feat: POC native ast plugins#47
Merged
Houseofmvps merged 4 commits intoJun 28, 2026
Merged
Conversation
WASM plugins on the codesight per-kind ABI (contractVersion, describe, alloc/dealloc, parseRoutes/Schemas/Imports) targeting wasm32-unknown-unknown. Rust (syn): actix/Rocket/axum routes, struct schemas, diesel/sea-orm/sqlx. Python (ruff): FastAPI/Flask/Django routes, SQLAlchemy/Django/pydantic/SQLModel schemas. Shared cargo workspace; Cargo.lock committed for reproducible builds.
WASI reactor (//go:wasmexport, GOOS=wasip1 -buildmode=c-shared) on the same per-kind ABI: Gin/Echo/Fiber/Chi method routes with router-group prefixes and net/http mux (incl. Go 1.22 "VERB /p" patterns); GORM and Ent schemas.
Compiles all three plugins (cargo --locked + Go), shrinks them with wasm-opt, round-trips each through the host ABI, and publishes .wasm + SHA256SUMS on plugins-v* tags. PR runs are path-filtered to plugins/ast so JS-only changes don't trigger them.
Add a Releases section to the WASM plugin contract: the published artifacts, independent plugins-v* versioning, and download/verify/install steps.
Houseofmvps
added a commit
that referenced
this pull request
Jun 28, 2026
Ships the untrusted-describe()-metadata hardening (bfa937c) to npm. Coerces malformed plugin describe() output (non-string languageId, non-string extensions entries) instead of crashing the scan on the opt-in --native-ast path. PR #47 (native-AST plugins) added nothing to the npm tarball, so this release carries only the hardening. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Houseofmvps
pushed a commit
that referenced
this pull request
Jun 29, 2026
Docs-only sync from the-wondersmith: corrects stale counts (14 ORM parsers, 14 MCP tools, 145 tests, 30+ frameworks), rewrites native-AST WASM plugin docs to match the shipped #46/#47 language-driven dispatch + reference plugins, adds gin-gorm eval fixture row and reference-plugin describe() note. Verified: 14 MCP tools registered, 145 tests pass, gin-gorm fixture present, 14 ORMs in source. No code/dependency changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR is the final piece of the #44 → #45 → #46 native-AST plugin PR stack.
PR adds canonical plugins for Rust, Go, and Python under
plugins/ast/, as well as the the CI (ast-plugins.yml) that builds and publishes them — turning the WASM plugin machinery established by earlier PRs into usable, downloadable binaries.Plugins Added
syn) — actix/Rocket/axum routes; struct schemas; diesel/sea-orm/sqlx ORMs.ruff) — FastAPI/Flask/Django routes + Django urlpatterns; SQLAlchemy (declarative + classic)/Django/pydantic/SQLModel schemas + relations.go/parser) — Gin/Echo/Fiber/Chi + router groups + net/http (incl. Go 1.22 method patterns); GORM + Ent schemas.All plugins export the per-kind ABI including
describe(). The npm package neither buildsnor ships them (excluded from the
filesallowlist) — they are opt-in artifacts.Docs Updated
Adds a "Releases" section to the plugin contract (download/verify/install).
Reviewer Notes
Important
This PR still doesn't change anything about
codesight's default behavior or add anything that cannot be rolled back completely cleanly. That said, it does add what are essentially three completely new (if relatively small) codebases in two completely new languages to the repo.tl;dr merging this PR as-is is guaranteed not to break anything, but it still should not be merged without due consideration