Skip to content

chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 in /action#2

Open
dependabot[bot] wants to merge 561 commits intomainfrom
dependabot/npm_and_yarn/action/picomatch-4.0.4
Open

chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 in /action#2
dependabot[bot] wants to merge 561 commits intomainfrom
dependabot/npm_and_yarn/action/picomatch-4.0.4

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 26, 2026

Bumps picomatch from 4.0.3 to 4.0.4.

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…ol extraction

Both parseImports and extractSymbolNames were calling parseSource independently,
doubling tree-sitter WASM work per file. Now build.ts calls parseSource once
and passes the root to parseImportsAstFromRoot and extractSymbolNamesFromRoot.
…g, symbol dedup

- remove parse, read, write, wrap, skip from stop words; these are discriminative
  function-name stems where IDF suppression is better than hard-stopping
- restructure to BM25F with separate path and symbols fields; per-field avgdl
  prevents symbol-rich files from drowning out precise path matches; unified df
  avoids double-counting terms that appear in both fields
- deduplicate exportedNames + symbolNames before indexing to remove the bias toward
  exported symbols over unexported ones
- add DEBUG_BM25=1 env var for structured JSON scoring output
- add 9 new assertions: stop word removal, path vs symbol normalization, barrel file
  visibility, symbol name matching and offline scoring tests
…st run

Scans root dir for *.sample.*, *.example.*, *.template.* files and copies
them to their counterpart if missing. Covers .env.example, ormconfig.sample.json
and similar patterns common across many projects.
…mconfig, detect slow compile

- task-context.md: resolve script now writes per-file symbolNames (top 8)
  alongside each target path so the pre-flight agent can navigate directly
  to the right function without a broad search
- ormconfig filter: after clarte generate, strip non-SQLite entries from
  copied ormconfig.json to avoid DB-connection error loops on TypeORM
- slow compile detection: when `test` script contains a gulp/tsc compile step,
  the Development section appends a note pointing to `tsc --noEmit` for fast
  type checks
…mit hook

The on-prompt.mjs hook now tries graph BM25F first (path + AST symbol names,
per-field normalization, import expansion, co-change coupling) and falls back
to git commit history BM25 when no graph is available.

When graph targets are found the hook writes an enriched task-context.md with
per-file symbol hints, giving the pre-flight agent direct navigation without a
broad search pass.
…ompile step

When scripts.test chains a compile step (gulp, tsc, or a "compile" sub-script)
with &&, running check-tests.sh repeatedly would trigger a 60s+ build each time.
generateCheckTestsScript now returns null for these projects and the Development
section omits the directive entirely. Both checks use the same regex to stay in sync.

Also widens the slow-compile detection regex to match "compile" as a word (covers
`pnpm run compile && ...` in addition to bare `tsc` and `gulp`).
- CLAUDE.md now includes an imperative directive for Claude IDE users:
  "First action on every coding task: call Agent(subagent_type='clarte-pre-flight'..."
  This increases natural compliance so the gate fires less often.
- Shorten both deny messages from multi-line explanations to a single line,
  reducing visual noise when the gate does fire.
Two failure modes observed in practice:
1. Pre-flight Haiku spiraled to 36 tool uses due to a re-verification
   step that caused repeated file re-reads.
2. Main agent re-explored after pre-flight because the denial message
   only said "call pre-flight first" with no post-flight instruction.

- Tighten pre-flight steps to "read each file exactly once, no re-reads"
  and exit with UNCERTAIN instead of reading more files to resolve it.
- Update both gate denial messages to include "apply FILE/LINE blocks
  directly after pre-flight; for UNCERTAIN items read only those files."
- Remove post-pre-flight re-read blocking (was net negative: caused
  failed Edits due to whitespace mismatch, agent needs reads for Edit
  tool precondition)
- Rewrite pre-flight agent prompt: first-person framing, task-type
  detection (skip non-fixes), anti-ellipsis instruction, full function
  context in FUNCTION blocks
- Add description param to deny message template (prevents Invalid
  tool parameters error on Agent call)
- Extend fail-fast hook to catch repeated build/compile commands
  (BUILD_RE) in addition to test commands
- Add targeted test directive to check-tests.sh CLAUDE.md output
- Soften CLAUDE.md graph tools section (voluntary, not enforced)
- Remove unused PostToolUse hook and verified-files state tracking
Test file paths encode what they test (e.g. test/sqlite-query-runner.test.ts),
so they match queries that the source file's path alone might miss. Scores
transfer to the mapped source file at 0.6x, never overriding a higher direct
match.

Also extracts scoreBM25F helper in both resolve-targets.ts and the generated
hook script to eliminate duplication.
Generates .clarte/scripts/run-test.sh that handles the correct filter
flag per runner (mocha --grep, jest/vitest -t, pytest -k) and compiles
first when mocharc spec paths point to build directories.

Detection algorithm:
- Reads .mocharc.json spec/file paths for build/dist/compiled patterns
- Falls back to SLOW_COMPILE_RE on package.json test script
- Resolves compile command from package.json scripts (compile, build)
- Adds -- separator for package manager scripts, skips when already present

CLAUDE.md directive updated: check-tests.sh for full suite with summary,
run-test.sh for filtered runs. Addresses the 11 wasted test-execution
turns observed in the typeorm pre-flight benchmark.
Mocha's --grep treats the pattern as a regex. Test names containing
parentheses (e.g., "simple enum arrays (sqlite)") would match zero
tests because parens are interpreted as regex groups.

The generated run-test.sh now pipes the pattern through sed to escape
all regex metacharacters before passing to --grep. Uses a POSIX-
compliant bracket expression (] first) for portable sed.

Only applies to Mocha; jest -t, vitest -t and pytest -k are unaffected.
The pre-flight-gate (blocking Read/Grep/Glob until pre-flight runs) and
pre-agent (blocking non-pre-flight Agent calls) hooks add friction
without clear benefit. The CLAUDE.md directive already suggests running
the pre-flight agent; enforcement blocks legitimate file reads in the
host repo and forces workarounds via Bash.

Removes PRE_FLIGHT_GATE_SCRIPT, PRE_AGENT_SCRIPT and all related state
management (PRE_FLIGHT_DONE marker, session-start/prompt resets).
PreToolUse now has 1 hook (fail-fast) instead of 3.
The previous commit removed both the Read/Grep gate and the Agent gate.
The Read/Grep gate was correctly removed (it blocked legitimate reads in
the host repo). But the Agent gate serves a different purpose: it steers
the agent to run clarte-pre-flight before spawning Explore or other
subagents in target projects.

Without it, agents bypass the pre-flight and go straight to Explore,
losing the exact-edit-location context the pre-flight provides.
The agent was running pnpm compile then run-test.sh, which compiles
again. Changed wording from "handles compilation automatically" to
"compiles automatically - never run the compile step separately."
The pre-flight Sonnet subagent was making 47 tool calls (7 min) on
typeorm instead of the expected 5-10. It ignored "Read only, no Grep"
and "read each file once" rules, running 10+ Greps and re-reading
files 5 times.

Reworded constraints to be harder: explicit 10-call ceiling, bolded
tool restrictions, shorter preamble. Partial findings are acceptable;
47-call investigations are not.
… sections

New source modules for MCP server support: package filtering, CLI
directive formatting, behavioral section rendering and file-index
section rendering. Includes tests and call-graph fixtures.
17 experiment write-ups covering BM25 retrieval, content vs wrapper,
failure patterns, hook context injection, monorepo routing and more.
Adds docs/research.md as the consolidated research overview.
Delete one-off experiment scripts. Add .mcp.json and memory/ to
.gitignore. Add .nvmrc (node 24). Update README, CLAUDE.md,
clarte.md rules, fail-fast hook and real-world benchmark script.
Replace .cursor/rules/clarte.mdc generation with two files:
- .cursor/mcp.json pointing at the clarte MCP server (npx clarte --mcp)
- .cursor/agents/clarte-pre-flight.md mirroring the Claude pre-flight agent

Deletes cursor-rules.ts (366 lines) and its test file (326 lines).
Updates hooks, summary, refresh and generate tests accordingly.
Single source of truth in src/templates/pre-flight-agent.ts.
Both claude and cursor targets now write the agent file from the
same buildPreFlightAgent() function. Model bumped to sonnet for both.

Claude Code users now get .claude/agents/clarte-pre-flight.md
generated automatically (previously only Cursor users got it).
semantic-release-bot and others added 22 commits March 25, 2026 12:43
- Open with the problem (60% wasted turns) and install command
- Move case studies above the fold as immediate proof
- Compress research narrative into Confidence > Information
- Add "What Clarté is NOT" positioning section
- Move architecture and benchmarks after the value proposition
…sings

SQLite serializes the full result set as one JSON string in C/WASM,
transferred as a single value, then parsed by V8's optimized JSON.parse.
Restores 5ms hard ceiling in the perf test.
- Add "ELI5 (or maybe slightly more)" mechanism bridge between
  research narrative and differentiation section
- Fix "Not a code search tool" claim (clarte_find exists)
- Blockquote the key contrast line for visual prominence
- Collapse math formulas behind "Definitely not ELI5" toggles
  in all four Architecture stages
- Remove redundant Architecture preamble (now covered by ELI5)
At 500 files the absolute timing difference is ~0.5ms, well within
CI scheduler noise. Previous 1.2x tolerance caused flakes when the
runner was under load. 1.5x still catches real regressions (lean
becoming 2x+ slower) while absorbing jitter.
- Add explicit `types: ["node"]` to both tsconfigs (TS 6.0 removes
  @types auto-discovery)
- Remove `esModuleInterop: true` (now always enabled)
- Update README badge to 6.0
@huggingface/transformers pulls ~160 transitive deps (onnxruntime,
sharp, protobufjs). Document --omit=optional for users who only
need BM25F retrieval without semantic search (~30 packages).
At 500 files the timing difference is sub-millisecond. CI runner load
variance caused this test to fail on 3 of the last 5 runs despite
increasing tolerance from 1.05x to 1.5x. The absolute ceiling test
(lean < 5ms) already covers performance regression detection.
Updated README to clarify agent functionality and performance improvements.
…launch

Split the 1903-line extract-file-graph.ts into per-language modules
(extract-ts, extract-python, extract-go, extract-java, extract-rust)
with shared helpers for DRY:
- getEnclosingFunction: replaces 5 language-specific AST walkers
- isDuplicateSymbol: replaces 7 duplicated dedup patterns
- extractTypeUsagesFromNodes: replaces 3 duplicated extractors
- language-indexed primitive type sets

Additional polish:
- Extract LRUCache to src/core/lru-cache.ts (was embedded in symbol-resolution.ts)
- DRY adjacency list construction in graph-store.ts via pushEdge helper
- Make scoring functions pure in targets-resolve.ts (return new Maps)
- Remove unused _symbolIndex params from ghost detectors
- Strip 30+ unnecessary comments that restated the code
Bumps [picomatch](https://github.com/micromatch/picomatch) from 4.0.3 to 4.0.4.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from michaelabrt as a code owner March 26, 2026 15:02
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 26, 2026
@github-actions
Copy link
Copy Markdown

Clarté Architecture Review

✅ No architectural concerns.


Powered by Clarté

@michaelabrt michaelabrt force-pushed the main branch 3 times, most recently from 10d6df4 to fdbb271 Compare March 29, 2026 10:20
michaelabrt added a commit that referenced this pull request Mar 29, 2026
…eedback loop

P0 #1: Add third BM25F field (imports, weight 0.5) that tokenizes import
target paths and imported names from graph edges. Files now gain retrieval
signal from what they consume, resolving zero token overlap cases (3.2 form
validator, 3.3 AbstractSqliteDriver). Both resolve-targets.ts and the hook
copy in generate-hooks.ts are updated in sync.

P0 #2: Three-hook prediction logging system for data-driven parameter tuning.
On-prompt writes predictions.json, PostToolUse edit tracker records actual
edits, SessionStart compares previous session's predictions vs edits and
appends precision/recall to prediction-log.jsonl.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants