@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/hyphenated-svg-attribute-test.yml

@@ -0,0 +1,11 @@
+id: hyphenated-svg-attribute
+valid:
+  - "const icon = <svg strokeWidth=\"2\" />;"
+  - "const custom = <my-element data-value=\"x\" />;"
+  - "const other = <div stroke-width=\"2\" />;"
+invalid:
+  - "const icon = <svg stroke-width=\"2\" />;"
+  - "const path = <path fill-rule=\"evenodd\" />;"
+  - "const path = <path clip-rule=\"evenodd\" />;"
+  - "const use = <use xlink-href=\"#icon\" />;"
+  - "const mask = <mask mask-type=\"luminance\" />;"

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-no-lateinit-test.yml

@@ -0,0 +1,17 @@
+id: kotlin-no-lateinit
+valid:
+  - |
+    class UserRepository(private val apiClient: ApiClient)
+  - |
+    class Foo {
+        var name: String = ""
+    }
+invalid:
+  - |
+    class UserRepository {
+        lateinit var apiClient: ApiClient
+    }
+  - |
+    class Foo {
+        lateinit var items: MutableList<String>
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-no-nullable-boolean-test.yml

@@ -0,0 +1,15 @@
+id: kotlin-no-nullable-boolean
+valid:
+  - |
+    fun isEligible(): Boolean = false
+  - |
+    class Foo {
+        var count: Int? = null
+    }
+invalid:
+  - |
+    fun isEligible(): Boolean? = null
+  - |
+    class Foo {
+        var flag: Boolean? = null
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-no-println-test.yml

@@ -0,0 +1,19 @@
+id: kotlin-no-println
+valid:
+  - |
+    fun main() {
+        logger.info { "starting up" }
+    }
+  - |
+    fun main() {
+        writer.println("hi")
+    }
+invalid:
+  - |
+    fun main() {
+        println("starting up")
+    }
+  - |
+    fun main() {
+        print("no newline")
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-no-unnecessary-let-test.yml

@@ -0,0 +1,7 @@
+id: kotlin-no-unnecessary-let
+valid:
+  - |
+    val length = name?.let { it.length }
+invalid:
+  - |
+    val length = name.let { it.length }

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-no-unsafe-cast-test.yml

@@ -0,0 +1,7 @@
+id: kotlin-no-unsafe-cast
+valid:
+  - |
+    val name = value as? String ?: return
+invalid:
+  - |
+    val name = value as String

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-no-var-test.yml

@@ -0,0 +1,7 @@
+id: kotlin-no-var
+valid:
+  - |
+    val total = prices.sum()
+invalid:
+  - |
+    var total = 0

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-prefer-data-class-test.yml

@@ -0,0 +1,25 @@
+id: kotlin-prefer-data-class
+valid:
+  - |
+    data class Point(val x: Int, val y: Int)
+  - |
+    open class Base(val x: Int)
+  - |
+    class Mixed(val x: Int, y: Int)
+  - |
+    class WithBehavior(val x: Int) {
+        fun scale(factor: Int): Int = x * factor
+    }
+  - |
+    class WithInit(val x: Int) {
+        init { println(x) }
+    }
+  - |
+    class WithComputed(val x: Int) {
+        val doubled: Int get() = x * 2
+    }
+invalid:
+  - |
+    class Point(val x: Int, val y: Int)
+  - |
+    class Ok(val v: String) : Result()

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/kotlin-prefer-is-empty-test.yml

@@ -0,0 +1,11 @@
+id: kotlin-prefer-is-empty
+valid:
+  - |
+    if (items.isEmpty()) return
+  - |
+    if (items.size > 0) return
+invalid:
+  - |
+    if (items.size == 0) return
+  - |
+    if (name.length == 0) return

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/no-important-test.yml

@@ -0,0 +1,21 @@
+id: no-important
+valid:
+  - |
+    .button {
+      color: red;
+    }
+  - |
+    .button {
+      color: red;
+    }
+    /* !important mentioned only in a comment, not a declaration */
+invalid:
+  - |
+    .button {
+      color: red !important;
+    }
+  - |
+    .modal {
+      display: none !important;
+      z-index: 9999 !important;
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/no-raw-types-test.yml

