Skip to content

astkit v0.16.10: audit fixes (call columns, Validate, .mts/.cts) - #14

Merged
tabladrum merged 3 commits into
mainfrom
release/v0.16.10
Oct 21, 2026
Merged

tabladrum merged 3 commits into
mainfrom
release/v0.16.10

Conversation

@tabladrum

Copy link
Copy Markdown
Contributor

Fixes three findings from the 2026-10-20 stack audit (prism docs/research/stack-audit-2026-10-20/REPORT.md):

GOWORK=off go test ./... and go vet ./... green.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Ai1qs5rPZ1cXyu74s4cdB

tabladrum and others added 3 commits October 20, 2026 21:18
…ed one

fillCallColumns finds a call name in the masked text (comments and strings
blanked byte for byte), then counted runes in the masked prefix. Masking
turns a multibyte character into several ASCII blanks, so an "é" in a
string before a call moved the column right by one (Go 22 vs 21, TS 32 vs
31, Python 20 vs 19), and an emoji by three.

The match still runs on the masked line; the column now counts characters
in the original line at the same byte offset. If masking ever changes a
line's byte length, the masked line is used as before.

Fixtures: multibyte strings, rune literals, comments, identifiers and
non-BMP characters before calls, and repeated calls on one line, in Go,
TypeScript and Python (stack audit 2026-10-20, finding 9).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Validate parsed and discarded the tree, returning only the parse error.
Tree-sitter recovers from bad input, so broken source ("func broken( {")
validated as nil. Validate now returns an error wrapping the new ErrSyntax
sentinel, naming the first ERROR/MISSING node's 1-based line:column, when
RootNode().HasError() is true. Non-AST languages (no tree) still validate.

Compatibility: no consumer relies on the old behavior. Searching grove,
prism, mason, fuse and shale (and every Go file importing astkit) for
.Validate( finds only shale's own store.Validate (unrelated type) and
astkit's own tests. Parse is unchanged, so callers that want a
best-effort tree from broken source keep it.

Stack audit 2026-10-20, finding 11.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DetectLanguage returned unknown for ES-module (.mts) and CommonJS (.cts)
TypeScript files, while Grove's parser maps both to typescript. They now
detect as LangTypeScript (case-insensitive, including .d.mts). .mjs and
.cjs already detect as JavaScript, matching Grove.

Stack audit 2026-10-20, finding 12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@tabladrum
tabladrum merged commit bba57c7 into main Oct 21, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant