pi-lens 4.1.6 → 4.2.0

package/rules/tree-sitter-queries/typescript/sql-injection.yml

@@ -1,15 +1,13 @@
 # SQL Injection Detection
 # Detects unsafe interpolation in SQL-like template literals.
-# Demoted from error/blocking to warning on 2026-09-10 (maintainer): the
-# query keys on the callee NAME only (query|execute|exec|run), so any
-# `run(`…${x}…`)` / `exec(`…`)` in non-SQL code fires — too many false
-# positives to block on. A real SQL sink needs a receiver/type signal.
+# The structural query keeps the common callee set, while the TypeScript-aware
+# post-filter requires a receiver bound to a known DB client or a SQL-leading template.
 id: sql-injection
 name: SQL Injection Risk
-severity: warning
+severity: error
 category: security
 defect_class: injection
-inline_tier: warning
+inline_tier: blocking
 language: typescript
 
 message: "SQL injection risk — use parameterized queries, never interpolate into SQL"
@@ -30,18 +28,32 @@ description: |
 
 query: |
   (call_expression
-    function: [
-      (identifier) @SQL_FUNC
-      (member_expression property: (property_identifier) @SQL_FUNC)
-    ]
+    function: (identifier) @SQL_FUNC
     arguments: (arguments
-      (template_string (template_substitution) @INTERPOLATION))
-    (#match? @SQL_FUNC "^(query|execute|exec|run)$"))
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (arguments
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (template_string (template_substitution) @INTERPOLATION) @TEMPLATE
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
 
 metavars:
   - SQL_FUNC
+  - OBJ
+  - TEMPLATE
   - INTERPOLATION
 
+post_filter: ts_sql_injection_sink
+
 has_fix: false
 
 tags:

package/scripts/analyze-pi-lens-logs.mjs

@@ -195,6 +195,7 @@ function createState(files) {
 		projects: counter(),
 		smellTotals: counter(),
 		latency: {
+			testRunnerVerdicts: new Map(),
 			runnerStatus: counter(),
 			runnerFailureKinds: counter(),
 			runnerBlockingFindings: counter(),
@@ -381,6 +382,22 @@ async function analyzeLatency(files, state) {
 				const phase = entry.phase ?? "unknown";
 				state.latency.phaseCounts.inc(phase);
 				if (phase.endsWith("_timeout")) state.latency.phaseTimeouts.inc(phase);
+				if (phase === "test_runner_verdict_delivery") {
+					const sessionId = entry.metadata?.sessionId ?? "unknown";
+					const summary = state.latency.testRunnerVerdicts.get(sessionId) ?? {
+						total: 0,
+						stale: 0,
+						unknown: 0,
+					};
+					const verdictCount = entry.metadata?.verdictCount;
+					const staleCount = entry.metadata?.staleCount;
+					const unknownCount = entry.metadata?.unknownCount;
+					summary.total += typeof verdictCount === "number" ? verdictCount : 1;
+					if (typeof staleCount === "number") summary.stale += staleCount;
+					else if (entry.metadata?.stale === true) summary.stale += 1;
+					if (typeof unknownCount === "number") summary.unknown += unknownCount;
+					state.latency.testRunnerVerdicts.set(sessionId, summary);
+				}
 				if (phase === "config_resolved") {
 					// #2526. Counted here rather than derived from phaseCounts so the
 					// legacy/record cross-check reads the same row it counts.
@@ -1481,6 +1498,18 @@ function buildReport(state) {
 			shownInlineShownAgentUnresolved: state.diagnostics.shownInline.toJSON(),
 		},
 		latency: {
+			testRunnerVerdicts: Object.fromEntries(
+				[...state.latency.testRunnerVerdicts.entries()].map(
+					([sessionId, summary]) => [
+						sessionId,
+						{
+							...summary,
+							denominator: summary.total,
+							rate: summary.total ? summary.stale / summary.total : 0,
+						},
+					],
+				),
+			),
 			runnerStatus: state.latency.runnerStatus.top(limit * 2),
 			runnerFailureKinds: state.latency.runnerFailureKinds.top(limit * 2),
 			runnerBlockingFindings: state.latency.runnerBlockingFindings.toJSON(),
@@ -1672,6 +1701,17 @@ function printReport(report) {
 		report.latency.runnerFailureKinds,
 		(x) => `${x.count.toString().padStart(5)}  ${x.key}`,
 	);
+	const verdictSessions = Object.entries(
+		report.latency.testRunnerVerdicts ?? {},
+	);
+	if (verdictSessions.length) {
+		console.log("\nTest-runner stale verdicts per session");
+		for (const [sessionId, summary] of verdictSessions) {
+			console.log(
+				`  ${sessionId}: ${summary.stale}/${summary.total} stale (${(summary.rate * 100).toFixed(1)}%)`,
+			);
+		}
+	}
 
 	const a = report.actionable;
 	if (a.reports || a.advisoriesInjected) {

package/skills/pi-lens-ast-grep/SKILL.md

@@ -9,6 +9,21 @@ Use `ast_grep_search` and `ast_grep_replace` for semantic code search/replace. a
 
 These tools (plus `ast_grep_outline`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `pi_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
 
+On hosts that aggregate pi-lens behind a single `lens` tool, the `ast_grep_*` tools and `pi_lens_activate_tools` may not be registered at all. There, fall back to the `ast-grep` CLI (alias `sg`) — patterns, metavariables, and YAML rules are identical:
+
+```bash
+# search (≈ ast_grep_search)
+ast-grep run -p 'fetchMetrics($$$ARGS)' -l ts src/
+
+# rewrite (≈ ast_grep_replace; -U applies all)
+ast-grep run -p 'var $X' -r 'let $X' -l js src/ -U
+
+# full YAML rule (≈ the rule: parameter)
+ast-grep scan --rule my-rule.yml src/
+```
+
+Structural-intent parameters map to YAML constraints: `insideKind` → `inside: { kind: ..., stopBy: end }`, `hasKind`/`hasDescendantKind` → `has: { kind: ... }`, `follows` → `follows: { pattern: ... }`, `precedes` → `precedes: { pattern: ... }`.
+
 ## When to Use
 
 - Function calls, imports, class methods (structured code)

package/skills/pi-lens-lsp-navigation/SKILL.md

@@ -7,6 +7,13 @@ description: Navigate code with IDE features and run proactive LSP diagnostics o
 
 Use `lsp_navigation` as **PRIMARY** for code intelligence. Use `lens_diagnostics` with `source=lsp` as **PRIMARY** for proactive type/error checks. Do NOT use grep/glob/ast-grep first for code intelligence.
 
+## Aggregate-tool hosts
+
+Some hosts expose pi-lens through a single aggregate tool — `lens(action=...)` — instead of registering the standalone names below. On those hosts:
+
+- Proactive checks: `lens({ action: "lsp_diagnostics", ... })` — same parameters as the table below; the cached-report entry point maps to `lens({ action: "diagnostics", ... })`.
+- If `lsp_navigation` is not among the aggregate's actions, do not call the standalone name: use the host's structural search funnel (`symbol_search` → `module_report` → `read_symbol`) or the `ast-grep` CLI for navigation instead.
+
 ## Diagnostics
 
 Use `lens_diagnostics` with `source=lsp` before builds/tests or after touching several files: