inline-sql-toolkit 0.5.4 → 0.6.1

package/.formatignore

@@ -0,0 +1,2 @@
+# Path prefixes the format gate skips (see scripts/format-check.sh).
+test/fixtures/

package/.oxfmtrc.json

@@ -0,0 +1,40 @@
+{
+  "semi": true,
+  "singleQuote": false,
+  "tabWidth": 2,
+  "printWidth": 100,
+  "sortPackageJson": false,
+  "ignorePatterns": [
+    "node_modules/",
+    "dist/",
+    "dist-vsix/",
+    "coverage/",
+    "reports/",
+    ".vscode-test/",
+    ".superpowers/",
+    ".headroom/",
+    "AGENTS.md",
+    "docs/superpowers/",
+    "test/fixtures/",
+    ".claude/",
+    ".codebuddy/",
+    ".cursor/",
+    ".gemini/",
+    ".kiro/",
+    ".qoder/",
+    ".mcp.json",
+    ".vscode/mcp.json",
+    "CLAUDE.md",
+    "CODEBUDDY.md",
+    "GEMINI.md",
+    "QODER.md",
+    ".cursorrules",
+    ".windsurfrules",
+    "opencode.jsonc",
+    ".github/code-review-graph.instruction.md",
+    "docs/inline-sql-toolkit-architecture.html",
+    "docs/inline-sql-toolkit-architecture.visual-check.html",
+    "docs/index.html",
+    "inline-sql-toolkit-architecture.html"
+  ]
+}

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.6.1 - 2026-11-06
+
+- Security: pin the dev-only transitive `minimatch` to 11.0.1 via package overrides, resolving CVE-2026-118764 (GHSA-g3hv-75wg-m249) reported by the OSV scanner.
+
+## 0.6.0 - 2026-11-06
+
+- Feature: the CLI accepts directory arguments and processes every `.py` / `.mo.py` file below them recursively, in path order. Scans skip dot-prefixed directories, `node_modules`, `.venv`, and `__pycache__`, and never follow symbolic-link directories; a file named directly and also found in a directory is processed once. A directory with no Python files in it exits with code 2. Files named explicitly are still processed whatever their extension.
+
 ## 0.5.4 - 2026-10-10
 
 - Docs: a skip pragma applies to every literal on its line (README).

package/README.md

@@ -143,10 +143,10 @@ The `inline-sql-toolkit` command-line tool formats Python files or standard inpu
 Run directly via `npx` or install with `bun add -d inline-sql-toolkit` (or `npm install -D inline-sql-toolkit`):
 
 ```bash
-npx inline-sql-toolkit [options] [files...]
+npx inline-sql-toolkit [options] [files-or-directories...]
 ```
 
-When run without file arguments, the CLI reads Python source from standard input and prints the formatted result to standard output. Notebook files (`.ipynb`) are not supported by the CLI; use the VS Code extension for Jupyter and marimo notebook cell formatting. The CLI supports standard Python source files (`.py`, `.mo.py`) and stdin.
+When run without file arguments, the CLI reads Python source from standard input and prints the formatted result to standard output. Explicit file arguments are processed regardless of their extension. Directory arguments are scanned recursively for `.py` and `.mo.py` files, in path order; scans skip all dot-prefixed directories (including `.git` and `.jj`), `node_modules`, `.venv`, and `__pycache__`. Notebook files (`.ipynb`) are not supported by the CLI; use the VS Code extension for Jupyter and marimo notebook cell formatting. The CLI supports standard Python source files (`.py`, `.mo.py`) and stdin.
 
 ### CLI Options
 

package/dist/cli.js

@@ -23007,7 +23007,7 @@ function formatProtectedSql(sql2, options) {
 }
 
 // src/cli.ts
-var USAGE = `Usage: inline-sql-toolkit [options] [files...]
+var USAGE = `Usage: inline-sql-toolkit [options] [files-or-directories...]
 
   -w, --write                      rewrite files in place
       --check                      exit 1 if any file would change
@@ -23022,7 +23022,103 @@ var USAGE = `Usage: inline-sql-toolkit [options] [files...]
       --keep-functions-inline      keep SUM(...) / COUNT(CASE ...) on one line
   -c, --config <file>              config JSON (default: nearest .inline-sql.json)
   -q, --quiet                      do not report skipped candidates on stderr
-  -h, --help / --version`;
+  -h, --help / --version
+
+  Directories are scanned recursively for .py and .mo.py files. Scans skip
+  dot-directories (including .git and .jj), node_modules, .venv, and __pycache__.`;
+var EXCLUDED_DIRECTORY_NAMES = /* @__PURE__ */ new Set([".git", ".jj", "node_modules", ".venv", "__pycache__"]);
+function isPythonSourceFile(file) {
+  return file.endsWith(".py") || file.endsWith(".mo.py");
+}
+function isExcludedDirectory(name) {
+  return name.startsWith(".") || EXCLUDED_DIRECTORY_NAMES.has(name);
+}
+function trimTrailingSeparators(path) {
+  let trimmedPath = path;
+  const rootLength = (0, import_node_path.parse)((0, import_node_path.resolve)(path)).root.length;
+  while (trimmedPath.length > rootLength && (trimmedPath.endsWith(import_node_path.sep) || import_node_path.sep !== "/" && trimmedPath.endsWith("/"))) {
+    trimmedPath = trimmedPath.slice(0, -1);
+  }
+  return trimmedPath;
+}
+function collectPythonFiles(directory) {
+  const pendingDirectories = [directory];
+  const pythonFiles = [];
+  while (pendingDirectories.length > 0) {
+    const currentDirectory = pendingDirectories.pop();
+    if (currentDirectory === void 0) continue;
+    for (const entry of (0, import_node_fs.readdirSync)(currentDirectory, { withFileTypes: true })) {
+      const entryPath = (0, import_node_path.join)(currentDirectory, entry.name);
+      if (entry.isDirectory()) {
+        if (!isExcludedDirectory(entry.name)) pendingDirectories.push(entryPath);
+        continue;
+      }
+      if (entry.isFile() && isPythonSourceFile(entryPath)) {
+        pythonFiles.push(entryPath);
+        continue;
+      }
+      if (entry.isSymbolicLink() && isPythonSourceFile(entryPath)) {
+        if ((0, import_node_fs.existsSync)(entryPath) && (0, import_node_fs.statSync)(entryPath).isFile()) pythonFiles.push(entryPath);
+      }
+    }
+  }
+  return pythonFiles.sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+}
+function expandFileArguments(positionals) {
+  const files = [];
+  const seenAbsolutePaths = /* @__PURE__ */ new Set();
+  function addFile(file) {
+    const absolutePath = (0, import_node_path.resolve)(file);
+    if (seenAbsolutePaths.has(absolutePath)) return;
+    seenAbsolutePaths.add(absolutePath);
+    files.push(file);
+  }
+  for (const positional of positionals) {
+    let fileInfo;
+    try {
+      fileInfo = (0, import_node_fs.lstatSync)(trimTrailingSeparators(positional));
+    } catch (err) {
+      return {
+        ok: false,
+        message: `inline-sql-toolkit: cannot read file: ${positional}: ${err.message}`
+      };
+    }
+    let isDirectory = fileInfo.isDirectory();
+    if (fileInfo.isSymbolicLink()) {
+      try {
+        isDirectory = (0, import_node_fs.statSync)(positional).isDirectory();
+      } catch {
+      }
+    }
+    if (!isDirectory) {
+      addFile(positional);
+      continue;
+    }
+    if (fileInfo.isSymbolicLink()) {
+      return {
+        ok: false,
+        message: `inline-sql-toolkit: no .py or .mo.py files found in directory: ${positional}`
+      };
+    }
+    let discoveredFiles;
+    try {
+      discoveredFiles = collectPythonFiles(positional);
+    } catch (err) {
+      return {
+        ok: false,
+        message: `inline-sql-toolkit: cannot read directory: ${positional}: ${err.message}`
+      };
+    }
+    if (discoveredFiles.length === 0) {
+      return {
+        ok: false,
+        message: `inline-sql-toolkit: no .py or .mo.py files found in directory: ${positional}`
+      };
+    }
+    for (const file of discoveredFiles) addFile(file);
+  }
+  return { ok: true, files };
+}
 function printError(message) {
   process.stderr.write(`${message}
 `);
@@ -23212,8 +23308,13 @@ function runCli(argv) {
     process.stdout.write(output);
     return 0;
   }
+  const expanded = expandFileArguments(positionals);
+  if (!expanded.ok) {
+    printError(expanded.message);
+    return 2;
+  }
   const tasks = [];
-  for (const file of positionals) {
+  for (const file of expanded.files) {
     let input;
     try {
       input = (0, import_node_fs.readFileSync)(file, "utf8");

package/package.json

@@ -11,7 +11,7 @@
   "bugs": {
     "url": "https://github.com/hidenobunagai/inline-sql-toolkit/issues"
   },
-  "version": "0.5.4",
+  "version": "0.6.1",
   "icon": "icon.png",
   "type": "module",
   "bin": {
@@ -161,9 +161,9 @@
     "@eslint/js": "10.0.1",
     "@types/node": "20.19.43",
     "@types/vscode": "1.95.0",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "4.1.12",
     "@vscode/test-electron": "3.1.0",
-    "@vscode/vsce": "3.9.2",
+    "@vscode/vsce": "4.0.0",
     "esbuild": "0.28.1",
     "eslint": "10.7.0",
     "eslint-plugin-simple-import-sort": "14.0.0",
@@ -172,16 +172,19 @@
     "prettier": "3.9.6",
     "typescript": "5.9.3",
     "typescript-eslint": "8.65.0",
-    "vitest": "4.1.11",
+    "vitest": "4.1.12",
     "yaml": "2.9.0"
   },
   "overrides": {
+    "@azure/msal-node": "7.1.0",
     "brace-expansion": "5.0.12",
-    "fast-uri": "3.1.8",
+    "fast-uri": "3.1.9",
+    "glob": "14.0.3",
     "js-yaml": "4.3.2",
+    "minimatch": "11.0.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
-    "qs": "6.16.0",
-    "undici": "7.29.1"
+    "qs": "6.16.1",
+    "undici": "7.30.1"
   }
 }

package/scripts/format-check.sh

@@ -0,0 +1,58 @@
+#!/bin/sh
+# format-check.sh - CI gate for the fleet-wide format/lint tool mapping.
+#
+# Runs the same tools as the post-edit dispatcher (agents-env:
+# ~/.agents/global/format-file) in check mode over the files given as
+# arguments, or over all git-tracked files when called without arguments.
+#
+# - Path prefixes listed in .formatignore (one per line) are skipped.
+# - Markdown is not gated yet: oxfmt's Markdown output still diverges
+#   from this repo's Prettier-formatted docs.
+# - Lint warnings are printed but do not fail the gate; errors do.
+set -u
+root=$(git rev-parse --show-toplevel) || exit 1
+cd "$root" || exit 1
+
+if [ $# -gt 0 ]; then
+  files="$*"
+else
+  files=$(git ls-files)
+fi
+
+ignored() {
+  [ -f .formatignore ] || return 1
+  while IFS= read -r pat; do
+    case "$pat" in
+      '' | \#*) continue ;;
+    esac
+    case "$1" in
+      "$pat"*) return 0 ;;
+    esac
+  done < .formatignore
+  return 1
+}
+
+fail=0
+for f in $files; do
+  [ -f "$f" ] || continue
+  if ignored "$f"; then continue; fi
+  case "$f" in
+    *.py | *.pyi)
+      inline-sql-toolkit --check -q "$f" || fail=1
+      ruff format --check "$f" || fail=1
+      ruff check "$f" || fail=1
+      ty check "$f" || fail=1
+      ;;
+    *.js | *.jsx | *.ts | *.tsx | *.mjs | *.cjs | *.mts | *.cts | *.vue | *.svelte)
+      oxfmt --check "$f" || fail=1
+      oxlint "$f" || fail=1
+      ;;
+    *.json | *.jsonc | *.json5 | *.yaml | *.yml | *.toml | *.css | *.scss | *.less | *.html | *.graphql | *.gql)
+      oxfmt --check "$f" || fail=1
+      ;;
+    *.sql)
+      sql-template-formatter --check "$f" || fail=1
+      ;;
+  esac
+done
+exit $fail