@@ -0,0 +1,30 @@
+id: no-raw-types
+valid:
+  - 'List<String> names = new ArrayList<String>();'
+  - 'Map<String, Integer> counts = new HashMap<>();'
+  # PR #2212 review F3: neither context has a valid parameterized form.
+  # `o instanceof List<String>` and `List<String>.class` are compile errors,
+  # so a finding here can never be acted on.
+  - |
+    class Probe {
+      void check(Object o) {
+        if (o instanceof List) { }
+      }
+    }
+  - |
+    class Probe {
+      Class<?> token() {
+        return List.class;
+      }
+    }
+  # The qualifier chain of a parameterized qualified type stays silent.
+  - 'java.util.List<String> queue = null;'
+  - 'Map.Entry<String, Integer> entry = null;'
+invalid:
+  - 'List names = new ArrayList();'
+  - 'Optional value = Optional.empty();'
+  # PR #2212 review F4: a raw type nested in a type argument. The pre-fix rule
+  # excluded it, because `not: inside: {kind: generic_type, stopBy: end}`
+  # walked every ancestor and found the enclosing `Map<...>`.
+  - 'Map<String, List> nested = null;'
+  - 'java.util.List raw = null;'

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/no-string-concat-in-loop-test.yml

@@ -0,0 +1,100 @@
+id: no-string-concat-in-loop
+valid:
+  - |
+    StringBuilder result = new StringBuilder();
+    for (String item : items) {
+      result.append(item);
+    }
+  - 'String result = prefix + suffix;'
+  - |
+    int total = 0;
+    for (int value : values) {
+      total = total + value;
+    }
+  - |
+    double count = 0;
+    while (ready()) {
+      count += 1;
+    }
+  # PR #2212 review F1: numeric accumulation whose right-hand side merely
+  # contains a string literal, deep inside a call argument. The pre-fix rule
+  # searched for a string_literal with `stopBy: end` and fired on both lines.
+  - |
+    class Counter {
+      void run(java.util.Map<String, Integer> counts, java.util.List<String> keys) {
+        int total = 0;
+        for (String key : keys) {
+          total += counts.get("label");
+          total = total + counts.getOrDefault("k", 0);
+        }
+      }
+    }
+  # A String-named local in a different method must not license numeric
+  # accumulation here. This pins the method scoping of the declaration arm.
+  - |
+    class Scoped {
+      String build(java.util.List<String> items) {
+        String total = "";
+        return total;
+      }
+      int count(java.util.List<String> items) {
+        int total = 0;
+        for (String item : items) {
+          total += item.length();
+        }
+        return total;
+      }
+    }
+invalid:
+  - |
+    String result = "";
+    for (String item : items) {
+      result += item + " ";
+    }
+  - |
+    while (ready()) {
+      result = result + " " ;
+    }
+  # PR #2212 review F2: the canonical true positive. No string literal appears
+  # anywhere in either statement, so the pre-fix rule reported nothing.
+  - |
+    class Builder {
+      String join(java.util.List<String> items) {
+        String s = "";
+        for (String x : items) {
+          s += x;
+        }
+        return s;
+      }
+    }
+  - |
+    class Builder {
+      String join(java.util.List<String> items) {
+        String t = "";
+        for (String x : items) {
+          t = t + x;
+        }
+        return t;
+      }
+    }
+  # The accumulator is a String field, not a local.
+  - |
+    class Accumulator {
+      private String buffer = "";
+      void add(java.util.List<String> items) {
+        for (String item : items) {
+          buffer += item;
+        }
+      }
+    }
+  # do-while loops allocate the same way as for and while.
+  - |
+    class Looper {
+      String pump() {
+        String out = "";
+        do {
+          out += next();
+        } while (ready());
+        return out;
+      }
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/no-system-out-println-test.yml

@@ -0,0 +1,7 @@
+id: no-system-out-println
+valid:
+  - 'logger.info("ready");'
+  - 'System.out.printf("%s", value);'
+invalid:
+  - 'System.out.println(value);'
+  - 'System.err.print(error);'

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/prefer-string-is-empty-test.yml

@@ -0,0 +1,7 @@
+id: prefer-string-is-empty
+valid:
+  - 'if (value.isEmpty()) return;'
+  - 'if (value.length() == 1) return;'
+invalid:
+  - 'if (value.length() == 0) return;'
+  - 'if (value.equals("")) return;'

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/python-optional-type-test.yml

