attocode-code-intel 0.1.0__py3-none-any.whl

attocode_intel/rules/packs/examples/php/rules/security.yaml

@@ -0,0 +1,66 @@
+# PHP security rules (Tier 1 regex).
+
+- id: php-md5-deprecated
+  name: md5() used for security purposes
+  pattern: '\bmd5\s*\('
+  message: "md5() is broken for security — use password_hash() or hash('sha256', ...)"
+  severity: medium
+  category: security
+  languages: [php]
+  cwe: CWE-327
+  confidence: 0.6
+  recommendation: "Use password_hash($pw, PASSWORD_BCRYPT) for passwords, hash('sha256', ...) for general hashing."
+
+- id: php-mysql-real-escape-string-only
+  name: mysql_real_escape_string as sole defense
+  pattern: '\bmysql_real_escape_string\s*\('
+  message: "mysql_* extension is removed in PHP 7+ — use PDO with parameterized queries"
+  severity: high
+  category: security
+  languages: [php]
+  cwe: CWE-89
+  confidence: 0.85
+  recommendation: "Migrate to PDO::prepare with bindParam, or mysqli prepared statements."
+
+- id: php-superglobal-direct-output
+  name: $_GET / $_POST echoed directly
+  pattern: 'echo\s+\$_(?:GET|POST|REQUEST|COOKIE)'
+  message: "Echoing user input directly — XSS risk; escape with htmlspecialchars()"
+  severity: high
+  category: security
+  languages: [php]
+  cwe: CWE-79
+  confidence: 0.8
+  recommendation: "Wrap in htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before echoing."
+
+- id: php-include-variable
+  name: include with a variable path
+  pattern: '\b(?:include|require)(?:_once)?\s*\(\s*\$'
+  message: "include/require with variable path — risk of LFI/RFI if attacker controls the path"
+  severity: high
+  category: security
+  languages: [php]
+  cwe: CWE-98
+  confidence: 0.6
+  recommendation: "Whitelist allowed paths, or build the path from an allowlist of identifiers."
+
+- id: php-error-reporting-display
+  name: display_errors enabled
+  pattern: "display_errors[^=]*=\\s*['\"]?(?:1|on|true)"
+  message: "display_errors leaks stack traces and paths to users in production"
+  severity: medium
+  category: security
+  languages: [php]
+  cwe: CWE-209
+  confidence: 0.7
+  recommendation: "Set display_errors = Off in production; log errors to a file instead."
+
+- id: php-suppress-error
+  name: Error suppression operator
+  pattern: '@\w'
+  message: "@ suppresses errors silently — fix the underlying issue or handle it explicitly"
+  severity: low
+  category: suspicious
+  languages: [php]
+  confidence: 0.5
+  recommendation: "Use try/catch or check the precondition; @ hides bugs."

attocode_intel/rules/packs/examples/php/rules/structural.yaml

@@ -0,0 +1,41 @@
+# PHP structural patterns (ast-grep, Tier 2).
+
+- id: php-var-dump-debug
+  name: var_dump debug leftover
+  structural_pattern: 'var_dump($X)'
+  message: "var_dump($X) — debug leftover, remove before commit"
+  severity: low
+  category: style
+  languages: [php]
+  confidence: 0.85
+  tags: [debug]
+  explanation: >
+    ``var_dump`` writes raw debug output to the current output stream,
+    typically into the page response in web contexts. Often committed
+    accidentally during local debugging.
+  recommendation: "Remove the var_dump or route through your logger."
+
+- id: php-print-r-debug
+  name: print_r debug leftover
+  structural_pattern: 'print_r($X)'
+  message: "print_r($X) — debug leftover, remove before commit"
+  severity: low
+  category: style
+  languages: [php]
+  confidence: 0.7
+  tags: [debug]
+  recommendation: "Remove the print_r or route through your logger."
+
+- id: php-die-with-message
+  name: die() / exit() with debug message
+  structural_pattern: 'die($X)'
+  message: "die($X) — terminates request, often a debug statement that escaped"
+  severity: medium
+  category: suspicious
+  languages: [php]
+  confidence: 0.5
+  explanation: >
+    ``die`` and ``exit`` halt the current request with the given output.
+    Useful in error handlers and CLI scripts; often a leftover debug
+    statement when found mid-handler.
+  recommendation: "Throw an exception so the framework can render an error page."

