improvement(audits): eliminate repeated parsing and scans

[waleedlatif1]

Summary

• avoid full AST parsing for files that cannot contain audited behavior
• cache repeated source reads, globs, schema conversions, validators, and generated OpenAPI documents
• reuse installed executables directly and consolidate duplicate documentation passes

Type of Change

• Improvement

Testing

• bun run lint
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run check:audits
• node_modules/.bin/vitest run scripts/check-db-audit-candidates.test.ts scripts/check-egress-boundary.test.ts scripts/check-tool-request-boundary.test.ts scripts/check-icon-path-precision.test.ts

Checklist

• Synchronized with origin/staging
• Generated artifacts are current
• Full audit suite passes
• Added regression coverage for candidate scanners

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 1, 2026 6:50pm UTC

[waleedlatif1]

@greptile

[greptile-apps]

Greptile Summary

The PR improves audit performance by avoiding unnecessary parsing and caching repeated filesystem, schema, validation, executable-resolution, and OpenAPI generation work.

• Adds token-based candidate scans before expensive AST parsing.
• Reuses source reads, globs, parsed block configurations, validators, and generated documents.
• Consolidates duplicate documentation-generation passes and directly invokes installed executables.
• Aligns the SQL date-binding prefilter with downstream support for drizzle-orm/* imports and adds regression coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported Drizzle subpath audit gap is fixed by the shared module predicate and corresponding regression test.

Important Files Changed

Filename	Overview
scripts/check-sql-date-binding.ts	The candidate scanner now uses the same exact-or-subpath Drizzle module predicate as downstream binding analysis, resolving the previously reported gap.
scripts/check-db-audit-candidates.test.ts	Adds regression coverage for aliased, escaped, and subpath Drizzle imports as well as pending-table candidates.
scripts/check-tool-request-boundary.ts	Reuses parsed syntax trees and skips parsing files that cannot contain direct tool-request access.
scripts/generate-docs.ts	Caches repeated reads, globs, and block parsing while consolidating visible and documentation icon-map generation.
scripts/openapi/generator.ts	Reuses generated OpenAPI documents to eliminate duplicate generation work.

_{Reviews (3): Last reviewed commit: "fix(audits): include drizzle subpath imp..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@greptile