Claude finished @carlos-alm's task —— View job

PR Review — fix(deps): remove malicious tree-sitter-erlang, fix 3 moderate vulns

• Gather context and read changed files
• Phase 1: Root cause analysis
• Phase 2: Configuration change detection
• Phase 3: Test integrity
• Phase 4: Code quality
• Phase 5: Backlog compliance
• Post final review

Root Cause Analysis

Problem Being Solved: tree-sitter-erlang (pinned to github:WhatsApp/tree-sitter-erlang) was flagged as malware under GHSA-rphw-c8qj-jv84 (CWE-506). Three transitive moderate vulnerabilities also needed patching: hono, protobufjs, and qs.

Why This Approach: Removing the devDependency entirely (rather than swapping the source) is the correct call — the advisory covers all versions by package name so any npm install would re-fetch the flagged package. npm audit fix for the three moderate vulns is the standard remediation. Both are sound.

Risk Assessment: Medium — the approach is correct, but the PR contains a factually inaccurate claim about the Erlang WASM file's status, and the comment in build-wasm.ts encodes that incorrect claim into the codebase. The actual Erlang WASM availability at runtime is not addressed by this PR. See critical concern below.

Phase 2: Configuration Change Detection

No lint rules relaxed. No test timeouts changed. No TypeScript strict flags modified. No biome configuration altered. Clean pass.

Phase 3: Test Integrity

No test files modified. The PR description references 12 pre-existing Erlang failures (filed as #1477) and correctly states they are unrelated. No assertions weakened. Clean pass.

Phase 4: Code Quality

package.json — single line removed, correct.

package-lock.json — removal of tree-sitter-erlang and its pinned subtree (node-addon-api@7.1.1, tree-sitter-cli@0.23.2, prettier@2.8.8). The three transitive bumps (hono@4.12.25, protobufjs@7.6.3, qs via @modelcontextprotocol/sdk) look correct. The libc field removals for the @optave/codegraph-linux-* optional packages appear to be an artifact of npm install re-serializing the lockfile — no functional impact, but worth noting as unexplained noise.

scripts/build-wasm.ts:214-217 — CRITICAL ISSUE. The comment reads:

"The grammar WASM is committed in grammars/ and was validated clean."

This is factually wrong. .gitignore line 8 is grammars/*.wasm — WASM files are explicitly excluded from the repository. Confirmed: git show HEAD:grammars/tree-sitter-erlang.wasm returns fatal: path does not exist in 'HEAD', and the file is absent from the working tree in this checkout.

The comment will mislead future contributors into believing the WASM is present when it is not. If the Erlang grammar was truly pre-validated and committed, the .gitignore would need a !grammars/tree-sitter-erlang.wasm exception — but no such exception was added, and no WASM binary is tracked in git history.

This means Erlang grammar support is not preserved at runtime — users running with --engine wasm on a clean checkout will have no Erlang WASM available. The PR description's claim that "Erlang grammar support is unaffected" needs verification.

Phase 5: Backlog Compliance

• Zero-dep: ✓ — removes a devDependency, adds nothing new
• Foundation-aligned: ✓ — no new cloud APIs, no external services, no agent behavior
• Problem-fit: 2 — security hygiene fix, does not reduce token waste or improve AI navigation. Necessary but tangential to the core product problem.
• Breaking: No — no CLI output changes, no API signature changes, no DB schema changes. Erlang parsing may silently degrade for WASM engine users (pre-existing behavior since WASM files aren't committed anyway).
• Tier: 1

Critical Concerns

1. Inaccurate claim encoded in source code — scripts/build-wasm.ts:214-217

The comment "The grammar WASM is committed in grammars/ and was validated clean" is false:

• .gitignore:8 excludes all grammars/*.wasm files
• grammars/tree-sitter-erlang.wasm does not exist in HEAD or anywhere in git history
• No !grammars/tree-sitter-erlang.wasm gitignore exception was added

Per the repo guidelines: "Never document bugs as expected behavior" and "Never fabricate facts." Encoding a false claim into a source comment violates both principles and will mislead future maintainers.

Required fix: Either:

• (a) Actually commit the validated WASM by adding !grammars/tree-sitter-erlang.wasm to .gitignore and tracking the file, or
• (b) Correct the comment to truthfully state the WASM is not committed: e.g. "The Erlang WASM is not in the repo (grammars/ is gitignored). To get Erlang support, manually install github:the-mikedavis/tree-sitter-erlang, add this entry back, run build:wasm, validate, then copy the WASM to grammars/ and add a gitignore exception."

2. PR description claim vs. reality

The PR description states "grammars/tree-sitter-erlang.wasm present and WASM-validated (correct export, no disallowed imports)" as a checked test-plan item. This cannot be verified from the committed state — the file is not in the repo. The validation may have been done locally on the author's machine, which is fine, but the description implies it persists in the repo.

Final Recommendation

• Rating: ⭐⭐⭐☆☆ (3/5)
• Action: REQUEST CHANGES
• Reasoning: The security remediation approach (drop the malicious dep, npm audit fix the three moderate vulns) is correct and the lockfile changes look sound. However, the comment added to build-wasm.ts contains a false factual claim that will mislead future maintainers. This must be corrected before merge — either commit the WASM file with a proper gitignore exception, or reword the comment to accurately describe the state.

Greptile Summary

This PR removes the malicious tree-sitter-erlang npm package (GHSA-rphw-c8qj-jv84 / CWE-506) and runs npm audit fix to patch three moderate transitive vulnerabilities (hono, protobufjs → 7.6.3, qs). All downstream effects are handled cleanly: the WASM build entry is commented out with restoration instructions, the grammar parity-check list is trimmed, Erlang parser tests skip gracefully when the WASM is absent, and benchmark regression exemptions document the expected precision/recall drop.

• Removes tree-sitter-erlang from package.json, scripts/build-wasm.ts, and scripts/check-grammar-versions.mjs; the package-lock.json libc field reordering for @optave/codegraph-linux-* entries is cosmetic only (data preserved).
• tests/parsers/erlang.test.ts uses Vitest's ctx.skip() pattern to gracefully bypass all 13 test cases when the WASM is unavailable; tests/benchmarks/regression-guard.test.ts explicitly exempts the erlang precision/recall drop from the 3.12.0 baseline.

Confidence Score: 5/5

Safe to merge — all blast-radius from the removal is accounted for across build scripts, version checks, parser tests, and benchmark baselines.

The malicious package is removed cleanly with no dangling references. The libc field reordering in the lockfile is cosmetic. Every downstream consumer (build script, grammar checker, parser tests, regression guard) is updated consistently. No production code paths are affected; Erlang was dev-only for WASM compilation.

The restoration comment in scripts/build-wasm.ts omits the step to re-add tree-sitter-erlang to scripts/check-grammar-versions.mjs — a minor gap that could cause a silent parity-check miss when Erlang support is eventually restored.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[GHSA-rphw-c8qj-jv84\nmalicious tree-sitter-erlang] -->|removed from| B[package.json\ndevDependencies]
    B --> C[package-lock.json\nnpm audit fix]
    C --> D[hono bumped\nprotobufjs → 7.6.3\nqs bumped]
    B --> E[scripts/build-wasm.ts\ngrammar entry commented out\nwith restoration steps]
    B --> F[scripts/check-grammar-versions.mjs\nerlang removed from parity list]
    E --> G[Erlang WASM unavailable]
    G --> H[tests/parsers/erlang.test.ts\nctx.skip when WASM absent]
    G --> I[tests/benchmarks/regression-guard.test.ts\n3.12.0 erlang precision/recall\nexempted in KNOWN_REGRESSIONS]

Reviews (6): Last reviewed commit: "fix(test): use ctx.skip() for explicit v..." | Re-trigger Greptile

Addressed all review feedback:

Claude review — critical concern:

• Fixed the false comment in scripts/build-wasm.ts that claimed the Erlang WASM was committed in grammars/. The WASM is gitignored and not in the repository. The comment now accurately describes the situation and provides complete step-by-step restoration instructions.
• Updated the PR description to remove the inaccurate 'grammars/tree-sitter-erlang.wasm present' test plan claim.

Greptile review — P2 comments:

• package-lock.json libc fields: Restored the libc discriminator fields for @optave/codegraph-linux-arm64-gnu (glibc), @optave/codegraph-linux-x64-gnu (glibc), and @optave/codegraph-linux-x64-musl (musl). These were stripped by npm on macOS during the audit fix run. The libc discriminator CI check now passes.
• protobufjs version mismatch: Updated the PR description to reflect the actual resolved version (7.6.3, not 7.5.8 as originally stated).

CI failures fixed (5 commits):

1. fix(lock): libc discriminators restored — unblocks Lint/Verify lockfile libc discriminators
2. fix(ci): tree-sitter-erlang removed from grammar version parity check — unblocks Grammar version parity
3. fix(tests): erlang parser tests skip gracefully when WASM unavailable — unblocks Test Node 22 (ubuntu/macos/windows)
4. fix(benchmarks): erlang resolution regression exempted in KNOWN_REGRESSIONS — unblocks Pre-publish benchmark gate
5. fix(docs): build-wasm.ts comment corrected

@greptileai

@claude

Claude finished @carlos-alm's task —— View job

Re-review — fix(deps): remove malicious tree-sitter-erlang, fix 3 moderate vulns

• Gather context and read changed files
• Verify build-wasm.ts comment fix
• Verify libc fields restoration in package-lock.json
• Verify test changes (erlang skip, regression guard)
• Post final review

Review Update

All concerns from the previous review have been addressed. Here's the verification:

Critical concern resolved — scripts/build-wasm.ts:214-222

The false comment is now accurate. It correctly states:

• The devDependency was removed due to malware (GHSA-rphw-c8qj-jv84)
• grammars/*.wasm is gitignored, so the Erlang WASM is not in the repository
• Erlang parsing is unavailable in the WASM engine until a clean replacement is integrated
• Clear step-by-step restoration instructions using github:the-mikedavis/tree-sitter-erlang

This is factually accurate and will not mislead future maintainers.

Greptile P2 concerns resolved

libc fields — Verified restored in package-lock.json for all three @optave/codegraph-linux-* entries:

• @optave/codegraph-linux-arm64-gnu → "libc": ["glibc"] ✓
• @optave/codegraph-linux-x64-gnu → "libc": ["glibc"] ✓
• @optave/codegraph-linux-x64-musl → "libc": ["musl"] ✓

Test integrity

tests/parsers/erlang.test.ts — All 13 test cases use if (!erlangAvailable) return; to skip gracefully when the WASM is absent. The suite structure is preserved for when the grammar is restored. Clean.

tests/benchmarks/regression-guard.test.ts:314-320 — Erlang exemptions added with a clear comment referencing the malware advisory:

'3.12.0:resolution erlang precision'
'3.12.0:resolution erlang recall'

The exemption is correctly anchored to 3.12.0 (the baseline where the drop will first appear) so it covers all subsequent dev vs 3.12.0 comparisons until a clean replacement is integrated.

scripts/check-grammar-versions.mjs — tree-sitter-erlang removed from the parity check list. No entry in package.json to compare against.

CI status

CI runs are in progress (triggered by the latest push). The previous round of CI fixes was clearly comprehensive — 5 distinct commits resolving each category of failure. No new concerns surfaced in the file review.

Verdict

All critical and P2 concerns addressed. The security remediation is correct and complete:

• Malicious dep removed
• Three transitive vulns patched via npm audit fix
• libc discriminators restored
• Tests updated to skip/exempt gracefully
• Source comment accurately describes the state

Rating: ⭐⭐⭐⭐⭐ (5/5) — Approved

Addressed Greptile's suggestion about ctx.skip(): updated all 14 test cases in tests/parsers/erlang.test.ts to use return ctx.skip() instead of bare early returns. Vitest will now report these tests as explicitly skipped (rather than silently passing) when the Erlang WASM is unavailable.

@greptileai