pi-lens 4.3.0 → 4.4.0

package/dist/clients/dispatch/rules/unsafe-boundary.js

@@ -1,126 +0,0 @@
-/**
- * Flags async functions that call IO/network/DB boundaries but have no
- * try/catch protection AND have non-trivial complexity.
- *
- * Rationale: boundary wrappers with high CC and no error handling are the
- * most common source of unhandled-rejection crashes and silent data loss.
- * Simple pass-throughs are excluded — they're expected to propagate errors.
- */
-// Entries ending with '.' are namespace prefixes (startsWith match).
-// All other entries are exact callee names — prevents e.g. "spawn" matching "spawned.map"
-// or "fetch" matching "fetchWithRetry".
-const IO_NAMESPACE_PREFIXES = [
-    "db.",
-    "prisma.",
-    "knex.",
-    "mongoose.",
-    "sequelize.",
-    "http.",
-    "https.",
-    "net.",
-    "dns.",
-    "redis.",
-    "mongo.",
-    "pg.",
-    "mysql.",
-    "s3.",
-    "storage.",
-    "bucket.",
-    "fs.promises.",
-];
-const IO_EXACT_CALLEES = new Set([
-    "fetch",
-    "axios",
-    "got",
-    "request",
-    "spawn",
-    "exec",
-    "execSync",
-    "spawnSync",
-    "readFile",
-    "writeFile",
-    "appendFile",
-    "readdir",
-    "mkdir",
-    "unlink",
-    "stat",
-]);
-const CC_THRESHOLD = 6; // raised from 4 — avoids flagging simple async wrappers with one IO call
-function callsToBoundary(outgoingCalls) {
-    for (const callee of outgoingCalls) {
-        const lower = callee.toLowerCase();
-        if (IO_EXACT_CALLEES.has(lower))
-            return callee;
-        if (IO_NAMESPACE_PREFIXES.some((p) => lower.startsWith(p)))
-            return callee;
-    }
-    return undefined;
-}
-function hasCatchCoverage(fn, catches) {
-    // A catch block is considered covering if it is non-empty and does one of:
-    // - rethrows the error
-    // - logs it (console.error / logger.*)
-    // - has no binding (catch {} — intentional swallow)
-    // - returns a structured value (return { ... } / return false / return null)
-    //   This handles the common "return structured error" pattern in IO helpers.
-    // Also handles Promise-executor pattern: if the function body itself resolves/rejects
-    // via new Promise((resolve) => {...}) we treat it as covered at the call site.
-    if (fn.outgoingCalls.some((c) => c === "resolve" || c === "reject"))
-        return true;
-    return catches.some((c) => {
-        if (c.line < fn.line)
-            return false;
-        if (c.isEmpty)
-            return false;
-        if (c.hasRethrow || c.hasLogging || c.catchParam === null)
-            return true;
-        // Catch body contains a return statement → structured error result
-        if (/\breturn\b/.test(c.bodyText))
-            return true;
-        // Catch body falls back by mutating existing state (e.g. extending a
-        // validity window on refresh failure) instead of rethrowing/logging/
-        // returning. That's still a real handler — the exception doesn't
-        // escape uncaught — just expressed via assignment rather than one of
-        // the three shapes above (#969).
-        if (c.catchHasFallbackAssignment)
-            return true;
-        return false;
-    });
-}
-export const unsafeBoundaryRule = {
-    id: "unsafe-boundary",
-    requires: ["file.functionSummaries", "file.tryCatchSummaries"],
-    appliesTo(ctx) {
-        return /\.tsx?$/.test(ctx.filePath);
-    },
-    evaluate(ctx, store) {
-        const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
-        const catches = store.getFileFact(ctx.filePath, "file.tryCatchSummaries") ?? [];
-        const diagnostics = [];
-        for (const f of fns) {
-            if (!f.isAsync)
-                continue;
-            if (f.isPassThroughWrapper)
-                continue; // expected to propagate
-            if (f.cyclomaticComplexity < CC_THRESHOLD)
-                continue;
-            const boundaryCalle = callsToBoundary(f.outgoingCalls);
-            if (!boundaryCalle)
-                continue;
-            if (hasCatchCoverage(f, catches))
-                continue;
-            diagnostics.push({
-                id: `unsafe-boundary:${ctx.filePath}:${f.line}`,
-                tool: "fact-rules",
-                rule: "unsafe-boundary",
-                filePath: ctx.filePath,
-                line: f.line,
-                column: f.column,
-                severity: "warning",
-                semantic: "warning",
-                message: `'${f.name}' is async, calls '${boundaryCalle}', has complexity ${f.cyclomaticComplexity}, but no try/catch — unhandled rejection risk`,
-            });
-        }
-        return diagnostics;
-    },
-};

package/dist/clients/dispatch/runner-context.js

@@ -1,52 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { normalizeMapKey } from "../path-utils.js";
-function resolveAgainstAncestors(cwd, filePath) {
-    if (path.isAbsolute(filePath)) {
-        return path.resolve(filePath);
-    }
-    const normalizedRelative = filePath.replace(/\\/g, "/");
-    const cwdBaseName = path.basename(path.resolve(cwd)).replace(/\\/g, "/");
-    if (cwdBaseName &&
-        (normalizedRelative === cwdBaseName ||
-            normalizedRelative.startsWith(`${cwdBaseName}/`))) {
-        const trimmedRelative = normalizedRelative === cwdBaseName
-            ? ""
-            : normalizedRelative.slice(cwdBaseName.length + 1);
-        const trimmedCandidate = trimmedRelative
-            ? path.resolve(cwd, trimmedRelative)
-            : path.resolve(cwd);
-        if (fs.existsSync(trimmedCandidate)) {
-            return trimmedCandidate;
-        }
-    }
-    const directCandidate = path.resolve(cwd, filePath);
-    if (fs.existsSync(directCandidate)) {
-        return directCandidate;
-    }
-    let current = path.resolve(cwd);
-    const { root } = path.parse(current);
-    while (current !== root) {
-        const parent = path.dirname(current);
-        if (parent === current)
-            break;
-        const candidate = path.resolve(parent, filePath);
-        if (fs.existsSync(candidate)) {
-            return candidate;
-        }
-        current = parent;
-    }
-    return directCandidate;
-}
-export function resolveRunnerPath(cwd, filePath) {
-    return normalizeMapKey(resolveAgainstAncestors(cwd, filePath));
-}
-export function toRunnerDisplayPath(cwd, filePath) {
-    const cwdKey = normalizeMapKey(path.resolve(cwd));
-    const fileKey = resolveRunnerPath(cwd, filePath);
-    const relative = path.relative(cwdKey, fileKey).replace(/\\/g, "/");
-    if (relative && relative !== "." && !relative.startsWith("../")) {
-        return relative;
-    }
-    return fileKey;
-}

package/dist/clients/dispatch/runners/actionlint.js

@@ -1,111 +0,0 @@
-import path from "node:path";
-import { pathsEqual } from "../../path-utils.js";
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
-import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
-const actionlint = createAvailabilityChecker("actionlint", ".exe");
-export function isGitHubWorkflowFile(filePath) {
-    const normalized = filePath.replace(/\\/g, "/");
-    return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(normalized);
-}
-function toDiagnostic(issue, filePath) {
-    const line = issue.line && issue.line > 0 ? issue.line : 1;
-    const column = issue.column && issue.column > 0 ? issue.column : 1;
-    const rule = issue.kind || "actionlint";
-    const message = issue.message || "GitHub Actions workflow issue";
-    const idMessage = message
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, "-")
-        .slice(0, 80);
-    return {
-        id: `actionlint-${rule}-${line}-${column}-${idMessage}`,
-        message,
-        filePath,
-        line,
-        column,
-        severity: "error",
-        semantic: "blocking",
-        tool: "actionlint",
-        rule,
-        defectClass: "correctness",
-        matchedText: issue.snippet,
-    };
-}
-export function parseActionlintJson(raw, filePath, cwd) {
-    const trimmed = raw.trim();
-    if (!trimmed)
-        return [];
-    // #3295: actionlint resolves reusable-workflow and composite-action refs, so
-    // its `filepath` is not always the workflow we asked about.
-    const absTarget = path.resolve(cwd, filePath);
-    const isTarget = (issue) => !issue.filepath || pathsEqual(path.resolve(cwd, issue.filepath), absTarget);
-    try {
-        const parsed = JSON.parse(trimmed);
-        const issues = Array.isArray(parsed) ? parsed : [parsed];
-        return issues.flatMap((issue) => isTarget(issue) ? [toDiagnostic(issue, filePath)] : []);
-    }
-    catch {
-        // Some actionlint versions or wrappers may emit one JSON object per line.
-        const diagnostics = [];
-        for (const line of trimmed.split(/\r?\n/)) {
-            if (!line.trim())
-                continue;
-            try {
-                const parsed = JSON.parse(line);
-                if (!isTarget(parsed))
-                    continue;
-                diagnostics.push(toDiagnostic(parsed, filePath));
-            }
-            catch {
-                // Ignore non-JSON chatter; the caller will synthesize a generic diagnostic
-                // if actionlint failed and no structured diagnostics were parsed.
-            }
-        }
-        return diagnostics;
-    }
-}
-const actionlintRunner = {
-    id: "actionlint",
-    appliesTo: ["yaml"],
-    priority: PRIORITY.YAML_LINT + 1,
-    skipTestFiles: false,
-    when(ctx) {
-        return isGitHubWorkflowFile(ctx.filePath);
-    },
-    async run(ctx) {
-        const cwd = resolveRunnerCwd(ctx, "actionlint");
-        let cmd = null;
-        if (await actionlint.isAvailableAsync(cwd)) {
-            cmd = actionlint.getCommand(cwd);
-        }
-        else {
-            cmd = await resolveToolCommandWithInstallFallback(cwd, "actionlint");
-        }
-        if (!cmd)
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        const relativeFilePath = path.relative(cwd, ctx.filePath) || ctx.filePath;
-        const result = await safeSpawnAsync(cmd, ["-format", "{{json .}}", relativeFilePath], {
-            cwd,
-            timeout: 15000,
-        });
-        const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-        const parsed = parseToolRun("actionlint", {
-            result,
-            output,
-            // EXIT TABLE (actionlint 1.7.7 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
-            exitCodes: { ran: [1, 2] },
-        }, (raw) => parseActionlintJson(raw, ctx.filePath, cwd));
-        if (parsed.skipped)
-            return parsed.skipped;
-        return finishParsedRun({
-            tool: "actionlint",
-            ctx,
-            result,
-            diagnostics: parsed.diagnostics,
-            classify: () => ({ status: "failed", semantic: "blocking" }),
-        });
-    },
-};
-export default actionlintRunner;