diffninja 0.3.1 → 0.4.0

package/dist/review/change-facts.js

@@ -17,6 +17,8 @@
  *
  *   - only file types listed here are read; any other file answers no question
  *     at all, never `no`;
+ *   - a hunk with a changed line longer than {@link MAX_READ_LINE_CHARS} is not
+ *     read either, rather than answered from part of that line;
  *   - `no` means the changed lines the hunk shows contain no such pattern, never
  *     that the property is absent from the file or the program;
  *   - a line moved without change cancels out, because every question compares
@@ -59,6 +61,16 @@ const CONFIG_FILE = /\.(?:ya?ml|json|jsonc|json5|toml|ini|cfg|conf|properties)$|
 const JSON_FILE = /\.json[c5]?$/i;
 /** Evidence text is the source line, bounded so one long line cannot dominate a report. */
 const EVIDENCE_TEXT_LIMIT = 160;
+/**
+ * The longest changed line the analysis reads. A longer one is minified or
+ * generated text, or padding that would push a change past any bound on how
+ * much of a line is read, so its hunk is left unread and uncertain instead.
+ */
+export const MAX_READ_LINE_CHARS = 4000;
+/** What diffninja does not read in a hunk whose facts have no language, as a phrase after "does not read". */
+export function unreadCause(file) {
+    return changeFactLanguageOf(file) === null ? "this file type" : `a hunk with a changed line over ${MAX_READ_LINE_CHARS.toLocaleString("en-US")} characters`;
+}
 export function changeFactLanguageOf(file) {
     if (C_LIKE_FILE.test(file))
         return "c-like";
@@ -86,12 +98,17 @@ export function factQuestionsFor(language) {
         return SQL_FACT_QUESTIONS;
     return CODE_FACT_QUESTIONS;
 }
+/** A star followed by whitespace, a slash or the end of the line: how a block comment's continuation line starts. */
+const COMMENT_CONTINUATION = /^\*(?:\s|\/|$)/;
 /**
  * One line with strings replaced by `S` and comments removed. `state` carries a
  * block comment or multi-line string into the next line of the same side.
  */
 function scanLine(line, language, state, keepStrings = false) {
     let out = "";
+    // Whether `out` holds anything but whitespace yet, kept as a flag: trimming it
+    // for every character would make a long line quadratic to scan.
+    let codeSeen = false;
     // A string's text, or its placeholder: facts ignore string content, while the
     // formatting-only check must see it, since changing a literal changes behavior.
     const literal = (from, to) => (keepStrings ? line.slice(from, to) : "S");
@@ -115,33 +132,34 @@ function scanLine(line, language, state, keepStrings = false) {
             state.open = null;
             continue;
         }
-        const rest = line.slice(index);
-        if (language === "c-like" && rest.startsWith("//"))
+        if (language === "c-like" && line.startsWith("//", index))
             break;
         // A hunk can start inside a block comment it never shows opening: a line
         // that begins `* ` or `*/` is that comment's continuation, not code.
-        if (language === "c-like" && out.trim() === "" && /^\*(?:\s|\/|$)/.test(rest)) {
-            if (rest.includes("*/")) {
-                index = line.indexOf("*/", index) + 2;
+        if (language === "c-like" && !codeSeen && COMMENT_CONTINUATION.test(line.slice(index, index + 2))) {
+            const close = line.indexOf("*/", index);
+            if (close >= 0) {
+                index = close + 2;
                 continue;
             }
             break;
         }
-        if (language === "c-like" && rest.startsWith("/*")) {
+        if (language === "c-like" && line.startsWith("/*", index)) {
             state.open = "comment";
             index += 2;
             continue;
         }
-        if (language !== "c-like" && rest.startsWith("#"))
+        if (language !== "c-like" && line.startsWith("#", index))
             break;
-        if (language === "python" && (rest.startsWith('"""') || rest.startsWith("'''"))) {
-            const delimiter = rest.startsWith('"""') ? '"""' : "'''";
+        if (language === "python" && (line.startsWith('"""', index) || line.startsWith("'''", index))) {
+            const delimiter = line.startsWith('"""', index) ? '"""' : "'''";
             const end = closingIndex(line, index + 3, delimiter);
             if (end < 0) {
                 state.open = delimiter;
                 return out + literal(index, line.length);
             }
             out += literal(index, end + 3);
+            codeSeen = true;
             index = end + 3;
             continue;
         }
@@ -153,6 +171,7 @@ function scanLine(line, language, state, keepStrings = false) {
                 return out + literal(index, line.length);
             }
             out += literal(index, end + 1);
+            codeSeen = true;
             index = end + 1;
             continue;
         }
@@ -161,10 +180,13 @@ function scanLine(line, language, state, keepStrings = false) {
             if (end < 0)
                 return out + literal(index, line.length);
             out += literal(index, end + 1);
+            codeSeen = true;
             index = end + 1;
             continue;
         }
         out += char;
+        if (!codeSeen && char !== undefined && !/\s/.test(char))
+            codeSeen = true;
         index += 1;
     }
     return out;
@@ -213,12 +235,30 @@ function compact(code) {
         .trim()
         .replace(/ (?=[^\w$])|(?<=[^\w$]) /g, "");
 }
+/**
+ * The line without its `--` comment, as `line.replace(/--.*$/, "")` does it, in
+ * linear time. `.` refuses the four line terminators, so the comment must start
+ * after the last one; the regex rescanned the rest of the line from every `--`
+ * whenever a terminator followed, quadratic on a long line of them.
