
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/no-commented-credentials.js

@@ -1,52 +0,0 @@
-/**
- * no-commented-credentials — password/token/secret in comments (TS/JS/Python/Go/
- * Ruby/YAML/JSON/env). Regex/line-based (no compiler); formerly SN-007 (#402).
- */
-const CREDENTIAL_PATTERNS = [
-    /password\s*[:=]\s*["'][^"']{3,}/i,
-    /(?:api[_-]?key|secret|token)\s*[:=]\s*["'][^"']{6,}/i,
-    /(?:aws|gcp|azure)[_-]?(?:key|secret|token)\s*[:=]\s*["'][^"']{6,}/i,
-];
-// Files that define credential patterns as code (scanners, test fixtures, etc.) —
-// their own regex literals would otherwise self-trigger this rule.
-const CREDENTIALS_EXEMPT = /[/\\](secrets?[-_]?(scanner|detect|check)|scanner|fixture|mock)[^/\\]*\.(tsx?|ya?ml|json|env)$/i;
-function isCommentLine(line) {
-    return line.startsWith("//") || line.startsWith("#") || line.startsWith("*");
-}
-export const commentedCredentialsRule = {
-    id: "no-commented-credentials",
-    requires: ["file.content"],
-    appliesTo(ctx) {
-        return (/\.(tsx?|py|go|rb|ya?ml|json|env)$/.test(ctx.filePath) &&
-            !CREDENTIALS_EXEMPT.test(ctx.filePath));
-    },
-    evaluate(ctx, store) {
-        const content = store.getFileFact(ctx.filePath, "file.content");
-        if (!content)
-            return [];
-        const diagnostics = [];
-        const lines = content.split("\n");
-        for (let i = 0; i < lines.length; i++) {
-            const line = lines[i].trimStart();
-            if (!isCommentLine(line))
-                continue;
-            for (const p of CREDENTIAL_PATTERNS) {
-                if (p.test(line)) {
-                    diagnostics.push({
-                        id: `no-commented-credentials:${ctx.filePath}:${i + 1}`,
-                        tool: "fact-rules",
-                        rule: "no-commented-credentials",
-                        filePath: ctx.filePath,
-                        line: i + 1,
-                        column: 1,
-                        severity: "error",
-                        semantic: "blocking",
-                        message: "Possible credential in commented-out code — remove it and rotate the secret",
-                    });
-                    break;
-                }
-            }
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/pass-through-wrappers.js

@@ -1,42 +0,0 @@
-import { isTestFile } from "../../file-utils.js";
-const ALIAS_COMMENT_RE = /\b(alias|backward\s*compat|backwards\s*compat|compatibility|shim|adapter)\b/i;
-function hasAliasCommentNear(line, comments) {
-    return comments.some((comment) => comment.line >= line - 2 &&
-        comment.line <= line &&
-        ALIAS_COMMENT_RE.test(comment.text));
-}
-export const passThroughWrappersRule = {
-    id: "pass-through-wrappers",
-    requires: ["file.functionSummaries", "file.comments"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath) && !isTestFile(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const summaries = store.getFileFact(ctx.filePath, "file.functionSummaries");
-        const comments = store.getFileFact(ctx.filePath, "file.comments");
-        if (!summaries || !comments)
-            return [];
-        const diagnostics = [];
-        for (const fn of summaries) {
-            if (!fn.isPassThroughWrapper ||
-                fn.statementCount !== 1 ||
-                fn.isBoundaryWrapper) {
-                continue;
-            }
-            if (hasAliasCommentNear(fn.line, comments))
-                continue;
-            diagnostics.push({
-                id: `pass-through-wrapper:${ctx.filePath}:${fn.line}:${fn.column}`,
-                tool: "fact-rules",
-                filePath: ctx.filePath,
-                line: fn.line,
-                column: fn.column,
-                severity: "warning",
-                semantic: "warning",
-                rule: "pass-through-wrappers",
-                message: `Function '${fn.name}' is a trivial pass-through wrapper`,
-            });
-        }
-        return diagnostics;
-    },
-};

package/node_modules/pi-lens/dist/clients/dispatch/rules/placeholder-comments.js

@@ -1,40 +0,0 @@
-import { isTestFile } from "../../file-utils.js";
-const PLACEHOLDER_PATTERNS = [
-    /add\s+more\s+validation/i,
-    /handle\s+(additional|more)\s+cases?/i,
-    /can\s+be\s+extended\s+in\s+the\s+future/i,
-    /extend\s+this\s+(logic|function|method|handler|module)/i,
-    /customize\s+this\s+(logic|behavior|function|method|handler)/i,
-    /future\s+enhancement/i,
-    /implement\s+.+\s+here/i,
-];
-export const placeholderCommentsRule = {
-    id: "placeholder-comments",
-    requires: ["file.comments"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath) && !isTestFile(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const comments = store.getFileFact(ctx.filePath, "file.comments");
-        if (!comments)
-            return [];
-        const diagnostics = [];
-        for (const comment of comments) {
-            const matched = PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(comment.text));
-            if (!matched)
-                continue;
-            diagnostics.push({
-                id: `placeholder-comments:${ctx.filePath}:${comment.line}:1`,
-                tool: "fact-rules",
-                filePath: ctx.filePath,
-                line: comment.line,
-                column: 1,
-                severity: "warning",
-                semantic: "warning",
-                rule: "placeholder-comments",
-                message: "Placeholder comment detected. Prefer comments that describe current behavior over future intent.",
-            });
-        }
-        return diagnostics;
-    },
-};