@@ -0,0 +1,9 @@
+id: python-optional-type
+valid:
+  - "value: str | None"
+  - "value: list[str]"
+invalid:
+  - "value: Optional[str]"
+  - "value: Optional[list[int]]"
+  - "value: typing.Optional[str]"
+  - "value: t.Optional[str]"

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/reducible-list-comprehension-test.yml

@@ -0,0 +1,11 @@
+id: reducible-list-comprehension
+valid:
+  - "total = sum(price for price in prices)"
+  - "items = [item for item in source]"
+  - "result = max([value for value in values])"
+  - "total = sum([price async for price in prices])"
+  - "found = any([await check(item) for item in items])"
+invalid:
+  - "total = sum([price for price in prices])"
+  - "found = any([item for item in items])"
+  - "complete = all([item.ready for item in items])"

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/ruby-symbol-to-proc-candidate-test.yml

@@ -0,0 +1,10 @@
+id: ruby-symbol-to-proc-candidate
+valid:
+  - "names.each { |name| puts name }"
+  - "names.map { |name| name.upcase(prefix) }"
+  - "names.map { |name| name.(1) }"
+  - "names.map(&:upcase)"
+  - "names.map { |name| name.() }"
+invalid:
+  - "names.map { |name| name.upcase }"
+  - "names.select { |name| name.empty? }"

package/node_modules/pi-lens/rules/ast-grep-rules/rule-tests/rust-no-chars-enumerate-test.yml

@@ -0,0 +1,7 @@
+id: rust-no-chars-enumerate
+valid:
+  - "for (index, character) in text.char_indices() {}"
+  - "for character in text.chars() {}"
+invalid:
+  - "for (index, character) in text.chars().enumerate() {}"
+  - "let positions = value.chars().enumerate();"

package/node_modules/pi-lens/rules/ast-grep-rules/rules/c-no-malloc-free.yml

@@ -0,0 +1,39 @@
+# C No malloc/free
+# Detects manual heap allocation via malloc/calloc/realloc/free.
+# Ported from vinhnx/VTCode rules/c/no-malloc-free.yml (#2201, refs #2195).
+id: c-no-malloc-free
+language: c
+severity: warning
+message: "Manual malloc/calloc/realloc/free; verify ownership and error handling"
+note: |
+  Manual heap management is routine and often correct in C, but every call
+  site needs a matching free on every path (including error returns) and a
+  NULL check on the allocation itself. This rule surfaces the call sites for
+  review; it does not imply the allocation is wrong.
+  Detection-only: whether an allocation is intentional, already
+  correctly paired and error-checked, or a leak/double-free candidate
+  requires tracing ownership across the function, which this syntactic rule
+  cannot verify.
+  Expect volume in an unmanaged-memory C codebase: this fires once per
+  malloc/calloc/realloc/free call site, so a file with routine heap use can
+  report many findings that are individually fine. Treat a high count as a
+  prompt to skim for the unpaired or unchecked exceptions, not as a signal
+  every call site needs a change.
+rule:
+  kind: call_expression
+  has:
+    field: function
+    kind: identifier
+    regex: "^(malloc|calloc|realloc|free)$"
+tags:
+  - c
+  - idiom
+  - memory-safety
+examples:
+  bad: |
+    int *buf = malloc(sizeof(int) * count);
+    /* ... */
+    free(buf);
+  good: |
+    /* Same call sites, reviewed for a matching free on every path and a
+       NULL check on the allocation. */

package/node_modules/pi-lens/rules/ast-grep-rules/rules/cpp-no-malloc-free.yml

@@ -0,0 +1,45 @@
+# C++ No malloc/free
+# Detects manual heap allocation via malloc/calloc/realloc/free in C++.
+# Ported from vinhnx/VTCode rules/cpp/no-malloc-free.yml (#2201, refs #2195).
+id: cpp-no-malloc-free
+language: cpp
+severity: warning
+message: "Manual malloc/calloc/realloc/free in C++; consider RAII (new/unique_ptr/vector)"
+note: |
+  C++ has RAII, smart pointers, and standard containers that pair allocation
+  with automatic, exception-safe deallocation. malloc/free bypass
+  constructors/destructors entirely, which is unsafe for anything but a
+  trivial type.
+  Detection-only: migrating a call site to RAII requires knowing the
+  object's lifetime and whether it crosses an API boundary that expects a
+  raw pointer (a C interop layer, a custom allocator), which this rule
+  cannot verify.
+rule:
+  kind: call_expression
+  has:
+    field: function
+    any:
+      # A bare call: malloc(...).
+      - kind: identifier
+        regex: "^(malloc|calloc|realloc|free)$"
+      # A namespace-qualified call: std::malloc(...) or ::malloc(...). C++
+      # inherits these into std:: via <cstdlib>, and the global-scope form
+      # is common in code that also has a project-local `malloc` overload.
+      # The qualifier itself (`std`/empty) isn't part of the identifier
+      # node's text, so it's unconstrained here; only the trailing name is
+      # checked, which is exactly the function being called either way.
+      - kind: qualified_identifier
+        has:
+          field: name
+          kind: identifier
+          regex: "^(malloc|calloc|realloc|free)$"
+tags:
+  - cpp
+  - idiom
+  - memory-safety
+examples:
+  bad: |
+    int* buf = static_cast<int*>(malloc(sizeof(int) * count));
+    free(buf);
+  good: |
+    auto buf = std::make_unique<int[]>(count);

package/node_modules/pi-lens/rules/ast-grep-rules/rules/cpp-no-printf.yml

@@ -0,0 +1,41 @@
+# C++ No printf
+# Detects C-style `printf` in C++ code.
+# Ported from vinhnx/VTCode rules/cpp/no-printf.yml (#2201, refs #2195).
+id: cpp-no-printf
+language: cpp
+severity: warning
+message: "Avoid printf in C++; prefer std::cout/std::format for type-safe formatting"
+note: |
+  printf's format string and argument types aren't checked by the compiler,
+  so a mismatch is undefined behavior instead of a compile error.
+  std::cout/std::format (C++20) and iostreams are type-checked.
+  Detection-only: replacing printf changes call-site syntax and, for
+  std::format, requires a C++20 toolchain, both project policy calls this
+  rule cannot make. Scoped to bare `printf`; `fprintf`/`sprintf` overlap the
+  existing `fix-format-security-error-cpp` CodeRabbit rule and are left to
+  it.
+rule:
+  kind: call_expression
+  has:
+    field: function
+    any:
+      # A bare call: printf(...).
+      - kind: identifier
+        regex: "^printf$"
+      # A namespace-qualified call: std::printf(...) or ::printf(...). C++
+      # inherits printf into std:: via <cstdio>. The qualifier isn't part of
+      # the identifier node's text, so only the trailing name is checked.
+      - kind: qualified_identifier
+        has:
+          field: name
+          kind: identifier
+          regex: "^printf$"
+tags:
+  - cpp
+  - idiom
+  - type-safety
+examples:
+  bad: |
+    printf("count: %d\n", count);
+  good: |
+    std::cout << "count: " << count << "\n";

package/node_modules/pi-lens/rules/ast-grep-rules/rules/go-no-fmt-println.yml

@@ -0,0 +1,43 @@
+# Go No fmt.Println in Production Code
+# Detects fmt.Println/Printf/Fprintln/Fprint/Fprintf calls outside tests and
+# examples, which should route through a structured logger instead.
+# Ported from vinhnx/VTCode rules/go/no-fmt-println.yml (#2200, refs #2195).
+id: go-no-fmt-println
+language: go
+severity: warning
+message: "Avoid fmt.Println/Printf-family calls in production code; use a structured logger"
+note: |
+  Direct console output via fmt.Println/Printf/Fprintln/Fprint/Fprintf is not
+  configurable and cannot be routed to log aggregators. Use log/slog
+  (Go 1.21+) or a structured logging library for production code.
+  fmt.Println is acceptable in tests, examples, and CLI tools, so this rule
+  excludes _test.go files and examples/ directories.
+  Detection-only: which logger to use, and whether a given call site is a
+  CLI entry point rather than library code, is a project policy call this
+  rule cannot make.
+rule:
+  any:
+    - pattern: $FUNC($$$)
+constraints:
+  FUNC:
+    regex: "^fmt\\.(Println|Printf|Fprintln|Fprint|Fprintf)$"
+    has:
+      kind: field_identifier
+ignores:
+  - "**/*_test.go"
+  - "**/examples/**"
+  - "tests/fixtures/**"
+  - "cases/**"
+tags:
+  - go
+  - idiom
+  - logging
+examples:
+  bad: |
+    func main() {
+        fmt.Println("hello")
+    }
+  good: |
+    func main() {
+        slog.Info("hello")
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rules/go-no-panic-in-lib.yml

@@ -0,0 +1,41 @@
+# Go No panic() in Library Code
+# Detects panic() calls outside tests and cmd/ entry points; library code
+# should return error values instead.
+# Ported from vinhnx/VTCode rules/go/no-panic-in-lib.yml (#2200, refs #2195).
+id: go-no-panic-in-lib
+language: go
+severity: warning
+message: "Avoid panic() in library code; return errors instead"
+note: |
+  panic() unwinds the entire goroutine stack and is not recoverable by
+  callers unless they use defer/recover. Library code should return error
+  values so callers can handle failures gracefully. Scoped to non-test,
+  non-cmd Go files, since main packages under cmd/ legitimately panic on
+  unrecoverable startup failures.
+  Detection-only: converting a panic to an error return changes the
+  function's signature and every caller, which this rule cannot verify is
+  safe.
+rule:
+  pattern: panic($MSG)
+ignores:
+  - "**/*_test.go"
+  - "**/cmd/**"
+tags:
+  - go
+  - idiom
+  - error-handling
+examples:
+  bad: |
+    func mustDivide(a, b int) int {
+        if b == 0 {
+            panic("division by zero")
+        }
+        return a / b
+    }
+  good: |
+    func divide(a, b int) (int, error) {
+        if b == 0 {
+            return 0, errors.New("division by zero")
+        }
+        return a / b, nil
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rules/go-no-underscore-func-name.yml

@@ -0,0 +1,35 @@
+# Go No Underscore in Function Names
+# Detects snake_case Go function names, which violate Go's camelCase
+# naming convention.
+# Ported from vinhnx/VTCode rules/go/no-underscore-func-name.yml
+# (#2200, refs #2195).
+id: go-no-underscore-func-name
+language: go
+severity: hint
+message: "Use camelCase for Go function names, not snake_case"
+note: |
+  Go convention uses camelCase for function names (e.g. getUserName, not
+  get_user_name). Detection-only, with no autofix: renaming a function
+  requires updating every call site, and an exported (capitalized) name
+  change also breaks API compatibility for downstream importers. Scoped to
+  non-test Go files.
+rule:
+  pattern: func $NAME($$$) $$$ { $$$ }
+constraints:
+  NAME:
+    regex: "^[a-z_]*_[a-z]"
+ignores:
+  - "**/*_test.go"
+tags:
+  - go
+  - idiom
+  - naming-convention
+examples:
+  bad: |
+    func get_user_name(id int) string {
+        return ""
+    }
+  good: |
+    func getUserName(id int) string {
+        return ""
+    }

package/node_modules/pi-lens/rules/ast-grep-rules/rules/go-prefer-errors-is.yml

@@ -0,0 +1,40 @@
+# Go Prefer errors.Is Over Direct Comparison
+# Detects direct == / != comparison against an error-shaped identifier,
+# which fails to match wrapped errors.
+# Ported from vinhnx/VTCode rules/go/prefer-errors-is.yml (#2200, refs #2195).
+id: go-prefer-errors-is
+language: go
+severity: hint
+message: "Use errors.Is(err, target) instead of direct comparison for error checking"
+note: |
+  Direct comparison (err == target / err != target) fails for wrapped
+  errors. errors.Is unwraps the error chain and compares each layer, which
+  is the idiomatic check for a specific error value in Go 1.13+.
+  Detection-only, with no autofix: VTCode ships an unconditional
+  `fix: errors.Is($ERR, $TARGET)`, but that rewrite is wrong for the `!=`
+  form (it needs `!errors.Is(...)`) and requires inserting an `errors`
+  import the rule cannot verify is already present, so pi-lens withholds
+  the fix pending a review of both branches (per the #2195 triage verdict).
+  Scoped to non-test Go files.
+rule:
+  any:
+    - pattern: $ERR == $TARGET
+    - pattern: $ERR != $TARGET
+constraints:
+  TARGET:
+    regex: "^(Err|err|[A-Z].*[Ee]rror|os\\.Err)"
+ignores:
+  - "**/*_test.go"
+tags:
+  - go
+  - idiom
+  - error-handling
+examples:
+  bad: |
+    if err == os.ErrNotExist {
+        return nil
+    }
+  good: |
+    if errors.Is(err, os.ErrNotExist) {
+        return nil
+    }