@herbertgao/pi-extensions 2026.9.6 → 2026.9.7

package/node_modules/pi-lens/dist/clients/tool-policy.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { TERRAGRUNT_FILENAMES } from "./file-kinds.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { logLatency } from "./latency-logger.js";
 import { resolvePackagePath } from "./package-root.js";
 import { findNearestContaining, normalizeMapKey, walkUpDirs, } from "./path-utils.js";
@@ -371,6 +372,24 @@ const FORMATTER_POLICY_BY_EXTENSION = new Map([
             gate: "smart-default",
         },
     ],
+    [
+        ".typ",
+        {
+            formatterNames: ["typstyle"],
+            defaultFormatter: "typstyle",
+            defaultWhenUnconfigured: true,
+            gate: "smart-default",
+        },
+    ],
+    [
+        ".typc",
+        {
+            formatterNames: ["typstyle"],
+            defaultFormatter: "typstyle",
+            defaultWhenUnconfigured: true,
+            gate: "smart-default",
+        },
+    ],
     [
         ".c",
         {
@@ -738,6 +757,7 @@ const AUTO_INSTALLABLE_DEFAULT_FORMATTERS = new Map([
     ["shfmt", "shfmt"],
     ["taplo", "taplo"],
     ["ktlint", "ktlint"],
+    ["typstyle", "typstyle"],
 ]);
 // `gate: "smart-default"` so a matched file is formatted only when nothing else
 // claims it. Misdetection edge: `root.hcl` is filename-detected as terragrunt, so
@@ -1633,17 +1653,25 @@ export function getAutofixPolicyForFile(filePath, context = {}) {
 export function getPreferredAutofixTools(filePath, context) {
     return getAutofixPolicyForFile(filePath, context)?.preferredTools ?? [];
 }
-const ESLINT_CONFIGS = [
+// Flat-config filenames resolve like ESLint itself: upward from cwd without
+// stopping at an intermediate package.json (#3017, shape 39). Legacy
+// `.eslintrc.*` names and the `package.json#eslintConfig` field keep the
+// historic per-package boundary below.
+const ESLINT_FLAT_CONFIGS = [
+    "eslint.config.js",
+    "eslint.config.mjs",
+    "eslint.config.cjs",
+    "eslint.config.ts",
+    "eslint.config.mts",
+    "eslint.config.cts",
+];
+const ESLINT_LEGACY_CONFIGS = [
     ".eslintrc",
     ".eslintrc.js",
     ".eslintrc.cjs",
     ".eslintrc.json",
     ".eslintrc.yaml",
     ".eslintrc.yml",
-    "eslint.config.js",
-    "eslint.config.mjs",
-    "eslint.config.cjs",
-    "eslint.config.ts",
 ];
 function* walkUpDirsUntilPackageJson(cwd) {
     for (const dir of walkUpDirs(cwd)) {
@@ -1692,8 +1720,19 @@ export function hasNearestPackageJsonField(cwd, fieldName) {
     return false;
 }
 export function hasEslintConfig(cwd) {
+    // Flat configs mirror ESLint's own discovery: every ancestor dir up to
+    // the filesystem root, ignoring intermediate package.json boundaries, so
+    // a monorepo root config stays visible from inside a nested package.
+    for (const dir of walkUpDirs(cwd)) {
+        for (const cfg of ESLINT_FLAT_CONFIGS) {
+            if (fs.existsSync(path.join(dir, cfg)))
+                return true;
+        }
+    }
+    // Legacy `.eslintrc.*` and `package.json#eslintConfig` keep per-package
+    // semantics: the walk stops at the nearest package.json.
     for (const dir of walkUpDirsUntilPackageJson(cwd)) {
-        for (const cfg of ESLINT_CONFIGS) {
+        for (const cfg of ESLINT_LEGACY_CONFIGS) {
             if (fs.existsSync(path.join(dir, cfg)))
                 return true;
         }
@@ -2231,6 +2270,16 @@ const KOTLIN_GRADLE_FILES = [
     "settings.gradle.kts",
     "settings.gradle",
 ];
+const GRADLE_KTLINT_PLUGIN_PATTERN = /(?:id\s*\(\s*|id\s+|apply\s+plugin\s*:\s*)["']org\.jlleitschuh\.gradle\.ktlint["']/g;
+const GRADLE_BUILD_LOGIC_DIRS = ["buildSrc", "build-logic"];
+const GRADLE_BUILD_LOGIC_EXTENSIONS = [".gradle", ".gradle.kts", ".kt"];
+const GRADLE_INCLUDE_BUILD_PATTERN = /\bincludeBuild\s*\(\s*["']([^"']+)["']/g;
+/**
+ * Bound the synchronous ownership probe so a large convention tree cannot
+ * stall every autofix. Exceeding it is an unknown ownership result, not proof
+ * of no owner, and callers must decline the write (#3004).
+ */
+export const GRADLE_BUILD_LOGIC_SCAN_MAX_ENTRIES = 10_000;
 const spotlessKotlinConfigCache = new Map();
 let spotlessGradleReadCount = 0;
 /** Test-only observability for asserting the hot-path I/O bound. */
@@ -2429,6 +2478,110 @@ export function getSpotlessKotlinFormatter(cwd) {
 export function hasKtlintConfig(cwd) {
     return getSpotlessKotlinFormatter(cwd) === "ktlint";
 }
+/**
+ * Whether Gradle build logic applies the ktlint Gradle plugin. The plugin
+ * establishes project ownership of ktlint, but its plugin version is not a
+ * ktlint CLI version and must never be used as one (#3000).
+ */
+export function hasGradleKtlintPlugin(cwd) {
+    const files = new Set();
+    const scan = { entries: 0, exceeded: false, indeterminate: false };
+    for (const dir of walkUpDirs(cwd)) {
+        for (const gradle of KOTLIN_GRADLE_FILES) {
+            const filePath = path.join(dir, gradle);
+            if (fs.existsSync(filePath))
+                files.add(filePath);
+        }
+        for (const buildLogicDir of GRADLE_BUILD_LOGIC_DIRS) {
+            if (!addGradleBuildLogicFiles(path.join(dir, buildLogicDir), files, scan)) {
+                scan.exceeded = true;
+            }
+        }
+        for (const settings of ["settings.gradle.kts", "settings.gradle"]) {
+            const settingsPath = path.join(dir, settings);
+            if (!fs.existsSync(settingsPath))
+                continue;
+            try {
+                const raw = fs.readFileSync(settingsPath, "utf-8");
+                const stripped = stripGradleCommentsAndStrings(raw);
+                GRADLE_INCLUDE_BUILD_PATTERN.lastIndex = 0;
+                let match;
+                while ((match = GRADLE_INCLUDE_BUILD_PATTERN.exec(raw)) !== null) {
+                    const code = stripped.slice(match.index, match.index + match[0].length);
+                    const includedBuild = match[1];
+                    if (includedBuild && /^\s*includeBuild\s*\(\s*/.test(code)) {
+                        if (!addGradleBuildLogicFiles(path.resolve(dir, includedBuild), files, scan)) {
+                            scan.exceeded = true;
+                        }
+                    }
+                }
+            }
+            catch {
+                scan.indeterminate = true;
+            }
+        }
+    }
+    if (scan.exceeded) {
+        recordDegradationOnce({
+            kind: "gradle-ktlint-scan-budget-exceeded",
+            subject: "ktlint:gradle-build-logic",
+            reason: `Gradle build-logic ownership scan exceeded its ${GRADLE_BUILD_LOGIC_SCAN_MAX_ENTRIES}-entry budget; ` +
+                "ownership cannot be established, so ktlint autofix is declined",
+        });
+        return { kind: "indeterminate" };
+    }
+    if (scan.indeterminate)
+        return { kind: "indeterminate" };
+    for (const filePath of files) {
+        try {
+            const raw = fs.readFileSync(filePath, "utf-8");
+            const stripped = stripGradleCommentsAndStrings(raw);
+            GRADLE_KTLINT_PLUGIN_PATTERN.lastIndex = 0;
+            let match;
+            while ((match = GRADLE_KTLINT_PLUGIN_PATTERN.exec(raw)) !== null) {
+                const code = stripped.slice(match.index, match.index + match[0].length);
+                if (!/^\s*$/.test(code))
+                    return { kind: "owned" };
+            }
+        }
+        catch {
+            return { kind: "indeterminate" };
+        }
+    }
+    return { kind: "not-owned" };
+}
+function addGradleBuildLogicFiles(root, files, scan) {
+    if (!fs.existsSync(root))
+        return true;
+    const pending = [root];
+    while (pending.length > 0) {
+        const dir = pending.pop();
+        if (!dir)
+            continue;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            scan.indeterminate = true;
+            continue;
+        }
+        for (const entry of entries) {
+            scan.entries += 1;
+            if (scan.entries > GRADLE_BUILD_LOGIC_SCAN_MAX_ENTRIES)
+                return false;
+            const entryPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                pending.push(entryPath);
+            }
+            else if (entry.isFile() &&
+                GRADLE_BUILD_LOGIC_EXTENSIONS.some((extension) => entry.name.endsWith(extension))) {
+                files.add(entryPath);
+            }
+        }
+    }
+    return true;
+}
 export function hasKtfmtConfig(cwd) {
     const spotlessFormatter = getSpotlessKotlinFormatter(cwd);
     if (spotlessFormatter)
@@ -2557,7 +2710,10 @@ const OXLINT_CONFIGS = [
     "oxlint.config.mts",
 ];
 export function hasOxlintConfig(cwd) {
-    for (const dir of walkUpDirsUntilPackageJson(cwd)) {
+    // Oxlint auto-discovers the nearest config by file location, so the walk
+    // ignores intermediate package.json boundaries just like the flat
+    // ESLint branch above (#3017).
+    for (const dir of walkUpDirs(cwd)) {
         for (const cfg of OXLINT_CONFIGS) {
             if (fs.existsSync(path.join(dir, cfg)))
                 return true;

package/node_modules/pi-lens/dist/clients/tree-sitter-client.js

@@ -57,6 +57,14 @@ const PYTHON_SQL_SINK_METHODS = new Set([
     "query",
     "raw",
 ]);
+const TYPESCRIPT_SQL_KNOWN_PACKAGES = new Set([
+    "pg",
+    "mysql2",
+    "better-sqlite3",
+    "knex",
+    "@prisma/client",
+]);
+const TYPESCRIPT_SQL_IMPORTS = new WeakMap();
 const NOT_PARSED = { parsed: false };
 function createParserCounters() {
     return {
@@ -3408,6 +3416,118 @@ export class TreeSitterClient {
             case "ts_command_injection_sink":
                 return (captures.MOD?.text === "child_process" &&
                     /^(exec|execSync)$/.test(captures.FN?.text ?? ""));
+            case "ts_sql_injection_sink": {
+                const template = captures.TEMPLATE?.text ?? "";
+                // Inspect only the template's raw prefix. Leading SQL comments are
+                // ignored; comments and unrelated strings elsewhere cannot satisfy it.
+                const rawPrefix = template
+                    .replace(/^`/, "")
+                    .replace(/`$/, "")
+                    .replace(/^(?:\s|\/\*[\s\S]*?\*\/|--[^\n]*(?:\n|$))*/, "");
+                if (/^(?:SELECT[\s\S]*(?:\bFROM\b|\$\{)|INSERT\s+INTO\b|UPDATE\s+[\s\S]*\bSET\b|DELETE\s+FROM\b|CREATE\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|DROP\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|ALTER\s+(?:OR\s+REPLACE\s+|TEMP(?:ORARY)?\s+|UNIQUE\s+|MATERIALIZED\s+)*(?:TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|PROCEDURE|SEQUENCE|TYPE|EXTENSION)\b|GRANT\b|REVOKE\b|WITH[\s\S]*\bSELECT\b|MERGE\s+INTO\b|TRUNCATE\s+TABLE\b|REPLACE\s+INTO\b)/i.test(rawPrefix))
+                    return true;
+                if (!rootNode || !captures.OBJ)
+                    return false;
+                let imported = TYPESCRIPT_SQL_IMPORTS.get(rootNode);
+                if (!imported) {
+                    const names = new Set();
+                    const stack = [rootNode];
+                    while (stack.length > 0) {
+                        const node = stack.pop();
+                        if (!node)
+                            continue;
+                        if (node.type === "import_statement") {
+                            const source = node.childForFieldName?.("source")?.text ?? "";
+                            const packageName = source.replace(/^['"]|['"]$/g, "");
+                            const isKnown = [...TYPESCRIPT_SQL_KNOWN_PACKAGES].some((pkg) => packageName === pkg || packageName.startsWith(`${pkg}/`));
+                            if (isKnown) {
+                                const importStack = [node];
+                                while (importStack.length > 0) {
+                                    const importNode = importStack.pop();
+                                    if (!importNode)
+                                        continue;
+                                    if (importNode.type === "identifier" ||
+                                        importNode.type === "import_specifier") {
+                                        names.add(importNode.text);
+                                    }
+                                    importStack.push(...importNode.children);
+                                }
+                            }
+                        }
+                        stack.push(...node.children);
+                    }
+                    const declarations = new Map();
+                    const declarationStack = [rootNode];
+                    while (declarationStack.length > 0) {
+                        const node = declarationStack.pop();
+                        if (!node)
+                            continue;
+                        if (node.type === "variable_declarator") {
+                            const name = node.childForFieldName?.("name")?.text;
+                            const value = node.childForFieldName?.("value");
+                            if (name && value)
+                                declarations.set(name, value);
+                        }
+                        declarationStack.push(...node.children);
+                    }
+                    const resolvesKnownValue = (node, seen = new Set()) => {
+                        if (node.type === "identifier") {
+                            if (names.has(node.text))
+                                return true;
+                            if (seen.has(node.text))
+                                return false;
+                            const value = declarations.get(node.text);
+                            if (!value)
+                                return false;
+                            seen.add(node.text);
+                            return resolvesKnownValue(value, seen);
+                        }
+                        if (node.type === "await_expression") {
+                            const value = node.children.find((child) => child.isNamed);
+                            return value ? resolvesKnownValue(value, seen) : false;
+                        }
+                        if (node.type === "new_expression") {
+                            const ctor = node.childForFieldName?.("constructor");
+                            return ctor ? resolvesKnownValue(ctor, seen) : false;
+                        }
+                        if (node.type === "call_expression") {
+                            const fn = node.childForFieldName?.("function");
+                            return fn ? resolvesKnownValue(fn, seen) : false;
+                        }
+                        return false;
+                    };
+                    let changed = true;
+                    while (changed) {
+                        changed = false;
+                        for (const [name, value] of declarations) {
+                            if (!names.has(name) && resolvesKnownValue(value)) {
+                                names.add(name);
+                                changed = true;
+                            }
+                        }
+                    }
+                    imported = names;
+                    TYPESCRIPT_SQL_IMPORTS.set(rootNode, imported);
+                }
+                const resolvesToKnownClient = (node) => {
+                    if (node.type === "identifier")
+                        return imported.has(node.text);
+                    if (node.type === "await_expression") {
+                        const value = node.children.find((child) => child.isNamed);
+                        return value ? resolvesToKnownClient(value) : false;
+                    }
+                    if (node.type === "new_expression") {
+                        const ctor = node.childForFieldName?.("constructor");
+                        return ctor ? resolvesToKnownClient(ctor) : false;
+                    }
+                    if (node.type === "call_expression") {
+                        const fn = node.childForFieldName?.("function");
+                        return fn ? resolvesToKnownClient(fn) : false;
+                    }
+                    return false;
+                };
+                return resolvesToKnownClient(captures.OBJ);
+            }
             case "ts_ssrf_sink": {
                 const fn = captures.FN?.text ?? "";
                 const obj = captures.OBJ?.text ?? "";