pi-lens 3.8.72 → 3.8.74

package/dist/clients/dispatch/runners/tree-sitter.js

@@ -4,15 +4,14 @@
  * Executes all loaded tree-sitter query files from rules/tree-sitter-queries/
  * for fast AST-based pattern matching.
  */
-import * as fs from "node:fs";
 import * as path from "node:path";
 import { RuleCache } from "../../cache/rule-cache.js";
+import { minimatch } from "../../deps/minimatch.js";
 import { isTestFile } from "../../file-utils.js";
-import { resolvePackagePath } from "../../package-root.js";
 import { buildOrUpdateGraph, computeImpactCascade, recordEntitySnapshotDiff, } from "../../review-graph/service.js";
 import { getSharedTreeSitterClient, isTreeSitterWasmAborted, markTreeSitterWasmAborted, resolveTreeSitterLanguage, } from "../../tree-sitter-shared.js";
 import { logTreeSitter } from "../../tree-sitter-logger.js";
-import { isDisabledQueryFilePath, queryLoader, } from "../../tree-sitter-query-loader.js";
+import { isDisabledQueryFilePath, queriesForLanguage, queryLoader, ruleFilesForLanguage, ruleSourceLanguages, } from "../../tree-sitter-query-loader.js";
 import { classifyDefect } from "../diagnostic-taxonomy.js";
 import { PRIORITY } from "../priorities.js";
 const blastCooldownByFile = new Map();
@@ -222,7 +221,7 @@ const ENTITY_QUERIES = {
         },
     ],
 };
-async function extractEntitySnapshot(client, filePath, languageId) {
+async function extractEntitySnapshot(client, filePath, languageId, contentOverride) {
     const defs = ENTITY_QUERIES[languageId] ?? [];
     const snapshot = new Map();
     for (const def of defs) {
@@ -237,7 +236,11 @@ async function extractEntitySnapshot(client, filePath, languageId) {
             metavars: ["NAME"],
             has_fix: false,
             filePath: "",
-        }, filePath, languageId, { maxResults: 200 });
+        }, filePath, languageId, { maxResults: 200 }, 
+        // Parse the same buffer content the diagnostics phase used (#885).
+        // Without this, unsaved buffers snapshot stale disk content and
+        // thrash the parse-cache entry the rule walk just populated.
+        contentOverride);
         for (const match of matches) {
             const name = match.captures.NAME?.trim();
             if (!name)
@@ -289,6 +292,23 @@ function getTotalLinesChanged(ranges) {
 }
 /** Threshold: skip entity extraction for changes under 5 lines */
 const ENTITY_EXTRACTION_LINE_THRESHOLD = 5;
+/**
+ * `filePath` relative to `root`, forward-slashed, for matching a rule's
+ * `ignore_paths` globs. Falls back to the absolute (slash-normalized) path
+ * when `filePath` isn't under `root` (e.g. an out-of-tree temp file), so a
+ * glob like `scripts/**` simply never matches rather than throwing.
+ */
+function relativeForIgnoreGlob(filePath, root) {
+    const rel = path.relative(root, filePath);
+    const normalized = (rel.startsWith("..") ? filePath : rel).split(path.sep).join("/");
+    return normalized;
+}
+function matchesIgnorePaths(filePath, root, patterns) {
+    if (!patterns || patterns.length === 0)
+        return false;
+    const rel = relativeForIgnoreGlob(filePath, root);
+    return patterns.some((pattern) => minimatch(rel, pattern, { dot: true }));
+}
 const treeSitterRunner = {
     id: "tree-sitter",
     appliesTo: ["jsts", "python", "go", "rust", "ruby", "cxx", "csharp", "php", "css"],
@@ -334,20 +354,11 @@ const treeSitterRunner = {
         // Try cache first, fall back to loading from disk
         let languageQueries = [];
         const cache = new RuleCache(languageId, ctx.cwd);
-        // Get all rule files for this language — project-local AND pi-lens built-ins.
-        // Both sets must be in the hash so the cache is invalidated when either changes.
-        const rulesDir = path.join(ctx.cwd, "rules", "tree-sitter-queries", languageId);
-        const builtinRulesDir = resolvePackagePath(import.meta.url, "rules", "tree-sitter-queries", languageId);
-        const ruleFileSet = new Set();
-        for (const dir of [rulesDir, builtinRulesDir]) {
-            if (fs.existsSync(dir)) {
-                for (const f of fs.readdirSync(dir)) {
-                    if (f.endsWith(".yml"))
-                        ruleFileSet.add(path.join(dir, f));
-                }
-            }
-        }
-        const ruleFiles = [...ruleFileSet];
+        // Fingerprint EVERY rule file the effective rule set for this language is
+        // built from — project-local AND bundled built-ins, across all rule-source
+        // languages (tsx also runs the typescript rules; #878). The loader owns
+        // that composition so this can't drift from `queriesForLanguage`.
+        const ruleFiles = ruleFilesForLanguage(languageId, ctx.cwd);
         // Try cache
         const cached = cache.get(ruleFiles);
         let cacheHit = false;
@@ -363,14 +374,18 @@ const treeSitterRunner = {
                 .filter((q) => !isDisabledQueryFilePath(q.filePath));
         }
         else {
-            // Load from disk
-            await queryLoader.loadQueries(ctx.cwd);
-            languageQueries = queryLoader.getQueriesForLanguage(languageId);
-            if (languageId === "javascript") {
-                // JavaScript files also match TypeScript rules (shared grammar)
-                const tsQueries = queryLoader.getQueriesForLanguage("typescript");
-                languageQueries = [...languageQueries, ...tsQueries];
-            }
+            // A miss means the rule-file fingerprint moved (or no cache yet), so the
+            // loader's in-memory memo may hold the PRE-edit rules — without `force`
+            // it would hand those back and cache.set below would persist stale rules
+            // under the fresh fingerprint, poisoning every future process (#878).
+            await queryLoader.loadQueries(ctx.cwd, { force: true });
+            // The effective rule set is composed by the loader (tsx also runs the
+            // typescript rules; javascript deliberately does not — see
+            // ruleSourceLanguages in tree-sitter-query-loader.ts).
+            languageQueries = queriesForLanguage(new Map(ruleSourceLanguages(languageId).map((lang) => [
+                lang,
+                queryLoader.getQueriesForLanguage(lang),
+            ])), languageId);
             // Save to cache
             cache.set(ruleFiles, languageQueries.map((q) => ({
                 id: q.id,
@@ -384,7 +399,10 @@ const treeSitterRunner = {
                 post_filter_params: q.post_filter_params,
                 defect_class: q.defect_class,
                 inline_tier: q.inline_tier,
+                skip_test_files: q.skip_test_files,
+                ignore_paths: q.ignore_paths,
                 has_fix: q.has_fix,
+                fix_action: q.fix_action,
                 filePath: q.filePath,
             })));
         }
@@ -408,9 +426,15 @@ const treeSitterRunner = {
         // python-assert-production — `assert` is the idiomatic test assertion) opt
         // out via `skip_test_files` while the runner otherwise runs on test files.
         const fileIsTest = isTestFile(filePath);
+        // Per-rule path carve-out (#965): a rule that's noise on CLI scripts or a
+        // project's own logging sink (e.g. no-console-except-error firing inside
+        // scripts/** or lib/logger.ts) opts out via `ignore_paths`, the same way
+        // `skip_test_files` opts a rule out of test files above.
+        const ignoreRoot = ctx.projectRoot ?? ctx.cwd;
         const effectiveQueries = (ctx.blockingOnly
             ? languageQueries.filter((q) => q.inline_tier !== "review")
-            : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files));
+            : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files) &&
+            !matchesIgnorePaths(filePath, ignoreRoot, q.ignore_paths));
         logTreeSitter({
             phase: "queries_loaded",
             filePath,
@@ -424,110 +448,109 @@ const treeSitterRunner = {
         const contentOverride = contentFromFacts !== undefined && contentFromFacts !== null
             ? contentFromFacts
             : undefined;
-        // Run queries in parallel with concurrency limit for optimal performance
-        const CONCURRENCY_LIMIT = 6;
-        const queryResults = [];
-        for (let i = 0; i < effectiveQueries.length; i += CONCURRENCY_LIMIT) {
-            // Yield the event loop between batches so already-resolved promises from
-            // other parallel groups (LSP, eslint skip, etc.) can drain. Each wasm query
-            // batch is synchronous CPU work that would otherwise pin the event loop for
-            // the full runner duration, making other runners' latency measurements wrong.
-            if (i > 0)
-                await new Promise((r) => setImmediate(r));
-            const batch = effectiveQueries.slice(i, i + CONCURRENCY_LIMIT);
-            const batchResults = await Promise.all(batch.map(async (query) => {
-                const queryDiagnostics = [];
-                try {
-                    const matches = await client.runQueryOnFile(query, filePath, languageId, { maxResults: 10 }, contentOverride);
-                    for (const match of matches) {
-                        // Get line/column from match (already 0-indexed from tree-sitter)
-                        const line = match.line;
-                        const column = match.column;
-                        // Modified-ranges gate only applies to blocking-tier diagnostics.
-                        // Warning-tier diagnostics always flow through for logging.
-                        const isSeverityBlocking = query.severity === "error" ||
-                            query.inline_tier === "blocking" ||
-                            SILENT_ERROR_QUERY_IDS.has(query.id);
-                        if (ctx.blockingOnly &&
-                            isSeverityBlocking &&
-                            !isLineInModifiedRanges(line + 1, ctx.modifiedRanges)) {
-                            continue;
-                        }
-                        // Map severity to semantic
-                        const semantic = query.severity === "error"
-                            ? "blocking"
-                            : query.severity === "warning"
-                                ? "warning"
-                                : "none";
-                        const defectClass = query.defect_class ??
-                            classifyDefect(query.id, "tree-sitter", query.message);
-                        const suggestion = query.has_fix && query.fix_action
-                            ? `${query.fix_action} this statement`
-                            : semantic === "blocking"
-                                ? defaultFixSuggestion(defectClass, query.id)
-                                : undefined;
-                        const hasSuggestedFix = !!query.has_fix;
-                        queryDiagnostics.push({
-                            id: `tree-sitter:${query.id}:${line}`,
-                            message: query.message.replace(/\{\{(\w+)\}\}/g, (_, name) => match.captures[name]?.trim() ?? `{{${name}}}`),
-                            filePath,
-                            line: line + 1, // 1-indexed
-                            column: column + 1, // 1-indexed
-                            severity: query.severity,
-                            semantic,
-                            tool: "tree-sitter",
-                            rule: query.id,
-                            defectClass,
-                            // Surface fix intent to agent — tree-sitter never auto-applies;
-                            // linters (biome/ruff/eslint) own the autofix phase.
-                            fixable: hasSuggestedFix,
-                            autoFixAvailable: false,
-                            fixKind: hasSuggestedFix ? "suggestion" : undefined,
-                            fixSuggestion: suggestion,
-                            matchedText: match.matchedText || undefined,
-                            astNodeType: match.nodeType || undefined,
-                        });
-                    }
-                }
-                catch (err) {
-                    // pi-lens-ignore: missing-error-propagation — per-query resilience loop, intentional
-                    const msg = err instanceof Error ? err.message : String(err);
-                    // Emscripten abort() corrupts the entire module-level wasm heap.
-                    // Poison the singleton so no further queries attempt to use the dead runtime.
-                    if (msg.includes("Aborted") || msg.includes("abort()")) {
-                        markTreeSitterWasmAborted();
-                        logTreeSitter({
-                            phase: "query_error",
-                            filePath,
-                            languageId,
-                            queryId: query.id,
-                            error: "wasm_aborted_fatal",
-                        });
-                    }
-                    else {
-                        console.error(`[tree-sitter] Query ${query.id} failed:`, err);
-                        logTreeSitter({
-                            phase: "query_error",
-                            filePath,
-                            languageId,
-                            queryId: query.id,
-                            error: msg,
-                        });
-                    }
+        // ONE tree walk for the whole effective rule set, not one per rule (#888).
+        // The per-rule loop re-walked the tree ~30-40 times per edit; the work is
+        // synchronous WASM, so the concurrency-limit batching only chunked CPU work
+        // without parallelizing anything. runQueriesOnFile concatenates the patterns
+        // in rule order and maps each match back to its owning rule, so the per-rule
+        // maxResults(10) cap, metavars, predicates and post-filters still apply and
+        // results stay grouped in rule order. The post-match gating below (modified
+        // ranges, severity mapping) is unchanged.
+        const diagnostics = [];
+        try {
+            const found = await client.runQueriesOnFile(effectiveQueries, filePath, languageId, { maxResults: 10 }, contentOverride);
+            for (const { queryDef: query, match } of found) {
+                // match.line/column are already 1-indexed — the client emits
+                // startPosition.row + 1 (tree-sitter-client searchFileWithQuery).
