fix: escape LIKE wildcards in NodeQuery.fileFilter and nameLike by carlos-alm · Pull Request #446 · optave/codegraph

carlos-alm · 2026-03-16T06:29:50Z

Summary

NodeQuery.fileFilter() and nameLike() in query-builder.js now escape LIKE wildcards (_, %, \) before building the SQL pattern, matching the behavior of direct queries in nodes.js
Fixes parity gap where SQLite findNodesWithFanIn treated _ as a wildcard but the in-memory version treated it as literal (Greptile review comment on feat: Repository abstraction with InMemoryRepository (3.13) #444)
Deduplicates escapeLike — nodes.js now imports it from query-builder.js instead of defining its own copy
Pin native binary optionalDependencies to 3.1.4 (Closes bug: native binary optionalDependencies pinned to 3.1.3 after v3.1.4 release #454)
Add dogfood report for v3.1.4

Found during

Dogfooding v3.1.4 — native binary pin issue found as #454

Test plan

New fileFilter() and nameLike() escaping tests in query-builder.test.js verify _ is treated as literal
New findNodesWithFanIn parity test in repository-parity.test.js verifies both implementations reject _ as wildcard
All 1862 tests pass
Lint passes

…pyramid (3.13) Introduce a Repository base class, InMemoryRepository (Maps-backed, no SQLite), and SqliteRepository (delegates to existing fn(db,...) functions). Includes fluent TestRepoBuilder fixture factory and 105 new tests (51 unit + 54 parity) verifying behavioral equivalence between both implementations. Existing code and tests remain unchanged. Impact: 139 functions changed, 6 affected

- Add kind/role validation to InMemoryRepository.findNodesForTriage matching SqliteRepository behavior (throws ConfigError) - Optimize findIntraFileCallEdges sort with pre-built lookup map instead of spreading nodes Map per comparison - Remove dead #nameIndex field from TestRepoBuilder - Add validation parity tests for invalid kind/role Impact: 5 functions changed, 0 affected

Impact: 2 functions changed, 0 affected

…graph into feat/testing-pyramid

Move the duplicate-name guard before repo.addNode() so the repo is not mutated when a duplicate is detected. Impact: 2 functions changed, 0 affected

findNodesByScope, findNodeByQualifiedName, findNodesWithFanIn, listFunctionNodes, and findNodesForTriage all passed user-provided strings directly into likeToRegex without escaping % and _ chars. This caused divergence from SQLite which uses escapeLike + ESCAPE '\'. Also adds parity tests for findNodesByScope, findNodeByQualifiedName, findNodesWithFanIn, findFileNodes, findNodeChildren, import queries, getCallableNodes, getFileNodesAll, getImportEdges, and hasCfgTables. Impact: 7 functions changed, 5 affected

Impact: 9 functions changed, 14 affected

The in-memory noTests filter only checked .test. and .spec. patterns, missing __test__, __tests__, and .stories. that the SQLite query-builder excludes. Add the missing patterns to both findNodesForTriage and iterateFunctionNodes. Extend parity test fixtures with __tests__ and .stories. nodes so the divergence is caught automatically. Impact: 5 functions changed, 0 affected

fileFilter() and nameLike() in query-builder.js passed user input directly into LIKE patterns without escaping, so _ and % acted as wildcards instead of literals. This caused a parity gap where the SQLite findNodesWithFanIn treated _ as a wildcard but the in-memory version (which already called escapeLike) treated it as literal. Fix: add escapeLike() to query-builder.js (exported), use it in fileFilter() and nameLike() with ESCAPE '\', and deduplicate the copy in nodes.js by importing from query-builder.js.

carlos-alm · 2026-03-16T06:30:12Z

@greptileai

greptile-apps · 2026-03-16T06:33:43Z

Greptile Summary

This PR fixes a correctness bug where LIKE wildcards (_, %, \) in user-supplied search terms were not escaped before being interpolated into SQL LIKE patterns in NodeQuery.fileFilter() and nameLike(), causing characters like _ to act as single-character wildcards instead of literals. The fix centralises a canonical escapeLike helper in query-builder.js, updates both builder methods to use it with an ESCAPE '\\' clause, and eliminates duplicate private copies of the same function that previously existed independently in nodes.js and in-memory-repository.js.

escapeLike centralised — exported from query-builder.js; private copies removed from nodes.js and in-memory-repository.js, both of which now import the canonical version
fileFilter() and nameLike() now call escapeLike(value) before wrapping with %, and append ESCAPE '\\' to the SQL fragment so SQLite honours the backslash escape sequences
Parity gap closed — the in-memory findNodesWithFanIn already escaped opts.file via its private copy; the SQLite path now does the same via the updated fileFilter(), making both implementations consistent
Tests added — query-builder.test.js verifies _ is treated as a literal by both fileFilter() and nameLike(); repository-parity.test.js confirms the fix holds across both the SQLite and in-memory repositories
Native binary pins corrected — all six optionalDependencies bumped from 3.1.3 to 3.1.4 in package.json and package-lock.json, resolving bug: native binary optionalDependencies pinned to 3.1.3 after v3.1.4 release #454 found during dogfooding

Confidence Score: 5/5

Safe to merge — the fix is correct, well-tested, and introduces no regressions.
The escapeLike implementation correctly escapes %, _, and \; the ESCAPE '\\' clause in JS produces the single-backslash SQL string ESCAPE '\' that SQLite expects; likeToRegex in the in-memory path correctly interprets the same backslash-escape sequences; and the two new test suites verify both the SQL builder and the cross-implementation parity. The package-version bump is mechanical and matches the lock file. No unrelated files are touched and all 1862 tests pass per the PR description.
No files require special attention.

Important Files Changed

Filename	Overview
src/db/query-builder.js	Canonical `escapeLike` export added; `fileFilter()` and `nameLike()` now escape wildcards and include `ESCAPE '\\'` clause — implementation is correct and consistent.
src/db/repository/nodes.js	Private `escapeLike` removed; now imports canonical version from `query-builder.js`. `findNodesWithFanIn` delegates `opts.file` to `fileFilter()` which now escapes correctly.
src/db/repository/in-memory-repository.js	Private `escapeLike` removed; imports from `query-builder.js`. `findNodesWithFanIn` correctly uses `escapeLike(opts.file)` before `likeToRegex`, achieving parity with the SQLite implementation.
tests/unit/query-builder.test.js	New tests verify `fileFilter()` and `nameLike()` treat `_` as literal; existing chain test updated to assert the `ESCAPE '\\'` clause is present in built SQL.
tests/unit/repository-parity.test.js	New parity test confirms both SQLite and in-memory `findNodesWithFanIn` treat `_` as a literal character in `opts.file`, closing the previously-reported parity gap.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["User input\n(e.g. '_oo.js')"] --> B["escapeLike()\nquery-builder.js\nexport"]

    B --> C["'_oo.js' → '\\_oo.js'"]

    C --> D1["NodeQuery.fileFilter()\n'%\\_oo.js%'"]
    C --> D2["NodeQuery.nameLike()\n'%\\_oo.js%'"]
    C --> D3["InMemoryRepository\nfindNodesWithFanIn()\n likeToRegex('%\\_oo.js%')"]

    D1 --> E1["SQL: n.file LIKE ? ESCAPE '\\'"]
    D2 --> E2["SQL: n.name LIKE ? ESCAPE '\\'"]
    D3 --> E3["RegExp: /^.*_oo\\.js.*$/i\n(via likeToRegex)"]

    E1 --> F["SQLite: '_' treated as literal ✓"]
    E2 --> F
    E3 --> G["In-memory: '_' treated as literal ✓"]

    style B fill:#4caf50,color:#fff
    style F fill:#2196f3,color:#fff
    style G fill:#2196f3,color:#fff

_{Last reviewed commit: 2cf64b5}

greptile-apps · 2026-03-16T06:33:46Z

src/db/repository/in-memory-repository.js

+ * Escape LIKE special characters so they are treated as literals.
+ * Mirrors the `escapeLike` function in `nodes.js`.
+ * @param {string} s
+ * @returns {string}
+ */
+function escapeLike(s) {
+  return s.replace(/[%_\\]/g, '\\$&');
+}


Stale JSDoc and duplicate escapeLike

The JSDoc says "Mirrors the escapeLike function in nodes.js", but nodes.js no longer defines its own escapeLike — this PR moved the canonical copy to query-builder.js. The comment is now stale.

More broadly, the PR description states it "Deduplicates escapeLike" by having nodes.js import from query-builder.js, yet this file defines a third private copy. Consider importing the canonical export instead to complete the deduplication:

Suggested change

* Escape LIKE special characters so they are treated as literals.

* Mirrors the `escapeLike` function in `nodes.js`.

* @param {string} s

* @returns {string}

*/

function escapeLike(s) {

return s.replace(/[%_\\]/g, '\\$&');

}

import { escapeLike } from '../query-builder.js';

Fixed — removed the private escapeLike copy and now importing it from query-builder.js. All 183 related tests pass.

Already addressed in the current state of the PR: in-memory-repository.js imports escapeLike from the canonical ../query-builder.js (line 3) — there is no duplicate definition and no stale JSDoc referencing nodes.js. The deduplication is complete.

carlos-alm · 2026-03-16T06:36:08Z

@greptileai

Closes #454

…ile-444

carlos-alm · 2026-03-16T07:33:23Z

@greptileai

carlos-alm added 14 commits March 14, 2026 13:59

Merge branch 'main' into feat/testing-pyramid

afd5224

fix: throw on duplicate node names in TestRepoBuilder.build()

1ac56af

Impact: 2 functions changed, 0 affected

style: format duplicate-name error for biome line length

65230c6

Impact: 2 functions changed, 0 affected

Merge branch 'feat/testing-pyramid' of https://github.com/optave/code…

522ea8b

…graph into feat/testing-pyramid

fix: check for duplicate names before adding node to repo

31ebeac

Move the duplicate-name guard before repo.addNode() so the repo is not mutated when a duplicate is detected. Impact: 2 functions changed, 0 affected

style: format repository-parity test file

e00fe4d

Merge remote-tracking branch 'origin/main' into feat/testing-pyramid

6283c84

Impact: 9 functions changed, 14 affected

Merge branch 'main' into feat/testing-pyramid

02b9bb2

Merge branch 'main' into feat/testing-pyramid

016171b

greptile-apps bot reviewed Mar 16, 2026

View reviewed changes

fix: import escapeLike from query-builder instead of duplicating it

af036e6

carlos-alm added 6 commits March 16, 2026 00:40

Merge remote-tracking branch 'origin/main' into fix/greptile-444

fd8a73c

Merge branch 'main' into fix/greptile-444

fe9615c

Merge remote-tracking branch 'origin/main' into fix/greptile-444

f2d56f4

fix(deps): pin native binaries to 3.1.4 in optionalDependencies

7b604c7

Closes #454

docs: add dogfood report for v3.1.4

36ffc3b

Merge remote-tracking branch 'origin/fix/greptile-444' into fix/grept…

2cf64b5

…ile-444

Merge branch 'main' into fix/greptile-444

0c388ed

carlos-alm merged commit 2fa6e1f into main Mar 16, 2026
13 checks passed

carlos-alm deleted the fix/greptile-444 branch March 16, 2026 07:40

github-actions bot locked and limited conversation to collaborators Mar 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: escape LIKE wildcards in NodeQuery.fileFilter and nameLike#446

fix: escape LIKE wildcards in NodeQuery.fileFilter and nameLike#446
carlos-alm merged 22 commits intomainfrom
fix/greptile-444

carlos-alm commented Mar 16, 2026 •

edited

Loading

Uh oh!

carlos-alm commented Mar 16, 2026

Uh oh!

greptile-apps bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

greptile-apps bot Mar 16, 2026

Uh oh!

carlos-alm Mar 16, 2026

Uh oh!

carlos-alm Mar 16, 2026

Uh oh!

carlos-alm commented Mar 16, 2026

Uh oh!

carlos-alm commented Mar 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

carlos-alm commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Found during

Test plan

Uh oh!

carlos-alm commented Mar 16, 2026

Uh oh!

greptile-apps bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps bot Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

carlos-alm Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

carlos-alm Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

carlos-alm commented Mar 16, 2026

Uh oh!

carlos-alm commented Mar 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

carlos-alm commented Mar 16, 2026 •

edited

Loading

greptile-apps bot commented Mar 16, 2026 •

edited

Loading