attocode_intel/rules/packs/examples/python/manifest.yaml

@@ -0,0 +1,4 @@
+name: python
+version: 1.0.0
+languages: [python]
+description: "Python analysis pack — performance patterns, correctness, idioms"

attocode_intel/rules/packs/examples/python/rules/performance.yaml

@@ -0,0 +1,90 @@
+# Python performance antipatterns
+
+- id: py-string-concat-loop
+  name: String concatenation in loop
+  pattern: '\w+\s*\+=\s*[''"]'
+  message: "String concatenation in loop creates N intermediate strings"
+  severity: low
+  category: performance
+  languages: [python]
+  confidence: 0.5
+  explanation: >
+    Python strings are immutable. Concatenation with += creates a new string
+    object each iteration, copying all previous content. For N iterations,
+    this is O(N^2) total characters copied.
+  recommendation: "Collect into a list and use ''.join(parts) at the end"
+  examples:
+    - bad: "result = ''\nfor item in items:\n    result += str(item)"
+      good: "result = ''.join(str(item) for item in items)"
+      explanation: "join() pre-calculates total size and copies once"
+
+- id: py-mutable-default-arg
+  name: Mutable default argument
+  pattern: 'def\s+\w+\s*\([^)]*(?:=\s*\[\]|=\s*\{\}|=\s*set\(\))'
+  message: "Mutable default argument — shared across all calls"
+  severity: medium
+  category: correctness
+  languages: [python]
+  confidence: 0.85
+  explanation: >
+    Default mutable arguments (list, dict, set) are evaluated once at function
+    definition time, not at each call. All calls that use the default share the
+    same object, leading to surprising mutation bugs.
+  recommendation: "Use None as default and create inside function: if arg is None: arg = []"
+  examples:
+    - bad: "def add(item, items=[]):\n    items.append(item)\n    return items"
+      good: "def add(item, items=None):\n    if items is None:\n        items = []\n    items.append(item)\n    return items"
+
+- id: py-dict-keys-iteration
+  name: Iterating dict.keys() unnecessarily
+  pattern: 'for\s+\w+\s+in\s+\w+\.keys\(\)\s*:'
+  message: "Iterating .keys() is redundant — iterate the dict directly"
+  severity: info
+  category: style
+  languages: [python]
+  confidence: 0.9
+  recommendation: "Use 'for key in my_dict:' instead of 'for key in my_dict.keys():'"
+  examples:
+    - bad: "for key in config.keys():"
+      good: "for key in config:"
+
+- id: py-isinstance-chain
+  name: Long isinstance chain
+  pattern: 'isinstance\s*\([^)]+\)\s*(?:and|or)\s*isinstance'
+  message: "Chained isinstance calls — consider match/case or dict dispatch"
+  severity: low
+  category: complexity
+  languages: [python]
+  confidence: 0.6
+  explanation: >
+    Long isinstance chains are hard to read and maintain. Python 3.10+
+    match/case provides cleaner structural pattern matching, or use a
+    dispatch dict for handler routing.
+  recommendation: "Use match/case (3.10+) or a type->handler dict"
+
+- id: py-global-import-in-function
+  name: Import inside function
+  pattern: '^\s{4,}import\s+\w+'
+  message: "Import inside function — runs on every call (acceptable for optional deps)"
+  severity: info
+  category: performance
+  languages: [python]
+  confidence: 0.4
+  recommendation: "Move to top of file unless it's intentionally lazy for optional dependencies"
+
+- id: py-bare-except
+  name: Bare except clause
+  pattern: 'except\s*:'
+  message: "Bare except catches SystemExit, KeyboardInterrupt — too broad"
+  severity: medium
+  category: correctness
+  languages: [python]
+  confidence: 0.9
+  explanation: >
+    A bare 'except:' clause catches everything including SystemExit (sys.exit)
+    and KeyboardInterrupt (Ctrl+C), making it impossible to stop the program
+    normally.
+  recommendation: "Use 'except Exception:' to exclude system-level exceptions"
+  examples:
+    - bad: "try:\n    risky()\nexcept:\n    pass"
+      good: "try:\n    risky()\nexcept Exception as e:\n    logger.error(e)"

