nexus-agents 8.4.0 → 8.6.0

package/dist/chunk-WZZQI774.js

@@ -0,0 +1,244 @@
+import {
+  SecurityError,
+  ValidationError,
+  createLogger,
+  formatZodError
+} from "./chunk-DC2OJAIB.js";
+
+// src/security/ast-rule-runner.ts
+import { existsSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse, registerDynamicLanguage } from "@ast-grep/napi";
+import goLangRegistration from "@ast-grep/lang-go";
+import pythonLangRegistration from "@ast-grep/lang-python";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+var polyglotLangsRegistered = false;
+function ensurePolyglotLangs() {
+  if (polyglotLangsRegistered) return;
+  registerDynamicLanguage({ python: pythonLangRegistration, go: goLangRegistration });
+  polyglotLangsRegistered = true;
+}
+var AST_RULE_LANGUAGES = ["python", "go"];
+var AST_RULE_SEVERITIES = ["error", "warning", "info"];
+var RuleFileSchema = z.object({
+  id: z.string().min(1),
+  language: z.enum(AST_RULE_LANGUAGES),
+  severity: z.enum(AST_RULE_SEVERITIES),
+  message: z.string().min(1),
+  rule: z.record(z.string(), z.unknown())
+});
+var MAX_SNIPPET_CHARS = 200;
+var DEFAULT_AST_QA_LIMIT = 200;
+var MAX_AST_QA_LIMIT = 2e3;
+var AST_QA_MAX_DEPTH = 24;
+var MAX_FILES_SCANNED = 5e3;
+var logger = createLogger({ component: "ast-rule-runner" });
+async function loadRules(dir) {
+  let entries;
+  try {
+    entries = (await readdir(dir)).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml")).sort();
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    throw new ValidationError(`ast-rule-runner: cannot read rules dir ${dir}: ${e.message}`, {
+      cause: e
+    });
+  }
+  const rules = [];
+  for (const file of entries) {
+    const path = join(dir, file);
+    const raw = await readFile(path, "utf8");
+    let parsed;
+    try {
+      parsed = parseYaml(raw);
+    } catch (caught) {
+      const e = caught instanceof Error ? caught : new Error(String(caught));
+      throw new ValidationError(`ast-rule-runner: malformed YAML in ${path}: ${e.message}`, {
+        cause: e
+      });
+    }
+    const result = RuleFileSchema.safeParse(parsed);
+    if (!result.success) {
+      throw new ValidationError(
+        `ast-rule-runner: invalid rule file ${path}: ${formatZodError(result.error)}`
+      );
+    }
+    rules.push(result.data);
+  }
+  return rules;
+}
+function getBuiltInAstRulesPath() {
+  const currentFile = fileURLToPath(import.meta.url);
+  const currentDir = dirname(currentFile);
+  if (currentFile.includes(`${sep}dist${sep}`) || currentFile.endsWith(`${sep}dist`)) {
+    const distIndex = currentFile.lastIndexOf(`${sep}dist${sep}`);
+    if (distIndex !== -1) {
+      const distDir = currentFile.substring(0, distIndex + 5);
+      const bundledPath = join(distDir, "security", "ast-rules");
+      if (existsSync(bundledPath)) return bundledPath;
+    }
+  }
+  const possiblePaths = [
+    join(currentDir, "ast-rules"),
+    // Unbundled: sibling of this file in src/security/
+    join(currentDir, "security", "ast-rules"),
+    // Bundled chunk: dist/security sibling
+    join(dirname(currentDir), "security", "ast-rules")
+  ];
+  for (const path of possiblePaths) {
+    if (existsSync(path)) return path;
+  }
+  return join(currentDir, "ast-rules");
+}
+function resolveWithinCwd(target) {
+  const resolved = resolve(target);
+  const cwdRoot = resolve(".");
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + sep)) {
+    return { error: `Path traversal denied: scope must be within ${cwdRoot}` };
+  }
+  return { resolved };
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+var POLYGLOT_EXT_TO_LANG = {
+  ".py": "python",
+  ".go": "go"
+};
+function inferRuleLang(file) {
+  return POLYGLOT_EXT_TO_LANG[extname(file).toLowerCase()] ?? null;
+}
+async function findPolyglotFiles(dir, maxDepth) {
+  if (maxDepth <= 0) return [];
+  const out = [];
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    logger.warn(`ast-rule-runner: skipped unreadable directory ${dir}: ${e.message}`);
+    return out;
+  }
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+      out.push(...await findPolyglotFiles(fullPath, maxDepth - 1));
+    } else if (entry.isFile() && inferRuleLang(entry.name) !== null) {
+      out.push(fullPath);
+    }
+  }
+  return out;
+}
+function langToParseArg(lang) {
+  ensurePolyglotLangs();
+  return lang;
+}
+function scanFile(src, lang, applicable, budget) {
+  const { rel, limit, alreadyFound } = budget;
+  const root = parse(langToParseArg(lang), src).root();
+  const lines = src.split("\n");
+  const findings = [];
+  let total = 0;
+  for (const rule of applicable) {
+    const config = { rule: rule.rule };
+    for (const node of root.findAll(config)) {
+      total += 1;
+      if (alreadyFound + findings.length < limit) {
+        const { start } = node.range();
+        const rawLine = lines[start.line] ?? node.text();
+        findings.push({
+          ruleId: rule.id,
+          severity: rule.severity,
+          message: rule.message,
+          file: rel,
+          line: start.line + 1,
+          column: start.column + 1,
+          snippet: rawLine.trim().slice(0, MAX_SNIPPET_CHARS)
+        });
+      }
+    }
+  }
+  return { findings, total };
+}
+async function assertScanRootIsDirectory(resolved) {
+  let rootStat;
+  try {
+    rootStat = await stat(resolved);
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    throw new ValidationError(`ast-rule-runner: cannot read targetDir ${resolved}: ${e.message}`, {
+      cause: e
+    });
+  }
+  if (!rootStat.isDirectory()) {
+    throw new ValidationError(
+      `ast-rule-runner: targetDir must be a directory, got a non-directory path: ${resolved}`
+    );
+  }
+}
+async function resolveScanFiles(root) {
+  const discovered = await findPolyglotFiles(root, AST_QA_MAX_DEPTH);
+  const files = discovered.slice(0, MAX_FILES_SCANNED);
+  const filesSkipped = discovered.length - files.length;
+  const filesTruncated = filesSkipped > 0;
+  if (filesTruncated) {
+    logger.warn(
+      `ast-rule-runner: ${String(filesSkipped)} file(s) NOT scanned \u2014 file cap ${String(MAX_FILES_SCANNED)} exceeded (discovered=${String(discovered.length)}). Scan is PARTIAL; do not treat findings as exhaustive.`
+    );
+  }
+  return { files, filesSkipped, filesTruncated };
+}
+async function collectAstQaFindings(opts) {
+  const guard = resolveWithinCwd(opts.targetDir);
+  if ("error" in guard) {
+    throw new SecurityError(guard.error);
+  }
+  await assertScanRootIsDirectory(guard.resolved);
+  const rulesDir = opts.rulesDir ?? getBuiltInAstRulesPath();
+  const rules = await loadRules(rulesDir);
+  const limit = Math.min(Math.max(opts.limit ?? DEFAULT_AST_QA_LIMIT, 1), MAX_AST_QA_LIMIT);
+  const { files, filesSkipped, filesTruncated } = await resolveScanFiles(guard.resolved);
+  const findings = [];
+  let total = 0;
+  for (const file of files) {
+    const lang = inferRuleLang(file);
+    if (lang === null) continue;
+    const applicable = rules.filter((r) => r.language === lang);
+    if (applicable.length === 0) continue;
+    let src;
+    try {
+      src = await readFile(file, "utf8");
+    } catch {
+      logger.warn(`ast-rule-runner: skipped unreadable file ${file}`);
+      continue;
+    }
+    const rel = relative(guard.resolved, file) || file;
+    const scanned = scanFile(src, lang, applicable, { rel, limit, alreadyFound: findings.length });
+    findings.push(...scanned.findings);
+    total += scanned.total;
+  }
+  if (total > findings.length) {
+    logger.warn(
+      `ast-rule-runner: ${String(total - findings.length)} finding(s) omitted beyond limit=${String(limit)} (total=${String(total)})`
+    );
+  }
+  return { findings, total, limit, filesScanned: files.length, filesSkipped, filesTruncated };
+}
+async function runAstQaRules(opts) {
+  const { findings } = await collectAstQaFindings(opts);
+  return findings;
+}
+
+export {
+  ensurePolyglotLangs,
+  AST_RULE_LANGUAGES,
+  AST_RULE_SEVERITIES,
+  DEFAULT_AST_QA_LIMIT,
+  MAX_AST_QA_LIMIT,
+  MAX_FILES_SCANNED,
+  loadRules,
+  getBuiltInAstRulesPath,
+  collectAstQaFindings,
+  runAstQaRules
+};
+//# sourceMappingURL=chunk-WZZQI774.js.map

package/dist/chunk-WZZQI774.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/ast-rule-runner.ts"],"sourcesContent":["/**\n * nexus-agents/security - Polyglot (Python/Go) AST QA/Security Rule Runner (#4249 child C)\n *\n * Runs YAML-defined `@ast-grep/napi` rules against Python/Go source, detecting\n * common QA/security anti-patterns (dynamic `eval`/`exec`, shell injection,\n * unchecked external command execution). Same engine already used by\n * `search_usages` (indexer/usage-ast.ts, #4265) and the ast-fixer rewrites\n * (agents/collaboration/ast-rewrites.ts, #4243/#4249 child B) — no new AST\n * dependency, just new language grammars for it.\n *\n * **Language support gap.** `Lang` in `@ast-grep/napi@0.44.1` ships only\n * Html/JavaScript/Tsx/Css/TypeScript — no Python, no Go. This module closes\n * that gap via napi's `@experimental registerDynamicLanguage` API, backed by\n * the `@ast-grep/lang-python`/`@ast-grep/lang-go` prebuilt tree-sitter\n * grammars. Both are EXACT-pinned in package.json (no caret): these are\n * early/experimental packages and a caret range could silently swap in an\n * incompatible native `.so` grammar build underneath a \"safe\" semver-minor\n * bump. `registerDynamicLanguage` throws if called more than once per\n * process (napi-rs's own documented constraint) — {@link ensurePolyglotLangs}\n * is a lazy, module-level, once-only guard so repeated calls (tests, repeat\n * runner invocations within one process) never trip it twice.\n *\n * **Read-only.** Reads rule YAML and target source files, walks their ASTs,\n * performs NO writes. ast-grep YAML rule files support a `fix:` key for\n * autofixing, but napi's `SgNode.findAll` (used here) never applies it —\n * only ast-grep's separate rewrite/CLI machinery does — so even a rule\n * author who adds `fix:` cannot turn this runner into a writer by accident.\n * MCP exposure is deliberately deferred (see the follow-up issue referenced\n * in the #4249 child C PR) to keep this surface a plain function until a\n * named consumer needs it wired through a tool.\n *\n * @module security/ast-rule-runner\n * @see Issue #4249 - epic: ast-grep adoption (Child C: polyglot QA/security rules)\n */\n\nimport { existsSync } from 'node:fs';\nimport { readdir, readFile, stat } from 'node:fs/promises';\nimport { dirname, extname, join, relative, resolve, sep } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { parse, registerDynamicLanguage } from '@ast-grep/napi';\nimport type { NapiConfig } from '@ast-grep/napi';\n// Both packages are CJS `export = <LanguageRegistration>` modules — the\n// default import is the whole registration object (`libraryPath` getter,\n// `extensions`, `languageSymbol`, `expandoChar`). See their `index.d.ts`.\nimport goLangRegistration from '@ast-grep/lang-go';\nimport pythonLangRegistration from '@ast-grep/lang-python';\nimport { parse as parseYaml } from 'yaml';\nimport { z } from 'zod';\nimport { createLogger, SecurityError, ValidationError, formatZodError } from '../core/index.js';\n\n// ============================================================================\n// Dynamic language registration (@experimental, call-once)\n// ============================================================================\n\nlet polyglotLangsRegistered = false;\n\n/**\n * Lazily register the Python/Go tree-sitter grammars with ast-grep's\n * `registerDynamicLanguage`. That API throws if called more than once in a\n * process; this guard makes every call after the first a no-op so repeated\n * runner invocations (or a test suite that constructs the runner many times)\n * never trip the constraint.\n */\nexport function ensurePolyglotLangs(): void {\n  if (polyglotLangsRegistered) return;\n  registerDynamicLanguage({ python: pythonLangRegistration, go: goLangRegistration });\n  polyglotLangsRegistered = true;\n}\n\n// ============================================================================\n// Rule schema (fail-closed)\n// ============================================================================\n\n/** Languages a rule file may declare. Deliberately narrowed to the two this\n * runner actually SCANS (python/go): admitting `typescript`/`javascript` here\n * would let a TS/JS rule file validate at load time and then silently never\n * fire (there is no TS/JS extension in {@link POLYGLOT_EXT_TO_LANG}), which is\n * a fail-OPEN gap for a security scanner where \"no findings\" reads as \"clean\".\n * TS/JS structural analysis is already covered by `search_usages` (#4265) and\n * the ast-fixer rewrites (#4243); a TS/JS rule here would fail LOUD at load\n * (unknown-language Zod error) instead of loading dead. */\nexport const AST_RULE_LANGUAGES = ['python', 'go'] as const;\nexport type AstRuleLanguage = (typeof AST_RULE_LANGUAGES)[number];\n\nexport const AST_RULE_SEVERITIES = ['error', 'warning', 'info'] as const;\nexport type AstRuleSeverity = (typeof AST_RULE_SEVERITIES)[number];\n\n/** Schema for one `*.yml` rule file. `rule` is passed through as ast-grep's\n * own `Rule` object (napi already validates it structurally at match time);\n * Zod only pins down the envelope so an unknown `language` or a missing\n * field FAILS CLOSED instead of silently loading a partial/broken rule. */\nconst RuleFileSchema = z.object({\n  id: z.string().min(1),\n  language: z.enum(AST_RULE_LANGUAGES),\n  severity: z.enum(AST_RULE_SEVERITIES),\n  message: z.string().min(1),\n  rule: z.record(z.string(), z.unknown()),\n});\n\nexport type AstQaRuleFile = z.infer<typeof RuleFileSchema>;\n\n/** Per-match snippet char cap (matches indexer/usage-ast.ts's discipline). */\nconst MAX_SNIPPET_CHARS = 200;\n\n/** Default cap on emitted findings. Excess is counted + reported, never silently dropped. */\nexport const DEFAULT_AST_QA_LIMIT = 200;\n/** Hard upper bound a caller may request for the finding cap. */\nexport const MAX_AST_QA_LIMIT = 2000;\n/** Directory walk depth for the target-dir scan (not caller-configurable — no\n * named consumer needs a deeper/shallower walk yet; YAGNI). */\nconst AST_QA_MAX_DEPTH = 24;\n/** Upper bound on files parsed in a single run, to bound worst-case cost.\n * Exceeding it makes the scan PARTIAL — surfaced via {@link AstQaCollectResult}'s\n * `filesTruncated`/`filesSkipped` + a warn, never silently dropped. */\nexport const MAX_FILES_SCANNED = 5000;\n\nconst logger = createLogger({ component: 'ast-rule-runner' });\n\n// ============================================================================\n// Rule loading\n// ============================================================================\n\n/**\n * Load and Zod-validate every `*.yml` rule file in `dir`. FAILS CLOSED: a\n * single malformed YAML file, or a file with an unrecognized `language` or\n * missing field, throws a {@link ValidationError} — there is no\n * \"load what parsed, skip the rest\" partial mode.\n */\nexport async function loadRules(dir: string): Promise<AstQaRuleFile[]> {\n  let entries: string[];\n  try {\n    entries = (await readdir(dir)).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml')).sort();\n  } catch (caught: unknown) {\n    const e = caught instanceof Error ? caught : new Error(String(caught));\n    throw new ValidationError(`ast-rule-runner: cannot read rules dir ${dir}: ${e.message}`, {\n      cause: e,\n    });\n  }\n\n  const rules: AstQaRuleFile[] = [];\n  for (const file of entries) {\n    const path = join(dir, file);\n    const raw = await readFile(path, 'utf8');\n\n    let parsed: unknown;\n    try {\n      parsed = parseYaml(raw);\n    } catch (caught: unknown) {\n      const e = caught instanceof Error ? caught : new Error(String(caught));\n      throw new ValidationError(`ast-rule-runner: malformed YAML in ${path}: ${e.message}`, {\n        cause: e,\n      });\n    }\n\n    const result = RuleFileSchema.safeParse(parsed);\n    if (!result.success) {\n      throw new ValidationError(\n        `ast-rule-runner: invalid rule file ${path}: ${formatZodError(result.error)}`\n      );\n    }\n    rules.push(result.data);\n  }\n  return rules;\n}\n\n// ============================================================================\n// Built-in rules dir resolution (mirrors workflows/template-loader.ts)\n// ============================================================================\n\n/**\n * Resolve the built-in `ast-rules/` directory, handling both dev (unbundled,\n * `src/security/ast-rule-runner.ts`) and published (bundled,\n * `dist/index.js` + `dist/security/ast-rules/*.yml` copied by tsup's\n * `onSuccess` step) layouts — the same two-layout problem\n * `getBuiltInTemplatesPath` solves for workflow templates.\n */\nexport function getBuiltInAstRulesPath(): string {\n  const currentFile = fileURLToPath(import.meta.url);\n  const currentDir = dirname(currentFile);\n\n  if (currentFile.includes(`${sep}dist${sep}`) || currentFile.endsWith(`${sep}dist`)) {\n    const distIndex = currentFile.lastIndexOf(`${sep}dist${sep}`);\n    if (distIndex !== -1) {\n      const distDir = currentFile.substring(0, distIndex + 5); // +5 for \"/dist\"\n      const bundledPath = join(distDir, 'security', 'ast-rules');\n      if (existsSync(bundledPath)) return bundledPath;\n    }\n  }\n\n  const possiblePaths = [\n    join(currentDir, 'ast-rules'), // Unbundled: sibling of this file in src/security/\n    join(currentDir, 'security', 'ast-rules'), // Bundled chunk: dist/security sibling\n    join(dirname(currentDir), 'security', 'ast-rules'),\n  ];\n  for (const path of possiblePaths) {\n    if (existsSync(path)) return path;\n  }\n  return join(currentDir, 'ast-rules'); // Fallback (for error reporting)\n}\n\n// ============================================================================\n// Path-traversal guard (copied from mcp/tools/search-usages-tool.ts —\n// keep in sync if that guard changes)\n// ============================================================================\n\n/** Resolve a caller path against a path-traversal guard (must stay within cwd). */\nfunction resolveWithinCwd(target: string): { resolved: string } | { error: string } {\n  const resolved = resolve(target);\n  const cwdRoot = resolve('.');\n  // The `+ sep` is load-bearing: a sibling dir whose name starts with the cwd\n  // basename bypasses a bare startsWith. Matches security/safe-path.ts.\n  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + sep)) {\n    return { error: `Path traversal denied: scope must be within ${cwdRoot}` };\n  }\n  return { resolved };\n}\n\n// ============================================================================\n// File walk (LOCAL extension map — python/go only; does NOT reuse\n// indexer/usage-ast.ts's TS/JS inferLang or indexer/codebase-search.ts's\n// TS/JS-only findSourceFiles)\n// ============================================================================\n\nconst SKIP_DIRS = new Set(['node_modules', 'dist', '.git']);\n\n/** file-extension -> ast-rule language, for the two languages this runner scans. */\nconst POLYGLOT_EXT_TO_LANG: Readonly<Record<string, AstRuleLanguage>> = {\n  '.py': 'python',\n  '.go': 'go',\n};\n\n/** Infer the ast-rule language for a file from its extension, or `null` if unsupported. */\nfunction inferRuleLang(file: string): AstRuleLanguage | null {\n  return POLYGLOT_EXT_TO_LANG[extname(file).toLowerCase()] ?? null;\n}\n\n/**\n * Recursively collect `.py`/`.go` files under `dir`, bounded by `maxDepth`.\n * A subdirectory whose `readdir` fails mid-walk (e.g. a `chmod 000` dir) is\n * WARNED about per-dir and skipped rather than silently swallowed — the scan\n * continues, but the partiality is surfaced in the log. The SCAN ROOT's own\n * readability is validated up front by {@link collectAstQaFindings} (fail\n * loud), so this soft-skip only ever applies to descendant dirs.