+ */
+export function withoutSqlComment(line) {
+    let after = 0;
+    for (let index = line.length - 1; index >= 0; index -= 1) {
+        const char = line[index];
+        if (char === "\n" || char === "\r" || char === "\u2028" || char === "\u2029") {
+            after = index + 1;
+            break;
+        }
+    }
+    const comment = line.indexOf("--", after);
+    return comment === -1 ? line : line.slice(0, comment);
+}
 function scannerFor(language, file) {
     if (language === "prose")
         return { code: (line) => line, literal: (line) => line };
     if (language === "sql") {
         // `--` comments go; string text stays, it is what a statement writes.
-        const scan = (line) => line.replace(/--.*$/, "");
+        const scan = withoutSqlComment;
         return { code: scan, literal: scan };
     }
     if (language === "config") {
@@ -231,6 +271,7 @@ function scannerFor(language, file) {
         literal: (line, state) => scanLine(line, language, state, true),
     };
 }
+/** Both sides of the hunk, or null when a changed line is too long to read. */
 function sidesOf(diff, scanners) {
     const before = [];
     const after = [];
@@ -248,6 +289,8 @@ function sidesOf(diff, scanners) {
         if (!inHunk || line.startsWith("\\"))
             continue;
         const marker = line[0];
+        if ((marker === "-" || marker === "+") && line.length - 1 > MAX_READ_LINE_CHARS)
+            return null;
         const raw = line.slice(1);
         const entry = (state, literalState, changed) => ({
             raw,
@@ -275,7 +318,60 @@ const CONDITION_KEYWORD = /\b(if|elif|while|unless|until|switch|when)\b/;
 const LOGICAL_OPERATOR = /(&&|\|\||\band\b|\bor\b)/;
 /** Where a logical operator is a condition: continuing one, or a returned boolean. */
 const CONDITION_LINE = /^(?:return\b|&&|\|\||!|\()|(?:&&|\|\||\()\s*$/;
-const TERNARY = /\s\?\s[^:]*\s:\s/;
+/**
+ * Whether a line has a ternary, as the regex `\s\?\s[^:]*\s:\s` matches it, in
+ * linear time. That regex rescans the rest of the line from every ` ? ` for the
+ * next colon; here that colon is found once and shared by every ` ? ` before it.
+ */
+function hasTernary(code) {
+    let colon = code.indexOf(":");
+    for (let mark = code.indexOf("?"); mark >= 0; mark = code.indexOf("?", mark + 1)) {
+        if (!SPACE.test(code[mark - 1] ?? "") || !SPACE.test(code[mark + 1] ?? ""))
+            continue;
+        if (colon !== -1 && colon < mark + 2)
+            colon = code.indexOf(":", mark + 2);
+        if (colon === -1)
+            return false;
+        // The space before the colon cannot be the one after `?`.
+        if (colon > mark + 2 && SPACE.test(code[colon - 1] ?? "") && SPACE.test(code[colon + 1] ?? ""))
+            return true;
+    }
+    return false;
+}
+/**
+ * `head`, a span up to the first `close` after it, then `tail`: the regex
+ * `head[^close]*close tail`, in linear time. With `open`, the span is optional
+ * and starts with it: `head(?:open[^close]*close)?tail`. The regex rescans the
+ * rest of the line from every head for the next `close`, so a line of heads
+ * without one took seconds; here that `close` is found once and shared.
+ * `head` must be global and `tail` sticky.
+ */
+function spanPattern(head, open, close, tail) {
+    const tailAt = (text, at) => {
+        tail.lastIndex = at;
+        return tail.test(text);
+    };
+    return {
+        test: (text) => {
+            let closing = text.indexOf(close);
+            for (const match of text.matchAll(head)) {
+                let from = (match.index ?? 0) + match[0].length;
+                if (open !== null) {
+                    if (tailAt(text, from))
+                        return true;
+                    if (text[from] !== open)
+                        continue;
+                    from += 1;
+                }
+                if (closing !== -1 && closing < from)
+                    closing = text.indexOf(close, from);
+                if (closing !== -1 && tailAt(text, closing + 1))
+                    return true;
+            }
+            return false;
+        },
+    };
+}
 const LIMIT_WORD = /\b\w*(?:timeout|limit|max|min|size|length|len|offset|index|idx|count|capacity|retries|attempts|ttl|threshold|page|batch|delay|interval|slice|substring|substr|take|skip|range|depth|width|height|bound)\w*/i;
 const NUMBER = /(?<![\w$.])-?\d[\d_]*(?:\.\d+)?(?:e-?\d+)?\b/gi;
 /** Non-global twin of {@link NUMBER} for `test`, which a global pattern makes stateful. */
@@ -290,17 +386,21 @@ const ASSERTION = /\b(?:expect|assert\w*|should)\s*[.(]|\bt\.\w+\(|\.to(?:Be|Equ
 const DEFERRAL = /\b(?:retry|retries|retrying|retried|backoff|requeue|reschedul\w*|dead_?letter|dlq)\w*/i;
 /** Values a handler returns instead of the error: a default, not a failure. */
 const DEFAULT_VALUE = String.raw `(?:null|undefined|nil|None|false|False|0|-1|S|\[\s*\]|\{\s*\}|\(\s*\))`;
+/** `catch` and the space after it; {@link spanPattern} reads the binding. */
+const CATCH = /\bcatch\s*/g;
 const INLINE_DISCARD = [
     new RegExp(String.raw `\.catch\(\s*(?:\(\s*\w*\s*\)|\w+)\s*=>\s*(?:\{\s*\}|${DEFAULT_VALUE})\s*\)`),
     /\.catch\(\s*(?:noop|_\.noop|\(\)\s*=>\s*void\s+0)\s*\)/,
-    /\bcatch\s*(?:\([^)]*\))?\s*\{\s*\}/,
-    new RegExp(String.raw `\bcatch\s*(?:\([^)]*\))?\s*\{\s*(?:return(?:\s+${DEFAULT_VALUE})?|continue|break)\s*;?\s*\}`),
-    /\bexcept\b[^:]*:\s*(?:pass|continue)\s*$/,
+    spanPattern(CATCH, "(", ")", /\s*\{\s*\}/y),
+    spanPattern(CATCH, "(", ")", new RegExp(String.raw `\s*\{\s*(?:return(?:\s+${DEFAULT_VALUE})?|continue|break)\s*;?\s*\}`, "y")),
+    spanPattern(/\bexcept\b/g, null, ":", /\s*(?:pass|continue)\s*$/y),
     /\brescue\s+nil\b/,
     /^_\s*=\s*err\b/,
 ];
+const CATCH_BLOCK = spanPattern(CATCH, "(", ")", /\s*\{\s*$/y);
+const GO_ERROR_BLOCK = /\bif\s*\(?\s*err\s*!=\s*nil\s*\)?\s*\{\s*$/;
 const BLOCK_HANDLER = {
-    "c-like": /(?:\bcatch\s*(?:\([^)]*\))?|\bif\s*\(?\s*err\s*!=\s*nil\s*\)?)\s*\{\s*$/,
+    "c-like": { test: (code) => CATCH_BLOCK.test(code) || GO_ERROR_BLOCK.test(code) },
     python: /^except\b[^:]*:\s*$/,
     ruby: /^rescue\b/,
 };
@@ -331,15 +431,42 @@ function difference(before, after) {
     }
     return { removed, added };
 }
+/**
+ * Every comparison on a line is read, operands whole: each operand lies between
+ * two operators, so the reads cover each character a bounded number of times.
+ */
+const OPERAND_CHAR = /[\w$.[\]]/;
+const SPACE = /\s/;
+/** The operand ending just before `at`: whitespace skipped, then the run of operand characters. */
+function operandBefore(code, at) {
+    let end = at;
+    while (end > 0 && SPACE.test(code[end - 1] ?? ""))
+        end -= 1;
+    let start = end;
+    while (start > 0 && OPERAND_CHAR.test(code[start - 1] ?? ""))
+        start -= 1;
+    return code.slice(start, end);
+}
+/** The operand starting after `from`: whitespace skipped, an optional minus, then the run of operand characters. */
+function operandAfter(code, from) {
+    let start = from;
+    while (start < code.length && SPACE.test(code[start] ?? ""))
+        start += 1;
+    let end = start;
+    if (code[end] === "-")
+        end += 1;
+    const bodyStart = end;
+    while (end < code.length && OPERAND_CHAR.test(code[end] ?? ""))
+        end += 1;
+    return end === bodyStart ? "" : code.slice(start, end);
+}
 function comparisonAtoms(code, language) {
     const atoms = [];
     const patterns = language === "python" ? [COMPARISON_OPERATOR, PYTHON_COMPARISON_OPERATOR] : [COMPARISON_OPERATOR];
     for (const pattern of patterns) {
         for (const match of code.matchAll(pattern)) {
             const at = match.index ?? 0;
-            const left = /[\w$.[\]]+$/.exec(code.slice(0, at).trimEnd())?.[0] ?? "";
-            const right = /^-?[\w$.[\]]+/.exec(code.slice(at + match[0].length).trimStart())?.[0] ?? "";
-            atoms.push({ left, operator: match[0].trim(), right });
+            atoms.push({ left: operandBefore(code, at), operator: match[0].trim(), right: operandAfter(code, at + match[0].length) });
         }
     }
     return atoms;
@@ -364,7 +491,7 @@ function conditionOf(code) {
     }
     // A line of a multi-line condition, or a returned boolean; an assignment such
     // as `const x = a || b` combines values and is not a condition by itself.
-    if ((LOGICAL_OPERATOR.test(code) && CONDITION_LINE.test(code)) || TERNARY.test(code))
+    if ((LOGICAL_OPERATOR.test(code) && CONDITION_LINE.test(code)) || hasTernary(code))
         return compact(code);
     return null;
 }
@@ -391,29 +518,76 @@ function lineHits(lines, pattern) {
 /** Each bound operator and its strict or non-strict twin. */
 const STRICTNESS = new Map([["<", "<="], ["<=", "<"], [">", ">="], [">=", ">"]]);
 const isNumber = (token) => /^-?\d[\d_]*(?:\.\d+)?(?:e-?\d+)?$/i.test(token);
+/**
+ * For each group of `items`, the index of its first item and of the first after
+ * it with another value. Whatever value a lookup brings, one of the two is the
+ * group's first item with a different value: a lookup instead of a scan of
+ * every item, which made pairing one side of a hunk with the other quadratic.
+ */
+function firstDiffering(items, groupOf, valueOf) {
+    const groups = new Map();
+    items.forEach((item, index) => {
+        const group = groupOf(item);
+        if (group === null)
+            return;
+        const seen = groups.get(group);
+        if (seen === undefined)
+            groups.set(group, { first: index });
+        else if (seen.other === undefined && valueOf(item) !== valueOf(items[seen.first]))
+            seen.other = index;
+    });
+    return (group, value) => {
+        const seen = groups.get(group);
+        if (seen === undefined)
+            return undefined;
+        return valueOf(items[seen.first]) !== value ? seen.first : seen.other;
+    };
+}
 /**
  * A bound whose admitted range changed: the same comparison with a strict and a
  * non-strict operator swapped, or a numeric side changed; or a line naming a limit
  * whose only difference is a number.
  */
 function limitHit(removed, added, language) {
-    const removedAtoms = removed.flatMap((hit) => comparisonAtoms(hit.line.code, language).map((atom) => ({ atom, hit })));
-    const addedAtoms = added.flatMap((hit) => comparisonAtoms(hit.line.code, language).map((atom) => ({ atom, hit })));
-    for (const { atom: before } of removedAtoms) {
-        for (const { atom: after, hit } of addedAtoms) {
-            const sameOperands = before.left === after.left && before.right === after.right;
-            if (sameOperands && STRICTNESS.get(before.operator) === after.operator)
-                return hit;
-            const sameDirection = before.operator === after.operator || STRICTNESS.get(before.operator) === after.operator;
-            if (!sameDirection)
+    // A line has one hit per condition and per comparison; its comparisons are read once, not once per hit.