attocode_intel/rules/packs/examples/python/rules/structural.yaml

@@ -0,0 +1,55 @@
+# Python structural patterns (ast-grep, Tier 2).
+#
+# These complement the regex-based rules in ``performance.yaml`` —
+# patterns that are awkward or imprecise as regex but trivial as AST.
+
+- id: py-debug-print-leftover
+  name: Debug print left in source
+  structural_pattern: 'print($X)'
+  message: "Debug print($X) left in source — remove before commit or switch to logger"
+  severity: low
+  category: style
+  languages: [python]
+  confidence: 0.35
+  tags: [debug]
+  explanation: >
+    A bare ``print()`` is fine in scripts and CLI tools but usually
+    indicates a debug statement when found inside libraries or service
+    code. Easy to leave behind during quick iteration.
+  recommendation: "Remove the print or replace with logging.debug/info"
+  examples:
+    - bad: "def handle(req):\n    print(req)\n    return process(req)"
+      good: "logger.debug('handling %s', req)"
+      explanation: "Use the standard logging module so verbosity can be controlled at deploy time."
+
+- id: py-assert-in-non-test
+  name: Plain assert outside tests
+  structural_pattern: 'assert $X'
+  message: "assert $X — stripped when Python runs with -O; use explicit checks in production"
+  severity: medium
+  category: correctness
+  languages: [python]
+  confidence: 0.5
+  explanation: >
+    ``assert`` is removed when the interpreter runs with ``-O``. Tests
+    and dev-time invariants are fine; production code paths that rely
+    on the check (input validation, postconditions) silently lose their
+    guard.
+  recommendation: "Raise an explicit exception (ValueError, AssertionError) instead of assert."
+
+- id: py-blocking-sleep
+  name: Blocking time.sleep call
+  structural_pattern: 'time.sleep($X)'
+  message: "time.sleep($X) blocks the thread — wrong inside async code or hot loops"
+  severity: low
+  category: performance
+  languages: [python]
+  confidence: 0.5
+  explanation: >
+    ``time.sleep`` blocks the thread. Inside ``async def`` functions
+    use ``await asyncio.sleep`` instead so the event loop can do work.
+  recommendation: "Use asyncio.sleep in async code; reserve time.sleep for sync scripts and tests."
+  examples:
+    - bad: "async def poll():\n    time.sleep(1)"
+      good: "async def poll():\n    await asyncio.sleep(1)"
+      explanation: "Frees the event loop while waiting."

attocode_intel/rules/packs/examples/ruby/manifest.yaml

@@ -0,0 +1,4 @@
+name: ruby
+version: 1.0.0
+languages: [ruby]
+description: "Ruby analysis pack — Rails/AR pitfalls, dynamic-eval risks, idiomatic style"

attocode_intel/rules/packs/examples/ruby/rules/security.yaml

@@ -0,0 +1,73 @@
+# Ruby security and correctness rules (Tier 1 regex).
+
+- id: ruby-yaml-load-untrusted
+  name: YAML.load on untrusted input
+  pattern: '\bYAML\.load\b'
+  message: "YAML.load can deserialize arbitrary objects — use YAML.safe_load instead"
+  severity: high
+  category: security
+  languages: [ruby]
+  cwe: CWE-502
+  confidence: 0.85
+  explanation: >
+    ``YAML.load`` instantiates whatever Ruby classes appear in the
+    document, allowing attackers to construct objects with side effects
+    or to gain code execution via gadget chains.
+  recommendation: "Use YAML.safe_load(data) — restricts to a small set of safe types."
+
+- id: ruby-marshal-load-untrusted
+  name: Marshal.load on untrusted input
+  pattern: '\bMarshal\.load\b'
+  message: "Marshal.load deserializes arbitrary Ruby objects — never call on untrusted input"
+  severity: critical
+  category: security
+  languages: [ruby]
+  cwe: CWE-502
+  confidence: 0.9
+  recommendation: "Use a structured format (JSON, MessagePack) for untrusted data."
+
+- id: ruby-send-with-user-input
+  name: .send/.public_send with non-literal method name
+  pattern: '\.(?:public_)?send\s*\(\s*[^"'']'
+  message: "send with dynamic method name — risk of invoking arbitrary methods"
+  severity: medium
+  category: security
+  languages: [ruby]
+  cwe: CWE-470
+  confidence: 0.5
+  recommendation: "Whitelist allowed method names, or refactor to explicit dispatch."
+
+- id: ruby-where-string-interpolation
+  name: ActiveRecord .where with string interpolation
+  pattern: '\.where\s*\(\s*["''][^"'']*#\{'
+  message: ".where(\"...#{var}...\") — SQL injection risk; use placeholders"
+  severity: high
+  category: security
+  languages: [ruby]
+  cwe: CWE-89
+  confidence: 0.85
+  recommendation: "Use .where(\"col = ?\", value) or .where(col: value) to parameterize."
+  examples:
+    - bad: 'User.where("name = #{params[:name]}")'
+      good: 'User.where("name = ?", params[:name])'
+      explanation: "Placeholder syntax escapes the value through ActiveRecord."
+
+- id: ruby-rescue-bare
+  name: Bare rescue catches everything
+  pattern: '^\s*rescue\s*(?:=>|\n|$)'
+  message: "Bare rescue catches StandardError and below — usually too broad"
+  severity: medium
+  category: correctness
+  languages: [ruby]
+  confidence: 0.55
+  recommendation: "Catch specific exception classes (rescue Net::HTTPError => e)."
+
+- id: ruby-update-without-bang
+  name: ActiveRecord .update return value ignored
+  pattern: '\.(?:update|save)(?:\([^)]*\))?\s*$'
+  message: ".update / .save without ! returns false on failure — check the result or use the bang variant"
+  severity: low
+  category: correctness
+  languages: [ruby]
+  confidence: 0.4
+  recommendation: "Use .update! / .save! to raise on failure, or check the return value."

