codeguardian-mcp 1.3.6 → 1.3.8

package/dist/tools/validation/validation.js

@@ -19,10 +19,10 @@ import * as path from "path";
 import * as fsSync from "fs";
 import { globSync } from "glob";
 import { resolveImport } from "../../context/projectContext.js";
-import { extractSymbolsAST, collectLocalDefinitionsAST } from "./extractors/index.js";
+import { extractSymbolsAST, collectLocalDefinitionsAST, } from "./extractors/index.js";
 import { parseCodeCached } from "./parser.js";
 import { suggestSimilar, extractSimilarSymbols } from "./scoring.js";
-import { isPythonSymbolExported, getPythonPipNameForImport } from "./manifest.js";
+import { isPythonSymbolExported, getPythonPipNameForImport, } from "./manifest.js";
 import { isJSBuiltin, isPythonBuiltin, isTSBuiltinType, NODE_BUILTIN_MODULES, } from "./builtins.js";
 import { usagePatternAnalyzer } from "../../analyzers/usagePatterns.js";
 import { isContextuallyValid, } from "./contextualNaming.js";
@@ -50,7 +50,12 @@ function findPrismaSchemaPathSync(projectPath) {
     // (best-effort; guarded by caching so it won't run repeatedly).
     try {
         const matches = globSync(path.join(projectPath, "**/prisma/schema.prisma"), {
-            ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", "**/.git/**"],
+            ignore: [
+                "**/node_modules/**",
+                "**/dist/**",
+                "**/build/**",
+                "**/.git/**",
+            ],
             nodir: true,
             absolute: true,
         });
@@ -124,8 +129,8 @@ export async function validateManifest(imports, manifest, newCode, language = "t
         }
         // Check if package is in manifest
         if (!manifest.all.has(pkgName)) {
-            const scopedName = imp.module.startsWith("@") ?
-                imp.module.split("/").slice(0, 2).join("/")
+            const scopedName = imp.module.startsWith("@")
+                ? imp.module.split("/").slice(0, 2).join("/")
                 : pkgName;
             if (!manifest.all.has(scopedName)) {
                 // For Python, check if this import name is a known alias of a pip package
@@ -141,7 +146,7 @@ export async function validateManifest(imports, manifest, newCode, language = "t
     if (unknownPackages.length === 0)
         return issues;
     // Phase 2: Batch registry lookups — deduplicate and check in parallel
-    const uniquePkgNames = [...new Set(unknownPackages.map(u => u.pkgName))];
+    const uniquePkgNames = [...new Set(unknownPackages.map((u) => u.pkgName))];
     const REGISTRY_BATCH_SIZE = 10;
     const registryResults = new Map();
     for (let i = 0; i < uniquePkgNames.length; i += REGISTRY_BATCH_SIZE) {
@@ -487,8 +492,8 @@ typeReferences = []) {
     for (const sym of newCodeSymbols) {
         const projectSym = {
             name: sym.name,
-            type: sym.type === "interface" || sym.type === "type" ?
-                "variable"
+            type: sym.type === "interface" || sym.type === "type"
+                ? "variable"
                 : sym.type,
             file: "(new code)",
             params: sym.params,
@@ -606,7 +611,10 @@ typeReferences = []) {
                             file: resolvedFile || imp.module,
                         };
                         validVariables.set(name.local, namespaceSym);
-                        validFunctions.set(name.local, { ...namespaceSym, type: "function" });
+                        validFunctions.set(name.local, {
+                            ...namespaceSym,
+                            type: "function",
+                        });
                         validClasses.set(name.local, { ...namespaceSym, type: "class" });
                     }
                     continue;
@@ -623,7 +631,8 @@ typeReferences = []) {
                             // Double check against all symbols in file marked as exported
                             // (sometimes exports are implicit in simple extractors)
                             // For Python: ALL module-level names are importable (no export keyword)
-                            let symExport = fileInfo.symbols.find((s) => (language === "python" || s.exported) && s.name === name.imported);
+                            let symExport = fileInfo.symbols.find((s) => (language === "python" || s.exported) &&
+                                s.name === name.imported);
                             // For Python: check if the symbol is imported at module level in the target file.
                             // In Python, any name imported at module level is part of the module's namespace
                             // and is importable by other modules (e.g., `from app.api.cli_tokens import CLIToken`
@@ -633,7 +642,12 @@ typeReferences = []) {
                                     modImp.defaultImport === name.imported);
                                 if (isImportedInModule) {
                                     // Treat as found — symbol is a valid Python namespace member via re-import
-                                    symExport = { name: name.imported, kind: "variable", line: 0, exported: true };
+                                    symExport = {
+                                        name: name.imported,
+                                        kind: "variable",
+                                        line: 0,
+                                        exported: true,
+                                    };
                                 }
                             }
                             if (!symExport) {
@@ -645,7 +659,8 @@ typeReferences = []) {
                                         : path.dirname(resolvedFile);
                                     const subModPy = path.join(resolvedDir, `${name.imported}.py`);
                                     const subModInit = path.join(resolvedDir, name.imported, "__init__.py");
-                                    if (context.files.has(subModPy) || context.files.has(subModInit)) {
+                                    if (context.files.has(subModPy) ||
+                                        context.files.has(subModInit)) {
                                         // Valid sub-module import
                                         continue;
                                     }
@@ -759,7 +774,9 @@ typeReferences = []) {
                 if (language === "python" && projectSym) {
                     // First check if it's a sub-module file (sub-modules don't need __all__)
                     if (context) {
-                        const moduleDir = imp.module.replace(/^\.+/, "").replace(/\./g, "/");
+                        const moduleDir = imp.module
+                            .replace(/^\.+/, "")
+                            .replace(/\./g, "/");
                         const basePath = context.projectPath;
                         let subModFound = false;
                         const subModPy = path.join(basePath, moduleDir, `${name.imported}.py`);
@@ -821,7 +838,9 @@ typeReferences = []) {
                     // For Python: check if the imported name is a sub-module file
                     // e.g., "from app.api import auth" where app/api/auth.py exists
                     if (language === "python" && context) {
-                        const modulePath = imp.module.replace(/^\.+/, "").replace(/\./g, "/");
+                        const modulePath = imp.module
+                            .replace(/^\.+/, "")
+                            .replace(/\./g, "/");
                         const basePath = context.projectPath;
                         let resolvedSubMod = null;
                         const subModulePy = path.join(basePath, modulePath, `${name.imported}.py`);
@@ -946,7 +965,8 @@ typeReferences = []) {
                     const fn = valueNode.childForFieldName("function");
                     if (fn?.type === "member_expression") {
                         const prop = fn.childForFieldName("property");
-                        if (prop && newCode.slice(prop.startIndex, prop.endIndex) === "json") {
+                        if (prop &&
+                            newCode.slice(prop.startIndex, prop.endIndex) === "json") {
                             return true;
                         }
                     }
@@ -1045,8 +1065,8 @@ typeReferences = []) {
                 issues.push({
                     type: "nonExistentFunction",
                     severity: "critical",
-                    message: existsInProject ?
-                        `Function '${used.name}' exists in your project but is not imported in this file`
+                    message: existsInProject
+                        ? `Function '${used.name}' exists in your project but is not imported in this file`
                         : `Function '${used.name}' does not exist in project`,
                     line: used.line,
                     file: filePath,
@@ -1071,9 +1091,7 @@ typeReferences = []) {
                         existsInProject: true,
                         strictMode,
                     });
-                    const expectedRange = min === max
-                        ? `${max}`
-                        : `${min}-${max}`;
+                    const expectedRange = min === max ? `${max}` : `${min}-${max}`;
                     issues.push({
                         type: "wrongParamCount",
                         severity: "high",
@@ -1081,8 +1099,8 @@ typeReferences = []) {
                         line: used.line,
                         file: filePath,
                         code: used.code,
-                        suggestion: func.params ?