+    const atomsOf = (hits) => {
+        const seen = new Set();
+        const atoms = [];
+        for (const hit of hits) {
+            if (seen.has(hit.line))
                 continue;
-            if (before.left === after.left && isNumber(before.right) && isNumber(after.right) && before.right !== after.right) {
-                return hit;
-            }
-            if (before.right === after.right && isNumber(before.left) && isNumber(after.left) && before.left !== after.left) {
-                return hit;
-            }
+            seen.add(hit.line);
+            for (const atom of comparisonAtoms(hit.line.code, language))
+                atoms.push({ atom, hit });
+        }
+        return atoms;
+    };
+    // For the first removed comparison that has one, the earliest added comparison
+    // that moves its bound, found by lookups in the added side. Comparing every
+    // pair was quadratic, and the cap that bounded it let padding hide the change.
+    const candidates = atomsOf(added);
+    const exact = new Map();
+    candidates.forEach(({ atom }, index) => {
+        const key = `${atom.left}\n${atom.operator}\n${atom.right}`;
+        if (!exact.has(key))
+            exact.set(key, index);
+    });
+    const sameLeft = firstDiffering(candidates, ({ atom }) => (isNumber(atom.right) ? `${atom.left}\n${atom.operator}` : null), ({ atom }) => atom.right);
+    const sameRight = firstDiffering(candidates, ({ atom }) => (isNumber(atom.left) ? `${atom.right}\n${atom.operator}` : null), ({ atom }) => atom.left);
+    for (const { atom: before } of atomsOf(removed)) {
+        const twin = STRICTNESS.get(before.operator);
+        // The same operands with the strict and non-strict operator swapped.
+        const found = [twin === undefined ? undefined : exact.get(`${before.left}\n${twin}\n${before.right}`)];
+        // The same direction, one side the same and the other a different number.
+        for (const operator of twin === undefined ? [before.operator] : [before.operator, twin]) {
+            if (isNumber(before.right))
+                found.push(sameLeft(`${before.left}\n${operator}`, before.right));
+            if (isNumber(before.left))
+                found.push(sameRight(`${before.right}\n${operator}`, before.left));
         }
+        const earliest = Math.min(...found.filter((index) => index !== undefined));
+        if (earliest !== Infinity)
+            return candidates[earliest].hit;
     }
     return null;
 }
@@ -421,13 +595,14 @@ function numericLimitHit(before, after) {
     const limitLines = (lines) => lines
         .filter((line) => line.changed && line.code !== "" && LIMIT_WORD.test(line.code) && HAS_NUMBER.test(line.code) && !ASSERTION.test(line.code))
         .map((line) => ({ key: compact(line.code), numberless: compact(line.code.replace(NUMBER, "N")), line }));
-    const removed = limitLines(before);
+    // For the first removed line that has one, the earliest added line of the
+    // same form, numbers aside, with other numbers.
     const added = limitLines(after);
-    for (const old of removed) {
-        for (const candidate of added) {
-            if (old.numberless === candidate.numberless && old.key !== candidate.key)
-                return { key: candidate.key, line: candidate.line };
-        }
+    const differing = firstDiffering(added, (line) => line.numberless, (line) => line.key);
+    for (const old of limitLines(before)) {
+        const index = differing(old.numberless, old.key);
+        if (index !== undefined)
+            return added[index];
     }
     return null;
 }
@@ -441,7 +616,10 @@ function guardHits(lines, changedConditions) {
     lines.forEach((line, index) => {
         if (!changedConditions.has(line))
             return;
-        const next = lines.slice(index + 1).find((candidate) => candidate.code !== "");
+        let after = index + 1;
+        while (after < lines.length && lines[after].code === "")
+            after += 1;
+        const next = lines[after];
         if (PROPAGATION.test(line.code) || (next !== undefined && PROPAGATION.test(next.code))) {
             hits.push({ key: `guard:${compact(line.code)}`, line });
         }
@@ -463,7 +641,8 @@ function discardHits(lines, language) {
             return;
         const body = [];
         let closed = false;
-        for (const candidate of lines.slice(index + 1)) {
+        for (let after = index + 1; after < lines.length; after++) {
+            const candidate = lines[after];
             if (candidate.code === "")
                 continue;
             if (language === "python" && candidate.indent <= line.indent) {
@@ -521,10 +700,43 @@ const NORMATIVE = /\b(?:must|shall|should|required|requires|never|always|only|ca
 const REFERENCE = /\]\(\s*<?([^)\s>]+)|(https?:\/\/[^\s)>"'\]]+)/g;
 /** Settings that turn a failing CI check into a passing or advisory one. */
 const GATE_WEAKENING = /continue-on-error:\s*true|allow_failure:\s*true|\|\|\s*true\b|\bset\s+\+e\b|--no-verify\b|\bif:\s*false\b|\bskip\b|\bwarn(?:ing)?\b|\bignore\b|fail_?[oO]n_?[eE]rror\W+false|--passWithNoTests|\bexit\s+0\b|--force\b/i;
-/** A step that runs a check; fewer of them after the change is a weaker gate. */
-const CHECK_STEP = /\b(?:run|script|command)\b.*\b(?:test|tests|lint|check|audit|verify|typecheck|tsc|vitest|jest|pytest|mypy|eslint|oxlint)\b|\buses:.*\b(?:codeql|lint|test|scan)/i;
+/**
+ * A step that runs a check; fewer of them after the change is a weaker gate.
+ * `^(?=(.*?X))\1` takes the first `run` or `uses:` once, since a lookahead does
+ * not backtrack, and a check after any later one is also after the first. The
+ * plain `run.*test` rescanned the line from every `run`, quadratic on a long line.
+ */
+const CHECK_STEP = /^(?=(.*?\b(?:run|script|command)\b))\1.*\b(?:test|tests|lint|check|audit|verify|typecheck|tsc|vitest|jest|pytest|mypy|eslint|oxlint)\b|^(?=(.*?\buses:))\2.*\b(?:codeql|lint|test|scan)/i;
 const PERMISSION = /\bpermissions\b|:\s*write(?:-all)?\b|\bwrite-all\b|\bpull_request_target\b|\bsecrets\.|\bid-token\b|\bGITHUB_TOKEN\b|\bprivileged:\s*true|\ballowPrivilegeEscalation\b|\brunAsUser:\s*0\b|^USER\s+root\b|\bsudo\b/i;
-const PIN = /\buses:\s*\S+@|\bimage:\s*\S+|^FROM\s|\bversion\b|"[@\w./-]+"\s*:\s*"\s*[\^~<>=*]?\s*(?:v?\d|latest|\*)/i;
+const PIN_SETTING = /\bimage:\s*\S+|^FROM\s|\bversion\b|"[@\w./-]+"\s*:\s*"\s*[\^~<>=*]?\s*(?:v?\d|latest|\*)/i;
+const USES = /\buses:\s*/gi;
+const WHITESPACE = /\s/g;
+/**
+ * `uses:` naming a ref, as `uses:\s*\S+@` matches it, in linear time. That regex
+ * rescanned the rest of the word from every `uses:` in it; here the next `@` and
+ * the next space are found once and shared.
+ */
+function usesRef(text) {
+    let mark = text.indexOf("@");
+    let space = -1;
+    for (const match of text.matchAll(USES)) {
+        const word = (match.index ?? 0) + match[0].length;
+        if (word >= text.length)
+            return false;
+        if (mark !== -1 && mark <= word)
+            mark = text.indexOf("@", word + 1);
+        if (mark === -1)
+            return false;
+        if (space < word) {
+            WHITESPACE.lastIndex = word;
+            space = WHITESPACE.exec(text)?.index ?? text.length;
+        }
+        if (mark < space)
+            return true;
+    }
+    return false;
+}
+const PIN = { test: (text) => PIN_SETTING.test(text) || usesRef(text) };
 /** Changed lines of one side whose text carries each link target they name. */
 function referenceHits(lines) {
     const hits = [];
@@ -558,7 +770,9 @@ const CONTRACT = [
     /^export\s+(?:default\s+)?(?:declare\s+)?(?:async\s+)?(?:function|class|interface|type|enum|const|let|abstract)\b/,
     /^@(?:Get|Post|Put|Patch|Delete|All|Controller|Resolver|Query|Mutation|Column|PrimaryColumn|PrimaryGeneratedColumn|Entity|ManyToOne|OneToMany|OneToOne|ManyToMany|JoinColumn|Index|Unique|Is[A-Z]\w*|Min|Max|Length|ValidateNested|Type|Transform|Api(?:Property|ResponseProperty)\w*|Field|Prop|Schema)\b/,
     /^(?:public\s+|static\s+|async\s+|override\s+|readonly\s+)*(?!(?:if|for|while|switch|catch|return|function|await|new|else|do|try)\b)[A-Za-z_$][\w$]*\s*(?:<[^>]*>)?\s*\([^)]*\)\s*(?::\s*[^={;]+)?\s*\{$/,
-    /^(?:public|protected)\s+(?:static\s+|abstract\s+|final\s+|async\s+|override\s+)*[\w<>[\],.? ]+\s+\w+\s*\(/,
+    // Modifiers are part of the type run: listing them in a loop before it made
+    // every split between the two a new try, quadratic on a line of modifiers.
