pi-lens 3.8.73 → 4.0.0

package/rules/tree-sitter-queries/typescript/ts-insecure-random.yml

@@ -16,22 +16,19 @@ description: |
   ✅ FIX: use crypto.getRandomValues / crypto.randomUUID / secure server-side RNG.
 
 query: |
-  (variable_declarator
-    name: (identifier) @VAR
-    value: (call_expression
-      function: (member_expression
-        object: (identifier) @OBJ
-        property: (property_identifier) @FN)
-      arguments: (arguments) @ARGS)
+  (call_expression
+    function: (member_expression
+      object: (identifier) @OBJ
+      property: (property_identifier) @FN)
+    arguments: (arguments) @ARGS
     (#eq? @OBJ "Math")
-    (#eq? @FN "random")
-    (#match? @VAR "(?i)(token|secret|password|key|nonce|salt|csrf|auth|session|credential|hash|otp|pin)"))
+    (#eq? @FN "random")) @CALL
 
 metavars:
   - OBJ
   - FN
   - ARGS
-  - VAR
+  - CALL
 
 post_filter: ts_insecure_random_source
 

package/rules/tree-sitter-queries/typescript/unsafe-regex.yml

@@ -2,10 +2,10 @@
 # Detects dynamic regex construction that can lead to ReDoS
 id: unsafe-regex
 name: Dynamic Regex Construction
-severity: error
+severity: warning
 category: security
 defect_class: injection
-inline_tier: blocking
+inline_tier: warning
 language: typescript
 
 message: "Dynamic regex from user input — can cause ReDoS (Regular Expression Denial of Service)"
@@ -44,6 +44,8 @@ metavars:
   - INTERPOLATION
   - PATTERN
 
+post_filter: unsafe_regex_dynamic_identifier
+
 has_fix: false
 
 tags:

package/rules/typos/_typos.toml

@@ -0,0 +1,17 @@
+# pi-lens bundled default typos allowlist (#967).
+#
+# This file is injected as `initializationOptions.config` for the `typos-lsp`
+# auxiliary server ONLY when a project has no local typos config of its own
+# (`typos.toml` / `_typos.toml` / `.typos.toml` — see clients/typos-config.ts).
+# Any project-owned config always wins outright: pi-lens injects nothing in
+# that case, so this file never merges with (and can never outrank) a team's
+# own allowlist.
+#
+# Keep this list to evidenced false positives only — exact-identifier matches
+# via `extend-identifiers`, never the looser `extend-words` (which also
+# rewrites substrings inside unrelated words). Do not bulk-import a
+# dictionary here; every entry must have a provenance comment.
+
+[default.extend-identifiers]
+dito = "dito"            # #967 — real model/vendor namespace (provider-failover normalization prefix), not a misspelling of "ditto"
+unparseable = "unparseable"  # #967 — valid English spelling ("un-parseable"), not a typo of "unparsable"

package/scripts/analyze-pi-lens-logs.mjs

@@ -8,6 +8,7 @@
  *   ~/.pi-lens/cascade*.log          JSONL impact-cascade logs
  *   ~/.pi-lens/read-guard*.log       JSONL read-guard friction logs
  *   ~/.pi-lens/tree-sitter*.log      JSONL structural runner logs
+ *   ~/.pi-lens/extension*.log        JSONL extension diagnostics and console-guard telemetry
  *   ~/.pi-lens/actionable-warnings*.log  JSONL advisory pipeline (inject/suppress)
  *   ~/.pi-lens/ast-grep-tools*.log   JSONL MCP ast-grep search/replace telemetry
  *   ~/.pi-lens/logs/*.jsonl          JSONL diagnostic findings
@@ -18,10 +19,12 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { fileURLToPath } from "node:url";
+import { minimatch } from "minimatch";
 
 const DEFAULT_ROOT = path.join(os.homedir(), ".pi-lens");
 const DEFAULT_SINCE = "2d";
 const DEFAULT_LIMIT = 12;
+const DEFAULT_EXCLUDE_GLOBS = ["**/AppData/Local/Temp/claude/**", "**/heap-corpus*/**", "**/.plegma/work/**"];
 
 const args = parseArgs(process.argv.slice(2));
 const root = path.resolve(expandHome(args.root ?? DEFAULT_ROOT));
@@ -30,6 +33,10 @@ const limit =
 	Number.parseInt(args.limit ?? `${DEFAULT_LIMIT}`, 10) || DEFAULT_LIMIT;
 const outputJson = Boolean(args.json);
 const includeArchived = Boolean(args.archived);
+const excludeGlobs = [
+	...DEFAULT_EXCLUDE_GLOBS,
+	...(Array.isArray(args.exclude) ? args.exclude : args.exclude ? [args.exclude] : []),
+];
 
 const thresholds = {
 	startupSlowMs: Number.parseInt(args.startupSlowMs ?? "500", 10),
@@ -83,7 +90,14 @@ function parseArgs(argv) {
 			const key = arg.slice(2);
 			const next = argv[i + 1];
 			if (!next || next.startsWith("--")) out[key] = "true";
-			else out[key] = argv[++i];
+			else if (key === "exclude") {
+				const value = argv[++i];
+				out.exclude = out.exclude
+					? Array.isArray(out.exclude)
+						? [...out.exclude, value]
+						: [out.exclude, value]
+					: value;
+			} else out[key] = argv[++i];
 		}
 	}
 	return out;
@@ -158,6 +172,7 @@ function createState(files) {
 		window: { since: since?.toISOString() ?? "all", root },
 		files,
 		parseErrors: counter(),
+		excludedRows: 0,
 		seen: counter(),
 		projects: counter(),
 		smellTotals: counter(),
@@ -557,6 +572,10 @@ async function analyzeSessionStart(files, state) {
 			const ts = dateOf(match[1]);
 			if (!inWindow(ts)) return;
 			const message = match[2];
+			if (isExcludedText(message)) {
+				state.excludedRows++;
+				return;
+			}
 			state.seen.inc("sessionstart");
 
 			const cwd = /session_start cwd:\s*(.*)$/.exec(message)?.[1];
@@ -722,13 +741,45 @@ async function forEachJsonLine(file, bucket, state, visitor) {
 	await forEachLine(file, async (line) => {
 		if (!line.trim()) return;
 		try {
-			visitor(JSON.parse(line));
+			const entry = JSON.parse(line);
+			if (isExcludedEntry(entry)) {
+				state.excludedRows++;
+				return;
+			}
+			visitor(entry);
 		} catch {
 			state.parseErrors.inc(`${bucket}:${path.basename(file)}`);
 		}
 	});
 }
 
+function isExcludedEntry(entry) {
+	return pathValues(entry).some((value) =>
+		excludeGlobs.some((glob) =>
+			minimatch(value, glob, { nocase: true, dot: true }),
+		),
+	);
+}
+
+function pathValues(value, key = "") {
+	if (typeof value === "string") {
+		return /(file|path|cwd|root|project)/i.test(key) ? [normalizePath(value)] : [];
+	}
+	if (!value || typeof value !== "object") return [];
+	return Object.entries(value).flatMap(([childKey, child]) =>
+		pathValues(child, childKey),
+	);
+}
+
+function isExcludedText(text) {
+	const cwd = /session_start cwd:\s*(.*)$/.exec(text)?.[1];
+	return cwd
+		? excludeGlobs.some((glob) =>
+				minimatch(normalizePath(cwd), glob, { nocase: true, dot: true }),
+			)
+		: false;
+}
+
 async function forEachLine(file, visitor) {
 	if (!fs.existsSync(file)) return;
 	const rl = readline.createInterface({
@@ -1129,6 +1180,7 @@ function buildReport(state) {
 			Object.entries(state.files).map(([key, list]) => [key, list.length]),
 		),
 		rowsSeen: state.seen.toJSON(),
+		rowsExcluded: state.excludedRows,
 		parseErrors: state.parseErrors.toJSON(),
 		projects: state.projects.top(limit),
 		smells,
@@ -1232,6 +1284,7 @@ function printReport(report) {
 			.map(([k, v]) => `${k}=${v}`)
 			.join(", ")}`,
 	);
+	console.log(`${report.rowsExcluded} rows excluded (synthetic corpora)`);
 	if (Object.keys(report.parseErrors).length)
 		console.log(`parse errors: ${JSON.stringify(report.parseErrors)}`);
 

package/skills/pi-lens-write-tree-sitter-rule/SKILL.md

@@ -111,6 +111,11 @@ predicates:
      client.runQueryOnFile(queryDef, filePath, "typescript")
    (TreeSitterClient compiles via the same WASM the runner uses.)
 
+✅ For rule-bug fixes, also add a real-runner regression test through
+   treeSitterRunner.run() via makeRealRunnerCtx (tests/support/real-runner-ctx.ts) —
+   runQueryOnFile bypasses dispatch (skip_test_files, tiers, delta, rule cache).
+   Template: tests/clients/dispatch/runners/tree-sitter-skip-test-files.test.ts.
+
 ✅ JS files also run typescript/ rules (shared grammar) — one rule in
    rules/tree-sitter-queries/typescript/ covers BOTH .ts and .js. No -js copy needed.
 

package/dist/clients/ast-grep-parser.js

@@ -1,86 +0,0 @@
-import * as path from "node:path";
-export class AstGrepParser {
-    getRuleDescription;
-    mapSeverity;
-    constructor(getRuleDescription, mapSeverity) {
-        this.getRuleDescription = getRuleDescription;
-        this.mapSeverity = mapSeverity;
-    }
-    parseOutput(output, filterFile) {
-        const resolvedFilterFile = path.resolve(filterFile);
-        try {
-            const items = JSON.parse(output);
-            if (Array.isArray(items)) {
-                return items
-                    .map((item) => this.parseDiagnostic(item, resolvedFilterFile))
-                    .filter((d) => d !== null);
-            }
-        }
-        catch (err) {
-            void err;
-        }
-        return output
-            .split(/\r?\n/)
-            .filter((l) => l.trim())
-            .map((line) => {
-            try {
-                return this.parseDiagnostic(JSON.parse(line), resolvedFilterFile);
-            }
-            catch (err) {
-                void err;
-                return null;
-            }
-        })
-            .filter((d) => d !== null);
-    }
-    parseDiagnostic(item, filterFile) {
-        if (item.labels?.length) {
-            return this.parseNewFormat(item, filterFile);
-        }
-        if (item.spans?.length) {
-            return this.parseLegacyFormat(item, filterFile);
-        }
-        return null;
-    }
-    parseNewFormat(item, filterFile) {
-        const label = item.labels.find((l) => l.style === "primary") || item.labels[0];
-        const filePath = path.resolve(label.file || filterFile);
-        if (filePath !== filterFile)
-            return null;
-        const start = label.range?.start || { line: 0, column: 0 };
-        const end = label.range?.end || start;
-        return {
-            line: start.line + 1,
-            column: start.column,
-            endLine: end.line + 1,
-            endColumn: end.column,
-            severity: this.mapSeverity(item.severity),
-            message: item.message || "Unknown issue",
-            rule: item.ruleId || "unknown",
-            ruleDescription: this.getRuleDescription(item.ruleId || "unknown"),
-            file: filePath,
-        };
-    }
-    parseLegacyFormat(item, filterFile) {
-        const span = item.spans?.[0];
-        if (!span)
-            return null;
-        const filePath = path.resolve(span.file || filterFile);
-        if (filePath !== filterFile)
-            return null;
-        const start = span.range?.start || { line: 0, column: 0 };
-        const end = span.range?.end || start;
-        const ruleId = item.name || item.ruleId || "unknown";
-        return {
-            line: start.line + 1,
-            column: start.column,
-            endLine: end.line + 1,
-            endColumn: end.column,
-            severity: this.mapSeverity(item.severity || item.Severity || "warning"),
-            message: item.Message?.text || item.message || "Unknown issue",
-            rule: ruleId,
-            ruleDescription: this.getRuleDescription(ruleId),
-            file: filePath,
-        };
-    }
-}

package/dist/clients/config-enabled-shape.js

@@ -1,39 +0,0 @@
-/**
- * Shared parser for the `{ enabled?: boolean }` shape used by BOTH the global
- * config (`clients/lens-config.ts`, `~/.pi-lens/config.json`) and the project
- * config (`clients/project-lens-config.ts`, `.pi-lens.json`) for their
- * mutation-control keys (`format`, `autofix`, `actionableWarnings.autoFix`).
- *
- * Extracted (#792) so both loaders parse and warn on the identical shape
- * identically instead of two independent hand-rolled implementations that had
- * diverged in strictness — project warned on invalid `enabled` values via its
- * own `warnInvalidConfigOnce`, global silently dropped them. This module has
- * no dependency on either config module (avoids an import cycle) — callers
- * supply their own `warnInvalid` callback so each config keeps its own
- * warn-once plumbing (keyed by its own config path).
- */
-/**
- * Parse a raw `{ enabled?: boolean }` value.
- *
- * - `undefined` input → `undefined` (key absent from the config).
- * - Non-object (or array) input → `warnInvalid` is called, returns `undefined`.
- * - Object with no `enabled` key → `{}` (present but nothing to say).
- * - `enabled` present but not a boolean → `warnInvalid` is called, returns `{}`.
- * - `enabled` a boolean → `{ enabled }`.
- */
-export function parseEnabledShape(value, fieldPath, warnInvalid) {
-    if (value === undefined)
-        return undefined;
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        warnInvalid(`${fieldPath} must be an object`);
-        return undefined;
-    }
-    const raw = value;
-    if (!("enabled" in raw))
-        return {};
-    if (typeof raw.enabled !== "boolean") {
-        warnInvalid(`${fieldPath}.enabled must be a boolean`);
-        return {};
-    }
-    return { enabled: raw.enabled };
-}