\n */\nasync function findPolyglotFiles(dir: string, maxDepth: number): Promise<string[]> {\n  if (maxDepth <= 0) return [];\n  const out: string[] = [];\n  let entries;\n  try {\n    entries = await readdir(dir, { withFileTypes: true });\n  } catch (caught: unknown) {\n    const e = caught instanceof Error ? caught : new Error(String(caught));\n    logger.warn(`ast-rule-runner: skipped unreadable directory ${dir}: ${e.message}`);\n    return out;\n  }\n  for (const entry of entries) {\n    const fullPath = join(dir, entry.name);\n    if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {\n      out.push(...(await findPolyglotFiles(fullPath, maxDepth - 1)));\n    } else if (entry.isFile() && inferRuleLang(entry.name) !== null) {\n      out.push(fullPath);\n    }\n  }\n  return out;\n}\n\n/** Map a rule's declared language to the `parse()` first argument, registering\n * the dynamic grammars on first use. Both supported languages (python/go) are\n * dynamically-registered CustomLangs, so the language name string IS the\n * `parse()` key set up in {@link ensurePolyglotLangs}. */\nfunction langToParseArg(lang: AstRuleLanguage): AstRuleLanguage {\n  ensurePolyglotLangs();\n  return lang; // the CustomLang string keys used in registerDynamicLanguage()\n}\n\n// ============================================================================\n// Findings\n// ============================================================================\n\n/** One ast-grep rule match against a source file. */\nexport interface AstRuleFinding {\n  ruleId: string;\n  severity: AstRuleSeverity;\n  message: string;\n  /** Path relative to the resolved `targetDir`. */\n  file: string;\n  /** 1-based line number. */\n  line: number;\n  /** 1-based column number. */\n  column: number;\n  /** Trimmed, length-capped source line for the match. */\n  snippet: string;\n}\n\nexport interface RunAstQaRulesOptions {\n  /** Directory containing `*.yml` rule files (default: the built-in bundled rules). */\n  rulesDir?: string;\n  /** Directory to scan for `.py`/`.go` source files (must stay within cwd). */\n  targetDir: string;\n  /** Max findings emitted (default {@link DEFAULT_AST_QA_LIMIT}). Excess is counted + reported. */\n  limit?: number;\n}\n\n/** {@link collectAstQaFindings}'s full result — findings plus the true total,\n * so overflow beyond `limit` is counted and reported, never silently dropped. */\nexport interface AstQaCollectResult {\n  findings: AstRuleFinding[];\n  /** True count of matches found, before the `limit` cap was applied. */\n  total: number;\n  limit: number;\n  /** Number of `.py`/`.go` files actually scanned (after the file cap). */\n  filesScanned: number;\n  /** Number of discovered files DROPPED because the file cap ({@link MAX_FILES_SCANNED})\n   * was exceeded. Non-zero means the scan was PARTIAL — a downstream consumer\n   * must not treat empty/low findings as a clean bill of health. */\n  filesSkipped: number;\n  /** True iff `filesSkipped > 0` — the scan did not cover every candidate file. */\n  filesTruncated: boolean;\n}\n\n/** Findings + true-match-count from scanning ONE already-read source file. */\ninterface FileScanResult {\n  findings: AstRuleFinding[];\n  total: number;\n}\n\n/** Bundles {@link scanFile}'s cap-tracking inputs (max-params discipline). */\ninterface FileScanBudget {\n  /** Path emitted on each finding (relative to the resolved `targetDir`). */\n  rel: string;\n  /** Max TOTAL findings across the whole run. */\n  limit: number;\n  /** Findings already accepted by earlier files in this run. */\n  alreadyFound: number;\n}\n\n/**\n * Scan one already-read source file against the rules applicable to its\n * language, pushing findings only while the running total (`budget.alreadyFound`\n * + findings pushed so far) stays under `budget.limit` — while still counting\n * every true match, so the caller can report overflow instead of silently\n * dropping it.\n */\nfunction scanFile(\n  src: string,\n  lang: AstRuleLanguage,\n  applicable: readonly AstQaRuleFile[],\n  budget: FileScanBudget\n): FileScanResult {\n  const { rel, limit, alreadyFound } = budget;\n  const root = parse(langToParseArg(lang), src).root();\n  const lines = src.split('\\n');\n  const findings: AstRuleFinding[] = [];\n  let total = 0;\n\n  for (const rule of applicable) {\n    const config: NapiConfig = { rule: rule.rule };\n    for (const node of root.findAll(config)) {\n      total += 1;\n      if (alreadyFound + findings.length < limit) {\n        const { start } = node.range();\n        const rawLine = lines[start.line] ?? node.text();\n        findings.push({\n          ruleId: rule.id,\n          severity: rule.severity,\n          message: rule.message,\n          file: rel,\n          line: start.line + 1,\n          column: start.column + 1,\n          snippet: rawLine.trim().slice(0, MAX_SNIPPET_CHARS),\n        });\n      }\n    }\n  }\n  return { findings, total };\n}\n\n/**\n * Fail LOUD on an unreadable / non-directory scan root. `loadRules` already\n * throws on an unreadable RULES dir; the TARGET traversal must not fail OPEN —\n * a lone file path, a bad path, or a `000` root would otherwise return an empty\n * finding set that reads as \"clean\" for a security scanner.