pi-lens 3.8.73 → 3.8.74

package/package.json

@@ -1,140 +1,141 @@
 {
-	"name": "pi-lens",
-	"version": "3.8.73",
-	"type": "module",
-	"description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/apmantza/pi-lens.git"
-	},
-	"main": "./dist/index.js",
-	"bin": {
-		"pi-lens-mcp": "dist/mcp/server.js",
-		"pi-lens-analyze": "dist/mcp/analyze-cli.js"
-	},
-	"scripts": {
-		"build": "tsc --project tsconfig.build.json",
-		"build:dist": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && npx --yes -p typescript@7.0.2 tsc --project tsconfig.dist.json --noCheck && npm run bundle:dist",
-		"bundle:dist": "node scripts/bundle-dist.mjs",
-		"prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars",
-		"lint": "tsc --project tsconfig.json",
-		"watch": "tsc --watch",
-		"test": "vitest run",
-		"test:unit": "vitest run --ignore tests/index-integration.test.ts --ignore tests/clients/lsp/integration.test.ts",
-		"test:integration": "vitest run tests/index-integration.test.ts tests/clients/lsp/integration.test.ts",
-		"test:watch": "vitest",
-		"check": "node scripts/check-extensions.mjs",
-		"selftest:install": "node scripts/install-selftest.mjs",
-		"check:lockfile": "node scripts/check-lockfile-sync.mjs",
-		"check:grammars": "node scripts/check-grammar-provenance.mjs",
-		"check:grammar-load": "node scripts/check-grammar-load.mjs",
-		"audit:tree-sitter": "node scripts/audit-tree-sitter-rules.mjs",
-		"audit:rule-catalog": "node scripts/validate-rule-catalog.mjs",
-		"audit:astgrep-rule-pairs": "node scripts/audit-astgrep-rule-pairs.mjs",
-		"audit:playground": "node scripts/playground-verify-rule.mjs",
-		"logs:smells": "node scripts/analyze-pi-lens-logs.mjs",
-		"changelog:check": "node scripts/changelog-release.mjs --check",
-		"changelog:release": "node scripts/changelog-release.mjs",
-		"changelog:extract": "node scripts/changelog-extract.mjs",
-		"release:backfill-notes": "node scripts/backfill-github-releases.mjs",
-		"release:backfill-thanks": "node scripts/backfill-release-thanks.mjs",
-		"docs:rule-catalogs": "node scripts/gen-rule-catalogs.mjs",
-		"banner": "npx -y sharp-cli --input banner.svg --output banner.png resize 2200 620",
-		"download-grammars": "node scripts/download-grammars.js",
-		"harness:poc": "node scripts/run-harness.mjs cases/ts/pipeline-dispatch-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
-		"harness:python-poc": "node scripts/run-harness.mjs cases/python/pipeline-dispatch-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
-		"harness:ts-format-poc": "node scripts/run-harness.mjs cases/ts/format-default-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
-		"harness:python-autofix-poc": "node scripts/run-harness.mjs cases/python/autofix-default-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
-		"harness:go-poc": "node scripts/run-harness.mjs cases/go/pipeline-dispatch-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\""
-	},
-	"keywords": [
-		"pi",
-		"pi-extension",
-		"pi-package",
-		"linter",
-		"biome",
-		"ast-grep",
-		"ruff",
-		"typescript",
-		"code-quality",
-		"feedback",
-		"type-coverage",
-		"jscpd",
-		"knip"
-	],
-	"author": "Apostolos Mantzaris",
-	"license": "MIT",
-	"files": [
-		"dist/",
-		"docs/",
-		"grammars/",
-		"config/",
-		"rules/",
-		"skills/",
-		"scripts/download-grammars.js",
-		"scripts/grammars.lock.json",
-		"scripts/analyze-pi-lens-logs.mjs",
-		"scripts/install-selftest.mjs",
-		"scripts/rpc-load-check.mjs",
-		"README.md",
-		"CHANGELOG.md",
-		"banner.svg",
-		"banner.png"
-	],
-	"dependencies": {
-		"@ast-grep/cli": "^0.45.0",
-		"@ast-grep/napi": "^0.45.0",
-		"@earendil-works/pi-tui": "^0.82.1",
-		"js-yaml": "^5.2.2",
-		"minimatch": "^10.2.5",
-		"pidusage": "^4.0.1",
-		"typebox": "^1.0.0",
-		"vscode-jsonrpc": "^9.0.0"
-	},
-	"peerDependencies": {
-		"@earendil-works/pi-coding-agent": "*"
-	},
-	"peerDependenciesMeta": {
-		"@earendil-works/pi-coding-agent": {
-			"optional": true
-		}
-	},
-	"optionalDependencies": {
-		"web-tree-sitter": "0.25.10"
-	},
-	"devDependencies": {
-		"@biomejs/biome": "^2.4.10",
-		"@earendil-works/pi-coding-agent": "^0.82.1",
-		"@types/node": "^26.0.0",
-		"@types/pidusage": "^2.0.5",
-		"@vitest/coverage-v8": "^4.1.5",
-		"typescript": "^7.0.2",
-		"typescript-language-server": "^5.1.3",
-		"vitest": "^4.1.1"
-	},
-	"pi": {
-		"extensions": [
-			"./dist/index.js"
-		],
-		"skills": [
-			"../../skills"
-		]
-	},
-	"knip": {
-		"entry": [
-			"index.ts"
-		],
-		"project": [
-			"**/*.ts",
-			"!**/*.test.ts"
-		],
-		"ignore": [
-			"**/*.test.ts"
-		]
-	},
-	"allowScripts": {
-		"@ast-grep/cli@0.44.1": true,
-		"@google/genai@1.52.0": true,
-		"protobufjs@7.6.4": true
-	}
+  "name": "pi-lens",
+  "version": "3.8.74",
+  "type": "module",
+  "description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/apmantza/pi-lens.git"
+  },
+  "main": "./dist/index.js",
+  "bin": {
+    "pi-lens": "dist/mcp/cli.js",
+    "pi-lens-mcp": "dist/mcp/server.js",
+    "pi-lens-analyze": "dist/mcp/analyze-cli.js"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "build:dist": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && npx --yes -p typescript@7.0.2 tsc --project tsconfig.dist.json --noCheck && npm run bundle:dist",
+    "bundle:dist": "node scripts/bundle-dist.mjs",
+    "prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars",
+    "lint": "tsc --project tsconfig.json",
+    "watch": "tsc --watch",
+    "test": "vitest run",
+    "test:unit": "vitest run --ignore tests/index-integration.test.ts --ignore tests/clients/lsp/integration.test.ts",
+    "test:integration": "vitest run tests/index-integration.test.ts tests/clients/lsp/integration.test.ts",
+    "test:watch": "vitest",
+    "check": "node scripts/check-extensions.mjs",
+    "selftest:install": "node scripts/install-selftest.mjs",
+    "check:lockfile": "node scripts/check-lockfile-sync.mjs",
+    "check:grammars": "node scripts/check-grammar-provenance.mjs",
+    "check:grammar-load": "node scripts/check-grammar-load.mjs",
+    "audit:tree-sitter": "node scripts/audit-tree-sitter-rules.mjs",
+    "audit:rule-catalog": "node scripts/validate-rule-catalog.mjs",
+    "audit:astgrep-rule-pairs": "node scripts/audit-astgrep-rule-pairs.mjs",
+    "audit:playground": "node scripts/playground-verify-rule.mjs",