+                const { line, column } = match;
+                // Modified-ranges gate only applies to blocking-tier diagnostics.
+                // Warning-tier diagnostics always flow through for logging.
+                const isSeverityBlocking = query.severity === "error" ||
+                    query.inline_tier === "blocking" ||
+                    SILENT_ERROR_QUERY_IDS.has(query.id);
+                if (ctx.blockingOnly &&
+                    isSeverityBlocking &&
+                    !isLineInModifiedRanges(line, ctx.modifiedRanges)) {
+                    continue;
                 }
-                return queryDiagnostics;
-            }));
-            queryResults.push(...batchResults);
+                // Map severity to semantic
+                const semantic = query.severity === "error"
+                    ? "blocking"
+                    : query.severity === "warning"
+                        ? "warning"
+                        : "none";
+                const defectClass = query.defect_class ??
+                    classifyDefect(query.id, "tree-sitter", query.message);
+                const suggestion = query.has_fix && query.fix_action
+                    ? `${query.fix_action} this statement`
+                    : semantic === "blocking"
+                        ? defaultFixSuggestion(defectClass, query.id)
+                        : undefined;
+                const hasSuggestedFix = !!query.has_fix;
+                diagnostics.push({
+                    id: `tree-sitter:${query.id}:${line}`,
+                    message: query.message.replace(/\{\{(\w+)\}\}/g, (_, name) => match.captures[name]?.trim() ?? `{{${name}}}`),
+                    filePath,
+                    line,
+                    column,
+                    severity: query.severity,
+                    semantic,
+                    tool: "tree-sitter",
+                    rule: query.id,
+                    defectClass,
+                    // Surface fix intent to agent — tree-sitter never auto-applies;
+                    // linters (biome/ruff/eslint) own the autofix phase.
+                    fixable: hasSuggestedFix,
+                    autoFixAvailable: false,
+                    fixKind: hasSuggestedFix ? "suggestion" : undefined,
+                    fixSuggestion: suggestion,
+                    matchedText: match.matchedText || undefined,
+                    astNodeType: match.nodeType || undefined,
+                });
+            }
         }
-        // Flatten all query results into final diagnostics array
-        const diagnostics = queryResults.flat();
-        // Skip expensive entity extraction for trivial changes (< 5 lines)
-        // This avoids ~500-800ms overhead for small edits like single-line fixes
+        catch (err) {
+            // pi-lens-ignore: missing-error-propagation — per-dispatch resilience, intentional
+            const msg = err instanceof Error ? err.message : String(err);
+            // Emscripten abort() corrupts the entire module-level wasm heap.
+            // Poison the singleton so no further queries attempt to use the dead runtime.
+            if (msg.includes("Aborted") || msg.includes("abort()")) {
+                markTreeSitterWasmAborted();
+                logTreeSitter({
+                    phase: "query_error",
+                    filePath,
+                    languageId,
+                    error: "wasm_aborted_fatal",
+                    metadata: { queryIds: effectiveQueries.map((q) => q.id) },
+                });
+            }
+            else {
+                console.error("[tree-sitter] Batched query run failed:", err);
+                logTreeSitter({
+                    phase: "query_error",
+                    filePath,
+                    languageId,
+                    error: msg,
+                    metadata: { queryIds: effectiveQueries.map((q) => q.id) },
+                });
+            }
+        }
+        // Skip expensive entity extraction for trivial changes (< 5 lines).
+        // Before #885 this threshold only guarded the zero-diagnostics early
+        // return below; a second extractEntitySnapshot block ran UNCONDITIONALLY
+        // after it, so small edits (skipEntityExtraction=true) still paid the
+        // ~500-800ms snapshot cost on every dispatch. One guarded block now
+        // serves both paths.
+        // Absent/empty modifiedRanges means "whole file" (full-file dispatches,
+        // fresh writes — see isLineInModifiedRanges above), never "trivial edit":
+        // entity extraction must run in that case.