\n */\nasync function assertScanRootIsDirectory(resolved: string): Promise<void> {\n  let rootStat;\n  try {\n    rootStat = await stat(resolved);\n  } catch (caught: unknown) {\n    const e = caught instanceof Error ? caught : new Error(String(caught));\n    throw new ValidationError(`ast-rule-runner: cannot read targetDir ${resolved}: ${e.message}`, {\n      cause: e,\n    });\n  }\n  if (!rootStat.isDirectory()) {\n    throw new ValidationError(\n      `ast-rule-runner: targetDir must be a directory, got a non-directory path: ${resolved}`\n    );\n  }\n}\n\n/** Result of resolving the candidate file set under a scan root, with the\n * file-cap truncation signal surfaced (never a silent `.slice`). */\ninterface ScanFileSet {\n  files: string[];\n  filesSkipped: number;\n  filesTruncated: boolean;\n}\n\n/** Discover candidate `.py`/`.go` files, applying + SURFACING the file cap. */\nasync function resolveScanFiles(root: string): Promise<ScanFileSet> {\n  const discovered = await findPolyglotFiles(root, AST_QA_MAX_DEPTH);\n  const files = discovered.slice(0, MAX_FILES_SCANNED);\n  const filesSkipped = discovered.length - files.length;\n  const filesTruncated = filesSkipped > 0;\n  if (filesTruncated) {\n    logger.warn(\n      `ast-rule-runner: ${String(filesSkipped)} file(s) NOT scanned — file cap ` +\n        `${String(MAX_FILES_SCANNED)} exceeded (discovered=${String(discovered.length)}). ` +\n        `Scan is PARTIAL; do not treat findings as exhaustive.`\n    );\n  }\n  return { files, filesSkipped, filesTruncated };\n}\n\n/**\n * Run every applicable rule in `rulesDir` against every `.py`/`.go` file under\n * `targetDir`, returning capped findings plus the true total (so callers that\n * need the overflow count — e.g. a future MCP tool wrapper — can report it).\n * {@link runAstQaRules} is the capped-array convenience wrapper over this.\n */\nexport async function collectAstQaFindings(\n  opts: RunAstQaRulesOptions\n): Promise<AstQaCollectResult> {\n  const guard = resolveWithinCwd(opts.targetDir);\n  if ('error' in guard) {\n    throw new SecurityError(guard.error);\n  }\n  await assertScanRootIsDirectory(guard.resolved);\n\n  const rulesDir = opts.rulesDir ?? getBuiltInAstRulesPath();\n  const rules = await loadRules(rulesDir);\n  // Clamp into [1, MAX]: a limit <= 0 would report total > 0 with zero findings\n  // (fail-open \"clean\" signal), so the floor is load-bearing, not cosmetic.\n  const limit = Math.min(Math.max(opts.limit ?? DEFAULT_AST_QA_LIMIT, 1), MAX_AST_QA_LIMIT);\n\n  const { files, filesSkipped, filesTruncated } = await resolveScanFiles(guard.resolved);\n\n  const findings: AstRuleFinding[] = [];\n  let total = 0;\n\n  for (const file of files) {\n    const lang = inferRuleLang(file);\n    if (lang === null) continue;\n    const applicable = rules.filter((r) => r.language === lang);\n    if (applicable.length === 0) continue;\n\n    let src: string;\n    try {\n      src = await readFile(file, 'utf8');\n    } catch {\n      logger.warn(`ast-rule-runner: skipped unreadable file ${file}`);\n      continue;\n    }\n\n    const rel = relative(guard.resolved, file) || file;\n    const scanned = scanFile(src, lang, applicable, { rel, limit, alreadyFound: findings.length });\n    findings.push(...scanned.findings);\n    total += scanned.total;\n  }\n\n  if (total > findings.length) {\n    logger.warn(\n      `ast-rule-runner: ${String(total - findings.length)} finding(s) omitted beyond ` +\n        `limit=${String(limit)} (total=${String(total)})`\n    );\n  }\n\n  return { findings, total, limit, filesScanned: files.length, filesSkipped, filesTruncated };\n}\n\n/**\n * Run the polyglot QA/security ast-grep rules and return the capped findings\n * array. Overflow beyond `limit` is counted and logged (never silently\n * dropped) — use {@link collectAstQaFindings} directly when the caller needs\n * the true total/overflow count programmatically.\n */\nexport async function runAstQaRules(opts: RunAstQaRulesOptions): Promise<AstRuleFinding[]> {\n  const { findings } = await collectAstQaFindings(opts);\n  return findings;\n}\n"],"mappings":";;;;;;;;AAmCA,SAAS,kBAAkB;AAC3B,SAAS,SAAS,UAAU,YAAY;AACxC,SAAS,SAAS,SAAS,MAAM,UAAU,SAAS,WAAW;AAC/D,SAAS,qBAAqB;AAC9B,SAAS,OAAO,+BAA+B;AAK/C,OAAO,wBAAwB;AAC/B,OAAO,4BAA4B;AACnC,SAAS,SAAS,iBAAiB;AACnC,SAAS,SAAS;AAOlB,IAAI,0BAA0B;AASvB,SAAS,sBAA4B;AAC1C,MAAI,wBAAyB;AAC7B,0BAAwB,EAAE,QAAQ,wBAAwB,IAAI,mBAAmB,CAAC;AAClF,4BAA0B;AAC5B;AAcO,IAAM,qBAAqB,CAAC,UAAU,IAAI;AAG1C,IAAM,sBAAsB,CAAC,SAAS,WAAW,MAAM;AAO9D,IAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,UAAU,EAAE,KAAK,kBAAkB;AAAA,EACnC,UAAU,EAAE,KAAK,mBAAmB;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACxC,CAAC;AAKD,IAAM,oBAAoB;AAGnB,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB;AAGhC,IAAM,mBAAmB;AAIlB,IAAM,oBAAoB;AAEjC,IAAM,SAAS,aAAa,EAAE,WAAW,kBAAkB,CAAC;AAY5D,eAAsB,UAAU,KAAuC;AACrE,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,KAAK,EAAE,SAAS,OAAO,CAAC,EAAE,KAAK;AAAA,EAC/F,SAAS,QAAiB;AACxB,UAAM,IAAI,kBAAkB,QAAQ,SAAS,IAAI,MAAM,OAAO,MAAM,CAAC;AACrE,UAAM,IAAI,gBAAgB,0CAA0C,GAAG,KAAK,EAAE,OAAO,IAAI;AAAA,MACvF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,QAAyB,CAAC;AAChC,aAAW,QAAQ,SAAS;AAC1B,UAAM,OAAO,KAAK,KAAK,IAAI;AAC3B,UAAM,MAAM,MAAM,SAAS,MAAM,MAAM;AAEvC,QAAI;AACJ,QAAI;AACF,eAAS,UAAU,GAAG;AAAA,IACxB,SAAS,QAAiB;AACxB,YAAM,IAAI,kBAAkB,QAAQ,SAAS,IAAI,MAAM,OAAO,MAAM,CAAC;AACrE,YAAM,IAAI,gBAAgB,sCAAsC,IAAI,KAAK,EAAE,OAAO,IAAI;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,eAAe,UAAU,MAAM;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,sCAAsC,IAAI,KAAK,eAAe,OAAO,KAAK,CAAC;AAAA,MAC7E;AAAA,IACF;AACA,UAAM,KAAK,OAAO,IAAI;AAAA,EACxB;AACA,SAAO;AACT;AAaO,SAAS,yBAAiC;AAC/C,QAAM,cAAc,cAAc,YAAY,GAAG;AACjD,QAAM,aAAa,QAAQ,WAAW;AAEtC,MAAI,YAAY,SAAS,GAAG,GAAG,OAAO,GAAG,EAAE,KAAK,YAAY,SAAS,GAAG,GAAG,MAAM,GAAG;AAClF,UAAM,YAAY,YAAY,YAAY,GAAG,GAAG,OAAO,GAAG,EAAE;AAC5D,QAAI,cAAc,IAAI;AACpB,YAAM,UAAU,YAAY,UAAU,GAAG,YAAY,CAAC;AACtD,YAAM,cAAc,KAAK,SAAS,YAAY,WAAW;AACzD,UAAI,WAAW,WAAW,EAAG,QAAO;AAAA,IACtC;AAAA,EACF;AAEA,QAAM,gBAAgB;AAAA,IACpB,KAAK,YAAY,WAAW;AAAA;AAAA,IAC5B,KAAK,YAAY,YAAY,WAAW;AAAA;AAAA,IACxC,KAAK,QAAQ,UAAU,GAAG,YAAY,WAAW;AAAA,EACnD;AACA,aAAW,QAAQ,eAAe;AAChC,QAAI,WAAW,IAAI,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO,KAAK,YAAY,WAAW;AACrC;AAQA,SAAS,iBAAiB,QAA0D;AAClF,QAAM,WAAW,QAAQ,MAAM;AAC/B,QAAM,UAAU,QAAQ,GAAG;AAG3B,MAAI,aAAa,WAAW,CAAC,SAAS,WAAW,UAAU,GAAG,GAAG;AAC/D,WAAO,EAAE,OAAO,+CAA+C,OAAO,GAAG;AAAA,EAC3E;AACA,SAAO,EAAE,SAAS;AACpB;AAQA,IAAM,YAAY,oBAAI,IAAI,CAAC,gBAAgB,QAAQ,MAAM,CAAC;AAG1D,IAAM,uBAAkE;AAAA,EACtE,OAAO;AAAA,EACP,OAAO;AACT;AAGA,SAAS,cAAc,MAAsC;AAC3D,SAAO,qBAAqB,QAAQ,IAAI,EAAE,YAAY,CAAC,KAAK;AAC9D;AAUA,eAAe,kBAAkB,KAAa,UAAqC;AACjF,MAAI,YAAY,EAAG,QAAO,CAAC;AAC3B,QAAM,MAAgB,CAAC;AACvB,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,EACtD,SAAS,QAAiB;AACxB,UAAM,IAAI,kBAAkB,QAAQ,SAAS,IAAI,MAAM,OAAO,MAAM,CAAC;AACrE,WAAO,KAAK,iDAAiD,GAAG,KAAK,EAAE,OAAO,EAAE;AAChF,WAAO;AAAA,EACT;AACA,aAAW,SAAS,SAAS;AAC3B,UAAM,WAAW,KAAK,KAAK,MAAM,IAAI;AACrC,QAAI,MAAM,YAAY,KAAK,CAAC,UAAU,IAAI,MAAM,IAAI,GAAG;AACrD,UAAI,KAAK,GAAI,MAAM,kBAAkB,UAAU,WAAW,CAAC,CAAE;AAAA,IAC/D,WAAW,MAAM,OAAO,KAAK,cAAc,MAAM,IAAI,MAAM,MAAM;AAC/D,UAAI,KAAK,QAAQ;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAMA,SAAS,eAAe,MAAwC;AAC9D,sBAAoB;AACpB,SAAO;AACT;AAsEA,SAAS,SACP,KACA,MACA,YACA,QACgB;AAChB,QAAM,EAAE,KAAK,OAAO,aAAa,IAAI;AACrC,QAAM,OAAO,MAAM,eAAe,IAAI,GAAG,GAAG,EAAE,KAAK;AACnD,QAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,QAAM,WAA6B,CAAC;AACpC,MAAI,QAAQ;AAEZ,aAAW,QAAQ,YAAY;AAC7B,UAAM,SAAqB,EAAE,MAAM,KAAK,KAAK;AAC7C,eAAW,QAAQ,KAAK,QAAQ,MAAM,GAAG;AACvC,eAAS;AACT,UAAI,eAAe,SAAS,SAAS,OAAO;AAC1C,cAAM,EAAE,MAAM,IAAI,KAAK,MAAM;AAC7B,cAAM,UAAU,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;AAC/C,iBAAS,KAAK;AAAA,UACZ,QAAQ,KAAK;AAAA,UACb,UAAU,KAAK;AAAA,UACf,SAAS,KAAK;AAAA,UACd,MAAM;AAAA,UACN,MAAM,MAAM,OAAO;AAAA,UACnB,QAAQ,MAAM,SAAS;AAAA,UACvB,SAAS,QAAQ,KAAK,EAAE,MAAM,GAAG,iBAAiB;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,MAAM;AAC3B;AAQA,eAAe,0BAA0B,UAAiC;AACxE,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK,QAAQ;AAAA,EAChC,SAAS,QAAiB;AACxB,UAAM,IAAI,kBAAkB,QAAQ,SAAS,IAAI,MAAM,OAAO,MAAM,CAAC;AACrE,UAAM,IAAI,gBAAgB,0CAA0C,QAAQ,KAAK,EAAE,OAAO,IAAI;AAAA,MAC5F,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,SAAS,YAAY,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,6EAA6E,QAAQ;AAAA,IACvF;AAAA,EACF;AACF;AAWA,eAAe,iBAAiB,MAAoC;AAClE,QAAM,aAAa,MAAM,kBAAkB,MAAM,gBAAgB;AACjE,QAAM,QAAQ,WAAW,MAAM,GAAG,iBAAiB;AACnD,QAAM,eAAe,WAAW,SAAS,MAAM;AAC/C,QAAM,iBAAiB,eAAe;AACtC,MAAI,gBAAgB;AAClB,WAAO;AAAA,MACL,oBAAoB,OAAO,YAAY,CAAC,wCACnC,OAAO,iBAAiB,CAAC,yBAAyB,OAAO,WAAW,MAAM,CAAC;AAAA,IAElF;AAAA,EACF;AACA,SAAO,EAAE,OAAO,cAAc,eAAe;AAC/C;AAQA,eAAsB,qBACpB,MAC6B;AAC7B,QAAM,QAAQ,iBAAiB,KAAK,SAAS;AAC7C,MAAI,WAAW,OAAO;AACpB,UAAM,IAAI,cAAc,MAAM,KAAK;AAAA,EACrC;AACA,QAAM,0BAA0B,MAAM,QAAQ;AAE9C,QAAM,WAAW,KAAK,YAAY,uBAAuB;AACzD,QAAM,QAAQ,MAAM,UAAU,QAAQ;AAGtC,QAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,SAAS,sBAAsB,CAAC,GAAG,gBAAgB;AAExF,QAAM,EAAE,OAAO,cAAc,eAAe,IAAI,MAAM,iBAAiB,MAAM,QAAQ;AAErF,QAAM,WAA6B,CAAC;AACpC,MAAI,QAAQ;AAEZ,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,cAAc,IAAI;AAC/B,QAAI,SAAS,KAAM;AACnB,UAAM,aAAa,MAAM,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI;AAC1D,QAAI,WAAW,WAAW,EAAG;AAE7B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IACnC,QAAQ;AACN,aAAO,KAAK,4CAA4C,IAAI,EAAE;AAC9D;AAAA,IACF;AAEA,UAAM,MAAM,SAAS,MAAM,UAAU,IAAI,KAAK;AAC9C,UAAM,UAAU,SAAS,KAAK,MAAM,YAAY,EAAE,KAAK,OAAO,cAAc,SAAS,OAAO,CAAC;AAC7F,aAAS,KAAK,GAAG,QAAQ,QAAQ;AACjC,aAAS,QAAQ;AAAA,EACnB;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,WAAO;AAAA,MACL,oBAAoB,OAAO,QAAQ,SAAS,MAAM,CAAC,oCACxC,OAAO,KAAK,CAAC,WAAW,OAAO,KAAK,CAAC;AAAA,IAClD;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,OAAO,OAAO,cAAc,MAAM,QAAQ,cAAc,eAAe;AAC5F;AAQA,eAAsB,cAAc,MAAuD;AACzF,QAAM,EAAE,SAAS,IAAI,MAAM,qBAAqB,IAAI;AACpD,SAAO;AACT;","names":[]}

