4 Commits

Author SHA1 Message Date
Dragan Spiridonov 2086bafa6b feat(parsers): add web-tree-sitter WASM for Python, Java, C#, Rust, Swift (#323)
Integrate tree-sitter WASM as the default parser for 5 languages, replacing
regex-only parsing (~97-98%) with AST-based parsing (~100% accuracy).

- Add TreeSitterWASMParser implementing ILanguageParser for 5 languages
- Bundle only needed WASM grammars in assets/grammars/ (8.5MB vs 50MB)
- Add FallbackParser with 3-retry logic before permanent regex degradation
- Add per-call parser instances to prevent concurrency races across await
- Add cyclomatic complexity computation from AST branching nodes
- Add property extraction from class/struct AST nodes
- Add AQE_PARSER_REGEX_ONLY=1 env var for opt-out to regex
- Replace require() with ESM-compatible dynamic import() in registry
- Mark web-tree-sitter as external in CLI/MCP esbuild configs
- Amend ADR-076 with decision rationale and alternatives evaluated

Alternatives evaluated and rejected:
- @ast-grep/napi: npm package only ships JS/TS/CSS/HTML, others need native .so
- node-tree-sitter: requires native C compilation via node-gyp

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 12:43:14 +00:00
Dragan Spiridonov fc1e86ad2d fix(security): resolve P0/P1 issues from v3.8.3 QE swarm analysis
P0 fixes:
- Fix command injection (CWE-78) in test-verifier.ts: replace exec()
  with execFile() + ALLOWED_TEST_COMMANDS allowlist
- Unify SQL allowlists: add 5 missing tables to sql-safety.ts, replace
  local duplicate in unified-memory.ts with canonical validateTableName()
- Add validateTableName() to all 7 SQL interpolation sites in
  ruvector/brain-shared.ts

P1 fixes:
- Remove 70 process.exit() calls from learning.ts (45) and hooks.ts (25),
  replacing with return/throw for proper cleanup handler execution
- Move @faker-js/faker from dependencies to devDependencies (~8MB savings)
- Enable bundle minification: CLI 9.8→6.9MB (-30%), MCP 12→7.2MB (-40%)
- Fix no-op verification scripts to perform real checks with non-zero
  exit codes on failure

QE reports:
- Add 12 comprehensive QE analysis reports for v3.8.3 covering code
  quality, security, performance, tests, SFDIPOT, dependencies, API
  contracts, architecture/DDD, accessibility, and brutal honesty audit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 13:53:54 +00:00
Profa 9f5b3b49bf fix: lazy-load typescript to prevent CLI crash on global install
TypeScript was an external ESM dependency loaded at bundle startup,
crashing `aqe --version` when typescript isn't installed (global
installs). Now lazy-loaded via createRequire Proxy — only triggers
when AST parsing features are used.

Also adds isolated install verification to /release skill (steps 8e
and 15) to catch missing externals before they reach users.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 15:28:26 +00:00
Profa c0ba2b4d86 fix: rename scripts to .cjs/.mjs for ESM compatibility
package.json has "type": "module" so .js files are treated as ESM.
Scripts using require() renamed to .cjs, scripts using import to .mjs.
Fixes Test Dashboard CI failure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-01 16:58:50 +00:00