         const totalLinesChanged = getTotalLinesChanged(ctx.modifiedRanges);
-        const skipEntityExtraction = totalLinesChanged < ENTITY_EXTRACTION_LINE_THRESHOLD;
-        if (diagnostics.length === 0 && !skipEntityExtraction) {
+        const skipEntityExtraction = ctx.modifiedRanges != null &&
+            ctx.modifiedRanges.length > 0 &&
+            totalLinesChanged < ENTITY_EXTRACTION_LINE_THRESHOLD;
+        if (!skipEntityExtraction) {
             try {
-                const snapshot = await extractEntitySnapshot(client, filePath, languageId);
+                const snapshot = await extractEntitySnapshot(client, filePath, languageId, contentOverride);
                 const diff = recordEntitySnapshotDiff(ctx.facts, filePath, snapshot);
                 const changedEntityKeys = [
                     ...diff.added,
@@ -564,6 +587,8 @@ const treeSitterRunner = {
             catch {
                 /* entity snapshot / blast-radius enrichment is best-effort */
             }
+        }
+        if (diagnostics.length === 0) {
             logTreeSitter({
                 phase: "runner_complete",
                 filePath,
@@ -579,44 +604,6 @@ const treeSitterRunner = {
         // Check if any blocking issues
         const hasBlocking = diagnostics.some((d) => d.semantic === "blocking");
         const blockingCount = diagnostics.filter((d) => d.semantic === "blocking").length;
-        try {
-            const snapshot = await extractEntitySnapshot(client, filePath, languageId);
-            const diff = recordEntitySnapshotDiff(ctx.facts, filePath, snapshot);
-            const changedEntityKeys = [
-                ...diff.added,
-                ...diff.modified,
-                ...diff.removed,
-            ];
-            if (changedEntityKeys.length > 0) {
-                logTreeSitter({
-                    phase: "entity_diff",
-                    filePath,
-                    languageId,
-                    metadata: {
-                        added: diff.added,
-                        modified: diff.modified,
-                        removed: diff.removed,
-                        totalChanged: changedEntityKeys.length,
-                    },
-                });
-                const lastBlast = blastCooldownByFile.get(filePath) ?? 0;
-                if (Date.now() - lastBlast < BLAST_COOLDOWN_MS) {
-                    logTreeSitter({
-                        phase: "blast_radius",
-                        filePath,
-                        languageId,
-                        metadata: { skipped: "cooldown", cooldownMs: BLAST_COOLDOWN_MS },
-                    });
-                }
-                else {
-                    blastCooldownByFile.set(filePath, Date.now());
-                    runBlastRadiusInBackground(ctx.cwd, filePath, languageId, ctx.facts);
-                }
-            }
-        }
-        catch {
-            // best-effort experimental telemetry only
-        }
         logTreeSitter({
             phase: "runner_complete",
             filePath,

package/dist/clients/dispatch/runners/utils/runner-helpers.js

@@ -10,7 +10,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { getGlobalPiLensDir } from "../../../file-utils.js";
-import { ensureTool } from "../../../installer/index.js";
+import { ensureTool, isSpawnableCommand } from "../../../installer/index.js";
 import { getServersForFileWithConfig, isServerDisabled, } from "../../../lsp/config.js";
 import { findGlobalBinary } from "../../../package-manager.js";
 import { safeSpawnAsync } from "../../../safe-spawn.js";
@@ -207,27 +207,26 @@ export async function resolveToolCommandWithInstallFallback(cwd, toolId, timeout
     return resolveCommandWithInstallFallback(resolveToolCommand(cwd, toolId) ?? spec.command, spec.managedToolId ?? toolId, cwd, spec.versionArgs ?? ["--version"], timeout);
 }
 async function verifyOrInstallCommand(command, toolId, cwd, versionArgs = ["--version"], timeout = 5000) {
-    const versionCheck = await safeSpawnAsync(command, versionArgs, {
-        timeout,
-        cwd,
-    });
-    if (!versionCheck.error && versionCheck.status === 0) {
-        return command;
+    // Skip the --version spawn when the command isn't even on disk — the ~μs
+    // stat/PATH walk beats a guaranteed-to-fail spawn round-trip.
+    if (await isSpawnableCommand(command)) {
+        const versionCheck = await safeSpawnAsync(command, versionArgs, {
+            timeout,
+            cwd,
+        });
+        if (!versionCheck.error && versionCheck.status === 0) {
+            return command;
+        }
     }
     if (!shouldAutoInstallTool(toolId)) {
         return null;
     }
-    const installed = await ensureTool(toolId);
-    if (!installed)
-        return null;
-    const installedCheck = await safeSpawnAsync(installed, versionArgs, {
-        timeout,
-        cwd,
-    });
-    if (installedCheck.error || installedCheck.status !== 0) {
-        return null;
-    }
-    return installed;
+    // ensureTool's result is already trusted: a probe-cache hit validated
+    // path+mtime, and a fresh install verified the binary. Re-probing
+    // --version here booted the tool's node shim once per invocation for
+    // zero new information; a broken install now surfaces as the runner's
+    // own spawn error instead of a silent null.
+    return (await ensureTool(toolId)) ?? null;
 }
 export async function resolveCommandArgsWithInstallFallback(command, toolId, cwd, versionArgs = ["--version"], timeout = 5000) {
     const versionCheck = await safeSpawnAsync(command.cmd, [...command.args, ...versionArgs], { timeout, cwd });

package/dist/clients/feature-hints.js

@@ -1,5 +1,22 @@
 function normalizeHintInput(value) {
-    return value.replace(/\\/g, "/").toLowerCase();
+    return value.replace(/\\/g, "/");
+}
+function hasHintToken(value, tokens) {
+    const escaped = tokens.map((token) => token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    const alternatives = escaped.join("|");
+    // Path/word boundaries are deliberately explicit: a token must occupy a
+    // segment (or a dot/dash/underscore-separated word), never an arbitrary
+    // substring. The second expression preserves camelCase names such as
+    // authStore and DatabaseClient without making `adb` match `db`.
+    return (new RegExp(`(?:^|[/_.\\-\\s])(?:${alternatives})(?=[/_.\\-\\s]|$)`, "i").test(value) ||
+        new RegExp(`(?:^|(?<=[a-z0-9]))(?:${tokens
+            .flatMap((token) => [
+            token[0].toUpperCase() + token.slice(1),
+            ...(token === "openai" ? ["OpenAI"] : []),
+            ...(token === "github" ? ["GitHub"] : []),
+            ...(token === "gitlab" ? ["GitLab"] : []),
+        ])
+            .join("|")})(?=[A-Z]|[/_.\\-\\s]|$)`).test(value));
 }
 /**
  * Deterministic feature-kind hint derived from package/entity/file names.
@@ -7,10 +24,19 @@ function normalizeHintInput(value) {
  */
 export function inferFeatureKind(nameOrPath) {
     const normalized = normalizeHintInput(nameOrPath);
-    if (/config|store|db|database|github|openai|sync|service/.test(normalized)) {
+    if (hasHintToken(normalized, [
+        "config",
+        "store",
+        "db",
+        "database",
+        "github",
+        "openai",
+        "sync",
+        "service",
+    ])) {
         return "service";
     }
-    if (/(^|[/_.\-\s])(cli|command|bin)([/_.\-\s]|$)/.test(normalized)) {
+    if (/(^|[/_.\-\s])(cli|command|bin)([/_.\-\s]|$)/i.test(normalized)) {
         return "cli-command";
     }
     return "library";
@@ -22,20 +48,40 @@ export function inferFeatureKind(nameOrPath) {
 export function inferTrustBoundaries(nameOrPath) {
     const normalized = normalizeHintInput(nameOrPath);
     const boundaries = new Set();
-    if (/config|store|db|database|repo|repository|model|migration/.test(normalized)) {
+    if (hasHintToken(normalized, [
+        "config",
+        "store",
+        "db",
+        "database",
+        "repo",
+        "repository",
+        "model",
+        "migration",
+    ])) {
         boundaries.add("filesystem");
         boundaries.add("database");
     }
-    if (/github|gitlab|openai|anthropic|stripe|slack|sync|webhook|api|client/.test(normalized)) {
+    if (hasHintToken(normalized, [
+        "github",
+        "gitlab",
+        "openai",
+        "anthropic",
+        "stripe",
+        "slack",
+        "sync",
+        "webhook",
+        "api",
+        "client",
+    ])) {
         boundaries.add("network");
         boundaries.add("external-api");
         boundaries.add("serialization");
     }
-    if (/(^|[/_.\-\s])(cli|command|bin|exec|spawn|process|shell)([/_.\-\s]|$)/.test(normalized)) {
+    if (/(^|[/_.\-\s])(cli|command|bin|exec|spawn|process|shell)([/_.\-\s]|$)/i.test(normalized)) {
         boundaries.add("user-input");
         boundaries.add("process-exec");
     }
-    if (/auth|login|token|session|oauth|jwt/.test(normalized)) {
+    if (hasHintToken(normalized, ["auth", "login", "token", "session", "oauth", "jwt"])) {
         boundaries.add("auth");
         boundaries.add("user-input");
     }