+    /^(?:public|protected)\s+[\w<>[\],.? ]+\s+\w+\s*\(/,
     /^def\s+[A-Za-z]\w*\s*\(/,
     /^class\s+[A-Z]\w*/,
     /^func\s+(?:\([^)]*\)\s*)?[A-Z]\w*\s*\(/,
@@ -595,8 +809,12 @@ function proseFacts(sides, record) {
     const limit = numericLimitHit(sides.before, sides.after);
     record("limitChanged", limit === null ? null : evidenceOf(limit, "added"));
 }
-/** Bookkeeping files whose numbers record state, not bounds. */
-const BOOKKEEPING_FILE = /(?:suppressions?|baseline|snapshot|lock)[\w.-]*\.(?:json|ya?ml|toml)$/i;
+/**
+ * Bookkeeping files whose numbers record state, not bounds. `^(?=([\s\S]*X))\1`
+ * takes the last keyword once: if a plain name runs from any keyword to the
+ * extension, one runs from the last. Trying every keyword was quadratic on a long path.
+ */
+const BOOKKEEPING_FILE = /^(?=([\s\S]*(?:suppressions?|baseline|snapshot|lock)))\1[\w.-]*\.(?:json|ya?ml|toml)$/i;
 function configFacts(sides, record, file) {
     const weakening = difference(textHits(sides.before, GATE_WEAKENING), textHits(sides.after, GATE_WEAKENING));
     const checksBefore = textHits(sides.before, CHECK_STEP);
@@ -652,6 +870,8 @@ export function changeFactsOf(unit) {
     if (language === null)
         return { language, inert: null, answers: {}, evidence: {} };
     const sides = sidesOf(unit.diff, scannerFor(language, unit.file));
+    if (sides === null)
+        return { language: null, inert: null, answers: {}, evidence: {} };
     const answers = {};
     for (const question of factQuestionsFor(language))
         answers[question] = "no";
@@ -678,7 +898,9 @@ export function changeFactsOf(unit) {
     return { language, inert: isInert(sides, language), importsOnly: importsOnly(sides), answers, evidence };
 }
 const IMPORT_START = /^(?:import\b|export\s+(?:\*|\{[^}]*\})\s+from\b|from\s+[\w.]+\s+import\b|using\s+[\w.]+\s*;|(?:const|let|var)\s+[\w{}\s,:]+=\s*require\()/;
-const IMPORT_LIST_OPEN = /^(?:import\b[^;]*\{[^}]*$|import\s*\($|from\s+[\w.]+\s+import\s*\($|export\s*\{[^}]*$)/;
+// `(?=([^;]*\{))\1` takes the last `{` before any `;` once: if a `}` follows it,
+// one follows every earlier `{`, and trying each of them was quadratic.
+const IMPORT_LIST_OPEN = /^(?:import\b(?=([^;]*\{))\1[^}]*$|import\s*\($|from\s+[\w.]+\s+import\s*\($|export\s*\{[^}]*$)/;
 const IMPORT_LIST_CLOSE = /[})]/;
 const IMPORT_LIST_ITEM = /^(?:type\s+)?[\w$]+(?:\s+as\s+[\w$]+)?,?$/;
 const IMPORT_LIST_END = /^\}\s*from\b/;

package/dist/review/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
 import { runSetup, setupHelp } from "./setup.js";
+import { runGrammars } from "./grammars-command.js";
 /**
  * diffninja runs inside an agent CLI through its MCP server; this command only
  * registers that server. Reviews are requested from the agent, which calls the
@@ -11,7 +12,14 @@ import { runSetup, setupHelp } from "./setup.js";
 const help = `diffninja. Pull request review inside your coding agent.
 
   diffninja setup [--cli claude,codex,omp,pi] [--uninstall] [--dry-run] [--no-install]
-                  Register the diffninja MCP server on every detected agent CLI.
+                  Register the diffninja MCP server on every detected agent CLI. Runs
+                  npm to install diffninja globally, and rewrites each JSON config it
+                  changes (see diffninja setup --help).
+  diffninja grammars install [--build] [--dry-run] | status
+                  Add the tree-sitter grammars call flows use for languages other than
+                  JavaScript and TypeScript. Downloads code through npm, and only when
+                  you run it (exact versions, integrity-checked, no install scripts
+                  unless you pass --build).
   diffninja --help
 
 After setup, ask your agent to review a GitHub pull request link, a diff, or a git
@@ -28,6 +36,10 @@ async function main() {
         console.log(help);
         return;
     }
+    if (command === "grammars") {
+        runGrammars(args);
+        return;
+    }
     if (command !== "setup")
         throw new Error(NO_TERMINAL_REVIEW);
     const { values, positionals } = parseArgs({ args, options: {

package/dist/review/connected-analysis.d.ts

@@ -11,6 +11,7 @@
  * MCP client that recorded it.
  */
 import { type QuestionKind, type Verdict } from "./questions.js";
+import type { UpdateNotice } from "./update-check.js";
 import type { AgentSummary, ReviewReport, ReviewStatus, SuggestedComment } from "./types.js";
 import type { ExplanationChange } from "./explanation.js";
 /** Most agenda entries the page lists; the full report has the rest. */
@@ -89,7 +90,7 @@ export interface ConnectedAnalysis {
     };
     /** Changed files that have call-flow diagrams, for the page's "Call flow" buttons; empty for a patch-only analysis. */
     readonly callFlowFiles: readonly string[];
-    /** Line comments the reviewing agent suggested, for the human to add to their review or not. */
+    /** Comments the reviewing agent says block the merge, each with its proof, for the human to add to their review or not. */
     suggestions?: {
         readonly suggestedBy: string;
         readonly comments: readonly SuggestedComment[];
@@ -102,6 +103,8 @@ export interface ConnectedAnalysis {
      * author's stated intent, not a claim that the changes achieve it.
      */
     summary?: AgentSummary;
+    /** A newer diffninja exists: the page shows a one-line notice with the command. */
+    update?: UpdateNotice;
     /** Present once the reviewing agent's business explanation was accepted for this report. */
     explanation?: ConnectedExplanation;
 }

package/dist/review/connected-analysis.js

@@ -10,7 +10,7 @@
  * facts are lexical, and an answer is a closed-set choice attributed to the
  * MCP client that recorded it.
  */
-import { CHANGE_FACT_QUESTIONS } from "./change-facts.js";
+import { CHANGE_FACT_QUESTIONS, unreadCause } from "./change-facts.js";
 import { verdictOf } from "./questions.js";
 /** Most agenda entries the page lists; the full report has the rest. */
 export const CONNECTED_AGENDA_LIMIT = 5;
@@ -76,7 +76,7 @@ function noteOf(item) {
         return "Not read by diffninja (binary, rename, mode, or other metadata-only change). Check it yourself.";
     }
     if (item.facts?.language === null)
-        return "diffninja does not read this file type. Read this hunk yourself.";
+        return `diffninja does not read ${unreadCause(item.file)}. Read this hunk yourself.`;
     if (item.facts?.inert === true)
         return "Formatting or comments only.";
     if (item.facts?.importsOnly === true)
@@ -178,6 +178,8 @@ export function connectedAnalysisOf(report, snapshotId, reviewId, reportUrl, sco
     // verbatim, attributed, and never synthesized here.
     if (report.agentSummary !== undefined)
         analysis.summary = report.agentSummary;
+    if (report.updateNotice !== undefined)
+        analysis.update = report.updateNotice;
     const explanation = report.agentExplanation;
     if (explanation !== undefined) {
         analysis.explanation = {

package/dist/review/connected-html.d.ts

@@ -5,13 +5,24 @@
  * draft to `/api/preview`, and posts the same payload to `/api/submit`. Every
  * string that comes from GitHub (paths, diff lines, the diff text itself, error
  * messages) reaches the DOM through `textContent`; nothing is interpolated into
- * markup or into the script. Style and script carry the session CSRF token as
- * their CSP nonce, so the server can serve a `default-src 'none'` policy with
- * no inline handlers and no inline styles.
+ * markup or into the script. Style and script carry a per-response nonce, so the
+ * server can serve a `default-src 'none'` policy with no inline handlers and no
+ * inline styles; the session's CSRF token is a different secret, and the whole
+ * page lives under the session's secret path prefix.
  *
  * Drafts live in `sessionStorage`, keyed per pull request and stamped with the
  * snapshot id. Restoring a draft revalidates every comment anchor against the
  * snapshot on screen: a comment whose line no longer exists in the new revision
  * is dropped, never silently carried over.
+ *
+ * A change is viewed only by the reader's click on its rail checkbox, never by
+ * scrolling. GitHub's Viewed mark is per file, so the page marks a file Viewed
+ * on GitHub (`POST api/viewed`) exactly when every hunk of it is viewed, and
+ * un-marks it when one is not. Progress inside a file stays in `sessionStorage`,
+ * keyed by snapshot id.
  */
-export declare function renderConnectedPage(csrf: string): string;
+export declare function renderConnectedPage(options: {
+    readonly csrf: string;
+    readonly nonce: string;
+    readonly base: string;
+}): string;