-                            `Expected params: ${func.params.join(", ")}`
+                        suggestion: func.params
+                            ? `Expected params: ${func.params.join(", ")}`
                             : `Check the function signature in ${func.file}`,
                         confidence,
                         reasoning,
@@ -1108,7 +1126,7 @@ typeReferences = []) {
                 // Example: `${sop.code}-${sop.number}`.toLowerCase().includes(q)
                 // Returning a pseudo-root like `${sop` causes false undefinedVariable findings.
                 if (trimmedObj.startsWith("`") ||
-                    trimmedObj.startsWith("\"") ||
+                    trimmedObj.startsWith('"') ||
                     trimmedObj.startsWith("'")) {
                     return "";
                 }
@@ -1139,7 +1157,9 @@ typeReferences = []) {
                         // Not a type assertion — check if it's an arithmetic/logical/nullish expression
                         // e.g., (i + 1), (value / 1000), (milestones || []), (budgetUsedPercentage || 0)
                         // These are NOT object references — skip method validation entirely.
-                        if (/[+\-*/%|&<>=!~^]/.test(innerExpr) || /\s\|\|\s/.test(innerExpr) || /\s\?\?\s/.test(innerExpr)) {
+                        if (/[+\-*/%|&<>=!~^]/.test(innerExpr) ||
+                            /\s\|\|\s/.test(innerExpr) ||
+                            /\s\?\?\s/.test(innerExpr)) {
                             return ""; // Not a valid object reference
                         }
                         // Otherwise extract from the inner expression (e.g., (myObj).method())
@@ -1177,15 +1197,20 @@ typeReferences = []) {
                 if (!first || first.toUpperCase() === first)
                     return "";
                 const candidate = first.toUpperCase() + rootObject.slice(1);
-                return projectClasses.has(candidate) || hasContextClass(candidate) ? candidate : "";
+                return projectClasses.has(candidate) || hasContextClass(candidate)
+                    ? candidate
+                    : "";
             })();
             const scopesToMatch = new Set([used.object, rootObject, inferredClassName].filter(Boolean));
             // CRITICAL FIX: Skip ALL 'this'/'self'/'cls' method calls - we can't validate class scope
             // The 'this' keyword (JS/TS) and 'self'/'cls' (Python) are always in scope within a class context
             // TypeScript/ESLint/mypy handle class method validation, not CodeGuardian
-            if (used.object === "this" || used.object?.startsWith("this.") ||
-                used.object === "self" || used.object?.startsWith("self.") ||
-                used.object === "cls" || used.object?.startsWith("cls.")) {
+            if (used.object === "this" ||
+                used.object?.startsWith("this.") ||
+                used.object === "self" ||
+                used.object?.startsWith("self.") ||
+                used.object === "cls" ||
+                used.object?.startsWith("cls.")) {
                 continue; // Trust class scope - this is not a hallucination risk
             }
             // Skip other whitelisted global objects and common patterns
@@ -1315,9 +1340,7 @@ typeReferences = []) {
                 // that `<model>` exists as a Prisma delegate derived from schema.prisma.
                 // This catches hallucinations like `prisma.ghostItems.findMany()`.
                 if (rootObject === "prisma" && typeof used.object === "string") {
-                    const expr = used.object
-                        .replace(/\s+/g, "")
-                        .replace(/\?\./g, ".");
+                    const expr = used.object.replace(/\s+/g, "").replace(/\?\./g, ".");
                     // Only handle the delegate form. Client-level methods like `prisma.$transaction()`
                     // have used.object === "prisma" and should not be checked here.
                     const parts = expr.split(".").filter(Boolean);
@@ -1373,9 +1396,18 @@ typeReferences = []) {
                 // NOT for generic whitelisted objects (db, prisma, etc.) where `as any` may
                 // be a legitimate workaround for missing type definitions.