+    "logs:smells": "node scripts/analyze-pi-lens-logs.mjs",
+    "changelog:check": "node scripts/changelog-release.mjs --check",
+    "changelog:release": "node scripts/changelog-release.mjs",
+    "changelog:extract": "node scripts/changelog-extract.mjs",
+    "release:backfill-notes": "node scripts/backfill-github-releases.mjs",
+    "release:backfill-thanks": "node scripts/backfill-release-thanks.mjs",
+    "docs:rule-catalogs": "node scripts/gen-rule-catalogs.mjs",
+    "banner": "npx -y sharp-cli --input banner.svg --output banner.png resize 2200 620",
+    "download-grammars": "node scripts/download-grammars.js",
+    "harness:poc": "node scripts/run-harness.mjs cases/ts/pipeline-dispatch-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
+    "harness:python-poc": "node scripts/run-harness.mjs cases/python/pipeline-dispatch-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
+    "harness:ts-format-poc": "node scripts/run-harness.mjs cases/ts/format-default-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
+    "harness:python-autofix-poc": "node scripts/run-harness.mjs cases/python/autofix-default-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\"",
+    "harness:go-poc": "node scripts/run-harness.mjs cases/go/pipeline-dispatch-poc --pi-bin \"C:\\Users\\R3LiC\\AppData\\Roaming\\npm\\pi.cmd\""
+  },
+  "keywords": [
+    "pi",
+    "pi-extension",
+    "pi-package",
+    "linter",
+    "biome",
+    "ast-grep",
+    "ruff",
+    "typescript",
+    "code-quality",
+    "feedback",
+    "type-coverage",
+    "jscpd",
+    "knip"
+  ],
+  "author": "Apostolos Mantzaris",
+  "license": "MIT",
+  "files": [
+    "dist/",
+    "docs/",
+    "grammars/",
+    "config/",
+    "rules/",
+    "skills/",
+    "scripts/download-grammars.js",
+    "scripts/grammars.lock.json",
+    "scripts/analyze-pi-lens-logs.mjs",
+    "scripts/install-selftest.mjs",
+    "scripts/rpc-load-check.mjs",
+    "README.md",
+    "CHANGELOG.md",
+    "banner.svg",
+    "banner.png"
+  ],
+  "dependencies": {
+    "@ast-grep/cli": "^0.45.0",
+    "@ast-grep/napi": "^0.45.0",
+    "@earendil-works/pi-tui": "^0.82.1",
+    "js-yaml": "^5.2.2",
+    "minimatch": "^10.2.5",
+    "pidusage": "^4.0.1",
+    "typebox": "^1.0.0",
+    "vscode-jsonrpc": "^9.0.0"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-coding-agent": {
+      "optional": true
+    }
+  },
+  "optionalDependencies": {
+    "web-tree-sitter": "0.25.10"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.10",
+    "@earendil-works/pi-coding-agent": "^0.82.1",
+    "@types/node": "^26.0.0",
+    "@types/pidusage": "^2.0.5",
+    "@vitest/coverage-v8": "^4.1.5",
+    "typescript": "^7.0.2",
+    "typescript-language-server": "^5.1.3",
+    "vitest": "^4.1.1"
+  },
+  "pi": {
+    "extensions": [
+      "./dist/index.js"
+    ],
+    "skills": [
+      "../../skills"
+    ]
+  },
+  "knip": {
+    "entry": [
+      "index.ts"
+    ],
+    "project": [
+      "**/*.ts",
+      "!**/*.test.ts"
+    ],
+    "ignore": [
+      "**/*.test.ts"
+    ]
+  },
+  "allowScripts": {
+    "@ast-grep/cli@0.44.1": true,
+    "@google/genai@1.52.0": true,
+    "protobufjs@7.6.4": true
+  }
 }

package/rules/ast-grep-rules/rule-tests/hardcoded-url-js-test.yml

@@ -2,6 +2,7 @@ id: hardcoded-url-js
 valid:
   - 'const url = process.env.API_URL'
   - 'const x = "hello"'
+  - 'export const BASE_URL_CLINE = "https://api.cline.bot";'
 invalid:
   - 'const url = "https://api.example.com"'
   - 'const endpoint = "http://localhost:3000"'

package/rules/ast-grep-rules/rule-tests/hardcoded-url-test.yml

@@ -2,6 +2,8 @@ id: hardcoded-url
 valid:
   - 'const url = process.env.API_URL'
   - 'const x = "hello"'
+  - 'export const BASE_URL_CLINE = "https://api.cline.bot";'
+  - 'export const URL_KILO_TOS = "https://kilo.dev/tos";'
 invalid:
   - 'const url = "https://api.example.com"'
   - 'const endpoint = "http://localhost:3000"'

package/rules/ast-grep-rules/rule-tests/no-case-declarations-js-test.yml

@@ -7,6 +7,16 @@ valid:
         break;
       }
     }
+  - |
+    switch (x) {
+      case 1: {
+        if (x) {
+          const y = 1;
+          consume(y);
+        }
+        break;
+      }
+    }
   - |
     var z = 1; switch (x) { case 1: break; }
 invalid:

package/rules/ast-grep-rules/rule-tests/no-case-declarations-test.yml

@@ -7,6 +7,16 @@ valid:
         break;
       }
     }
+  - |
+    switch (x) {
+      case 1: {
+        if (x) {
+          const y = 1;
+          consume(y);
+        }
+        break;
+      }
+    }
   - |
     var z = 1; switch (x) { case 1: break; }
 invalid:

package/rules/ast-grep-rules/rule-tests/no-javascript-url-js-test.yml

@@ -8,7 +8,17 @@ valid:
     it("rejects javascript: urls", () => {
       expect(openBrowser("javascript:alert(1)")).toBe(false);
     });
+  - 'const links = arr.filter((l) => !l.startsWith("javascript:"))'
+  - 'if (url.includes("javascript:")) return null;'
+  - 'const isBlocked = url === "javascript:alert(1)"'
+  - 'const safe = url !== "javascript:alert(1)"'
+  - 'url?.startsWith("javascript:")'
 invalid:
   - 'a.href = "javascript:alert(1)"'
   - 'a.href = "javascript:void(0)"'
   - 'const u = "javascript:alert(1)"'
+  - 'a.href = str.replace("http:", "javascript:alert(1)")'
+  - 'if (candidates.includes(link.href = "javascript:alert(1)")) { doThing(); }'
+  - 'someArray.includes((a.href = "javascript:alert(1)", true));'
+  - 'if ((a.href = "javascript:alert(1)") === expected) { doThing(); }'
+  - 'const ok = (typeof (a.href = "javascript:alert(1)")) === "string";'

package/rules/ast-grep-rules/rule-tests/no-javascript-url-test.yml

@@ -12,7 +12,17 @@ valid:
     test.each(["javascript:alert(1)"])("rejects %s", (url) => {
       expect(openBrowser(url)).toBe(false);
     });
+  - 'const links = arr.filter((l) => !l.startsWith("javascript:"))'
+  - 'if (url.includes("javascript:")) return null;'
+  - 'const isBlocked = url === "javascript:alert(1)"'
+  - 'const safe = url !== "javascript:alert(1)"'
+  - 'url?.startsWith("javascript:")'
 invalid:
   - 'a.href = "javascript:alert(1)"'
   - 'a.href = "javascript:void(0)"'
   - 'const u = "javascript:alert(1)"'
+  - 'a.href = str.replace("http:", "javascript:alert(1)")'
+  - 'if (candidates.includes(link.href = "javascript:alert(1)")) { doThing(); }'
+  - 'someArray.includes((a.href = "javascript:alert(1)", true));'
+  - 'if ((a.href = "javascript:alert(1)") === expected) { doThing(); }'
+  - 'const ok = (typeof (a.href = "javascript:alert(1)")) === "string";'

package/rules/ast-grep-rules/rule-tests/strict-equality-js-test.yml

@@ -3,6 +3,9 @@ valid:
   - 'a === b'
   - 'a !== b'
   - 'a = b'
+  - 'value == null'
+  - 'null == value'
+  - 'value == undefined'
 invalid:
   - 'a == b'
   - 'a == "x"'

package/rules/ast-grep-rules/rule-tests/strict-equality-test.yml

@@ -3,6 +3,9 @@ valid:
   - 'a === b'
   - 'a !== b'
   - 'a = b'
+  - 'value == null'
+  - 'null == value'
+  - 'value == undefined'
 invalid:
   - 'a == b'
   - 'a == "x"'

package/rules/ast-grep-rules/rule-tests/strict-inequality-js-test.yml

@@ -3,6 +3,9 @@ valid:
   - 'a !== b'
   - 'a === b'
   - 'a < b'
+  - 'value != null'
+  - 'null != value'
+  - 'value != undefined'
 invalid:
   - 'a != b'
   - 'a != "x"'

package/rules/ast-grep-rules/rule-tests/strict-inequality-test.yml

@@ -3,6 +3,10 @@ valid:
   - 'a !== b'
   - 'a === b'
   - 'a < b'
+  - 'value != null'
+  - 'null != value'
+  - 'thinkingMap != null'
+  - 'value != undefined'
 invalid:
   - 'a != b'
   - 'a != "x"'

package/rules/ast-grep-rules/rules/hardcoded-url-js.yml

@@ -9,9 +9,27 @@ note: |
   level for some shapes; using a regex on `variable_declarator` (the
   inner `name = value` node) catches all const/let/var URL assignments
   regardless of the surrounding keyword.
+  A `SCREAMING_SNAKE_CASE` name is the project-wide convention for a
+  deliberate, named constant (see e.g. `check_secret_pattern` in
+  tree-sitter-client.ts, which trusts the same convention for secrets).
+  Provider/integration endpoint constants (`BASE_URL_CLINE`, `URL_KILO_TOS`,
+  …) are declared this way on purpose — they are configuration, just
+  expressed as a JS constant instead of an env var — so exempting that
+  naming shape removes the low-signal noise while still catching a URL
+  hardcoded under an ordinary lower/camelCase name (#964).
 rule:
   any:
-    - kind: variable_declarator
-      regex: '"https?://'
-    - kind: assignment_expression
-      regex: '"https?://'
+    - all:
+        - kind: variable_declarator
+          regex: '"https?://'
+        - not:
+            has:
+              field: name
+              regex: "^[A-Z][A-Z0-9_]*$"
+    - all:
+        - kind: assignment_expression
+          regex: '"https?://'
+        - not:
+            has:
+              field: left
+              regex: "^[A-Z][A-Z0-9_]*$"

package/rules/ast-grep-rules/rules/hardcoded-url.yml

@@ -9,9 +9,27 @@ note: |
   level for some shapes; using a regex on `variable_declarator` (the
   inner `name = value` node) catches all const/let/var URL assignments
   regardless of the surrounding keyword.
+  A `SCREAMING_SNAKE_CASE` name is the project-wide convention for a
+  deliberate, named constant (see e.g. `check_secret_pattern` in
+  tree-sitter-client.ts, which trusts the same convention for secrets).
+  Provider/integration endpoint constants (`BASE_URL_CLINE`, `URL_KILO_TOS`,
+  …) are declared this way on purpose — they are configuration, just
+  expressed as a TS constant instead of an env var — so exempting that
+  naming shape removes the low-signal noise while still catching a URL
+  hardcoded under an ordinary lower/camelCase name (#964).
 rule:
   any:
-    - kind: variable_declarator
-      regex: '"https?://'
-    - kind: assignment_expression
-      regex: '"https?://'
+    - all:
+        - kind: variable_declarator
+          regex: '"https?://'
+        - not:
+            has:
+              field: name
+              regex: "^[A-Z][A-Z0-9_]*$"
+    - all:
+        - kind: assignment_expression
+          regex: '"https?://'
+        - not:
+            has:
+              field: left
+              regex: "^[A-Z][A-Z0-9_]*$"

package/rules/ast-grep-rules/rules/no-case-declarations-js.yml

@@ -1,6 +1,8 @@
 id: no-case-declarations-js
 language: JavaScript
-message: "Unexpected lexical declaration in case block — wrap in braces to restrict scope"
+message: >-
+  Unexpected lexical declaration in case block — wrap in braces to restrict
+  scope
 severity: error
 note: |
   Variables declared with let/const in a case clause are accessible to the
@@ -17,5 +19,4 @@ rule:
     - not:
         inside:
           kind: statement_block
-          inside:
-            kind: switch_case
+          stopBy: end

package/rules/ast-grep-rules/rules/no-case-declarations.yml

@@ -1,6 +1,8 @@
 id: no-case-declarations
 language: TypeScript
-message: "Unexpected lexical declaration in case block — wrap in braces to restrict scope"
+message: >-
+  Unexpected lexical declaration in case block — wrap in braces to restrict
+  scope
 severity: error
 note: |
   Variables declared with let/const in a case clause are accessible to the
@@ -17,5 +19,4 @@ rule:
     - not:
         inside:
           kind: statement_block
-          inside:
-            kind: switch_case
+          stopBy: end

package/rules/ast-grep-rules/rules/no-console-except-error-js.yml

@@ -6,6 +6,16 @@ note: |
   console.log/debug/warn usually indicate leftover debug output shipped to
   production. Allow console.error ONLY inside catch blocks (logging the
   error there is useful for production triage).
+  Console output IS the point in a CLI script's own stdout contract and in
+  a logging implementation's console fallback/sink — flagging it there
+  just trains users to ignore the rule; `ignores` below carves those paths
+  out while application/library code elsewhere still gets flagged (#965).
+ignores:
+  - "scripts/**"
+  - "bin/**"
+  - "**/logger.ts"
+  - "**/logger.js"
+  - "**/logger.mjs"
 rule:
   any:
     - pattern: console.error($$$)

package/rules/ast-grep-rules/rules/no-console-except-error.yml

@@ -6,6 +6,16 @@ note: |
   console.log/debug/warn usually indicate leftover debug output shipped to
   production. Allow console.error ONLY inside catch blocks (logging the
   error there is useful for production triage).
+  Console output IS the point in a CLI script's own stdout contract and in
+  a logging implementation's console fallback/sink — flagging it there
+  just trains users to ignore the rule; `ignores` below carves those paths
+  out while application/library code elsewhere still gets flagged (#965).
+ignores:
+  - "scripts/**"
+  - "bin/**"
+  - "**/logger.ts"
+  - "**/logger.js"
+  - "**/logger.mjs"
 rule:
   any:
     - pattern: console.error($$$)

package/rules/ast-grep-rules/rules/no-javascript-url-js.yml

@@ -15,13 +15,49 @@ note: |
   `.only`/`.skip`/`.each` variants): a test asserting that a guard REJECTS a
   `javascript:` URL — e.g. `expect(openBrowser("javascript:...")).toBe(false)`
   — is the adversarial input the code is meant to reject, not a real sink.
+
+  Also excludes literals used as the needle in a defensive string check —
+  `url.startsWith("javascript:")`, `.endsWith(...)`, `.includes(...)`,
+  `.indexOf(...)`, `.search(...)`, `.match(...)` — or as one side of an
+  equality/inequality comparison (`url === "javascript:..."`). These are the
+  code detecting/rejecting a javascript: URL, not introducing one (refs
+  #533). Deliberately NOT excluded: `.replace(...)`/`.replaceAll(...)`,
+  since the literal there could be the replacement (second) argument —
+  i.e. the malicious payload being substituted IN — and excluding the
+  whole call would hide that true positive.
+
+  IMPORTANT: unlike the expect/it/test/describe exclusion above, these two
+  new exclusions deliberately do NOT use `stopBy: end`. `inside` without
+  `stopBy` only checks the immediate parent, so the literal must be a
+  DIRECT argument/operand of the defensive call/comparison — not merely
+  somewhere in its subtree. Without this constraint, a real sink smuggled
+  inside the call/comparison would go unflagged, e.g.
+  `candidates.includes(link.href = "javascript:alert(1)")` (assignment
+  nested in `.includes()`'s argument), `arr.includes((a.href =
+  "javascript:...", true))` (comma operator), or `(a.href =
+  "javascript:...") === expected` (assignment nested in a `===` operand) —
+  in all three the literal's immediate parent is the assignment
+  expression, not the `arguments`/`binary_expression` node, so it stays
+  flagged.
 rule:
   kind: string
   regex: '^"javascript:'
   not:
-    inside:
-      stopBy: end
-      kind: call_expression
-      has:
-        field: function
-        regex: "^(expect|it|test|describe)(\\.\\w+)?$"
+    any:
+      - inside:
+          stopBy: end
+          kind: call_expression
+          has:
+            field: function
+            regex: "^(expect|it|test|describe)(\\.\\w+)?$"
+      - inside:
+          kind: arguments
+          inside:
+            kind: call_expression
+            has:
+              field: function
+              regex: "\\.(startsWith|endsWith|includes|indexOf|search|match)$"
+      - inside:
+          kind: binary_expression
+          has:
+            regex: "^(===|!==|==|!=)$"