attocode_intel/rules/packs/examples/ruby/rules/structural.yaml

@@ -0,0 +1,41 @@
+# Ruby structural patterns (ast-grep, Tier 2).
+
+- id: ruby-puts-debug
+  name: puts debug leftover
+  structural_pattern: 'puts $X'
+  message: "puts $X — debug leftover, use Rails.logger.debug or remove"
+  severity: low
+  category: style
+  languages: [ruby]
+  confidence: 0.35
+  tags: [debug]
+  explanation: >
+    Bare ``puts`` writes to stdout with no level filtering. In Rails
+    apps prefer ``Rails.logger.debug`` so output respects the configured
+    log level and is captured in production logs.
+  recommendation: "Use Rails.logger.debug \"...\" or remove if it was a debug aid."
+
+- id: ruby-pp-debug
+  name: pp / p debug leftover
+  structural_pattern: 'pp $X'
+  message: "pp $X — pretty-print debug leftover, remove before commit"
+  severity: low
+  category: style
+  languages: [ruby]
+  confidence: 0.7
+  tags: [debug]
+  recommendation: "Remove the pp call or route through Rails.logger.debug."
+
+- id: ruby-binding-pry
+  name: binding.pry / debugger left in code
+  structural_pattern: 'binding.pry'
+  message: "binding.pry — interactive debugger left in code; will hang in production"
+  severity: high
+  category: correctness
+  languages: [ruby]
+  confidence: 0.95
+  tags: [debug]
+  explanation: >
+    ``binding.pry`` opens an interactive REPL. In production this hangs
+    the request waiting for stdin. Should never be committed.
+  recommendation: "Remove the binding.pry call before committing."

attocode_intel/rules/packs/examples/rust/manifest.yaml

@@ -0,0 +1,4 @@
+name: rust
+version: 1.0.0
+languages: [rust]
+description: "Rust analysis pack — correctness, performance, idiomatic Rust patterns"

attocode_intel/rules/packs/examples/rust/rules/correctness.yaml

@@ -0,0 +1,51 @@
+# Rust correctness and performance patterns
+
+- id: rs-unwrap-usage
+  name: Unwrap without context
+  pattern: '\.unwrap\(\)'
+  message: "unwrap() panics on None/Err — use expect() or proper error handling"
+  severity: medium
+  category: correctness
+  languages: [rust]
+  confidence: 0.7
+  explanation: >
+    unwrap() provides no context on panic. In production code, use
+    expect("reason") for intentional panics or ? for propagation.
+  recommendation: "Use .expect('context') or the ? operator"
+  examples:
+    - bad: "let value = result.unwrap();"
+      good: 'let value = result.expect("config must be valid");'
+
+- id: rs-clone-in-loop
+  name: Clone in hot loop
+  pattern: '\.clone\(\)'
+  message: "clone() in potential hot path — deep copy may be expensive"
+  severity: low
+  category: performance
+  languages: [rust]
+  confidence: 0.4
+  recommendation: "Use references or Cow<T> to avoid unnecessary cloning"
+
+- id: rs-todo-macro
+  name: todo!() macro left in code
+  pattern: 'todo!\s*\('
+  message: "todo!() panics at runtime — unfinished implementation"
+  severity: high
+  category: correctness
+  languages: [rust]
+  confidence: 0.95
+  recommendation: "Implement the missing functionality or use unimplemented!() with a tracking issue"
+
+- id: rs-unsafe-block
+  name: Unsafe block usage
+  pattern: 'unsafe\s*\{'
+  message: "unsafe block — verify memory safety invariants"
+  severity: medium
+  category: security
+  languages: [rust]
+  confidence: 0.8
+  cwe: CWE-119
+  explanation: >
+    Unsafe blocks disable Rust's borrow checker guarantees. Every unsafe
+    block should have a SAFETY comment explaining why it's correct.
+  recommendation: "Add a // SAFETY: comment and consider safe alternatives"

attocode_intel/rules/packs/examples/rust/rules/structural.yaml

@@ -0,0 +1,49 @@
+# Rust structural patterns (ast-grep, Tier 2).
+#
+# IDs picked to avoid collision with the regex rules in
+# ``correctness.yaml`` (rs-unwrap-usage, rs-todo-macro). These are
+# precision-better restatements via the AST.
+
+- id: rs-expect-call
+  name: .expect() with hardcoded message
+  structural_pattern: '$X.expect($MSG)'
+  message: ".expect($MSG) on $X panics on None/Err — make sure $MSG is informative"
+  severity: low
+  category: correctness
+  languages: [rust]
+  confidence: 0.4
+  explanation: >
+    ``.expect("…")`` is preferable to ``.unwrap()`` because the message
+    surfaces the violated invariant. This rule flags every use so you
+    can audit whether the message actually helps debugging — terse
+    placeholders ("oops", "fail") are worse than nothing.
+  recommendation: "Make the expect message describe the precondition that should hold."
+
+- id: rs-debug-println
+  name: Debug println! left in source
+  structural_pattern: 'println!($X)'
+  message: "println!($X) left in source — switch to log/tracing or remove"
+  severity: low
+  category: style
+  languages: [rust]
+  confidence: 0.35
+  tags: [debug]
+  explanation: >
+    ``println!`` writes straight to stdout and is unfilterable. Use
+    ``log::info!`` or ``tracing::info!`` so output respects log levels
+    and structured logging.
+  recommendation: "Use tracing::info! / log::info! macros (or remove if it was a debug aid)."
+
+- id: rs-dbg-macro
+  name: dbg!() macro left in source
+  structural_pattern: 'dbg!($X)'
+  message: "dbg!($X) — debug macro that prints to stderr, remove before commit"
+  severity: low
+  category: style
+  languages: [rust]
+  confidence: 0.85
+  tags: [debug]
+  explanation: >
+    ``dbg!`` is a debug aid that prints the file/line and value to stderr.
+    Convenient during local iteration; should not survive into mainline.
+  recommendation: "Remove the dbg! macro before committing."

attocode_intel/rules/packs/examples/typescript/manifest.yaml

@@ -0,0 +1,4 @@
+name: typescript
+version: 1.0.0
+languages: [typescript, javascript]
+description: "TypeScript/JavaScript analysis pack — performance, correctness, security"

attocode_intel/rules/packs/examples/typescript/rules/performance.yaml

@@ -0,0 +1,70 @@
+# TypeScript/JavaScript performance and correctness patterns
+
+- id: ts-await-in-loop
+  name: Sequential await in loop
+  pattern: '^\s+(?:const|let|var)\s+\w+\s*=\s*await\s'
+  message: "Possible sequential await in loop — requests may execute one at a time"
+  severity: medium
+  category: performance
+  languages: [typescript, javascript]
+  confidence: 0.55
+  explanation: >
+    Using await inside a for loop makes each iteration wait for the previous
+    one to complete. If the operations are independent, they can run in
+    parallel with Promise.all(), potentially reducing total time by N×.
+  recommendation: "Collect promises and use Promise.all() for independent operations"
+  examples:
+    - bad: "for (const id of ids) {\n  const data = await fetch(id);\n}"
+      good: "const results = await Promise.all(ids.map(id => fetch(id)));"
+      explanation: "Promise.all runs all fetches concurrently"
+
+- id: ts-no-optional-chain
+  name: Nested null checks instead of optional chaining
+  pattern: '(\w+)\s*&&\s*\1\.\w+\s*&&\s*\1\.\w+\.\w+'
+  message: "Nested && null checks — use optional chaining (?.)"
+  severity: info
+  category: style
+  languages: [typescript, javascript]
+  confidence: 0.7
+  recommendation: "Use optional chaining: obj?.prop?.nested"
+  examples:
+    - bad: "if (user && user.address && user.address.city)"
+      good: "if (user?.address?.city)"
+
+- id: ts-array-push-spread
+  name: Array.push with spread in loop
+  pattern: '\.push\(\.\.\.'
+  message: "Array.push(...spread) can hit call stack limit for large arrays"
+  severity: medium
+  category: correctness
+  languages: [typescript, javascript]
+  confidence: 0.7
+  explanation: >
+    Array.push(...largeArray) passes each element as a function argument.
+    JavaScript engines have a maximum argument count (~65k-130k), so this
+    throws RangeError for large arrays.
+  recommendation: "Use Array.prototype.push.apply() or concat()"
+  examples:
+    - bad: "result.push(...bigArray)"
+      good: "for (const item of bigArray) result.push(item)"
+
+- id: ts-console-log
+  name: console.log in production code
+  pattern: 'console\.log\s*\('
+  message: "console.log left in code — use proper logging or remove"
+  severity: info
+  category: style
+  languages: [typescript, javascript]
+  confidence: 0.35
+  tags: [debug]
+  recommendation: "Use a structured logger or remove debug statements"
+
+- id: ts-any-type
+  name: TypeScript any type usage
+  pattern: ':\s*any\b'
+  message: "Explicit 'any' type — loses type safety"
+  severity: low
+  category: style
+  languages: [typescript]
+  confidence: 0.6
+  recommendation: "Use specific types, unknown, or generics instead of any"

attocode_intel/rules/packs/examples/typescript/rules/structural.yaml

@@ -0,0 +1,48 @@
+# TypeScript structural patterns (ast-grep, Tier 2).
+
+- id: ts-console-log-leftover
+  name: console.log left in source
+  structural_pattern: 'console.log($X)'
+  message: "console.log($X) left in source — remove or route through a logger"
+  severity: low
+  category: style
+  languages: [typescript, javascript]
+  confidence: 0.35
+  tags: [debug]
+  explanation: >
+    Bare ``console.log`` survives into production builds, leaks
+    information into the browser console, and bypasses any logging
+    pipeline. Use a structured logger or remove the line.
+  recommendation: "Use the project's logger; for browser code prefer console.debug behind a flag."
+  examples:
+    - bad: "function handle(req) { console.log(req); return process(req); }"
+      good: "logger.debug({ req }, 'handle');"
+      explanation: "Structured loggers support levels and shipping."
+
+- id: ts-non-null-assertion
+  name: Non-null assertion operator
+  structural_pattern: '$X!'
+  message: "Non-null assertion ($X!) bypasses the type checker — prove the invariant or guard explicitly"
+  severity: low
+  category: suspicious
+  languages: [typescript]
+  confidence: 0.4
+  explanation: >
+    The ``!`` operator silences the compiler without checking. When the
+    value is null at runtime you get an unhelpful TypeError. Either
+    refactor so the type narrows naturally, or add an explicit guard.
+  recommendation: "Use a runtime check (if (!x) throw …) or refactor the type."
+
+- id: ts-set-timeout-zero
+  name: setTimeout($X, 0) workaround
+  structural_pattern: 'setTimeout($X, 0)'
+  message: "setTimeout($X, 0) is a microtask hack — queueMicrotask is clearer intent"
+  severity: info
+  category: style
+  languages: [typescript, javascript]
+  confidence: 0.6
+  explanation: >
+    ``setTimeout(fn, 0)`` defers ``fn`` until after the current macro
+    task. ``queueMicrotask(fn)`` schedules sooner (after the current
+    sync code) and signals intent without the magic ``0``.
+  recommendation: "Use queueMicrotask(fn) when you want to defer until after sync work."