                 const STEALTH_HALLUCINATION_GLOBALS = new Set([
-                    "window", "navigator", "document", "location", "history",
-                    "localStorage", "sessionStorage", "console", "process",
-                    "global", "globalThis", "Intl",
+                    "window",
+                    "navigator",
+                    "document",
+                    "location",
+                    "history",
+                    "localStorage",
+                    "sessionStorage",
+                    "console",
+                    "process",
+                    "global",
+                    "globalThis",
+                    "Intl",
                 ]);
                 if (STEALTH_HALLUCINATION_GLOBALS.has(rootObject)) {
                     const codeLine = used.code || "";
@@ -1403,7 +1435,8 @@ typeReferences = []) {
                     // Check for @ts-ignore or @ts-expect-error which indicates intentional bypass
                     const codeLines = newCode.split("\n");
                     const prevLine = codeLines[used.line - 2]; // line is 1-indexed
-                    if (prevLine?.includes("@ts-ignore") || prevLine?.includes("@ts-expect-error")) {
+                    if (prevLine?.includes("@ts-ignore") ||
+                        prevLine?.includes("@ts-expect-error")) {
                         issues.push({
                             type: "nonExistentMethod",
                             severity: "high",
@@ -1422,17 +1455,42 @@ typeReferences = []) {
                     // - prisma.pantryItem.create() - 'pantryItem' is a model name
                     // We should validate that the METHOD (findMany, create, etc.) is a known ORM method
                     // and flag hallucinated methods like hallucinateMissingFunction()
-                    const ORM_OBJECTS = new Set(["prisma", "db", "entityManager", "repository", "queryBuilder"]);
+                    const ORM_OBJECTS = new Set([
+                        "prisma",
+                        "db",
+                        "entityManager",
+                        "repository",
+                        "queryBuilder",
+                    ]);
                     if (ORM_OBJECTS.has(rootObject)) {
                         // Known Prisma methods
                         const KNOWN_PRISMA_METHODS = new Set([
                             // Model-level methods (called on prisma.model)
-                            "findMany", "findUnique", "findFirst", "findFirstOrThrow", "findUniqueOrThrow",
-                            "create", "createMany", "update", "updateMany", "upsert",
-                            "delete", "deleteMany", "count", "aggregate", "groupBy",
+                            "findMany",
+                            "findUnique",
+                            "findFirst",
+                            "findFirstOrThrow",
+                            "findUniqueOrThrow",
+                            "create",
+                            "createMany",
+                            "update",
+                            "updateMany",
+                            "upsert",
+                            "delete",
+                            "deleteMany",
+                            "count",
+                            "aggregate",
+                            "groupBy",
                             // Client-level methods (called on prisma)
-                            "$connect", "$disconnect", "$transaction", "$queryRaw", "$executeRaw",
-                            "$use", "$on", "$extends", "$extends",
+                            "$connect",
+                            "$disconnect",
+                            "$transaction",
+                            "$queryRaw",
+                            "$executeRaw",
+                            "$use",
+                            "$on",
+                            "$extends",
+                            "$extends",
                         ]);
                         // Check if this is a model-level call (prisma.modelName.method())
                         // or a client-level call (prisma.$method())
@@ -1443,7 +1501,8 @@ typeReferences = []) {
                                 // Check for @ts-ignore or @ts-expect-error which indicates intentional bypass
                                 const codeLines = newCode.split("\n");
                                 const prevLine = codeLines[used.line - 2]; // line is 1-indexed
-                                if (prevLine?.includes("@ts-ignore") || prevLine?.includes("@ts-expect-error")) {
+                                if (prevLine?.includes("@ts-ignore") ||
+                                    prevLine?.includes("@ts-expect-error")) {
                                     issues.push({
                                         type: "nonExistentMethod",
                                         severity: "high",
@@ -1482,7 +1541,8 @@ typeReferences = []) {
                 // Check if the object is a locally-defined variable (function params, assignments, loop vars, etc.)
                 localDefinitions.has(rootObject) ||
                 // Python: Check if rootObject is the base of a dotted import (e.g., `import concurrent.futures` → `concurrent`)
-                (language === "python" && imports.some(imp => imp.names.some(n => n.local.startsWith(rootObject + ".")))) ||
+                (language === "python" &&
+                    imports.some((imp) => imp.names.some((n) => n.local.startsWith(rootObject + ".")))) ||
                 // Always trust common short variable names in non-strict mode
                 (!strictMode &&
                     [
@@ -1630,7 +1690,8 @@ typeReferences = []) {
                         line: used.line,
                         file: filePath,
                         code: used.code,
-                        suggestion: suggestion || "Use a real React API (e.g., useState, useEffect, memo, forwardRef).",
+                        suggestion: suggestion ||
+                            "Use a real React API (e.g., useState, useEffect, memo, forwardRef).",
                         confidence: 86,
                         reasoning: `The object '${objectName}' is imported from 'react'. React's public API is stable; '${used.name}' is not in a conservative allowlist of common React namespace methods/hooks.`,
                     });
@@ -1647,7 +1708,9 @@ typeReferences = []) {
                     else if (!imp.isExternal) {
                         // For internal imports, check if we have CLASS info
                         const objClass = projectClasses.get(objectName) ||
-                            (inferredClassName ? projectClasses.get(inferredClassName) : undefined);
+                            (inferredClassName
+                                ? projectClasses.get(inferredClassName)
+                                : undefined);
                         if (objClass || inferredClassName) {
                             shouldCheck = true; // We have class info, so we can validate methods
                         }
@@ -1683,8 +1746,11 @@ typeReferences = []) {
                     // ONLY check if we have class info, otherwise we don't know the type enough to flag it
                     // Use projectClasses (actual class definitions), not validClasses (which includes all imports)
                     const objClass = projectClasses.get(objectName) ||
-                        (inferredClassName ? projectClasses.get(inferredClassName) : undefined);
-                    if ((objClass || inferredClassName) && objClass?.file !== "(new code)") {
+                        (inferredClassName
+                            ? projectClasses.get(inferredClassName)
+                            : undefined);
+                    if ((objClass || inferredClassName) &&
+                        objClass?.file !== "(new code)") {
                         shouldCheck = true;
                     }
                     // Local literal inference: method calls on obvious built-in types (e.g., array literals)
@@ -1731,30 +1797,260 @@ typeReferences = []) {
             // and won't appear in the project symbol table
             const FRAMEWORK_METHODS = new Set([
                 // Pydantic BaseModel methods (v1 + v2)
-                "model_validate", "model_dump", "model_json_schema", "model_copy",
-                "model_validate_json", "model_dump_json", "model_fields_set",
-                "model_construct", "model_post_init", "model_rebuild",
-                "dict", "json", "parse_obj", "parse_raw", "parse_file",
-                "from_orm", "schema", "schema_json", "validate", "update_forward_refs",
-                "copy", "construct",
-                // SQLAlchemy Model/Query methods
-                "query", "filter", "filter_by", "all", "first", "one", "one_or_none",
-                "get", "count", "delete", "update", "order_by", "limit", "offset",
-                "join", "outerjoin", "group_by", "having", "distinct", "subquery",
-                "scalar", "scalars", "execute", "add", "flush", "commit", "rollback",
-                "refresh", "expire", "expunge", "merge", "close",
+                "model_validate",
+                "model_dump",
+                "model_json_schema",
+                "model_copy",
+                "model_validate_json",
+                "model_dump_json",
+                "model_fields_set",
+                "model_construct",
+                "model_post_init",
+                "model_rebuild",
+                "dict",
+                "json",
+                "parse_obj",
+                "parse_raw",
+                "parse_file",
+                "from_orm",
+                "schema",
+                "schema_json",
+                "validate",
+                "update_forward_refs",
+                "copy",
+                "construct",
+                // SQLAlchemy Model/Query methods (legacy 1.x style)
+                "query",
+                "filter",
+                "filter_by",
+                "all",
+                "first",
+                "one",
+                "one_or_none",
+                "get",
+                "count",
+                "delete",
+                "update",
+                "order_by",
+                "limit",
+                "offset",
+                "join",
+                "outerjoin",
+                "group_by",
+                "having",
+                "distinct",
+                "subquery",
+                "scalar",
+                "scalars",
+                "execute",
+                "add",
+                "flush",
+                "commit",
+                "rollback",
+                "refresh",
+                "expire",
+                "expunge",
+                "merge",
+                "close",
+                // SQLAlchemy 2.0 Core / Select / Result methods
+                // These are called on select(...) / session.execute(...) results and are
+                // extremely common in async FastAPI/SQLAlchemy 2.0 codebases.
+                "where",
+                "select_from",
+                "scalar_one_or_none",
+                "scalar_one",
+                "fetchall",
+                "fetchone",
+                "fetchmany",
+                "mappings",
+                "partitions",
+                "unique",
+                "tuples",
+                "columns",
+                "returning",
+                "with_for_update",
+                "correlate",
+                "correlate_except",
+                "execution_options",
+                "options",
+                "populate_existing",
+                "yield_per",
+                // SQLAlchemy event system (e.g., @event.listens_for(Model, 'after_insert'))
+                "listens_for",
+                "listen",
+                "remove",
                 // SQLAlchemy Column expression methods (called on Model.column attributes)
-                "desc", "asc", "in_", "notin_", "not_in", "isnot", "is_", "is_not",
-                "like", "ilike", "not_like", "not_ilike", "contains", "startswith", "endswith",
-                "between", "any_", "has", "label", "cast", "op", "collate",
-                "nullsfirst", "nullslast", "regexp_match", "regexp_replace",
-                "concat", "distinct", "nulls_first", "nulls_last",
+                "desc",
+                "asc",
+                "in_",
+                "notin_",
+                "not_in",
+                "isnot",
+                "is_",
+                "is_not",
+                "like",
+                "ilike",
+                "not_like",
+                "not_ilike",
+                "contains",
+                "startswith",
+                "endswith",
+                "between",
+                "any_",
+                "has",
+                "label",
+                "cast",
+                "op",
+                "collate",
+                "nullsfirst",
+                "nullslast",
+                "regexp_match",
+                "regexp_replace",
+                "concat",
+                "nulls_first",
+                "nulls_last",
                 // Django ORM methods
-                "objects", "create", "get_or_create", "update_or_create",
-                "bulk_create", "bulk_update", "values", "values_list",
-                "annotate", "aggregate", "exists", "exclude", "select_related",
-                "prefetch_related", "defer", "only", "using", "raw",
-                "save", "full_clean", "clean", "clean_fields",
+                "objects",
+                "create",
+                "get_or_create",
+                "update_or_create",
+                "bulk_create",
+                "bulk_update",
+                "values",
+                "values_list",
+                "annotate",
+                "aggregate",
+                "exists",
+                "exclude",
+                "select_related",
+                "prefetch_related",
+                "defer",
+                "only",
+                "using",
+                "raw",
+                "save",
+                "full_clean",
+                "clean",
+                "clean_fields",
+                // Python stdlib – datetime / date / time
+                // These are classmethods or instance methods on datetime/date/timedelta objects.
+                // They are imported directly (from datetime import datetime) and their
+                // type is not in the project symbol table, so the method check fires falsely.
+                "now",
+                "utcnow",
+                "today",
+                "fromisoformat",
+                "fromtimestamp",
+                "utcfromtimestamp",
+                "fromordinal",
+                "combine",
+                "strptime",
+                "strftime",
+                "isoformat",
+                "timetuple",
+                "toordinal",
+                "weekday",
+                "isoweekday",
+                "isocalendar",
+                "ctime",
+                "timestamp",
+                "utctimetuple",
+                "astimezone",
+                "dst",
+                "tzname",
+                "utcoffset",
+                // Python stdlib – timedelta
+                "total_seconds",
+                // Python stdlib – pathlib.Path / os.path operations
+                "resolve",
+                "absolute",
+                "expanduser",
+                "iterdir",
+                "glob",
+                "rglob",
+                "mkdir",
+                "rmdir",
+                "unlink",
+                "rename",
+                "stat",
+                "lstat",
+                "open",
+                "read_text",
+                "write_text",
+                "read_bytes",
+                "write_bytes",
+                "is_file",
+                "is_dir",
+                "is_symlink",
+                "exists",
+                "samefile",
+                "with_name",
+                "with_suffix",
+                "with_stem",
+                "relative_to",
+                // Python stdlib – itertools / functools
+                "group", // itertools.groupby group object
+                "chain",
+                // Jinja2 Template rendering
+                "render",
+                "render_async",
+                "generate",
+                "stream",
+                "make_module",
+                "get_template",
+                "select_template",
+                "get_or_select_template",
+                // Prometheus / metrics clients (prometheus-client, opentelemetry-sdk)
+                "inc",
+                "dec",
+                "observe",
+                "set_to_current_time",
+                "labels",
+                "remove",
+                // OpenTelemetry instrumentation methods
+                "instrument",
+                "uninstrument",
+                "start_span",
+                "use_span",
+                "set_attribute",
+                "add_event",
+                "record_exception",
+                "set_status",
+                // Cloudinary / file storage SDK methods
+                "upload",
+                "destroy",
+                "rename",
+                "explicit",
+                "generate_url",
+                "add_tag",
+                "remove_tag",
+                "replace_tag",
+                "remove_all_tags",
+                // NATS / message broker methods
+                "connect",
+                "subscribe",
+                "publish",
+                "unsubscribe",
+                "drain",
+                "flush",
+                // Alembic migration helpers
+                "op",
+                "batch_alter_table",
+                "add_column",
+                "drop_column",
+                "create_table",
+                "drop_table",
+                "create_index",
+                "drop_index",
+                "alter_column",
+                "bulk_insert",
+                // Authlib / OAuth methods
+                "authorize_redirect",
+                "authorize_access_token",
+                "parse_id_token",
+                "userinfo",
+                "revoke_token",
+                "introspect_token",
             ]);
             if (FRAMEWORK_METHODS.has(used.name))
                 continue;
@@ -1766,25 +2062,80 @@ typeReferences = []) {
             if (language === "python") {
                 const PYTHON_DYNAMIC_METHODS = new Set([
                     // HTTP client methods (httpx, requests, aiohttp, etc.)
-                    "post", "put", "patch", "request", "head", "options",
+                    "post",
+                    "put",
+                    "patch",
+                    "request",
+                    "head",
+                    "options",
                     // Python string methods called on model attribute chains (e.g., user.email.split())
-                    "split", "strip", "lstrip", "rstrip", "lower", "upper",
-                    "replace", "encode", "decode", "format", "capitalize",
+                    "split",
+                    "strip",
+                    "lstrip",
+                    "rstrip",
+                    "lower",
+                    "upper",
+                    "replace",
+                    "encode",
+                    "decode",
+                    "format",
+                    "capitalize",
                     // Storage/external client methods (Supabase, S3, GCS, etc.)
-                    "from_", "upload", "download", "create_signed_url", "get_public_url",
-                    "get_bucket", "create_bucket", "remove", "list",
+                    "from_",
+                    "upload",
+                    "download",
+                    "create_signed_url",
+                    "get_public_url",
+                    "get_bucket",
+                    "create_bucket",
+                    "remove",
+                    "list",
                     // Redis client methods
-                    "setex", "setnx", "getex", "hset", "hget", "hdel", "hgetall",
-                    "lpush", "rpush", "lpop", "rpop", "lrange", "sadd", "srem", "smembers",
-                    "zadd", "zrem", "zrange", "zrangebyscore", "expire", "ttl", "pttl",
-                    "publish", "subscribe", "unsubscribe", "pipeline",
+                    "setex",
+                    "setnx",
+                    "getex",
+                    "hset",
+                    "hget",
+                    "hdel",
+                    "hgetall",
+                    "lpush",
+                    "rpush",
+                    "lpop",
+                    "rpop",
+                    "lrange",
+                    "sadd",
+                    "srem",
+                    "smembers",
+                    "zadd",
+                    "zrem",
+                    "zrange",
+                    "zrangebyscore",
+                    "expire",
+                    "ttl",
+                    "pttl",
+                    "publish",
+                    "subscribe",
+                    "unsubscribe",
+                    "pipeline",
                     // Webhook/integration client methods
-                    "create_webhook", "delete_webhook", "grant_access", "revoke_access",
-                    "get_commit_details", "get_commits", "get_branches",
+                    "create_webhook",
+                    "delete_webhook",
+                    "grant_access",
+                    "revoke_access",
+                    "get_commit_details",
+                    "get_commits",
+                    "get_branches",
                     // Task/job object attribute access
-                    "func", "args", "kwargs", "result", "status",
+                    "func",
+                    "args",
+                    "kwargs",
+                    "result",
+                    "status",
                     // Celery task methods
-                    "delay", "apply_async", "retry", "revoke",
+                    "delay",
+                    "apply_async",
+                    "retry",
+                    "revoke",
                 ]);
                 if (PYTHON_DYNAMIC_METHODS.has(used.name))
                     continue;
@@ -1866,8 +2217,8 @@ typeReferences = []) {
                 issues.push({
                     type: "nonExistentClass",
                     severity: "critical",
-                    message: existsInProject ?
-                        `Class '${used.name}' exists in your project but is not imported in this file`
+                    message: existsInProject
+                        ? `Class '${used.name}' exists in your project but is not imported in this file`
                         : `Class '${used.name}' does not exist in project`,
                     line: used.line,
                     file: filePath,
@@ -1881,9 +2232,12 @@ typeReferences = []) {
         else if (used.type === "reference") {
             // CRITICAL FIX: Skip property access on 'this'/'self'/'cls' (e.g., this.ws, self.data, cls._client)
             // These are class properties and should not be validated as standalone variables
-            if (used.object === "this" || used.object?.startsWith("this.") ||
-                used.object === "self" || used.object?.startsWith("self.") ||
-                used.object === "cls" || used.object?.startsWith("cls.")) {
+            if (used.object === "this" ||
+                used.object?.startsWith("this.") ||
+                used.object === "self" ||
+                used.object?.startsWith("self.") ||
+                used.object === "cls" ||
+                used.object?.startsWith("cls.")) {
                 continue; // Trust class scope - properties are validated by TypeScript/mypy
             }
             const func = validFunctions.get(used.name);
@@ -1965,8 +2319,8 @@ typeReferences = []) {
                 issues.push({
                     type: "undefinedVariable",
                     severity: "critical",
-                    message: existsInProject ?
-                        `Variable '${used.name}' exists in your project but is not imported in this file`
+                    message: existsInProject
+                        ? `Variable '${used.name}' exists in your project but is not imported in this file`
                         : `Variable '${used.name}' is not defined or imported`,
                     line: used.line,
                     file: filePath,
@@ -1996,8 +2350,14 @@ typeReferences = []) {
     let currentModuleAllExports = null;
     if (language === "python" && filePath && pythonExports.size > 0) {
         const basePath = context?.projectPath || "";
-        const relPath = filePath.startsWith(basePath) ? filePath.slice(basePath.length + 1) : filePath;
-        const pyModPath = relPath.replace(/__init__\.py$/, "").replace(/\.py$/, "").replace(/\//g, ".").replace(/\.$/, "");
+        const relPath = filePath.startsWith(basePath)
+            ? filePath.slice(basePath.length + 1)
+            : filePath;
+        const pyModPath = relPath
+            .replace(/__init__\.py$/, "")
+            .replace(/\.py$/, "")
+            .replace(/\//g, ".")
+            .replace(/\.$/, "");
         currentModuleAllExports = pythonExports.get(pyModPath) || null;
     }
     // For Python: Build a set of symbol names that appear in the code text as word boundaries
@@ -2083,10 +2443,10 @@ typeReferences = []) {
             continue; // Only check type-only imports
         for (const name of imp.names) {
             // Check if this type-imported symbol is used as a value (not just in type positions)
-            const usages = usedSymbols.filter(u => u.name === name.local);
-            const typeUsages = typeReferences.filter(t => t.name === name.local);
+            const usages = usedSymbols.filter((u) => u.name === name.local);
+            const typeUsages = typeReferences.filter((t) => t.name === name.local);
             // If used in runtime contexts (call, instantiation, etc.) but imported as type
-            const runtimeUsages = usages.filter(u => u.type === "call" ||
+            const runtimeUsages = usages.filter((u) => u.type === "call" ||
                 u.type === "instantiation" ||
                 u.type === "methodCall");
             if (runtimeUsages.length > 0) {