@herbertgao/pi-extensions 2026.9.6 → 2026.9.7

package/node_modules/pi-lens/rules/tree-sitter-queries/typescript/sql-injection.yml

@@ -1,15 +1,13 @@
 # SQL Injection Detection
 # Detects unsafe interpolation in SQL-like template literals.
-# Demoted from error/blocking to warning on 2026-09-10 (maintainer): the
-# query keys on the callee NAME only (query|execute|exec|run), so any
-# `run(`…${x}…`)` / `exec(`…`)` in non-SQL code fires — too many false
-# positives to block on. A real SQL sink needs a receiver/type signal.
+# The structural query keeps the common callee set, while the TypeScript-aware
+# post-filter requires a receiver bound to a known DB client or a SQL-leading template.
 id: sql-injection
 name: SQL Injection Risk
-severity: warning
+severity: error
 category: security
 defect_class: injection
-inline_tier: warning
+inline_tier: blocking
 language: typescript
 
 message: "SQL injection risk — use parameterized queries, never interpolate into SQL"
@@ -30,18 +28,32 @@ description: |
 
 query: |
   (call_expression
-    function: [
-      (identifier) @SQL_FUNC
-      (member_expression property: (property_identifier) @SQL_FUNC)
-    ]
+    function: (identifier) @SQL_FUNC
     arguments: (arguments
-      (template_string (template_substitution) @INTERPOLATION))
-    (#match? @SQL_FUNC "^(query|execute|exec|run)$"))
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (arguments
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (template_string (template_substitution) @INTERPOLATION) @TEMPLATE
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
 
 metavars:
   - SQL_FUNC
+  - OBJ
+  - TEMPLATE
   - INTERPOLATION
 
+post_filter: ts_sql_injection_sink
+
 has_fix: false
 
 tags:

package/node_modules/pi-lens/scripts/analyze-pi-lens-logs.mjs

@@ -195,6 +195,7 @@ function createState(files) {
 		projects: counter(),
 		smellTotals: counter(),
 		latency: {
+			testRunnerVerdicts: new Map(),
 			runnerStatus: counter(),
 			runnerFailureKinds: counter(),
 			runnerBlockingFindings: counter(),
@@ -381,6 +382,22 @@ async function analyzeLatency(files, state) {
 				const phase = entry.phase ?? "unknown";
 				state.latency.phaseCounts.inc(phase);
 				if (phase.endsWith("_timeout")) state.latency.phaseTimeouts.inc(phase);
+				if (phase === "test_runner_verdict_delivery") {
+					const sessionId = entry.metadata?.sessionId ?? "unknown";
+					const summary = state.latency.testRunnerVerdicts.get(sessionId) ?? {
+						total: 0,
+						stale: 0,
+						unknown: 0,
+					};
+					const verdictCount = entry.metadata?.verdictCount;
+					const staleCount = entry.metadata?.staleCount;
+					const unknownCount = entry.metadata?.unknownCount;
+					summary.total += typeof verdictCount === "number" ? verdictCount : 1;
+					if (typeof staleCount === "number") summary.stale += staleCount;
+					else if (entry.metadata?.stale === true) summary.stale += 1;
+					if (typeof unknownCount === "number") summary.unknown += unknownCount;
+					state.latency.testRunnerVerdicts.set(sessionId, summary);
+				}
 				if (phase === "config_resolved") {
 					// #2526. Counted here rather than derived from phaseCounts so the
 					// legacy/record cross-check reads the same row it counts.
@@ -1481,6 +1498,18 @@ function buildReport(state) {
 			shownInlineShownAgentUnresolved: state.diagnostics.shownInline.toJSON(),
 		},
 		latency: {
+			testRunnerVerdicts: Object.fromEntries(
+				[...state.latency.testRunnerVerdicts.entries()].map(
+					([sessionId, summary]) => [
+						sessionId,
+						{
+							...summary,
+							denominator: summary.total,
+							rate: summary.total ? summary.stale / summary.total : 0,
+						},
+					],
+				),
+			),
 			runnerStatus: state.latency.runnerStatus.top(limit * 2),
 			runnerFailureKinds: state.latency.runnerFailureKinds.top(limit * 2),
 			runnerBlockingFindings: state.latency.runnerBlockingFindings.toJSON(),
@@ -1672,6 +1701,17 @@ function printReport(report) {
 		report.latency.runnerFailureKinds,
 		(x) => `${x.count.toString().padStart(5)}  ${x.key}`,
 	);
+	const verdictSessions = Object.entries(
+		report.latency.testRunnerVerdicts ?? {},
+	);
+	if (verdictSessions.length) {
+		console.log("\nTest-runner stale verdicts per session");
+		for (const [sessionId, summary] of verdictSessions) {
+			console.log(
+				`  ${sessionId}: ${summary.stale}/${summary.total} stale (${(summary.rate * 100).toFixed(1)}%)`,
+			);
+		}
+	}
 
 	const a = report.actionable;
 	if (a.reports || a.advisoriesInjected) {

package/node_modules/pi-lens/skills/pi-lens-ast-grep/SKILL.md

@@ -9,6 +9,21 @@ Use `ast_grep_search` and `ast_grep_replace` for semantic code search/replace. a
 
 These tools (plus `ast_grep_outline`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `pi_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
 
+On hosts that aggregate pi-lens behind a single `lens` tool, the `ast_grep_*` tools and `pi_lens_activate_tools` may not be registered at all. There, fall back to the `ast-grep` CLI (alias `sg`) — patterns, metavariables, and YAML rules are identical:
+
+```bash
+# search (≈ ast_grep_search)
+ast-grep run -p 'fetchMetrics($$$ARGS)' -l ts src/
+
+# rewrite (≈ ast_grep_replace; -U applies all)
+ast-grep run -p 'var $X' -r 'let $X' -l js src/ -U
+
+# full YAML rule (≈ the rule: parameter)
+ast-grep scan --rule my-rule.yml src/
+```
+
+Structural-intent parameters map to YAML constraints: `insideKind` → `inside: { kind: ..., stopBy: end }`, `hasKind`/`hasDescendantKind` → `has: { kind: ... }`, `follows` → `follows: { pattern: ... }`, `precedes` → `precedes: { pattern: ... }`.
+
 ## When to Use
 
 - Function calls, imports, class methods (structured code)

package/node_modules/pi-lens/skills/pi-lens-lsp-navigation/SKILL.md

@@ -7,6 +7,13 @@ description: Navigate code with IDE features and run proactive LSP diagnostics o
 
 Use `lsp_navigation` as **PRIMARY** for code intelligence. Use `lens_diagnostics` with `source=lsp` as **PRIMARY** for proactive type/error checks. Do NOT use grep/glob/ast-grep first for code intelligence.
 
+## Aggregate-tool hosts
+
+Some hosts expose pi-lens through a single aggregate tool — `lens(action=...)` — instead of registering the standalone names below. On those hosts:
+
+- Proactive checks: `lens({ action: "lsp_diagnostics", ... })` — same parameters as the table below; the cached-report entry point maps to `lens({ action: "diagnostics", ... })`.
+- If `lsp_navigation` is not among the aggregate's actions, do not call the standalone name: use the host's structural search funnel (`symbol_search` → `module_report` → `read_symbol`) or the `ast-grep` CLI for navigation instead.
+
 ## Diagnostics
 
 Use `lens_diagnostics` with `source=lsp` before builds/tests or after touching several files:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-extensions",
-  "version": "2026.9.6",
+  "version": "2026.9.7",
   "description": "Aggregate installer for HerbertGao-maintained Pi extensions.",
   "keywords": [
     "extensions",
@@ -46,16 +46,15 @@
     "@herbertgao/sol-pi": "0.3.0",
     "@juicesharp/rpiv-ask-user-question": "2.10.1",
     "@juicesharp/rpiv-config": "^2.10.1",
-    "@luxusai/pi-hindsight": "0.12.0",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/core": "2.0.0",
     "@modelcontextprotocol/ext-apps": "^1.2.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@mozilla/readability": "^0.6.0",
     "@napi-rs/keyring": "^1.3.0",
-    "@narumitw/pi-btw": "0.58.1",
+    "@narumitw/pi-btw": "0.59.0",
     "@narumitw/pi-caffeinate": "0.49.7",
-    "@narumitw/pi-tui-kit": "^0.59.0",
+    "@narumitw/pi-tui-kit": "^0.64.0",
     "@noble/ed25519": "^3.1.0",
     "@pi-plugins/fast-mode": "0.1.12",
     "@shikijs/cli": "^4.0.2",
@@ -67,7 +66,6 @@
     "@tifan/pi-preferred-thinking": "1.0.2",
     "@tifan/pi-recap": "0.4.7",
     "@tifan/pi-rename": "0.6.0",
-    "@vectorize-io/hindsight-client": "^0.9.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "chalk": "^6.0.0",
@@ -76,10 +74,9 @@
     "dbus-native": "^0.15.2",
     "defuddle": "0.19.3",
     "gpt-tokenizer": "^3.4.0",
-    "grok-mermaid": "0.2.2",
+    "grok-mermaid": "0.2.3",
     "jiti": "^2.7.0",
     "js-yaml": "^5.2.2",
-    "jsonc-parser": "^3.3.1",
     "linkedom": "^0.16.0",
     "minimatch": "^10.2.6",
     "nanoid": "^5.0.0",
@@ -87,7 +84,7 @@
     "p-limit": "^6.1.0",
     "pi-antigravity": "0.7.2",
     "pi-footer": "0.5.1",
-    "pi-lens": "4.1.6",
+    "pi-lens": "4.2.0",
     "pi-mcp-adapter": "2.34.0",
     "pi-web-access": "0.29.0",
     "pidusage": "^4.0.1",
@@ -117,7 +114,6 @@
     "@herbertgao/resume-from",
     "@herbertgao/sol-pi",
     "@juicesharp/rpiv-ask-user-question",
-    "@luxusai/pi-hindsight",
     "@narumitw/pi-btw",
     "@narumitw/pi-caffeinate",
     "@pi-plugins/fast-mode",
@@ -155,7 +151,6 @@
       "./node_modules/@herbertgao/pi-subagents/src/index.ts",
       "./node_modules/@juicesharp/rpiv-ask-user-question/index.ts",
       "./node_modules/@herbertgao/pi-bark/src/index.ts",
-      "./node_modules/@luxusai/pi-hindsight/extensions/index.ts",
       "./node_modules/@narumitw/pi-btw/dist/index.ts",
       "./node_modules/@narumitw/pi-caffeinate/dist/index.ts",
       "./node_modules/@pi-plugins/fast-mode/dist/index.mjs",
@@ -172,7 +167,6 @@
     ],
     "skills": [
       "./node_modules/@dietrichgebert/ponytail/skills",
-      "./node_modules/@luxusai/pi-hindsight/skills",
       "./node_modules/pi-mcp-adapter/skills",
       "./node_modules/pi-lens/skills"
     ]