@runa-ai/runa-cli 0.7.1 → 0.7.2

package/dist/{risk-detector-4U6ZJ2G5.js → risk-detector-VO5HJR4R.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-export { categorizeRisks, detectSchemaRisks } from './chunk-H2AHNI75.js';
+export { categorizeRisks, detectSchemaRisks } from './chunk-LCK2LGVR.js';
 import './chunk-VRXHCR5K.js';
 
 createRequire(import.meta.url);

package/dist/{risk-detector-core-TK4OAI3N.js → risk-detector-core-7WZJZ5ZI.js}

@@ -35,10 +35,26 @@ var MAX_SCHEMA_RISK_ANALYSIS_BYTES = Math.max(
   )
 );
 var SCAN_ABORT_REASON_CODE = "SCHEMA_SCAN_TOO_LARGE";
+var IDEMPOTENT_SQL_PATH_PATTERN = /[\\/]supabase[\\/]schemas[\\/]idempotent[\\/]/i;
+var SESSION_SEARCH_PATH_WITH_EXTENSIONS = /\bSET\s+(?:LOCAL\s+)?search_path\s+TO\b[^;]*\bextensions\b/i;
+var UNQUALIFIED_EXTENSION_REFERENCE_PATTERNS = [
+  {
+    pattern: /(^|[^A-Za-z0-9_."'])(geometry|geography|vector|halfvec|sparsevec)\s*\(/gim,
+    detail: "unqualified extension type reference"
+  },
+  {
+    pattern: /(^|[^A-Za-z0-9_."'])(st_[a-z_][a-z0-9_]*)\s*\(/gim,
+    detail: "unqualified PostGIS function reference"
+  },
+  {
+    pattern: /(<->|<=>|<#>)/g,
+    detail: "pgvector operator reference"
+  }
+];
 var plpgsqlModulePromise = null;
 async function loadPlpgsqlRiskDetectorModule() {
   if (!plpgsqlModulePromise) {
-    plpgsqlModulePromise = import('./risk-detector-plpgsql-HWKS4OLR.js').catch((error) => {
+    plpgsqlModulePromise = import('./risk-detector-plpgsql-ULV7NLDB.js').catch((error) => {
       plpgsqlModulePromise = null;
       throw error;
     });
@@ -82,6 +98,37 @@ function detectForeignKeyRisks(searchableContent, originalContent, lineStarts) {
   }
   return risks;
 }
+function detectIdempotentSearchPathRisk(filePath, searchableContent, originalContent, lineStarts) {
+  if (!IDEMPOTENT_SQL_PATH_PATTERN.test(filePath)) {
+    return [];
+  }
+  if (SESSION_SEARCH_PATH_WITH_EXTENSIONS.test(searchableContent)) {
+    return [];
+  }
+  for (const { pattern, detail } of UNQUALIFIED_EXTENSION_REFERENCE_PATTERNS) {
+    pattern.lastIndex = 0;
+    const match = pattern.exec(searchableContent);
+    if (!match) continue;
+    const prefixLength = match[1]?.length ?? 0;
+    const matchIndex = (match.index ?? 0) + prefixLength;
+    return [
+      {
+        level: "medium",
+        description: "Idempotent SQL references extension objects without local SET search_path; separate psql sessions do not inherit declarative search_path",
+        mitigation: 'Add `SET search_path TO "$user", public, extensions;` to this idempotent file or schema-qualify extension objects such as `extensions.vector(...)`.',
+        line: lineNumberFromIndex(originalContent, matchIndex, lineStarts),
+        reasonCode: "IDEMPOTENT_EXTENSION_SEARCH_PATH_REQUIRED",
+        confidence: "high",
+        evidence: {
+          source: "detectSchemaRisks",
+          snippet: match[0].trim(),
+          detail
+        }
+      }
+    ];
+  }
+  return [];
+}
 async function detectSchemaRisks(filePath) {
   try {
     if (!existsSync(filePath)) {
@@ -97,10 +144,21 @@ async function detectSchemaRisks(filePath) {
     const searchableContent = stripSqlStringsPreserveLines(commentStripped);
     const contentLineStarts = buildLineStarts(content);
     const contentRisks = detectRisksFromContent(searchableContent, content, contentLineStarts);
+    const idempotentSearchPathRisks = detectIdempotentSearchPathRisk(
+      filePath,
+      searchableContent,
+      content,
+      contentLineStarts
+    );
     const { detectPlpgsqlDynamicExecutionRisks } = await loadPlpgsqlRiskDetectorModule();
-    const plpgsqlRisks = detectPlpgsqlDynamicExecutionRisks(maskedContent);
+    const plpgsqlRisks = await detectPlpgsqlDynamicExecutionRisks(maskedContent, { filePath });
     const fkRisks = detectForeignKeyRisks(searchableContent, content, contentLineStarts);
-    const risks = deduplicateSchemaRisksBySeverity([...contentRisks, ...plpgsqlRisks, ...fkRisks]);
+    const risks = deduplicateSchemaRisksBySeverity([
+      ...contentRisks,
+      ...idempotentSearchPathRisks,
+      ...plpgsqlRisks,
+      ...fkRisks
+    ]);
     return risks;
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown parse error";