package/dist/{chunk-FBAEBGQ3.js → chunk-ZIZVA5OL.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-HVPF7BBS.js";
+} from "./chunk-I33FKHUF.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2159,4 +2159,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-FBAEBGQ3.js.map
+//# sourceMappingURL=chunk-ZIZVA5OL.js.map

package/dist/cli.js

@@ -153,10 +153,11 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-FURVUS67.js";
+} from "./chunk-6UWWVTQH.js";
 import "./chunk-PJAMCYKJ.js";
 import "./chunk-DGWT7DXX.js";
 import "./chunk-64GMIUM5.js";
+import "./chunk-WZZQI774.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
@@ -172,7 +173,7 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-2LQROHUE.js";
+} from "./chunk-QMUXBHKO.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -191,7 +192,7 @@ import {
   recordAuthenticVote,
   registerConsensusVoteTool,
   toRecordDecision
-} from "./chunk-CFGJGRVF.js";
+} from "./chunk-SNWGBSQ7.js";
 import {
   loadUsageEvents,
   rollupByModel
@@ -227,15 +228,15 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-FBAEBGQ3.js";
+} from "./chunk-ZIZVA5OL.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-HVPF7BBS.js";
+} from "./chunk-I33FKHUF.js";
 import {
   VERSION
-} from "./chunk-M5DIGZIM.js";
+} from "./chunk-4OILK4VD.js";
 import "./chunk-B6HNAXBM.js";
 import {
   createUnifiedRegistry,
@@ -11811,6 +11812,68 @@ function parseValidationArgs(positionals, format, verbose) {
   return options;
 }
 
+// src/cli/doctor-native-grammars.ts
+var GRAMMAR_PROBES = Object.freeze([
+  { lang: "python", src: "x = 1\n", kind: "assignment" },
+  { lang: "go", src: "package m\nfunc f() {}\n", kind: "function_declaration" }
+]);
+function probeGrammars(register, parse6, probes = GRAMMAR_PROBES) {
+  if (probes.length === 0) {
+    return { available: false, error: "no grammar probes are defined", languages: [] };
+  }
+  try {
+    register();
+  } catch (error) {
+    return {
+      available: false,
+      error: `grammar registration failed: ${getErrorMessage(error)}`,
+      languages: []
+    };
+  }
+  const working = [];
+  const broken = [];
+  for (const probe of probes) {
+    try {
+      const matches = parse6(probe.lang, probe.src).root().findAll({ rule: { kind: probe.kind } });
+      if (matches.length > 0) {
+        working.push(probe.lang);
+      } else {
+        broken.push(`${probe.lang} (parsed, but produced no ${probe.kind} node)`);
+      }
+    } catch (error) {
+      broken.push(`${probe.lang} (${getErrorMessage(error)})`);
+    }
+  }
+  if (broken.length > 0) {
+    return {
+      available: false,
+      error: `grammars unusable: ${broken.join("; ")}`,
+      languages: working
+    };
+  }
+  return { available: true, error: null, languages: working };
+}
+async function loadGrammarModules() {
+  const [{ ensurePolyglotLangs }, napi] = await Promise.all([
+    import("./ast-rule-runner-3N7DX6XO.js"),
+    import("@ast-grep/napi")
+  ]);
+  return { register: ensurePolyglotLangs, parse: napi.parse };
+}
+async function checkNativeGrammars(load = loadGrammarModules) {
+  let modules;
+  try {
+    modules = await load();
+  } catch (error) {
+    return {
+      available: false,
+      error: `ast-grep native grammars failed to load: ${getErrorMessage(error)}`,
+      languages: []
+    };
+  }
+  return probeGrammars(modules.register, modules.parse);
+}
+
 // src/cli/verify-command.ts
 function checkNodeVersion() {
   const version = process.version;
@@ -11923,6 +11986,23 @@ async function checkSqliteAvailability() {
     fix: "Upgrade to Node >= 22.5.0 (node:sqlite is a builtin; nothing to install)"
   };
 }
+async function checkGrammarAvailability() {
+  const result = await checkNativeGrammars();
+  if (result.available) {
+    return {
+      name: "Native Grammars",
+      passed: true,
+      message: `ast-grep ${result.languages.join("/")} grammars parse (polyglot scanner available)`
+    };
+  }
+  return {
+    name: "Native Grammars",
+    passed: false,
+    severity: "warn",
+    message: result.error ?? "ast-grep native grammars unavailable",
+    fix: "Reinstall without blocking scripts, or verify @ast-grep/lang-{python,go} shipped their prebuilds/ directory"
+  };
+}
 function checkDataDirs() {
   const result = checkDataDirectory();
   const unwritable = result.subdirectories.filter((s) => !s.exists || !s.writable);
@@ -11989,6 +12069,7 @@ async function runVerify() {
     checkConfigLoading(),
     checkExpertSystem(),
     await checkSqliteAvailability(),
+    await checkGrammarAvailability(),
     checkDataDirs(),
     await checkAdapterAvailability()
   ];
@@ -19586,7 +19667,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-UBDVNB55.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-GGYLCRGQ.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {